6/22/2020 Configuration Management System (CMS)

Configuration Management System (CMS)

For the Windows and Redhat Enterprise Linux operating systems

Software Version: 2020.05

Customized output from:

Document Release Date: May 2020

Software Release Date: May 2020

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 1/75
6/22/2020 Configuration Management System (CMS)

Legal Notices

Warranty
The only warranties for products and services of Micro Focus and its affiliates and licensors (“Micro Focus”) are set forth
in the express warranty statements accompanying such products and services. Nothing herein should be construed as
constituting an additional warranty. Micro Focus shall not be liable for technical or editorial errors or omissions contained
herein. The information contained herein is subject to change without notice.

Restricted Rights Legend

Confidential computer software. Except as specifically indicated otherwise, a valid license from Micro Focus is required for
possession, use or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer
Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's
standard commercial license.

Disclaimer
Certain versions of software and/or documents (“Material”) accessible here may contain branding from Hewlett-Packard
Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered
by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard
Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of
their respective owners.

Copyright Notice
© 2011 - 2020 Micro Focus or one of its affiliates.

Trademark Notices
MICRO FOCUS and the Micro Focus logo, among others, are trademarks or registered trademarks of Micro Focus (IP)
Limited or its subsidiaries in the United Kingdom, United States and other countries. All other marks are the property of
their respective owners.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 2/75
6/22/2020 Configuration Management System (CMS)

Adobe™ is a trademark of Adobe Systems Incorporated.

Microsoft® and Windows® are U.S. registered trademarks of Microsoft Corporation.

UNIX® is a registered trademark of The Open Group.

Documentation Updates
To check for recent updates or to verify that you are using the most recent edition of a document, go to:
https://softwaresupport.softwaregrp.com.

This site requires that you register for a Software Passport and to sign in. To register for a Software Passport ID, click
Register for Software Passport on the Micro Focus Support website at https://softwaresupport.softwaregrp.com.

You will also receive updated or new editions if you subscribe to the appropriate product support service. Contact your
Micro Focus sales representative for details.

Support
Visit the Micro Focus Support site at: https://softwaresupport.softwaregrp.com.

This website provides contact information and details about the products, services, and support that Micro Focus offers.

Micro Focus online support provides customer self-solve capabilities. It provides a fast and efficient way to access
interactive technical support tools needed to manage your business. As a valued support customer, you can benefit by
using the support website to:

Search for knowledge documents of interest

Submit and track support cases and enhancement requests
Download software patches
Manage support contracts
Look up Micro Focus support contacts
Review information about available services
Enter into discussions with other software customers
Research and register for software training

Most of the support areas require that you register as a Software Passport user and to sign in. Many also require a
support contract. To register for a Software Passport ID, click Register for Software Passport on the Micro Focus
Support website at https://softwaresupport.softwaregrp.com.

To find more information about access levels, go to:

https://softwaresupport.softwaregrp.com/web/softwaresupport/access-levels.

Integration Catalog accesses the Micro Focus Integration Catalog website. This site enables you to explore Micro Focus
Product Solutions to meet your business needs, includes a full list of Integrations between Micro Focus Products, as well
as a listing of ITIL Processes. The URL for this website is https://softwaresupport.softwaregrp.com/km/KM01702731.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 3/75
6/22/2020 Configuration Management System (CMS)

Check your selections

The following steps are customized according to your selections. Check that your selections are correct.

UCMDB with Universal Discovery

Upgrade to UCMDB 2020.05

Windows platform

MS-SQL
High availability environment

Welcome to the CMS Deployment Guide

This guide references the following sections in the CMS Online Help:

Support Matrix section

Database section

Hardening section

Administer section
Modeling section

Data Flow Management section

Backup and Recovery section

Upgrading UCMDB - Introduction

The instructions that follow explain how to upgrade UCMDB 10.3x, 11.0, 2018.05 (or later) to UCMDB 2020.05.

Important: One-hop upgrade from a CMS version 10.22 (with or without a CUP) environment to version 2019.11
is supported on UCMDB server, then you can upgrade to version 2020.05. .

The table below describes supported upgrade paths for the CMS products:

Supported Upgrade Paths

Supported Upgrade Paths CMS product supporting upgrades

UCMDB Data Flow Probe CMS UI Standalone

2020.05 2020.05 2020.05 [3]

10.2x (with or without a CUP) → 2020.05 No No No

10.2x FIPS → 2020.05[2] No No No

10.22 (with or without a CUP) → 2019.11 Yes No No

→ 2020.05[5]

10.2x FIPS → 2019.11 → 2020.05[2] No No No

10.3x → 2020.05 Yes Yes [1] Yes

10.3x FIPS → 2020.05[1] No No No

11.0 → 2020.05 Yes Yes [1] Yes

2018.05 → 2020.05 Yes Yes [1] Yes

2018.08 → 2020.05 Yes Yes [1] Yes

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 4/75
6/22/2020 Configuration Management System (CMS)

Supported Upgrade Paths CMS product supporting upgrades

UCMDB Data Flow Probe CMS UI Standalone

2020.05 2020.05 2020.05 [3]

2018.11 → 2020.05 Yes Yes [1] Yes

2018.11 FIPS → 2020.05 FIPS Yes Yes [1] Yes

2019.02 → 2020.05 Yes Yes [1] Yes

2019.02 FIPS → 2020.05 FIPS Yes Yes [1] Yes

2019.05 → 2020.05 Yes Yes [1] Yes

2019.05 FIPS → 2020.05 FIPS Yes Yes [1] Yes

2019.11 → 2020.05 Yes Yes [1] Yes

2019.11 FIPS → 2020.05 FIPS Yes Yes [1] Yes

2020.05 full installer Yes Yes Yes

2020.05 → 2020.05 FIPS [1] Yes Yes Yes

Note:

1. Automatic upgrade of Data Flow Probe to version 2020.05 is supported on Windows platform only. For details, see Data Flow Probe Upgrade

Overview.

Note that automatic upgrade of Data Flow Probe to version 2020.05 is not applicable to the following:

FIPS mode probes

Separate mode probes

Probes on Linux machine

Integration service

Two probes installed on a same Windows machine

2. Version 2020.05 supports FIPS mode. You can upgrade version 2018.11 (or later) in FIPS mode to 2020.05 FIPS. However, upgrading from

version 10.3x in FIPS mode is not supported. You need to upgrade a non-FIPS mode UCMDB server of an earlier version to version 2020.05, and

then switch the upgraded UCMDB server to FIPS mode. For details about FIPS deployment, see FIPS Deployment.

3. Before upgrading UCMDB Browser version 11.0 (or earlier) or CMS UI 2018.05 (and later) to CMS UI version 2020.05, make sure you have

already upgraded UCMDB server to version 2020.05.

4. Version 2020.05 of the Configuration Management System does not include a new release for UCMDB Configuration Manager (CM), and it does

not work with CM version 2018.11 or any earlier version. However, you can use the new Policy Management capability introduced in the Query

Designer module of CMS UI. For version compatibility between previous versions, see Configuration Manager compatibility with UCMDB Server.

5. One-hop upgrade from a CMS version 10.22 (with or without a CUP) environment to version 2019.11 is supported on UCMDB server, then you can

upgrade to version 2020.05.

6. Downgrade of any of the above products is not supported.

Note:

Please read through the entire procedure that follows before commencing the upgrade process.

Upgrading UCMDB to version 2020.05 may take several hours.

You can follow the progress of the upgrade in the following log files (located in the
C:\UCMDB\UCMDBServer\runtime\log folder):

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 5/75
6/22/2020 Configuration Management System (CMS)

servicepack.install.log
upgrade.short.log

upgrade.detailed.log

The minimum supported UCMDB Discovery and Integrations Content Pack version for UCMDB 2020.05 is
Content Pack 27.00. However, it is recommended that you deploy the latest content pack. You can choose to
do so if you want to deploy the latest content pack during the upgrading process.

Important:

Before the upgrade, make sure that all Data Flow Probe related command line windows and probe related
folders are closed. Otherwise when the probe auto upgrade agent backs up probe folders, backing up of those
files may fail as they are occupied.

When you perform a fresh install of UCMDB 2020.05 or upgrade UCMDB to version 2020.05, by default there
are no composite indexes with the CMDB_ID as a key column in Oracle database (ROOT tables) or Microsoft
SQL databases (ROOT and CDM tables). This is an optimization introduced in version 10.30. While it
increases the speed of data-in, the data consumption becomes slower.
The default UCMDB server installation directory is <UCMDB_Server_InstallDir>. Examples:

If you upgrade UCMDB from version 10.3x, the default UCMDB server installation directory is
C:\hp\UCMDB\UCMDBServer.
If you upgrade UCMDB from version 11.0 (or later), the default UCMDB server installation directory is
C:\UCMDB\UCMDBServer.

Caution: If you have defined LDAP servers in your system, before upgrading from version 10.3x to version
2020.05, make sure you mark the LDAP settings as sensitive, then change the master key, and then proceed with
the upgrade.

For details, see How to Mark Sensitive Settings and Enable Storing Encrypted Data in the Database Using JMX
and How to Set Master Keys.

Upgrading UCMDB - Best Practices

The following diagram may help you understand the overall UCMDB server and Data Flow Probes upgrade
process:

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 6/75
6/22/2020 Configuration Management System (CMS)

It is recommended that you back up your original environment (UCMDB Server and database) prior to upgrading
your environment.

It is recommended, prior to upgrading your environment, to clone your original environment (UCMDB Server and
database) to a new environment and perform the upgrade on the cloned environment. This way, the original server
can continue to be up and running during the upgrade procedure. Performing the upgrade on a cloned database
also enables you to deal with upgrade issues while not affecting the down time of the original server.

Once everything is up and running on the upgraded cloned environment, you can upgrade the original Server, and
then connect it to the database on the upgraded cloned environment.

In summary:

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 7/75
6/22/2020 Configuration Management System (CMS)

a. Clone the original (current) environment.

Note: It is strongly recommended, after the database schema has been cloned, not to make any changes
on the original environment as those changes will not be migrated to the upgraded environment.

b. Upgrade the cloned environment to 2020.05.

c. Once everything is up and running on the upgraded cloned environment, disconnect the original Server and
database, and uninstall the UCMDB Server from the original machine.
d. Disconnect the Server and the database on the upgraded cloned environment.

e. Install UCMDB 2020.05 on the original machine, connecting it to the cloned 2020.05 database.

Upgrading UCMDB - Save Modified Integration (Federation) Adapters

For all out-of-the-box adapters: If you modified adapter configurations in your current version, it is strongly
recommended that you save all adapter files before starting the upgrade. After the upgrade, you will need to make the
same changes to the relevant adapters.

For example, if you have an adapter default template, copy aside the relevant part of the adapter XML (the tag
“<adapterTemplates>”). After the upgrade, you will copy this tag back to the XML of the relevant adapter.

Note: All adapters must be compatible with the new Universal Data Model. If you made changes to existing out-
of-the-box adapters, you must make the same changes to the adapter files in version 2020.05.

Upgrading UCMDB - Save the Encryption Key

UCMDB uses the encryption key to encrypt credential information and to send sensitive credential information to the
Data Flow Probes. For security reasons, this encryption key is stored on the file system, and not in the database.

Back up the encryption key that is on the UCMDB Server. The encryption key is located in:

C:\hp\UCMDB\UCMDBServer\conf\discovery\key.bin (version 10.3x)

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 8/75
6/22/2020 Configuration Management System (CMS)

C:\UCMDB\UCMDBServer\conf\discovery\key.bin (version 11.0 or later)

Note: When upgrading UCMDB to version 2020.05 on the same machine, the original file remains on the
machine, and the backup is necessary in case the file is lost during the process.

When upgrading UCMDB to version 2020.05 on a clean machine, this file does not exist on the new machine and
must be copied to the new machine after installing UCMDB on the clean machine.

Upgrading UCMDB - Back up the Secure Keystore

Back up the following folder:

C:\hp\UCMDB\UCMDBServer\conf\security (version 10.3x)

C:\UCMDB\UCMDBServer\conf\security (version 11.0 or later)

Upgrading UCMDB - Save JMX Hardening Configuration

If the Java JMX access hardening was performed:

1. Edit the file permissions for the following file, so that the user you are logged in with can edit it:

C:\hp\UCMDB\UCMDBServer\bin\jre\lib\management\jmxremote.password (version 10.3x)

C:\UCMDB\UCMDBServer\bin\jre\lib\management\jmxremote.password (version 11.0 or later)

2. Save the file outside of the UCMDB installation folder.

Upgrading UCMDB - Uninstall the Data Flow Probes

To uninstall a Data Flow Probe:

Windows Note: The probe auto upgrade mechanism supports upgrading Data Flow Probes on Windows
directly for versions 10.3x (with or without a CUP) and later (union and non-FIPS mode). Only for
probes of unsupported versions, you need to uninstall the old version and then install the latest
version manually.

On the machine where the Probe is installed:

1. Stop the Probe: Start > All Programs > (HP) UCMDB > Stop Data Flow Probe
2. Uninstall the Probe: Start > All Programs >(HP) UCMDB > Uninstall Data Flow Probe. When the
Probe has finished being uninstalled, delete the folder that contained the Probe:
Version 10.3x: C:\hp\UCMDB\DataFlowProbe
Version 11.0 or later: C:\UCMDB\DataFlowProbe

Linux On the machine where the Probe is installed:

1. Stop the Probe:

Version 10.3x: /opt/hp/UCMDB/DataFlowProbe/bin/ProbeGateway.sh stop
Version 11.0 or later: /opt/UCMDB/DataFlowProbe/bin/ProbeGateway.sh stop
2. Uninstall the Probe. Do one of the following:
In shell, execute:
Version 10.3x: sh
/opt/hp/UCMDB/DataFlowProbe/UninstallerData/Uninstall_Discovery_Probe
Version 11.0 or later: sh
/opt/UCMDB/DataFlowProbe/UninstallerData/Uninstall_Discovery_Probe

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 9/75
6/22/2020 Configuration Management System (CMS)

Double-click the Uninstall_Discovery_Probe file in the file system.

Delete the /opt/hp/UCMDB/DataFlowProbe/ folder (for Version 10.3x) or
/opt/UCMDB/DataFlowProbe/ (for version 11.0 or later).

Upgrading UCMDB - Upgrade the Server

Caution:

Apart from the out-of-the-box (OOTB) files, DO NOT ADD any additional resources into the
<UCMDB_Server_Home>\deploy directory. Because UCMDB will try to deploy every file from this location,
which may cause the ucmdb-browser.war file not deployed completely, and as a result the UCMDB Browser
will fail to start.

Close all UCMDB server folders and files before the upgrade, and DO NOT open or access any of those
folders and files during the upgrade.

During the upgrade, UCMDB server folders and files will be modified or overwritten by the installer wizard.
Opening or accessing (for example, access through command) any of those folders or files during the upgrade
may result in upgrade failure.

In case of such upgrade failure, to restore the server, copy the entire content of the
C:\UCMDB\UCMDBServer\old folder into the C:\UCMDB\UCMDBServer folder. Then you can continue to
use the server or to perform another upgrade.

If you need to merge the customized changes of scripts you made in UCMDB with the new scripts included in
Content Pack 2020.05, before you proceed with the upgrade, check and make sure the infrastructure settings
Merge Packages/Content Pack and Merge Discovery Scripts are already set to True. Otherwise the default
setting will simply overwrite content and NOT perform any merges. For more information, see Compare and
Merge Packages or Content Packs.

Note: The following settings are backed up during the server upgrade, and restored after the upgrade:

All customized settings, which are saved to the settings.override.properties file

Oracle Advanced Security Option (ASO) settings

In case you want to check those settings, you can go to the <UCMDBServer>\old\conf folder. Backup copy of the
above settings are saved to this folder during the server upgrade.

1. Stop the current UCMDB Server (of version 10.3x, or 11.0, or later).

Note:

High-availability environment: If your current environment is a high-availability environment, stop all the
UCMDB Servers in the UCMDB Server cluster.

Standalone environment: If the UCMDB Integration Service is running, stop the service.

2. Run the UCMDB 2020.05 installer.

a. Locate the UCMDB executable file: UCMDB_Server_2020.05.exe, and double-click it to open the splash
screen.

Note: If you get a message that the digital signature is not valid, you should not install UCMDB. In this
case, contact Micro Focus Support.

b. Choose the locale language and click OK.

c. The Introduction page opens. Click Next.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 10/75
6/22/2020 Configuration Management System (CMS)

d. The License Agreement page opens. Accept the terms of the end-user license agreement and click Next.

e. On the Select Installation Folder page, make sure you select the existing UCMDB installation folder and click
Next.

f. On the Select Installation Type page of the installer, select Upgrade and click Next.

A message pops up, reminding you that upgrading UCMDB to version 2020.05 requires migration of existing
Universal Discovery licenses to units.

Important: Before you can proceed with the upgrade, you must do the following:

Access the Support Entitlement Portal to convert any MDR and ACM licenses you own to the format
required by 2020.05. This can be done by you and does not require any help from Micro Focus teams.

Contact the Software Sales Assist team (sw_ssa@microfocus.com) to begin the migration of your UD
Full and UD Inventory OSI licenses to units.

Click OK.

g. On the Install Data Flow Probe page, select one of the following:

Automatically update Data Flow Probe to 2020.05

Select this option if the existing probes that report to the UCMDB server are of version 10.3x or later (with
or without a CUP, union and non-FIPS mode on Windows machine). For supported upgrade paths, see
Upgrading UCMDB - Introduction. For more details about Data Flow Probe auto upgrade, see Data Flow
Probe Upgrade Overview in the UCMDB Help.
If you do not choose this option now, but still want to leverage the probe auto upgrade feature after the
UCMDB server upgrade, then when you have finished upgrading the UCMDB server, you can go to
<UCMDB_Server>\content\probe_patch and copy the probe-patch-2020.05-windows.zip package to
the <UCMDB_Server>\runtime\probe_upgrade directory. Then restart the UCMDB server. UCMDB
server will then perform probe auto upgrade.
Update the Data Flow Probe manually
Select this option if the probes that report to the UCMDB server in your environment are on Linux or of
versions not supported for auto upgrade. When you have finished upgrading the UCMDB server to version
2020.05, you can uninstall the old version probe first, and then install version 2020.05 probe manually. For
details, see Data Flow Probe - Upgrade Overview.

h. On the Deploy Content Pack page, select to deploy the new Content Pack and click Next.

Important: If you need to merge the customized changes of scripts you made in UCMDB with the new
scripts included in the new Content Pack, before you can proceed to deploy the new Content Pack, check
and make sure the infrastructure settings Merge Packages/Content Pack and Merge Discovery Scripts
are set to True. Otherwise the default setting will simply overwrite content and NOT perform any merges.
For more information, see Compare and Merge Packages or Content Packs.

i. Specify the passwords to be used for keystore and truststore:

Note: If all your passwords satisfy the requirements, you are brought to the Pre-Installation Summary
page directly.

On the Set Up Keystore Password page, enter the password that you want to use for the keystore, and
then enter the password again to validate it.
On the Set Up Truststore Password page, enter the password that you want to use for the truststore, and
then enter the password again to validate it.

Note:

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 11/75
6/22/2020 Configuration Management System (CMS)

The keystore/truststore passwords setup will only be present if default passwords are used. If custom
passwords are already in use, the wizard will not ask for them again.
The installer encrypts the above keystore/truststore passwords you provided in a newly generated file
server-storepass.conf.
The keystore/truststore passwords must follow the password policy below:
The password must contain 8 to 16 characters and include at least one of each of the following four
types of characters:

Uppercase alphabetic characters

Lowercase alphabetic characters
Numeric characters
Special characters: :/._+-[]

j. On the Summary page, click Install to start the installation.

k. The Remove folder access privilege page opens, asking you whether you want to remove the Users group
access privilege from the UCMDB server installation folder (<UCMDBServer_InstallDir>).

Select Yes, the installer removes the Users group access privilege from the <UCMDBServer_InstallDir>
folder automatically.

Select No to remain the same.

Note: You can remove the Users group access privilege from the <UCMDBServer_InstallDir> folder
manually later. Below is a command sample for your reference:

CACLS commands ‘cacls <user_install_dir> /T /E /R Users’

Click Next.

l. When the installation completes, click Done.

Note: When upgrading UCMDB to version 2020.05, it is not necessary to run the Server Configuration wizard
because the system uses the schemas from the 10.3x, 11.0, 2018.xx, or 2019.02 installation.

3. If you imported SSL certificates in UCMDB 10.3x, extract the certificates from

C:\hp\UCMDB\UCMDBServer\old (upgraded from version 10.3x)

C:\UCMDB\UCMDBServer\old (upgraded from version 11.0 or later)

and import them into

C:\hp\UCMDB\UCMDBServer\bin\jre\lib\security\cacerts (upgraded from version 10.3x)

C:\UCMDB\UCMDBServer\bin\jre\lib\security\cacerts(upgraded from version 11.0 or later)

For details, see the section describing enabling SSL on the Client SDK in the Hardening section of the UCMDB
Help.

4. Standalone environment: If you stopped the Integration Service above you must clear the Integration Service
data:

In C:\hp\UCMDB\UCMDBServer\integrations\tools (upgraded from 10.3x) or

C:\UCMDB\UCMDBServer\integrations\tools (upgraded from 11.0 or later) run clearProbeData.bat

5. IMPORTANT!

Note: This step is relevant only if you are upgrading to 2020.05 on a new machine, and if you customized the
key.bin in your previous deployment.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 12/75
6/22/2020 Configuration Management System (CMS)

Before you start the UCMDB Server, you must copy the encryption key (key.bin) that you backed up before you
started the upgrade procedure to the following folder on the new machine:

C:\hp\UCMDB\UCMDBServer\conf\discovery\ (upgraded from 10.3x)

C:\UCMDB\UCMDBServer\conf\discovery\ (upgraded from 11.0 or later)

6. If UCMDB patches have been installed on top of your current UCMDB version, you need to remove any Probe
patch archive (.zip) files that might be left over in the system:

Note:

This step is relevant only if you are upgrading UCMDB on top of your current version—that is, on the same
machine.
In a high-availability environment, repeat this procedure on each machine that is being upgraded.

In the C:\hp\UCMDB\UCMDBServer\runtime\probe_upgrade folder, delete all .zip files from previous versions
that have the probe-patch prefix.

7. Stop the Java process from <UCMDBServer>\bin\jre directory to make sure there is no UCMDB Server JRE
getting stuck.

Check if local_policy.jar and US_export_policy.jar are present in the <UCMDB_Server>\bin\jre\lib\security

folder, if yes, remove them.

8. Remove the <UCMDBServer>/runtime/jetty-cache folder.

9. (Oracle version 12.1.0.1 and lower only) If you upgraded UCMDB server from an earlier version with Oracle
version 12.1.0.1 (or lower), make sure you open a support case and apply the hotfix related to the issue in
QCCR1H126420 (After upgrade to 2019.05, startup fails at data acquisition step:
java.sql.SQLSyntaxErrorException: [mercury][Oracle JDBC Driver][Oracle]ORA-00904:
VMWARE_RESOURCE_POOL_1"."A_DATA_TAGS": invalid identifier).

10. Start up the UCMDB 2020.05 Server to complete the upgrade.

Note: It may take several hours for the server to start up. You can follow the progress in the following log files
(located in the ..\UCMDBServer\runtime\log folder):

servicepack.install.log

upgrade.short.log
upgrade.detailed.log

During the upgrade, you should also be observing frequent updates in the following log files to confirm your
installation is proceeding normally:

cmdb.dal.log
error.log

11. Standalone environment: If you stopped the Integration Service, restart it.

12. High-availability environment:

If you are upgrading a high-availability environment, or your upgraded environment is to be a high-availability

environment:

a. Install UCMDB 2020.05 on each of the machines that will be included in the UCMDB Server cluster:

If your current environment is a high availability environment , follow steps above to upgrade each UCMDB
Server in the current UCMDB Server (of version 10.3x, or 11.0 or later) cluster to version 2020.05.

To install new or additional servers, go back to the selection page of this interactive guide, and select
Install UCMDB 2020.05 and High Availability and following the generated instructions.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 13/75
6/22/2020 Configuration Management System (CMS)

b. Ensure that one of the UCMDB Servers in the cluster is up and running (has the Fully Up status), and then
start the other UCMDB Servers.

Note: In UCMDB 2020.05, all of the UCMDB Servers in a high-availability environment are active, while also
providing high availability in case of server failure.

Upgrading UCMDB - Upgrade the PostgreSQL Server (Optional)

For upgraded UCMDB server which uses the embedded PostgreSQL database, the PostgreSQL database version
stays the same as before. You can continue to use this version. In case you want use PostgreSQL database of a
newer version, you may manually upgrade the PostgreSQL database.

When you manually upgrade the PostgreSQL server, use the same account as you install the UCMDB Server.

Important: The commands in this section are only examples under the assumption that the existing PostgreSQL
installation is installed and configured as follows:

The PostgreSQL installation folder is <UCMDBServer>\PostgreSQL.

For new install, the default installation folder is C:\UCMDB\UCMDBServer\PostgreSQL; for upgrade, make
sure you select the existing installation folder, which is C:\hp\UCMDB\UCMDBServer\PostgreSQL (10.3x) or
C:\UCMDB\UCMDBServer\PostgreSQL (11.0 or later).

The port for the PostgreSQL server is 5431.

The user name of the PostgreSQL server is admin. This user name is specified during the
UCMDB installation.
The CMDB schema name is ucmdb_database.

You must customize the commands if your PostgreSQL installation is different.

Do not copy and paste these commands into the command line. Otherwise, the commands may not be
recognized correctly. Always type the commands into the command line.

1. Download PostgreSQL version 10 binaries (Win x86-64) from the PostgreSQL website:

http://www.enterprisedb.com/products-services-training/pgbindownload

2. Stop the UCMDB Server.

3. On the UCMDB server, back up the dump file by executing the following commands:

Upgraded from version 10.3x:

cd C:\hp\UCMDB\UCMDBServer\PostgreSQL\pgsql\bin
pg_dumpall -h localhost -p 5431 -U admin > backup.dump

Upgraded from version 11.0 or later:

cd C:\UCMDB\UCMDBServer\PostgreSQL\pgsql\bin
pg_dumpall -h localhost -p 5431 -U admin > backup.dump

Note: You need to type in the password of the admin user four times.

4. Monitor the dump file size in the PostgreSQL\pgsql\bin folder. When the size remains unchanged for 10
minutes, press Enter in the command line.

Note: Depending on the database size, the back-up can take five minutes or even longer.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 14/75
6/22/2020 Configuration Management System (CMS)

5. Stop the UCMDB_Server_DB service.

6. Rename the PostgreSQL folder (for example, rename it to PostgreSQL.old), create a new folder named
PostgreSQL, and then extract the downloaded PostgreSQL binaries into the PostgreSQL folder.

7. Copy the pgInitDB.bat, pgStart.bat, and pgStop.bat files from the PostgreSQL.old folder to the PostgreSQL
folder.

8. Initiate the new version of PostgreSQL database by using the command line.

Upgraded from version 10.3x:

cd C:\hp\UCMDB\UCMDBServer\PostgreSQL\pgsql\bin
initdb -D "C:\hp\UCMDB\UCMDBServer\PostgreSQL\pgsql\data"

Upgraded from version 11.0 or later:

cd C:\UCMDB\UCMDBServer\PostgreSQL\pgsql\bin
initdb -D "C:\UCMDB\UCMDBServer\PostgreSQL\pgsql\data"

9. Restore the configuration file. To do this, copy the ucmdbpg.conf file from the PostgreSQL.old\pgsql\data\
folder to the PostgreSQL\pgsql\data folder.

10. Register the new PostgreSQL as a UCMDB_Server_DB service by executing the following commands:

pg_ctl.exe register -N UCMDB_Server_DB -D "C:\hp\UCMDB\UCMDBServer\PostgreSQL\pgsql\data"

sc description UCMDB_Server_DB "UCMDB Database"
net start UCMDB_Server_DB

The UCMDB_Server_DB service is then started.

11. Create the PostgreSQL database by executing the following command:

createdb ucmdb_database

12. Create a new account by executing the following command:

createuser –s –P admin

Note: Use the same credentials as used in the previous PostgreSQL server.

13. Restore the dump data into the new version of PostgreSQL server by executing the following command:

psql -U admin -d ucmdb_database -f "C:\hp\UCMDB\UCMDBServer\PostgreSQL.old\pgsql\bin\backu

14. Start the UCMDB Server.

If any problem occurs or the upgrade fails and you wish to rollback to the previous PostgreSQL server installation,
you can delete the newly created PostgreSQL folder and then rename the PostgreSQL.old folder to PostgreSQL.
You can then follow the above steps to perform the upgrade again.

Upgrading UCMDB - Post-Upgrade Procedures

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 15/75
6/22/2020 Configuration Management System (CMS)

The following steps may be necessary after the upgrade.

Set Master Key. If the master key is not set in the previous version of UCMDB, you must set the master key after
upgrading to 2020.05. Otherwise, the UCMDB UI is inaccessible. For more information about how to do this, see
How to Set Master Keys in the UCMDB Help.

CMS UI. When upgrading to 2020.05, the embedded CMS UI 2020.05 is automatically installed. If you are working
with an earlier version of the CMS UI, you must update it manually.
Reverse Proxy. If the upgraded system is not going to run on the same machine as the previous version, you
need to reconfigure the reverse proxy after the upgrade. For configuration details, see Using a Reverse Proxy in
the UCMDB Help.

SSL.

Reinstall SSL configurations. For details, see Enabling Secure (HTTPS or SSL) Communication in the UCMDB
Help.

If SSL was activated on the source system, restore the \conf\security folder that you backed up before the
upgrade.

LW-SSO. Configure LW-SSO. For details, see Lightweight Single Sign-On (LW‑SSO) Authentication and Enabling
Login to Universal CMDB with LW-SSO in the UCMDB Help.

JMX Console. If you configured Java JMX access hardening, copy the file that you saved before the upgrade
back into the following folder:

C:\hp\UCMDB\UCMDBServer\bin\jre\lib\management\jmxremote.password (upgraded from version 10.3x)

C:\UCMDB\UCMDBServer\bin\jre\lib\management\jmxremote.password (upgraded from version 11.0 or later)

And edit the file's permissions so that:

the owner of the file is the same user that runs the UCMDB service

only the owner has permission to view the file (Reminder: This file has the JMX protocol password in clear text)

For more details, see Java JMX Access Hardening in the UCMDB Help.

Redo modifications on integration (federation) adapters. All adapters must be compatible with the new
Universal Data Model. If you made changes to existing out-of-the-box adapters, you must make the same changes
to the adapter files in version 2020.05. Do not copy files from your previous version and overwrite the files in
version 2020.05.

Enable Aging. During the upgrade, aging is disabled to prevent CIs from being deleted because of the time during
which the Probe is not collecting data (between the running of the upgrade process and until discovery starts
reporting all CIs).

It is very important to re-enable aging. However, it is recommended to wait until the system has stabilized before
re-enabling aging. To verify that the system has stabilized, run discovery and monitor all CIs that are marked for
deletion. For details, see Universal Discovery in the UCMDB Help.

Re-enable aging from the Administration > CI Lifecycle module and restart the server. For details about aging,
see CI Lifecycle and the Aging Mechanism in the UCMDB Help.

CyberArk Integration. Check if new hash value is the same as the one you configured in the CyberArk server. If
different, re-generate the hash value using the following command:

java -Xms500m -Xmx1200m -jar JavaAIMGetAppInfo.jar GetHash /AppExecutablesPattern="C:\hp\UC

And then fill the newly generated hash value into the CyberArk server.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 16/75
6/22/2020 Configuration Management System (CMS)

Set Up High Availability Mode

Note: This section is relevant only if your upgraded environment is to be a high-availability environment.

A typical configuration for a high-availability environment is two or more UCMDB Servers connecting to the same
database server. The server are configured to work behind a load balancer, that is, the load balancer serves as the
entry point to the UCMDB Servers. All of the UCMDB Servers are active at any given time and can handle both read
and write requests. Requests are distributed to the UCMDB Servers in the cluster by the load balancer. While read
requests are shared evenly among all of the UCMDB Servers (Readers), only one UCMDB Server (Writer) is also
responsible for write requests at one time. Any write requests received by a Reader are passed to the Writer.
Moreover, any of the UCMDB Servers can take over the Writer role in the case that the Writer becomes unavailable.

Note:

The load balancer used for high availability must have the ability to insert cookies and must be able to do
health checks ("keepalive").

The instructions defined below are certified over the load balancer, F5 BIG-IP version 10.x (and later).

If you are using a different load balancer, the configuration should be performed by a network administrator
who has a wide knowledge about how to configure your load balancer, and similar principles should be applied.

The set up procedure below assumes that you already have at least one UCMDB Server installed and
configured.

To set up a high availability environment after upgrading UCMDB to version 2020.05:

1. Install one or more additional UCMDB Servers to create a UCMDB Server cluster

Install the UCMDB Servers as you did the first UCMDB Server with one difference: when running the Server
Configuration wizard to configure the database on the additional UCMDB Server, select Connect to an existing
schema, and provide the details of the schema you created for the first UCMDB Server.

For details on installing UCMDB Servers, see Installing the UCMDB Server - Installation.

Note:

The machines used for all of the UCMDB Servers in the cluster should have similar hardware (and the
same amount of memory) and should be running the same operating system.

UCMDB Servers in the cluster must work on the same port number for HTTP, HTTPS, and so on. You
cannot configure the two UCMDB Servers to work on different ports.

If you are working in an IPv6-only environment, ensure that the UCMDB Server machines are configured
for IPv6.

i. In the wrapper.conf file, locate the following line:

wrapper.java.additional.<#>=-Djava.net.preferIPv4Stack=true
ii. If it is not commented out, then comment it out.

2. Complete the Server Startup

a. If the first UCMDB Server (preferably the writer server) is not started, start the process. Wait until the startup
process is complete.

b. Copy the <UCMDBServer>/conf folder from the first server (the writer) to the other servers.

c. Start the other UCMDB Servers.

3. Configure the Load Balancer

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 17/75
6/22/2020 Configuration Management System (CMS)

The load balancer is used to balance load sent to the UCMDB Servers in the cluster. Configure the load balancer
as follows:

a. Configure VIP addresses. On the load balancer:

Configure a Cluster VIP address to send requests to the whole UCMDB Server cluster.

Configure a Writer VIP address to send requests to the Writer only (for Universal Discovery only).

Note: Keep a note of the defined VIP addresses.

When defining the communication settings between the UCMDB Server and the Data Flow Probes,
always use the Writer VIP address when prompted for the UCMDB Server name.
When defining the communication settings between the UCMDB Server and other applications, always
use the Cluster VIP address when prompted for the UCMDB Server name.

b. Configure two identical pools of backend servers that represent all of the UCMDB Servers in the cluster. The
two pools will be monitored by different health monitors. One pool will be sent requests that are intended
solely for the Writer server (only for Universal Discovery), and the other pool will be sent requests that can be
processed by any server in the cluster.

c. Configure the health monitors (keepalive addresses). The health monitors check for the keepalive page of
each of the UCMDB Servers.

Configure the following URL for the Cluster VIP address:

/ping/

Configure the following URL for the Writer VIP address:

/ping/?restrictToWriter=true

Possible responses from both of these URLs are FullyUp or Down with http response codes 200 OK or 503
Service unavailable respectively.

The expected response should be FullyUp.

For more details, see How to monitor High Availability cluster with endpoint /ping below.

d. Connect the health monitors to the respective UCMDB Server pools configured above.

e. Configure "session stickiness" on the load balancer:

i. Configure the load balancer to insert cookies to the responses sent back to UCMDB clients.
Using the Insert method, add a persistence profile of type cookie for each VIP address.

Note: The cookie name and value are unimportant, as long as the load balancer knows how to
maintain stickiness with the cookies it sends out.

ii. Important! Since F5 BIG-IP adds a session cookie only to the first request per connection to the server,
you must do the following:

A. Log into UCMDB.

B. Go to Administration > Infrastructure Settings, and change the Force connection closing for
SDK clients to true.

When this setting is set to true, the UCMDB SDK clients add a Connection:close header to each
authentication request and class download request sent to the server. This way the load balancer
will think this is a first request in a connection and add the session cookie to the response.

Note: This is relevant to load balancers which, like F5 BIG-IP version 10.x, add a session cookie to
the first request per connection to the server only.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 18/75
6/22/2020 Configuration Management System (CMS)

If the load balancer you are using adds a session cookie to every response, Force connection
closing for SDK clients should be set to false (as is the default). In this case, setting it to true can
lead to a decline in system performance.

f. If the VIP is configured to accept secure connections and the load balancer forwards the requests to the
UCMDB servers over HTTP, you must configure redirect rewrites. In the F5 UI, configure the HTTP profile
associated with the VIP to rewrite all redirects by enabling the following option: Redirect Rewrite select All.

Note: If the load balancer is configured to forward requests to backend over HTTP, an extra setting is
required to be done on the load balancer. The load balancer admin should configure the load balancer to
rewrite the Location header to correctly point to the load balancer URL. This needs to be done for HTTP
connections that go to the jmx-console. This can be achieved through a regular expression like the following:

(https:\/\/(.*)):(\d*)(.*) \1\4

where the yellow part is the matching part and the green part is the replacing part.

4. Configure Data Flow Probes

When you install a Data Flow Probe, use the load balancer's Writer VIP address when defining the Universal
CMDB Server name.

If you already have a Data Flow Probe installed:

a. Stop the Probe.

b. In the c:\UCMDB\DataFlowProbe\conf\DataFlowProbe.properties file, change the serverName attribute to

point to the Writer VIP address.

c. Restart the Probe.

How to monitor High Availability cluster with endpoint /ping

The endpoint /ping allows monitoring of the High Availability cluster. So far the endpoint could be configured to ask
for the status of:

entire cluster (writer + readers)

only writer

The restrictToReader parameter was added to the aforementioned endpoint that returns the status of only the
readers in the cluster.

To configure this, the endpoint /ping should be called with the following parameter: restrictToReader=true

For example, /ping:8443?restrictToReader=true

Note: In case both restrictToWriter and restrictToReader parameters are present and have the value set to
true, for example,

/ping:8443?restrictToReader=true&restrictToWriter=true

Only the parameter restrictToWriter will be taken into account.

As a best practice for deployments that rely heavily on CMS UI, we recommend the use of a UCMDB HA Cluster with
at least three nodes (one writer and two readers).

For this type of deployment, we recommend that two virtual IPs are created on the load balancer:

One that points only to the writer, the endpoint for health check is: <UCMDB_URL>/ping?restrictToWriter=true

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 19/75
6/22/2020 Configuration Management System (CMS)

In case that the cluster contains 2 or more reader servers, one endpoint that points to all the reader servers. The
endpoint for health check is: <UCMDB_URL>/ping?restrictToReader=true

In case that the cluster contains 1 reader server, one endpoint that points to all the servers (reader and writer). The
endpoint for health check is: <UCMDB_URL>/ping

The health check endpoint will return:

status code 200 and the payload "FullyUp" if the application is started successfully.

status code 503 and the payload "Down" if the application is not yet fully started.

Note that other elements can affect the health check process, in this case the load balancer can get an error similar to
"Connection refused".

Set up a high availability UCMDB Server and CMS UI Environment with F5

BIG-IP Load Balancer and WebSEAL Reserve Proxy
This end-to-end use case describes how to set up a high-availability UCMDB and CMS UI environment with F5 BIG-
IP load balancer and WebSEAL reverse proxy.

Note: Product versions used in this end-to-end use case:

F5 BIG-IP version 13.00 Build 0.0.1645 Final

WebSEAL version 8.0.1.0

UCMDB version 2020.05

CMS UI Standalone version 2020.05

The diagram below illustrates the overall architecture of the environment we will set up.

This case contains the following key tasks:

1. UCMDB Server configuration

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 20/75
6/22/2020 Configuration Management System (CMS)

a. Prerequisites

i. You have installed the UCMDB Server and CMS UI.

ii. (Optional) You have set up high availability mode by following the instructions in the Deployment
Guide: "Set Up High Availability Mode".

b. Export the out-of-the-box UCMDB server keystore to a cert file

If using the out-of-the-box (OOTB) UCMDB cert, export it for later use.

To export the UCMDB server keystore (server.keystore) to a cert file (server.cert), do the following:

i. Open the command prompt and run the following command:

C:\UCMDB\UCMDBServer\bin\jre\bin\keytool.exe -export -alias <certificate alias> -

where:

certificate alias is the name given to the certificate.

Keystore file path is the full path of the location of the keystore file.

For example, for the out-of-the-box server.keystore use the following command:

C:\UCMDB\UCMDBServer\bin\jre\bin\keytool.exe -export -alias hpcert -keystore C:\u

Note: If self-signed certificate is not used, but a company generated certificate, use the following
command to get the alias for this certificate:

C:\UCMDB\UCMDBServer\bin\jre\bin\keytool.exe -list -keystore c:\ucmdb\ucmdbser

Keystore type: JKS

Keystore provider: SUN

Your keystore contains 1 entry.

<alias>, 14 Sept. 2012, PrivateKeyEntry.

Certificate fingerprint (SHA1): 2A:52:DF:17:D9:A5:37:2D:1F:1D:BA:4B:41:46:33:A8:18:42:5B:D7

The alias will look like: {45789-15478-1236-7895}

Use this alias to export the certificate.

ii. Enter the keystore password.

iii. Verify that the certificate was created in the following directory:
C:\UCMDB\UCMDBServer\conf\security\server.cert
iv. Convert the generated JKS file into PKCS12 format using UCMDB key tool keytool.exe (located in
the <UCMDBServer>\bin\jre\bin directory). (WebSEAL requires PKCS12 format cert.)

Run the following command:

C:\UCMDB\UCMDBServer\bin\jre\bin\keytool.exe -importkeystore -srckeystore server.

The server.p12 file is the resulting PKCS12 format cert.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 21/75
6/22/2020 Configuration Management System (CMS)

c. (Single Sign-On only) Set IDM User Name

i. Go to UCMDB server JMX console.

ii. Locate the setUserName JMX operation under the UCMDB-UI:name=LW-SSO Configuration
category.

iii. Provide the following parameter values for the setUserName JMX method:

Is inbound handler enabled: True

LW-SSO IDM User Name: <The real value for the IDM user name>. For example, iv-user (if you
are using LDAP with user iv-user).

iv. Click Invoke.

d. Set CMS UI URL

i. In UCMDB UI, go to Administration > Infrastructure Settings Manager.

ii. Locate the UCMDB Browser URL infrastructure setting, and set the value to your WebSEAL URL.

2. F5 load balancer configuration

a. Make sure you have a working F5 BIG-IP load balancer environment.

b. Log in to the F5 BIG-IP load balancer environment.

c. Make sure you have created the following in the F5 BIG-IP load balancer environment (Local Traffic >
Virtual Servers > Nodes|Pools):

A node for each of the virtual machines on which UCMDB server and/or CMS UI are running.
A pool that contains all the above nodes.

d. Import the UCMDB CA cert/key into F5.

i. In the navigation pane, go to Main > System > Certificate Management.

ii. Click Import .

iii. In the SSL Certificate/Key Source page, select Import Type:

When selecting Certificate, do the following:

Certificate Name: Keep Create New selected and provide the certificate name.

Certificate Source: Keep Upload File selected, click Browse... to select the UCMDB
server.cert file you exported earlier.

When selecting Key, do the following:

Key Name: Keep Create New selected and provide the key name.

Certificate Source: Keep Upload File selected, click Browse... to select the UCMDB key file.

iv. Click Import .

e. Add UCMDB CA cert/key to Certificate Key Chain.

i. In F5, go to Local Traffic > Virtual Servers > Profiles > SSL.

ii. Select and click an existing UCMDB cert profile.

Note: Create a SSL profile for HTTPS by clicking Create if you do not have one.

iii. Go to the Certificate Key Chain configuration setting, click Add .

iv. In the Add SSL Certificate to Key Chain dialog, select or provide values for the following settings as
appropriate and click Add :
Certificate: Select the UCMDB certificate file.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 22/75
6/22/2020 Configuration Management System (CMS)

Key. Select the UCMDB key.

Chain. Select the UCMDB chain.

Passphrase. Provide a pass phrase.

f. Create a cookie-based persistence profile.

i. In F5, go to Local Traffic > Virtual Servers > Persistence, and click Create .

ii. Select Cookie for Persistence Type and provide a name for the persistence profile.
iii. Click Finished.

g. Create a virtual server.

i. In F5, go to Local Traffic > Virtual Servers, and click Create .

ii. Specify values the following settings:

Configuration > HTTP Profile: http

Configuration > SSL Profile (Client): Select the UCMDB cert you imported in step 2.e from the
Available column and add it into the Selected column.

Configuration > Source Address Translation: Auto Map (If you select SNAT, make sure you
configure SNAT related settings properly)
Resources > Default Persistence Profile: Select the persistence profile you created in step 2.f.

iii. Provide values for other settings as appropriate.

iv. Click Finished.

3. WebSEAL reverse proxy configuration

a. Configure WebSEAL reverse proxy by following IBM official documentation: IBM Security Access Manager
(ISAM) Reverse Proxy Scenario.

Important: During the configuration, in the Identity tab of the Edit a Standard Junction window, make
sure you set the following settings as described below:

Junction Cookie: Leave the checkbox unselected

Include session cookie: Select the checkbox

HTTP Basic Authentication Header: For CMS UI and RESTful API authentication to work properly,
select Ignore from the dropdown list.

(Optional) HTTP Header Identity Information: Select IV-USER if you are using LDAP with user iv-
user.

b. Import UCMDB cert (OOTB or self-signed).

i. In IBM Security Access Manager, go to Manage > Secure Settings > SSL Certificate.
ii. Go to Manage > Edit SSL certificate database menu option, and select pdsrv.

iii. Go to the Personal Certificates tab, check if the OOTB UCMDB cert (for example, ucmdbcert) is
already listed in this tab.

iv. If no, select Manage > Import from the menu.

Provide the self signed certificate from the CMS UI/UCMDB Server or the OOTB UCMDB cert.

Make sure the cert type is PKCS12. If not PKCS12, you may need to convert it to PKCS12 from JKS.

Note: The OOTB UCMDB cert can be converted to PKCS12 using UCMDB key tool keytool.exe
(located in the <UCMDBServer>\bin\jre\bin directory). For the conversion command, see step
1.b.iv in UCMDB Server configuration.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 23/75
6/22/2020 Configuration Management System (CMS)

4. CMS UI configuration

a. Configure the ucmdb_browser_config.xml file.

i. Open the ucmdb_browser_config.xml file (located in the <CMS_UI_install_dir>\conf folder) using

a text editor.
ii. Set the <hostname> parameter value to the VIP that you set in F5.

iii. Set the <host_port> parameter to the Port that you set in F5.

iv. (Single Sign-on only) If you are using LDAP with user iv-user, locate the <webui> tags, then the
<validation> tags, copy and paste the following into the file:

<in-ui-identity-management>
<identity-management>
<userNameHeaderName>iv-user</userNameHeaderName>
</identity-management>
</in-ui-identity-management>

v. Save the file.

b. Create and configure a credentials file.

i. Create a credentials.txt file and put it in the same directory as the ucmdb_browser_config.xml file.

ii. In the file credentials.txt, enter the following content:

user=UISysadmin
password=<your-password>

iii. Save the file.

5. Verify the configured environment works

To do so, log in to any of the following:

Environment Login URL Remarks

WebSEAL https://<WebSEAL URL>:<port><WebSEAL Including CMS UI, UCMDB server,

Junction> and API

F5 https://<VIP>:<port> Including CMS UI and UCMDB server

CMS UI https://<CMS UI IP address>:<port>

UCMDB https://<UCMDB Server IP address>:<port>

Server

Troubleshooting F5 load balancer

Problem: In a very rare case, you might find UCMDB server is displayed as down or not available in F5 monitor.

Workaround: This might be caused by the difference between the F5 interval setting and the duration that garbage
collector requires to run on UCMDB server. For example, the default value for the Interval setting is 5 seconds in F5
(Local Traffic > Monitors > Browser > Properties); on UCMDB server, in a very extreme case, the garbage
collector needs more than 5 seconds to complete a run (normally it takes only 2 seconds or so to complete a run),
which makes the UCMDB writer server in the high availability environment busy with garbage collection and F5
monitor fails to detect the UCMDB writer server status.

In case you encounter such extreme case, to resolve the issue, increase the Interval setting in F5 environment
(Local Traffic > Monitors > Browser > Properties) to a desired value. Normally the default Interval value of 5
seconds should be sufficient.

To determine the total duration needed for running garbage collector on the UCMDB server, you can check for the
longest duration that the garbage collector takes in the <UCMDBServer>\runtime\log\wrapper.log file.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 24/75
6/22/2020 Configuration Management System (CMS)

Set Up a Solr Environment

Data Flow Probe - Windows Installation

Note: For instructions about how to perform unattended silent installation of Data Flow Probes, see Data Flow
Probe - Unattended Silent Installation.

The following procedure explains how to install the Data Flow Probe on a Windows machine.

Note:

Ensure that you have read the important notes and considerations above before you install the Data Flow
Probe.
The passwords that you specify during the Data Flow Probe installation must meet the following requirements:

The password must contain 8 to 16 characters and include at least one of each of the following four types of
characters:

Uppercase alphabetic characters

Lowercase alphabetic characters

Numeric characters

Special characters: :/._+-[]

To install the Data Flow Probe:

1. Extract the package for the Windows platform, and then double-click UCMDB_DataFlowProbe_2020.05.exe.

2. A progress bar is displayed. After the initial process is complete, the splash screen opens. Choose the locale
language and click OK.

3. The Introduction page opens. Click Next.

4. The License Agreement page opens.

Accept the terms of the end-user license agreement and click Next.

5. The UCMDB Data Flow Probe Setup Type page opens.

Select Full Data Flow Probe Installation. This installs the Data Flow Probe with all its components, including the
Inventory Tools (Analysis Workbench, Viewer, SAI Editor, and MSI Scanner) required for application teaching.

Note: The Inventory Tools option is used to install only the Inventory Tools. For details about application
teaching, see the Data Flow Management section of the UCMDB Help.

Click Next.

Note: If an existing Data Flow Probe is detected, a prompt pops up asking you if you would like to install a
second Data Flow Probe. Click OK to proceed, or click Cancel to exit the installation.

6. The Select Installation Type page opens.

Select New Installation if you are installing a new probe, and click Next.

Note:

Select Upgrade when you upgrade an existing probe manually.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 25/75
6/22/2020 Configuration Management System (CMS)

(Second Probe only) If you already have a probe installed, a prompt pops up reminding you that an existing
Data Flow Probe installation is detected, and asking you if you would like to install a second Data Flow
Probe. Click Yes to proceed, or click Cancel to cancel the installation.

7. The Select Installation Folder page opens.

Accept the default installation folder, C:\UCMDB\DataFlowProbe, or click Choose to select a different
installation folder.

(Second Probe only) For the second Data Flow Probe on the same Windows machine, specify a different
installation folder or click Choose to select a different installation folder for the second probe, instead of using the
one for the existing probe.

Note:

The installation folder that you select must be empty.

To restore the default installation folder, after selecting a different folder, click Restore Default Folder.

8. The UCMDB Data Flow Probe Configuration page opens, enabling you to configure the details of the
application server to which the Data Flow Probe will report.

Under Application to report to select Universal CMDB and in the Application Server address box, enter
the name or the IP address of the UCMDB server with which the Probe is to connect.

Note:

Two Data Flow Probes installed on the same Windows machine should report to two different UCMDB
servers respectively. For the second Probe you install, in the Application Server address box, make
sure you enter the name or the IP address of a different UCMDB server.
In a High Availability environment, use the Writer virtual IP address of the load balancer.

In the Data Flow Probe address box, enter the IP address or DNS name of the machine on which you are
currently installing the Probe, or accept the default.

Note: If the Data Flow Probe machine has more than one IP address, enter a specific IP address, and not
the DNS name.

Click Next.

Note: If you do not enter the address of the application server, or if there is no TCP connection to the
application server via default ports (8080,8443,80) (possibly because the application server has not fully
started yet), a message is displayed. You can choose to continue to install the Probe without entering the
address, or return to the previous page to add the address.

9. A second UCMDB Data Flow Probe Configuration page opens, enabling you to configure an identifier for the
Probe.

In the Data Flow Probe identifier box, enter a name for the Probe that is used to identify it in your
environment.

Note:

The Probe identifier is case sensitive, must be unique for each Probe in your deployment, and it must
not exceed 50 characters.

(Second Probe only) Make sure you enter a unique identifier for the second Probe.
(Applicable for the first Probe only) When installing the Probe in separate mode, that is, the Probe
Gateway and Probe Manager are installed on separate machines, you must give the same name to the

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 26/75
6/22/2020 Configuration Management System (CMS)

Probe Gateway and all its Probe Managers. This name appears in UCMDB as a single Probe node.
Failure to give the same name may prevent jobs from running.

To use the default UCMDB IP address or machine name, as defined in the UCMDB Server installation, select
Use Default CMDB Domain.

The Default UCMDB Domain is also configurable in UCMDB's Infrastructure Settings module (Administration
> Infrastructure Settings > Class Model Settings > Default Domain Property Value). For details, see the
Administer section of the UCMDB Help.

Click Next.

10. If you cleared the Use Default CMDB Domain box in the previous step, the Domain Configuration page opens.

Data Flow Probe domain type. Select the type of domain on which the Probe is to run:

Customer. Select if you are installing one or more Probes in your deployment.

Note: Always use this option for new installations.

External. Select this option for upgraded 6.x systems.

Data Flow Probe domain. If you are not using the default domain defined in UCMDB enter the name of the
domain here.

Note: For external domains, this value must be identical to the Data Flow Probe identifier defined in the
previous step.

Click Next.

11. The UCMDB Data Flow Probe Working Mode page opens.

Note: When installing a second Probe, this step is skipped.

You can run the Probe Gateway and Probe Manager as one Java process or as separate processes.

Note: The Probe can be configured in separate mode in IPv4 environments, and in IPv4/IPv6 environments,
but not in pure IPv6 environments.

Click No to run the Probe Gateway and Probe Manager as one process.

Click Yes to run the Probe Gateway and Probe Manager as two processes on separate machines.

Note: When running the Probe Gateway and Probe Manager as two processes ensure the following:

At least one Probe Gateway component must be installed. The Probe Gateway is connected to the
UCMDB Server. It receives tasks from the Server and communicates with the collectors (Probe Managers).

Several Probe Managers can be installed. The Probe Managers run jobs and gather information from
networks.

The Probe Gateway should contain a list of attached Probe Managers.

The Probe Managers must know to which Probe Gateway they are attached.

Click Next.

12. The UCMDB Data Flow Probe Memory Size page opens.

Define the minimum and maximum memory, in megabytes (MB), to be allocated to the Probe.

Note: For information about changing the maximum heap size value at a later point in time, see the Data
Flow Management section of the UCMDB Help.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 27/75
6/22/2020 Configuration Management System (CMS)

Click Next.

13. The PostgreSQL Account Configuration page opens.

The PostgreSQL Data Flow Probe account is used by the Data Flow Probe to connect to the PostgreSQL
database. This account is less privileged compared to the PostgreSQL root account. Its password is encrypted in
the DataFlowProbeOverride.properties configuration file.

Enter the password for the PostgreSQL Data Flow Probe account and enter it a second time for confirmation.

Click Next.

14. A second PostgreSQL Account Configuration page opens where you configure the PostgreSQL root account.
The PostgreSQL root account is the account used to administer the PostgreSQL database. When set, it may
need to be provided while executing scripts under the Probe's installation.

Enter the password for the PostgreSQL Data Flow Probe account, and enter it a second time for confirmation.

Note: Changing the root account password does not affect operation of the Probe.

Click Next.

15. The Configuration for System Administrator Password page opens.

Set the password for the system administrator (sysadmin), who has the ability to log into the JMX console.

Click Next.

16. The Account Configuration for Uploading Scan Files page opens. This is used for Manual Scanner
Deployment mode. It enables uploading scan files directly to the XML Enricher's incoming directory on the Data
Flow Probe using HTTP or HTTPS.

Enter the user name and password for this account, and enter the password a second time for confirmation. The
default user name is UploadScanFile.

Click Next.

17. The Pre-Installation Summary page opens.

Review the selections you have made and click Install to complete the installation of the Probe.

18. The Remove folder access privilege page opens, asking you whether you want to remove the Users group
access privilege from the Data Flow Probe installation folder (<DataFlowProbe_InstallDir>).

Select Yes, the installer removes the Users group access privilege from the <DataFlowProbe_InstallDir> folder
automatically.

Select No to remain the same.

Note: You can remove the Users group access privilege from the <DataFlowProbe_InstallDir> folder
manually later. Below is a command sample for your reference:

CACLS commands ‘cacls <user_install_dir> /T /E /R Users’

Click Next.

19. When the installation is complete, the Install Complete page opens.

Note:

Any errors occurring during installation are written to the following file:

<DataFlowProbe_InstallDir>\UninstallerData\Logs\UCMDB_Data_Flow_Probe_Install_<install date
and time>.log

For example,
C:\UCMDB\DataFlowProbe\UninstallerData\Logs\UCMDB_Data_Flow_Probe_Install_<install date
and time>.log for the first Probe on the Windows machine.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 28/75
6/22/2020 Configuration Management System (CMS)

Any database-related errors occurring during installation are written to the following log:

<DataFlowProbe_InstallDir>\runtime\log\postgresql.log

For example, C:\UCMDB\DataFlowProbe\runtime\log\postgresql.log for the first Probe on the Windows

machine.

Click Done.

20. If you customized the key.bin file, copy the key.bin that you saved earlier to
<DataFlowProbe_InstallDir>\conf\security.

21. Start the Probe by using one of the following methods:

Click Start > All Programs > UCMDB > Start Data Flow Probe.

Note: To start the second Probe: Select Start > All Programs > UCMDB (2) > Start Data Flow Probe.

To start the Probe from the console, at the command prompt execute the following script:

<DataFlowProbe_InstallDir>\bin\gateway.bat console

For example, C:\UCMDB\DataFlowProbe\bin\gateway.bat console for the first Probe on the Windows
machine.

Note:

In order for the Probe to connect to the application server, the application server must be fully started.

22. (Windows only, the first Probe only) If you selected to run the Probe Gateway and Probe Manager as two
processes on separate machines, you must configure the Probe Gateway and Probe Manager components. For
details, see Data Flow Probe - Configure the Database Scripts (Optional) below.

Data Flow Probe - Upgrade Overview

This section contains the following:

Data Flow Probe Upgrade Overview

Data Flow Probe Auto Upgrade Overview

Data Flow Probe Auto Upgrade Workflow

Data Flow Probe Manual Upgrade Workflow

Data Flow Probe Upgrade Overview

When upgrading Data Flow Probes, you have the following options:

Data flow probe auto upgrade. For supported probes of version 10.3x or later (with or without a CUP, union and
non-FIPS mode on Windows machine), you can select the Automatically update Data Flow Probe to 2020.05
option in the Install Data Flow Probe wizard page when upgrading the UCMDB server to perform auto upgrade of
connected probes. For more information, see Data Flow Probe - Unattended Silent Installation.

Data flow probe manual upgrade. In the following scenarios, you may need to perform manual upgrade of data
flow probes:

You selected the Update the Data Flow Probe manually option in the Install Data Flow Probe page of the
UCMDB server upgrade wizard while upgrading the UCMDB server.

For probes on Linux or probes of versions not supported for auto upgrade in your environment, you need to
manually uninstall the old version probe first, and then install the latest version probe.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 29/75
6/22/2020 Configuration Management System (CMS)

Data Flow Probe Auto Upgrade Overview

Once UCMDB server is upgraded to version 2020.05, the probe auto upgrade capability is in place. This capability
enables you to upgrade all the connected probes of version 10.3x (or later, with or without a CUP) in your
environments with just several clicks while upgrading UCMDB server, without having to access the probe servers
anymore.

Compared to the traditional manual probe deployment approach (uninstall the old probe and then install the new
probe), in general it takes 20-40 minutes to upgrade multiple probes in parallel with the probe auto upgrade
mechanism.

The time required for upgrading all the connected probes equals to that of the probe that takes the longest duration to
finish upgrade among all the connected probes. The network latency would be a impact factor, which has impact on
the time the probe downloads resources from the UCMDB Server. Micro Focus lab testing shows the following
results: A total of 60 connected probes finished upgrade in 40 minutes, while the majority of them finished around 20-
30 minutes with network latency less than 1 millisecond.

Supported Probes

Data Flow Probes that satisfy the following criteria are supported for auto upgrade:

Supported probe versions. The probe auto upgrade and deployment mechanism supports upgrading probes
from any of the following versions to version 2020.05 automatically:

10.3x (with or without a CUP)

11.0
2018.05 or later

Union and non-FIPS mode probes on Windows machine

The following probes are not supported for auto upgrade in version 2020.05:

FIPS mode probes

Separate mode probes
Probes on Linux machine

Integration service
Two probes installed on a same Windows machine

Data Flow Probe Auto Upgrade Workflow

The Data Flow Probe Auto Upgrade workflow contains the following steps:

1. The UCMDB Administrator upgrades UCMDB server from version 10.3x (or later, with or without a CUP) to
version 2020.05.

During the upgrade, the Administrator selects the Automatically update Data Flow Probe to 2020.05 option. As
a result, the probe auto upgrader package is placed under the <UCMDB_Server>\content\probe_patch folder,
and the Data Flow Probe installer package is placed under the <UCMDB_Server>\content\probe_installer
folder.

2. The probe auto upgrader performs the following operations:

a. Performs pre-check to decide if the probe is ready for upgrade. For example, if there is enough disk space
available or not, and if the probe is of a supported version.
b. Generates the response file required for silent installation.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 30/75
6/22/2020 Configuration Management System (CMS)

c. Downloads the Data Flow Probe installer file for Windows platform (for example,
UCMDB_DataFlowProbe_2020.05.exe) from the UCMDB server.

d. Stops the following services:

UCMDB_Probe

UCMDB_Probe_DB
UCMDB_Probe_XmlEnricher

e. Performs silent installation with the Update option.

During this step, the upgrader performs post-upgrade tasks, including merging customized settings, creating
and adjusting database tables, such as splitting tables (version 11.0 to version 2020.05), columns, indexes,
and so on.

f. Starts all three services after the installation is done: UCMDB_Probe, UCMDB_Probe_DB, and
UCMDB_Probe_XmlEnricher.

g. Reports probe upgrade status to the UCMDB server, and save probe auto upgrade logs to UCMDB Server.
For example: <UCMDB_Server>\runtime\log\probeUpgradeLogs\11.0to2020.05\success.

Note: If the upgrade is successful, the log would be placed under the success folder; if failed, the logs
would be placed under the failed folder.

Data Flow Probe Manual Upgrade Workflow

For probes that are supported by the probe auto upgrade mechanism, do either of the following:

Important: There is no need to uninstall the old version probes first for probes supported by the probe auto
upgrade mechanism.

Perform probe auto upgrade from UCMDB server.

To leverage the probe auto upgrade feature after the UCMDB server upgrade, then when you have finished
upgrading the UCMDB server,

i. Go to the <UCMDB_Server>\content\probe_patch directory.

ii. Copy the probe-patch-xxx-windows.zip package to the <UCMDB_Server>\runtime\probe_upgrade
directory.
iii. Restart the UCMDB server.
UCMDB server will then perform auto upgrade of all supported and connected probes.

Perform manual upgrade of probes on the probe servers.

i. Extract the package for the Windows platform, and then launch the probe installer
UCMDB_DataFlowProbe_2020.05.exe.
ii. On the UCMDB Data Flow Probe Setup Type wizard page, select Full Data Flow Probe Installation.
This installs the Data Flow Probe with all its components, including the Inventory Tools (Analysis
Workbench, Viewer, SAI Editor, and MSI Scanner) required for application teaching.

iii. On the Select Installation Type wizard page, select Upgrade.

iv. Follow wizard instructions to complete the probe upgrade.

For details, see Data Flow Probe - Manual Windows Upgrade.

For probes on Linux or probes of versions not supported for auto upgrade in your environment, perform manual
install of probes on the probe servers.

This workflow contains the following steps:

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 31/75
6/22/2020 Configuration Management System (CMS)

a. On the probe server, uninstall the old version probe.

For details, see the "Upgrading UCMDB - Uninstall the Data Flow Probes" section in the Deployment Guide.

b. Install the latest version Data Flow Probes manually.

On Windows platform:

i. Extract the package for the Windows platform, and then launch the probe installer
UCMDB_DataFlowProbe_2020.05.exe.

ii. On the UCMDB Data Flow Probe Setup Type wizard page, select Full Data Flow Probe Installation.
iii. On the Select Installation Type wizard page, select New Installation.
iv. Follow wizard instructions to complete the probe installation.

For details, see Data Flow Probe - Windows Installation.

On Linux platform:

i. Extract the package for the Linux platform, and then execute command to launch the installation.
ii. Follow the on-screen instructions to complete the probe installation.

For details, see the Data Flow Probe - Linux Installation.

Data Flow Probe - Pre-Check List for Upgrade

Pre-Check List for Both Auto Upgrade and Manual Upgrade of Probes

1. Check permissions for the user account that starts the Data Flow Probe service.

Make sure you grant the user full control of the <DataFlowProbe> folder before the upgrade, and revert the
control after the upgrade.

If the UCMDB_Probe and the UCMDB_Probe_DB services run under a custom account, make sure you grant
the custom account full control of the <DataFlowProbe> folder before the probe auto upgrade starts, and
revert the control after the upgrade.

For details, see "Troubleshooting Probe Upgrade > Permission Check".

2. Turn off Basic Authentication (BA) if it is enabled.

Check if Basic Authentication (BA) is enabled. If yes, turn off Basic Authentication via the UCMDB UI:

a. Log in to UCMDB as an administrator, and then go to Administration > Infrastructure Settings Manager.
b. Locate the Enable Basic Authentication for HTTP connections from probe setting, and then set the value
to False.

c. Restart UCMDB server.

3. Check communication port between UCMDB Server and Data Flow Probe.

a. Launch the UCMDB server JMX console (default username: sysadmin).

b. Locate the getComponentConfiguration JMX method from the UCMDB:service=Ports Management
Services category.
c. In the Value field for componentName, enter mam-collectors and click Invoke.
d. Check the Current Mapped Ports value in the returned result.

HTTP. (Obsoleted. For version 10.2x only) It means UCMDB Server and Data Flow Probe communicate
via the HTTP protocol. You need to change the HTTPS protocol to HTTP protocol after upgrading UCMDB
Server and Data Flow Probe. For details, see How to Enable HTTP Communication for UCMDB Server
(make sure you replace the HTTPS-related values with HTTP related values).

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 32/75
6/22/2020 Configuration Management System (CMS)

HTTPS. It means UCMDB Server and Data Flow Probe communicate via the HTTPS protocol. You do not
need to change the Current Mapped Ports after the upgrade.

HTTPS_CLIENT_AUTH. It means UCMDB Server and Data Flow Probe communicate by mutual (two-
way) certificate authentication. You do not need to change the Current Mapped Ports after the upgrade.

4. Check available disk space.

Check available disk space of the probe installation folder. To perform the probe auto upgrade, make sure you
have allocated sufficient disk space:

Minimum disk space required = Original PostgreSQL DB size for probe x 2 (for PostgreSQL database migration)
+ 5GB (for probe itself)

For example, if the original size of the PostgreSQL database for the probe is 10GB, make sure you have 25GB
available disk space at least (10GB x 2 + 5GB).

5. Check probe status.

Log in to the UCMDB server UI, and navigate to Data Flow Management > Data Flow Probe Setup, check the
Domains and Probes navigation pane. Only connected probes of supported versions can be upgraded
automatically.

6. Check probe versions to ensure the probes you plan to upgrade are supported.

For probe versions supported by the auto upgrade mechanism, see "Supported probe versions" in Data Flow
Probe - Upgrade Overview.

7. Back up the <DataFlowProbe> folder.

8. Also make sure that:

all Data Flow Probe related command line windows and probe related folders are closed. Otherwise automatic
backing up of those folders and files may fail as they are occupied.
ports 5436 and 5437 are free, as these two ports will be used during the probe upgrade.
stop the UCMDB_Probe and UCMDB_Probe_DB services.

9. And you are aware of the following:

For version 10.22 probes (with or without a CUP), the probe upgrade includes the PostgreSQL database ,
data, and the probe. (Probes of version 10.30 or later are already using the latest version of PostgreSQL).
For probe auto upgrade, the probe upgrader will merge the following configuration files:

DataFlowProbe.properties
DataFlowProbeOverride.properties (If exists)

The result is that all the custom configuration settings will be written into the
DataFlowProbeOverride.properties file.

Note: The recommended value of the appilog.agent.probe.sendtouchResultsToServer.maxObjects

setting in DataFlowProbe.properties for version 10.33 (or later) is 500. If your custom value is greater
than 500, it will be reverted back to 500.

After the upgrade, the following files will be replaced with the ones from your environment:

<DataFlowProbe>\conf\postgresql.conf

<DataFlowProbe>\conf\probeMgrList.xml
<DataFlowProbe>\conf\WrapperGatewayCustom.conf
<DataFlowProbe>\conf\WrapperManagerCustom.conf

<DataFlowProbe>\conf\security\ssl.properties
<DataFlowProbe>\conf\security\ProbeKeyStore.jks

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 33/75
6/22/2020 Configuration Management System (CMS)

<DataFlowProbe>\conf\security\ProbeTrustStore.jks

<DataFlowProbe>\conf\enricher.properties
<DataFlowProbe>\conf\EnricherServiceSettings.ini
<DataFlowProbe>\bin\WrapperEnv.conf

<DataFlowProbe>\bin\wrapper-platform.conf
<DataFlowProbe>\bin\WrapperManager.conf
<DataFlowProbe>\bin\WrapperGateway.conf
<DataFlowProbe>\bin\xmlenricher\WrapperEnricher.conf

Note:

During the upgrade, the probe upgrader backs up all your existing probe data and configuration to the
<DataFlowProbe>\old folder. If you need to recover any old data, just go to <DataFlowProbe>\old
folder.
During the upgrade, Micro Focus does not keep the configuration files for
<DataFlowProbe>\pgsql\data\postgresql.conf, so make sure you reconfigure it after the upgrade (if
necessary).

Data Flow Probe - Manual Windows Upgrade

To manually upgrade the Data Flow Probe on Windows:

1. Extract the package for the Windows platform, and then double-click UCMDB_DataFlowProbe_2020.05.exe.

2. A progress bar is displayed. After the initial process is complete, the splash screen opens. Choose the locale
language and click OK.

3. The Introduction page opens. Click Next.

4. The License Agreement page opens.

Accept the terms of the end-user license agreement and click Next.

5. The UCMDB Data Flow Probe Setup Type page opens.

Select Full Data Flow Probe Installation. This installs the Data Flow Probe with all its components, including the
Inventory Tools (Analysis Workbench, Viewer, SAI Editor, and MSI Scanner) required for application teaching.

Note: The Inventory Tools option is used to install only the Inventory Tools. For details about application
teaching, see the Data Flow Management section of the UCMDB Help.

Click Next.

Note: If an existing Data Flow Probe is detected, a prompt pops up asking you if you would like to install a
second Data Flow Probe. Click OK to proceed, or click Cancel to exit the installation.

6. The Select Installation Type page opens.

Select Upgrade and click Next.

Note: Select New Installation if you are installing a new probe.

7. The Select Installation Folder page opens.

Accept the default installation folder, C:\UCMDB\DataFlowProbe, or click Choose to select a different
installation folder for the existing probe.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 34/75
6/22/2020 Configuration Management System (CMS)

Note: To restore the default installation folder, after selecting a different folder, click Restore Default Folder.

8. The Pre-Installation Summary page opens.

Review the selections you have made and click Install to complete the probe upgrade.

9. The Remove folder access privilege page opens, asking you whether you want to remove the Users group
access privilege from the Data Flow Probe installation folder (<DataFlowProbe_InstallDir>).

Select Yes, the installer removes the Users group access privilege from the <DataFlowProbe_InstallDir> folder
automatically.

Select No to remain the same.

Note: You can remove the Users group access privilege from the <DataFlowProbe_InstallDir> folder
manually later. Below is a command sample for your reference:

CACLS commands ‘cacls <user_install_dir> /T /E /R Users’

Click Next.

10. When the installation is complete, the Install Complete page opens.

Click Done.

11. Start the Probe by using one of the following methods:

Click Start > All Programs > UCMDB > Start Data Flow Probe.

To start the Probe from the console, at the command prompt execute the following script:

<DataFlowProbe_InstallDir>\bin\gateway.bat console

For example, C:\UCMDB\DataFlowProbe\bin\gateway.bat console.

Data Flow Probe - Post-Upgrade Configuration

(Version 10.30 and earlier only) If UCMDB Server and Data Flow Probe communicate via the HTTP protocol
before the upgrade, then after the upgrade, you need to enable HTTP communication on the UCMDB server.

For details, see How to Enable HTTP Communication for UCMDB Server.

Enable Basic Authentication

If you disabled the Basic Authentication as described in Data Flow Probe - Pre-Check List for Upgrade, you can
enable it after all probes are upgraded successfully.

Data Flow Probe - Upgrade Success Checkpoints

1. Probe version and status: Probe version has changed to the new version.

a. Log in to the UCMDB server UI, and go to Data Flow Management > Data Flow Probe Setup.
b. Check the details pane for each probe.

If the probe has been successfully upgrade, the Status should display Connected, and the Version should
show the new version information.

2. Check the probe auto upgrade log file in UCMDB server's success folder

To check if a probe has been upgraded successfully, you can:

Check the probe_auto_upgrade.log file (in the

C:\UCMDB\DataFlowProbe\runtime\log\probeUpgradeLogs folder), if the probe is upgraded successfully,

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 35/75
6/22/2020 Configuration Management System (CMS)

you should be able to see the following message in the log file:

Finished probe upgrade. Probe has been upgraded to [version] [Build]. Probe auto upgrade

Check the success folder in UCMDB server.

The log files shows as <domain_name>_<probename>_auto_upgrade.log in the

<UCMDB_Server>\runtime\log\probeUpgradeLogs\<source_version>to<target_version>\success folder.
For example, <UCMDB_Server>\runtime\log\probeUpgradeLogs\10.22to2020.05\success. The log files in
the success folder indicate the probes that have been successfully upgraded.

For more details about the probe_auto_upgrade.log file, see "Data Flow Probe Log Files" in the Data Flow
Management section of the UCMDB Help.

3. Run some basic jobs.

Run IPs by ICMP job via the connected probe, the job should run successfully.

Data Flow Probe - Upgrade Failure Checkpoints

1. Probe version and status: Probe version remains the old version,

The Status shows Connected. This indicates the probes are not broken. In this case, if the upgrade fails, the
probe upgrader will try to recover the probe to its old version.
The Status shows Disconnected. This indicates the probes are broken. If the upgrade fails, you need to
perform troubleshooting by following the instructions in .

2. Probe upgrade log file in the failed folder on UCMDB server.

a. Go to <UCMDB_Server>\runtime\log\probeUpgradeLogs\<source_version>to<target_version>\failed
folder. For example, <UCMDB_Server>\runtime\log\probeUpgradeLogs\11.0to2020.05\failed.
b. Check the <domain_name>_<probename>_auto_upgrade.log files.

The log files in the failed folder indicate probes with upgrade failure. Open each upgrade log and check the
error messages.

Data Flow Probe - Troubleshooting Probe Upgrade

Troubleshooting Probe Upgrade - Permission Check

Problem: When logged in using a different user, the probe auto upgrade fails. (From the
probe_auto_upgrade.log, you may see a message "Failed to start probe service".)

Solution: Check your environment to make sure it meets the following requirements:

If you are using a system default user account (for example, administrator or admin), make sure you grant the
user the full control the <DataFlowProbe> folder permissions. For details, see Grant the <DataFlowProbe>
folder permissions .

if you are using a custom account, make sure the custom account meet the following requirements:

a. The user running the Probe service must be a member of the Administrators group.
b. If the UCMDB_Probe and the UCMDB_Probe_DB services run under a custom account, make sure you
grant the user the full control the <DataFlowProbe> folder permissions before the probe auto upgrade
starts, and revert the control after the upgrade.

c. Run one of the following commands using the custom account:

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 36/75
6/22/2020 Configuration Management System (CMS)

net stop UCMDB_Probe

net stop UCMDB_Probe_DB
net start UCMDB_Probe

net start UCMDB_Probe_DB

If any of the above commands fails, you need to do the following to grant the custom account the required
permissions:

Grant the custom users the permission to start/stop the probe services.

Note: The steps below use the UCMDB_Probe service as an example. You should also apply the
same steps for the UCMDB_Probe_DB and UCMDB_Probe_XmlEnricher services.

A. Locate the Command Prompt tool (cmd.exe), right-click and select Run as administrator.

B. Get the current permission for the UCMDB_Probe service by running the following command:

sc sdshow UCMDB_Probe

The returned result is as follows: (You may want to note down this string)

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCR

C. Get the SID for the custom user account by running whoami /all from the custom user command-
prompt.
The SID example for admin is S-1-5-21-3473967078-3408162587-394393321-1000.
If you cannot log in with the custom user account, do the following to get the user ID:

A. Run regedit to launch the registry.

B. Go to HKEY_USERS to find the user ID. You can locate the problematic custom user account
by the Volatile Environment tag.

D. Set the start/stop permission for the custom user account (for example, the admin user) on the
UCMDB_Probe service.
From your regular administrator command-prompt, run the following:

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 37/75
6/22/2020 Configuration Management System (CMS)

sc sdset UCMDB_Probe D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDW

The highlighted part means to grant the custom user's SID the permission to stop, start, and pause
the UCMDB_Probe service (RP, WP, and DT respectively).

Grant the <DataFlowProbe> folder permissions

A. Right-click the <DataFlowProbe> folder and select Properties > Security.

B. Edit the Users group permission by selecting the Allow checkbox for the Full Control permission.

C. Click Apply and OK.

Important: Make sure you revert the control after the probe auto upgrade.

(Not recommended) Change the group policy in the Local Group Policy Editor window.

A. Open the Local Group Policy Editor by clicking Start and type gpedit.msc in the Start Search box,
and then press ENTER.
B. In the navigation pane, expand Computer Configuration > Windows Settings > Security Settings
> Local Policies > Security Options.

C. Make sure the two highlighted UAC entries are both Disabled.

User Account Control: Admin Approval Mode for the Build-in Administrator account
(Disabled) – This means UAC is disabled for the built-in Administrator account.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 38/75
6/22/2020 Configuration Management System (CMS)

User Account Control: Run all Administrators in Admin Approval Mode (Disabled) – This
means for other administrator users, the UAC is disabled.

If this entry is Enabled, change it to Disabled and restart the operating system. The UAC would
be disabled for all the administrator users in the Administrators group, which means that they
have the same permission as the build-in administrator user.

Important: Make sure you change it back to Enabled after the upgrade.

Troubleshooting Probe Upgrade - How to check if a probe is upgraded successfully?

Before upgrading a probe, the probe auto upgrader checks the environment and the probe status:

1. Check probe version. Only a probe of version 10.3x (with or without a CUP) or later could be upgraded. For
details about supported probe versions, see Data Flow Probe Auto Upgrade Overview in the Data Flow
Management section.
2. Check probe status. Only union mode probe in non-FIPS mode could be upgraded.

3. Check available disk space. At least 10 GB disk space is required to perform the probe auto upgrade.

If a probe does not satisfy the requirements, it will be restored and back on running.

Important:

A probe has only one chance for auto upgrade. If the auto upgrade process fails, and the probe was not
broken during the process, it would be restored and you will need to manually upgrade it.

The probe auto upgrade does not support to upgrade a probe started in console mode.

To check if a probe has been upgraded successfully, you can check the probe_auto_upgrade.log file (in the
C:\UCMDB\DataFlowProbe\runtime\log\probeUpgradeLogs folder).

If the probe is upgraded successfully, you should be able to see the following message in the log file:

Finished probe upgrade. Probe has been upgraded to [version] [Build]. Probe auto upgrade

If your probe environment is still intact because the probe upgrader exits directly without taking any action when
auto upgrade pre-check fails.

In this case, the probe is still on previous version, probe service and probe DB service are still up. You can try to
run probe upgrader to perform auto upgrade again.

a. Modify <DataFlowProbe>/version.dat file. So that the version.dat file content looks like the following:

version=2020.05
build=<Release build number in the probe installer filename>
installedVersion=<Current probe version, for example, 11.0>
installedBuild=<Current probe build, for example, 196>

b. Go to the <DataFlowProbe>\tools\upgrade directory, and run post-upgrade.bat with administrator

privileges.

The probe upgrader will perform auto upgrade again.

If the probe upgrade failed, and there is no upgrade related error message in the probe_auto_upgrade.log file.

For further information about the upgrade failure, check the following log files:

probe_upgrade_conf_merge.log

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 39/75
6/22/2020 Configuration Management System (CMS)

pg_upgrade.log
probe_post_upgrade.log

For information about the probe log files, see "Data Flow Probe Log Files" in the Data Flow Management
section.

Troubleshooting Probe Upgrade - Known Issues, Limitations, and Problems

General issues

Probe Downgrade or Rollback

Automatic downgrade or rollback of the probe version is not supported. To perform downgrade or to rollback a
version upgrade, uninstall the probe and then install the required version.

Probe Restart

There are several situations where the Probe automatically restarts itself. For example, when deploying a new
Content Pack or applying a CUP. In these cases, the Probe waits for 15 minutes to allow the running jobs to
finish, and only then shuts down. Jobs that did not finish in that time (for example, long integrations) start
running again when the Probe restarts.

How to Change the PostgreSQL Database Default Port

To change the port for the PostgreSQL database, that is defined by default in the Data Flow Probe installation:

a. Stop the Probe (if already started).

b. Stop the UCMDB Probe DB Service.

c. Modify the port in the following file:

Windows: C:\UCMDB\DataFlowProbe\pgsql\data\postgresql.conf
Linux: /opt/UCMDB/DataFlowProbe/pgsql/data/postgresql.conf

The following shows how to change the port from 5432 to 5433:

Note: If two probes coexist on the same machine, plan the port usage carefully so that the ports used by
the two probes do not conflict.

#port = 5432 # (change requires restart) < Old line

port = 5433 # (change requires restart) < New line

d. Make the following changes in the DataFlowProbe.properties file (in C:\UCMDB\DataFlowProbe\conf on

Windows, and /opt/UCMDB/DataFlowProbe/conf on Linux):

Change:

jdbc:postgresql://localhost/dataflowprobe

to

jdbc:postgresql://localhost:5433/dataflowprobe

Change:

appilog.agent.local.jdbc.uri = jdbc:postgresql://localhost/dataflowprobe

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 40/75
6/22/2020 Configuration Management System (CMS)

to

appilog.agent.local.jdbc.uri = jdbc:postgresql://localhost:5433/dataflowprobe

Change:

appilog.agent.normalization.jdbc.uri = jdbc:postgresql://localhost/dataflowprobe

to

appilog.agent.normalization.jdbc.uri = jdbc:postgresql://localhost:5433/dataflowpro

Change:

appilog.agent.netflow.jdbc.uri = jdbc:postgresql://localhost/dataflowprobe

to

appilog.agent.netflow.jdbc.uri = jdbc:postgresql://localhost:5433/dataflowprobe

Probe auto upgrade limitation

If the probe auto upgrade fails, retry will not resolve the issue. You need to access the corresponding probe
server and perform manual deployment of the probe.

Probe auto upgrade known issue

The C:\UCMDB\temp folder was created and used by the probe auto upgrader during the upgrade process. If
you see this folder on your probe server, you can just ignore it, or safely remove it. It has no functional impact.

Problem: Sometimes due to the environment, the probe installer may be in hung state and cannot finish the
upgrade. If this happens, the probe upgrader will abort the probe upgrade process and restore the probe.

Solution: Manually upgrade the probe.

Problem: Log shows that “errors occurred installing probe”, and probe service, probe DB service, or
XML Enricher service could not be started. It may happen when errors occur launching the probe installer.

Solution: You need to manually upgrade the probe.

Most likely it is caused by the missing of some properties in the configuration file. If not, you may need to check
the probe auto upgrade log files for further information. For details, see Probe auto upgrade log files.

How to check if resources are placed under the right place after UCMDB server is upgraded to version
2020.05

1. Check if the Data Flow Probe installer is placed under the right place

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 41/75
6/22/2020 Configuration Management System (CMS)

Go to the <UCMDB_Server>\content\probe_installer directory. This directory should contain the probe

installer UCMDB_DataFlowProbe_2020.05.exe.

2. Check if the probe auto upgrader package is placed under the right place

Go to the <UCMDB_Server>\runtime\probe_upgrade directory. This directory should contain the probe

upgrade package probe-patch-windows.zip.

If the probe-patch-windows.zip package does not exist,

a. Go to <UCMDB_Server>\content\probe_patch.
b. Copy the probe-patch-2020.05-windows.zip package to the <UCMDB_Server>\runtime\probe_upgrade
directory.
c. Restart the UCMDB server. UCMDB server will then perform probe auto upgrade.

Probe auto upgrade log files

The following probe auto upgrade log files (in the <DataFlowProbe>\runtime\log directory) contains details if the
probe auto upgrade fails:

pg_upgrade.log. Shows the running details of the pg_upgrade.bat script, including the details about
PostgreSQL upgrade and table splitting.
probe_upgrade_conf_merge.log. Shows the related information when probe installer merger configuration
files.
probe_auto_upgrade.log. In the probeUpgradeLogs subfolder, shows the related information when the probe
auto upgrader upgrades a probe.

For more details about the log files, see "Data Flow Probe Log Files" in the Data Flow Management section of the
UCMDB Help.

XML Enricher service port conflict issue

Problem: The XML Enricher service may fail to start after the probe upgrade due to port conflict. In that case, the
probe_auto_upgrade.log is placed under the failed folder, for example,
<UCMDB_Server>\runtime\log\probeUpgradeLogs\11.0to2020.05\failed. You should find the following
message in probe_auto_upgrade.log:

2019-07-14 11:27:11 INFO ServiceControl:106 - Starting XML Enricher service...

2019-07-14 11:27:11 INFO ServiceControl:328 - XML EnricherStatus status: STOPPED
2019-07-14 11:27:11 INFO ServiceControl:381 - Waiting for execution...
2019-07-14 11:27:46 ERROR ServiceControl:394 - Problems occurred during execution.

Solution: Check <DataFlowProbe>\runtime\logWrapperEnricher.log, if you find "Port already in use:

34545", you can change the port for XMLEnricher by editing the
<DataFlowProbe>\bin\xmlenriche\WrapperEnricher.conf file, or free the port 34545.

Troubleshooting Probe Auto Upgrade - PostgreSQL Upgrade

Check the PostgreSQL version to verify if the upgrade is successful or not.

When PostgreSQL finishes upgrade, you can check the PostgreSQL version to verify if the probe upgrade is
successful or not.

Or, you can check the pg_upgrade.log in the <DataFlowProbe>\runtime\log folder for more details.

If PostgreSQL upgrade is completed successfully, you can find “The new PostgreSQL will be used” message
in the pg_upgrade.log file, and you can also see two folders: <DataFlowProbe>\pgsql and

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 42/75
6/22/2020 Configuration Management System (CMS)

<DataFlowProbe>\pgsql.old . The <DataFlowProbe>\pgsql.new folder was removed when the upgrade is

completed successfully. If you manually run the script from the <DataFlowProbe>/tools/dbscripts folder to
upgrade the database again, the log will tell you that pgsql.new does not exist, and running the script again has no
functional impact to the PostgreSQL installation.

How to read log messages when the PostgreSQL upgrade fails?

In some cases the PostgreSQL upgrade may fail. Then you can find three subfolders under <DataFlowProbe>:
pgsql, pgsql.old, and pgsql.new. You can also find more details in the pg_upgrade.log file, which displays
messages that may indicate why the upgrade failed. You may follow the solutions for different log messages.

1. Log message: Folder pgsql.new doesn't exist.

Possible Cause: Something unexpected happened when installing the probe, and the probe failed to
generate the pgsql.new folder.

Solution: Download PostgreSQL resources for the same version from the official PostgreSQL website and
extract the resources to the pgsql.new folder, then rerun the pg_upgrade.bat script.

Possible Cause: You have already run the script more than once, and the script already deleted the
pgsql.new folder previously.

Solution: The PostgreSQL upgrade is completed successfully previously. Just check for the PostgreSQL
version.

2. Log message: The new PostgreSQL database initialization failed.

Possible Cause: The conditions for initdb were not met.

Solution: Check if the password is correct, or there is no data folder in pgsql.new.

3. Log message: The precheck of the old and new PostgreSQL failed.

Possible Cause: The script did not run in the local system account or has no full control of the files.

Solution: Switch to the local system account, or add full control to the whole folder for users, then rerun the
script.

4. Log message: PostgreSQL upgrade failed, the old PostgreSQL will still be used.

Possible Cause: The conditions for pg_upgrade.exe were not met.

Solution: Check the conditions for both the old PostgreSQL and the new PostgreSQL, make sure both are
fine. You can manually run the following command to find more details:

"%DB_PATH%\pg_upgrade.exe" -b "%BASE_DIR%\pgsql\bin" -B "%BASE_DIR%\pgsql.new\bin" -d "

5. Log message: Table splitting failed, the old PostgreSQL will still be used.

Possible Cause: There is no ddm_discovery_results table in the database, or the upgrade failed when
creating the ddm_discovery_touch_results table.

Solution: Check the log details to find out where the problems happened, then check the script
tools\dbscripts\migrateData.cmd.

After resolving issue a ~ issue e above, you can follow the steps below to upgrade PostgreSQL manually:

1. Stop the UCMDB_Probe_DB service.

2. Remove the content of the pgsql folder and copy the content of the pgsql.old folder into the pgsql folder.
3. Give full control to the user of the DataFlowProbe folder, and then from the
<DataFlowProbe>/tools/dbscripts folder run the following command:

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 43/75
6/22/2020 Configuration Management System (CMS)

pg_upgrade.bat %DB_Password%

4. Once the command is successful run, revert the full control you granted to the user.

Note: During the upgrade, we do not keep the configuration files for
<DataFlowProbe>\pgsql\data\postgresql.conf, so make sure you reconfigure it after the upgrade (if
necessary).

Troubleshooting Probe Auto Upgrade - Customized Probe Configuration

When the probe installer is launched, it will merge the following configuration files:

DataFlowProbe.properties
DataFlowProbeOverride.properties (If exists)

The result is that all the custom configuration settings will be written into the DataFlowProbeOverride.properties
file.

Note: The recommended value of the appilog.agent.probe.sendtouchResultsToServer.maxObjects setting

in DataFlowProbe.properties for version 10.33 (and later)is 500. So if your value is greater than 500, it will be
reset back to 500.

The following files will be replaced with the ones from your environment:

<DataFlowProbe>\conf\postgresql.conf
<DataFlowProbe>\conf\probeMgrList.xml

<DataFlowProbe>\conf\WrapperGatewayCustom.conf
<DataFlowProbe>\conf\WrapperManagerCustom.conf
<DataFlowProbe>\conf\security\ssl.properties

<DataFlowProbe>\conf\security\ProbeKeyStore.jks
<DataFlowProbe>\conf\security\ProbeTrustStore.jks
<DataFlowProbe>\conf\enricher.properties

<DataFlowProbe>\conf\EnricherServiceSettings.ini
<DataFlowProbe>\bin\WrapperEnv.conf

<DataFlowProbe>\bin\wrapper-platform.conf
<DataFlowProbe>\bin\WrapperManager.conf

<DataFlowProbe>\bin\WrapperGateway.conf
<DataFlowProbe>\bin\xmlenricher\WrapperEnricher.conf

Problem: After finishing probe auto upgrade, the probe cannot not be started, and many properties in
DataFlowProbe.properties are empty. This happens when probe backing up configuration files failed.

Solution: You need to manually upgrade the probe. That is to say, uninstall the probe and install version 10.33 (or
later) probe manually.

Access Commands for the UCMDB Server

Access Commands for Windows

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 44/75
6/22/2020 Configuration Management System (CMS)

During the installation of Universal CMDB, a start menu is added to the settings of the machine on which you installed
UCMDB. You can start and stop the UCMDB Server and the UCMDB Integration Service, access the Server
Configuration wizard and view Server service status, and you can uninstall the Server.

If there is a Data Flow Probe installed on the same machine as the UCMDB Server, you can start and stop the Data
Flow Probe, as well as uninstall it, from this menu.

To access the Universal CMDB start menu, select Start > All Programs > UCMDB. The menu includes the following
options:

Command Description

Start Universal Starts the UCMDB Server service.

CMDB Server
Note: Alternatively, you can access the Windows Services window and locate the
UCMDB_Server service. Open the UCMDB_Server Properties (Local Computer) dialog box and
start the service. If required, change the Startup Type to Automatic.

Stop Universal Stops the UCMDB Server service.

CMDB Server
Note: Alternatively, you can access the Windows Services window and locate the
UCMDB_Server service. Open the UCMDB_Server Properties (Local Computer) dialog box and
stop the service.

Universal Opens a Web page with information about the server. For details, see UCMDB Services below.
CMDB Server To open a Web page with information about the UCMDB UI Server Status, enter the following
Status URL:
https://<UCMDB Server Host Name or IP>:8443/ucmdb-ui/status.jsp

Note: The link to the Server Status page is only displayed if the Show Status Page link on
first page infrastructure setting is set to True.

Start Universal Enables you to run the wizard to connect to an existing database or schema or to create a new
CMDB Server database or schema. For details, see Creating a Database or Connecting to an Existing One?
Configuration earlier in this document.
Wizard

Uninstall Uninstalls the UCMDB Server.

Universal
CMDB Server

Start Universal Starts the UCMDB Integration Service which allows performance of non-Jython-based
CMDB integration tasks without using a Data Flow Probe if your remote managed data repositories are
Integration accessible from the UCMDB Server machine.
Service
Note: The UCMDB Integration Service and the Data Flow Probe (if installed on the UCMDB
Server machine) cannot be running at the same time. To start the UCMDB Integration Service,
you must first stop the Data Flow Probe.

Stop Universal Stops the UCMDB Integration Service.

CMDB
Integration
Service

Inventory Enables you to access the Inventory Tools (and supporting documentation) that are used for
Tools viewing and analyzing data discovered by Inventory Discovery.

Available: Only when a Data Flow Probe is installed on the UCMDB Server machine.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 45/75
6/22/2020 Configuration Management System (CMS)

Command Description

Start Data Starts the Data Flow Probe on the UCMDB server.
Flow Probe
If the Data Flow Probe is installed on the UCMDB Server machine: The Data Flow Probe
and the UCMDB Integration Service cannot be running at the same time. To start the Data Flow
Probe, you must first stop the UCMDB Integration Service. See Stop Universal CMDB
Integration Service.

Available: Only when a Data Flow Probe is installed on the UCMDB Server machine.

Start Data Starts the Data Flow Probe on the console.

Flow Probe
(console) Available: Only when a Data Flow Probe is installed on the UCMDB Server machine.

Stop Data Flow Stops the Data Flow Probe.

Probe
Available: Only when a Data Flow Probe is installed on the UCMDB Server machine.

Uninstall Data Uninstalls the Data Flow Probe.

Flow Probe
Available: Only when a Data Flow Probe is installed on the UCMDB Server machine.

UCMDB Services
This section includes:

View the Status of Universal CMDB Server Services

Check the Universal CMDB Integration Service Status

Universal CMDB Services

View the Status of Universal CMDB Server Services

On the UCMDB Server machine, open your client browser and enter https://localhost:8443/status. The Status and
Detailed Status of all services are displayed, indicating whether the Universal CMDB services are running (Up) or
are down (Not Started).

The Status of the default client indicates the general status of the current UCMDB server.

Starting. Indicates that the UCMDB server is starting.

UP. Indicates the loading and deployment of the specified basic packages from a content pack is done, and the
UCMDB server is up and available for some non-core operations.

For a classic UCMDB environment, by default all packages from Content Pack are deployed during server startup,
and it takes around 20 ~ 30 minutes for the UCMDB server to fully start.

Fully Up. Indicates the deployment of all packages (including basic and advanced packages) from a content pack
is done, and the UCMDB server is fully functioning.

Not Started. The current UCMDB server is not started.

Note:

In case there are services that are not running, contact Micro Focus Support.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 46/75
6/22/2020 Configuration Management System (CMS)

If you are following the status of the UCMDB components as they come up at
https://<server_name>:8443/status ( where <server_name> is the name or IP address of the
UCMDB Server machine), you can expect the longest “wait” time to occur for the following three services:

classModel
histDB
content-install

Check the Universal CMDB Integration Service Status

If your remote managed data repositories are accessible from the UCMDB server machine, you can use the UCMDB
Integration Service for non-Jython-based integrations instead of a Data Flow Probe.

Note: The UCMDB Integration Service is supported in a standalone UCMDB environment only.

To ensure that the service is running:

1. Check the status on the UCMDB Server machine:

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 47/75
6/22/2020 Configuration Management System (CMS)

Windows Control Panel > Administration Tools > Services

Linux /opt/UCMDB/UCMDBServer/integrations/bin/service.sh status

2. If the service is not running:

a. Check if there is a Data Flow Probe installed and running on the UCMDB Server machine. If so, you must first
stop the Data Flow Probe before you can start the UCMDB Integration Service.

To stop the Data Flow Probe:

Windows Select Start > All Programs > UCMDB > Stop Data Flow Probe

Linux Enter the following command: /opt/UCMDB/DataFlowProbe/bin/probegateway.sh stop

b. Start the UCMDB Integration Service:

Windows Use one of the following:

Select Start > All Programs > UCMDB > Start Universal CMDB Integration Service
Select Start > Control Panel > Administration Tools > Services, and start the UCMDB
Integration Service

Linux Enter the following command:

/opt/UCMDB/UCMDBServer/integrations/bin/service.sh start

Universal CMDB Services

The Universal CMDB services are described in the following table:

Service Name Description of Service

authorization Responsible for the security model enforcement (users, roles, tenants, and so on).

autodiscovery Responsible for Data Flow Management-related services.

Browser_resources Responsible for managing the UCMDB Browser module related resources like
categories.

cla_queue Responsible for Client level authorization.

cla_statistics Responsible for Client level authorization.

classModel Responsible for maintaining the class model in the CMDB.

cmdb_mod_not Responsible for notifications of changes that occur in the CMDB.

cmdb_sys_tqls Responsible for the conditions applied to TQL nodes, and the condition results that
are stored in the system TQL.

cmdb_view Responsible for calculating view definitions over TQL results (the transformation from
graph to tree is given the view definition).

cmdb_widget_tracker Responsible for managing UCMDB Browser module widgets.

configuration Responsible for snapshots, CI change queries, and TQL/View History queries.

content-install Responsible for managing the content packs.

correlation Responsible for Universal CMDB impact, root cause, and correlation subsystems.

data-acquisition Responsible for managing integrations.

enrichment Responsible for executing both ad hoc and active enrichments.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 48/75
6/22/2020 Configuration Management System (CMS)

Service Name Description of Service

fcmdb-config A cache mechanism for federated data that allows basic FCMDB services before the
FCMDB is fully loaded.

fcmdb-management Responsible for managing the adapters, federation, and the data push flow.

folders Responsible for managing the folder hierarchy for every type of resource.

framework Responsible for dispatching operations within the UCMDB server.

generic_adapter_manager Responsible for generic adapter related operations.

grouping Responsible for holding the different bundles that allow the classification of resources.

histDB Responsible for saving changes to CIs and relationships in the CMDB.

impact Responsible for Universal CMDB impact, root cause, and correlation subsystems.

licensing Responsible for license management.

mapping-engine Used by the integrations. Allows reconciliation during a federated TQL calculation.

model Responsible for mapping CIs from external data sources to local CMDB CIs.

model_statistics Allows running database optimization operations. These operations are run in various
scenarios, such as history, upgrade, and JMX.

model_topology Responsible for loading the model topology graph (an internal data structure that
contains all CIs and relationships without properties and often allows avoiding
database queries).

model_update Responsible for managing updates to the class model in the CMDB.

msg_sync Messaging service for asynchronized history change messages.

offline_tql Responsible for managing and executing queries needed for CI tracking in the
UCMDB Browser module.

packaging Responsible for packages. Packages are zip files containing resources that are
structured in organized, predefined subdirectories.

reconciliation The CMDB’s data population reconciliation service. Responsible for the reconciliation
engine of Universal CMDB.

reconciliation_conf Handles the reconciliation configuration such as identification rules and reconciliation
priority configuration

report Responsible for Universal CMDB report services, such as adding, editing, and
removing System reports, calculation of Asset reports, Node Dependency reports.

scheduler Responsible for scheduling offline tasks.

softwarelibrary Software library (Teaching server) service for SAI editor/Express Teaching operations

state_management Responsible for managing states.

system-health Responsible for gathering a storing server related statistics.

topology_search Responsible for search engine related services.

tql Responsible for TQL calculations.

tql_res_utils Responsible for TQL result maintenance (active) and layout retrieval.

tql_tracker Responsible for managing UCMDB browser module CI tracking.

view Responsible for part of the business logic of the Modeling Studio, including "watch".

world A central repository for configuration information that is gathered from the various
Universal CMDB and third-party applications and tools. This information is used to
build Universal CMDB views.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 49/75
6/22/2020 Configuration Management System (CMS)

Accessing and Logging In to Universal CMDB

This section includes:

Overview

Accessing the UCMDB Components

Enabling Automatic Login
Launch UCMDB UI from Chrome 43+, Firefox 48+, Microsoft Edge, or Safari 10+

Launch UCMDB UI as a Desktop Application from UCMDB Local Client

Change Default Time Limit for User Inactivity Log Out

Overview

You access Universal CMDB using a supported Web browser, from any computer with a network connection (intranet
or Internet) to the Universal CMDB Server.

For details about Web browser requirements, as well as minimum requirements to successfully view Universal
CMDB, see the Support Matrix section of the CMS Help.

The level of access granted a user depends on the user’s permissions. For details on granting user permissions, see
the Administer section of the UCMDB Help.

For details on accessing Universal CMDB securely and login authentication strategies, see the Hardening section of
the UCMDB Help.

Accessing the UCMDB Components

1. In the Web browser, enter the URL of the Universal CMDB Server, for example:

https://<server name or IP address>.<domain name>:8443

where <server name or IP address>.<domain name> represents the fully qualified domain name (FQDN) of the
Universal CMDB Server.

If Universal CMDB is set up to work through a reverse proxy, enter https://<proxy_server_name>:443 where
proxy_server_name is the name or IP address of the proxy server.

If the correct Java version is not installed on your machine, you can choose to download the version from
sun.com or from the UCMDB server. (If you log in without installing Java, you will not be able to view pages that
need a Java applet to display correctly.)

2. Click a link to work with Universal CMDB:

UCMDB. Opens the login page. After logging in, the module you had open at the end of your last session
opens. If your user preferences are deleted, the IT Universe Manager is opened by default.

Note: You can also access the login page by entering https://<server name or IP address>.<domain
name>:8443/ucmdb.

UCMDB SAML Login. Opens to the default UCMDB module page directly if SAML authentication is enabled.

Note: This option is available only when SAML authentication is enabled.

User Management. Opens the login page. After logging in, you are taken directly to the Users and Groups
module where you can manage your UCMDB users.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 50/75
6/22/2020 Configuration Management System (CMS)

UCMDB Configuration Manager. Opens the Configuration Manager application. For the link to be active,
Configuration Manager must be running and the infrastructure setting Configuration Manager URL must
contain the application’s URL.

UCMDB Browser. Opens the UCMDB Browser. The UCMDB Browser is a web-based UCMDB UI for
displaying UCMDB information quickly and easily, and simplifying administrative and integration management
of UCMDB with improved user experience and ease of use. For the link to be active, UCMDB Browser must be
running and the infrastructure setting UCMDB Browser URL must contain the application’s URL.

UCMDB Class Model. Opens the UCMDB Class Model Reference, which contains information on all
packages, CI types, and relationships in the class model.

Server Status. Opens the Server Status page.

JMX Console. Enables you to perform operations on the CMDB through the JMX console interface.

API Connection Test. Displays information about the Universal CMDB Server for you to use when running an
API to the CMDB.

API Client Download. Downloads the UCMDB API jar file.

API Reference. Opens the UCMDB API Reference documentation.

a. When you click UCMDB or User Management, the login page opens.

Enter the default superuser login parameters:

User Login = admin, User Password = the password for admin.

If Universal CMDB is installed in a multiple customer or multiple state environment (for example, Universal
CMDB Configuration Manager), a Customer field is displayed. Choose the Customer name from the list.
Remember me on this machine. Select for automatic login. That is, the next time you log in to UCMDB,
you do not need to enter your user name and password.

3. Click Login. After logging in, your user name appears at the top right of the screen.

If you have problems logging in, see Troubleshooting Deployment - Logging In to UCMDB below.

Note: Click the Help button on the Login page for complete help with logging in.

4. (Recommended) Change the superuser password immediately to prevent unauthorized entry. For details, see the
Administer section of the CMS Help.

5. (Recommended) Create additional administrative users to enable Universal CMDB administrators to access the
system. For details, see the Administer section of the CMS Help.

Enabling Automatic Login

Advanced login options enables you to automate login, limit login access, and provide direct login capabilities to
specific pages in Universal CMDB.

When automatic login is enabled from the login page, and when you close the browser tab without using the Logout
button at the top of the Universal CMDB page, the next time you enter this URL to access Universal CMDB
(https://<server name or IP address>.<domain name>:8443/ucmdb-ui) or access the URL of the Universal CMDB
Server (https://<server name or IP address>.<domain name>:8443) to get to the splash screen and then click
UCMDB, the login page does not open, the login name and password do not have to be entered, and the default
page that is set to open opens automatically.

Caution: This option could be considered a security risk and should be used with caution.

To enable automatic login:

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 51/75
6/22/2020 Configuration Management System (CMS)

1. In the Universal CMDB login page, select the option Remember me on this machine.

2. When completing your session, do not click Logout at the top of the page, but close the browser tab.

When you open a new browser tab and navigate to link https://<server name or IP address>.<domain
name>:8443 and then click UCMDB, the login page should be skipped.

Guidelines for Using Automatic Login

Using the Logout option at the top of the Universal CMDB page, the Remember me on this machine option is still
enabled with your user name remembered. If you log out using the Logout button, the next time you try to log in, the
Login page opens with your login name pre-filled, you only need to enter your password manually.

The Remember me on this machine option can only be manually canceled by the user when he/she logs in next
time.

Launch UCMDB UI from Chrome 43+, Firefox 48+, Microsoft Edge, or Safari 10+

You can launch UCMDB UI application from web browsers without support for NPAPI plugins, including Chrome 43+,
Firefox 48~51, Microsoft Edge, and Safari 10+.

The JNLP feature allows users who use web browsers without support for NPAPI plugins to launch the UCMDB UI
application. Instead of running it in the internet web through the Java plug-in, a JNLP file is saved on the client
machine. After launching the JNLP file, it runs in a separate Java process and loads the UCMDB UI as a desktop
application.

The following web browsers are supported for accessing UCMDB UI using JNLP:

Chrome version 43 or later

Firefox versions 48 to 51

Microsoft Edge

Safari version 10 or later

The following scenarios are not supported:

Login through LW-SSO

CAC login
FIPS mode

How to launch UCMDB UI from web browsers without support for NPAPI plugins

Note: Most of the configurations here are one-time operation only.

To do so, perform the following:

1. Prerequisites

Oracle JRE is installed on the client machine (the latest version recommended)

Make sure you have enabled JNLP from JMX console

Otherwise follow the instructions below to enable JNLP:

i. Access the UCMDB server JMX console: Launch a Web browser and enter the following address:
https://<UCMDB machine name or IP address>:8443/jmx-console. You may have to log in with a
user name and password. (default username: sysadmin)

ii. Locate the UCMDB:service=Settings Services > setGlobalSettingValue operation.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 52/75
6/22/2020 Configuration Management System (CMS)

iii. To enable JNLP, provide values for the following parameters for the setGlobalSettingValue method:

name: mam.web.is.jnlp.enabled

value: true
The default value of the mam.web.is.jnlp.enabled setting is false.

iv. Click Invoke. The setting takes effect immediately.

2. Import the certificate to your client

Note: This is needed only when you do not have a certificate provided by a Certificate Authority.

a. Export a certificate (for example, ucmdb.cer) and save it to your machine.

Taking Windows and Chrome as an example,

i. In the client web browser, enter https://<UCMDB machine name or IP address>:8443/.

ii. Click the lock icon in the address bar.

iii. Click the Details link right under the site address.

The Details pane opens to the Overview tab page in the right side

iv. Click View Certificate.

v. In the Certificate dialog box, go to the Details tab, find the certificate which CN = Universal CMDB,
and click Copy to File.
The Certificate Export Wizard opens.

vi. Click Next.

vii. On the Export File Format page, select DER encoded binary X.509 (.CER). and click Next.
viii. On the File to Export page, enter a file name (for example, ucmdb) and click Next.

ix. Click Finish.

b. Import the certificate by executing the following command:

keytool -importcert -alias ucmdb -file <filepath>\ucmdb.cer -keystore <JRE_HOME>\lib\

For example,

keytool -importcert -alias ucmdb -file C:\Users\Administrator\Desktop\ucmdb.cer -keys

c. You may need to enter the default password changeit, and enter yes when prompted "Trust this
certificate?".

d. (Optional) Restart the UCMDB Server.

3. Launch UCMDB UI as a desktop application

a. In the Web browser, enter the URL of the Universal CMDB Server, for example:

https://<server name or IP address>.<domain name>:8443

where <server name or IP address>.<domain name> represents the fully qualified domain name
(FQDN) of the Universal CMDB Server.

For details about the options available on the UCMDB splash screen, see Accessing the UCMDB
Components.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 53/75
6/22/2020 Configuration Management System (CMS)

Tip: In case you see a message like "Your connection is not secure", go to the Advanced settings and
add a security exception. For example, on Firefox, click Advanced > Add Exception, and then in the
Add Security Exception dialog box that pops up, click Confirm Security Exception.

b. Click UCMDB or User Management.

c. Click Run as Java Web Start app.

On Chrome, a UCMDB.jnlp file is downloaded to your local machine automatically. Double-click the
downloaded UCMDB.jnlp file to launch it.

On Firefox, the Opening UCMDB.jnlp dialog box pops up.

Select Open with Java(TM) Web Start Launcher (default) and click OK if you want to launch
UCMDB UI directly.

Select Save File and click OK if you would like to save the file and launch UCMDB UI later. Double-
click the downloaded UCMDB.jnlp file to launch it.

d. In the Do you want to run this application? dialog box, click Run.

The UCMDB.jnlp file runs in a separate Java process and loads the UCMDB UI as a desktop application.

e. In the Universal CMDB dialog box that pops up, enter your UCMDB server login parameters.

f. Click Login.

Universal CMDB launches as a desktop application.

To exit Universal CMDB, click the Close button at the top right corner of the application window.

4. (Optional) Configure the JNLP memory size

If necessary, you may want to increase the JNLP memory size.

a. On the UCMDB server machine, open the <UCMDB_Server_Home>/deploy/ucmdb-ui/jnlp-generate.jsp

file using a text editor.

b. Locate the following line:

<j2se version="1.5+" initial-heap-size="512M" max-heap-size="1024M"/>

c. Modify the value of the initial-heap-size or max-heap-size setting to meet your needs, and save the
file.
d. Delete the UCMDB.jnlp file you downloaded in step 3.c, and re-download the UCMDB.jnlp file by
refreshing the web page and clicking the Run as Java Web Start app button from the web browser.

Note: For more details about the JNLP configuration, see JNLP File Syntax.

Tip: To access the same Universal CMDB server from one of the above mentioned web browsers, simply launch
the downloaded UCMDB.jnlp file.

Launch UCMDB UI as a Desktop Application from UCMDB Local Client

The UCMDB Local Client tool enables you to launch the administrative GUI (UCMDB UI) of a target UCMDB server
as a desktop application from the UCMDB local client tool, without the need for the Oracle JVM installed on that
desktop. It also allows you to manage login configurations for multiple UCMDB servers easily from a central place.

This section contains the following:

UCMDB Local Client Support Matrix

Launch UCMDB Server Admin UI as a desktop application from UCMDB Local Client

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 54/75
6/22/2020 Configuration Management System (CMS)

Export the OOTB UCMDB server certificate and import it to the UCMDB Local Client tool

Reuse the UCMDB server configuration information on a different machine

Modify the location for storing the config.json file

Modify the JVM proxy for the UCMDB Local Client

How to validate the jar file contained in UCMDB_Local_Client.zip is properly signed

Configure CAC support

Enable support for full validation checking of certificates

Uninstall UCMDB Local Client

Troubleshoot UCMDB Local Client

UCMDB Local Client Support Matrix

This release of the UCMDB Local Client tool supports the following:

Supported UCMDB versions

The current release of UCMDB Local Client tool supports UCMDB version 10.30 and later versions (up to
2020.05).

It also supports Micro Focus ITOM suites (SMA, OpsB, and APM) that contain UCMDB version 10.30 or later
versions (up to 2020.05).

This release also added support for multi-customer mode (CMS with and without IDM).

For the compatibility matrix between UCMDB Local Client releases and UCMDB server versions, see UCMDB
Local Client Compatibility Matrix.

HTTPS Supportability for ITOM Suites

ITOM Suite HTTPS HTTPS - CAC Remarks

CMS without IDM Yes Yes

with IDM Yes Yes

OpsB without IDM Yes Yes

with IDM Yes Yes

SMA without IDM n/a n/a Invalid deployment

with IDM Yes No

APM without IDM Yes No LDAP is not supported

with IDM No No

Note: The UCMDB Local Client tool supports UCMDB versions 10.30 up to the latest version released
together with the UCMDB Local Client. Forward compatibility is not supported.

Supported platforms

Windows (both 32-bit and 64-bit)

macOS

Linux

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 55/75
6/22/2020 Configuration Management System (CMS)

Red Hat Enterprise Linux Server 6, 7, and 8

Oracle Enterprise Linux with Oracle Unbreakable Kernel v6, v7, and v8

Supported Authentication Modes

LDAP authentication

Basic Authentication. This refers to support for basic authentication with IBM Security Access Manager for Web
WebSEAL version 8.0.

Mutual authentication. This refers to the support for mutual authentication with CAC.

Launch UCMDB Server Admin UI as a desktop application from

UCMDB
1. DownloadLocal Client
the UCMDB Local Client tool.

You can download the UCMDB Local Client tool from one of the following locations:

Micro Focus MySupport Self-Solve Knowledge Search site

Download the tool from UCMDB Server version 2020.05 when the server is up and running.

On the UCMDB server machine, go to the <UCMDB_Server>\tools directory and copy the
UCMDB_Local_Client.zip file to a location of your choice.
On the UCMDB splash screen, click Windows, macOS, or Linux in the Download UCMDB Local Client
(Windows, macOS, Linux) option to download the tool for your operating system (access UCMDB Server
version 2020.05 or later using the following URL: https://<server name or IP address>.<domain
name>:8443).

2. Launch the UCMDB Local Client tool.

a. Extract the UCMDB_Local_Client.zip package to a location of your choice, for example, the desktop.

b. Launch the UCMDB Local Client tool:

Windows Double-click UCMDB Local Client_win.cmd

macOS Run the following command: ./UCMDB_Local_Client_mac.sh

Linux Run the following command: ./UCMDB_Local_Client_lin.sh

The UCMDB Local Client window opens.

3. Add or edit login configuration for the target UCMDB servers that you want to access.

a. Click Add or Edit .

The Add/Edit Configuration dialog opens.

b. Provide or edit values for the fields as described in the table below.

UI Description Valid Values

Element

Host/IP Server name or IP address of the target UCMDB server that you want to Example: <host
access. name or IP
address>

Label Specify a label for the UCMDB server. If you leave it blank, the field will be
populated with the host value.

Protocol Select the protocol to use. Default: HTTPS

HTTPS. Select this option to use HTTPS communication.
HTTPS - Requires client authentication. Select this option to use
mutual authentication with CAC.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 56/75
6/22/2020 Configuration Management System (CMS)

UI Description Valid Values

Element

Port Specify the port number of the target UCMDB server that you want to Default: 8443
access.

Min Define the minimum memory, in megabytes (MB), to be allocated on the Default: 512
Memory local machine for launching the target UCMDB server admin UI.

Max Define the maximum memory, in megabytes (MB), to be allocated on the Default: 1536
Memory local machine for launching the target UCMDB server admin UI.

Language Select the language that you want the target UCMDB server UI to be Default: English
displayed in. Supported languages include:
English
Japanese
Korean
Chinese
French
German
Spanish
Italian
Russian
Portuguese

Context Specify the root context for the target UCMDB server. Leave the field as is Default: /
if you want to use the default root context value /.

Note: If you configured the infrastructure setting Root context value in

the Administration > Infrastructure Settings Manager module, make
sure you copy the value to the Context field, so that this Context
setting and the infrastructure setting Root context use the same value.
For instructions about how to configure the root context, see "How to
Change the Root Context for UCMDB Components".

Target Select the environment that the target UCMDB/RTSM server belongs to. Default: CMS
Env. The following options are available:
CMS
SMA
OpsB
APM

Note: If you upgraded from version 2020.02 and you were using ITOM
Platform with IDM as the target environment, it is recommended that
after upgrade, you select CMS with IDM as the target environment, as
ITOM Platform was merged with CMS.

c. Click OK.

4. Launch UCMDB server Admin UI from the UCMDB Local Client window.

a. In the UCMDB Local Client window, click the Label value for the UCMDB server that you want to access.

The Log In dialog opens.

Note: If any warning message related to the certificate issue pops up, import the UCMDB server
certificate by following instructions in the Export the OOTB UCMDB server certificate and import it to the
UCMDB Local Client tool section below.

b. In the Log In dialog, enter your login parameters.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 57/75
6/22/2020 Configuration Management System (CMS)

Note: When LW-SSO is not enabled, "Basic Authentication" displays as the header of the Log In dialog.

In Basic Authentication mode, you would need to log in twice, the first time for basic authentication, and
the second time for logging into the target UCMDB server.

c. Click Login.

The UCMDB server Admin UI opens in a new window.

Note: To log out the UCMDB session, simply click .

Export the OOTB UCMDB server certificate and import it to the UCMDB
To export the out-of-the-box UCMDB server certificate and import it to the UCMDB Local Client tool, do the following:
Local Client tool
Note: This is needed only when you do not have a certificate provided by a Certificate Authority.

1. Export the UCMDB server certificate (for example, ucmdb.cer) and save it to your machine.

Taking Windows and Chrome as an example,

a. In the client web browser, enter https://<UCMDB machine name or IP address>:8443/.

b. Click the lock icon in the address bar.

c. Click the Details link right under the site address.

The Details pane opens to the Overview tab page in the right side

d. Click View Certificate.

e. In the Certificate dialog box, go to the Details tab, find the certificate which contains CN = Configuration
Management System ROOT CA, and click Copy to File.

The Certificate Export Wizard opens.

f. Click Next.
g. On the Export File Format page, select DER encoded binary X.509 (.CER). and click Next.

h. On the File to Export page, enter a file name (for example, ucmdb) and click Next.

i. Click Finish.

2. Copy the exported ucmdb.cer file to the <UCMDB_Local_Client_dir> directory.

3. Import the certificate by executing the following command:

<UCMDB_Local_Client_dir>\jre\bin\keytool.exe -importcert -alias ucmdb -file <UCMDB_Local_

4. You may need to enter the default password changeit, and enter yes when prompted "Trust this certificate?".

5. (Optional) Restart the UCMDB Server.

Reuse the UCMDB server configuration information on a different

The UCMDB server configuration information you added in UCMDB Local Client are stored in the config.json file. To
machine
import or reuse the UCMDB server configuration information on a different machine, you can just copy and paste the
config.json file.

To do so,

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 58/75
6/22/2020 Configuration Management System (CMS)

1. Download and extract the UCMDB_Local_Client.zip package to the target machine.

2. On the source machine, go to the the following folder to copy the config.json file.

Windows %APPDATA%\Micro Focus\CMS\UCMDB Local Client

macOS /Users/$USER/Library/Application Support/CMS/UCMDB Local Client/

Linux $HOME/

Note: This is the default location for storing the config.json file.

To change the default location, see the Modify the location for storing the config.json file section below.

3. Go to the target machine, paste the config.json file to the following folder to replace the existing one:

Windows %APPDATA%\Micro Focus\CMS\UCMDB Local Client

macOS /Users/$USER/Library/Application Support/CMS/UCMDB Local Client/

Linux $HOME/

Modify the location for storing the config.json file

By default, the config.json file is stored in the %APPDATA%\Micro Focus\CMS\UCMDB Local Client (Windows) or
/Users/$USER/Library/Application Support/CMS/UCMDB Local Client/ (macOS) folder. If necessary, you can
configure a different location to store the config.json file. To do so,

1. In the UCMDB Local Client folder, open the UCMDB Local Client.cmd file using a text editor.

2. Locate the CMS_CLIENT_CONFIG parameter, which specifies the default location for storing the config.json file as
follows:

Windows:

CMS_CLIENT_CONFIG=%APPDATA%\Micro Focus\CMS\UCMDB Local Client

macOS:

CMS_CLIENT_CONFIG=/Users/$USER/Library/Application Support/CMS/UCMDB Local Client/

Linux:

$HOME/

3. Modify the CMS_CLIENT_CONFIG parameter value, so that it points to a location of your choice.
4. Save the file.

Modify the JVM proxy for the UCMDB Local Client

The UCMDB Local Clent tool can load command line parameters for JVM.

To change the JVM proxy for the UCMDB Local Client, you can add the following command in the UCMDB Local
Client.cmd file:

-DcustomConfiguration="proxyHost=127.0.0.1 proxyPort=8080"

Where:

customConfiguration: the key

proxyHost=127.0.0.1 proxyPort=8080: Parameters and values you want to configure in JVM. Use spaces to
separate parameters and values.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 59/75
6/22/2020 Configuration Management System (CMS)

When the command is successful, you should be able to see log entries similar to the following:

2018-12-25 14:29:08 INFO LocalClientsManager:697 - set custom configuration:proxyHost=127.0.0.1

2018-12-25 14:29:08 INFO LocalClientsManager:697 - set custom configuration:proxyPort=8080

How to validate the jar file contained in UCMDB_Local_Client.zip is

To do so,
properly signed
1. Locate the jarsigner tool contained in the bin folder of your JDK package.
2. Run the following command:

jarsigner -verify -verbose -certs UCMDB_Local_Client.jar

3. Check the returned result.

There should be hundreds of entries containing the following text:

...entry was signed on ... CN=Micro Focus Group Limited, OU=Micro Focus Cyber Security, O=

This means that the jarsigner tool verifies each signed entry in the jar file, and the jar file is properly signed by
Micro Focus.

Configure CAC support

1. Configure UCMDB server to support CAC authentication.

For details, see Configure CAC (Smart Card / PKI Authentication) Support on UCMDB.

2. Launch the UCMDB Local Client, and set the Protocol setting value to HTTS - Requires client authentication.

3. Click OK.

Enable support for full validation checking of certificates

To do so, do the following:

1. Go to the <UCMDB_Local_Client> folder. For example, on Windows it is C:\Users\

<username>\AppData\Roaming\Micro Focus\CMS\UCMDB Local Client.

2. Open the ssl.properties file using a text editor.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 60/75
6/22/2020 Configuration Management System (CMS)

3. Locate the javax.net.ssl.isFullValidation setting and change its value to true.

The default value is false. Setting to true enables the certificate full validation, and the UCMDB Local Client will
perform check on the certificates sent from UCMDB server.

4. Copy the CRL file to the machine where UCMDB Local Client resides and provide the path as value for the
java.security.cert.CRL setting in the ssl.properties file. For example,

java.security.cert.CRL=C:\\UCMDB\\DataFlowProbe\\conf\\security\\example.crl;

Important: Separate parameters with double backslash (\\).

5. Save the file.

6. Restart the UCMDB Local Client.

When enabled, except for the standard certificate, the UCMDB Local Client checks for the following:

Checks if the certificate is revoked.

You would need to provide this information. See step 4 above for the instruction.

A self-signed certificate will not pass the check.

Checks for key usage (if exists) in the certificate.

Check for extended key usage (if exists).

Uninstall UCMDB Local Client

To completely uninstall UCMDB Local Client, do the following:

1. Prerequisites: Ensure all UCMDB Local Client related files are closed.
2. Delete the folder where the UCMDB_Local_Client.zip package is extracted.

3. Delete the folder where the config.json file is located. The default location is as follows:

Windows: %APPDATA%\Micro Focus\CMS\UCMDB Local Client

macOS: /Users/$USER/Library/Application Support/CMS/UCMDB Local Client/

Linux: $HOME/

Troubleshoot UCMDB Local Client

Limitation: When trying to perform Export Selected CITs to Excel in the Modeling > CI Type Manager module, the
"out of the memory" error might occur to the web browser due to the maximum memory available.

Workaround: Use the latest UCMDB Local Client to perform Export Selected CITs to Excel in the Modeling > CI
Type Manager module, as the max memory of the UCMDB Local Client is 1500 MB.

Problem: On macOS or Linux platform, sometimes the UCMDB Local Client fails to launch with the following error:
"Permission denied".

Workaround: After unzipping the UCMDB_Local_Client_Mac.zip or UCMDB_Local_Client_Linux.zip package to

the corresponding OS platform, by default, you can run the startup script UCMDB_Local_Client_mac.sh (macOS) or
UCMDB_Local_Client_linux.sh (Linux) directly to launch the UCMDB Local Client directly.

If you encounter the "Permission denied" error, do the following:

1. Execute the following command first:

macOS: chmod u+x UCMDB_Local_Client_mac.sh

Linux: chmod u+x UCMDB_Local_Client_linux.sh

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 61/75
6/22/2020 Configuration Management System (CMS)

2. Run the the startup script UCMDB_Local_Client_mac.sh (macOS) or UCMDB_Local_Client_linux.sh (Linux)

again.

Change Default Time Limit for User Inactivity Log Out

Universal CMDB includes an automatic logout feature which logs out when the system is inactive for a set time
period. The default period is 1440 minutes (24 hours). After that time, a message appears with a 30-second
countdown until logout.

This task describes how to adjust the time limit UCMDB stays open without any user input before automatically
logging out.

To change the default logout time:

1. Select Administration > Infrastructure Settings > General Settings category > Inactive allowed time setting.

2. In the Value column, enter a new time interval in minutes. All values for inactive allowed time are located in the
Properties window (right-click Inactive Allowed Time > Properties or double-click the Inactive Allowed Time
setting).

Working with UCMDB in Non-English Locales

This section includes:

Installation and Deployment Issues

Database Environment Issues

Multi-Lingual User (MLU) Interface Support

Installation and Deployment Issues

If you use the Japanese, Chinese, or Korean language in your browser, you must ensure that the Universal CMDB
server has East Asian languages installed. On the machine on which the Universal CMDB server is installed, you
must select Control Panel > Regional and Language Options > Languages > Install files for East Asian
languages.

Universal CMDB in an I18N environment is supported for Universal CMDB installed on a Windows or Linux
platform.

The installation path for all Universal CMDB components must not contain non-English language characters.

The Upgrade Wizard for version 2020.05 does not support the non-English user interface. (The upgrade itself
works properly.)

Database Environment Issues

To work in a non-English language Universal CMDB environment, you can use either an Oracle Server database,
Microsoft SQL Server database, or PostgreSQL Server database. The OS Windows regional settings language of
the database should be the same as that of the UCMDB Server. When using an Oracle Server database, the
encoding of the database can also be UTF-8 or AL32UTF-8, which supports both non-English languages as well
as multiple languages.

When you create a new Oracle instance in an Oracle database, you must specify the character set for the
instance. All character data, including data in the data dictionary, is stored in the instance’s character set. For
details, see the section describing the Oracle Summary Checklist in the Database section of the UCMDB Help.

The Database Query Monitor can connect to an Oracle database, but the Oracle user names and passwords must
contain only English characters.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 62/75
6/22/2020 Configuration Management System (CMS)

Multi-Lingual User (MLU) Interface Support

Use the language preference option in your browser to select how to view Universal CMDB. The language preference
chosen affects only your local machine (the client machine) and not the Universal CMDB Server machine or any other
user accessing the same Universal CMDB machine.

The Universal CMDB user interface can be viewed in the following languages in your Web browser:

✓ English ✓ Korean

✓ French ✓ Brazilian Portuguese

✓ German ✓ Russian

✓ Italian ✓ Simplified Chinese

✓ Japanese ✓ Spanish

To set up and view Universal CMDB in a specific language:

1. Install the appropriate language’s fonts on your local machine if they are not yet installed. If you choose a
language in your Web browser whose fonts have not been installed, Universal CMDB displays the characters as
squares.

2. If you are logged in to Universal CMDB, you must log out. Click LOGOUT at the top of the Universal CMDB
window.

Close every open browser window or, alternatively, clear the cache.

3. If Universal CMDB is running on Internet Explorer, configure the Web browser on your local machine to select the
language in which you want to view Universal CMDB (Tools > Internet Options).

a. Click the Languages button and in the Language Preference dialog box, highlight the language in which you
want to view Universal CMDB.

b. If the language you want is not listed in the dialog box, click Add to display the list of languages. Select the
language you want to add and click OK.

c. Click Move Up to move the selected language to the first row.

d. Click OK to save the settings.

e. Display the Universal CMDB login window.

f. From the Internet Explorer menu, select View > Refresh. Universal CMDB immediately refreshes and the
user interface is displayed in the selected language.

Note: For details on viewing Web pages in Internet Explorer that are written in a different language, see
http://support.microsoft.com/kb/306872/en-us.

Configure the UCMDB Mail Server - Optional

1. Configure UCMDB mail server

a. In UCMDB, go to Administration > Infrastructure Settings > Mail Settings.

b. Configure mail settings as described in the table below:

Mail Setting Description

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 63/75
6/22/2020 Configuration Management System (CMS)

Mail Setting Description

Activate If SMTP server requires secure connection via TLS/SSL then the value should be
TLS/SSL True, and make sure you proceed to 2. Configure UCMDB client to configure
connection communication protocol. Else if SMTP server accepts non-secure connection, the
value should be changed to False.

SMTP server Enter the address of the SMTP server.

SMTP server Edit the SMTP server port. The default value is 25.
port

The username of Enter the user name of the primary SMTP server. If no authentication is required,
SMTP server leave this filed empty.

The password of Enter the password of the primary SMTP server. If no authentication is required,
SMTP server leave this filed empty.

Email sender Enter the name to appear in reports that Universal CMDB sends.

Sender Setting this value to True enables users to change the Email sender name inside
editability the form that sends mail. Otherwise, leave its value as False.

c. As a backup for the main SMTP server, you can provide information about an alternative server. Configure
the following settings:

Mail Setting Description

Alternate SMTP Enter the address of the alternate SMTP server.

server

Alternate SMTP Enter the alternate SMTP server port.

server port

Alternate SMTP Enter the user name of the alternate SMTP server. If no authentication is required,
server username leave this filed empty.

Alternate SMTP Enter the password of the alternate SMTP server. If no authentication is required,
server password leave this filed empty.

Note: It is strongly recommended to set both the SMTP server and Alternate SMTP server. In case the
SMTP server is not available, the alternative SMTP server will be used by the UCMDB server when
sending emails.

2. Configure UCMDB client

Note: This step is required only when Activate TLS/SSL connection is set to True.

After configuring the mail server with a certificate, to benefit from secure communication and secure
authentication option, you must transfer the certificate to UCMDB server truststores.

a. Retrieve UCMDB JRE path.

Example: C:\UCMDB\UCMDBServer\bin\jre

b. Retrieve your certificate path.

Example: C:\Users\Administrator.SMTP\Desktop\certs\Keypublic.pem (the file extension could be

anything, not just pem)

c. Retrieve UCMDB server truststore path.

Examples:

C:\UCMDB\UCMDBServer\conf\security\server.truststore

C:\UCMDB\UCMDBServer\conf\security\server-fips.truststore (for FIPS mode)

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 64/75
6/22/2020 Configuration Management System (CMS)

d. Retrieve UCMDB JRE truststore path.

Example: C:\UCMDB\UCMDBServer\bin\jre\lib\security\cacerts

e. Navigate to the C:\UCMDB\UCMDBServer\bin\jre\bin folder, and open the command prompt.

f. Run the following commands using keytool to import the certificate to UCMDB server truststore and
UCMDB JRE truststore:

Note: Default truststore passwords are used in the following commands : changeit and hppass. If you
configured a specific password for your truststore, just replace hppass or changeit with your
password. Also, paths provided in the examples above are used. Make sure you replace them with
your specific paths.

Command for importing the certificate to UCMDB JRE truststore:

keytool -import -file "C:\Users\Administrator.SMTP\Desktop\certs\Keypublic.pem" -keys

Command for importing the certificate to UCMDB server truststore:

For non-FIPS mode:

keytool -import -file "C:\Users\Administrator.SMTP\Desktop\certs\Keypublic.pem" -keys

For FIPS mode:

keytool -import -fle "C:\Users\Administrator.SMTP\Desktop\certs\Keypublic.pem" -keyst

Large Capacity Planning for UCMDB

This section includes:

Large Capacity Planning Overview

Configuring the UCMDB Server for Large Capacity

Configuring the Microsoft SQL Database for Large Capacity

Configuring Configuration Manager for Large Capacity

System Capacity Test

Large Capacity Planning Overview

Using the default configuration, Universal CMDB can work with a deployment of more than 25 million CIs and
relationships. To work with a larger deployment, you must implement the following configuration:

Depending in the number of CIs and relationships, increase the CMDB heap as follows:

# CIs and Relationships Heap Size

≤ 40 million 12 GB

40 million – 60 million 16 GB

60 million – 125 million 24 GB

> 125 million 55 GB

For capacity planning requirements, see the Support Matrix section of the UCMDB Help.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 65/75
6/22/2020 Configuration Management System (CMS)

For details about the changes you must make to the system configuration to support this capacity, see
"Configuring the UCMDB Server for Large Capacity" in the Deployment Guide.
For details on how to improve performance, see "Configuring the Oracle Database for Large Capacity" and
"Configuring the Microsoft SQL Database for Large Capacity" in the Deployment Guide.
For details about the setup used for capacity testing and performance results, see "System Capacity Test" in the
Deployment Guide.

Configuring the UCMDB Server for Large Capacity

For the system to support the desired number of CIs and relationships, update the following parameters on the
UCMDB Server:

Parameter Default CIs and Relationships (million) Location

≤ 40 40 – 60 60 – 125 > 125

wrapper.java. 1024 2048 8192

initmemory Windows: C:\UCMDB\UCMDBServer\bin\wrapper-platform.conf
Linux: /opt/UCMDB/UCMDBServer/bin/wrapper-platform.conf
wrapper.java. 4096 8192 16384 24576 56320
maxmemory

wrapper.java. 256 512 1024

additional.31=
-XX:MaxMetas
paceSize

dal.object.condi 2000000 50000000 50000000

tion.max.result. Windows: C:\UCMDB\UCMDBServer\conf\
size settings.override.properties
Linux: /opt/UCMDB/UCMDBServer/conf/
dal.use.memory. 600000 6000000 6000000 10000000
settings.override.properties
instead.temp.tab
le.high.threshold.
oracle

dal.joinf.max.res 400000 4000000 4000000

ult.size

Configuring the Oracle Database for Large Capacity

When working on a system containing more than 40 million objects and relationships, you can improve performance
by increasing the Oracle SGA and PGA to the following suggested sizes:

CIs and Relationships SGA PGA

40 million – 60 million 22 GB 6 GB

60 million – 120 million 42 GB 14 GB

> 120 million 88 GB 24 GB

This improves the performance of both the TQL calculation for several types of TQL queries, as well as for data-in
operations performed on the system.

Configuring the Microsoft SQL Database for Large Capacity

When working on a system containing more than 40 million objects and relationships, you can improve performance
by increasing the Microsoft SQL Server Memory to the following suggested sizes:

CIs and Relationships Microsoft SQL Server Memory

40 million – 60 million 28 GB

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 66/75
6/22/2020 Configuration Management System (CMS)

CIs and Relationships Microsoft SQL Server Memory

> 60 million 56 GB

Configuring Configuration Manager for Large Capacity

Configuration Manager supports working with up to 20,000 composite CIs in a single managed view. To enable this
functionality, do the following:

Note:

If you want to enable this functionality, it is recommended to install Configuration Manager on a server that has
a minimum of 8 GB of memory (RAM).
Managed views that are based on dynamic TQL queries and result in more than 20,000 composite CIs are not
supported.

1. To access the JMX console, launch your Web browser and enter the following address: http://<server_name>:
<port_number>/cnc/jmx-console, where <server_name> is the name of the machine on which Configuration
Manager is installed.

2. Enter the JMX console authentication credentials.

3. Click Configuration Manager > View Service. Select supportLargeViews and click Invoke.

4. In UCMDB, change the value of the TQL Group View Result Size setting to 500,000 (Administration >
Infrastructure Settings Manager > TQL Settings).

5. Do one of the following:

If you use the Universal CMDB Configuration Manager Windows service to start Configuration Manager,
navigate to the <Configuration_Manager_installation_directory>/bin/ folder and double-click the edit-
server-0.bat file. In the Java tab, increase the value of the Maximum memory pool parameter to 4096 or
greater.

If you use the start-server-0.bat file to start Configuration Manager, edit the start-server-0.bat file and raise
the value of the –Xmx parameter to 4096m or greater.

System Capacity Test

Setup

The system capacity test is conducted for Microsoft SQL Server (with 125 million CIs and relationships) and Oracle
Database (with 200 million CIs and relationships) separately, by using the following hardware configurations.

Microsoft SQL Server

Role CPU Memory OS + 3rd Party SW

CMDB 2 x 4-cores @ 32 GB Microsoft Windows Server 2008 R2 Enterprise Edition x64 SP1
2.67 GHz

Database 2 x 8-cores @ 64 GB
Microsoft Windows Server 2008 R2 Enterprise Edition x64
2.93 GHz
SP1
Microsoft SQL Server 2014 - 12.0.2000.8 (x64)

Oracle Database
Role CPU Memory OS + 3rd Party SW

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 67/75
6/22/2020 Configuration Management System (CMS)

Role CPU Memory OS + 3rd Party SW

CMDB 2 x E5-2630V3 @ 2.40GHz 32 GB Red Hat Enterprise Linux 7.2

Database 2 x E5-2630V3 @ 2.40GHz 97 GB

Oracle Linux 7.2
Oracle Database 12c Enterprise Edition x64 - 12.1.0.2

The following business flows were tested as part of the system test:

TQL Calculation

TQLs were divided into sub groups according to the result size (<100, <1000, and <10000), according to the data
set that the TQL retrieves, and according to the TQL configuration:

Like Condition

Like Ignore case

Different number of hierarchies in the TQL results (2-5)

Compound

Sub-graph

Data-in

The data-in scenario in the system test included insertion, updates, and deletion.

Enrichments

Enrichment scenarios included insert, update, and delete.

Results

Following the load test in the scenario that includes query execution (2 days), data-in (7 days for Oracle and 10 days
for MS SQL), and enrichment execution, the following results were achieved:

The system was stable throughout the run. No restarts, memory leaks, or any other degradation over time was
observed.
System performance was acceptable.

Troubleshooting Deployment - Available Troubleshooting Resources for

UCMDB
Installation troubleshooting. Use to troubleshoot common problems that you may encounter when installing
Micro Focus Universal CMDB, and the solutions to those problems. See Troubleshooting Deployment - UCMDB
Server and Troubleshooting Deployment - Keystore and Truststore below.

Login troubleshooting. Use to troubleshoot possible causes of failure to log in to Micro Focus Universal CMDB.
Micro Focus Software Self-solve knowledge base. Use to search for specific troubleshooting information on a
wide variety of topics. Located on the Micro Focus Software Support site, the Micro Focus Software Self-solve
knowledge base can be accessed by selecting Troubleshooting & Knowledge Base from the Universal CMDB Help
menu.

Note that only registered customers can access the resources on the Micro Focus Support site. Customers who
have not yet registered can do so from this site.

Universal CMDB Log files. Use to troubleshoot CMDB runtime problems. For details, see UCMDB Log files.
Data Flow Management log files. Use to troubleshoot DFM problems. For details, see Data Flow Probe log files.

Query log files. Use to view definitions for query parameter log files. For details, see UCMDB Log files.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 68/75
6/22/2020 Configuration Management System (CMS)

Troubleshooting Deployment - UCMDB Server

Problem: The UCMDB Server does not start automatically upon system restart.

Solution:

1. Open the Windows Services dialog box and select the UCMDB_Server service.

2. Open the UCMDB_Server Properties (Local Computer) dialog box.

3. In the General tab, ensure that:

The Path to executable field points to the correct executable location.

The service is configured to automatically start (Startup type is Automatic).

4. In the Log On tab, ensure that the service uses the correct user for logon. For details on changing the service
user, see the Hardening section of the UCMDB Help.

5. In the Dependencies tab, ensure that the service is configured to have no dependencies (<No Dependencies>).

Problem: Cannot access some modules from the UCMDB admin UI after upgrading server in Azure.

Solution: To resolve the issue, do the following:

1. Stop the Java process from <UCMDBServer>\bin\jre directory to make sure there is no UCMDB Server JRE
getting stuck.

2. Check if local_policy.jar and US_export_policy.jar are present in the <UCMDB_Server>\bin\jre\lib\security

folder, if yes, remove them.

Troubleshooting Deployment - Keystore and Truststore

Troubleshooting Keystore and Truststore - Non-FIPS mode

Problem: UCMDB server startup failed, and the startup.log shows message similar to the following:

2018-07-04 08:32:17,074 ERROR [WrapperSimpleAppMain] (JettyManager.java:247) - Failure star

MultiException[java.io.IOException: Keystore was tampered with, or password was incorrect, ja
at org.eclipse.jetty.server.Server.doStart(Server.java:329)
at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68
at com.mercury.topaz.cmdb.server.manage.servlet.JettyManager.startServer(JettyManager
at com.mercury.topaz.cmdb.server.manage.Framework.doStart0(Framework.java:242)
at com.mercury.topaz.cmdb.server.manage.Framework.access$100(Framework.java:102)
at com.mercury.topaz.cmdb.server.manage.Framework$2.executeInContext(Framework.java:2
at com.mercury.topaz.cmdb.server.manage.Framework$2.executeInContext(Framework.java:2
at com.mercury.topaz.cmdb.shared.manage.AuthorizationContextUtils.executeInSystemAuth
at com.mercury.topaz.cmdb.server.manage.Framework.start0(Framework.java:218)
at com.mercury.topaz.cmdb.server.manage.Framework.doStartUp(Framework.java:204)
at com.mercury.topaz.cmdb.server.manage.Framework.access$000(Framework.java:102)
at com.mercury.topaz.cmdb.server.manage.Framework$1.executeInContext(Framework.java:1
at com.mercury.topaz.cmdb.server.manage.Framework$1.executeInContext(Framework.java:1
at com.mercury.topaz.cmdb.shared.manage.AuthorizationContextUtils.executeInSystemAuth
at com.mercury.topaz.cmdb.server.manage.Framework.startUp(Framework.java:183)
at com.hp.ucmdb.server.Main.startFramework(Main.java:34)
at com.hp.ucmdb.server.Main.main(Main.java:23)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:
at java.lang.reflect.Method.invoke(Method.java:498)
at org.tanukisoftware.wrapper.WrapperSimpleApp.run(WrapperSimpleApp.java:325)
at java.lang.Thread.run(Thread.java:745)

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 69/75
6/22/2020 Configuration Management System (CMS)

Solution A:

Check the verify_store_pass.log (in the C:\UCMDB\UCMDBServer\runtime\log folder), if you see the following
message:

INFO: server-storepass.conf file exists and it contains keystore and truststore.

Do the following:

1. Stop the UCMDB Server.

2. Run commands.

a. Check keystore password.

Windows:

From C:\UCMDB\UCMDBServer\bin\jre\bin, run the following commands.

keytool -list -keystore C:\UCMDB\UCMDBServer\conf\security\server.keystore

Linux:

From /opt/UCMDB/UCMDBServer/bin/jre/bin, run the following commands:

./keytool -list -keystore /opt/UCMDB/UCMDBServer/conf/security/server.keystore

Enter the password that you set up during the installation of UCMDB server. If you see the following message:

keytool error: java.io.IOException:Keystore was tampered with, or password was incorrect.

Then the password was not properly set, and you need to change keystore and truststore passwords using
keytool.

b. Change the store password:

Windows:

keytool -storepasswd -new <new_keystore_pass> -keystore C:\UCMDB\UCMDBServer\conf\secur

Linux:

./keytool -storepasswd -new <new_keystore_pass> -keystore /opt/UCMDB/UCMDBServer/conf/s

c. Change the key password (if the store is not empty):

Windows:

keytool -keypasswd -alias <alias> -keypass <currentPass> -new <newPass> -keystore C:\UC

Linux:

./keytool -keypasswd -alias <alias> -keypass <currentPass> -new <newPass> -keystore /op

d. Change the trust store password:

Windows:

keytool -storepasswd -new <new_truststore_pass> -keystore C:\UCMDB\UCMDBServer\conf\se

Linux:

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 70/75
6/22/2020 Configuration Management System (CMS)

./keytool -storepasswd -new <new_truststore_pass> -keystore /opt/UCMDB/UCMDBServer/con

3. Start the UCMDB Server service.

Solution B:

Check the verify_store_pass.log, if you see the following message:

INFO: keystore password and truststore password don't exist.

Or the following:

INFO: server-storepass.conf file doesn't exist.

Do the following:

1. Generate the server-storepass.conf file.

Windows:

From the C:\UCMDB\UCMDBServer\bin folder, run the following command:

key-truststore.bat -f<fips_mode> -k<new_keystore_pass> -t<new_truststore_pass>

Linux:

From the /opt/UCMDB/UCMDBServer/bin folder, run the following command:

./key-truststore.sh -f<fips_mode> -k<new_keystore_pass> -t<new_truststore_pass>

where -f<fips_mode> can be only set to true or false (case-insensitive). The default value is false, which
means if the command does not contain -f<fips_mode>, then the script will regard this parameter as false. For
non-FIPS mode UCMDB server, false for -f<fips_mode>.

2. Stop the UCMDB Server.

3. Change keystore password and truststore password with keytool.

From the C:\UCMDB\UCMDBServer\bin\jre\bin (Windows) or /opt/UCMDB/UCMDBServer/bin/jre/bin (Linux)

folder, run the following commands:

a. Change the store password:

Windows:

keytool -storepasswd -new <new_keystore_pass> -keystore C:\UCMDB\UCMDBServer\conf\secur

Linux:

./keytool -storepasswd -new <new_keystore_pass> -keystore /opt/UCMDB/UCMDBServer/conf/s

b. Change the key password (if the store is not empty):

Windows:

keytool -keypasswd -alias <alias> -keypass <currentPass> -new <newPass> -keystore C:\UC

Linux:

./keytool -keypasswd -alias <alias> -keypass <currentPass> -new <newPass> -keystore /op

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 71/75
6/22/2020 Configuration Management System (CMS)

c. Change the trust store password:

Windows:

keytool -storepasswd -new <new_truststore_pass> -keystore C:\UCMDB\UCMDBServer\conf\sec

Linux:

./keytool -storepasswd -new <new_truststore_pass> -keystore /opt/UCMDB/UCMDBServer/conf

4. Start the UCMDB Server service.

Solution C:

If you only changed keystore password or truststore password during UCMDB server installation, and then server
startup failed and the startup.log shows similar error messages as shown above. You can follow the instructions
provided in Solution A or Solution B, but you need to change the keystore password or truststore password that you
set during installation.

For example, if you only changed truststore password during installation and you need to generate server-
storepass.conf, run the following command:

Windows: key-truststore.bat -f<fips_mode> -t<new_truststore_pass>

Linux: ./key-truststore.sh -f<fips_mode> -t<new_truststore_pass>

Problem: You have changed schema in UCMDB Server. The server startup failed and the startup.log shows the
following message:

2018-07-04 08:32:17,074 ERROR [WrapperSimpleAppMain] (JettyManager.java:247) - Failure star

MultiException[java.io.IOException: Keystore was tampered with, or password was incorrect, ja
at org.eclipse.jetty.server.Server.doStart(Server.java:329)
at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68
at com.mercury.topaz.cmdb.server.manage.servlet.JettyManager.startServer(JettyManager
at com.mercury.topaz.cmdb.server.manage.Framework.doStart0(Framework.java:242)
at com.mercury.topaz.cmdb.server.manage.Framework.access$100(Framework.java:102)
at com.mercury.topaz.cmdb.server.manage.Framework$2.executeInContext(Framework.java:2
at com.mercury.topaz.cmdb.server.manage.Framework$2.executeInContext(Framework.java:2
at com.mercury.topaz.cmdb.shared.manage.AuthorizationContextUtils.executeInSystemAuth
at com.mercury.topaz.cmdb.server.manage.Framework.start0(Framework.java:218)
at com.mercury.topaz.cmdb.server.manage.Framework.doStartUp(Framework.java:204)
at com.mercury.topaz.cmdb.server.manage.Framework.access$000(Framework.java:102)
at com.mercury.topaz.cmdb.server.manage.Framework$1.executeInContext(Framework.java:1
at com.mercury.topaz.cmdb.server.manage.Framework$1.executeInContext(Framework.java:1
at com.mercury.topaz.cmdb.shared.manage.AuthorizationContextUtils.executeInSystemAuth
at com.mercury.topaz.cmdb.server.manage.Framework.startUp(Framework.java:183)
at com.hp.ucmdb.server.Main.startFramework(Main.java:34)
at com.hp.ucmdb.server.Main.main(Main.java:23)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:
at java.lang.reflect.Method.invoke(Method.java:498)
at org.tanukisoftware.wrapper.WrapperSimpleApp.run(WrapperSimpleApp.java:325)
at java.lang.Thread.run(Thread.java:745)

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 72/75
6/22/2020 Configuration Management System (CMS)

Solution: You need to re-generate server-storepass.conf, because the new schema does not store any keystore
and truststore passwords.

If you remember what passwords were specified previously, you can generate the server-storepass.conf file with
the following command:

Windows: key-truststore.bat -f<fips_mode> -k<new_keystore_pass> -t<new_truststore_pass>

Linux: ./key-truststore.sh -f<fips_mode> -k<new_keystore_pass> -t<new_truststore_pass>

where -f<fips_mode> can be only set to true or false (case-insensitive). For non-FIPS mode UCMDB server,
false for -f<fips_mode>.

If you don't remember the passwords, follow the instructions in Solution B to regenerate the passwords.

Troubleshooting Deployment - Logging In to UCMDB

This section includes the following:

Possible Causes for Failure to Log In to UCMDB

Java Not Installed on Client Machine

Possible Causes for Failure to Log In to UCMDB

Use the following information to troubleshoot possible causes of failure to log into Universal CMDB.

Problem/Possible Causes Solutions

Universal CMDB is not started Solution 1: Verify that the Universal CMDB Server is up and running by
successfully. accessing the Web console https://<Server name>:8443/web-console
where <server name> is the name of the Universal CMDB Server to
Indication: The startup.log file does which you are connecting.
not include the following line:
Solution 2: Check the database connection:
**** All components started ****
To check that the database server is up and running:

1. Launch the Web browser and navigate to:

https://localhost:8443/jmx-console.
2. Under UCMDB, click UCMDB:service=Dal Services to open the
JMX MBean View.
3. Invoke the function getDbContext with a customerID parameter
value of 1.
4. Check that the operation result shows no problems.

Solution 3: Check that the database connection parameters are correct.

Ensure that you can log into the database server using the credentials
you provided during the configuration procedure.

Solution 4: Use the cmdb.dal.log file to verify the database

connections. The cmdb.dal.log file can be found in the following
directory:

Windows: C:\UCMDB\UCMDBServer\runtime\log
Linux: /opt/UCMDB/UCMDBServer/runtime/log

Solution 5: To verify that the database connection is valid, in the

Windows command interpreter (cmd.exe), type sqlplus
cmdb/cmdb@skazal.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 73/75
6/22/2020 Configuration Management System (CMS)

Problem/Possible Causes Solutions

The CMDB is corrupted (for example, a Import a previously backed up database file. For details, see the
user record may have been deleted Database section of UCMDB Help.
accidentally from the CMDB).

Important: The Universal CMDB server must be down while importing

the database.

Note: When you import a previously backed up database file, you

lose all data previously existing in the system.

The Universal CMDB login fails. This Solution 1: Ensure that you enter a correct login user name/password
may be due to an incorrect login combination.
name/password combination.
Solution 2: Restore the default

Universal CMDB login fails due to Solution 1: Select Start > All Programs > UCMDB > Universal CMDB
unexpected errors. Server Status and ensure that the service is running.

Solution 2: Look for errors in the following log files:

C:\UCMDB\UCMDBServer\runtime\log\error.log
C:\UCMDB\UCMDBServer\runtime\log\ui-server.log

If you find errors that are unfamiliar to you, contact Micro Focus
Software Support.

Universal CMDB fails to start, even Restore the default passwords:

though the password was successfully
changed. 1. Overwrite the existing file by copying the Basic_Authorization.zip
file from the following folder:
Windows: C:\UCMDB\UCMDBServer\content\backup
Linux: /opt/UCMDB/UCMDBServer/content/backup

to the following folder:

Windows: C:\UCMDB\UCMDBServer\content/basic_packages
Linux: /opt/UCMDB/UCMDBServer/content/basic_packages

2. Log into the the JMX Console and locate the UCMDB-
UI:name=UCMDB Integration service.
3. Run setCMDBSuperIntegrationUser by using the credentials of
UISysadmin.
4. Stop the UCMDB Server.
5. Create a new schema.
6. Restart the UCMDB Server.

After upgrading UCMDB from version For more details about the problematic scenario, possible cause and
10.30 (or earlier) to 10.31 (or later), solutions, see Troubleshooting Hybrid User Management in the CMS
LDAP authentication fails and users Help.
cannot log in to UCMDB.

Java Not Installed on Client Machine

If Java is not installed on your machine or you have a version older than Java 8, during login a message is displayed
asking you to install the correct Java Runtime Environment version. JRE is needed to view Universal CMDB applets.

Click the relevant button to allow Universal CMDB to install Java from either oracle.com or the Universal CMDB
Server.

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 74/75
6/22/2020 Configuration Management System (CMS)

© Copyright 2011 - 2020 Micro Focus or one of its affiliates

https://docs.microfocus.com/UCMDB/2020.05/ucmdb-docs/docs/eng/pdfs/Deployment_Guide/Guide/UCMDB_Deployment.htm 75/75