This section describes the system management features that are new in this release. These features enable you to configure services with seamless configuration management, automate configuration enforcements across systems, and provide secure, remote administrative access.
See also Configure Immutable Zones by Running in the Trusted Path.
Oracle Solaris provides many system observability tools, including statistics tools (such as mpstat), DTrace, and audit records. The Oracle Solaris System Web Interface Dashboard enables you to more easily view different kinds of single system and application performance data together graphically for more effective observability and analysis. Identify current system state, and visualize statistics, faults, and administrative changes over time and compared with other time periods. Open a data sheet to see more details and additional related data. Compare current and historical data graphs to visualize anomalies and trends, view related data in graphs in additional charts on the same page, and view events such as audit events on the same graph with other data.
The Oracle Solaris System Web Interface Dashboard visually shows current and recent performance, any recent system faults, and other events. This combination of information helps you determine which system resources to examine to diagnose problems.
You can view the average utilization for all of a selected type of resource or view the utilization of a single resource. For example, you can determine which applications are responsible for most of the network traffic on a system. Similarly, in addition to overall CPU usage data, you can select the zone partition of CPU usage data to determine which zones are using the CPU the most. You can determine whether a resource is allocated to a particular zone or workload.
For more information, see Using Oracle Solaris 11.4 StatsStore and System Web Interface. For information about how to store your own data in the underlying statistics store, see Adding Custom Data to the Oracle Solaris 11.4 StatsStore and System Web Interface.
On SPARC M7, M8, T7, and T8 systems, you can use the daxstat command to display DAX statistics (per-dax, per-cpu, or per-queue) in tabular form.
The daxinfo command enables users to determine the static configuration of DAX hardware available on a system. This information can be used for performance and diagnostic reporting.
For more information, see Displaying DAX Information in Managing System Information, Processes, and Performance in Oracle Solaris 11.4 and the daxstat(8) and daxinfo(8) man pages.
The Oracle Solaris Service Management Facility (SMF) provides an infrastructure for storing system configuration data in a central location, rather than within the application-specific configuration files. The previous SMF modeling capability was limited in its ability to model affiliations among configuration data.
The Oracle Solaris 11.4 release modifies the SMF property group relationship so that a property group cannot only be parented by a service or instance, but can also be parented by another property group. With the introduction of this relationship, the ability to model a greater variety of system configuration data is now possible. A consequence of adding this relationship is that when uniquely identifying a property group, you must not only consider the name, but also the lineage.
Nested property groups are subject to the same privilege model as property groups, as well as the same template verification as property groups. For more information, see the smf_template(7) man page.
Oracle Solaris 11.4 introduces three new SMF profile layers: enterprise-profile, node-profile, and sysconfig-profile. In previous releases, SMF configuration could only be applied to the site-profile and admin layers. In this release, by using multiple layers, you can apply generally useful configuration to the enterprise-profile layer, location-specific configuration to the site-profile layer, and host-specific configuration to the node-profile layer. This feature enables the effective use of SMF profiles in environments where subsets of systems or individual systems need to override more general configuration.
For more information, see Repository Layers in Managing System Services in Oracle Solaris 11.4 and Chapter 5, Configuring Multiple Systems in Managing System Services in Oracle Solaris 11.4. See also the smf(7), svccfg(8), and svcprop(1) man pages and the sysconfig(8), solaris(7), solaris-kz(7), and smf_bootstrap(7) man pages.
Oracle Solaris 11.4 includes a new type of services, goal services, which provides a single point of monitoring for configurable set of services, on which the goal services are dependent. If a dependency of a goal service cannot be satisfied, the goal service enters the maintenance state and generates a software FMA alert.
For more information, see Chapter 7, Creating a Service that Notifies if Conditions are not Satisfied in Developing System Services in Oracle Solaris 11.4 and the smf(7) and svcadm(8) man pages.
In Oracle Solaris 11.4, the new Device Usage Information feature helps in diagnosing hotplug failures. In previous releases, when the hotplug command failed to remove a busy device, the error message "Devices or resources are busy." was displayed with no further explanation, which made it difficult to diagnose the problem. Now with this feature, additional information is displayed explaining what opened or held the device, which helps in diagnosing the problem.
For example, to check if the device is busy, use the following command:
# hotplug offline /pci@0,0 pci.1,0
ERROR: devices or resources are busy.
/pci@0,0/pci8086,3408@1/pci1000,1000@0/sd@0,0:
{ Hold: module devfs (modid=6). }
{ Hold: module specfs (modid=3): spec_open() }
{ Open: process format[123501]. }
{ Open: module zfs (modid=49). }
For more information, see Managing Devices in Oracle Solaris 11.4.
Oracle Solaris 11.4 introduces the new sysadm utility that can be used to control maintenance mode for a system, and perform evacuation of zones hosted on the system. Starting a maintenance mode logs an audit record, and prevents the subsequent attach, boot, or incoming migration of any zones into the system. The host may be evacuated by migrating all solaris-kz brand zones away from the system to targets specified in a zones SMF service instance.
Maintenance mode and evacuation can be used to perform administration on a zones host, or remove it from service. You can prevent new zones from attaching or booting, migrate away any running kernel zones, perform some maintenance requiring a reboot such as updating Oracle Solaris, and finally migrate back those kernel zones, with just a few commands and no disruptions to the running kernel zones.
For more information, see the sysadm(8) man page.
The ldapservercfg utility automates the configuration of the OpenLDAP server and Oracle Unified Directory (OUD) server to support Oracle Solaris LDAP naming services and account management. The utility is integrated with the svc:/network/ldap/server:openldap SMF service and automatically configures the server when it is first enabled. It can also be run interactively to customize the OpenLDAP server configuration or to configure the OUD server. The ldapservercfg utility helps users to easily deploy OpenLDAP and OUD server on Oracle Solaris systems. It also enables the functionality for remote account management using RAD.
For more information, see the ldapservercfg(8) man page.
Puppet is cross-platform software that you can use to automate the configuration management of multiple platforms, including Oracle Solaris servers and their subsystems.
You can use Puppet to standardize and enforce resource configurations across your entire IT infrastructure. Oracle Solaris 11.4 includes core Puppet resource types, including files, packages, users, and services. In addition, many modules are included for managing other third-party software on Oracle Solaris. Finally, several Oracle Solaris specific resource types are provided for use in the Oracle Solaris release, such as Oracle Solaris zones.
The new Oracle Solaris Puppet configuration option config/degrade_smf_on_error Degrade_smf_on_error causes the puppet:agent service to change state to degraded when a resource error occurs during Puppet manifest application. Puppet continues to run after being marked degraded. This option makes resource errors in Puppet manifest applications more visible to the user.
Note that Oracle Solaris 11.4 supports Puppet 5.5. This software package is not installed by default on your system.
If a system has a previous Puppet version installed, that version will be automatically upgraded to Puppet 5.5. See What’s New in Puppet in Oracle Solaris 11.4 in Using Puppet to Perform Configuration Management in Oracle Solaris 11.4 for important information about this upgrade.
For general information about Puppet, refer to Puppet Documentation.
The Marionette Collective, known as MCollective is a framework that enables you to more easily build and manage a large number of servers. While working with a large number of servers, it is difficult to rely on a static list of tools for system management. MCollective uses a discovery method that is based on metadata, as well as filtering to search for hosts.
MCollective also uses a publish-subscribe pattern to broadcast request to all of the servers that are connected to the middleware component. These requests have filters that are attached so that only those servers matching a filter will act on the requests.
For more information, see Using Puppet to Perform Configuration Management in Oracle Solaris 11.4 and Using MCollective Command Line Applications.
Augeas is a library and command-line tool that provides a unified way to edit UNIX configuration files of differing formats. When invoked, Augeas provides a command-line interface where configuration files can be read and presented in a tree format. This data can then be manipulated within the Augeas interface. Data is then translated back into the format of the original configuration files for saving.
Augeas provides a single public API for manipulating various UNIX configuration files. Other applications can leverage this API, rather than having each application provide its own solution for modifying configuration files.
In Oracle Solaris 11.4, the functionality of qualified user attributes is extended to provide default settings for specific hosts or netgroups. LDAP-based user accounts without explicitly assigned attributes can inherit the default attributes for the host on which they are executed. If no host-based default attributes is specified, and the user is a member of a netgroup, then the attributes associated with the netgroup are inherited. This functionality simplifies administration of LDAP-based accounts by enabling them to share common user attributes based on netgroup membership.
For more information, see the user_attr(5), useradd(8), userdel(8), and usermod(8) man pages.
The useradm tool is an interactive menu-based tool for administration of user and role accounts. This tool is a replacement for the Visual Panels User Manager. The tool is implemented as a RAD client using the Python bindings described in usermgr (3RAD) (3RAD), and can be run on any terminal window. The user interface consists of hierarchical menus containing lists of available selections.
The menu-based interface of useradm simplifies the management of users and roles, supporting all aspects of account management such as access rights, auditing, and password management. All valid choices are presented in scrolling lists that enable you to interact with the keyboard and make selections by using the appropriate keystroke.
For more information, see the useradm(8) man page.
A new stackdiag feature enables fmadm faulty to display a list of bugs that might have caused the fault. Using this known bug list, you can look for solutions on My Oracle Support.
For more information, see Managing Faults, Defects, and Alerts in Oracle Solaris 11.4 and the stackdiag(1) man page.
In Oracle Solaris 11.4, the fcinfo utility has been enhanced to provide the following functionality:
Establish whether an HBA port has access to a remote port or not. The fcinfo remote-port command can show the number and details of all remote ports for each HBA port when no option is specified.
Establish the path class and the path state for all LUNs presented by an individual storage array. The fcinfo lu -v command can specify the remote port and node World Wide Name (WWN) with the –P and –N options respectively.
For more information, see the fcinfo(8) man page.
The Oracle Solaris Image Packaging System (IPS) has new options to help manage package repository access and troubleshoot some installation and update issues:
Ignore network cache. A new global option named –-no-network-cache is added to ignore cached network data.
Problems with accessing package data can be caused by caching proxies between the package client and network-based package repositories. To troubleshoot such problems, use the –-no-network-cache option to always get package data from a repository and not from any caches that an HTTP proxy might have.
For more information, see Initial Troubleshooting Steps in Updating Systems and Adding Software in Oracle Solaris 11.4 and the pkg(1) man page.
Enable or disable a specific origin. The combination of –d, –e, and –g of the pkg set-publisher subcommand can be used to enable or disable a specific origin of a publisher.
For more information, see Enabling and Disabling Publisher Origins in Updating Systems and Adding Software in Oracle Solaris 11.4 and the pkg(1) man page.
IPS also has better error messaging. For example, an error message that reports a missing file entry also includes the package that delivers the file.