What is the impact of UID changes to users that run CA Performance Management

Products

• CA Performance Management
• Network Observability

Issue/Introduction

Unix Operations team requires a change to system user UID values in order to meet acceptance requirements.

We once had an issue with the older version of Vertica that utilized a "spread" account.

We have upgraded to r3.6 and want to be sure the system isn't impacted by the changes pending by the Unix Operations team.

What effects, if any will this have on the operation of any aspect of Performance Management?

What problems would by caused by a change to the UID for system user accounts which the Performance Management install uses or created?

Environment

All supported Performance Management releases

Resolution

In general if the Data Aggregator (DA), Data Collector (DC), and NetOps Portal servers are installed and running as the root user, there should be no impact or further changes needed as a result of the root users UID changing.

If any of the following systems CAPM services run as a non-root (ie: sudo root) user the following steps need to be undertaken.

NetOps Portal

• For the four primary NetOps Portal services:
  
  • All four NetOps Portal services need to be stopped
    
    • Includes the NetOps Portal Console (caperfcenter_console), Device Manager (caperfcenter_devicemanager), Event Manager (caperfcenter_eventmanager) and SSO (caperfcenter_sso) services
  • Run a chown against the install area (/opt/CA default) owned by the old UID with the new UID.
  • Restart the four NetOps Portal Services services. 
• .For the MySql user account for the MySql databases:
  
  • Stop the mysql service
  • Run a chown against all files in /opt/CA/MySql owned by the old UID with the new UID.
  • Restart the mysql service
• Note: To stop mysql we must first stop the four primary NetOps Portal services. Recommendation is to bring down all five services (four Performance Management services and mysql service), make the UID changes via chown command, ,and restart the services.

CA Data Aggregator (DA)

• Stop the dadaemon service
• Stop the activemq service
• Run a chown against the install area (/opt/IMDataAggregator default) owned by the old UID with the new UID.
• Start the dadaemon service. It will restart the activemq service.

CA Data Repository (DR)

The dradmin or equivalent database user runs the Vertica database on the DR system. If the UID changes for the user the following needs to be done
Note the original UID of the dradmin user as it will be needed in a later step as well:

• Enter adminTools and stop the database from running
• Run a chown -R dradmin against the following directories as the dradmin after dradmin UID change on each node:
  
  • ~dradmin (dradmin home directory shortcut)
  • /data (or equivalent)
  • /catalog (or equivalent)
  • cd  /opt/vertica, the using the original UID of the user, run the following to update the files that need to be changed:
     find . -uid <original UID> -exec chown dradmin  {} \;
    
    
• Restart the database

CA Data Collector (DC)
The DC has both the dcmd and activemq services that work together and may be owned by the root or sudo root install owner. It also has the icmpd daemon service but this is always owned by root.

• For the primary dcmd and activemq services:
  
  • Stop the dadaemon service
  • Stop the activemq service
  • Run a chown against the install area (/opt/IMDataAggregator default) owned by the old UID with the new UID.
  • Start the dadaemon service. It will restart the activemq service.
• For the icmpd daemon service that always is owned by and runs as root no change is needed

Additional Information

Full service restart instructions can be found in the following Knowledge Base Article:

https://knowledge.broadcom.com/external/article?articleId=32043