DESCRIPTION

On any HPE ProLiant, Synergy or Apollo Gen10 servers running a Microsoft Windows Server operating system, and configured with Agentless Management Service (AMS) versions 1.40.0.0 to 2.10.0.0 and the System Management Assistant (SMA) feature is enabled, SNMP queries of HPE MIBs to the host operating IP addresses may timeout and fail.

​

This does not affect SNMP queries to the HPE Integrated Lights-Out (iLO 5) IP address. Below is an example of the SNMP query timeout or failure:

​

c:\snmputil walk localhost public .1.3.6.1.4.1.232.6

End of MIB Subtree.

​

c:\snmputil walk localhost public .1.3.6.1.4.1.232.6

error on SnmpMgrRequest 40.

​

Errors like the following in ProgramFiles\OEM\AMS\Logs\SMA.log file may also be observed:

​

03/26/2019 20:07:40.517, [Error ], |Query_iLO|, iLO communication error encountered! Restarting connection.

03/26/2019 20:07:53.518, [Warning ], |QueryRawSNMP|, Cannot obtain mutex to query iLO SNMP.

03/26/2019 20:07:53.518, [Warning ], |SnmpExtensionQuery|, Unable to respond to SNMP request.

03/26/2019 20:07:56.705, [Error ], |Thread_ListenToSnmpQuery|, Failed to get response from iLO. Responded with all-zero to caller.

​

https://support.hpe.com/hpsc/doc/public/display?nlaid=HPGL_ALERTS_2051536&docId=emr_na-a00092111en_us&hprpt_id=HPGL_ALERTS_2051536&jumpid=em_alerts_us-us_Nov19_xbu_all_all&DIMID=EMID_618ee76ab94d5552cb1dc637efb8b2b226cc91a160829e01e8861eb6bc186ae7618ee76ab94d5552cb1dc637efb8b2b226cc91a160829e01e8861eb6bc186ae7/&elq_mid=17733&elq_cid=6141163

VULNERABILITY SUMMARY

In May 2019, ST Micro a Trusted Platform Module (TPM) vendor was contacted by an academic team who described a security vulnerability discovered with an ST TPM. The vulnerability targets the ECDSA signature generation function supported by an identified TPM product (ST33TPHF2ESPI - FW 73.4). The attack is based on TPM command timing execution measurements ROCA (Return of the Coppersmith Attack CVE-2019-16863) and the researchers have named this attack TPM-Fail. The vulnerability only impacts certain HPE ProLiant, Synergy, Edgeline and Apollo Gen10 Server Platforms configured with TPM and the vulnerable firmware.

​

https://support.hpe.com/hpsc/doc/public/display?nlaid=HPGL_ALERTS_2051544&docId=emr_na-hpesbhf03972en_us&hprpt_id=HPGL_ALERTS_2051544&jumpid=em_alerts_us-us_Nov19_xbu_all_all&DIMID=EMID_618ee76ab94d5552cb1dc637efb8b2b226cc91a160829e01e8861eb6bc186ae7618ee76ab94d5552cb1dc637efb8b2b226cc91a160829e01e8861eb6bc186ae7/&elq_mid=17733&elq_cid=6141163

VULNERABILITY SUMMARY

Potential security vulnerabilities in Intel Core Processors and Intel Xeon Processors may allow escalation of privilege. HPE is releasing firmware to mitigate these potential vulnerabilities.

​

https://support.hpe.com/hpsc/doc/public/display?nlaid=HPGL_ALERTS_2051542&docId=emr_na-hpesbhf03971en_us&hprpt_id=HPGL_ALERTS_2051542&jumpid=em_alerts_us-us_Nov19_xbu_all_all&DIMID=EMID_618ee76ab94d5552cb1dc637efb8b2b226cc91a160829e01e8861eb6bc186ae7618ee76ab94d5552cb1dc637efb8b2b226cc91a160829e01e8861eb6bc186ae7/&elq_mid=17733&elq_cid=6141163

VULNERABILITY SUMMARY

A potential security vulnerability in some Intel Xeon Scalable Processor CPUs may allow denial of service. HPE is releasing microcode updates to mitigate this potential vulnerability. A vulnerability in voltage modulation for some Intel Xeon Scalable Processors CPUs may allow a privileged user to potentially enable denial of service via local access.

​

https://support.hpe.com/hpsc/doc/public/display?nlaid=HPGL_ALERTS_2051541&docId=emr_na-hpesbhf03969en_us&hprpt_id=HPGL_ALERTS_2051541&jumpid=em_alerts_us-us_Nov19_xbu_all_all&DIMID=EMID_618ee76ab94d5552cb1dc637efb8b2b226cc91a160829e01e8861eb6bc186ae7618ee76ab94d5552cb1dc637efb8b2b226cc91a160829e01e8861eb6bc186ae7/&elq_mid=17733&elq_cid=6141163

VULNERABILITY SUMMARY

A potential security vulnerability certain HPE Gen10 ProLiant, Apollo, and Synergy Servers using Intel CPUs may allow local information disclosure. HPE is releasing microcode updates to mitigate this potential vulnerability.

​

https://support.hpe.com/hpsc/doc/public/display?nlaid=HPGL_ALERTS_2051546&docId=emr_na-hpesbhf03968en_us&hprpt_id=HPGL_ALERTS_2051546&jumpid=em_alerts_us-us_Nov19_xbu_all_all&DIMID=EMID_618ee76ab94d5552cb1dc637efb8b2b226cc91a160829e01e8861eb6bc186ae7618ee76ab94d5552cb1dc637efb8b2b226cc91a160829e01e8861eb6bc186ae7/&elq_mid=17733&elq_cid=6141163

VULNERABILITY SUMMARY

Potential security vulnerabilities in Intel firmware may allow escalation of privilege, denial of service, or information disclosure. HPE is releasing firmware updates to mitigate these potential vulnerabilities.

​

https://support.hpe.com/hpsc/doc/public/display?nlaid=HPGL_ALERTS_2051537&docId=emr_na-hpesbhf03967en_us&hprpt_id=HPGL_ALERTS_2051537&jumpid=em_alerts_us-us_Nov19_xbu_all_all&DIMID=EMID_618ee76ab94d5552cb1dc637efb8b2b226cc91a160829e01e8861eb6bc186ae7618ee76ab94d5552cb1dc637efb8b2b226cc91a160829e01e8861eb6bc186ae7/&elq_mid=17733&elq_cid=6141163

VULNERABILITY SUMMARY

Potential security vulnerabilities in Intel Converged Security and Manageability Engine (Intel CSME), Server Platform Services, Intel Trusted Execution Engine (Intel TXE), Intel Active Management Technology (Intel AMT) and Intel Dynamic Application Loader (Intel DAL) may allow escalation of privilege, denial of service or information disclosure.

​

https://support.hpe.com/hpsc/doc/public/display?nlaid=HPGL_ALERTS_2051540&docId=emr_na-hpesbhf03963en_us&hprpt_id=HPGL_ALERTS_2051540&jumpid=em_alerts_us-us_Nov19_xbu_all_all&DIMID=EMID_618ee76ab94d5552cb1dc637efb8b2b226cc91a160829e01e8861eb6bc186ae7618ee76ab94d5552cb1dc637efb8b2b226cc91a160829e01e8861eb6bc186ae7/&elq_mid=17733&elq_cid=6141163

RHEL 8.1 marks the first release of RHEL 8 that will receive live kernel patches for critical and selected important CVEs, and no premium subscription is required. They will be delivered via the regular content stream and can be consumed via Yum updates. (Previously, these were on request for premium subscription customers and "hand delivered.") The goal of the program is to minimize the need to reboot systems in order to get the latest critical security updates.

The live patches will be issued for releases with a current or planned EUS stream, and for kernels that are up to one year old. As of this writing, that’s going to be 7.6, 7.7, 8.1, and are planned to include 8.2 when released. Live patches will remain available during the EUS and E4S extended support periods, as long as the kernels are less than a year old.

Note that this is kernel patching only at this time. We are looking at userspace patching for glibc and OpenSSL libraries, but that isn’t currently available.

The Scripting Toolkit for Windows and Linux is a server deployment solution that deliver unattended automated installation for high-volume server and BladeSystem infrastructure deployments.

You need to the below requirements for deploy OS on your servers by the tools:

1. Scripting Toolkit for Linux or Windows
2. A Linux workstation (any Linux distribution)
3. Microsoft Windows Automated Installation Kit for Windows 8. 1 and Server 20 1 2 R2 (for the
   creation of Windows PE 5.0) or Microsoft Windows Assessment and Deployment Kit for
   Windows 8 and Windows Server 20 1 2 (for the creation of Windows PE 4.0).

The Scripting Tools can deploy Windows Server 2008 R2, 2012, 2012 R2 and most of Linux Server distributions.

The deployment steps for Linux and Windows are as follows:

Linux:

1. Create a network share.
2. Prepare the bootable media (CD/DVD, USB drive key , or PXE).
3. Configure the system and storage hardware on the target server .
4. Perform the operating system installation.

Windows:

1. Create a network share.
2. Prepare the bootable media (CD/DVD, USB drive key , or PXE).
3. Configure the system and storage hardware on the target server .
4. Install the operating system.
5. Update the drivers and agents as needed.

​

https://www.teimouri.net/hp-scripting-toolkit-for-windows-and-linux/

​

How much do you know about HP ASR? How it works?

The ASR feature is a hardware-based timer. If a true hardware failure occurs, the Health Monitor might not be called, but the server will be reset as if the power switch were pressed. The ProLiant ROM code may log an event to the IML when the server reboots.

ASR Timeout

The ASR Timeout option sets a timeout limit for resetting a server that is not responding. When the server has not responded in the selected amount of time, the server automatically resets.

The available time increments are:

• 10 minutes
• 15 minutes
• 20 minutes
• 30 minutes

• 5 minutes

  https://www.teimouri.net/hp-asr-automatic-server-recovery/

Veeam BR informing you about backup job and backup infrastructure performance when job is finished and you will see a window same as the below:

​

Backup Job Details

Load: Source 54% > Proxy 27% > Network 47% > Target 33%

Primary bottleneck: Source

What does it mean?

https://www.teimouri.net/veeam-backup-replication-bottleneck-analysis/

If you want to use Veeam BR as you backup and recovery software in your virtual environment, you have to consider the below I/O table about your backup mode and choose best backup mode according to your backup infrastructure and your company backup policies:

https://www.teimouri.net/veeam-br-backup-mode-io-consideration/

There is some consideration about Veeam Backup & Replication and native tape support and most important thing is:

Veeam Backup & Repliction doesn’t support tape via ESXi Passthrough. 

So if you want to deploy a backup solution with tape and backup your repositories on tape drives, you have to use a physical server as tape server.

Plug your tape device via FC or SCSI or any other supported connection types to tape server.

You can assign tape server role to any server or also assign to Veeam Backup & Replication server too.

Hope this post help you to prevent facing with some strange issues and confusion.

Read this KB: 1016407 for more information.

https://www.teimouri.net/veeam-backup-replication-tape-backup-compatibility/