Administering Red Hat Satellite

Procedure

1. Identify the fully qualified domain name of your Satellite Server:

   # hostname -f

2. Access the pub directory on your Satellite Server using a web browser pointed to the fully qualified domain name:

   https://satellite.example.com/pub

3. When you access Satellite for the first time, an untrusted connection warning displays in your web browser. Accept the self-signed certificate and add the Satellite URL as a security exception to override the settings. This procedure might differ depending on the browser being used. Ensure that the Satellite URL is valid before you accept the security exception.
4. Select katello-server-ca.crt.
5. Import the certificate into your browser as a certificate authority and trust it to identify websites.

CLI procedure

1. From the Satellite CLI, copy the katello-server-ca.crt file to the machine you use to access the Satellite web UI:

   # scp /var/www/html/pub/katello-server-ca.crt username@hostname:remotefile

2. In the browser, import the katello-server-ca.crt certificate as a certificate authority and trust it to identify websites.

Procedure

1. Access Satellite Server using a web browser pointed to the fully qualified domain name:

   https://satellite.example.com/

2. Enter the user name and password created during the configuration process. If a user was not created during the configuration process, the default user name is admin. If you have problems logging in, you can reset the password. For more information, see Section 1.8, “Resetting the administrative user password”.

Procedure

1. Obtain a Kerberos ticket-granting ticket (TGT) on behalf of a Satellite user:

   $ kinit idm_user

   Warning

   If, when you were setting Red Hat Identity Management to be the authentication provider, you enabled access to both the Satellite API and the Satellite web UI, an attacker can now obtain an API session after the user receives the Kerberos TGT. The attack is possible even if the user did not previously enter the Satellite login credentials anywhere, for example in the browser.

2. If automatic negotiate authentication is not enabled, use the TGT to authenticate to Hammer manually:

   $ hammer auth login negotiate

3. Optional: Destroy all cached Kerberos tickets in the collection:

   $ kdestroy -A

Procedure

1. Obtain the Kerberos ticket granting ticket (TGT) for yourself using your Red Hat Identity Management credentials:

   $ kinit idm_user
   Password for idm_user@EXAMPLE.COM:

2. In your browser address bar, enter the URL of your Satellite Server.

   You are logged in automatically.

Procedure

1. Enable the Chrome browser to use Kerberos authentication:

   $ google-chrome --auth-server-whitelist="*.example.com" --auth-negotiate-delegate-whitelist=”*.example.com"

   Note

   Instead of allowlisting the whole domain, you can also allowlist a specific Satellite Server.

2. Obtain the Kerberos ticket-granting ticket (TGT) for yourself using your Red Hat Identity Management credentials:

   $ kinit idm_user
   Password for idm_user@_EXAMPLE.COM:

3. In your browser address bar, enter the URL of your Satellite Server.

   You are logged in automatically.

Procedure

1. In the Satellite web UI, click your user name at the top right corner.
2. Select My Account from the menu.
3. In the Current Password field, enter the current password.
4. In the Password field, enter a new password.
5. In the Verify field, enter the new password again.
6. Click Submit to save your new password.

To reset the administrative user password

1. Log in to the base operating system where Satellite Server is installed.

2. Enter the following command to reset the password:

   # foreman-rake permissions:reset
   Reset to user: admin, password: qwJxBptxb7Gfcjj5

3. Use this password to reset the password in the Satellite web UI.

4. Edit the ~/.hammer/cli.modules.d/foreman.yml file on Satellite Server to add the new password:

   # vi ~/.hammer/cli.modules.d/foreman.yml

To set a new administrative user password

1. Log in to the base operating system where Satellite Server is installed.

2. To set the password, enter the following command:

   # foreman-rake permissions:reset password=new_password

3. Edit the ~/.hammer/cli.modules.d/foreman.yml file on Satellite Server to add the new password:

   # vi ~/.hammer/cli.modules.d/foreman.yml

Procedure

1. In the Satellite web UI, navigate to Administer > Settings, and click the General tab.
2. Click the edit button next to Login page footer text, and enter the desired text to be displayed on the login page. For example, this text may be a warning message required by your company.
3. Click Save.
4. Log out of the Satellite web UI and verify that the custom text is now displayed on the login page below the Satellite version number.

1. Back up the source server.
2. Clone the source server to the target server.
3. Power off the source server.
4. Update the network configuration on the target server to match the target server’s IP address with its new host name.
5. Test the new target server.

1. Perform a backup with PostgreSQL databases active excluding the Pulp data:

   # satellite-maintain backup offline --skip-pulp-content \
   --assumeyes /var/backup

2. Stop and disable Satellite services:

   # satellite-maintain service stop
   # satellite-maintain service disable

3. Copy the Pulp data to the target server:

   # rsync --archive --partial --progress --compress \
   /var/lib/pulp/ target_server.example.com:/var/lib/pulp/

Procedure

1. Use the instructions in Attaching the Satellite Infrastructure Subscription to attach a Satellite subscription to your server.

2. Disable all repositories and enable only the following repositories:

   # subscription-manager repos --disable '*'
   # subscription-manager repos \
   --enable=satellite-6.15-for-rhel-8-x86_64-rpms \
   --enable=satellite-maintenance-6.15-for-rhel-8-x86_64-rpms \
   --enable=rhel-8-for-x86_64-baseos-rpms \
   --enable=rhel-8-for-x86_64-appstream-rpms

3. Enable the following module:

   # dnf module enable satellite:el8

   Note

   Enablement of the module satellite:el8 warns about a conflict with postgresql:10 and ruby:2.5 as these modules are set to the default module versions on Red Hat Enterprise Linux 8. The module satellite:el8 has a dependency for the modules postgresql:12 and ruby:2.7 that will be enabled with the satellite:el8 module. These warnings do not cause installation process failure, hence can be ignored safely. For more information about modules and lifecycle streams on Red Hat Enterprise Linux 8, see Red Hat Enterprise Linux Application Streams Lifecycle.

Procedure

1. To install PostgreSQL, enter the following command:

   # dnf install postgresql-server postgresql-evr postgresql-contrib

2. To initialize PostgreSQL, enter the following command:

   # postgresql-setup initdb

3. Edit the /var/lib/pgsql/data/postgresql.conf file:

   # vi /var/lib/pgsql/data/postgresql.conf

   Note that the default configuration of external PostgreSQL needs to be adjusted to work with Satellite. The base recommended external database configuration adjustments are as follows:

   • checkpoint_completion_target: 0.9
   • max_connections: 500
   • shared_buffers: 512MB
   • work_mem: 4MB

4. Remove the # and edit to listen to inbound connections:

   listen_addresses = '*'

5. Edit the /var/lib/pgsql/data/pg_hba.conf file:

   # vi /var/lib/pgsql/data/pg_hba.conf

6. Add the following line to the file:

     host  all   all   Satellite_ip/32   md5

7. To start, and enable PostgreSQL service, enter the following commands:

   # systemctl enable --now postgresql

8. Open the postgresql port on the external PostgreSQL server:

   # firewall-cmd --add-service=postgresql

9. Make the changes persistent:

   # firewall-cmd --runtime-to-permanent

10. Switch to the postgres user and start the PostgreSQL client:

    $ su - postgres -c psql

11. Create three databases and dedicated roles: one for Satellite, one for Candlepin, and one for Pulp:

    CREATE USER "foreman" WITH PASSWORD 'Foreman_Password';
    CREATE USER "candlepin" WITH PASSWORD 'Candlepin_Password';
    CREATE USER "pulp" WITH PASSWORD 'Pulpcore_Password';
    CREATE DATABASE foreman OWNER foreman;
    CREATE DATABASE candlepin OWNER candlepin;
    CREATE DATABASE pulpcore OWNER pulp;

12. Connect to the Pulp database:

    postgres=# \c pulpcore
    You are now connected to database "pulpcore" as user "postgres".

13. Create the hstore extension:

    pulpcore=# CREATE EXTENSION IF NOT EXISTS "hstore";
    CREATE EXTENSION

14. Exit the postgres user:

    # \q

15. From Satellite Server, test that you can access the database. If the connection succeeds, the commands return 1.

    # PGPASSWORD='Foreman_Password' psql -h postgres.example.com  -p 5432 -U foreman -d foreman -c "SELECT 1 as ping"
    # PGPASSWORD='Candlepin_Password' psql -h postgres.example.com -p 5432 -U candlepin -d candlepin -c "SELECT 1 as ping"
    # PGPASSWORD='Pulpcore_Password' psql -h postgres.example.com -p 5432 -U pulp -d pulpcore -c "SELECT 1 as ping"

Procedure

1. On Satellite Server, stop Satellite services:

   # satellite-maintain service stop

2. Start the PostgreSQL services:

   # systemctl start postgresql

3. Back up the internal databases:

   # satellite-maintain backup online \
   --preserve-directory \
   --skip-pulp-content \
   /var/migration_backup

4. Transfer the data to the new external databases:

   PGPASSWORD='Foreman_Password' pg_restore -h postgres.example.com -U foreman -d foreman < /var/migration_backup/foreman.dump
   PGPASSWORD='Candlepin_Password' pg_restore -h postgres.example.com -U candlepin -d candlepin < /var/migration_backup/candlepin.dump
   PGPASSWORD='Pulpcore_Password' pg_restore -h postgres.example.com -U pulp -d pulpcore < /var/migration_backup/pulpcore.dump

5. Use the satellite-installer command to update Satellite to point to the new databases:

   # satellite-installer \
   --foreman-db-database foreman \
   --foreman-db-host postgres.example.com \
   --foreman-db-manage false \
   --foreman-db-password Foreman_Password \
   --foreman-db-username foreman \
   --foreman-proxy-content-pulpcore-manage-postgresql false \
   --foreman-proxy-content-pulpcore-postgresql-db-name pulpcore \
   --foreman-proxy-content-pulpcore-postgresql-host postgres.example.com \
   --foreman-proxy-content-pulpcore-postgresql-password Pulpcore_Password \
   --foreman-proxy-content-pulpcore-postgresql-user pulp \
   --katello-candlepin-db-host postgres.example.com \
   --katello-candlepin-db-name candlepin \
   --katello-candlepin-db-password Candlepin_Password \
   --katello-candlepin-db-user candlepin \
   --katello-candlepin-manage-db false

Procedure

1. In the Satellite web UI, navigate to Administer > Organizations.
2. Click New Organization.
3. In the Name field, enter a name for the organization.
4. In the Label field, enter a unique identifier for the organization. This is used for creating and mapping certain assets, such as directories for content storage. Use letters, numbers, underscores, and dashes, but no spaces.

5. Optional: If you do not wish to enable Simple Content Access (SCA), uncheck the Simple Content Access checkbox. For more information on SCA, see Simple Content Access.

   Note

   Red Hat does not recommend disabling SCA as entitlement mode is deprecated.

6. Optional: In the Description field, enter a description for the organization.
7. Click Submit.
8. If you have hosts with no organization assigned, select the hosts that you want to add to the organization, then click Proceed to Edit.
9. In the Edit page, assign the infrastructure resources that you want to add to the organization. This includes networking resources, installation media, kickstart templates, and other parameters. You can return to this page at any time by navigating to Administer > Organizations and then selecting an organization to edit.
10. Click Submit.

CLI procedure

1. To create an organization, enter the following command:

   # hammer organization create \
   --name "My_Organization" \
   --label "My_Organization_Label" \
   --description "My_Organization_Description"

   Note

   Organizations created this way have Simple Content Access (SCA) enabled by default. If you wish to disable SCA, add the --simple-content-access false parameter to the command. Red Hat does not advise you to disable SCA because entitlement mode (not using SCA) is deprecated.

2. Optional: To edit an organization, enter the hammer organization update command. For example, the following command assigns a compute resource to the organization:

   # hammer organization update \
   --name "My_Organization" \
   --compute-resource-ids 1

Procedure

1. In the Satellite web UI, navigate to Administer > Organizations.
2. Select an organization that you want to generate a debug certificate for.
3. Click Generate and Download.
4. Save the certificate file in a secure location.

Procedure

1. Split the private and public keys from the certificate into two files.

   1. Open the X.509 certificate, for example, for the default organization:

      $ vi 'Default Organization-key-cert.pem'

   2. Copy the contents of the file from -----BEGIN RSA PRIVATE KEY----- to -----END RSA PRIVATE KEY-----, into a key.pem file.
   3. Copy the contents of the file from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE-----, into a cert.pem file.
2. To use a browser, you must first convert the X.509 certificate to a format your browser supports and then import the certificate.

For Firefox users

1. Convert the certificate into the PKCS12 format using the following command:

   $ openssl pkcs12 -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES -export -in cert.pem -inkey key.pem -out My_Organization_Label.pfx -name My_Organization

2. In the Firefox browser, navigate to Edit > Preferences > Advanced Tab.
3. Select View Certificates and click the Your Certificates tab.
4. Click Import and select the .pfx file to load.

5. Enter the following URL in the address bar to browse the accessible paths for all the repositories and check their contents:

   https://satellite.example.com/pulp/content/

Procedure

1. In the Satellite web UI, navigate to Administer > Organizations.
2. From the list to the right of the name of the organization you want to delete, select Delete.
3. Click OK to delete the organization.

CLI procedure

1. Enter the following command to retrieve the ID of the organization that you want to delete:

   # hammer organization list

   From the output, note the ID of the organization that you want to delete.

2. Enter the following command to delete an organization:

   # hammer organization delete --id Organization_ID

Procedure

1. In the Satellite web UI, navigate to Administer > Locations.
2. Click New Location.
3. Optional: From the Parent list, select a parent location. This creates a location hierarchy.
4. In the Name field, enter a name for the location.
5. Optional: In the Description field, enter a description for the location.
6. Click Submit.
7. If you have hosts with no location assigned, add any hosts that you want to assign to the new location, then click Proceed to Edit.
8. Assign any infrastructure resources that you want to add to the location. This includes networking resources, installation media, kickstart templates, and other parameters. You can return to this page at any time by navigating to Administer > Locations and then selecting a location to edit.
9. Click Submit to save your changes.

Procedure

1. In the Satellite web UI, navigate to Administer > Locations.
2. Select Delete from the list to the right of the name of the location you want to delete.
3. Click OK to delete the location.

CLI procedure

1. Enter the following command to retrieve the ID of the location that you want to delete:

   # hammer location list

   From the output, note the ID of the location that you want to delete.

2. Enter the following command to delete the location:

   # hammer location delete --id Location ID

Procedure

1. In the Satellite web UI, navigate to Administer > Users.
2. Click the Username of the user you want to edit.
3. On the User tab, verify the value of the Mail field. Email notifications will be sent to the address in this field.
4. On the Email Preferences tab, select Mail Enabled.

5. Select the notifications you want the user to receive using the drop-down menus next to the notification types.

   Note

   The Audit Summary notification can be filtered by entering the required query in the Mail Query text box.

6. Click Submit.

   The user will start receiving the notification emails.

Procedure

1. In the Satellite web UI, navigate to Administer > Users.
2. Click on the username.

3. On the Email Preferences tab, click Test email.

   A test email message is sent immediately to the user’s email address.

1. Verify the user’s email address.
2. Verify Satellite Server’s email configuration.
3. Examine firewall and mail server logs.

4. If your Satellite Server uses the Postfix service for email delivery, the test email might be held in the queue. To verify, enter the mailq command to list the current mail queue. If the test email is held in the queue, mailq displays the following message:

   postqueue: warning: Mail system is down -- accessing queue directly
   -Queue ID-  --Size-- ----Arrival Time---- -Sender/Recipient-------
   BE68482A783    1922 Thu Oct  3 05:13:36  satellite-noreply@example.com

   To fix the problem, start the Postfix service on your Satellite Server:

   # systemctl start postfix

Procedure

1. In the Satellite web UI, navigate to Hosts > All Hosts, locate the host that you want to view, and click Edit in the Actions column.
2. Go to the Additional Information tab. If the checkbox Include this host within Satellite reporting is checked, then the email notifications are enabled on that host.

3. Optional: Toggle the checkbox to enable or disable the email notifications.

   Note

   If you want to receive email notifications, ensure that you have an email address set in your user settings.

Procedure

1. Enter the du command to estimate the size of uncompressed directories containing Satellite database and configuration files:

   # du -sh /var/lib/pgsql/data /var/lib/pulp
   100G    /var/lib/pgsql/data
   100G	/var/lib/pulp
   
   # du -csh /var/lib/tftpboot /etc /root/ssl-build \
   /var/www/html/pub /opt/puppetlabs
   16M   /var/lib/tftpboot
   37M   /etc
   900K  /root/ssl-build
   100K  /var/www/html/pub
   2M    /opt/puppetlabs
   942M  total

2. Calculate how much space is required to store the compressed data.

   The following table describes the compression ratio of all data items included in the backup:

   Table 11.1. Backup data compression ratio

   Data type	Directory	Ratio	Example results
   PostgreSQL database files	/var/lib/pgsql/data	80 – 85%	100 GB → 20 GB
   Pulp RPM files	/var/lib/pulp	(not compressed)	100 GB
   Configuration files	/var/lib/tftpboot /etc /root/ssl-build /var/www/html/pub /opt/puppetlabs	85%	942 MB → 141 MB

   In this example, the compressed backup data occupies 120 GB in total.

3. To calculate the amount of available space you require to store a backup, calculate the sum of the estimated values of compressed and uncompressed backup data, and add an extra 20% to ensure a reliable backup.

   This example requires 201 GB plus 120 GB for the uncompressed and compressed backup data, 321 GB in total. With 64 GB of extra space, 385 GB must be allocated for the backup location.

Procedure

1. To perform a full offline backup, enter the following command:

   # satellite-maintain backup offline /var/backup_directory

2. To create a directory within your backup directory to store the first incremental back up, enter the satellite-maintain backup command with the --incremental option:

   # satellite-maintain backup offline --incremental /var/backup_directory/full_backup /var/backup_directory

3. To create the second incremental backup, enter the satellite-maintain backup command with the --incremental option and include the path to the first incremental backup to indicate the starting point for the next increment. This creates a directory for the second incremental backup in your backup directory:

   # satellite-maintain backup offline --incremental /var/backup_directory/first_incremental_backup /var/backup_directory

4. Optional: If you want to point to a different version of the backup, and make a series of increments with that version of the backup as the starting point, you can do this at any time. For example, if you want to make a new incremental backup from the full backup rather than the first or second incremental backup, point to the full backup directory:

   # satellite-maintain backup offline --incremental /var/backup_directory/full_backup /var/backup_directory

Procedure

1. Choose the appropriate method to install Satellite or Capsule:

   • To install Satellite Server from a connected network, follow the procedures in Installing Satellite Server in a connected network environment.
   • To install Satellite Server from a disconnected network, follow the procedures in Installing Satellite Server in a disconnected network environment.
   • To install a Capsule Server, follow the procedures in Installing Capsule Server.
2. Copy the backup data to Satellite Server’s local file system. Use /var/ or /var/tmp/.

3. Run the restoration script.

   # satellite-maintain restore /var/backup_directory

   Where backup_directory is the time-stamped directory or subdirectory containing the backed-up data.

   The restore process can take a long time to complete, because of the amount of data to copy.

Procedure

1. Restore the last full backup using the instructions in Section 12.1, “Restoring from a full backup”.
2. Remove the full backup data from Satellite Server’s local file system, for example, /var/ or /var/tmp/.
3. Copy the incremental backup data to Satellite Server’s local file system, for example, /var/ or /var/tmp/.

4. Restore the incremental backups in the same sequence that they are made:

   # satellite-maintain restore /var/backup_directory/FIRST_INCREMENTAL
   # satellite-maintain restore /var/backup_directory/SECOND_INCREMENTAL

Procedure

1. On Satellite Server, run the satellite-change-hostname script, and provide the new host name. Choose one of the following methods:

   • If your Satellite Server is installed with the default self-signed SSL certificates:

     # satellite-change-hostname new-satellite \
     --username My_Username \
     --password My_Password

   • If your Satellite Server is installed with custom SSL certificates:

     # satellite-change-hostname new-satellite \
     --username My_Username \
     --password My_Password \
     --custom-cert "/root/ownca/test.com/test.com.crt" \
     --custom-key "/root/ownca/test.com/test.com.key"

2. If you have created a custom SSL certificate for the new Satellite Server host name, run the Satellite installation script to install the certificate. For more information about installing a custom SSL certificate, see Deploying a Custom SSL Certificate to Satellite Server in Installing Satellite Server in a connected network environment.
3. Reregister all hosts and Capsule Servers that are registered to Satellite Server. For more information, see Registering Hosts in Managing hosts.

4. On all Capsule Servers, run the Satellite installation script to update references to the new host name:

   # satellite-installer \
   --foreman-proxy-foreman-base-url https://new-satellite.example.com \
   --foreman-proxy-trusted-hosts new-satellite.example.com

5. On Satellite Server, list all Capsule Servers:

   # hammer capsule list

6. On Satellite Server, synchronize content for each Capsule Server:

   # hammer capsule content synchronize \
   --id My_capsule_ID

7. If you use the virt-who agent, update the virt-who configuration files with the new host name. For more information, see Modifying a virt-who Configuration in Configuring virtual machine subscriptions.
8. If you use external authentication, reconfigure Satellite Server for external authentication after you run the satellite-change-hostname script. For more information, see Configuring External Authentication in Installing Satellite Server in a connected network environment.

Procedure

1. On your Satellite Server, generate a new certificates archive file for your Capsule Server.

   • If you are using the default SSL certificate, regenerate the default SSL certificates:

     # capsule-certs-generate \
     --certs-tar /root/new-capsule.example.com-certs.tar \
     --foreman-proxy-fqdn new-capsule.example.com

     Ensure that you enter the full path to the .tar file.

   • If you are using a custom SSL certificate, create a new SSL certificate for your Capsule Server. For more information, see Configuring Capsule Server with a Custom SSL Certificate in Installing Capsule Server.

2. On your Satellite Server, copy the certificates archive file to your Capsule Server. For example, to copy the archive file to the root user’s home directory:

   # scp /root/new-capsule.example.com-certs.tar root@capsule.example.com:

3. On your Capsule Server, run the satellite-change-hostname script and provide the host’s new name, Satellite credentials, and certificates archive file name.

   # satellite-change-hostname new-capsule.example.com \
   --certs-tar /root/new-capsule.example.com-certs.tar \
   --password My_Password \
   --username My_Username

   Ensure that you enter the full path to the .tar file.

4. If you have created a custom certificate for your Capsule Server, deploy the certificate to your Capsule Server by entering the satellite-installer command that the capsule-certs-generate command returned in a previous step. For more information, see Deploying a Custom SSL Certificate to Capsule Server in Installing Capsule Server.

5. On all hosts registered to your Capsule Server, enter the following commands to reinstall the bootstrap RPM, reregister clients, and refresh their subscriptions.

   You can use the remote execution feature to perform this step. For more information, see Configuring and Setting up Remote Jobs in Managing hosts.

   # dnf remove katello-ca-consumer*
   
   # dnf install http://new-capsule.example.com/pub/katello-ca-consumer-latest.noarch.rpm
   
   # subscription-manager register \
   --environment="My_Lifecycle_Environment" \
   --force \
   --org="My_Organization"
   
   # subscription-manager refresh

6. Update the Capsule host name in the Satellite web UI.

   1. In the Satellite web UI, navigate to Infrastructure > Capsules.
   2. Locate Capsule Server in the list, and click Edit.
   3. Edit the Name and URL fields to match Capsule Server’s new host name, then click Submit.
   4. On your DNS server, add a record for the new hostname of your Capsule Server, and delete the record of the previous host name.

Procedure

1. In the Satellite web UI, navigate to Administer > Settings.
2. On the General tab, find the Saved audits interval setting.
3. Set the value of the setting to the number of days after which you want Satellite to delete the audit records.

Procedure

1. Connect to your Satellite Server using SSH:

   # ssh root@satellite.example.com

2. Optional: View the task:

   # hammer task info --id My_Task_ID

3. Delete the task:

   # foreman-rake foreman_tasks:cleanup TASK_SEARCH="id=My_Task_ID"

4. Optional: Ensure the task has been removed from Satellite Server:

   # hammer task info --id My_Task_ID

   Note that because the task is deleted, this command returns a non-zero exit code.

Procedure

1. Let running Pulp tasks finish but do not trigger any new ones as they can fail due to the full disk.

2. Ensure that the LV with the /var/lib/pulp directory on it has sufficient free space. Here are some ways to achieve that:

   1. Remove orphaned content:

      # foreman-rake katello:delete_orphaned_content RAILS_ENV=production

      This is run weekly so it will not free much space.

   2. Change the download policy from Immediate to On Demand for as many repositories as possible and remove already downloaded packages. See the Red Hat Knowledgebase solution How to change syncing policy for Repositories on Satellite from "Immediate" to "On-Demand" on the Red Hat Customer Portal for instructions.

   3. Grow the file system on the LV with the /var/lib/pulp directory on it. For more information, see Growing a logical volume and file system in Red Hat Enterprise Linux 8 Configuring and managing logical volumes.

      Note

      If you use an untypical file system (other than for example ext3, ext4, or xfs), you might need to unmount the file system so that it is not in use. In that case, complete the following steps:

      1. Stop Satellite services:

         # satellite-maintain service stop

      2. Grow the file system on the LV.

      3. Start Satellite services:

         # satellite-maintain service start

3. If some Pulp tasks failed due to the full disk, run them again.

Procedure

1. Stop all services, except for the postgresql service:

   # satellite-maintain service stop --exclude postgresql

2. Switch to the postgres user and reclaim space on the database:

   # su - postgres -c 'vacuumdb --full --all'

3. Start the other services when the vacuum completes:

   # satellite-maintain service start

Verification

1. Access the Satellite web UI from your local machine. For example, https://satellite.example.com.
2. In your browser, view the certificate details to verify the deployed certificate.

Procedure

1. On your Satellite Server, validate the custom SSL certificate input files:

   # katello-certs-check -t capsule \
   -b /root/capsule_cert/ca_cert_bundle.pem \
   -c /root/capsule_cert/capsule_cert.pem \
   -k /root/capsule_cert/capsule_cert_key.pem

2. On your Satellite Server, generate the certificate archive file for your Capsule Server:

   # capsule-certs-generate \
   --certs-tar "/root/My_Certificates/capsule.example.com-certs.tar" \
   --certs-update-server \
   --foreman-proxy-fqdn "capsule.example.com" \
   --server-ca-cert "/root/My_Certificates/ca_cert_bundle.pem" \
   --server-cert "/root/My_Certificates/capsule_cert.pem" \
   --server-key "/root/My_Certificates/capsule_cert_key.pem"

3. On your Satellite Server, copy the certificate archive file to your Capsule Server:

   # scp /root/My_Certificates/capsule.example.com-certs.tar user@capsule.example.com:

   You can move the copied file to the applicable path if required.

4. Retain a copy of the satellite-installer command that the capsule-certs-generate command returns for deploying the certificate to your Capsule Server.

5. Deploy the certificate on your Capsule Server using the satellite-installer command returned by the capsule-certs-generate command:

   # satellite-installer --scenario capsule \
   --certs-tar-file "/root/My_Certificates/capsule.example.com-certs.tar" \
   --certs-update-server \
   --foreman-proxy-foreman-base-url "https://satellite.example.com" \
   --foreman-proxy-register-in-foreman "true"

Procedure for configuring logging with journal

1. Enter the following satellite-installer command to configure logging to the journald service:

   # satellite-installer \
   --foreman-logging-type journald \
   --foreman-proxy-log JOURNAL

2. Optional: To inspect the log messages, use the journalctl utility. For example:

   • journalctl --unit foreman and journalctl --unit foreman-proxy show messages for the foreman and foreman-proxy units
   • journalctl REQUEST=request_ID shows messages for a specified request

Procedure for configuring file-based logging

1. Enter the following satellite-installer command to configure file-based logging:

   # satellite-installer \
   --reset-foreman-logging-type \
   --reset-foreman-proxy-log

2. Optional: To inspect the log messages, view these files:

   • /var/log/foreman/production.log
   • /var/log/foreman-proxy.log

Procedure for configuring logging to JSON output

1. On your Satellite Server, enable logging to JSON output for satellite-installer:

   # satellite-installer \
   --foreman-logging-layout json \
   --foreman-logging-type file

2. Optional: Inspect the log messages using jq:

   # cat /var/log/foreman/production.log | jq

Procedure

1. Enable the required individual loggers. For example, to enable sql and ldap loggers, enter the following command:

   # satellite-installer \
   --foreman-loggers ldap:true \
   --foreman-loggers sql:true

2. Optional: Reset all loggers to their default values:

   # satellite-installer --reset-foreman-loggers

To configure RSS feed notifications

1. In the Satellite web UI, navigate to Administer > Settings and select the Notifications tab.
2. In the RSS URL row, click the edit icon in the Value column and type the required URL.
3. In the RSS enable row, click the edit icon in the Value column to enable or disable this feature.

Procedure

1. In the Satellite web UI, navigate to Monitor > Audits to view the audit records.

2. To obtain a list of all the audit attributes, use the following command:

   # foreman-rake audits:list_attributes

Procedure

1. In the Satellite web UI, navigate to Administer > Webhook > Webhook Templates.
2. Click Clone an existing template or Create Template.
3. Enter a name for the template.

4. Use the editor to make changes to the template payload.

   A webhook HTTP payload must be created using Satellite template syntax. The webhook template can use a special variable called @object that can represent the main object of the event. @object can be missing in case of certain events. You can determine what data are actually available with the @payload variable.

   For more information, see Template Writing Reference in Managing hosts and for available template macros and methods, visit /templates_doc on Satellite Server.

5. Optional: Enter the description and audit comment.
6. Assign organizations and locations.
7. Click Submit.

Procedure

1. In the Satellite web UI, navigate to Administer > Webhook > Webhooks.
2. Click Create new.
3. From the Subscribe to list, select an event.
4. Enter a Name for your webhook.
5. Enter a Target URL. Webhooks make HTTP requests to pre-configured URLs. The target URL can be a dynamic URL.
6. Click Template to select a template. Webhook templates are used to generate the body of the HTTP request to Satellite Server when a webhook is triggered.
7. Enter an HTTP method.
8. Optional: If you do not want activate the webhook when you create it, uncheck the Enabled flag.
9. Click the Credentials tab.
10. Optional: If HTTP authentication is required, enter User and Password.
11. Optional: Uncheck Verify SSL if you do not want to verify the server certificate against the system certificate store or Satellite CA.
12. On the Additional tab, enter the HTTP Content Type. For example, application/json, application/xml or text/plain on the payload you define. The application does not attempt to convert the content to match the specified content type.
13. Optional: Provide HTTP headers as JSON. ERB is also allowed.

Procedure

1. Modify the /var/lib/foreman-proxy/shellhooks/print_args script to print arguments to standard error output so you can see them in the Capsule logs:

   #!/bin/sh
   #
   # Prints all arguments to stderr
   #
   echo "$@" >&2

2. In the Satellite web UI, navigate to Administer > Webhook > Webhooks.
3. Click Create new.
4. From the Subscribe to list, select Actions Remote Execution Run Host Job Succeeded.
5. Enter a Name for your webhook.

6. In the Target URL field, enter the URL of your Capsule Server followed by :9090/shellhook/print_args:

   https://capsule.example.com:9090/shellhook/print_args

   Note that shellhook in the URL is singular, unlike the shellhooks directory.

7. From the Template list, select Empty Payload.
8. On the Credentials tab, check Capsule Authorization.

9. On the Additional tab, enter the following text in the Optional HTTP headers field:

   {
       "X-Shellhook-Arg-1": "Hello",
       "X-Shellhook-Arg-2": "World!"
   }

10. Click Submit. You now have successfully created a shellhook that prints "Hello World!" to Capsule logs every time you a remote execution job succeeds.

Verification

1. Run a remote execution job on any host. You can use time as a command. For more information, see Executing a Remote Job in Managing hosts.

2. Verify that the shellhook script was triggered and printed "Hello World!" to Capsule Server logs:

   # tail /var/log/foreman-proxy/proxy.log

   You should find the following lines at the end of the log:

   [I] Started POST /shellhook/print_args
   [I] Finished POST /shellhook/print_args with 200 (0.33 ms)
   [I] [3520] Started task /var/lib/foreman-proxy/shellhooks/print_args\ Hello\ World\!
   [W] [3520] Hello World!