Whole root or sparse root zones and patching
Hi all,
A while back, I did some cluster patching tests on a system with only sparse root zones, and one with whole root zones...and I seem to recall that the patch time was about equal which surprised me. I had thought the sparse root model mainly is patching the global zone, and even though patchadd may need to run through the sparse NGZ's...that it isn't doing much other than updating /var/sadm info in the NGZ's.
Has anyone seen this to be true or if there are major patching improvements using a "sparse" root NGZ model over a "whole" root model?
thanks much.
My testing showed the same results and I was a bit surprised as well. As I dug into it further my understanding was that the majority of the patch application time goes into figuring out what to patch, not actually copying files around. That work must be done for the sparse zones in the same way as for the full root zones, we just save the few milliseconds of actually backing up and replacing the file.
I suspect there is a large amount of slack that could be optimized in the patching process (both with and without zones), but I don't understand it nearly well enough to say that with any authority.
Similar Messages
-
Hi, I'm fairly new to Solaris so sorry for possible dumb question.
When I do patch OS in global zone are those changed reflected in sub-zones as well ? I do assume they are not, right ?
Thanks for an reply
Petr R.Hi, I'm fairly new to Solaris so sorry for possible
dumb question.
When I do patch OS in global zone are those changed
reflected in sub-zones as well ? I do assume they are
not, right ?Actually, they usually are. If the patch doesn't apply to another zone (usually due to package differences), then it won't be applied. Otherwise it is. In a few cases, you can patch a non-global zone, but only if the packages allow it.
The docs have quite a bit of information on this.
http://docs.sun.com/app/docs/doc/817-1592/6mhahuoqn?a=view
Darren -
Few zone and diffrent patch level
I make two small zones, detach one of this zone and patching all system and I have some questions.
root@Solek # zoneadm list -cv
ID NAME STATUS PATH BRAND IP
0 global running / native shared
1 zone1 running /zone/zone1 native shared
- zone2 configured /zone/zone2 native shared
root@Solek # zoneadm -z zone2 attach
These packages installed on this system were not installed on the source system:
SUNWinstall-patch-utils-root (11.10,REV=2005.01.09.23.05)
SUNWbindr (11.10.0,REV=2005.01.08.05.16)
These patches installed on this system were not installed on the source
system:
126538
126419
120011
.....and this is ok, but how can I "patch" this zone?
I know this is small zone and it use file in global zone (which is patched), but what can I do to correct information in zone2 about all install patches?
i attach this zone with "-F"
root@Solek # showrev -p | grep 126538
Patch: 126538-01 Obsoletes: 121901-02 Requires: 119042-09
root@Solek # zoneadm -z zone2 attach -F
root@Solek # zoneadm -z zone2 boot
root@Solek # zlogin -C zone2
root@zone2 #showrev -p | grep 126538
[Connection to zone 'zone2' console closed]
root@Solek # zoneadm -z zone2 halt
root@Solek # zoneadm -z zone2 deatach
root@Solek # zoneadm -z zone2 attachWhy now I detach/attach this zone whithout any error?and this is ok, but how can I "patch" this zone? You need a system at the same patchlevel as the zone,
then attach the zone to this system.
You could now detach your zones, remove the patches, attach
your unpatched zone, patch system, attach all other zones.
Why now I detach/attach this zone whithout any error?This is a sun design issue. They compare the patchlevel of the
source and target system, not the patchlevel of the zone!
After the attach -F the zone patchlevel is different, but zoneadm
doesn't care ...
Best regards,
Marcel -
I installed in my global zone the "Entire Distribution" of Solaris 10 and some software from Companion CD.
Now I would like install a "whole root zone" with a basic set of packages (like "End User Distribution") and without the packages
from the Companion CD.
I can use pkgrm to delete the unnecessary packages in my whole root zone.
But is there a more elegant way to get a whole root zone only with basic packages?
Regards. P.The "easy" way would be to do a minimal installation in the Global zone and then install the required services in the local zone.
HTH,
Roger S. -
Whole Root / Sparse Root fusion // lofs problem
Hello everybody!
Actually i am getting probz with installations of software in sparse-root zones.
Especially caused by the lofs-techniques regarding /usr , /usr/bin and /usr/local, required for linking back the executables to the home folders of users in Sparse-Root zone.
are there any workarounds to obtain a functional setup for this cases or override the lofs-problem for linkage .
Read only after install to /usr/bin is o.k. but for Software install in Sparse Root it`s needed.
Encountered this problems with Oracle and DirX installs.
Whole-root zone obligation and the inherit disk usage would be unacceptable.
Would be running out of disk space.
Thanks for Replies !Is there any option setable to temporarily override the "ro" lofs for an inherited-pkg-dir?
-fs-special?
The Application i want to install is DIRX for LDAP management.
It links the executable from /usr/bin to /export/home/ldap before finising the Installation.
The Installation is cacelled by the installer if the links cant be set.
After install there is no problem with "ro" access to the executable..
If i had to do all zones as whole-root zones i would use Xen on an Intel or amd based machine.
Sparse-root zone model is posible with Xen, but implies a lot of work.
The decision to solaris was due to low performance of Linux Kernels on Sparc compared with a native Solaris, the hardware of a Fire 880 was built for.
Any HowTo`s to a Workaround, e.g. a comand string ?( 4meNxDummy? ;) ) -
Using a interface in a sparse-root zone on a different subnet
Hello,
is it possible to use interface ce0 for the global zone and configure interface ce1 for the non-global zone, but the interfaces are on a different subnet?
ce0 ... 10.5.5.18 / global zone
ce1 ... 192.168.5.18 / non-global zone
using Solaris 5.10 Generic_125100-10
I configured ce0 in the global zone (of course)
and I plumbed ce1 also in the global zone - but configured ce1 in the zones definition
zonecfg:oem> add net
zonecfg:oem:net> set physical=ce1
zonecfg:oem:net> set address=192.168.5.18The zone boots without any problems and it looks like this:
[global zone]
# ifconfig -a
ce0: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index 2
inet 10.5.5.18 netmask ffffff00 broadcast 10.5.5.255
ether 0:3:ba:b0:53:39
ce1: flags=1000842<BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index 7
inet 0.0.0.0 netmask 0
ether 0:3:ba:b0:53:39
ce1:1: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index 7
zone oem
inet 192.168.5.18 netmask ffffff00 broadcast 192.168.5.255[non-global zone]
# ifconfig -a
ce1:1: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index 7
inet 192.168.5.18 netmask ffffff00 broadcast 192.168.5.255I've read this is solved with GLDv3 drivers and exclusive IP instances mentioned in the blog http://blogs.sun.com/stw/entry/what_s_up_ce_doc -
so the system shows
# dladm show-link
ce0 type: legacy mtu: 1500 device: ce0
ce1 type: legacy mtu: 1500 device: ce1I get weird results even if I ping between the zones, I get "ICMP Destination unreachable"
Can this be solved with a full-root zone ...?
-- Nickhere are my current settings:
*[global zone]*
# netstat -nr
Routing Table: IPv4
Destination Gateway Flags Ref Use Interface
10.5.5.0 10.5.5.18 U 1 10864 ce0
224.0.0.0 10.5.5.18 U 1 0 ce0
default 10.5.5 .1 UG 1 42839
127.0.0.1 127.0.0.1 UH 2 619817 lo0
# ifconfig -a
ce0: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index 2
inet 10.5.5.18 netmask ffffff00 broadcast 10.5.5.255
ether 0:3:ba:b0:53:39
ce1: flags=1000842<BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index 7
inet 0.0.0.0 netmask 0
ether 0:3:ba:b0:53:39
ce1:1: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index 7
zone oem
inet 192.168.5.18 netmask ffffff00 broadcast 192.168.5.255
! root@elba2:/ # route get 192.168.5.18
route to: 192.168.5.18
destination: 192.168.5.18
mask: 255.255.255.255
interface: ce1:1
flags: <UP,DONE>
recvpipe sendpipe ssthresh rtt,ms rttvar,ms hopcount mtu expire
0 0 0 0 0 0 8232 0 *[sparse-root zone]*
# netstat -nr
Routing Table: IPv4
Destination Gateway Flags Ref Use Interface
192.168.5.0 192.168.5.18 U 1 83 ce1:1
224.0.0.0 192.168.5.18 U 1 0 ce1:1
127.0.0.1 127.0.0.1 UH 19 86105 lo0:1
# ifconfig -a
ce1:1: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index 7
inet 192.168.5.18 netmask ffffff00 broadcast 192.168.1.255
# route get 10.5.5.18
route to: 10.5.5.18
destination: 10.5.5.18
mask: 255.255.255.255
interface: ce0
flags: <UP,DONE>
recvpipe sendpipe ssthresh rtt,ms rttvar,ms hopcount mtu expire
0 0 0 0 0 0 8232 0 Thank you for your time !
-- Nick -
To break out of a non-global zone and become root user in the global zone
Hi folks
"to break out of a non-global zone and become root user in the global zone through a kernel bug exploit"
Is this possible and has SUN allready a fix/workaround/patch for that?
CheersIs it possible there's a bug in the kernel? Sure.
Someone would need to find and identify such a bug before it could be fixed. I've not heard of the discovery of a bug like this. You could check the bug database at www.opensolaris.org.
Darren -
Sparse Root Zone using loopback refuses to shutdown
New to zones, so been following along with the System Administration Guide: Solaris Containers-Resource Management and Solaris Zones doc from Sun (#817-1592). Everything seems ok with a plain jane zone, but I've run into trouble trying to use the loopback method to mount some other filesystems.
The zone in question refuses to shut down no matter what method I use, and seemingly points to an RPC issue.
using zlogin from the global zone, I get this, and it just hangs:
# zlogin oracle_ods01 shutdown -i 0
Shutdown started. Fri Jul 24 08:40:02 PDT 2009
Cannot send to root on /dev/pts/2
open: No such device or address
Cannot send to root on /dev/pts/2
open: No such device or address
showmount: oracle_ods01: RPC: Rpcbind failure - RPC: SuccessLogged into the zone:
# shutdown -i 0
Shutdown started. Fri Jul 24 08:41:27 PDT 2009
Broadcast Message from root (pts/2) on oracle_ods01 Fri Jul 24 08:41:28...
The system oracle_ods01 will be shut down in 1 minute
Broadcast Message from root (pts/2) on oracle_ods01 Fri Jul 24 08:41:28...
The system oracle_ods01 will be shut down in 1 minute
Broadcast Message from root (pts/2) on oracle_ods01 Fri Jul 24 08:41:28...
The system oracle_ods01 will be shut down in 1 minute
showmount: oracle_ods01: RPC: Rpcbind failure - RPC: Success
Changing to init state 0 - please waitBasically, I'm guessing its related to communication between the zones, but I'm not sure exactly what I'm missing. It's a default Solaris 10 install, so I've not disabled anything that wasn't already disabled. I did enable pools, but thats about it for the changes I've made so far. I guess I"m jus tnot sure if I should be looking at something I need to do in the global zone, or if I need to do something in the sparse root zone.
Any insights appreciated, as I'm not sure that I didn't miss something along the way!
Edited by: jef_e on Jul 24, 2009 8:52 AM
I take that back - my other test zone also seems to be giving me issues. I initally issues a zone halt to shut it down, which seems to work for all zones. But is that recommended?New to zones, so been following along with the System Administration Guide: Solaris Containers-Resource Management and Solaris Zones doc from Sun (#817-1592). Everything seems ok with a plain jane zone, but I've run into trouble trying to use the loopback method to mount some other filesystems.
The zone in question refuses to shut down no matter what method I use, and seemingly points to an RPC issue.
using zlogin from the global zone, I get this, and it just hangs:
# zlogin oracle_ods01 shutdown -i 0
Shutdown started. Fri Jul 24 08:40:02 PDT 2009
Cannot send to root on /dev/pts/2
open: No such device or address
Cannot send to root on /dev/pts/2
open: No such device or address
showmount: oracle_ods01: RPC: Rpcbind failure - RPC: SuccessLogged into the zone:
# shutdown -i 0
Shutdown started. Fri Jul 24 08:41:27 PDT 2009
Broadcast Message from root (pts/2) on oracle_ods01 Fri Jul 24 08:41:28...
The system oracle_ods01 will be shut down in 1 minute
Broadcast Message from root (pts/2) on oracle_ods01 Fri Jul 24 08:41:28...
The system oracle_ods01 will be shut down in 1 minute
Broadcast Message from root (pts/2) on oracle_ods01 Fri Jul 24 08:41:28...
The system oracle_ods01 will be shut down in 1 minute
showmount: oracle_ods01: RPC: Rpcbind failure - RPC: Success
Changing to init state 0 - please waitBasically, I'm guessing its related to communication between the zones, but I'm not sure exactly what I'm missing. It's a default Solaris 10 install, so I've not disabled anything that wasn't already disabled. I did enable pools, but thats about it for the changes I've made so far. I guess I"m jus tnot sure if I should be looking at something I need to do in the global zone, or if I need to do something in the sparse root zone.
Any insights appreciated, as I'm not sure that I didn't miss something along the way!
Edited by: jef_e on Jul 24, 2009 8:52 AM
I take that back - my other test zone also seems to be giving me issues. I initally issues a zone halt to shut it down, which seems to work for all zones. But is that recommended? -
SAP Install on Solaris 10 Sparse Root Zone ../usr/sap
Hi All,
I was wondering if anyone is running SAP on Solaris 10, SAP EHP4 ECC 6.0 Oracle DB version 10. App and Db in a sparse root zone.
When we initially created our SAP install the Directories containing <SID> and trans_<SID> was give to us as "/usr/sap"
Since this is a sparse root zone, the /usr directory is read only. To accommodate SAP, a directory was created in the global zone for each of the containers ( we have ECC, PI, BW etc..) and then mounted as a filesystem in each container. /usr/sap exists in every container, and it was supposed to be nothing more than a mount point for the <SID> and trans_<SID> NFS mounts. This /usr/sap directory exists on the global zone of our M5000 and the additional files and folders are eating up OS space.
This creates me with two problems.
1. WHen I take a snapshot, I can't recover the zone in a automatic fashion because the local zone can not see the global /usr directory, so I have to recover that folder/file manually.
2. I don't know exactly, but files are being created in the usr/sap directory that is causing internal drives to grow quickly.
To resolve our issues it was determined that the best course of action is to remove the connection to the global zone by creating a /sap directory in each container and linking it as /usr/sap. The /sap directory will be an NFS/FC mount point and that will fix the issue of disk space usage and backup recovery.
Does anyone have another way to solve this problem or any suggestions that we should do something different. ?I use sparse zones on Solaris with ZFS.
I delegate filesystems to the zone.
root@global ~# zonecfg -z zone_name info
zonename: zone_name
zonepath: /zfs_zones/zone_name
brand: native
autoboot: true
bootargs:
pool:
limitpriv:
scheduling-class:
ip-type: shared
hostid:
inherit-pkg-dir:
dir: /lib
inherit-pkg-dir:
dir: /platform
inherit-pkg-dir:
dir: /sbin
inherit-pkg-dir:
dir: /usr
net:
address: w.x.y.z/nn
physical: nxge0
defrouter: w.x.y.z
dataset:
name: zfs_zones/zone_name/oracle
dataset:
name: zfs_zones/zone_name/sapmnt
dataset:
name: zfs_zones/zone_name/usr_sap
root@zone_name ~# zfs list -o name,mountpoint
NAME MOUNTPOINT
zfs_zones/zone_name/oracle /oracle
zfs_zones/zone_name/oracle/SID_mirrlogA /oracle/SID/mirrlogA
zfs_zones/zone_name/oracle/SID_mirrlogB /oracle/SID/mirrlogB
zfs_zones/zone_name/oracle/SID_oraarch /oracle/SID/oraarch
zfs_zones/zone_name/oracle/SID_origlogA /oracle/SID/origlogA
zfs_zones/zone_name/oracle/SID_origlogB /oracle/SID/origlogB
zfs_zones/zone_name/oracle/SID_sapdata1 /oracle/SID/sapdata1
zfs_zones/zone_name/oracle/SID_sapdata2 /oracle/SID/sapdata2
zfs_zones/zone_name/oracle/SID_sapdata3 /oracle/SID/sapdata3
zfs_zones/zone_name/oracle/SID_sapdata4 /oracle/SID/sapdata4
zfs_zones/zone_name/sapmnt /sapmnt
zfs_zones/zone_name/usr_sap /usr/sap
Edited by: RUSS HANSEN on Dec 14, 2011 8:52 PM -
How to add /usr/local to sparse-root zone ?
I had created sparse-root local zone. The installed some soft and realised that I would need /usr/locain the zone. But I have problem with adding it.
Original configuration of the zone:
bash-3.00# zonecfg -z z1
zonecfg:z1> info
zonepath: /zones/z1
autoboot: true
pool:
inherit-pkg-dir:
dir: /lib
inherit-pkg-dir:
dir: /platform
inherit-pkg-dir:
dir: /sbin
inherit-pkg-dir:
dir: /usr
net:
address: x.x.x.x/y
physical: elxl0
zonecfg:z1>Current configuration:
bash-3.00# zonecfg -z z1
zonecfg:z1> info
zonepath: /zones/z1
autoboot: true
pool:
inherit-pkg-dir:
dir: /lib
inherit-pkg-dir:
dir: /platform
inherit-pkg-dir:
dir: /sbin
inherit-pkg-dir:
dir: /usr
fs:
dir: /usr/local
special: /zones/z1-local
raw not specified
type: lofs
options: [rw]
net:
address: x.x.x.x/y
physical: elxl0Now:
bash-3.00# zoneadm -z z1 boot
zoneadm: zone 'z1': Could not mkdir /zones/z1/root/usr/local.
zoneadm: zone 'z1': It is on a read-only file system in this local zone.
zoneadm: zone 'z1': Make sure /usr/local exists in the global zone.
zoneadm: zone 'z1': call to zoneadmd failedprzemolThe messages contains all you need:
zoneadm: zone 'z1': Make sure /usr/local exists in the global zone.Just do a "mkdir /usr/local" in global zone and your zone installation will work.
But: Unfortunately you will get into trouble, if you want to install some software packages into /usr/local later.
Installation of Software below an inherited filesystem like /usr is not supported and somewhat impossible. The fact that /usr/local is a mounted filesystem does not count here.
These type of problems are already discussed in this forum... -
In my zone xml files I have configured filesystems to be mounted in the non global zones.
The filesystems exists on separate SAN storage.
filesystem special=/dev/dsk/controllerdisknumber raw=/dev/dsk/controllerdisknumber directory=/somemountpoint
The problem we are experiencing is that occasionally our path to the SAN goes down. Yes these are multipathed but we still experience the outage.
What happens is that the filesystems that are mounted in the NGZ's go away. So the zone is left running
but the mountpoints are not mounted any longer.
When the path to the SAN comes back, the global zone sees that the devices are back, but the NGZ still
does not mount their filesystems as specified in their specific xml.
The only way for the mount points to come back is to 1) reboot the zone or 2) manually mount the filesystems from the global zone, specifying that they be mounted in the NGZ.
Is this working as it should? Should the zone not attempt to remount its filesystems if they are lost?
Instead of specifying a filesystem in the zoneconfig, should we just be giving the devices to the zone and then use the NGZ /etc/vfstab to mount ?
Thank you for the help.I've seen this issue also, but not aware of a good fix.
One possibility that comes to mind but I havent actually tested is to do a NFS export from the global zone and automount it in the local zone.
The automounter shoud deal with mountpoint reliability issues OK.
Its kind of ugly and isnt likely to be as efficient as a loopback mount though. -
Is it possible to patch Global Zone and only specific Non-Global Zones?
Hi Champs,
Is it possible to patch Global Zone and only specific Non-Global Zones? Idea is to patch DEV-zones only on the system & test applications and then patch only the STG-zones on same server!
Not sure if it is possible but just throwing a question...
Cheers,
NitinM10vir wrote:
Yes, if you have branded (non-sparse) zone!Branded zones and sparse zones don't have the relation that you imply. In Solaris 10, native zones can be sparse or whole-root (non-sparse, as you say). Zones that are not native zones are branded zones. Branded zones on Solaris 10 include Solaris Legacy Containers, previously known as Solaris 8 Containers and Solaris 9 Containers. That add-on product allows you to run Solaris 8 and Solaris 9 application environments under a thin layer of virtualization provided by the brands framework. solaris8 and solaris9 branded zones can be patched independently of each other and of the global zone.
Solaris 11 has no "native zones" - all zones use the brands framework. The "solaris" brand does no emulation and in that respect is very similar to native zones on Solaris 10. Solaris 11 also provides Solaris 10 Zones via the solaris10 brand. This allows zones or the global zone from a Solaris 10 system to be transferred to a Solaris 11 system and run as solaris10 zones. When running on Solaris 11, solaris10 zones can each be patched independently from each other and the Solaris 11 global zone. Technically, Solaris 11 doesn't have patches - it just has newer versions of packages to which the system is updated. -
We can able to add package and patch in Non-Golbel zone?
Hi Sun Gurus,
We have V890 server and it's configered zones.We are facing problem with package and Patch adding in Non-Golbel zone.
I want to confirm whether we can able to add package and patch in Non-Golbel zone?
Thanks in advance
RajaIf their sparse root zones, then you have to install the package and patch in the global zone. The non global zones will all pick them up automatically.
If you need to be able to install packages in only specific zones then you need to make them whole root zones. -
When I type a link to a page in my root directory in code view and I click on the link in live view it does nothing. When I then go to preview in a browser it works fine. Can anybody help?
I am not sure however I suspect live view is for viewing the page you are working on. You would have to open the other page to see it in live view. The browser on the other hand is doing what it is designed to do. I jump back and forth all the time from live view to the browsers I have installed.
-
Customizing root folder for our custom and standard reports
Hi Experts,
We are planning to have customizing root folder for our custom and standard reports,
I have couple of questions to do this customization.
1) How do we setup root folder as default instead XA or SSA for all the users?
2) What are the implications on Spend adviser reports, we will not customize spend adviser, planning to use standard SPD?
3) Do we have any developments required or setup at visual Admin level?
Someone can guide me what would be the pros and cons along with above concerns? Your reply will be highly appreciated.
Regards,
MaheshMadhav,
Do i have further inputs on this?
Regards,
Mahesh
Maybe you are looking for
-
Itunes won't start & Freezes Windows Vista - Please Please Help!!
Hey Guys, Ever since I've upgraded to Itunes 10.1.2, my itunes won't even open. I click the icon on my desktop, I get the swirly circle for a bit, and then it stops. In the task manager, itunes.exe is listed as one of the processes, but doesn't seem
-
Hi guys, I have developed an HTTP to SOAP scenario, in order to invoke a Web Service. I am trying to test the scenario by using an HTTP client. However, I am getting the following message, in the result: Result: <SOAP:Envelope xmlns:SOAP="http://sche
-
Accessing a different class using ActionPerformed
hi im trying to access a method in a different class using public void actionPerformed (ActionEvent e) { if(e.getSource() == AuthorCombo) { ComboAction(); else if(e.getSource() == SearchButton){
-
Creating UDA in Essbase Studio
Hi All, Can Someone help mw out how to create assign a UDA for a particular column in Essbase Studio Thanks, Reddy Bodhanapu
-
Elements 6 won't install from Bamboo Disc
Our school recently bought some Wacom tablets that had Elements 6 as additional software on the Bamboo disc. I have a lab of 10 new iMacs running Snow Leopard. 4 out of the 10 computers will not load Elements 6. When I double click on the Setup ic