1z0-821 Oracle Solaris 11 System Administration Questions and Answers

Image Packaging System (IPS) is a new network based package management system included in Oracle Solaris 11. It provides a framework for complete software lifecycle management such as installation, upgrade and removal of software packages. IPS also enables you to create your own software packages, create and manage package repositories, and mirror existing package repositories.

Oracle Solaris software is distributed in IPS packages. IPS packages are stored in IPS package repositories, which are populated by IPS publishers.

E: The following command displays property information about the local repository.

$ pkgrepo get -s /export/repoSolaris11

SECTION PROPERTY VALUE publisher prefix solaris repository description This\ repository\ serves\ a\ copy\ of\ the\ Oracle\ Solaris\ 11\ Build\ 175b\ Package\ Repository.

repository name Oracle\ Solaris\ 11\ Build\ 175b\ Package\ Repository

repository version 4

The value of the publisher prefix specifies that solaris is to be used in the following cases:

When more than one publisher's packages are present and no publisher is specified in the package name in the pkg command

When packages are published to the repository and no publisher is specified.

The zfs list command provides an extensible mechanism for viewing and querying dataset information.

You can list basic dataset information by using the zfs list command with no options. This command displays the names of all datasets on the system and the values of their used, available, referenced, and mountpoint properties. For more information about these properties, see Introducing ZFS Properties.

For example:

# zfs list

NAME USED AVAIL REFER MOUNTPOINT

pool 476K 16.5G 21K /pool

pool/clone 18K 16.5G 18K /pool/clone

pool/home 296K 16.5G 19K /pool/home

pool/home/marks 277K 16.5G 277K /pool/home/marks

pool/home/marks@snap 0 - 277K -

pool/test 18K 16.5G 18K /test

A: The – of the Active Column indicates that this boot environment is inactive, and hence not bootable.

Note: The values for the Active column are as follows:

R – Active on reboot.

N – Active now.

NR – Active now and active on reboot.

“-” – Inactive.

“!” – Unbootable boot environments in a non-global zone are represented by an exclamation point.

http://docs.oracle.com/cd/E23824_01/html/E21801/unbootable.html#scrolltoc

ZFS Deduplication Property

Solaris Express Community Edition, build 129: In this Solaris release, you can use the deduplication property to remove redundant data from your ZFS file systems. If a file system has the dedup property enabled, duplicate data blocks are removed synchronously. The result is that only unique data is stored and common components are shared between files.

You can enable this property as follows:

# zfs set dedup=on tank/home

You can change an inactive boot environment into an active boot environment. Only one boot environment can be active at a time. The newly activated boot environment becomes the default environment upon reboot.

How to Activate an Existing Boot Environment

1. Use the following command to activate an existing, inactive boot environment:

beadm activate beName

beName is a variable for the name of the boot environment to be activated.

Note the following specifications.

beadm activate beName activates a boot environment by setting the bootable pool property, bootfs, to the value of the ROOT dataset of the boot environment that is being activated.

beadm activate sets the newly activated boot environment as the default in the menu.lst file.

2. Reboot.

The newly activated boot environment is now the default on the x86 GRUB menu or SPARC boot menu.

The line

init core file pattern: /var/core/core.%f.%p

will be used for the non-global process to determine the destination of the dump file.

Note: When a process is dumping core, up to three core files can be produced: one in the per-process location, one in the system-wide global location, and, if the process was running in a local (non-global) zone, one in the global location for the zone in which that process was running.

If you're logged on to the system, you can run prstat -Z to generate a summary of cpu/memory utilization by zone.

First the full backup must be restored. This would be the Sunday backup.

Then the last incremental backup must be restored. This would be the Wednesday backup.

Before restoring the Wednesday incremental file system snapshot, the most recent snapshot must first be rolled back.

By exclusion D) would be best answer even though it is incomplete.

The Internet Protocol (IP) is the principal communications protocol in the Internet protocol suite for relaying datagrams across network boundaries. Its routing function enables internetworking, and essentially establishes the Internet.

The following options are supported:

C

Connects to the zone console. Connects to the zone console.

Note:

After you install a zone, you must log in to the zone to complete its application environment. You might log in to the zone to perform administrative tasks as well. Unless the -C option is used to connect to the zone console, logging in to a zone using zlogin starts a new task. A task cannot span two zones

The NVRAM chip stores user-definable system parameters, also referred to as NVRAM variables or EEPROM parameters. The parameters allow administrators to control variables such as the default boot device and boot command. The NVRAM also contains writeable areas for user-controlled diagnostics, macros, and device aliases. NVRAM is where the system identification information is stored, such as the host ID, Ethernet address, and time-of-day (TOD) clock.

Examples of NVRAM variables:

Variable Default Description boot-device disk or net

The device from which to start up.

diag-device net The diagnostic startup source device.

diag-file Empty string Arguments passed to the startup program in diagnostic mode.

diag-switch? false Whether to run in diagnostic mode

A: The beadm utility includes support for creating and administering non-global zone boot environments.

Note: A boot environment is a bootable instance of the Oracle Solaris operating system image plus any other application software packages installed into that image. System administrators can maintain multiple boot environments on their systems, and each boot environment can have different software versions installed.

B: Role-based access control (RBAC) is a security feature for controlling user access to tasks that would normally be restricted to the root role. By applying security attributes to processes and to users, RBAC can divide up superuser capabilities among several administrators.

In the Bourne Again, C, Korn, TC, and Z shells, the tilde (~) is used as a shortcut for specifying your home directory.

cd –

It's the command-line equivalent of the back button (takes you to the previous directory you were in).

Note:

To make certain that you are in your home directory, type the cd (change directory) command. This command moves you to your home (default) directory.

A: ZFS also allows you to use UFS files as virtual devices in your storage pool. This feature is aimed primarily at testing and enabling simple experimentation, not for production use. The reason is that any use of files relies on the underlying file system for consistency. If you create a ZFS pool backed by files on a UFS file system, then you are implicitly relying on UFS to guarantee correctness and synchronous semantics.

However, files can be quite useful when you are first trying out ZFS or experimenting with more complicated layouts when not enough physical devices are present. All files must be specified as complete paths and must be at least 64 Mbytes in size.

B, E: You can construct logical devices for ZFS using volumes presented by software-based volume managers, such as Solaris Volume Manager (SVM) or Veritas Volume Manager (VxVM). However, these configurations are not recommended. While ZFS functions properly on such devices, less-than-optimal performance might be the result.

How to Monitor All Failed Login Attempts

This procedure captures in a syslog file all failed login attempts.

Assume the Primary Administrator role, or become superuser.

1. Assume the Primary Administrator role, or become superuser.

2. (C) Set up the /etc/default/login file with the desired values for SYSLOG and SYSLOG_FAILED_LOGINS

3. (A) Create a file with the correct permissions to hold the logging information.

Create the authlog file in the /var/adm directory.

4. (B) Edit the syslog.conf file to log failed password attempts.

Unlike DOS, which uses the file extension to determine if a file is executable or not, UNIX relies on file permissions.

The value assigned by umask is subtracted from the default.

User's file creation mask. umask sets an environment variable which automatically sets file permissions on newly created files. i.e. it will set the shell process's file creation mask to mode.

umask 000 would grant full permissions.

Note: 777 full permissions

The prctl utility allows the examination and modification of the resource controls associated with an active process, task, or project on the system. It allows access to the basic and privileged limits and the current usage on the specified entity.

How to Change the zone.cpu-shares Value in a Zone Dynamically

This procedure can be used in the global zone or in a non-global zone.

For more information about roles, see Configuring and Using RBAC (Task Map) in System Administration Guide: Security Services.

# prctl -n zone.cpu-shares -r -v value -i zone zonename

idtype is either the zonename or the zoneid. value is the new value.

Note: project.cpu-shares

Number of CPU shares granted to a project for use with the fair share scheduler

zfs snapshot [-r] [-o property=value] ... filesystem@snapname|volume@snapname

Creates a snapshot with the given name. All previous modifications by successful system calls to the file system are part of the snapshot

zfs clone [-p] [-o property=value] ... snapshot filesystem|volume

Creates a clone of the given snapshot.

Note:

Because snapshots are fast and low overhead, they can be used extensively without great concern for system performance or disk use .

With ZFS you can not only create snapshot but create a clone of a snapshot.

A clone is a writable volume or file system whose initial contents are the same as the dataset from which it was created. As with snapshots, creating a clone is nearly instantaneous, and initially consumes no additional disk space. In addition, you can snapshot a clone.

A clone is a writable volume or file system whose initial contents are the same as the original dataset. As with snapshots, creating a clone is nearly instantaneous, and initially consumes no additional space.

Clones can only be created from a snapshot. When a snapshot is cloned, it creates an implicit dependency between the parent and child.

Here we should use SIGTERM to terminate the process.

Note:

When no signal is included in the kill command-line syntax, the default signal that is used is –15 (SIGKILL). Using the –9 signal (SIGTERM) with the kill command ensures that the process terminates promptly. However, the –9 signal should not be used to kill certain processes, such as a database process, or an LDAP server process. The result is that data might be lost.

Tip - When using the kill command to stop a process, first try using the command by itself, without including a signal option. Wait a few minutes to see if the process terminates before using the kill command with the -9 signal.

IPv6 defines three address types:

unicast

Identifies an interface of an individual node.

multicast

Identifies a group of interfaces, usually on different nodes. Packets that are sent to the multicast address go to all members of the multicast group.

anycast

Identifies a group of interfaces, usually on different nodes. Packets that are sent to the anycast address go to the anycast group member node that is physically closest to the sender.

From the output exhibit we can deduce that the shell has id 15156.

It has spawned three subprocesses:

grep: id 15166

ps –aef 15165

The remaining 15163 must be the subshell (see note below).

This is the id of the process which should be terminated.

Note: dladm rename-link [-R root-dir] link new-link

Rename link to new-link. This is used to give a link a meaningful name, or to associate existing link configuration such as link properties of a removed device with a new device.

C: /etc/security/exec_attr is a local database that specifies the execution attributes associated with profiles. The exec_attr file can be used with other sources for execution profiles, including the exec_attr NIS map and NIS+ table.

A profile is a logical grouping of authorizations and commands that is interpreted by a profile shell to form a secure execution environment.

dlstat show-aggr [-r | -t] [-i interval] [-p] [ -o field[, ...]] [-u R|K|M|G|T|P] [link]

Display per-port statistics for an aggregation.

'ipadm show-addr' displays all the configured addresses on the system.

Example:

# ipadm show-addr

ADDROBJ TYPE STATE ADDR

lo0/v4 static ok 127.0.0.1/8

lo0/v6 static ok ::1/128

Only the loopback addresses are configured. No IP address is configured.

Set the EDITOR variable to vi.

Commands like `crontab -e` will use ed per default. If you'd like to use some better editor (like vi) you can use the environment variable EDITOR:

# EDITOR=vi; crontab –e will open the users crontab in vi. Of course you can set this variable permanently.

Incorrect answers

C: -e Edits a copy of the current user's crontab file, or creates an empty file to edit if crontab does not exist. When editing is complete, the file is installed as the user's crontab file. If a username is given, the specified user's crontab file is edited, rather than the current user's crontab file; this can only be done by a user with the solaris.jobs.admin authorization. The environment variable EDITOR determines which editor is invoked with the -e option. The default editor is ed(1). All crontab jobs should be submitted using crontab. Do not add jobs by just editing the crontab file, because cron is not aware of changes made this way.

A: Non-global zones can not utilize DHCP (neither client nor server).

B (not C): By default, non-global zones will be configured with a shared IP functionality. What this means is that IP layer configuration and state is shared between the zone you’re creating and the global zone. This usually implies both zones being on the same IP subnet for each given NIC.

Note: A zone is a virtual operating system abstraction that provides a protected environment in which applications run. The applications are protected from each other to provide software fault isolation. To ease the labor of managing multiple applications and their environments, they co-exist within one operating system instance, and are usually managed as one entity.

The original operating environment, before any zones are created, is also called the "global zone" to distinguish it from non-global zones, The global zone is the operating system instance.

Incorrect answer:

E: Exclusive-IP zones can use IPMP. IPMP is configured the same way in an exclusive-IP zone as it is on a system not using zones.

For shared-IP zones, IPMP can be configured in the global zone.

F: Full IP-level functionality is available in an exclusive-IP zone.

An exclusive-IP zone has its own IP-related state.

An exclusive-IP zone is assigned its own set of data-links using the zonecfg command. The zone is given a data-link name such as xge0, e1000g1, or bge32001, using the physical property of the net resource. The address property of the net resource is not set.

Note that the assigned data-link enables the snoop command to be used.

The dladm command can be used with the show-linkprop subcommand to show the assignment of data-links to running exclusive-IP zones.

JumpStart: Use the setup_install_server(1M) command.

AI: Use the installadm create-service command.

* (Not A, B, C): interval (here 10 seconds): Specifies the length in seconds to pause between each interval report.

* duration (here 24 h)

* -R report[, report] (here high)

Print a summary report.

High Print a summary report detailing the highest usage of each resource and zone during any interval of the zonestat utility invocation.

Note: The zonestat utility reports on the cpu, memory, and resource control utilization of the currently running zones. Each zone's utilization is reported both as a percentage of system resources and the zone's configured limits.

The zonestat utility prints a series of interval reports at the specified interval. It optionally also prints one or more summary reports at a specified interval.

The default output is a summary of cpu, physical, and virtual memory utilization. The -r option can be used to choose detailed output for specific resources.

OpenBoot firmware is executed immediately after you turn on your system. The primary tasks of OpenBoot firmware are to:

* Test and initialize the system hardware (B)

* Determine the hardware configuration

*Boot the operating system from either a mass storage device or from a network (C)

*Provide interactive debugging facilities for testing hardware and software

B: Configure the AI install server to use a static IP address and default route. 

D: The create-service command can set up DHCP on the AI install server. If you want to set up a separate DHCP server or configure an existing DHCP server for use with AI. The DHCP server must be able to provide DNS information to the systems to be installed.

E: An automated installation of a client over the network consists of the following high-level steps:

1. The client system boots over the network and gets its network configuration and the location of the install server from the DHCP server.

2. The install server provides a boot image to the client.

3. Characteristics of the client determine which installation instructions and which system configuration instructions are used to install the client.

4. The Oracle Solaris 11 OS is installed on the client, pulling packages from the package repository specified by the installation instructions in the AI install service.

G: Install the AI tool set.

Use the installadm create-service command to create an AI install service. Give the service a meaningful name, and specify the path where you want the service created. Specify the source of the network boot image (net image) package or ISO file.

installadm create-service [-n svcname]

[-s FMRI_or_ISO] [-d imagepath]

-d imagepath

The imagepath is the location of the new install service. The install-image/solaris-auto-install package is installed to this location, or the specified ISO file is expanded at this location.

zonep2vchk

- check a global zone's configuration for physical to virtual migration into non-global zone

The zonep2vchk utility is used to evaluate a global zone's configuration before the process of physical-to-virtual (p2v) migration into a non-global zone.

The p2v process involves archiving a global zone (source), and then installing a non-global zone (target) using that archive

Zonep2vchk serves two functions. First, it can be used to report issues on the source which might prevent a successful p2v migration. Second, it can output a template zonecfg, which can be used to assist in configuring the non-global zone target.

Zonep2vchk can be executed on a Solaris 10 or later global zone. To execute on Solaris 10, copy the zonep2vchkutility to the Solaris 10 source global zone.

When run on Solaris 10, a target release of S11 can be specified, which will check for p2v into a Solaris 10 Branded zone.