--- canonical: https://safekit.evidian.com/wp-content/uploads/downloads_safekit/version-82/slides-en/3-install-setup-en.pptx --- # PowerPoint Converted to Markdown Source: https://safekit.evidian.com/wp-content/uploads/downloads_safekit/version-82/slides-en/3-install-setup-en.pptx ## Slide 1: SafeKit Installation - Install, configure, upgrade ### Speaker notes > These slides are timed and automatically move from one to the next after a delay. To remove this automation: Go to 'Slide Show' and uncheck 'Use Timings’. > The slides have a soundtrack represented by an audio icon on the right side of each slide. To remove the soundtrack, click on each audio icon and lower the volume to the minimum. > I'm going to present the installation of SafeKit, including the installation of the package, configuration of nodes in the cluster, and the upgrade procedure. ## Slide 2 - Overview ### Speaker notes > Let's start with an overview. ## Slide 3: Install and configure - Install the SafeKit package - Install it on all SafeKit nodes - Configure the SafeKit cluster - Specify the SafeKit nodes in the cluster - Configure the SafeKit nodes - Configure security settings, license keys - Configure a SafeKit module - Deploy a mirror or a farm module - 1 - 2 - 3 - 4 - 3 & 4 explained in: - "SafeKit web console" slides - "Command line interface" slides ### Speaker notes > To install and configure SafeKit, follow these steps: > In step 1, install the SafeKit package on all SafeKit nodes. > In step 2, configure the SafeKit nodes by setting up security settings and license keys. > In step 3, configure the SafeKit cluster by specifying the nodes in the cluster. > In step 4, configure a SafeKit module by deploying either a mirror or a farm module. > Steps 1 and 2 are explained in these slides, while steps 3 and 4 are detailed in the "SafeKit web console" or "Command line interface" slides. ## Slide 4 - Prerequisites ### Speaker notes > Let's start by analyzing the prerequisites before installation. ## Slide 5: Mirror module prerequisites - Operating system - Windows or Linux - Same OS and version - Align clocks (NTP) - Application - Install with the same settings - Disable automatic start at boot of the application - Network - Same IP network if using - If possible, 1 dedicated replication network - 1 - 2 - 3 - File replication - Same path for replicated directories - On Linux, align uids/gids - 4 ### Speaker notes > Let's review the prerequisites for installing a mirror module. > In step 1, ensure that the operating system is either Windows or Linux, and that all nodes are running the same OS and version. It is also important to align the clocks. This ensures accurate log analysis and proper file management across the servers. > In step 2, for the application, make sure it is installed with the same settings on all nodes. Additionally, disable the automatic start at boot of the application. The application start will be managed by the automatic start at boot of the module. > In step 3, for the network, ensure that all nodes are on the same IP network if using a virtual IP. If possible, set up a dedicated replication network to enhance performance. > In step 4, for file replication, ensure that the replicated directories have the same path on all nodes. On Linux, align the user IDs and group IDs. > On the schema, you can see the principle of a mirror module, which operates in the PRIM-SECOND state. Each node has its own physical IP address, IP1 and IP2. The virtual IP is configured by SafeKit on the network interface of the PRIM node only, as an alias IP address. Clients connect to the virtual IP and are routed to the PRIM node. The application is started by SafeKit on the PRIM node using a start script. The folders to replicate are synchronized in real-time and synchronously, with only modifications inside files being replicated. ## Slide 6: Farm module prerequisites - Operating system - Windows or Linux - Same OS and version - On Linux: install the kernel compilation tools for the vip kernel module - Align clocks (NTP) - Network - Same IP network if using - Application - Install with the same settings - Disable automatic start at boot of application - 1 - 2 - 3 ### Speaker notes > Let's go over the prerequisites for setting up a farm module. > In step 1, for the operating system, ensure that you are using either Windows or Linux, and that all nodes are running the same OS and version. If you're using Linux, make sure to install the kernel compilation tools for the VIP kernel module. It is also important to align the clocks. This ensures accurate log analysis across the servers. > In step 2, for the network, all nodes should be on the same IP network if you're using a virtual IP. > In step 3, for the application, install it with the same settings on all nodes and disable the automatic start at boot of the application. The application start will be managed by the automatic start at boot of the module. > On the schema, you can see the principle of a farm module, which operates in the UP-UP state. Each node has its own physical IP address, IP1 and IP2. The application is started by SafeKit on both nodes using a start script. The virtual IP is configured by SafeKit on the network interface of each node, as an alias IP address. Clients are connected to the virtual IP and their TCP sessions are load balanced between node 1 and node 2, thanks to a vip kernel module. ## Slide 7 - Install the SafeKit Package ### Speaker notes > Let's examine how to install the SafeKit package. ## Slide 8: Before installation - Download the SafeKit package - Check the free disk space - 97 MB for the installation directory (SAFE) - 3 GB per module (SAFEVAR) - 1 - 2 - 3 - Documentation - Full documentation and training - User’s Guide - Training slides - Software Release Bulletin - Up-to-date list of supported operating systems - List of fixes and changes - SafeKit Release Notes - Migration instructions - Major changes - 4 ### Speaker notes > Let's go over the steps before installing SafeKit. > In step 1, download the SafeKit package. > In step 2, make sure to check the free disk space: you'll need 97 MB for the installation directory and 3 GB per module for the var directory. > In step 3, for Windows, the installation directories are in the C drive. For Linux, the installation directories are in /opt and /var. A command line interface is provided on Windows and Linux, and all the commands are prefixed by the safekit command followed by parameters. A web console is also provided and can be accessed from a browser on port 9010. > In step 4, for any help, review the three main documentation. The User’s Guide contains all technical information. The Software Release Bulletin gives an up-to-date list of supported operating systems and a list of fixes. The SafeKit Release Notes details migration instructions and major changes. ## Slide 9: Installation - Linux package - Windows package - As administrator - Double click on the package safekitwindows.msi - Check the box check "Set console credentials and firewall rules now” - Enter a password for the admin user - Assign the same password on all nodes - As root - chmod +x safekitlinux.bin - ./safekitlinux.bin - Extract the package and the safekitinstall script - ./safekitinstall - Reply yes for firewall automatic configuration - Enter a password for the admin user - Assign the same password on all nodes - Modules (.safe files) - Choose a module - Each .safe comes with a quick installation guide and a free trial - Copy the .safe file in - SAFE/Application_Modules/generic/ - Silent installation as administrator - msiexec /i safekitwindows.msi /qn SAFEINSTALLDIR=C:\ - Silent installation as root - ./safekitinstall –q –passwd pwd [-nofirewall] - A .safe file is a zip file containing: - start/stop scripts - a configuration file userconfig.xml ### Speaker notes > Let's examine the package installation and start with the installation of the Windows package. As an administrator, you will need to double-click on the safekitwindows.msi package to begin the process. At the end of the installation, a window displays a checkbox with the message: "Set console credentials and firewall rules now". Check the box, enter a password for the admin user and assign the same password on all nodes. > Let's move on to the installation of the Linux package. As root, you will need to make the downloaded safekitlinux.bin file executable. Then, execute the file to start the installation process. It will extract the package and the safekitinstall script. Run safekitinstall, reply "yes" for firewall automatic configuration, enter a password for the admin user, and assign the same password on all nodes. > Now, let's move on to the installation of the modules. First, choose a module from the list provided on our web site. Each module comes with a quick installation guide and a free trial. Once you have selected a module, copy the .safe file to the generic directory. A .safe file is essentially a zip file that contains start and stop scripts, as well as a configuration file named userconfig.xml. ## Slide 10 - Configure SafeKit Nodes ### Speaker notes > Let's now examine how to configure the nodes in a cluster. ## Slide 11: SafeKit services installed on each node - safewebserver - safeadmin - Runs the SafeKit framework - manage the start and stop of modules - each module has its own real-time replication, virtual IP, failover processes - in the localsystem account on Windows (no password) - in the root account on Linux (password) - Runs the Apache server required for - the web console, the global safekit command, the module checker - in a virtual account on Windows (no password) - in the safekit account on Linux (locked password) - Boot and shutdown - At boot - safeadmin starts - safewebserver starts - safeadmin starts modules configured to start at boot - Commands - Windows - net start | stop safeadmin - Linux - systemctl start | stop safeadmin - Commands - safekit webserver start | stop | restart - At shutdown - safeadmin stops running modules - safeadmin stops - safewebserver stops ### Speaker notes > Let's talk about the SafeKit services installed on each node. The safeadmin service runs the SafeKit framework. It manages the start and stop of modules, with each module having its own processes for real-time replication, virtual IP, and failover. On Windows, it operates in the localsystem account without a password, while on Linux, it runs in the root account with a password. > For commands, on Windows, you can use net start or net stop to control safeadmin. On Linux, you can use systemCTL start or systemCTL stop for safeadmin. > The safewebserver service runs the Apache server, which is required for the web console, the global safekit command, and the module checker. On Windows, it operates in a virtual account without a password, and on Linux, it runs in the safekit account with a locked password. For controlling safewebserver, you can use the safekit webserver start, stop, or restart commands. > At boot, safeadmin starts, followed by safewebserver, and then safeadmin starts the modules configured to start at boot. At shutdown, safeadmin stops running modules, then safeadmin itself stops, as well as safewebserver. ## Slide 12: Firewall setup* - Add SafeKit firewall rules for Microsoft Windows Firewall and Linux firewalld/iptables - Manual setup - Setup after install - Windows - Before SafeKit 8.2.3 - Run the manual setup - Since SafeKit 8.2.3 - No action required when firewall automatic configuration has been accepted during install - Linux - No action required when firewall automatic configuration has been accepted during install - Windows - Open a PowerShell as administrator on each node - Run C:/safekit/private/bin/firewallcfg add - Linux - Open a shell as root on each node - Run /opt/safekit/private/bin/firewallcfg add - *For other cases, refer to “Firewall settings” in the SafeKit User’s Guide ### Speaker notes > Let's discuss the firewall setup for SafeKit. This involves adding SafeKit firewall rules for both Microsoft Windows Firewall and Linux firewall D or IP tables. > The firewall configuration is important for web console communications, for communications of the SafeKit framework between modules, and executing global commands. > For Windows since SafeKit 8.2.3 and for Linux, no action is required if the firewall automatic configuration was accepted during the installation. > For a manual setup on Windows, open a PowerShell as an administrator on each node and run the command firewallCFG add. On Linux, open a shell as root on each node and run the same command firewallCFG add. You can reapply this command multiple times without any consequences. > For other firewalls, refer to “Firewall settings” in the SafeKit User’s Guide where the list of processes and the list of ports used by SafeKit are described. ## Slide 13: SafeKit web service setup* - Initialize the user admin with its password for the web console and activate the global safekit command - Manual setup - Setup after install - Windows - Before SafeKit 8.2.3 - Run the manual setup - Since SafeKit 8.2.3 - No action required when password initialization has been done during install - Linux - No action required when when password initialization has been done during install - Windows - Open a PowerShell as administrator on each node - Run C:/safekit/private/bin/webservercfg -passwd pwd - Linux - Open a shell as root on each node - Run /opt/safekit/private/bin/webservercfg -passwd pwd - pwd is the admin user’s password that is identical on all nodes - *Minimum setup else refer to "Securing the SafeKit web service” in the SafeKit User’s Guide - Web console http://node1:9010 - admin, pwd ### Speaker notes > Let's discuss the setup of the SafeKit web service. This process involves initializing the user admin with its password for the web console and activating the global SafeKit command. > For Windows since SafeKit 8.2.3 and for Linux, no action is required if the password initialization was done during the installation. > Now, let's move on to the manual setup. For Windows, open a PowerShell as an administrator on each node and run the webserverCFG command  to set the password. > For Linux, open a shell as root on each node and run the same webserverCFG  command to set the password. > You can reapply this command to reset the admin password. Please note that the admin user's password should be identical on all nodes, otherwise the web console and the global command will not work. > This is the minimum setup required. For advanced authentication on https, please refer to "Securing the SafeKit web service" in the User’s Guide. ## Slide 14: Antivirus setup - Exclude legitimate SafeKit directories - If an antivirus interferes with the operation of SafeKit - Exclude the SafeKit binaries and var directory (SAFE and SAFEVAR) - Exclude all replicated folders of a mirror module - For more information, refer to "Antivirus settings” in the SafeKit User’s Guide ### Speaker notes > Let's discuss the setup of antivirus exclusions for SafeKit. In some cases, due to SafeKit's close integration with the operating system, it may be necessary to configure the antivirus to exclude certain directories to ensure smooth operation. Let's talk about the directories that need to be excluded. For Windows, exclude the safekit directory in the C drive which contains the binaries and the var directory. On Linux, exclude the safekit directory in /opt and /var. Additionally, all replicated folders defined in mirror modules should be excluded. For more information, please refer to 'Antivirus settings' in the SafeKit User’s Guide. ## Slide 15: SafeKit license key - Free trial license key - Without license, SafeKit starts but stops every 3 days - Get a free one-month trial key "any hostname"/"any OS" - Permanent license key (license.txt) - After a purchase order, get a permanent key based on hostname/OS - License installation, on each node - Copy the license key file into safekit/conf - Check the license with the web console or the command safekit level - 1 - 2 - 3 ### Speaker notes > Let's talk about the SafeKit license key setup. > Firstly, let's discuss the free trial license key. Without a license, SafeKit will start, but will stop every three days. To avoid this, you can get a free one-month trial key for any hostname and any operating. > Secondly, for those who have made a purchase order, you can obtain a permanent license key based on your hostname and operating system. > Thirdly, let's move on to the license installation process on each node. Follow these steps: copy the license key file into the safekit/CONF directory. Then, check the license with the web console or by using the command safekit level. ## Slide 16 - Upgrade ### Speaker notes > Let's now examine how to make an upgrade of SafeKit. ## Slide 17: SafeKit Upgrade Procedure - Before upgrading - Uninstall the current package - Install the new package - For a fix, check the list of fixes in the Software Release Bulletin - For a migration, read the SafeKit Release Notes for migration instructions - Select your version of SafeKit - Stop all running modules - safekit shutdown - Uninstall the SafeKit package - Windows: Control Panel – Add/Remove Programs - Linux: safekit uninstall - The main configurations files (cluster, module, license, …) are not removed. - Download and install the SafeKit package - If major upgrade, apply migration instructions (see release notes) - Before SafeKit 8.2.3, run manual firewall setup in Windows - Before SafeKit 8.2.1, re-apply modules configuration - safekit config -m AM (where AM is the module name) - Before using the web console, clear the browser’s cache (hold CTRL and SHIFT while tapping the DELETE key) ### Speaker notes > The upgrade procedure involves three important steps to ensure a smooth transition. > Firstly, before upgrading, check the list of fixes in the Software Release Bulletin and read the SafeKit Release Notes for migration instructions. You can then select your version of SafeKit. > Secondly, let's start with the uninstall of the current package. Stop all running modules by executing the command: safekit shutdown. > For Windows, to uninstall the current SafeKit package, use the Control Panel to Add/Remove Programs. > For Linux,  to uninstall the current SafeKit package, run the command: safekit uninstall. > Please note that the main configuration files (cluster, module, license, etc.) are not removed during this process. > Thirdly, proceed with the installation of the new SafeKit package. Download and install the SafeKit package from the support website. If it is a major upgrade, apply the migration instructions as specified in the release notes. For versions before SafeKit 8.2.3, run the manual firewall setup in Windows. For versions before SafeKit 8.2.1, re-apply the modules configuration using the command: safekit config with the module name as parameter. Before using the web console, make sure to clear the browser’s cache by holding CTRL and SHIFT while tapping the DELETE key. ## Slide 18: Minor upgrade - Fix on the same version of SafeKit - Stop node 2, upgrade it and restart it - Upgrade node 1 and restart it - Rollback if ALONE not working - stop the ALONE node - force node 1 to start as primary (before its upgrade) - reinstall the previous version on node 2 - Stop node 1. Downtime equals the time of the failover - node1 - node2 - Step 1 - Step 2 - Step 3 - Step 4 - Step 5 ### Speaker notes > Let's consider a minor upgrade fixing the same version of SafeKit and ensuring a smooth transition with minimal downtime. > At step 1 in the figure, the cluster to upgrade is running PRIM-SECOND. > At step 2, we stop node 2, upgrade it, and then restart it. During the upgrade of node 2, the application is not interrupted and runs on node 1. > At step 3, the module is started on node 2 and has resynchronized application data. > At step 4, we stop the module on node 1. Then there is an automatic restart of the application on node 2, resulting in a downtime associated with this restart. If everything works well on the upgraded node 2, then node 1 can be upgraded. If something is not working correctly on node 2, it is possible to make a rollback by stopping the module on node 2 and forcing the start as primary on node 1 with the old version before the upgrade. > At step 5, after the upgrade of node 1, we can start the module on node 1 which resynchronizes the application data before becoming secondary. > The cluster is then upgraded with a minimum downtime associated with the restart of the application at step 4. ## Slide 19: Major upgrade - Change of SafeKit version with migration instructions in the release notes - Stop node 2 then node 1 - Rollback if ALONE not working - stop the ALONE node - force node 2 to start as primary (before its upgrade) - reinstall the previous version on node 1 - Upgrade node 1 - node1 - node2 - Step 1 - Step 2 - Step 3 - Step 4 - Start node 1. - Downtime equals the time to upgrade node 1 - Upgrade node 2 and restart it ### Speaker notes > Let's now consider a major upgrade involving a change in the SafeKit version. > At step 1 in the figure, the cluster to upgrade is running PRIM-SECOND. > At step 2, we stop the entire cluster, starting with node 2, to avoid an unnecessary failover. Then, we upgrade node 1. > At step 3, we restart the module on node 1 and check that everything works well. If it does, we can upgrade node 2. If not, we can stop node 1 and force node 2 to start as primary with the old version before the upgrade. > At step 4, after upgrading node 2, we restart the module on it. Node 2 resynchronizes application data before becoming the secondary. > The entire cluster is upgraded with downtime limited to the upgrade of node 1 at step 2. ## Slide 20: Thank you ! _No extractable slide text found._ ### Speaker notes > Thank you for your attention. If you have any questions or need further clarification, please feel free to ask.