Remote Debugging

---

HP OO 10 OnBoarding Kit – Community Assistance Team

Remote Debugging This tutorial demonstrates the usage of remote debugging in HP Operations Orchestration 10. One of the main differences between OO 9 to OO 10 is that there is no direct connection between Studio and Central. However, in some cases you may need to use the Studio debugging capabilities in order to investigate an issue on Central or debug a flow during development by running it on Central. HP OO remote debugging enables you to connect from Studio to a remote Central, run the debugger, and use resources such as configuration items and RAS servers without the need to deploy a content pack or change any properties on Central.

Sample use case John has developed a new flow. The flow uses a system account which has an override value in Central. Furthermore, John’s Studio machine does not have network access to RAS servers which are used by Central to execute the flow. This tutorial will show how John can easily debug the flow by connecting from Studio to Central, utilizing the RAS servers and system account, without the need to pack and deploy his content first.

HP Operations Orchestration HP Operations Orchestration (HP OO) is a next generation IT Process Automation solution that is designed from the ground up to increase automation adoption whether in a traditional data center or hybrid cloud environment. OO 10 Community Onboarding Kit This tutorial is part of the onboarding kit created for the OO community in order to make it even faster to learn OO 10. It is for both new OO 10 users and for existing OO 9 users who want to know what’s new. The kit contains four persona-based learning tracks for administrators, flow authors, integrators, and end users. Each track provides knowledge assets of the following types:     

Videos Tutorials Quick Guides Presentations Direct links to relevant manuals

Remote Debugging

Flow overview The example flow in this tutorial relates to restarting Windows servers. The flow utilizes the HP OO 10 RAS Groups feature and will be used as a sub flow by several other flows in order to restart servers in different environments, including servers which reside in the DMZ. The flow makes use of the following group aliases:

The main flow We assume that according to the John’s company’s naming policy, servers that belong to the dmz have the string “dmz” as part of the server FQDN, so the first step in the flow checks the server FQDN in order to understand which worker group should run the operation.

As you can see, the Check Domain step has three responses: DMZ, INTERNAL, and the default failure. Each of the above responses is wired to the next relevant step (Restart DMZ Server or Restart Internal Server). Both the Restart DMZ Server and Restart Internal Server steps use the Restart Server subflow. However, the Restart DMZ Server step has the rasGroup input populated with the DMZ_RAS_GROUP group alias name, while in the Restart INTERNAL Server step, this input variable is populated with an empty constant value (equivalent to null).The final step in the main flow runs the Logger subflow, which is less relevant to this tutorial.

HP Operations Orchestration, June 2014

Remote Debugging

Restart the server (subflow) The first step (using the out-of-the-box Check Null operation) determines if the rasGroup variable is populated:

If it is not populated (it is null), the default worker group should be used. Thus, we do not need to do anything special before running the Restart Server operation. If the rasGroup variable is populated, the group alias used in the next (Restart Windows) operation is changed. This is done by populating the overrideNRAS variable from the rasGroup variable, using the out-of-the-box Set Flow Variable operation. To learn more about overriding RAS groups, please see our tutorial “Worker Groups in OO 10”.

Central Group Aliases configuration The following Group Aliases are configured in the remote Central:

The task of mapping aliases to worker groups is usually done by an OO administrator.

HP Operations Orchestration, June 2014

Remote Debugging

Configuring remote debugging Configuring Studio Let’s configure the connection to our Central Server by clicking the Settings\Edit Connections menu option:

Note: it is possible to specify a proxy server if needed, using the “Proxy…” option from the menu. We will add the Central URL as described in the following screenshot:

Configuring Central In order to be able to use remote debugging, we need to verify the following:  The same content pack versions are deployed on Studio and Central. In our case it is oo10-base-cp-1.0.142.jar (There is no need to pack and deploy the tested contented. This is one of the benefits of remote debugging).  The user has the permissions to run remote debug.

HP Operations Orchestration, June 2014

Remote Debugging

As you can see in the following screenshot, john is granted with the HelpDesk_Level4 role:

Let’s check how this role is configured:

HP Operations Orchestration, June 2014

Remote Debugging

Debugging from Studio In order to initiate a remote debug, we will choose the Staging Central connection which we have defined earlier.

When starting the debug, an authentication window will pop up, as we specified when defining the connection:

The used connection is presented in the debug view:

We can also see that the restart server step has failed with an “Access is denied” error.

HP Operations Orchestration, June 2014

Remote Debugging

Let us take a look at the context inspector:

1

2

3

5

4

1. As you can see, the user which was used by the restart server operation is John. And the error we received means john does not have the suitable permissions to restart the server or fails to authenticate to the server. 2. We see that the correct RAS Group Alias was selected by the flow. 3. We see that the flow was run on Central by John, and we get the Run ID. 4. In the bottom we see that the user name was taken from the RAS_Groups.windowesNodeUser. 5. If we hoover the mouse over the icon we can see that the value is taken from Studio. The icon itself is an indication too. If we will log in to Central as John, we will see the failed run in the run explorer:

HP Operations Orchestration, June 2014

Remote Debugging

Let’s put a breakpoint on the Restart DMZ Server Step and debug again:

When we reach the breakpoint, we will override the system account value:

You can see that the value was changed, and the system property’s icon has changed too (red triangle).

And if you hoover the mouse on the icon, a “Modified” tooltip will appear. Before running the flow again, let’s configure a system account in Central, and assign it with an override value. When we run the flow now, it will succeed. The system account override value takes priority and the right credentials will be used for the operation.

HP Operations Orchestration, June 2014

Remote Debugging

We can see that the System Account icon was changed:

The green arrow indicates that the value’s source is the remote Central.

Rerunning flows from Studio HP OO 10.10 enables you to remote debug a flow by using the same input values of a previous flow run in Central. This is a good tool to analyze problems in a flow by reproducing the run in a debug mode. In order to use remote debug, start the debugger and choose a remote central as explained previously. Click on the

icon:

Enter the run ID of the flow run you want to reproduce:

HP Operations Orchestration, June 2014

Remote Debugging

Click on the Details button in the following pop up, in order to see the loaded inputs:

Start debugging as usual by clicking on the

button.

Summary We have seen how remote debugging enables John to debug the flow using studio debugger with no access to the DMZ, without knowing the privileged user’s password, utilizing the Central’s configuration without the need to deploy the content as a CP and affect the environment.

However, we need to understand the possible implications of using remote debug:  Since the remote debug is a very sensitive/broad permission, which allows the Author to run ANY content on Central.  In case of an upgrade from any OO version which is older than 10.10, the Remote Debug capability is not granted to ANY role by default. This includes the Administrator role.  Running remote debug against a production server is dangerous. In case you absolutely must run it on a production server, the author must be supervised during the debug, and the permission should be denied immediately after the job is done.  In case of a production issue, our recommendation is to reproduce it on staging and use remote debug against the staging Central if necessary. For more details about remote debugging, please read the “Debugging a flow on a remote central” section in the Studio Guide.

We are always interested in your questions and feedback, so please post them on the OO community forums: http://www.hp.com/go/OOPractitionerForum Check the HP OO community for additional resources such as guides, tutorials, videos, content, and more: https://hpln.hp.com/group/operations-orchestration

HP Operations Orchestration, June 2014