Stackvora.tech

Lenovo ThinkSystem: configure servers in bulk with OneCLI

Deploying and maintaining a fleet of Lenovo ThinkSystem servers efficiently requires robust automation tools. Lenovo XClarity OneCLI (One Command Line…

Deploying and maintaining a fleet of Lenovo ThinkSystem servers efficiently requires robust automation tools. Lenovo XClarity OneCLI (One Command Line Interface) offers a powerful, scriptable solution for managing server configurations, updating firmware, and collecting inventory data across multiple systems. This article details practical applications of OneCLI for bulk operations, focusing on configuration management and firmware updates, essential for consistent infrastructure provisioning.

OneCLI typically runs on a management workstation or server, connecting to ThinkSystem servers via their Baseboard Management Controller (BMC), also known as the XClarity Controller (XCC). It supports various operating systems, including Windows, Linux, and ESXi. For most use cases, a Linux or Windows client is preferred for scripting.

Setting Up OneCLI

Before using OneCLI, download the appropriate package from the Lenovo Support website (e.g., onecli_linux_x64.tgz for Linux). Extract the archive to a convenient location. The primary executable is onecli or onecli.exe.

# For Linux
mkdir /opt/onecli
tar -zxvf onecli_linux_x64.tgz -C /opt/onecli
export PATH=$PATH:/opt/onecli/onecli_linux_x64

# Verify installation
onecli --version
# Expected output: Lenovo XClarity OneCLI Version: [e.g., 2.13.0]

OneCLI communicates with the BMC using HTTPS on port 443. Ensure network connectivity and appropriate firewall rules are in place. Authentication typically uses the XCC administrator username and password.

Configuration Management with OneCLI

One of OneCLI's most compelling features is its ability to export, compare, and apply server configurations. This is invaluable for maintaining consistent baselines across many servers or quickly restoring configurations after hardware replacement.

Exporting Current Settings

To capture the full configuration of a server, including BIOS, RAID, network adapter settings, and XCC parameters, use the config show command. It's good practice to redirect output to a file for review and later application.

# Export all configuration settings from a server
onecli config show --bmc admin:Password123@10.0.0.10 > server_10_0_0_10_config.txt

# To show only BIOS settings
onecli config show --type bios --bmc admin:Password123@10.0.0.10

# Exporting settings from a server with a specific service processor port (e.g., 50000 if non-standard)
onecli config show --bmc admin:Password123@10.0.0.10:50000 > server_custom_port_config.txt

The output file (server_10_0_0_10_config.txt) will contain a series of set commands, each defining a specific configuration parameter. For example:

set IMM.SysInfo.SysName "ThinkSystem-SN-ABCDEF"
set IMM.Date.Year "2023"
set IMM.Network.NIC1.IPv4Addr "10.0.0.10"
set BIOS.UEFI.BootMode "UEFI"
set BIOS.SysConfig.PowerRestorePolicy "Restore_Last_State"
set LCC.Adapter.Slot1.RAID.Array1.RaidLevel "RAID5"

These files are human-readable and can be version-controlled.

Applying a Configuration Baseline

Once you have a baseline configuration file (e.g., baseline.txt), you can apply it to other servers. This is crucial for rapid deployment and ensuring uniformity.

# Apply a baseline configuration to a server
onecli config set --file baseline.txt --bmc admin:Password123@10.0.0.11

# To apply and automatically reboot if necessary (some BIOS settings require a reboot)
onecli config set --file baseline.txt --bmc admin:Password123@10.0.0.12 --reboot --force

The --reboot flag instructs OneCLI to initiate a server reboot if any applied settings require it for activation. Use --force to bypass confirmation prompts for reboots.

Comparing Configurations

To identify differences between two server configurations or between a server and a baseline, you can use the config compare command. This requires exporting both configurations first.

# Export server A's config
onecli config show --bmc admin:Password123@10.0.0.10 > config_serverA.txt

# Export server B's config
onecli config show --bmc admin:Password123@10.0.0.11 > config_serverB.txt

# Compare the two files (using standard diff utility)
diff config_serverA.txt config_serverB.txt

# Alternatively, OneCLI can directly compare a server against a file (requires OneCLI v2.0 or newer)
onecli config compare --file baseline.txt --bmc admin:Password123@10.0.0.13

The direct config compare command will output a list of discrepancies, showing values that differ between the target server and the specified baseline file.

Firmware Management

Keeping firmware up-to-date is vital for security, stability, and access to new features. OneCLI simplifies bulk firmware updates, often integrating with local repositories.

Creating a Local Firmware Repository

For large-scale deployments, downloading firmware updates directly from Lenovo's website for each server is inefficient. Create a local repository by downloading firmware update packages (.tgz, .zip, or .uxz files) and placing them in a directory accessible by OneCLI.

# Example repository structure:
./firmware_repo/
├── lnvo_fw_xcc_tstg43a-4.30_anyos_noarch.tuz
├── lnvo_fw_uefi_m3e108h-1.08_anyos_32-64.xml
├── lnvo_fw_nic_qlnv-005.008.00_anyos_x64.tgz
└── ... (other firmware files)

OneCLI will scan this directory for applicable updates based on the server's machine type and current firmware versions.

Updating Firmware from a Repository

Use the update flash command to initiate firmware updates. OneCLI will identify necessary updates from the specified directory, transfer them to the XCC, and initiate the flashing process.

# Update all applicable firmware components from the './firmware_repo' directory
onecli update flash --dir ./firmware_repo --bmc admin:Password123@10.0.0.14 --reboot

# To specify a specific component type (e.g., only update the XCC firmware)
onecli update flash --dir ./firmware_repo --type xcc --bmc admin:Password123@10.0.0.15 --reboot

# To preview changes without applying them
onecli update flash --dir ./firmware_repo --bmc admin:Password123@10.0.0.16 --dry-run

The --reboot flag is critical, as most firmware updates (especially UEFI and XCC) require a server reboot to become active. The --dry-run option is excellent for validating the repository and understanding which updates will be applied before committing changes.

Checking Firmware Status

After updates, or for general auditing, you can check the current firmware versions on a server.

onecli update get --bmc admin:Password123@10.0.0.14

This command lists all installed firmware components and their versions, confirming the success of your update operations.

Bulk Operations and Scripting

The real power of OneCLI emerges when combined with scripting languages (Bash, PowerShell, Python) to automate tasks across many servers. Here's a conceptual example for iterating through a list of servers:

#!/bin/bash

# List of server IPs and XCC credentials
SERVERS=(
  "10.0.0.10:admin:Password123"
  "10.0.0.11:admin:Password123"
  "10.0.0.12:admin:Password123"
)
FIRMWARE_REPO="./firmware_repo"
BASELINE_CONFIG="./baseline.txt"
LOG_DIR="./logs"

mkdir -p $LOG_DIR

for SERVER_ENTRY in "${SERVERS[@]}"; do
  IFS=':' read -r IP USER PASS <<< "$SERVER_ENTRY"
  BMC_TARGET="${USER}:${PASS}@${IP}"
  LOG_FILE="${LOG_DIR}/server_${IP}.log"

  echo "Processing server: ${IP}" | tee -a $LOG_FILE

  # Step 1: Apply baseline configuration
  echo "Applying baseline configuration to ${IP}..." | tee -a $LOG_FILE
  onecli config set --file "$BASELINE_CONFIG" --bmc "$BMC_TARGET" --reboot --force >> $LOG_FILE 2>&1
  if [ $? -ne 0 ]; then
    echo "ERROR: Configuration failed for ${IP}. Check $LOG_FILE" | tee -a $LOG_FILE
    continue
  fi

  # Step 2: Update firmware
  echo "Updating firmware for ${IP}..." | tee -a $LOG_FILE
  onecli update flash --dir "$FIRMWARE_REPO" --bmc "$BMC_TARGET" --reboot --force >> $LOG_FILE 2>&1
  if [ $? -ne 0 ]; then
    echo "ERROR: Firmware update failed for ${IP}. Check $LOG_FILE" | tee -a $LOG_FILE
    continue
  fi

  echo "Successfully processed ${IP}." | tee -a $LOG_FILE
done

echo "Bulk operation complete."

This script demonstrates how to loop through server entries, apply a configuration, and then update firmware, logging all output for review. For production environments, robust error handling, credential management (e.g., using environment variables or a secure vault instead of hardcoding passwords), and parallel execution are recommended.

OneCLI Limitations and Considerations

  • Version Compatibility: Always check the OneCLI documentation for compatibility with your specific ThinkSystem server models and XCC firmware versions. Newer OneCLI versions often support more server features and models.
  • Credential Security: Passing credentials directly on the command line can expose them in process lists or shell history. Consider using environment variables (e.g., XCC_USER, XCC_PASS) or prompting for input for enhanced security, especially in interactive scripts.
  • Reboot Requirements: Many configuration changes and firmware updates require a server reboot. Plan these operations during maintenance windows.
  • Network Latency: Bulk operations over high-latency networks can be slow or encounter timeouts. Ensure robust connectivity between the OneCLI host and your XCCs.
  • Resource Management: OneCLI can consume significant memory and CPU, especially during firmware updates to multiple servers concurrently. If running on a management server, monitor its resources.

Common Pitfalls and Troubleshooting

  • Authentication Failures: Double-check XCC usernames and passwords. Ensure the account has sufficient privileges (typically "Administrator" or equivalent).
  • Network Issues: Verify connectivity to the XCC IP address on port 443. Use ping and nmap -p 443 <XCC_IP> to confirm. Firewalls are a common culprit.
  • Incorrect Firmware Files: Ensure the firmware files in your repository are correct for your server models. OneCLI will typically report "No applicable updates found" if they don't match. Download firmware from the official Lenovo support site.
  • "Connection Reset by Peer" / SSL Errors: This often indicates an issue with the XCC's web server or a mismatch in SSL/TLS protocols. Ensure your OneCLI version is recent enough to support the XCC's security settings. XCC firmware updates sometimes resolve these.
  • Timeout Errors: For slow networks or very large updates, OneCLI operations might time out. There isn't a direct global timeout setting in OneCLI, but ensuring stable network conditions and running operations sequentially for problematic servers can help.
  • Configuration Command Syntax: When manually editing configuration files, ensure the syntax exactly matches what onecli config show outputs. Typos or incorrect parameter names will lead to errors.

Back to the knowledge base · Ask the AI assistant