What’s new for Red Hat Enterprise Linux 6 Server?

Reliability, availability, and scalability (RAS)
• Red Hat Enterprise Linux 6 supports more sockets, more cores, more threads, and more memory.
• RAS hardware-based hot add of CPUs and memory is enabled.
• When supported by machine check hardware, the system can recover from some previously fatal hardware errors with minimal disruption.
• Memory pages with errors can be declared as “poisoned” and will be avoided.
• The CFS schedules the next task to be run based on which task has consumed the least time, task prioritization, and other factors. Using hardware awareness and multi-core topologies, the CFS optimizes task performance and power consumption.

Filesystems
The new default file system, ext4, is faster, more robust, and scales to 16 TB.
The scalable file system add-on contains the XFS file system, which scales to 100 TB. The resilient storage add-on includes the high availability, clustered GFS2 file system.
NFSv4 is significantly improved over NFSv3, and is backwards compatible.
Fuse allows filesystems to run in user space allowing testing and development on newer fused-based filesystems (such as cloud filesystems).

High availability
• The web interface based on Conga has been redesigned for added functionality and ease of use.
• The cluster group communication system, Corosync, is mature, secure, high-performance, and lightweight.
• Nodes can re-enable themselves after failure without administrative intervention using unfencing.
• Unified logging and debugging simplifies administrative work.
• Virtualized KVM guests can be run as managed services, which enables fail-over, including between physical and virtual hosts.
• Centralized configuration and management is provided by Conga.
• a single cluster command can be used to manage system logs from different services, and the logs have a consistent format that is easier to parse.

Power management
The tickless kernel feature keeps systems in the idle state longer, resulting in net power savings.
active State power Management and aggressive Link power Management provide enhanced system control, reducing the power consumption of I/O subsystems. administrators can actively throttle power levels to reduce consumption.
Relatime drive access optimization reduces filesystem metadata write overhead.

System resource allocation
• Cgroups organize system tasks so that they can be tracked and so that other system services can control the resources that cgroup tasks may consume (partitioning). Two userspace tools, cgexec and cgclassify, provide easy configuration and management of cgroups.
• Cpuset applies CPU resource limits to cgroups, allowing processing performance to be allocated across tasks.
• The memory resource controller applies memory resource limits to cgroups.
• The network resource controller applies network traffic limits to cgroups.

Storage
• a snapshot of a logical volume may be merged back into the original logical volume, reverting changes that occurred after the snapshot.
• Mirror logs of regions that need to be synchronized can be replicated, supporting high availability.
• LVM hot spare allows the behavior of a mirrored logical volume after a device failure to be explicitly defined.
• DM-Multipath allows paths to be dynamically selected based on queue size or I/O time data.
• Very large SAN-based storage is supported.
• Automated I/O alignment and self-tuning is supported.
• Filesystem usage information is provided to the storage device, allowing administrators to use thin provisioning to allocate storage on-demand.
• SCSI and aTa standards have been extended to provide alignment and I/o hints, allowing automated tuning and I/o alignment.
• DIF/DIX provides better integrity checks for application data.

Networking
• UPD Lite tolerates partially corrupted packets to provide better service for multimedia protocols, such as voIp, where partial packets are better than none.
• Multiqueue Networking increases processing parallelism for better performance from multiple processors and CPU cores.
• Large Receive Offload (LRO) and Generic Receive Offload (GRO) aggregate packets for better performance.
• Support for datacenter bridging includes data traffic priorities and flow control for increased quality of service.
• New support for software Fiber Channel over Ethernet (FCoE) is provided.
• iSCSI partitions may be used as either root or boot filesystems.
• Ipv6 is supported.

Access control
• SELinux policies have been extended to more system services.
• SELinux sandboxing allows users to run untrusted applications safely and securely.
• File and process permissions have been systematically reduced whenever possible to reduce the risk of privilege escalation.
• New utilities and system libraries provide more control over process privileges for easily managing reduced capabilities.
• Walk-up kiosks (as in banks, HR departments, etc.) are protected by SELinux access control, with on-the-fly environment setup and take-down, for secure public use.
• openswan includes a general implementation of Ipsec that works with Cisco Ipsec.

Enforcement and verification of security policies
• OpenSCAP standardizes system security information, enabling automatic patch verification and system compromise evaluation.
• The new System Security Services Daemon (a.k.a. SSSD) provides centralized access to identity
and authentication resources, enables caching and offline support.
• OpenLdap is a compliant LDAP client with high availability from N-way multimaster replication and performance improvements.

Kernel-based virtualization
• The KVM hypervisor is fully integrated into the kernel, so all Red Hat Enterprise Linux system improvements benefit the virtualized environment.
• The application environment is consistent for physical and virtual systems.
• Deployment flexibility, provided by the ability to easily move guests between hosts, allows administrators to consolidate resources onto fewer machines during quiet times or to free up hardware for maintenance downtime.

Leverages kernel features
• Hardware abstraction enables applications to move from physical to virtualized environments independently of the underlying hardware.
• Increased scalability of CPUs and memory provides more guests per server.
• Block storage benefits from selectable I/O schedulers and support for asynchronous I/O.
• Cgroups and related CPU, memory, and networking resource controls provide the ability to reduce resource contention and improve overall system performance.
• Reliability, availability, and serviceability (RAS) features (e.g., hot add of processors and memory, machine check handling, and recovery from previously fatal errors) minimize downtime.
• Multicast bridging includes the first release of IGMP snooping (in IPv4) to build intelligent packet routing and enhance network efficiency.
• CPU affinity assigns guests to specific CPUs.

Guest acceleration
• CPU masking allows all guests to use the same type of CPU.
• SR-IOV virtualizes physical I/O card resources, primarily networking, allowing multiple guests to share a single physical resource.
• Message-signaled interrupts deliver interrupts as specific signals, increasing the number of interrupts.
• Transparent hugepages provide significant performance improvements for guest memory allocation.
• Kernel Same Page (KSM) provides reuse of identical pages across virtual machines (known as deduplication in the storage context).
• The tickless kernel defines a stable time model for guests, avoiding clock drift.
• Advanced paravirtualization interfaces include non-traditional devices such as the clock (enabled by the tickless kernel), interrupt controller, spinlock subsystem, and vmchannel.
• In virtualized environments, sVirt (powered by SELinux) protects guests from one another.
• Windows WHQL-certified drivers enable virtualized Windows systems and allow Microsoft customers to receive technical support for virtualized instances of Windows Server.

Installation, updates, and deployment
• Anaconda supports installation of a “minimal platform” as a specific server installation or as a strategy for reducing the number of software packages to increase security.
• Red Hat Network and Red Hat Network Satellite continue to provide management, provisioning, and monitoring for large deployments.
• Installation options have been reorganized into “workload profiles” so that each system installation will provide the right software for specific tasks.
• Dracut, a replacement for mkinitrd, minimizes the impact of underlying hardware changes, is more maintainable, and makes it easier to support third-party drivers.
• The new yum history command provides information about yum transactions, and supports undo and redo of selected operations.
• Yum and RPM offer significantly improved performance.
• RPM signatures use the Secure Hash Algorithm (SHA256) for data verification and authentication, improving security.
• Storage devices can be designated for encryption at installation time, protecting user and system data. key escrow allows recovery of lost keys.
• Standards-Based Linux Instrumentation for Manageability (SBLIM) manages systems using Web-Based Enterprise Management (WBEM).
• ABRT enhanced error reporting speeds triage and resolution of software failures.

Routine task delegation
• Policykit allows administrators to provide users access to privileged operations, such adding a printer or rebooting a desktop, without granting administrative privileges.
• Samba improvements include support for Windows 2008 R2 trust relationships, specifically Windows cross-forest, transitive trust, and one-way domain trust.
• applications can use openChange to gain access to Microsoft Exchange servers using native protocols, allowing mail clients like Evolution to have tighter integration with Exchange servers.

This is summerized from The official release note which can be downloaded here (pdf).

Sometimes when you face unexpected error like below, you might want to update this toolset to the latest version.

$ sudo /etc/init.d/hp-snmp-agents start
Using Proliant Standard
IPMI based System Health Monitor
Using standard Linux IPMI device driver
Starting ipmi drivers: [ OK ]
Starting Proliant Standard
IPMI based System Health Monitor (hpasmlited): [FAILED]

/etc/init.d/hp-health: failed to start! Please review log file for details.
The log file locations are documented in the hp-health(4) man page.

How can we Update HP System Health Monitor to the latest version?

HP maintains a software delivery repository to provides access to various software products. For ProLiant running RHEL/CentOS v5, we can access it like:

$ wget http://downloads.linux.hp.com/SDR/downloads/bootstrap.sh
$ sudo sh bootstrap.sh ProLiantSupportPack -r 5Server -y hp-psp-repository.repo

The above two commands create a new repo configuration named /etc/yum.repos.d/hp-psp-repository.repo. Then the utilities can be updated as normal packages as below:

$ sudo yum install hp-health

Then the issue resolved:

$ sudo /etc/init.d/hp-snmp-agents start
Starting Health agent (cmahealthd): [ OK ]
Starting Standard Equipment agent (cmastdeqd): [ OK ]
Starting Host agent (cmahostd): [ OK ]
Starting Threshold agent (cmathreshd): [ OK ]
Starting RIB agent (cmasm2d): [ OK ]
Starting Rack Infrastructure Info Srv (cpqriisd): [ OK ]
Starting Rack agent (cmarackd): [ OK ]
Starting Performance agent (cmaperfd): [ OK ]
Starting SNMP Peer (cmapeerd): [ OK ]
Starting Storage Event Logger (cmaeventd): [ OK ]
Starting FCA agent (cmafcad): [ OK ]
Starting SAS agent (cmasasd): [ OK ]
Starting IDA agent (cmaidad): [ OK ]
Starting IDE agent (cmaided): [ OK ]
Starting SCSI agent (cmascsid): [ OK ]
Starting NIC Agent Daemon (cmanicd): [ OK ]

This minor update releases typically provide feature enhancements, bugfixes and new hardware support. From the release notes:

Highlights of the Red Hat Enterprise Linux 5.5 release include hardware enablement for the Intel Boxboro-EX platform, AMD Magny-Cours processor and IBM Power 7 processor.
Virtualization is improved, with support for multiple 10 GigE SR-IOV cards, and automatic usage of hugepages for virtual guest memory when enabled on the system. Interoperability improvements include boot support for virtual machines using Microsoft based PXE services.

A summary of technical details would highlight:

• Kickstart improvements to logging post-install
• New hardware driver support (pmcraid, ibmvfs, bfa, be2iscsi)
• Updated hardware support (too many to list)
• Run-time memory allocation for KVM guests (memory ballooning)
• PCI passthrough improvements (hotswapping PCI devices, 1:1 performance improvements)
• Detecting kernel tasks stuck in the uninterruptible sleep state (D-state)
• Improved CFQ I/O scheduler performance
• Kernel CIFS updates and new GFS mount option (for troubleshooting)

Apart from this Red Hat also shared Technology Previews within each release. Functionality that is not yet supported, but available for testing purposes:

• FCoE (Fibre Channel over Ethernet)
• ext4 filesystem support
• gcc 4.4 and new glibc malloc
• Trusted Platform Module (TPM) hardware support
• eCryptfs cryptographic filesystem
• Stateless Linux
• SGPIO Support for dmraid
• Device Failure Monitoring of RAID sets
• iSER support (block storage transfer across a network)

The above Technology Preview features of RHEL5.5 may become part of a future RHEL5 release! Even though there is no predicted timeline for CentOS releases, CentOS 5.5 is not expected before May 4th 2010.

For more details on the changelog, please check the release notes here.

The question is: How can I disable a certain package from being updated by Yum in Linux server environment?

After having a check with the parameter “–help“, I know that the Yum under RedHat / CentOS has an option “–exclude“, and it will exclude a specific package by name or shell glob (* or ?) from being updated, here’re two examples:

1, Bypass updates for an exact package
You can just run this command. Note that you need to login as privileged user to use following commands:

yum --exclude=mysql-server update

2, Bypass some packages with glob
For example, with the following command, you can exclude both mysql-client and mysql-server from update:

yum --exclude=mysql* update

There’s another alternative way to bypass the package.
Yum also supplies a configuration parameter that can be used in /etc/yum.conf to bypass specified packages completely.
To exclude packages from being updated, you can edit /etc/yum.conf and add one line as below:

exclude=mysql*

Further readings: Updating Your System with yum
For any issues, it’s welcome to create postings at our support forum at forum.admon.org!

Before you start, A word of advice i believe most experienced RHEL/CentOS users will show you regarding what you’re thinking:

Upgrade between minor versions (i.e. CentOS 5.2 -> 5.3 -> 5.4, or even 5.0 -> 5.4) YES
Upgrade between major system versions (i.e. CentOS 4.8 to CentOS 5.4) NO

As far as I recall, not even Red Hat recommends this – although they do guarantee the miner updates will go smoothly. Even if you manage to hammer that 4.8 to 5.4 upgrade into place, you might end up with a mess that will be very difficult to maintain. Before processing the system update, it’s suggested to create a backup!

If you are currently running a version of RHEL/CentOS earlier than 4.8 (cat /etc/redhat-release), then please do a proper ‘yum update‘ and get your current system updated to 4.8 before we start.

Then the first thing we need to do is to make sure none of our core binaries, libraries or other content is immutable as it causes package installation failures. If you use immutable bits on system paths then you should run these commands:

chattr -Ria /bin
chattr -Ria /etc
chattr -Ria /etc
chattr -Ria /include
chattr -Ria /lib
chattr -Ria /sbin
chattr -Ria /usr/bin
chattr -Ria /usr/include
chattr -Ria /usr/lib
chattr -Ria /usr/libexec
chattr -Ria /usr/local/bin
chattr -Ria /usr/local/include
chattr -Ria /usr/local/lib
chattr -Ria /usr/local/sbin
chattr -Ria /usr/sbin
chattr -Ria /usr/share
chattr -Ria /var/lib
chattr -Ria /var/lock
chattr -Ria /var/log
chattr -Ria /var/run
chattr -Ria /var/spool/repackage

Once finished, go ahead and have a quick run through of cleaning up yum cache, double check that any pending updates are installed and rebuild the rpmdb:

yum clean all && yum update

If you run into any dependency issues for packages that are not essential, such as syslinux and lftp then you can either exclude them or better just remove them. If the denpency issue is openssh-server related, you can enable telnet login during update by modifing /etc/xinetd.d/telnet.

rpm -e lftp syslinux mkboot

OR (but not recommended)

yum update --exclude=syslinux --exclude=lftp --exclude=mkboot

At this point you should be able to run a ‘yum update‘ command with optional exclude and receive no errors. Now we are ready to get going, please google around, find and download these packages, they mostly available at CentOS official mirror site:

# ls
centos-release-5-4.el5.centos.1.i386.rpm    python-elementtree-1.2.6-5.el4.centos.i386.rpm
centos-release-notes-5.4-4.i386.rpm       python-elementtree-1.2.6-5.el5.i386.rpm
kernel-2.6.18-164.el5.i686.rpm            python-elementtree-1.2.6-5.i386.rpm
kernel-devel-2.6.18-164.el5.i686.rpm      python-sqlite-1.1.7-1.2.1.i386.rpm

We need to go ahead and setup the centos-release package as follows:

rpm -Uhv centos-release-*.rpm

If you see that CentOS-Base.repo was created as /etc/yum.repos.d/CentOS-Base.repo.rpmnew then move it to the right place:

# mv /etc/yum.repos.d/CentOS-Base.repo.rpmnew /etc/yum.repos.d/CentOS-Base.repo

Now we are ready to go with kernel changes, this is an important part so pay attention. The key to successful upgrade is that you remove ALL OLD KERNELS as many packages will fail to install during the upgrade if they detect a release 4.x kernel due to minimum kernel version dependency checks. We will first start with installing the new CentOS 5.4 kernel so it preserves grub templating:

rpm -ivh kernel-2.6.18-164.el5.i686.rpm kernel-devel-2.6.18-164.el5.i686.rpm --nodeps

NOTE: release 5.x has smp support integrated into the standard kernel, so no *-smp version is required for multi-processor systems.

If you are running an older system the chances are you got allot of older kernel packages installed, so make sure you get them all out of the way:

rpm -e $(rpm -qa | grep kernel | grep -v 2.6.18 | tr 'n' ' ') --nodeps

That said and done you should now only have 2 kernel packages installed which are the 2.6.18 release 5.x kernels. DO NOT under any circumstance continue if you still got 2.6.9 release 4.x kernels packages installed, remove them ALL!

# rpm -qa | grep -i kernel
kernel-2.6.18-164.el5
kernel-devel-2.6.18-164.el5

A cleanup of /etc/grub.conf may be required, though the rpm command should have done this for you already, but review it anyways for good measure. You should find that 2.6.18-164.el5 is the only kernel in the file. When kernel updated, a reboot here is OK, but it’s not suggested.

Then we can continute the system updates. There is a known bug with python-elementtree package versions which cause yum/rpm to think the release 4.x version is newer than the 5.x version, to get around this without blowing up the entire python installation we need to remove the package from just the rpmdb as follows:

rpm -e --justdb python-elementtree --nodeps

We can now go ahead and use yum to start the upgrade process, this is a dry run and will take some minutes to compile list of available packages and associated dependency checks. You should carry the exclude options, if any, that you used during the ‘yum update’ process as so to avoid unresolvable dependencies:

yum clean all
yum upgrade

You will end up with a small list of dependency errors, these should be resolved by again evaluating a packages need as a critical system component and either removing it with ‘rpm -e‘ or excluding it with ‘–exclude‘ (remember to query description if you are unsure what something does). In my case the packages that threw up red flags were stuff I had manually installed over time such as nfs in addition to default installed samba, these can all safely be removed or excluded as you prefer.

    Error: Missing Dependency: perl(Convert::ASN1) is needed by package samba
    Error: Missing Dependency: libevent-1.1a.so.1 is needed bypackage nfs-utils

At this point you should be ready to do a final dry run and see where we stand on dependencies, rerun the earlier ‘yum upgrade‘ while making sure to carry over any exclude options you are using.

You should now end up with a summary of actions that yum needs to perform, go ahead and kick it off… this will take a bit time to complete.

    Transaction Summary
    ===========================================================
    Install 183 Package(s)
    Update 527 Package(s)
    Remove 0 Package(s)
    Total download size: 679 M
    Is this ok [y/N]:Y

Once yum has completed we need to fix a few things, the first is the rpmdb needs a rebuild due to version changes that will cause any rpm commands to fail:

rm -f /var/lib/rpm/__db.00*
rpm --rebuilddb
yum clean all

The next issue on the list is python-elementtree and python-sqlite, one or both of these may have ended up in a broken state that will cause all yum commands to break, so we will go ahead and reinstall both of them:

rpm -e --justdb python-elementtree --nodeps
rpm -ivh python-elementtree-1.2.6-5.el5.i386.rpm
rpm -ivh python-sqlite-1.1.7-1.2.1.i386.rpm --nodeps --force

The yum command should now work, go ahead and run it with no options, if you do not get any errors, you are all sorted!

Hopefully the install went well for you, the only thing left to do is go ahead and reboot the system:

shutdown -rf now

For the sake of avoiding a system raised fsck, we will reboot with the -f option to skip fsck.

Finding out that Xen in Redhat Enterprise Linux is not so easy to download – I cannot find it from any public accessible websites, I decided to use CentOS’s yum repoes to download and install Xen. When I have CentOS yum repo created in /etc/yum.repo.d, I noticed that it cannot work in RHEL – It cannot recognize OS version without some updates of application.

That’s why I tried to convert my RHEL 5.3 to CentOS 5.3. Here are the commands that I used. You can just copy & paste:

rpm -e --nodeps redhat-release
rpm -e --nodeps yum-rhn-plugin
wget http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-5
rpm --import RPM-GPG-KEY-CentOS-5
rpm -Uvh http://mirror.centos.org/centos/5/os/x86_64/CentOS/centos-release-notes-5.3-3.x86_64.rpm
rpm -Uvh http://mirror.centos.org/centos/5/os/x86_64/CentOS/centos-release-5-3.el5.centos.1.x86_64.rpm
wget http://mirror.centos.org/centos/5/os/x86_64/CentOS/yum-3.2.19-18.el5.centos.noarch.rpm

Now the convertion has finished, you can check /etc/redhat-release for an updated information, and the repo’s config directory for more details on current repoes.

Finally, dont forget to enjoy a FREE CentOS yum updating:

yum clean all
yum update

I’m not quite sure if it totally works well. Nevertheless, I’ve succefully had the system updated, the Xen kernel are running smoothly as well. If I faced any issues, I’d create a new post at our redhat/centos support forum.