Tarball Installation

This topic describes how to install Moogsoft Onprem on a single host using the tarball archives (previously called the non-root install).

Follow these steps if you do not have root access to the machine or machines on which you will install Moogsoft Onprem.

To install Moogsoft Onprem in a highly available environment, see High Availability Installation.

For RPM installation steps, see RPM Installation.RPM Installation

Before you begin

Before you start to install Moogsoft Onprem, complete all steps in Moogsoft Onprem Online Tarball Pre-installation or Moogsoft Onprem Offline Tarball Pre-installation.

Installation process pre-requisite

An experienced Linux RHEL System Administrator is required to perform the installation/upgrade. If help is needed, please contact Moogsoft Support in order to engage Moogsoft Professional Services

Install Moogsoft Onprem

To complete a tarball installation of Moogsoft Onprem, perform the following steps:

Download the tarball installer, using one of the following options:
- Download via a web browser from https://speedy.moogsoft.com/v9/installer and user the Yum user credentials provided by Moogsoft support.
- Use the following cURL command, substituting your "speedy" Yum repo user credentials:
```
curl -L -O "https://<username>:<password>@speedy.moogsoft.com/v9/installer/moogsoft-enterprise-9.1.0.tgz"
```
Optional: GPG key validation of the tarball
Users who want to validate the tarball before installation must follow these steps:
1. Download the key from this site:
```
https://keys.openpgp.org/vks/v1/by-fingerprint/0A8FD9AB6F1693A1967B3B8CB919E617EC6946C2
```
2. Copy the key (it will be a .asc file) to the server onto which the tarball will be installed.
3. Import the key:
```
gpg --import 0A8FD9AB6F1693A1967B3B8CB919E617EC6946C2.asc
```
4. Download the moogsoft-enterprise-9.1.0.tgz.sig file from the same 'speedy' path:
```
curl -L -O "https://<username>:<password>@speedy.moogsoft.com/v9/installer/moogsoft-enterprise-9.1.0.tgz.sig"
```
5. Ensure both the tgz and the .sig file are both in the same folder, then copy the following command into a bash terminal and run it to perform the validation:
```
gpg --verify moogsoft-enterprise-9.1.0.tgz.sig moogsoft-enterprise-9.1.0.tgz
```
6. Confirm that the report states:
```
Good signature from "Moogsoft Information Security Team "<security@moogsoft.com>"
```

Extract the non-Percona dependency files. This step is ONLY needed if Moogsoft Onprem is being installed on a server without internet access and the 'Offline Tarball Pre-install' document was followed. Perform steps from the working directory.

mkdir -p ~/install/libraries;

cp ~/libquadmath-*.rpm ~/install/libraries/
cp ~/libgfortran-*.rpm ~/install/libraries/
cp ~/compat-libgfortran-48-*.rpm ~/install/libraries/
cp ~/libaio-*.rpm ~/install/libraries/

cd ~/install/libraries/

rpm2cpio ./libaio-*.rpm | cpio -idmv && \
rm -f ./libaio-*.rpm && \
rm -f ~/install/libraries/usr/lib64/libaio.so.1 && \
ln -s ~/install/libraries/usr/lib64/libaio.so.1.0.1 ~/install/libraries/usr/lib64/libaio.so.1

rpm2cpio libquadmath-*.rpm | cpio -idmv && \
rm -f libquadmath-*.rpm

rpm2cpio libgfortran-*.rpm | cpio -idmv && \
rm -f libgfortran-*.rpm

rpm2cpio compat-libgfortran-48-*.rpm | cpio -idmv && \
rm -f compat-libgfortran-48-*.rpm

echo "export LD_LIBRARY_PATH=$(pwd)/usr/lib64:\$LD_LIBRARY_PATH" >> ~/.bashrc
source ~/.bashrc

Unzip and untar the Moogsoft Onprem distribution archive in your working directory:
```
tar -xf moogsoft-enterprise-9.1.0.tgz
```
The distribution archive contains the following files:
- A README.txt file
- The installation script: moogsoft-enterprise-install-9.1.0.sh
- The distribution archive: moogsoft-enterprise-dist-9.1.0.tgz
- The integration distribution archive: moogsoft-enterprise-integrations-dist-9.1.0.tgz
Run the Percona installation script (this requires the 'nc' package to be present on the system as a prerequisite):
```
bash install_percona_nodes_tarball.sh
```
The script guides you through the installation process.
Use these settings to configure a single database node on the same server as Moogsoft Onprem:
- Configure Percona as "Primary".
- Do not set the server to "DB only".
- Set the first database node IP address to the server IP address.
- When prompted to enter the IP addresses of the second and third nodes, press Enter to skip these settings.
Source the bashrc file:
```
source ~/.bashrc
```
If the root user installs the tarball, Moogsoft Onprem must not be installed in the /root directory
Execute the installation script moogsoft-enterprise-install-9.1.0.sh in your working directory to install Moogsoft Onprem.
```
bash moogsoft-enterprise-install-9.1.0.sh
```
The script guides you through the installation process. The installation directory defaults to <working-directory>/Moogsoft. You can change this if you wish.
Set the $MOOGSOFT_HOME environment variable to point to your installation directory, and add $MOOGSOFT_HOME/bin/utils to the path. For example:
```
echo "export MOOGSOFT_HOME=~/moogsoft" >> ~/.bashrc
echo "export PATH=$PATH:\$MOOGSOFT_HOME/bin/utils" >> ~/.bashrc && \
source ~/.bashrc
```

Initialize Moogsoft Onprem

When the installation process is complete, initialize Moogsoft Onprem as follows:

Configure the Toolrunner to execute locally by setting "execute_locally: true" in $MOOGSOFT_HOME/config/servlets.conf:
```
sed -i 's/# execute_locally: false,/,execute_locally: true/1' $MOOGSOFT_HOME/config/servlets.conf
```
Run the initialization script moog_init to initialize Moogsoft Onprem.
You can run this script with the -k flag to set processes (such as Percona, RabbitMQ, Moogfarmd) to automatically restart when you reboot the system. For example:
```
$MOOGSOFT_HOME/bin/utils/moog_init.sh -kI <zone_name> -u root
```
If you do not want to set these processes to automatically restart when you reboot the system, run this script without the -k flag. For example:
```
$MOOGSOFT_HOME/bin/utils/moog_init.sh -I <zone_name> -u root
```
If you then decide after you have finished the install that you want these processes to automatically restart after all, run:
```
[ -z "$(crontab -l|grep process_keepalive.sh)" ] && (crontab -l; echo -e "*\t*\t*\t*\t* $MOOGSOFT_HOME/bin/utils/process_keepalive.sh 2>&1") | crontab -
```
The moog_init script prompts you to accept the End User License Agreement (EULA) and guides you through the initialization process.
When asked if you want to change the configuration hostname, say yes and enter the public URL for the server.
Note
When prompted for a password, enter the password for the root database user (not the UNIX system user). If you are installing Percona on this machine for the first time, leave the password blank and press Enter to continue.
The zone_name sets up a virtual host for the Message Bus. If you have multiple systems sharing the same bus, set a different zone name for each.
For more information see Configure Services to Restart.

Restart Moogfarmd and Apache Tomcat:

$MOOGSOFT_HOME/bin/utils/process_cntl moog_farmd restart
$MOOGSOFT_HOME/bin/utils/process_cntl apache-tomcat restart

Tarball inetd crontab setup

The process which allows a programmatic check (via HTTP endpoint) of whether Percona MySQL is available (inetd) needs to start when the server itself is started or restarted (along with Percona itself).

For Tarball deployments, this is controlled using crontab which runs once per minute. The following command can be run to add the appropriate crontab entry:

[ -z "$(crontab -l|grep install\/inetd)" ] && (crontab -l; echo -e "*\t*\t*\t*\t* [ -z \"\$(ps ax|grep install\/inetd|grep -v grep)\" ] && { nohup ~/install/inetd &>> ~/inetd_\$(date +\%Y\%m\%d-\%H\%M\%S).log & }") | crontab -

If the log file is not needed this part of the command can be updated as follows:

nohup ~/install/inetd &>> >/dev/null &

If the script fails to restart the inetd service when it is stopped, ensure the PATH set in the crontab to define the main bin directories and the mysql bin directory (as it is required by the clustercheck percona script).

Configure OpenSearch heap size

The minimum and maximum JVM heap sizes must be large enough to ensure that OpenSearch starts.

To set the minimum and maximum JVM heap sizes:

For RPM, edit the /etc/opensearch/jvm.options.d/moog.options file.
For Tarball, edit the $MOOGSOFT_HOME/cots/opensearch/jvm.options.d/moog.options file.

These heap sizes must be the same value. For example, to set the heap to 4 GB:

# Xms represents the initial size of total heap space
# Xmx represents the maximum size of total heap space

-Xms4g
-Xmx4g

If you change the heap size, you must restart OpenSearch:

For RPM, run service opensearch restart.
For Tarball, run $MOOGSOFT_HOME/bin/utils/process_cntl opensearch restart.

Disable the enhanced Content Security Policy (optional)

Moogsoft has provided an optional enhanced Content Security Policy (CSP) as part of this release. CSP is a security standard introduced to prevent Cross Site Scripting (XSS), Cross Site Request Forgery (CSRF), and other data injection attacks. For more information, see the Mozilla document on Content Security Policy.

The CSP is controlled by Nginx and is enabled by default. You can optionally disable it:

Edit the following file:

$MOOGSOFT_HOME/cots/nginx/config/conf.d/moog-ui-headers.conf

Comment the line that starts with add_header Content-Security-Policy and save the file.

Restart Nginx:

$MOOGSOFT_HOME/bin/utils/process_cntl nginx restart

Note

If you enable the enhanced CSP you must follow the steps below to allow access to external domains. If you want to access the UI with the Safari web browser, you must follow the steps below to configure Moogsoft Onprem for use with Safari.

Allow access to external domains

If you enable the enhanced CSP, the following features require additional configuration to allow access to external domains:

Situation Room plugins to external domains
Situation client tools to external URLs

To allow access to required external domains:

Edit the following file:

$MOOGSOFT_HOME/cots/nginx/config/conf.d/moog-ui-headers.conf

Add a frame-src directive to the Content-Security-Policy header for the required domain. For example, run the following command to allow Google domains:

sed -i "s/add_header Content-Security-Policy\(.*\)\" always/add_header Content-Security-Policy\1; frame-src 'self' *.google.com\" always/" $MOOGSOFT_HOME/cots/nginx/config/conf.d/moog-ui-headers.conf

Restart Nginx:

$MOOGSOFT_HOME/bin/utils/process_cntl nginx restart

Note

Moogsoft Onprem allows access to Pendo and WalkMe domains by default.

Configure Moogsoft Onprem for use with Safari

Due to a known issue in the Safari web browser, you must take additional steps if you've enabled the enhanced CSP and you want to access the UI with Safari:

Edit the following file:

$MOOGSOFT_HOME/cots/nginx/config/conf.d/moog-ui-headers.conf

Add the following websocket URLs to the Content-Security-Policy section of the file. Substitute your hostname for <webhost>:

wss://<webhost>/moogpoller/ws
wss://<webhost>/integrations/ws/v1

You can update the configuration using a command similar to the following. Substitute your hostname for <webhost>:

sed -i.bak "s;connect-src 'self' app;connect-src 'self' wss://<webhost>/moogpoller/ws wss://<webhost>/integrations/ws/v1 app;g" $MOOGSOFT_HOME/cots/nginx/config/conf.d/moog-ui-headers.conf

Restart Nginx:

$MOOGSOFT_HOME/bin/utils/process_cntl nginx restart

Run an unattended installation

The moog_init script provides the ability to run a 'quiet' installation and to automatically accept the terms of the EULA. This means that, instead of manually installing and initializing Moogsoft Onprem, you can write a bash script to automatically do this. For example:

~/moogsoft-aiops-enterprise-9.0*.sh -d ~/moogsoft && ~/moogsoft/bin/utils/moog_init.sh \
-qI MoogsoftAIOps -p MySQLpasswd -u root --accept-eula

Run moog_init.sh -h for a description of all options.

Important

Enabling the "latency performance" RHEL profile is strongly recommended. This profile allows RabbitMQ to operate much more efficiently so that throughput is increased and smoothed out.

For more information on performance profiles, see https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/monitoring_and_managing_system_status_and_performance/getting-started-with-tuned_monitoring-and-managing-system-status-and-performance

Enable the profile by running the following command as root:

tuned-adm profile latency-performance

This setting will survive machine restarts and only needs to be set once.

Verify the installation

Change passwords for default users

Install Moogsoft Add-Ons

Moogsoft periodically releases add-ons to extend and enhance the core Moogsoft Onprem functionality. For example, new Workflow Engine functions, new Workflow Engines, or Integrations tiles. All add-ons releases are cumulative and include the fixes from previous releases.

Once you have finished upgrading or installing Moogsoft Onprem, you should install the Moogsoft Onprem add-ons to ensure you have the latest version.

See Install Moogsoft Add-ons for more information on how to install the Moogsoft Onprem add-ons.Install Moogsoft Add-ons

In this section:

Tarball Installation

Before you begin

Installation process pre-requisite

Install Moogsoft Onprem

Initialize Moogsoft Onprem

Note

Tarball inetd crontab setup

Configure OpenSearch heap size

Disable the enhanced Content Security Policy (optional)

Note

Allow access to external domains

Note

Configure Moogsoft Onprem for use with Safari

Run an unattended installation

Important

Verify the installation

Change passwords for default users

Install Moogsoft Add-Ons

Search results