### **LARGE-SCALE PC MANAGEMENT AND CONFIGURATION FOR SNS DIAGNOSTICS ^\[1\]^**

Darryl J. Murphy, ORNL, Oak Ridge, TN 37830, USA

J. David Purcell, ORNL, Oak Ridge, TN 37830, USA

*Abstract*

The Spallation Neutron Source (SNS) Project's diagnostics group has
begun its implementation of more than 300 PC-based Network Attached
Devices (NAD) ^\[2\]^. An implementation of this size creates many
challenges, such as distribution of patches and software upgrades;
virus/worm potentials; and the configuration management, including
interaction with the SNS relational database. As part of the initial
solution, a base operating system (OS) configuration has been determined
and computer management software has been implemented. Each PC requires
a unique configuration, but all are based on a common OS and supporting
applications. The diagnostics group has started with an implementation
of an XP Embedded (XPe) OS and uses Altiris® eXpress Deployment
Solution™ ^\[3\]^. The use of XPe and Altiris gives the diagnostics
group the ability to easily configure, distribute, and manage software
on a large scale. This paper describes the initial experience and
discusses plans for the future.

**1 INTRODUCTION**

The SNS project is a partnership involving six U.S. Department of Energy
(DOE) national laboratories: Argonne, Brookhaven, Jefferson, Los Alamos,
Lawrence Berkeley, and Oak Ridge. The project is described in more
detail on the SNS Web site ^\[4\]^.

The SNS diagnostics group is in the process of installing more than 300
PC-based NADs. Several factors were considered in determining an
approach to the configuration management of the PCs. Although many of
the devices are similar in application (e.g., there will be 157 Beam
Position Monitors), the time scale of PC acquisition assured us of quite
different base hardware configurations. Modifications for future
implementations as well as deployed applications will occur as the
accelerator goes through its commissioning phases. OS updates will be
required. Finally, it is expected that time will affect the PC's
hardware, and replacement of parts or entire new chassis will be needed.

It was obvious very early on that tight control had to be exercised to
successfully manage such a large, diverse group of PCs. With a
challenging objective of potential push-button PC imaging and updates,
it was determined that tools like Altiris and an XPe OS would lead us to
the configuration control required.

**2 DEPLOYMENT TOOLSET**

*2.1 Altiris Deployment Solution*

Altiris Deployment Solution provides OS deployment, configuration, and
software deployment across hardware platforms and OS types. We leveraged
the SNS Technical Information Systems Group's experience with Altiris
Deployment Solution in their thth environment, which includes
approximately 500 desktops and laptops, and tailored the PC management
solution to our PC-based NADs. Altiris Deployment Solution is a
client/server PC management tool that has many features, some of which
include the ability to create disk images of the PCs hard disk and to
distribute that image across the network to a NAD that is configured to
Wake on LAN and PXE boot. This can be done to one or more of these
devices simultaneously. With our current OS, this process, regardless of
the number of machines being configured, takes about 15 minutes. Figure
1 shows how many PCs can be stacked and imaged at one time. This
software also allows us to deploy software, run specific scripts and
configure each device from one console. Altiris gives us the ability to
take a PC from its box and, assuming the supplier has set up the bios
correctly, set it in a rack where it will boot and receive its
appropriate image.

*2.2 Windows Server 2003*

Windows Server is required for the Altiris software. We have installed
it on a dual processor 2.8 GHz server with 2 GB RAM and 140 GB of
storage for disk images. This configuration exceeds initial hardware
requirements and allows for future growth.

*2.3 Windows XP Embedded*

Windows XP Embedded is an operating system that is based on a subset of
components which has been derived from the Windows OS. Based on the same
binaries as Windows XP Pro, XPe enabled us to choose the individual
components needed to achieve optimum functionality. XPe was also chosen
as the OS platform because of its ability to run with only the needed
services and because of the small footprint on disk. Currently the
embedded base OS stands at approximately 300 MB compared to
approximately 1 GB for the basic XP Pro installation. This smaller image
eliminates potential network security concerns as well as enables better
utilization of system resources (i.e., memory). Using the Task Manager,
you can see that the number of processes running and the memory
required, although varying, is half that of the standard XP Pro
installation. Conveniently, this lean image also speeds up the imaging
process.

Figure 1: XPe Image Deployment Using Altiris
![](media/image1.jpeg){width="5.688888888888889in"
height="4.266666666666667in"}

*2.4 Support Structure (ORACLE, Controls or ORNL implementation of
Network Registration \[NetReg\])*

Network security is important to the operation of both the accelerator
and to these devices. The Diagnostics group cannot allow others
uncontrolled access to the network or these machines. The SNS Controls
group has implemented NetReg, a process that requires all devices that
use the network to go through a registration and scan procedure. The use
of NetReg ensures that the network does not have devices attached to it
that are not meant to be. It also scans devices prior to being attached
to make sure they are virus free and properly patched.

*2.5 Backup*

The images are stored on a RAID 5 Storage Array and backed up to tape.

**3 CONFIGURATION PROCESS**

*3.1 Determining Base Configuration*

The deployment of all the diagnostic PCs is based on a standard base
configuration. Instead of using XP Pro or Windows 2000 as an OS, we have
used the components of XP Pro to make up our embedded OS. Determining
baseline components is an ongoing process that starts with the analysis
of a functioning complete OS on your planned hardware. We analyzed
functioning systems using XPe tools and use only those XP Pro components
that are needed. As work continues, it becomes obvious that certain
excluded components are needed and that some included components can be
omitted. An example of this includes the use of specific control panels.
These control panels are not necessary to a running OS but are useful on
our machines. At this point, we have a base list of components that
provides an OS capable of not only running the required device
applications but also directly supporting development.

As the base OS becomes stabilized, other standard tools, settings, or
conveniences are added to the base configuration as required. These
include major applications like LabVIEW, Altiris, Timbuktu, and the
EPICS toolsets. Settings included are the EPICS environment variables
and some basic windows settings. Other conveniences include a program
that identifies which computer you are on, shortcuts to network Web
pages (logbook), and a list of IP addresses for all machines that can be
used with Remote Desktop or Timbuktu.

*3.2 Cloning Process -- Distribution*

During the distribution of the devices, one has to consider the fact
that the base configuration is going to be greatly distributed but that
the security IDs have to be different for each implementation of XPe.
One of the components included with XPe is the System Cloning Tool. This
component is used to ensure that each device has a base image containing
a unique computer security ID. The use of the tool gives us the ability
to use Altiris and distribute images without having to touch each
machine. The following image gives an example of the process.

Figure 2: Cloning Process XP Embedded ^\[5\]^
![](media/image2.png){width="5.981944444444444in"
height="3.2597222222222224in"}

*3.3 Database Interaction*

One problem with deploying PCs and allowing them to boot and receive an
appropriate image is that a unique security ID does not identify the
device and that somehow an accelerator device ID has to be assigned to
the machine. Because the PCs have to be registered with the network to
function, the IP and MAC addresses are known. At boot up time, a Java
application using the JDBC thin client accesses the SNS Oracle
production database to retrieve the configuration file for the Input
Output Controller.  The application uses a global read-only account to
access IP address of the IOC making the connection. This IP is contained
in the database and is used to look up the IOC record in the IOC_DVC
table.  The application then writes the configuration file from the
IOC_DVC table into a directory and file name, which are also specified
in the IOC_DVC table.  No software other than the Java Runtime
Environment is required to be installed on the IOC for this process.

**4 CONTROL OF DEPLOYED DEVICES**

Because the NADs are PC-based, many changes will have to be made to the
systems over the life of the machine. This toolset allows us to maintain
control of the devices while keeping them up to date with current
applications and hardware.

Because XPe is based on the Windows XP OS, it is necessary to have the
ability to apply security patches to the devices in operation. To keep
device downtime to a minimum, the patches will only be applied when
appropriate, but we still need the ability to quickly patch our devices
in the event of an emergency. Windows XP Embedded SP1 includes a method
for this called Device Update Agent (DUA). There are at least a couple
of ways to configure DUA. Because we have hard disks in our devices, we
chose to copy the updated files to the specified directory using an
Altiris Job. This "job" can be dropped on one or many systems
simultaneously. Once the files are in place, DUA takes over the task of
installing the patch. DUA is in a constant wait mode and does nothing
until the specified directory is "loaded" with the appropriate files.

Similar to Microsoft patches, the deployed devices will also require
updated applications or additional software. Again, this can be
accomplished in a couple of different ways. DUA can be triggered to run
an executable that has been loaded on to the machines via Altiris.
Altiris can also deploy updates/additions in a manner similar to any
type of file management.

Many of these deployed devices will also have to undergo hardware
changes because of failures or upgrade needs. Again, Altiris allows the
software changes to be handled with relative ease. Altiris can take a
known configuration and monitor the changes made to it during any kind
of upgrade. This is known as a Rapid Install Package (RIP). Upon
completion of the upgrade, the RIP can be applied to any similarly
configured devices.

Using Altiris as the management tool of the deployed images also gives
us the ability to rapidly redeploy a device's current configuration to
replacement hardware. As with any new configuration, applying the OS to
a device takes under 20 minutes.

**5 INITIAL EXPERIENCE AND FUTURE PLANS**

*5.1 Initial Experience*

Our initial exposure to the use of these tools and their implementation
required little learning time. This was particularly true when it came
to Altiris. Previous SNS use of this application allowed us to quickly
deploy it. It was not obvious to us at all during the start that XPe was
going to be of any use at all. XPe was initially a very cumbersome tool.
Initially, it required some patience and it took us time to ramp up and
use it effectively. However, after using it for a short time, we began
to see the base OS take shape and the designer tools and components have
become easy to use.

Overall, the combination of these two major components have given us the
ability to safely deploy an XP Pro-like image, maintain configuration
control, and easily update images. The time required to deploy an image
is far shorter than using standard installation methods. The OS runs
just as an XP Pro image but without any unnecessary overhead. And
because of this process, our standard NAD is configured in a way that
allows us to comfortably continue with our installation of diagnostic
systems.

*5.2 Future Plans*

One future idea is to move to a diskless solution. This would allow the
NADs to boot up and operate from a unique disk image file located on a
networked server or servers. The OS would still be Windows XP Embedded
and would allow for quick (about the same as hard disk) boot times. This
solution will be considered because of the gain in the ability to deploy
new images to the same hardware. Before completely converting to a
diskless deployment, diskless operation would provide a reliable backup
system in case of hard disk failure. Currently we are evaluating a
product called BXP from Venturcom^\[6\]^ that can give us this ability.

The interaction with the relational database gives us the opportunity to
expand the database role and use it to capture and house device images
as a whole. Although Altiris provides a simple way to handle images and
300-400 images is not that great of a number overall, the relational
database naturally lends itself to be the repository of all data related
to a device.

Because these machines are configured with an XP Pro-like image, we have
included the Remote Desktop Feature. This has given us the ability to
log on to the machines over the network and has not required the use of
monitors within each rack. However, XPe allows the devices to be
headless (no graphical interface). Using a headless configuration may
give us increased stability and/or increase the efficiency of the
operating system.

**6 REFERENCES**

^\[1\]^ Work supported by the U.S. Department of Energy under contract
DE-AC05-00OR22725.

^\[2\]^ "Network Attached Devices at SNS", W. Blokland and T. Shea,
ORNL, Oak Ridge, TN, USA, M. Stettler, LANL, Los Alamos, NM, USA. DIPAC
2003.

^\[3\]^ SNS Web site: http://www.sns.gov/.

^\[4\]^ http://www.altiris.com/products/deploymentsol/.

^\[5\]^ Sean D. Liming, "Windows XP Embedded Advanced", RTC Books, 2003.

^\[6\]^ http://www.vci.com.