A Good Adjustment

I’m busy working on the homlab trying my best to duplicate a homelabber and failing miserably. But more information will be coming on that later.

For now I found a great KB that needs some sharing! VMware has been known for some great pointers to fix issues. This one fell into my lap from an issue I was seeing.

The Problem

So every VRealize Automation environment is different so let me be straight. This change will only help vRO extensiblility actions and automations. For me it was a good improvement over the vRO XaaS workflows that I had published.

We were seeing timeouts and errors showing “Form not found” when trying to open workflows that had actions to pull specific information(AD, VSphere, etc.) because of this the workflows were in the tank and sometimes even IaaS Deployments would return with an error 400.

The KB can be found here: https://kb.vmware.com/s/article/2147109

The Steps:

In Embedded vRealize Orchestrator Server:
  1. Open the /usr/lib/vco/app-server/bin/setenv.sh file using a text editor.
  2. Modify the memory by setting the Xmx and Xms values to the MB value required.For example:

    2.5 GB memory is allocated to each Xmx and Xms(this is the default setting):

    JVM_OPTS=”$JVM_OPTS –Xmx2560m Xms2560m -Xmn896m -XX:MetaspaceSize=512m -XX:MaxMetaspaceSize=1024m -Xss256k”

  3. Edit the /etc/vr/memory-custom file using a text editor.
  4. Add this entry:add_service_mem vco-server *NUMBER*

    Note: The *NUMBER* is equal to the sum of -Xmx and -MetaspaceSize as configured in step #1. The memory is in MB.

  5. Stop the vRealize Appliance and increase/decrease the memory to match the increased/decreased memory of the vRealize Orchestrator.
  6. Start the vRealize Appliance.
  7. Repeat steps #1 to #6 to rest of the nodes in the cluster.

Just a short, quick blog for today, but this was a very good change for me, and I saw a marked improvement in response time from my embedded vRO.

Hopefully some hilarity from homelabbing coming, but I hope it helps someone out there. Some highlights:

  2. WAN +2LAN2? or WAN+LAN2??
  4. “Its just making them talk to each other right?”

VRealize Deployments: Part One, Active Directory Policy

So this is a blog series on how to setup and create quick deployments for self-service users in vRealize Automation. This is mostly built-in automation with minimal custom creations. This is pretty basic, but I wanted to start there and grow. I guess in that light I need to go over licensing and the architecture of building the automation as well. but for now, lets just say you have advanced licensing(at least) and your running a minimum to medium enterprise deployment this should work for you.

Should be fun, and maybe it will help someone out there.

*I’m going to assume the following.

  1. Endpoint agents are configured
  2. Resources are granted to specific business groups
  3. Entitlements are granted to said groups for appropriate services/catalog

That being said, here we go.

Deployment Step 1. AD Endpoint

First thing you will want to configure is your Active directory Endpoint. For this you will go to Administration -> vRO Configuration -> Endpoints. From here click “New” and on plugin you will select Active Directory policy.


From here you will input the Name and Description of the endpoint, then the following details for the server. For now, we’ll use ldap connection. Input the host/ip at the top, baseDN, Default Domain, username/password. If failover, round-robin, or Single-server drop-down and add the DC’s to the array below. Finally add the Name for vRO and the final two options aren’t too needed for adjustment. Below is an example of how it should look.


Active-Directory Policy

This is specifically for users who need the computer to drop to a specific OU. To find this on vRA you would go to Administration->Active Directory Policies (If the option does not exist you may be missing some roles on your vRA account). From there you can click “New” which will open up your settings. Here you select the ID(Remember for later),endpoint, domain, and OU you wish the policy to put the Policy.


Now you have an endpoint, and a policy. How do you add it to the blueprint?

The custom property ext.policy.activedirectory.id is your go to there. Below is a screenshot that will explain how to associate the policy with the blueprint.


This will create the computer object before the deployment starts and will remove it upon destruction. Nice Self-Service.

Now how do I verify the computer name doesn’t exist?

Create an Action in vRO to find it!

Action in vRO for Checking Computer Name

Set you vRO to Design, and on the cog, you can create an action.

Return type = String


  1. strComputer – string
  2. defaultADServer – AD:AdHost

var computers = ActiveDirectory.getComputerADRecursively(strComputer,defaultADServer);
if(computers[0] == null){
return "This name is available"
return "This name is unavailable"

Place this as a external action on the blueprint against the “Hostname” Custom property(basically the name that the VM will take). This return “This name is unavailable” if it finds anything close to the name, However, this does not stop the request going through. For that you can do a Match field with another Text Field of “This name is unavailable”. Which should only let the request go through if it states “This name is unavailable”

Hope this helps someone get things rolling! I’ll do a blog on Network Profiles next.

The One About Tagging..

So with the future of datacenter segmentation looking like tagging in IT we have seen a major push towards VMtagging around the cubes. Well at least I have.

Lets not mix words. I hated tags. It was basically like putting a sticky note on a machine with no management to make sure things ARE tagged, and no way to easily do tag assignment in bulk. Sound familiar… maybe like a naming convention? Here was the RUB for me. A naming convention is right in front of everyone’s face and it puts the devs in line. Tagging, however, is 100% infrastructure team(or virtual team depending on your organization size).  Well, by the end of this post I should think better of tags… and maybe you will too?


Get PowerCLI

Lets be real. If your not using PowerCLI for automated management of your vCenter your doing yourself a disservice. For one, its a really good resource to pull information across the entire vCenter and dump it in front of yourself in different formats(.csv, .xml etc.). Another is that PowerCLI allows assignment and adjustment across multiple VMs. So for tags of course PowerCLI would be your go-to for assignment, adjustment, and removal.

There are multiple code sources out there for tag assignment. Here are a couple excerpts. NOTE: always remember to assign to the proper vCenter for the tags, Assigning to vCenter b to assign a tag to a VM in vCenter A will not work even if the IDs are identical.

Connect-viserver vcenter1 -user vcenteruser -pass vcenterpassword

This connects the your client machine to the needed vCenter. Though tag ID is now the same across linked vCenters PowerCLI needs you to assign to the VM’s vCenter to assign the tag. We’ll get more into this later.

From here you can run your gets, removal, and assignments of tags by NAME. so

get-tag -name ‘tagname’

This can be set to a variable like: $tag = get-tag -name ‘tagname’ which can then be assigned to a VM. So lets just see a simple VM get and tag assignment.

$vms = Get-VM vmname*
$tag = Get-Tag -name "TheCoolestTag"
$vms | New-TagAssignment -Tag $tag

NOTE: the astrisk after “vmname” is a wildcard, it it actually pulls a group of VMs starting with “vmname”. If you want to do one at a time(and why would you) remove the * and put the full VM name.

Just a simple get and assign of tags through powerCLI. Now lets look at the same thing via vRO

vRealize Orchestrator

Now in vRA deployments you want to tag all VMs properly so that they have the proper tags needed for management. The built in library has several tag based workflows out of the box, but first you need to run through some setup.

First create a vapi endpoint to your vCenter(Wokflow is found in the library -> VAPI -> “Import VAPI Metamodel”(the VAPI endpoint will be added as well)


You want to use Secure Protocol Connection so that the endpoint is used for future orchestration. Input the name of the vCenter (plus /api), so https://vcenterlink.com/api. Input a username/Password combination that will not change(service account if possible), and Select to add the vAPI endpoint.

This will create the connection for you for tagging. Now, lets talk about that tagging assignment, and gets; this is where it can get a little tricky. The library for tagging is found in library -> VAPI -> Examples -> Tags. This includes creating category’s, tags, and assigning tags.  In the “examples” folder you will find some “Get” workflows, but, if you run you get a csv string for all IDs of the tags. I don’t know about you, but I don’t remember tags by IDs.

So, how do we do a pull by name? Well, there is an action in vRO for findTagByName in com.vmware.vapi.tags. This takes an input of the vAPI endpoint(metamodule is needed so it should be there if you followed above), name, and whether you want to run it as case sensitive(boolean). Now, you can take this workflow and run a system.log after the action for the needed information. Here is what my workflow looks like:


This should return the information you need to tag VMs with the specific tag. You should be all set using the built in workflow “Associate vSphere tag to VM”. This workflow needs the API, the ID of the tag(tagid) and the VM :


But lets make a quick change to that workflow’s “Scriptable task”. Currently the built-in workflow(as of 7.5) shows this:

if (vapiEndpoint == null) {
throw "'endpoint' parameter should not be null";
if (tagId == null) {
throw "'tagId' parameter should not be null";
var i = 0;
while (i<5)

try {
var client = vapiEndpoint.client();
var tagging = new com_vmware_cis_tagging_tag__association(client);
var enumerationId = new com_vmware_vapi_std_dynamic__ID() ;
enumerationId.id = vcVm.id;
enumerationId.type = vcVm.vimType;
tagging.attach(tagId, enumerationId);
System.debug("Tag ID " + tagId + " assigned to VC VM " + vcVm.name);

} catch(e) {
System.debug("Associating " + tagId + " failed. Retrying " + i + " of 5 attempts");
if (i=4) { System.error(e.message); }

There are some opportunities for this workflow. First, if you use this out of the box and put in an incorrect tag it will continually cycle, 2nd if you fix the cycle, it will never fail. So here is the code with my adjustments to ensure it only tries 5x, fails on the 5th, and sends the exception.

if (vapiEndpoint == null) {
throw "'endpoint' parameter should not be null";
if (tagId == null) {
throw "'tagId' parameter should not be null";

var i = 0;
while (i<6){

try {
var client = vapiEndpoint.client();
var tagging = new com_vmware_cis_tagging_tag__association(client);
var enumerationId = new com_vmware_vapi_std_dynamic__ID() ;
enumerationId.id = vcVm.id;
enumerationId.type = vcVm.vimType;
tagging.attach(tagId, enumerationId);
System.debug("Tag ID " + tagId + " assigned to VC VM " + vcVm.name);

} catch(e) {
System.debug("Associating " + tagId + " failed. Retrying " + i + " of 5 attempts");
if (i==6) {
throw e.message}

Lets go through the changes:

  1. To try “5 out of 5”. The end catch should be 6 not 4…
  2. Change the “while” clause to 6 so that the catch runs at 6 and it doesn’t just end successfully.
  3. Finally “throw e.message” will make the workflow actually fail. If you just want the log, but want the workflow to continue, you can remove this.

**NOTE** You can attach multiple tags this way, just duplicate the workflow and add attributes for each tag ID, adjusting the script to use the proper attribute variables one at a time, per vAPI.

Now, with this workflow and inputs you should be able to add tags to your VMs, with property assignment, and subscriptions. That’s for another time I suppose.