Introduction

First I have to say this article contains the results of many brilliant people and is not my content. I’m only assembling this information into a consistent document instead of spread around buried in posts and responses. My intent is to not dig into the details behind the scripts or how to tweak them for your needs. You can read the links below to figure out why things are being done the way they are. I wanted to create a tutorial that was as close to a cut and paste to get driver injection going in your environment. Now I will primarily focus on Dell hardware for the main reason that Dell does supply driver archive files (known as .CABs) that can be downloaded and extracted quickly to create the driver structure. I’m sure that HP, Lenovo, and others have similar driver packs.

You can download the Dell driver cabs for your hardware from here: http://en.community.dell.com/techcenter/enterprise-client/w/wiki/2065.dell-command-deploy-driver-packs-for-enterprise-client-os-deployment

Reference links:
https://forums.fogproject.org/topic/4278/utilizing-postscripts-rename-joindomain-drivers-snapins
https://forums.fogproject.org/topic/7740/the-magical-mystical-fog-post-download-script-under-construction
https://forums.fogproject.org/topic/7740/the-magical-mystical-fog-post-download-script
https://forums.fogproject.org/topic/8878/fog-drivers-script-will-not-run-correctly-in-postdownloadscripts/46

In this series if posts I plan on outlining what the FOG post download script is, what its about, and how to use it to your advantage with image deployment.

I’ve debated with myself if another post was needed since Lee https://forums.fogproject.org/topic/4278/utilizing-postscripts-rename-joindomain-drivers-snapins and I https://forums.fogproject.org/topic/7391/deploying-a-single-golden-image-to-different-hardware-with-fog have written tutorial about them in the past.

Where I want to explore with this series of posts is more about the background behind its function and to cover some of the script elements from Lee’s and my previously linked tutorials.

First of all lets get a little background here and some terminology defined. The FOG image deployment system consists of three main components:

1. The FOG management environment. The FOG management environment is the FOG server itself, which is responsible for planning, scheduling, instructing and documenting the image deployment.
2. The FOS (FOG OS) target engine {need better name here}. The FOS target engine, or FOS (as it will be known in this document) is responsible for capturing and deploying images from the defined storage node, as well as other actions on the target computer. FOS is actually an FOG Project created high performance linux operating system that was specifically constructed to image target computers. We have to remember for the rest of the tutorial, FOS is a linux based operating system that is used to deploy any OS image to your target computer.
3. FOG Client. This is an add on utility service for windows and linux, which is installed on the final or target OS. The FOG Client queries the FOG server for instructions and actions. I’m not planning on discussing the FOG client during this tutorial since it is out of scope in regards to post installation scripting.

The FOG Post install scripts give FOG system admins the ability to inject actions in the image creation process. To allow this custom scripts to run the developers added an external call into the image deployment sequence. Just after the image is placed on the target computer’s storage device, the FOG server calls a script in the /images/postdownloadscripts directory (on the FOG server). That script is called fog.postdownload. The fog.postdownload script is created when the FOG Server is installed. In its default state the script doesn’t do anything much. It is just a place holder to call your custom post install scripts. As I mentioned the fog deployment process calls this fog.postdownload bash script just after the image is placed on the target computer’s storage device. Once all of the external post install scripts have completed the FOG server completes the imaging and data recording steps.

While the post install scripts are stored on the FOG server in the /images/postinstall directory, they are executed by FOS running on the target host. So you have to remember when writing your post install scripts, they execute from the perspective of the target host. The post install scripts have limited access to resources on the FOG server (outside of the /images directory), but have full access to the target host. As noted above, these scripts run on a linux OS, so any resource (programs) available to linux operating systems can be run against the target host. I want to make this distinction to make it clear that FOS is linux and not MS Windows based. So you can not run MS Windows based applications, like DISM, in your post install script. FOS and linux is very powerful, but also limiting in some ways. As long as you are aware that MS Windows based applications can not run in a post install script then you should have little trouble. There are some cross over applications that are compiled for both MS Windows and linux, you just need to ensure you have the correct application for the OS and architecture (IA32 or X64).

The developers found this issue to why the log file grew so big (after almost a year of log file collection). The log file will now be capped at the log file maximum set by the fog configuration settings. This was just a fluke case that caused this file to grow to an abnormal size.

The fix / log file limiting code will be in 1.3.5RC11 when its released.

What you need to understand that the FOS Engine (the customized linux operating system that captures and deployed images on the target computer) is a complete linux OS. It is built with 2 halves. The first part is the the kernel (bzImage) which contains the core linux functions as well as the compiled in device drivers. And the second part is the virtual hard drive (inits) which contains the linux utilities, programs, and fog command scripts. When you PXE boot a target computer into the iPXE menu, certain iPXE menu options will send the bzImage and inits files to the target computer. The iPXE menu will also send specific kernel parameters to tell the FOS Engine (linux) how to react when it boots.

You can take the FOS Engine (bzImage and inits) and just as easily boot directly from a usb flash if you use grub as your boot loader. The FOS Engine will boot from the USB stick without requiring the FOG server to be online. The FOS Engine won’t do much without the proper kernel parameters being passed from the FOG server. But in the end FOS is a specialized, high performance, standalone linux OS.

Now for specifics, I don’t have the details from inside FOS, but I suspect there is something in /etc/init.d that calls the main fog script called /bin/fog that script. The fog master script reads in the passed kernel parameters and then selects the proper task to execute.

Preface

The bits I’m going to cover here are the general outline of what needs to be done to create and deploy a hardware independent image across your fleet of computers. In this tutorial I’m going to discuss how to do this with Dell computers. I know this process works with Lenovo, Intel NUC, and a few others with some caveats. I’m going to touch on some steps that you need to do in MDT to build your universal reference image, but I’m not going to discuss how to setup MDT to create your reference images. There are plenty of examples on the internet on how to do this.

This process makes use of a custom script that gets executed post image deployment but prior to the reboot of the FOS client. This step is vial since we need to make some tweaks to the windows environment pre first windows boot. This is the key. I can’t/won’t share that script I created because of my contract with my employer, because it is derived work because of my employment. So that script is intellectual property of my company. I’ve held the job title of unemployed, its not a great title. The pay stinks, the stress level is high, but the hours are great. I don’t plan on going there any time soon, so no script for you. BUT, sitting here on my zorin (ubuntu) dell laptop I should be able to reverse engineer the important parts to give the crafty scripters here the tools they need to create their own post install script.

Our master image is created following the standard Microsoft SOE guidelines, meaning MDT to build the reference image, sysprep to reseal the image, use a custom unattend.xml file (required to make this process work for Win10) and some disk imaging tool to capture and deploy the image to the target hardware. In this process sysprep is mandatory since we want to create a single image that can be deployed to any hardware. The generalize process of sysprep removes all hardware references (for the reference image) so that when windows first boots it goes through the hardware discovery process. Without sysprepping the image the process I’m going to discuss will not work. So use sysprep.

When I started out creating this process for FOG, I began with the process we created for deploying Windows XP from a usb stick using Ghost. In that process we would automate the image deployment with ghost to lay a hardware independent image onto the target hardware and then detect the current hardware using a DOS program that would query smbios to get the target hardware. Then once the target hardware was known we would move the correct driver pack into a location where windows would find it on the first boot. This worked extremely well with Windows XP. So I took the knowledge that I had from that process and tried to do something similar with FOG.

I do have to say I did not think up this entire process all by my self. I did start the design base on the information found on this wiki page. https://wiki.fogproject.org/wiki/index.php?title=Auto_driver_Install This page and associated scripts gave me just what I needed to take our xp/ghost process and covert it to windows 7/FOG. So without that wiki page the remainder could not be possible.

@julianh A SSD for only the OS will not add much value making FOG go fast. The critical data path is from /images -> nfs -> network -> target computer.

NOTE: Changes in FOG's code since this article was written have made it harder to use NAS' as storage node with FOG. If you use a NAS with FOG 1.5.x and beyond the FOG replicator will continue to cycle and recopy files over and over again.

Part 1 NAS Setup

So far I’ve setup what should work from the synology NAS side of the fog storage node. This has NOT been proven to work just yet. So far the synology nas has been configured to what “should work”. On my test NAS I’m using DSM 6.0.

The following is just my short hand notes that will be used to create the actual tutorial. I’m out of time tonight to complete the docs for this.

The first thing we need to do is setup our NAS with the required network shares. To do this you need access to the Synology NAS’s web console. Log into the web console as admin and do the following.

1. Control Panel->Shared Folder
   Create new share
   Name: images
   Location: volume 1
   Checked Hide this shared folder in My Network Places
   Checked Hide sub-folders and files from users without permissions
   Press OK
   NFS Permission (tab)
   Create new Permission
   Hostname or IP: *
   Privilege: Read/Write
   Squash: No mapping
   Security: sys
   Checked Enable asynchronous
   Checked Allow users to access mounted subfolders

2. Control Panel->Shared Folder
   Create new share
   Name: snapins
   Location: volume 1
   Checked Hide this shared folder in My Network Places
   Checked Hide sub-folders and files from users without permissions
   Press OK
   NFS Permision (tab)
   Create new Permission
   Hostname or IP: *
   Privilege: Read/Write
   Squash: No mapping
   Security: sys
   Checked Enable asynchronous

3. Control Panel->Shared Folder
   Create new Share
   Name: tftpboot
   Location: volume 1
   Checked Hide this shared folder in My Network Places
   Checked Hide sub-folders and files from users without permissions
   Press OK
   NFS Permission (tab)
   Create new Permission (we only need this nfs shared for setting up the storage node)
   Hostname or IP: *
   Privilege: Read/Write
   Squash: No mapping
   Security: sys
   Checked Enable asynchronous

4. Control Panel->File Services
   Select Win/Mac/NFS (tab)
   Checked Enable NFS

5. Control Panel->File Services
   Select FTP (tab)
   Checked Enable FTP service (no encryption)
   Checked Use the default port range

6. Control Panel->File Services
   Select TFTP (tab)
   Checked Enable TFTP service
   TFTP root folder: tftpboot (this is the share name we created above)

7. Control Panel->User
   Select User (tab)
   Create user foguser
   Name: foguser
   Description: FOG User
   Password: fogremote1 (pick your own secure password)
   Conform Password: fogremote1
   Checked Disallow the user to change account password
   Press Next
   Join to group: users
   Press Next
   images: RW
   snapins: RW
   tftpboot: RO
   Press Next
   (Assign quota as needed)
   Press Next
   Assign application permissions: None
   Press Next
   Speed limiting: None
   Press Next
   Press Apply

8. Control Panel->User
   Select the Advanced (tab)
   (scroll way at bottom)
   Under User Home
   Checked Enable user home service
   Press Apply

That completes the setup of the Synology NAS.

In the next part we’ll test the network shares we setup above and create the remaining flag files and directory structure needed to transform the Synology NAS into a FOG storage node.

@oraniko What hardware are you using?

On my campus I have 15 standard hardware where I deploy 1 image to then and then copy the appropriate driver files during FOG imaging.

Ref: https://forums.fogproject.org/topic/7391/deploying-a-single-golden-image-to-different-hardware-with-fog
Ref: https://forums.fogproject.org/topic/8889/fog-post-install-script-for-win-driver-injection
Ref: https://forums.fogproject.org/topic/7740/the-magical-mystical-fog-post-download-script
Ref: https://forums.fogproject.org/topic/4278/utilizing-postscripts-rename-joindomain-drivers-snapins

To answer several requests in the forum about changing the keyboard mapping in the FOG iPXE menu. The only way to do change the keyboard mappings is to recompile the iPXE kernels from their source code since the keyboard layout is defined/set at compile time and not run time.

By following the process below you should be able to compile your own copies of the ipxe boot kernels (undionly.kpxe, ipxe.efi or any other FOG Project supplied boot kernel).
Understand: This method of creating your own boot kernels is not supported by the FOG Project Developers. If your make your own boot kernels and your computers fail to pxe boot, YOU are responsible for fixing any issue (or rerun the fog installer to restore the files to what the developers have created and tested).

Be aware that FOG uses another open source application called iPXE to provide the dynamic menuing structure. iPXE is created and manged by the iPXE Project team and not the FOG Developers.

This tutorial is only an example of how one might compile your own iPXE boot kernels on your fog server.

If your fog server is Ubuntu based you will need to install the compiler and development tools

sudo apt-get install build-essential liblzma-dev

If your fog server is Centos based you will need to install the compiler tools and required library

yum groupinstall "Development Tools" 
yum install xz-devel

Change to your home directory and clone the ipxe source files

git clone http://git.ipxe.org/ipxe.git ipxe

Make back up copies of the files we ar e about to change.

mv ~/ipxe/src/config/console.h ~/ipxe/src/config/console.h.sav
mv ~/ipxe/src/config/general.h ~/ipxe/src/config/general.h.sav
mv ~/ipxe/src/config/settings.h ~/ipxe/src/config/settings.h.sav

If you have the FOG Project installer files already downloaded on your fog server, you can just copy the FOG Project customized files to the iPXE source directories

cp <path_to_installer_files>/fogproject/src/ipxe/src/config/* ~/ipxe/src/config
cp <path_to_installer_files>/fogproject/src/ipxe/src/ipxescript ~/ipxe/src

If you DO NOT have the FOG Project installer files you can download only the specific files needed from the FOG Project GitHub site to create your custom iPXE boot kernels:

wget https://raw.githubusercontent.com/FOGProject/fogproject/blob/master/src/ipxe/src/config/console.h -O ~/ipxe/src/config/console.h
wget https://raw.githubusercontent.com/FOGProject/fogproject/blob/master/src/ipxe/src/config/general.h -O ~/ipxe/src/config/general.h
wget https://raw.githubusercontent.com/FOGProject/fogproject/blob/master/src/ipxe/src/config/settings.h -O ~/ipxe/src/config/settings.h 
wget https://raw.githubusercontent.com/FOGProject/fogproject/blob/master/src/ipxe/src/ipxescript -O ~/ipxe/src/ipxescript

Use the linux command sed to change the keyboard mapping. To use the following command replace XX with the proper keyboard code for your location.
sed -i 's/KEYBOARD_MAP\tus/KEYBOARD_MAP\tXX/g' ~/ipxe/src/config/console.h

For example if you want to change the US keyboard to the French keyboard in the FOG iPXE menus you would replace XX with fr as in this example:

sed -i 's/KEYBOARD_MAP\tus/KEYBOARD_MAP\tfr/g' ~/ipxe/src/config/console.h

To be sure the settings are correct, you can run the following command to confirm the keyboard mappings have been changed.

grep -e 'KEYBOARD_MAP' ~/ipxe/src/config/console.h

[Editor note, insert expected output here]

All supported iPXE keymaps are listed on this page:
https://github.com/ipxe/ipxe/tree/master/src/hci/keymap

Now that you have the keyboard mapping set, lets compile iPXE…
Change to the iPXE source directory and run make clean to remove any unneeded bits

cd ~/ipxe/src
make clean

Build the BIOS boot kernel undionly.kpxe, rename the original undionly.kpxe file, and finally copy over the custom iPXE boot kernel.

make bin/undionly.kpxe EMBED=~/fogproject/src/ipxe/src/ipxescript
sudo mv /tftpboot/undionly.kpxe /tftpboot/undionly.kpxe.old
sudo cp bin/undionly.kpxe /tftpboot

Purge any prevoiusly built object files (aways good practice when you update configuration files.

make clean

If you have the FOG Project installer files already downloaded on your fog server, you can just copy the FOG Project customized files to the iPXE source directories

cp <path_to_installer_files>/fogproject/src/ipxe/src-efi/config/* ~/ipxe/src/config

If you DO NOT have the FOG Project installer files you can download only the specific files needed from the FOG Project GitHub site to create your custom iPXE boot kernels:

wget https://raw.githubusercontent.com/FOGProject/fogproject/blob/master/src/ipxe/src-efi/config/console.h -O ~/ipxe/src/config/console.h
wget https://raw.githubusercontent.com/FOGProject/fogproject/blob/master/src/ipxe/src-efi/config/general.h -O ~/ipxe/src/config/general.h
wget https://raw.githubusercontent.com/FOGProject/fogproject/blob/master/src/ipxe/src-efi/config/settings.h -O ~/ipxe/src/config/settings.h

Use the same sed command above to update the UEFI boot files. Hint: Don’t forget to replace XX with your desired keyboard map.

sed -i 's/KEYBOARD_MAP\tus/KEYBOARD_MAP\tXX/g' ~/ipxe/src/config/console.h

Build the UEFI boot kernel ipxe.efi, rename the original ipxe.efi file, and finally copy over the custom iPXE boot kernel.

make bin-x86_64-efi/ipxe.efi EMBED=~/fogproject/src/ipxe/src/ipxescript
sudo mv /tftpboot/ipxe.efi /tftpboot/ipxe.efi.old
sudo cp ~/ipxe/src/bin-x86_64-efi/ipxe.efi /tftpboot

If you need snponly.efi (roughly equivelent to BIOS’ undionly.kpxe) run these commands (Hint: This compile command will run really quick since all of the hard work was done in the previous step).

make bin-x86_64-efi/snponly.efi EMBED=~/fogproject/src/ipxe/src/ipxescript
sudo mv /tftpboot/snponly.efi /tftpboot/snponly.efi.old
sudo cp ~/ipxe/src/bin-x86_64-efi/snponly.efi /tftpboot

Clean up after yourself in case you need to build these kernels over again.

make clean

@ITSolutions said

Disadvantages in my personal opinion are few:

• Need to have Linux knowledge(although having Linux knowledge is a advantage in the industry)
  The other disadvantages I used to see, when I first found FOG in the .3x days have been corrected/added. I would like to see what others feel are disadvantages.

I can see the linux knowledge thing being a big issue for those that grew up in the MS Windows era. Once the system is setup you don’t need to step into linux at all. But every once an a while you need access to the linux command shell, so you will need someone in your company with some familiarity with linux.

Other things I can see that are limitations…
Access control. Right now there isn’t a real good way to limit what IT techs can do in the system. Like certain IT techs can only deploy images 1,2,3 to location C only.

Having a centralized login authentication system with either AD/LDAP.

Linux hardware drivers lag a bit behind windows drivers. The fact is that most hardware vendors develop hardware for the windows folks and then it seems like linux is either an after thought or some really smart linux people hack into the hardware and come up with their own linux drivers. (thinking about the surface pro 4 as I write this).

@EduardoTSeoane It would be helpful if you could document the changes you have made to your fog installation. The developers don’t have FOG installations as large as what you have so its hard to simulate the workloads you are seeing. It would be helpful for both the Developers as well as other large campus FOG installations if you could share what you have learned. @fry_p does have a large campus network where he was working on a similar issue to what you have.

So it would be very helpful if you could share what you learned from your testing for everyone.

@Jimbohello After you are able to image the machine, could you provide feedback on if the kernel args works for you or you had to go the debug route and enter the instructions directly into the console? We are trying to collect information on which solution works the best for resolving these issues with these specific nvme drives.

In short these two commands (applied differently) keep the drive from going into low power mode during imaging. The developers are working towards a solution where the imaging engine will adapt these commands without intervention.

This may take a few times discussion to find the best solution for you.

Lets start with basics of FOG.

The operating system that runs on the target computer to capture and deploys images is based on linux, for this talk we will call it FOS (Fog Operating System) Linux. This is a customized version of linux designed just for imaging. So you have to remember that FOS is Linux and can only run linux program not windows programs. There are a few linux programs that let you interact with windows registry but not many.

In FOG there are 2 places where the fog admin can add in custom linux bash scripts to interact with the target computer. The first place is a POSTINIT script. This script is run before imaging begins. In the POSTINIT script the fog admin can run commands that maybe needed to connect to disk arrays or configure the system needed before imaging starts.

The second place is a POSTINSTALL script. This bash script is called after the image has been written to the storage media and before the system reboots. At this place you have the ability to connect to the target disk and interact with the contents of the disk using linux commands. You may NOT run any windows commands in a POSTINSTALL because FOS is Linux not Windows.

If you want to interact with the UEFI bios boot order FOS Linux has the linux command efibootmgr that you can call from your POSTINSTALL script.

Your POSTINSTALL script can edit text files on the target computer by mounting the proper partition and using sed or other linux script commands to change the text file values. So if you need to edit the grub.conf file you can do it in the post install script.

@mattlong01 said in Boot problems on Lenovo M720s with M.2 drive & UEFI:

The M.2 drive isn’t even listed

So this tells me that the firmware can’t find the uefi boot loader typically in /EFI/Boot directory on the uefi boot partition.

I didn’t ask you this last time, what version of FOG are you using? If its not 1.5.7 then what kernel version are you using (as seen under the fog configuration menu)?

@EduardoTSeoane said in Bottleneck on DATABASE:

Yes i have the database virtual server (mariadb 10.4) and fog web virtual server are different virtual machines.

Ok good this would have been the first step.

The Virtual Sysadmin told me than the database server is stored on a mechanical sas.

As long as its a sas array then its OK. A single sas disk is not good for FOG imaging. But since you said its a VM then you probably have a proper VM Host server.

On myISAM i have implemented all the recommendations, now i have innodb on basic configuration, I’ll do optimizations next week with a few days working.

The mysqltuner script is very informative on its recommendations. Its good to let your mysql server run for a few days so it collects good run time data for the mysqltuner script to review.

I use FOG client, with a checkin time about 15min as test, currently workload average is about 15-17, but im still doing verifications.

For a 15 minute check in time and 17000 fog client computers, that gives you (In an ideal environment) 18 check-ins per second. I wonder if you increased the number of php-fpm worker threads to help with this load.

I do this changes because i detect a lot of table locks, that make a poor performance.

First let me say that FOG isn’t designed for this large of an installation. But I’m sure there are things we can do to optimized the installation. The first step is to get the database running well. Then we can look into other tweaks to help productivity.

Have you already moved the mysql server (service) to its own server instance and not running directly on the FOG server?

Is the disk where the database stored been moved to a flash based media (SSD or NVMe)?

Have you run the mysqltuner script against your mysql server? Have you implemented any of its recommendations?

In your installation, do you use the FOG client? If so what is the check in time you set?

Did you sysprep the image before capture?

How did you build your reference image? Did you build it on the same model computer, capture and then deploy to a different computer of the same model, or did you create a generic reference image on a VM and then deployed it to the target hardware.

For uefi computers, if the boot device has a fat32 partition with the boot file in the proper location the uefi firmware will let you set it as a bootable device. If the boot file isn’t found that drive won’t be selectable to boot.

So this tells me that refind can find the proper uefi boot loader, but the firmware can’t??

Does the lenovo have something similar to the Dell F12 boot manager? If so can you select the m.2 drive from that menu and have it boot?

@mpatel OK a few more question. What is your plan for imaging at the remote site (physical action plan)? Will you send a IT Tech to the remote site and image all of the computers or do you want to do everything remotely?

Do you have hardware you can send to the remote site to act as a FOG server? Understand that a circa 2016 laptop with 4GB of RAM and a SSD is more than enough computer for a FOG server for less than 50 computers.

@stu Once you get the system registered, I’d like you to do something for us.

1. Schedule a capture/deploy it doesn’t matter, but before you hit the schedule task button tick the debug checkbox. Then schedule the task.
2. PXE boot the target computer. Plug a traditional keyboard in for this test.
3. After several screens of text on the target computer that you need to clear by pressing the enter key, you will be dropped to the FOS Linux command prompt in debug mode.
4. At the command prompt key in lspci and take a clear picture of the numbers it prints.
5. Plug in the KVM switch (but leave the traditional keyboard connected). Confirm that the KVM is selected towards the target computer.
6. Run the same lspci command again. Hopefully you have 1 or more new PCI devices listed. Take a picture of the new output (you can probably get both outputs in one screen shot as long as I can read the numbers we will be good.

The difference between the two commands will be the hardware IDs of the kvm switch. We can then take those IDs and confirm that the linux kernel supports the KVM.

Yes, windows is in a dirty state. Google “windows dirty bit” for more details on this issue. The issue isn’t with FOG but Windows and how it closes the files on the disk.

To fix this you will need to restart the workstation and then:

1. Use the proper sysprep command switch to power off the computer (best)
2. Sysprep the system then use shutdown.exe -s -t 0 to power off the computer.

Since Windows 8 windows start button shutdown isn’t really a shutdown, but an enhanced sleep state (S5). Using one of the above methods will ensure the system is properly closed and ready for imaging.