topic Re: Serviceguard A.11.16.00 in Operating System - HP-UX

Serviceguard A.11.16.00

Silver_1 — Wed, 13 Apr 2005 17:07:04 GMT

All,

Configuring a cluster getting the following error.

Anybody is having any idea.

"root@prod1:/etc/cmcluster# cmcheckconf -C conf.ascii

Begin cluster verification...
Error: Node prod1 is refusing Serviceguard communication.
Please make sure that the proper security access is configured on node
through either file-based access (pre-A.11.16 version) or role-based
access (version A.11.16 or higher) and/or that the host name lookup
on node prod1 resolves the IP address correctly.
cmcheckconf : Failed to gather configuration information"

Thanks,
Nair

Re: Serviceguard A.11.16.00

Rick Garland — Wed, 13 Apr 2005 17:18:03 GMT

Are you resolving OK? name --> IP --> name

Re: Serviceguard A.11.16.00

Julio Yamawaki — Wed, 13 Apr 2005 18:36:39 GMT

Hi,

You must configure .rhosts in both servers in order to get configuration from one node to the other.

Re: Serviceguard A.11.16.00

Ermin Borovac — Wed, 13 Apr 2005 21:30:19 GMT

Is this unpatched SG A.11.16? If it's unpatched, it might be a good idea to install latest SG patch. Latest patch for your version is PHSS_32731 (assuming you're on 11.11).

For SG patches PHSS_31071 and above, you will need to have working identd service (check /etc/inetd.conf).

Are you using /etc/cmcluster/cmclnodelist? If yes, do you have host names or IP addresses in that file? I think unpatched A.11.16 broke the ability to use IP addresses in cmclnodelist.

Re: Serviceguard A.11.16.00

Geoff Wild — Wed, 13 Apr 2005 22:33:58 GMT

Make sure both servers have each other in /etc/hosts....

Rgds...Geoff

Re: Serviceguard A.11.16.00

Isralyn Manalac_1 — Thu, 14 Apr 2005 00:48:40 GMT

Kindly post nslookup output.

Regards,

Isralyn

Re: Serviceguard A.11.16.00

rariasn — Thu, 14 Apr 2005 01:16:31 GMT

He,
You must configure file /etc/cmnodelist in both servers in order to get configuration from one node to the other.

-rw-r----- 1 root sys 183 Nov 4 2003 /etc/cmclnodelist

Re: Serviceguard A.11.16.00

melvyn burnard — Thu, 14 Apr 2005 03:33:20 GMT

With Serviceguard A.11.16, the security access model changed.
You must set up the cmclnodelist at the time of initial cluster creation, but once the cluster has been created it will then use the new built in role based access, and ignore cmclnodelist.
Another point to consider is that the entries in the cmclnodelist cannot use ip addresses unless you have patched the nodes with the latest patch for 11.16.

You may find it helpful to look at the following:

http://docs.hp.com/en/B3935-90078/B3935-90078.pdf

http://docs.hp.com/en/6283/SGsecurityfiles.pdf

http://docs.hp.com/en/5874/securingserviceguard.pdf

You must also check that your hostname to ip address resolution works ok, as this could also cause issues like this.

Re: Serviceguard A.11.16.00

Mark Nieuwboer — Thu, 14 Apr 2005 04:42:52 GMT

Hi Nair,

I had the same problems with installing and configuring MC/Serviceguard.
I did everything correct and at one time i just the + in the .rhost file but still connection refused.
After i reboot the nodes the problem was gone and cmcheckconf worked fine.

grtz. Mark