Cluster commands not working - Permission denied to 127.0.0.1

[Amol Pathak]

From few days, no command of cluster is working on one of the four nodes. The commands works fine on all other three nodes. The cluster and package functionality is fine on this node. I can also failover or failback packages to and fro this node. Nothing relative change has been done recently on this node. The errors are as follows:

# cmgetconf -v temp.ascii
Error: Permission denied to 127.0.0.1
cmgetconf : Unable to get local cluster configuration information.
Either cluster is not configured, or the user doesn't
have access to get the cluster configuration.

# cmviewcl
Error: Permission denied to 127.0.0.1
cmviewcl : Cannot view the cluster configuration.
Either this node is not configured in a cluster, user doesn't have
access to view the cluster configuration, or there is some obstacle
to viewing the configuration. Check the syslog file for more information.
For a list of possible causes, see the Serviceguard manual for cmviewcl.

Also in syslog, the follwoing error is appearing continusly from many days:

cmclconfd[24053]: Local node -a claims to be in cluster psccluster1, but psccluster1 cluster configu
ration does not include node -a. It contains node(s):
cmclconfd[24053]: This node's claimed configuration will be ignored by Serviceguard commands and oth
er configuration clients

Also while gathering cluster information from other node via cmgetconf, this node is not appearing after
"Gathering configuration information .
Gathering storage information .."

[whiteknight]

Amol,

What is node -a ? It could be you accidentally change hostname to "-a" ?

check your hostname

WK

[Amol Pathak]

I have already checked hostname. Its not changed. Nothing related to "-a" found anywhere on the system.

[Delcho Tuhchiev]

Hi,

Perhaps there is some problem with name resolution!?!

Can you check with nslookup the name resolutions!

[Ludovic Derlyn]

hi,

try to add again this node to cluster

Have you checked if all services are present ?

In /etc/inetd.conf , have you uncommented this lines ?

hacl-cfg dgram udp wait root /usr/lbin/cmclconfd cmclconfd -p
hacl-cfg stream tcp nowait root /usr/lbin/cmclconfd cmclconfd -c

regards

L-DERLYN

[Delcho Tuhchiev]

Also I've check on one node from my cluster.
In result i receive the same error


$ /usr/sbin/cmviewcl
Error: Permission denied to 127.0.0.1
cmviewcl : Cannot view the cluster configuration.
Either this node is not configured in a cluster, user doesn't have
access to view the cluster configuration, or there is some obstacle
to viewing the configuration. Check the syslog file for more information.
For a list of possible causes, see the Serviceguard manual for cmviewcl.

So in my situation I've try with non privileged user (with root account on the same node i have no problems)
Did you try to execute the command with root user?

[whiteknight]

Amol,

.


Configure /etc/cmcluster/cmclnodelist on every node to list EVERY node in the cluster, using a simple hostname and give each root access. For example:

hostA root
hostB root

Note:
Version A.11.16, and later, only use cmclnodelist to authorize creation of the cluster binary. Thereafter, identd is used.

Certain versions of ServiceGuard that have been patched since October 2004, cause the ServiceGuard commands to fail if only IP addresses of the servers are loaded in cmclnodelist


WK

[Stephen Doud]

Check the syslog.log on the node that gives the error messages and give us any error messages that you see related to cluster commands.

Use 'netstat -a | grep hacl' on the problem node to verify that the SG ports are listening. If not, verify 3 hacl lines exist in /etc/inetd.conf and look like the lines on the good servers, then run 'inetd -c'

Insure /etc/nsswitch.conf shows:
hosts: files dns

Insure /etc/hosts lists ALL IP addresses that are fixed to NICs on every server in the cluster. And insure ALL IP addresses are aliased to the simple hostname of the server the NIC is installed in. (make it the last alias in the list)

Insure ports for identd or hacl-cfg are not filtered via such as Bastille or /var/adm/inetd.sec
If bastille
/etc/opt/sec_mgmt/bastille/config has
SecureInetd.deactivate_ident="Y"
Change it to:
SecureInetd.deactivate_ident="N"

[Kevin Wright]

what does your /etc/hosts file look like? Are you using aliasing? Verify all aliases is configured for all IP's in you cluster. Certainly the "-a" needs investigated as you seem to be having hostname/name resolution issues.

[Amol Pathak]

I have tried all suggestions to no avail. All related configs are OK on the problem as well as working nodes. No name resolution issue. When trying to check the current cluster config on the working node, the following error appears:

Begin cluster verification...
Warning: Not probing node pscuxs15 as it is currently unreachable.
This may cause network partitions to be reported.
Error: Node pscuxs15 is unreachable. Cannot proceed with configuration operation.