User access policy changes after failover

[dictum9]

I am running SG 11.17 on 11.23.

After a failover of the package, a user is no longer able to access Service Guard command per access policy defined in /etc/cmcluster/

However, everything works well prior to the failover.

Is there a patch for this?

[Todd McDaniel_1 · Accepted solution]

I'm sure the first thing you checked was the permissions on the commands in question. Does another user who had access have any issues on the failover box?

Next, I would validate your cluster config is identical on each box in the cluster.

If that doesn't solve the issue, then I would look at the user's access. ie. any sudo privileges or group membership, search path etc...

[dictum9]

A user can run the cmviewcl on both nodes of the cluster without any issues.

A failover happens.

At this point, the user is no longer able to run the cmviewcl command.


The configuration file is identical on both nodes.

[Juan M Leon]

can you ll cmview on both servers and post it here.

[Todd McDaniel_1]

If different user has no issues on the failover server then the issue is most likely with the other user.

I would double check the user's access on the failover server. Is this a normal user or an application/dba user?

[dictum9]

The user is the same.

[Juan M Leon]

where you able to run cmviewcl from the other node before the failover.
can you post the output for the following command

ls -ltr cmviewcl

[Charles H Emery]

You might also have them try the Service Guard Manager GUI interface from their PC. Depending on the user, this may be friendlier for them.

Service Guard Manager can be downloaded: http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B8325BA

[dictum9]

# ls -lrt /usr/sbin/cmviewcl
-r-xr-xr-x 12 bin bin 3489464 Sep 23 2005 /usr/sbin/cmviewcl

[dictum9]

Apparently in SG 11.17, you have to specify user permissions in /etc/cmcluster/ and grant permission for both nodes to the cluster.
I think that's what fixed the problem.