P2000 extremely slow http/https

[Bunny82]

2012 edition P2000 G3 iSCSI dual controller TS250R023 + Zabbix

(It's covered for another year too...)

For some reason, "hp-msa.pl  10.39.20.31 lld" has stopped working with an SSL error:

File does not exist: 500 SSL negotiation failed: error:1406D0B8:SSL routines:GET_SERVER_HELLO:no cipher list
at ./hp-msa.pl line 122

If I remove the "s" and only use http, it takes almost 4 minutes. Not bad until you consider that is only about 5 API requests.

This isn't just a zabbix issue though. Logging in through the web interface is so slow you can make a cup of tea AND drink it before the menu comes up. And then it keeps dropping the connection. Something is wrong with my P2000, but what?

[Torsten.]

I would restart the management controllers (from CLI restart mc both) and update the firmware to TS251P006.

[Bunny82]

I am sorry, but I do not think that "when in doubt, reboot" is a solution for SAN controllers.

While it *is* a dual controller model, it is also production hardware that is busy hosting a pile of VMs.

I will have to wait until the maintenance window as this is a non-critical issue. (I am wondering if I should open a trouble ticket with HP.)

I find it interesting that wget can't negotiate with the P2000 controller after a while:

wget -v https://10.39.20.31/
--2014-12-02 12:25:16-- https://10.39.20.31/
Connecting to 10.39.20.31:443... connected.
OpenSSL: error:140943FC:SSL routines:SSL3_READ_BYTES:sslv3 alert bad record mac
Unable to establish SSL connection.

wget -v https://10.39.20.33/
--2014-12-02 12:28:03-- https://10.39.20.33/
Connecting to 10.39.20.33:443... connected.
ERROR: cannot verify 10.39.20.33's certificate, issued by `/C=US/O=Secure Array Vendor/OU=Engineering/CN=Secure Array/emailAddress=info@secureArray.net':
Self-signed certificate encountered.

Here is controller 1 taking 52 seconds to negotiate: 

time openssl s_client -verify 0 -connect 10.39.20.31:443 >&out.txt

0.029u 0.005s 0:52.63 0.0% 0+0k 0+16io 0pf+0w

Ouch, fail. 

controller 2 responds promptly, which implies that using https API is *really* bad for the controller.

[Torsten.]

"restart mc" will restart the webserver, more or less. It does not affect the storage.

You may try to restart one mc by one, see if this helps. I have seen before that one bad controller prevents the other controller from working normally ...

You may also check if one of the release notes of all the later versions mention a similar symtom ... the new firmware has a new certificate also.

[vio321]

after upgrade went into the same problem.

restart mc both

that solved it.