Access Crontrol Policies in Serviceguard 11.16

[Rangarajan Radhakrishna]

OS Version: HP-UX 11.11 (PA RISC)
Serviceguard version: 11.16

I need to be able to provide any user in cluster member node with monitor privileges.

Will the following step(s) work without downtime.
1) Edit cluster access file and add:
USER_NAME ANY_USER
USER_HOST CLUSTER_MEMBER_NODE
USER_ROLE MONITOR
[does the location within cluster ascii file matter?]

The documentation (Editing Security Files for Serviceguard dated Mar 2005) on security mentions:
"NOTE: You do not have to halt the cluster or package to configure or modify access control policies."

Questions:
a) Will the cluster really be able to honor monitor requests without additional steps involving "cmcheckconf" and "cmapplyconf"

b) Does cmapplyconf require a cluster downtime or that depends on the nature of change to cluster ascii file

[Matti_Kurkela]

The cluster ascii file created by "cmgetconf" will have some comments about the policy settings. The standard location for the policy settings is at the very end of the ascii file.

a) No. You must "cmapplyconf" to make the changes take effect. ("cmcheckconf" first is optional but highly recommended.)

b) It depends on the nature of the change. If you change only the access control policies, cmapplyconf can be executed while the cluster and the packages are running.

See Table 7-1 (Types of Changes to Permanent Cluster Configuration) here to see what cluster configuration changes can be done with the cluster running. Note that "Change Access Control Policy" is allowed.
http://docs.hp.com/en/B3936-90079/ch07s04.html#d0e17957

The Table 7-2 lists the package configuration changes in the same way:
http://docs.hp.com/en/B3936-90079/ch07s05.html#d0e18708

These two tables are essential in planning ServiceGuard maintenance operations. You might want to bookmark them in your web browser or maybe print them out.

MK

[melvyn burnard · Accepted solution]

to make these changes, you must use cmcheckconf/cmapplyconf, but this type of change does not require you halt the cluster.

[Rangarajan Radhakrishna]

Thank you for the responses. Very helpful.

[Rangarajan Radhakrishna]

closing thread.