cmruncl permission denied (node 2 ip)

[diego delgado]

hi,
when i tried to run cmviewcl i received :

cmviewcl -v
Error: Permission denied to 10.204.159.69 (node 2 ip)

CLUSTER STATUS
oraclu up

NODE STATUS STATE
node1 up running

Network_Parameters:
INTERFACE STATUS PATH NAME
PRIMARY up 1/0/2/1/0/6/0 lan3
PRIMARY up 1/0/2/1/0/6/1 lan4
PRIMARY up 1/0/1/1/0/4/0 lan0
STANDBY up 1/0/14/1/1 lan8
STANDBY up 1/0/14/1/0 lan7

PACKAGE STATUS STATE AUTO_RUN NODE
ora-pkg up running enabled node1

Policy_Parameters:
POLICY_NAME CONFIGURED_VALUE
Failover configured_node
Failback manual

Script_Parameters:
ITEM STATUS MAX_RESTARTS RESTARTS NAME
Subnet up 10.204.159.64
Subnet up 10.204.159.192

Node_Switching_Parameters:
NODE_TYPE STATUS SWITCHING NAME
Primary up enabled node1 (current)
Alternate unknown node 2

NODE STATUS STATE
node 2 down unknown

Network_Parameters:
INTERFACE STATUS PATH NAME
PRIMARY unknown 1/0/2/1/0/6/0 lan3
STANDBY unknown 1/0/14/1/1 lan8
PRIMARY unknown 1/0/2/1/0/6/1 lan4
STANDBY unknown 1/0/14/1/0 lan7
PRIMARY unknown 1/0/1/1/0/4/0 lan0


and the second node can't startup the cluster's node.

cmrunnode -v node 2
cmrunnode : Unable to communicate with a running cluster or with all nodes in the cluster.
cmrunnode : In order to use cmrunnode, the cluster must already be running on a subset of reachable nodes or else all cluster nodes must be reachable.
cmrunnode : Issuing cmrunnode again may succeed.

O.S = HP.UX 11.11
SG = 11.16

thanks in advance

diego

[Asif Sharif]

Hi diego,

Please run "cmruncl -v" on node2.

Regards,
Asif Sharif

[diego delgado]

cmruncl -v
cmruncl : Validating network configuration...
Gathering configuration information ..
Gathering Network Configuration ...... Done
Not probing node node1 as it is currently unreachable.
cmruncl : Network validation complete
Warning: The configuration file on node node1 will not be checked.
Error: Cannot reach node "node1"

[Steven E. Protter]

Shalom diego,

Usually this is a problem in the cmnodesecurity(I think that is the name). cmnode I'm sure of.

This file permits the nodes to talk to each other.

Also see that SG is correctly installed and the daemons are enabled the same way in inetd.conf file

SEP

[Venkata Nagesh]

Take a look at "/etc/cmcluster/cmclnodelist" file. If this file exists, rename this and try again.

Regards,
Nagesh

[diego delgado]

thanks SEP i'll try it,
venkata i tried yet with the nodelist files but without any good results.
today i'll try the SEP suggestion ,
see you later

[Stephen Doud]

There are many reasons the 'permission denied' error can occur, but all center on /usr/lbin/identd being unable to relate the node 2 ip to a member of the cluster.
Serviceguard uses this daemon (via /etc/inetd.conf) to insure SG commands are coming from authorized nodes.
'identd' requires that:
1) First time cluster builds: /etc/cmcluster/cmclnodelist exist on each node, and give each node root access (just like a .rhosts file).
2) /etc/nsswitch.conf points 'hosts' to 'files' before 'dns'
3) /etc/hosts identifies all IPs that are listed in the cluster ASCII file (and applied in the cluster binary file)
- all such IPs must be aliased to the sponsoring hostname. (Yes - it sounds strange, but it works) See "Hostname resolution" in the Managing Serviceguard manual.
- use the same sequence on each IP line. Example:
16.113.145.28 roller-hb.atl.hp.com roller
- /etc/hosts must contain a loopback line:
127.0.0.1 localhost loopback

4) If /var/adm/inetd.sec is configured, insure auth (identd) and hacl-cfg services are "allow"ed and associated with all IPs and loopback. (rename the file to temporarily diagnose whether it is part of the problem).

5) Insure the line referencing /usr/lbin/ident in /etc/inetd.conf is uncommented.

6) If /etc/cmcluster/cmclconfig is missing on a node that -is- a member of the cluster, copy to file from another member node to the node lacking the file. (use 'strings' command on the file to verify the hostname of the node is in there)

After all this, reset inetd:
# inetd -k
# inetd (-l)

Then test again.
If you still have trouble - consider opening a support case with HP.