cmviewcl hangs on ServiceGuard11.16 when no cluster is configured

[Michelle_61]

When I run cmviewcl on a node when no cluster is configured, it hangs for aboout one minutes and then returns the following output:

***********************************************
Error: Permission denied to 127.0.0.1
cmviewcl : Cannot view the cluster configuration.
Either this node is not configured in a cluster, user doesn't have access to view the cluster configuration, or there is some obstacle to viewing the configuration. Check the syslog file for more information.
***********************************************

I checked /var/adm/syslog/syslog.log file and found this message line:

Jul 20 11:36:35 cmclconfd[18976]: Permission denied for user root on node (2)

Doesn't the root user have permission to query cluster database?
What can I do to make the cmviewcl command return immediatly?

[melvyn burnard · Accepted solution]

well why would you want to run cmviewcl on a node that does not have a cluster configured?

Anyway, have you set up your cmclnodelist correctly?

Please review the following documents:

http://docs.hp.com/en/5874/securingserviceguard.pdf

http://docs.hp.com/en/6283/SGsecurityfiles.pdf

http://docs.hp.com/en/B3935-90078/B3935-90078.pdf

[Geoff Wild]

That is by design - if no cluster configuration - cmviewcl can not see anything - it times out - as it keeps trying...

Rgds...Geoff

[baiju_3]

Its is the norman behaviour ,if no cluster running command will take a long time to return .

There is no need to run cmviewcl on a a machine with out cluster configured.

If you just want to see that this server is a part of any cluster you can do by

ps -aef |grep cmcld.

Thanks,
BL.

[Michelle_61]

Thanks for all responses.

I created /etc/cmcluster/cmclnodelist and added the root user of the local host to this file. Now the command returns the same output but does not hang.

Is it possible to use cmviewcl command to view the state of a remote cluster? I saw there is a "-c " option in the man page of cmviewcl.

[Geoff Wild]

Yes - if access is granted on the remote cluster.

Rgds...Geoff

[Michelle_61]

Does the remote node that issues cmviewcl has to be in the same subnet as the cluster nodes?

[melvyn burnard]

yes, if the correct permissions are allowed on the remote cluster, and you add the option to cmviewcl to do this.

[melvyn burnard]

not necessarily in the same subnet.
You might also want to look at the free Serviceguard Manager product for viewing clusters

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B8325BA

[Geoff Wild]

Michelle - did you get it to work?

I'm testing myself.

On one of my clusters, I added myself and my workstation:

USER_NAME gwild
USER_HOST sha1
USER_ROLE monitor


Did the cmapplyconf, everything looks good...

Yet, from my workstation, I still get:

sha1:gwild:/home/gwild # /usr/sbin/cmviewcl -v -c sdha
cmviewcl : Cannot find cluster sdha.
Either cluster sdha is not configured, or the user doesn't
have access to view the cluster configuration.

My workstation is a one node cluster I use for testing...

Rgds...Geoff

[Michelle_61]

Yes Geoff, I got cmviewcl -c to query a ServiceGuard v11.15. Since the version of the cluster is lower than 11.16, I just added the root user for the remote host to the /etc/cmcluster/cmclnodelist file of the cluster host.

However, so far this method works only for remote nodes that are in the same subnet of the cluster nodes. I got the same error messages as you when the remote node is not in the same subnet. I have tried adding entries to /etc/hosts and set "files" as the first choice for "hosts" in nsswitch.conf file. But that does not help. That is why I am curious about whether cmviewcl can be issued from a remote node that is outside of the cluster subnet.

Any insights?

[Geoff Wild]

Found my issue - we have disabled identd daemon - and MC/SG needs it to validate usernames...sigh...sometimes security hurts...

Rgds...Geoff

[Geoff Wild]

You may be on to something with the subnet...

Example:

my workstation:

# ifconfig lan0
lan0: flags=843
inet 192.44.162.125 netmask fffff800 broadcast 192.44.167.255

Cluster node:
# ifconfig lan2
lan2: flags=1843
inet 192.44.176.16 netmask fffffc00 broadcast 192.44.179.255

Different broadcast...and subnet mask...even though I can ping it....

PS: also remembered that I run cluster daemons with the -i option - so as to not use identd:

hacl-probe stream tcp nowait root /opt/cmom/lbin/cmomd /opt/cmom/lbin/cmomd -i -f /var/
opt/cmom/cmomd.log -r /var/opt/cmom
hacl-cfg dgram udp wait root /usr/lbin/cmclconfd cmclconfd -p
hacl-cfg stream tcp nowait root /usr/lbin/cmclconfd cmclconfd -c -i


Rgds...Geoff

[Michelle_61]

There are some network problems. I cannot even ping the IP address of the cluster name from outside of the subnet.

Thanks for all the help!