DCE configuration under MC Service Guard

[Nicolé]

Hi,

We have configured a DCE server running on our Production m/c. Initially, this was done without setting the MC Service Guard option.

We now want to reconfigure DCE under MC Service Guard, however, we want to retain our previous database of CDS entries, principals, etc.

Would highly appreciate if somebody could provide us the necessary information to do the same. Also need to know which files would be required to be modified or deleted so that this can work.

Regards,
NicolT.

[Sarah Plunkett]

Hi,

Setting up DCE to work with MC/SG is not difficult. I'll point you in the direction of a fine document which will help you. (sorry about the URL. If the URL isn't readable, just go to http://docs.hp.com,click on "Search" and put in the keywords, "dce serviceguard")

http://docs.fc.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B3190-90073/B3190-90073_top.html&con=/hpux/onlinedocs/B3190-90073/00/00/39-con.html&toc=/hpux/onlinedocs/B3190-90073/00/00/39-toc.html&searchterms=dce%20serviceguard&queryid=20010123-011308

You will not have to change any DCE CDS entries or prinicipals. The modifications are in the SG package scripts, and some slight tweaking to some lvol names.

The document at docs.hp.com is the official guidance, so this is the best starting point for configuring your DCE server(s) to work with MC/Serviceguard.

[Nicolé]

Sarah,

Thanx for the info. It appears that the document talks about setting up DCE for the first time, and not over an existing DCE setup. Since our scenario is a bit different, I think I need to clarify what exactly we will be implementing :-

> Currently, assume our host has hostname hostA and physical IP WXYZ.

> Under MCSG, we will be changing the hostname and physical IP of hostA to hostB & ABCD respectively, and assigning the original hostname & IP as the new Package name & Logical IP

This is to enable our users to be transparent to the change

Since DCE was originally configured under hostA, but not under MC S/G, what I need to know is,

1> Do I have to configure it again under MC S/G, or will it work as it is (for eg., by setting RPC_SUPPORTED_NETADDR) ? If I don't have to reconfigure, are there any files that need to be edited/removed, or any variables need to be set ?

2> If I have to reconfigure, after reconfiguring, will I retain my original setup (CDS, principals etc.) ? Do any files need to be modified ? This is our main concern.


Would really appreciate any feedback on the same.

Thanx & regards,
NicolT.

[Alex Glennie]

Mmmm thats more interesting .... I'd do the following :

1. Have a good backup

2. Take things step by step .

Changing the Network Address of a DCE Machine


Occasionally, a machine running DCE will need to change its network address. DCE stores the network address in several files which need to be updated.
To change a DCE machine's network address, you must perform the following procedure:

Shutdown DCE (by selecting option 3 "stop DCE" in the dce_config Main Menu. If the IP address change involves a master replica, the complete cell needs
to be taken down.
Change the machine's network address and reboot the operating system, as needed.
Stop DCE, remove the machine's CDS cache:
rm /opt/dcelocal/var/adm/directory/cds/cds_cache*
Update the network address in the /opt/dcelocal/etc/security/pe_site file. If the system is the
security master then change the old IP address in the file /opt/dcelocal/etc/security/pe_site for the new one on all the systems in your cell.
security slave, update only that slave's pe_site file.
Note: Do not change the IP address of more than 1 security server at a time. If you have more than 1 server to change ip address, you must complete all
steps in this document and verify you have an up and running cell and that the propagation of new security server address is complete, before
changing the IP address of another security server. When "dcecp -c registry show -replica" no longer shows the old ip address, then its ok to proceed
to the next ip address change.
Restart DCE (by selecting option 2 "START" in the dce_config Main Menu OR /sbin/init.d/dce start).
If necessary, update the following CDS objects:
/.:/hosts/hostname/self
/.:/hosts/hostname/dts-entity.
These CDS objects contain bindings that are exported when the cell is configured by the dce_config script, but are not checked when daemons are restarted.
After changing IP address bring your cell back up again. Please note that it will take much longer than usual for your cell to come up.

Then tackle the SG side ? see attached.

I'll see if Sarah's free to confirm this ......

[Alex Glennie]

post your email, I'll send the attached doc to you if you can't get to it.

also :

DCE & ServiceGuard Common Problems:


Some common DCE client errors when the DCE Master is under
ServiceGuard control. In this example, the DCE master is running at
SG pkg IP address of DCEpkgIP. All DCE clients are not under SG control.

-Trying to configure DCE client, get the error, unable to get object
UUID of security server. The pe_site file does specify the DCEpkgIP
address for the security server. dce_config is failing on the hostdata
lookup of the security server system's pe_site file.
"dcecp -c hostdata show ncadg_ip_udp: -ifname pe_site "
fails with no more profile elements.
"server ping {UUID@ncadg_ip_udp: }" returns 1, so the
security server is talking. The UUID is from the local pe_site file for
this DCEpkgIP address.
Another method is:
"server ping {IF-UUID,hostname}" where IF-UUID is from the
/etc/opt/dce/hpadmin/wellknownif file.
Problem: duplicate pkg IP address. Run "netstat -in" on all nodes in
the cell looking for the DCEpkgIP address. The IP address should exist
only in 1 place, the active SG system.
Most likely cause is an incorrect shutdown of the DCE SG pkg. The last
thing done in the pkg shutdown is to release the pkg IP address. So,
most likely, the user defined shutdown script was hung, and the user
did not specify the option to timeout the user script, therefore leaving
the pkg IP address active.
Get-around: The duplicate IP address can be released on the incorrect
system by "cmmodnet -r -i
Fix: set the SG option to timeout the user script.

-"dce_login " returns
user identification failure- file open failed (??? / aap)
dcecp and dceval coredump. dceping -C runs OK.
As root user, dce appears to run fine.
Problem: permissions are wrong for /opt/dcelocal/dce_cf.db. Should be
644 w/ owner/group of root:sys.

-Using dce_config to configure dce client, get the error:
Can't create sec_clientd.binding file.
dced aborted. Fatal.log shows:
dced FATAL can not use '*all*' protocol sequence. bad filenumber.
Problem: RPC_SUPPORTED_NETADDRS was set to DCEpkgIP address in the
/etc/opt/dce/dce_com_env and dce_config_env files. This variable
should be set to only IP addresses that are local to the system.
Fix: Comment out the setting of RPC_SUPPORTED_NETADDRS in the
dce_com_env and dce_config_env files on the dce client nodes.

-dcecp -c server ping cpu spin (ties up the cpu at 95+ utilization).
Problem is usually seen after a MC/SG DCE package switchover to the standby
node. When DCE has come up on the new node, the dce.monitor script does a
dcecp -c server ping to the endpoints of key DCE services.
Fix: Turn off DMS. This can be done by placing
export DMS_FORCEOFF=something
in /etc/rc.config.d/dce or /etc/opt/dce/dce_com_env file.

[Nicolé]

Alex,

Thanx very much for the info. My email is webnemesis23@hotmail.com. Would appreciate if you could send me the mentioned doc, since SG is where the complications start !

Regards,
NicolT.