Error after upgrading servicegaurd to 11.16

[SUDHAKAR_18]

config: hpux 11.11/Rp7410/npar/2node cluster.

After upgrading serviceguard version to 11.14 to 11.16, I am contineusly getting following error messages in syslog file.

Aug 11 18:05:00 ram1 cmclconfd[17361]: cmclconfd running with weak security (identd disabled).

Pls help me to resolve this...

Regards,
Sudhakar.

[melvyn burnard]

this is because there were changes made in SG A.11.16, and which were available as patches to A.11.14 and A.11.15, which enhanced SG security.
You need to check your networking config and enable identd rather than authd
Take aread of:
http://docs.hp.com/en/6283/SGsecurityfiles.pdf
and
http://docs.hp.com/en/5874/securingserviceguard_nov2005.pdf

[SUDHAKAR_18]

Hi Melvyn,

We are already gone through this documents.

Pls see my inetd.conf file.

still I am getting error messages on both the nodes of clusrer.

Regards,
Sudhakar

[melvyn burnard]

Here is your problem:
hacl-cfg stream tcp nowait root /usr/lbin/cmclconfd cmclconfd -c -i
and
hacl-probe stream tcp nowait root /opt/cmom/lbin/cmomd /opt/cmom/lbin/cmomd -i -f /var/opt/cmom/cmomd
There should not be the -i option

[SUDHAKAR_18]

In rolling upgrades, after upgrading to 11.16 in one node, while running #cmrunnode -v we are getting error messages .As per docs we disabled idend by putting -i option in inetd.conf.

Attaching syslog shot.

[melvyn burnard]

well if you are in the middle of a rolling upgrade, this could be expected, due to the changes, and possible network differences in the two versions.
Your syslog is showing that there are networmk issues that should be investigated.

[SUDHAKAR_18]

That means , Now upgradation is complete. can i remove -i from inetd.conf?

Regards,
Sudhakar

[melvyn burnard]

If you have finished the rolling upgrade, i.e. ALL nodes are at 11.16, then yes you shoul dremove those -i settings.

[SUDHAKAR_18]

Hi,

After removing -i in inetd.conf, still we are getting same error messages.

Is there any patch?

Regards,
Sudhakar

[SUDHAKAR_18]

Wheather system requires reboot after removing -i option?

Regards,

[melvyn burnard]

did you do an inetd -c?
And which specific errors are you stil getting.
You should make sure you have the latest SG patch for A.11.16
PHSS_36898 and PHSS_32734

[SUDHAKAR_18]

Aug 12 16:29:15 ram1 cmclconfd[21189]: cmclconfd running with weak security (identd disabled)

same error after removing -i and inetd -c.

but there is a line in inetd.conf
#ident stream tcp wait bin /usr/lbin/identd identd

can we remove # ?

I will down load and install these patches.

Regards,
Sudhakar

[melvyn burnard]

yes, that means identd is commented out an dNOT in use.
You should remove the comment and redo inetd -c

[SUDHAKAR_18]

After removing # ,I am getting error while using cmviewcl.

(root)(ram1):/home/hcl>cmviewcl -v

CLUSTER STATUS
dbappscl up

NODE STATUS STATE
ram0 up running
cmviewcl : Unable to determine the number of network interfaces on ram0.
Cluster may be reforming. Try again.

NODE STATUS STATE
ram1 up running
cmviewcl : Unable to determine the number of network interfaces on ram1.
Cluster may be reforming. Try again.


what may be the problem? After putting # and -i above problem solved, but weak security error is still generating.

Regards,

[melvyn burnard]

you appear to possibly have networking issues witrh name resolution etc.
Sounds like it is time to log a call with your local HP Response Centre