Error: Node fcretn1 is refusing Serviceguard communication.

[Antonio Saucedo]

I'm getting a cluster buy when I run cmcheckconf, I get the following
error


aasv@SD32A-fcretn1 > cmcheckconf -v -C /etc/cmcluster/rmsprd.ascii -P /etc/cmcluster/fcret/oracle.cfg

Checking cluster file: /etc/cmcluster/rmsprd.ascii
Checking nodes ... Done
Checking existing configuration ... Done
Warning: Unable to get configuration for cluster fcretcl.
Error: Node fcretn1 is refusing Serviceguard communication.
Please make sure that the proper security access is configured on node
fcretn1 through either file-based access (pre-A.11.16 version) or role-based
access (version A.11.16 or higher) and/or that the host name lookup
on node fcretn1 resolves the IP address correctly.
cmcheckconf : Failed to gather configuration information
aasv@SD32A-fcretn1 >

I have

1. created a cmcmnodelist
2. created a /.rhosts.
3. added all required entries to the /etc/hosts
4. checked an nslookup resolved the hostames OK - it does

I don't have firewall between nodes


Any Idea?

[Srinivas Krishnappa Sha]

I hope you have checked the hostname as well.

hostname should give just the name of the system and it should not be fully qualified domain name.

For ex:hostname on system xyz should be xyz and not xyz.abc.com

Can you copy paste the contents of .rhosts and /etc/hosts ?

I think the file cmcmnodelist is a typo and it is actually cmclnodelist

Hope this helps

[Stephen Doud]

create /etc/cmcluster/cmclnodelist, place a * in the file until you have successfully completed cmcheckconf. After that, use:

fcretn1 root
root

/etc/hosts:
Insure ALL IP-bearing NICs are identified in /etc/hosts. Add the fully qualified domain name first then simple hostname/alias, then on lines that do not contain the hostname, add the hostname at the end.
Insure this line exists in /etc/hosts:
127.0.0.1 localhost loopback

/etc/nsswitch.conf:
Insure the 'hosts' line looks something like this:

hosts: files dns

/var/adm/inetd.sec:
Inspect the file. If any IP filtering has been added, insure the hacl ports listed in /etc/services are "allow"ed. Also "allow" the registrar service

[Ignacio Javier]

Hola Antonio:

What version of ServiceGuard are you running ?

Have you patched the system lately or this configuration never worked ?

If it is a SG11.16 and you have patched, there are speciall instalation instrucctions to follow.


Regards Saludos

[Antonio Saucedo]

Hi all, I did forget to comment this
the primary node is fcretn1 and secundary node is fcret1n2
the version of OS is 11.11 on both nodes

Srinivas, this is the information

aasv@SD32A-fcretn1 > grep fcretn1 /etc/hosts
10.80.1.118 fcretn1.femcom.net fcretn1
10.80.15.128 fcretn1-m.femcom.net fcretn1-m
10.80.8.128 fcretn1-s fcretn1-s.femcom.net
aasv@SD32A-fcretn1 > tail .rhosts
fceai2
fcoms1
fcret1n2
fcwmprd1.fecmcom.net
+
fcret4 rmssbx


Stephen Doud, I think that to this you talk about

aasv@SD32A-fcretn1 > grep fcret1n2 /etc/hosts
10.80.1.91 fcret1n2.femcom.net fcret1n2
aasv@SD32A-fcretn1 > tail /etc/cmcluster/cmclnodelist
fcretn1 root
fcret1n2 root
aasv@SD32A-fcretn1 > grep hosts /etc/nsswitch.conf
hosts: files dns

I don't have the file /var/adm/inetd.sec in the hosts




Que tal Ignacio,

la version de Serviceguard es A.11.16


Thanks to all, but I even have the problem

[Prashanth.D.S]

Hi Antonio,

inetd to be the primary suspect here..check inetd.conf file on both the nodes is it same as mentioned below if not change it..

/etc/services: ident 113/tcp auth tap # RFC 1413
/etc/inetd.conf: ident stream tcp wait bin /usr/lbin/identd identd

and "inetd -c"

If above is fine then check for the node names & ip address mentioned in cluster ascii file

Verify the cluster ascii file with cmcheckconf

# cmcheckconf -v -C cluster.ascii


Best Regards,
Prashanth

[Antonio Saucedo]

Hi Prashanth,
I checked the configurations, is same on both nodes


aasv@SD32A-fcretn1 > grep ident /etc/services
ident 113/tcp authentication # RFC1413
aasv@SD32A-fcretn1 > grep ident /etc/inetd.conf
ident stream tcp wait bin /usr/lbin/identd identd
aasv@SD32A-fcretn1 > grep hacl /etc/inetd.conf
hacl-probe stream tcp nowait root /opt/cmom/lbin/cmomd /opt/cmom/lbin/cmomd -f /var/opt/cmom/cmomd.log
hacl-cfg dgram udp wait root /usr/lbin/cmclconfd cmclconfd -p
hacl-cfg stream tcp nowait root /usr/lbin/cmclconfd cmclconfd -c

The continuous problem

[Ermin Borovac]

If you have unpatched A.11.16 make sure to install the following patches

PHSS_35302
PHSS_31073

[Rita C Workman]

Antonio,

Just thinking out loud....
...look at fcretn1 .rhost file entries you posted above. It shows the hostname, but not the user "root".
Try editing the file, enter the user root, and give it another try.


Rgrds,
Rita

[Antonio Saucedo]

I have installed the patches and modifies the file rhost but it doesn't work

Regards
Antonio

[Ermin Borovac]

aasv@SD32A-fcretn1 > cmcheckconf -v -C /etc/cmcluster/rmsprd.ascii -P /etc/cmcluster/fcret/oracle.cfg

Stupid question but you are running this as root (not aasv user), right?

Also looking at your PS1 it makes me wonder if it's hardcoded to SD32A-fcretn1 or it's the output of $(uname -n). Output of $(uname -n) must match node name you have in cluster ascii file.

[Antonio Saucedo]

aasv@SD32A-fcretn1 > uname -n
fcretn1
aasv@SD32A-fcretn1 > id
uid=0(root) gid=3(sys) groups=0(root),1(other),2(bin),4(adm),5(daemon),6(mail),7(lp),20(users)

[Ermin Borovac]

Anything interesting in /var/adm/syslog/syslog.log? Make sure you run 'inetd -l' (or 'inetd -s') to turn on connection logging (unless you have it already), retry cmcheckconf and finally check syslog.log.