Serviceguard 11.16 failed to start

[John Kelly_3]

This is more of a post-mortem post as I now have the cluster running. I just want to know what happened...

I failed over to node1 and ran cmhaltnode node2. I installed the GOLDBASE and GOLDAPPS from Dec 2006 onto node2 and also PHSS_35302 because the GOLD packs required it.
Everything looked fine and I failed back to node2 and proceeded to add the same patches to node1. When node 1 came back up it failed to start the SG cluster service.
Errors from cmviewconf were: -
cmviewconf: Unable to get cluster configuration information.
Unable to open communications to configuration daemon: Not owner
Unable to connect to configuration database.
Error: Failed to lookup /cluster in configuration database.
Error: Fail to load data from configuration database.
Internal error: Unable to open communications to configuration daemon: Not owner
Error: Unable to connect to configuration database.
cmrunnode : Unable to determine nodes on the current cluster.
Either no cluster configuration file exists, the file is corrupted,
cmclconfd is unable to run, or user root on node ekbei01
doesn't have access to view the configuration.
ERROR: Unable to join cluster

I removed some patches related to Serviceguard and cmviewconf then worked correctly but could still not read the config from node2. I ran cmviewconf on node2 and had the same errors.

In the end I had to amend the hacl-cfg and hacl-probe entries in /etc/inetd.conf by adding the -i switch so as not to use identd. (identd was always commented out of my /etc/inetd.conf file)

What happened? What behaviour has been changed with these patches? Why does the -i switch make a difference when identd was always disabled? (.rhosts files have always been disabled too)

Sorry for the long post... Thanks for any responses.

[Duncan Edmonstone · Accepted solution]

John,

I expect you installed PHSS_34759. Did you read the special installation instructions:

http://www4.itrc.hp.com/service/patch/patchDetail.do?patchid=PHSS_34759&sel={hpux:11.11,}&BC=main|releaseIndexPage|releasePage{5013-6487}|depotPage{GOLDQPK11i:B.11.11.0612.459}|#Special%20Installation%20Instructions:

Also worth looking at these two whitepapers:

http://docs.hp.com/en/5874/securingserviceguard_nov2005.pdf

http://docs.hp.com/en/6283/SGsecurityfiles.pdf

HTH

Duncan

[Steven E. Protter]

Shalom,

SG 11.16 will not run at all without the modifications in inetd.conf for -i

SEP

[John Kelly_3]

Thanks Duncan. No I didn't read the special instructions. :-(

So ideally I should turn off the identd functionality until all nodes are patched and running. Then I should activate identd in inetd.conf and remove the -i switch from hacl-probe and hacl-cfg.

I'm not going to do that since we want identd switched off. So I will let it run as it is with the -i switch in place.

Thanks

[John Kelly_3]

Serviceguard 11.16 requires all nodes to run identd from inetd.conf after patching with PHSS_35302. A workaround is to add an -i switch to the /etc/inetd.conf entries for hacl-cfg and hacl-probe

Thanks to all