Serviceguard A.11.18.00 " New Cluster" cmquerycl problem

[jose da silva]

When applying cmquerycl -C service_guard.ascii -n uranus -n neptune
I get the following error
Please make sure that the proper security access is configured on node
neptune through either file-based access (pre-A.11.16 version) or role-based
access (version A.11.16 or higher) and/or that the host name lookup
on node neptune resolves the IP address correctly.
Failed to gather configuration information.

I can remsh ssh scp between the nodes. Please advise. See attached inedt, netconf services etc files attached.

[Steven E. Protter]

Shalom,

http://docs.hp.com/en/B9903-90048/B9903-90048.pdf

HP moved away from the file based security model to one based on cmnodelist

remsh is a terrible security liability and should be avoided for most applications.

SEP

[jose da silva]

Hi Steven

Sorry I just want to be sure I am on the correct track.Do you mean that the nsswitch.conf should have entries only with nis and not files?

[Aneesh Mohan]

Hi Jose,


1)Check the host name resolution .
2)Check cmclnodelist file
3)Check the below entries in the respective files.

root@olprd1:/etc/cmcluster# cat /etc/inetd.conf |grep -i hacl
hacl-probe stream tcp nowait root /opt/cmom/lbin/cmomd /opt/cmom/lbin/cmm
hacl-cfg dgram udp wait root /usr/lbin/cmclconfd cmclconfd -p
hacl-cfg stream tcp nowait root /usr/lbin/cmclconfd cmclconfd -c

root@olprd1:/etc/cmcluster# cat /etc/services |grep -i hacl
hacl-hb 5300/tcp # High Availability (HA) Cluster heartbeat
hacl-gs 5301/tcp # HA Cluster General Services
hacl-cfg 5302/tcp # HA Cluster TCP configuration
hacl-cfg 5302/udp # HA Cluster UDP configuration
hacl-probe 5303/tcp # HA Cluster TCP probe
hacl-probe 5303/udp # HA Cluster UDP probe
hacl-local 5304/tcp # HA Cluster Commands
hacl-test 5305/tcp # HA Cluster Test
hacl-dlm 5408/tcp # HA Cluster distributed lock manager

root@olprd1:/etc/cmcluster#cat /etc/inetd.conf |grep -i auth
auth stream tcp6 wait bin /usr/lbin/identd identd

4) Read the 11.18 release note
http://www.docs.hp.com/en/B3935-90114/B3935-90114.pdf


Thanks,
Aneesh

[Stephen Doud · Accepted solution]

ON EACH NODE:
1) Temporarily create /etc/cmcluster/cmclnodelist and then insert a + in the file.

2) Move /etc/inetd.sec to another name temporarily

3) Edit /etc/hosts and insure all IPs defined on each system are included. Then alias all IPs to the hostname of the corresponding server, even HB NICs.

[Emil Velez]

I have had a issue like that when I added a IP to a lan card and did not have a hostname for that IP in /etc/hosts or DNS.

[jose da silva]

Hi ALL

Firstly thank you all for the inputs. yesterday I revised all the config files such as inetd.conf, nswwitch.conf , hosts.equiv and they were all OK. What was strange that even when I applied inetd -c and inetd -k and inetd -s to the two nodes but nothing changed. Then I decided to reboot both nodes and ALL came right starnge for some reason. The only issue is now the networking and I will work on this issue today and give feedback to you all. One thing I would like some advice , if I have configured two NIC for the stationary_ip " data package traffic" should I on the hosts file put the ip address and full qualified name of the hosts or should I just give it an alias " short hostname" with the ip address?

[wci]

Hi Jose,

we do have nodes using short host names
in /etc/hosts file and nsswitch.conf hosts line configured as below.

hosts: files [notfound=continue] dns

This setup works for us for many years without an issue.
dns obviously resolves to the FQDN.

WCI

[Stephen Doud]

If you only put the simple hostname alias for the IP on the line, Serviceguard configuration commands will issue a Warning statement, "unable to determine local domain name". Since it's just a warning, you can ignore it. If you want to eliminate it, put the FQDN just after the IP. Add the simple hostname of the server next, if the alias does not include it.

Example:
16.113.1.215 helix-hb.alf.cpqcorp.net helix-hb helix

[jose da silva]

Hi All

The issue I am getting now is different. The nodes can talk to each other but I still have issues when executing cmcheckconf see the txt file attached with " cat SOl.ascii , cat syslog.log and the results when I run cmcheckconf". Please advise.

[jose da silva]

Hi See the attachemnet sysinfo file. Perhapps I am missing something .

[jose da silva]

Hi All

Please see this attachement " sysinfo" and ignore the previous one sent.