Error: Node is refusing Serviceguard communication.

[zafar.rizvi]

Hi all,
I have a two node cluster running and i want to add one new node in it. I copied all cmcluster directory from my running node. I present the cluster qurum disk on new node as well. I change the file of ascii with new node ip and disk. When i try to execute this command cmquerycl -v -c staging -n test1 -n test2 -n test3 (test3 i need to add in cluster)on new node then i got msg that the apple node is refusing service gurad communication and Please make sure that the proper security access is configured on node
tppora50 through either file-based access (pre-A.11.16 version) or role-based
access (version A.11.16 or higher) and/or that the host name lookup
on node tppora50 resolves the IP address correctly.

But all nodes can communicate without any error and root login is available for login for any node. I add all nodes name and username in the .rhosts file and respected /etc/hosts exist in the file. But can't understand why it is not communicating with already running cluster nodes.

I check all things from ITRC posted msgs but did't succeed in adding new node. Any person have an idea.......why this thing happening.

For furthur information, feel free to contact.

[Matti_Kurkela]

Do you have the /etc/cmcluster/cmclnodelist files configured, especially on the new node?

Chapter 5, subchapter 1 of the "Managing ServiceGuard" manual has the details:

http://docs.hp.com/en/B3936-90079/ch05s01.html#d0e9758

Which version of ServiceGuard are you using?

If it's A.11.16 or newer, remember that A.11.16 changed many things about ServiceGuard access control. The .rhosts files should no longer be needed for ServiceGuard.

MK

[Ludovic Derlyn]

hi

have you checked /etc/inetd.conf
this two lines will be uncommented :

hacl-cfg dgram udp wait root /usr/lbin/cmclconfd cmclconfd -p
hacl-cfg stream tcp nowait root /usr/lbin/cmclconfd cmclconfd -c

regards
L-DERLYN

[Ludovic Derlyn]

if response is correct don't forget to assign points ;-)

Your profil indicates 0 points to 17 questions

[zafar.rizvi]

I am using serviceguard 11.16 and i configure the cmclnodelist with following host entries.

test50 root
test51 root
test52 root

and same thing was defined in the .rhosts before but no configuration working and same results after running cmquerycl command.

hacl-cfg dgram udp wait root /usr/lbin/cmclconfd cmclconfd -p
hacl-cfg stream tcp nowait root /usr/lbin/cmclconfd cmclconfd -c
these two lines exist there in the inetd.conf.....But same results.
I will rank it confirm after this problem solution.

zafar

[Stephen Doud]

Insure /etc/cmcluster/cmclnodelist lists EVERY node, on EVERY nodes' /etc/cmcluster/cmclnodelist file.

On the new node, remove /etc/cmcluster/cmclconfig - it only contains references for the older 2-node cluster, so it is not accurate for the new node

Check /etc/inetd.conf - look for the 'ident' line and insure it matches the cluster nodes.

Insure /etc/hosts lists every fixed IP assigned to all nodes in the cluster. Insure each line entry also contains the simple hostname of the server, even though the IP is not aliased directly to the hostname.

[zafar.rizvi]

My all nodes using 11.16 service guard. But both existing cluster nodes contains cmclnodelist file with + sign entry and .rhosts file contains hosts and username. On new node cmclnodelist created with cluster nodes and root access.

Also
ident stream tcp wait bin /usr/lbin/identd identd line exist in the inetd.conf.

so what else i have to check because nothing seems wrong.

[melvyn burnard]

I recommend you take a read of the following:

http://docs.hp.com/en/6283/SGsecurityfiles.pdf
http://docs.hp.com/en/5874/securingserviceguard_nov2005.pdf

They may explain your symptoms, which are indicative of a communications configuration issue

[zafar.rizvi]

I tried everything and found these results

Begin checking the nodes...
Error: Permission denied to
Error: Permission denied to
Error: Node test1 is refusing Serviceguard communication.
Please make sure that the proper security access is configured on node
tppora50 through either file-based access (pre-A.11.16 version) or role-based
access (version A.11.16 or higher) and/or that the host name lookup
on node tppora50 resolves the IP address correctly.
Failed to gather configuration information.


so now what will be reason after all security options checked.

[zafar.rizvi]

Any body have idea......about my problem.

I am really stucked here......