Showing posts with label VCS. Show all posts
Showing posts with label VCS. Show all posts

Wednesday, March 21, 2012

VCS Cluster Communications Guide

VCS Cluster Communications

From HP's MC/Serviceguard, cluster membership is defined in the primary cluster configuration file - simply an ASCII file that the administrator edits. Cluster communications takes place in any network path between the cluster nodes.

Veritas Cluster Server's communications is more complex. But once you have everything set up, in theory, you should never have to worry about it again. However, troubleshooting VCS cluster communications without the requisite knowledge, would be a very entertaining exercise - to watch...

This page seeks to document the VCS communications elements and how to go about updating/modifying them, as needed. The first section is an overview - how the pieces tie togeter.

Following that, we'll work our way up from the bottom - examining LLT, then GAB in order.

Overview

To begin the overview, refer to the picture:


















VCS agents track the state of all resources and service groups in the cluster. _HAD_ polls the various agents on the node and, if there's a change, reports that to _GAB_. _GAB_ (Group Membership Services/Atomic Broadcast) has two jobs.

First, it tracks which systems are part of the cluster. Cluster membership is defined by systems sharing the same cluster ID and a pair of redundant Ethernet LLT cables.

GAB's second job is to transmit resource status changes to all nodes in the cluster.

The atomic broadcast portion of the name implies (correctly, as it turns out) that all systems in the cluster are notified of any changes. If a failure occurs during the update, the "status change" is rolled back ensuring that, upon recovvery, all nodes have the same status information. It's the same paradigm as a database commit, if that's familiar to you _LLT_ is responsible for transmitting the heartbeat signals which GAB uses to maintain cluster membership.

A cluster can have between 2 and 8 LLT cables. LLT links can be identified as low or high priority.

- High priority links:
  - Send a heartbeat ever .5 seconds
  - Carry cluster status information
  - Should be configured over dedicated network links

- Low priority links:
  - Send a hearbeat every second.
  - Do not carry cluster status information.
  - Can be configured on public networks
  - Will be automtically promoted to high priority links if all other high priority links have failed.

LLT


LLT is the lowest protocol in the VCS communications chain so everything else relies on it. If LLT isn't happy, ain't nothing happening - so, let's make LLT happy.

_/etc/llttab_

_/etc/llttab_ is LLT's primary configuration file. At a minimum, it specifies the system ID, cluster ID, and the local links that LLT uses for heartbeat signals.

You can see what other options are available via the sample llttab file in _/opt/VRTSllt/llttab_ and in the llttab man page. Since the file defines host specific entries, it must be unique to the host. No rdist'ing this file...

# cat /etc/llttab
set-node       1
set-cluster    10
link qfe0 /dev/qfe:0 - ether - -
link hme0 /dev/hme:0 - ether - \-

set-node

Ensure that there is only one _set-node_ directive in the file The value for the set-node can be either a number (0-31) or a system name. If you use the system name, the name must resolve to a unique number in the _/etc/llthosts_ file.

For instance:

# cat /etc/llttab
set-node       athena
set-cluster    10
link qfe0 /dev/qfe:0 - ether - -
link hme0 /dev/hme:0 - ether - -
# cat /etc/llthosts
0 athena
1 zeus
2 otehllo
3 ...

If you decide to use the _/etc/llthosts_, the following rules apply: - The file must be synced across all nodes in the cluster. - The node numbers must be unique otherwise, the cluster won't start. - The system names used must match those in the _/etc/llttab_, _etc/VRTSvcs/conf/main.cf_ and _/etc/VRTSvcs/conf/sysname_ (if used) files.

set-cluster

The set-cluster directive must specify a unique number across any clusters that the LLT heartbeat can reach. This implies that you can have multiple clusters sharing the same LLT links. This makes it easier on the networking people in that you can have four 4-node clusters sharing the same two 16-port switches thereby reducing the overall hardware costs.

_/etc/sysname_

The sysname file eliminates VCS's dependence on the UNIX uname command to identify the hostname. The problem is that some OSs will report a fully qualified domain name for a "uname -n" command. If that's the case, the system name won't match the name in the main.cf file and VCS will puke.

If you use the sysname file, ensure the system name matches the one used in the llttab and ltthosts file - assuming you're using the system name there as well. At a minimum, it must match the name in the main.cf file.

LLT commands


OK; now that we have all the LLT configuration files set up, it's time to run LLT:lltconfig -c Now that it's running, how do we verify that

# lltconfig -a list
llt is running

The "lltstat -nvv" command displays some verbose information on the status of LLT. You can use this command to verify that all LLT links are operational.

The training manual suggests executing the command via cron and looking for DOWN periodically. See the man page for additional options


GAB


GAB is the next rung up the protocol ladder; hower, it's easier to configure than is LLT h3. _/etc/gabtab_

The gabtab file is the primary (and only) means of configuring GAB. It specifies the command line used to start GAB. As such, in order to start GAB, you just run the /etc/gabtab file/etc/gabtab


GAB Status


Use "gabconfig -a" to check the status of GAB.

# gabconfig -a
GAB Port Membership
===============================================
Port a gen b38f123 membership 01        ; 2       01
Port h gen f00b123 membership 01        ; 2       01

There's quite a bit of useful information in the list above. For instance, the _Port a{_}indiates that GAB is communicating (which automatically means that LLT is fully functional) and has membership of nodes 0, 1, 12, 20, and 21.

The membership list uses ';' for 10's markers or 0 if the node is actually in use The _Port h_ indicates that had is started and has similar memberships to GAB

Manual Seeding


GAB will normally handle the seeding of the cluster nodes automatically based on the information in the _/etc/gabtab_. If, however, you have a node down for maintenance and need to restart your cluster, GAB will effectively hang waiting for the last system to come alive.

To circumvent this issue, you will need to manually seed the cluster. To do that, do the following: - On one node and one node only, execute gabconfig -c -x -

On the remaining available nodes, execute gabconfig -c

----
Reference:
[http://olearycomputers.com/ll/vcs/vcs_comms.html]

Enable VCS SecondLevelMonitoring for Apache with Siteminder Protection

This is a record of how i setup for VCS 5.0 MP3. The following steps has been tested on RHEL4 64bit with VCS 5.0MP3 and siteminder 6QMR5 Hotfix15. Originally VCS is sending the following to apache for 2nd level probing.

[root@webserver Apache]# grep HEAD Apache.pm
  print $sock "HEAD $sGetFile HTTP/1.0" . $space;

When we manually tested with Apache, the successful command is as follows,

[root@webserver siteminder]# telnet 10.11.12.13 80
Trying 10.11.12.13...
Connected to webserver.site.com (10.11.12.13).
Escape character is '^]'.
HEAD / HTTP/1.1
Host: webserver.site.com

HTTP/1.1 200 OK
Date: Mon, 17 Nov 2008 06:20:48 GMT
Server: Apache
Last-Modified: Thu, 06 Nov 2008 06:52:31 GMT
ETag: "4c4ab-25-45affbd9a39c0"
Accept-Ranges: bytes
Content-Length: 21
Vary: User-Agent
Content-Type: text/html; charset=ISO-8859-1

Connection closed by foreign host.
[root@webserver siteminder]#

When using HTTP/1.1 with additional host line, code 200 is returned. Therefore, we can try modifying Apache.pm with the following in RED to work with Siteminder using SecondLevelMonitoring. Host identifier for siteminder.

[root@webserver Apache]# grep HEAD Apache.pm
  print $sock "HEAD $sGetFile HTTP/1.1\nHost: $sHost" . $space;

A dummy file for checking that the web service is OK.

[root@webserver conf.d]# grep "sGetFile =" /opt/VRTSvcs/bin/Apache/Apache.pm
  $sGetFile =  '/ok.gif';

Without the above, the following will happen when SecondLevelMonitor is enabled, what you see in /var/VRTSvcs/log/Apache_A.log

2009/01/13 11:56:28 VCS ERROR V-16-2-13066 Thread(4136012704) Agent is calling clean for resource(webserver) because the resource is not up even after online completed.
2009/01/13 11:56:29 VCS NOTICE V-16-55005-10455 Resource(webserver) - (webserver:clean) VCSagentFW:SetupLogging:[clean] Entered by resource instance [webserver] with clean reason [3][Online Ineffective]
2009/01/13 11:56:34 VCS ERROR V-16-2-13068 Thread(4136012704) Resource(webserver) - clean completed successfully.
2009/01/13 11:56:34 VCS ERROR V-16-2-13071 Thread(4136012704) Resource(webserver): reached OnlineRetryLimit(0).
and you see in /var/log/messages
Jan 13 11:54:27 webserver Had[31344]: VCS ERROR V-16-1-20047 (webserver) Apache:webserver:monitor:  HTTP GET test failed for host [webserver.site.com] port [80]
Jan 13 11:55:28 webserver Had[31344]: VCS ERROR V-16-1-20047 (webserver) Apache:webserver:monitor:  HTTP GET test failed for host [webserver.site.com] port [80]
Jan 13 11:56:28 webserver Had[31344]: VCS ERROR V-16-1-20047 (webserver) Apache:webserver:monitor:  HTTP GET test failed for host [webserver.site.com] port [80]
Jan 13 11:56:28 webserver AgentFramework[31357]: VCS ERROR V-16-1-13066 Thread(4136012704) Agent is calling clean for resource(webserver) because the resource is not up even after online completed.
Jan 13 11:56:28 webserver Had[31344]: VCS ERROR V-16-1-13066 (webserver) Agent is calling clean for resource(webserver) because the resource is not up even after online completed.
Jan 13 11:56:34 webserver AgentFramework[31357]: VCS ERROR V-16-1-13068 Thread(4136012704) Resource(webserver) - clean completed successfully.

Eventually, the apache service will be FAULTED. Reason behind this is due to the simple query done by Apache.pm and siteminder blocked this query. Inside /var/log/messages, you will see something similar,

Jan 13 11:56:34 webserver AgentFramework[31357]: VCS ERROR V-16-1-13071 Thread(4136012704) Resource(webserver): reached OnlineRetryLimit(0).
Jan 13 11:56:35 webserver Had[31344]: VCS ERROR V-16-1-10303 Resource webserver (Owner: unknown, Group: webserver_grp) is FAULTED (timed out) on sys webserver

Do note that this is not supported by Symantec but the suggestion came from Symantec after i logged a case with them for VCS+Apache not working with Siteminder. You may need to backup this Apache.pm file in case the file gets overwritten during patching or when you need to get support from Symantec.

 Thats all folks.

Sunday, September 11, 2011

How to determine if the new oraerror.dat is loaded in OracleAgent

Recently, i need to change the behaviour of VCS how it managed my DB. To cut the story short, i wanted to check if the oraerror.dat file is loaded by the Oracle Agent so that monitoring behaviour is according to the oraerror.dat file. If the oraerror.dat is not loaded, the agent will assume the default behaviour after default monitoring (which is FAILOVER). Query the number of entries.

# egrep -v '^$|^#|}' /opt/VRTSagents/ha/bin/Oracle/oraerror.dat | wc -l
187
Check the gcore of the OracleAgent process, the data structure "token_data" stores the in-memory oraerror.dat.
# ps -ef |grep OracleAge
    root  5282     1  0   Aug 26 ?        5:10 /opt/VRTSagents/ha/bin/Oracle/OracleAgent -type Oracle -agdir /opt/VRTSagents/h
    root 23533 29154  0 10:33:32 pts/3    0:00 grep OracleAge
# gcore 5282
gcore: core.5282 dumped
Take a look at the 7th field, which is the number of entries in oraerror.dat plus 1.
# mdb /opt/VRTSagents/ha/bin/Oracle/OracleAgent core.5282
Loading modules: [ libthread.so.1 libc.so.1 ld.so.1 ]
> *token_data/20D
0x97000:        32              663408          0               690328          690424          629608
                188             3               1162824517      1330332928      97              1111573570
                1112492800      80              436440          2               262144          19800
                0               0
ctrl+D to exit. Both the 7th field and the number of entries of oraerror.dat matches. Also look at the permission of the file! If due to some reasons, the oraerror.dat file not loaded by the OracleAgent when it started, check that the file is readable and contains the valid entries, then restart the Oracle Agent.
# ls -l oraerror.dat
-rwxr--r--   1 root     sys         3611 Jul 15  2009 oraerror.dat
# haagent -stop Oracle -force -sys myserver
# haagent -start Oracle -sys myserver

# haagent -display | grep Oracle
Oracle        AgentDirectory /opt/VRTSagents/ha/bin/Oracle
Oracle        AgentFile
Oracle        Faults         0
Oracle        Running        Yes
Oracle        Started        Yes
Please noted that if oraerror.dat is modified, the agent has to be restarted in order to have the agent recognise the change. Reference: http://www.symantec.com/docs/TECH155872

Saturday, October 31, 2009

HowTo setup Link-based IPMP with VCS for Solaris 10.

Thanks Bret Sanders for the knowledge. Have used this to setup and like to share.

Original: http://www.runningunix.com/2009/01/link-based-ipmp-setup-with-vcs/

We know that Solaris 10 allows us to setup link-based IPMP. Though a nice feature which the OS determines NIC availability solely on the NIC driver reporting the physical link status - UP or DOWN, setting link-based IPMP in VCS is a little different.

Previous versions used “probe-based” IPMP, where connectivity is tested by pinging something on the network from each interface.

While probe-based is actually a more thorough test (tests network layer 3 as well as 2), it is much more cumbersome to configure, and you need an extra IP address for each interface for “test” addresses. usually Link-based IPMP is sufficient for most applications.

For some reason, configuring link-based IPMP in VCS is somewhat tricky, and the documentation doesn’t seem to help much. It seems all the default values for VCS are for probe-based IPMP only.

To achieve link-based IPMP, There are values you need to change from the defaults in the MultiNICB resource:

Tells VCS to use mpathd for network link status
UseMpathd: 1

The default, /usr/sbin/in.mpathd is just incorrect - it doesn’t live there.
MpathCommand: /usr/lib/inet/in.mpathd -a

If you leave this at 1, it will overwrite your /etc/hostname.xxx files with probe-based IPMP configuration
ConfigCheck: 0

The “interface alias” for each device is not needed, leave them blank.
Device: (your IPMP interfaces here)

You want VCS to NOT ignore link status, since this is how link-based IPMP works.
IgnoreStatus: 0

Do not use your IPMP group name here, it’s not needed. VCS is not monitoring the group, mpathd is.
GroupName:

Here’s how it looks in main.cf:

MultiNICB csgmultinic (
UseMpathd = 1
MpathdCommand = “/usr/lib/inet/in.mpathd -a”
ConfigCheck = 0
Device = { ce0 = “”, ce4 = “” }
IgnoreLinkStatus = 0
)