[ClusterLabs] ClusterMon SNMP resource agent unable to start

[S Sathish S]

Hi Reid Wahl/Team,

With user=root getting error "This account is currently not available" may be bcoz in our application we disable root user account in the system.

Error logs: 
Nov 25 01:08:02 node1 pacemaker-controld[1360516]: notice: Initiating start operation SNMP_tnode1_start_0 locally on node1
Nov 25 01:08:02 node1 pacemaker-controld[1360516]: notice: Requesting local execution of start operation for SNMP_node1 on node1
Nov 25 01:08:02 node1 su[1433598]: (to root) root on none
Nov 25 01:08:02 node1 systemd[1]: Started Session c325947 of user root.
Nov 25 01:08:02 node1 pacemaker-controld[1360516]: notice: Result of start operation for SNMP_node1 on node1: error
Nov 25 01:08:02 node1 systemd[1]: session-c325947.scope: Succeeded.
Nov 25 01:08:02 node1 pacemaker-controld[1360516]: notice: SNMP_node1_start_0 at node1 output [ This account is currently not available.\n ]
Nov 25 01:08:02 node1 pacemaker-controld[1360516]: notice: Transition 714229 aborted by operation SNMP_node1_start_0 'modify' on node1: Event failed
Nov 25 01:08:02 node1 pacemaker-controld[1360516]: notice: Transition 714229 action 44 (SNMP_node1_start_0 on node1): expected 'ok' but got 'error'
Nov 25 01:08:02 node1 pacemaker-controld[1360516]: notice: Transition 714229 (Complete=2, Pending=0, Fired=0, Skipped=0, Incomplete=1, Source=/var/lib/pacemaker/pengine/pe-input-2920.bz2): Complete
Nov 25 01:08:02 node1 pacemaker-attrd[1360514]: notice: Setting fail-count-SNMP_node1#start_0[node1]: 124 -> 125

As per your suggestion , we have omit the user attribute while create SNMP ClusterMon resource type and it able to start without error.

Thanks for the support.

Regards,
S Sathish S

-----Original Message-----
From: Reid Wahl <nwahl at redhat.com> 
Sent: 25 November 2022 01:56
To: S Sathish S <s.s.sathish at ericsson.com>
Cc: Cluster Labs - All topics related to open-source clustering welcomed <users at clusterlabs.org>
Subject: Re: [ClusterLabs] ClusterMon SNMP resource agent unable to start

On Thu, Nov 24, 2022 at 6:09 AM S Sathish S <s.s.sathish at ericsson.com> wrote:
>
> Thanks Reid Wahl for below suggestion.
>
> As you said , We want to keep symmetric-cluster=false I have created location constraints for the resources and enable it .
>
> Now resource is try to start but failed with below error message , we have tried both root and hacluster users it doesn’t not work for us.
>
> While Config user are hacluster:
> Nov 24 09:02:34 node1pacemaker-controld[1360516]: notice: Initiating 
> start operation SNMP_node1_start_0 locally on node1 Nov 24 09:02:34 
> node1pacemaker-controld[1360516]: notice: Requesting local execution 
> of start operation for SNMP_node1on node1 Nov 24 09:02:34 node1su[2094082]: (to hacluster) root on none Nov 24 09:02:34 node1systemd[1]: Started Session c24515 of user hacluster.
> Nov 24 09:02:34 node1pacemaker-controld[1360516]: notice: Result of 
> start operation for SNMP_node1on node1: error Nov 24 09:02:34 
> node1pacemaker-controld[1360516]: notice: SNMP_node1_start_0 at node1output [ This account is currently not available.\n ] Nov 24 09:02:34 node1systemd[1]: session-c24515.scope: Succeeded.
> Nov 24 09:02:34 node1pacemaker-controld[1360516]: notice: Transition 
> 114937 aborted by operation SNMP_node1_start_0 'modify' on node1: Event failed Nov 24 09:02:34 node1pacemaker-controld[1360516]: notice: Transition 114937 action 44 (SNMP_node1_start_0 on node1): expected 'ok' but got 'error'
> Nov 24 09:02:34 node1pacemaker-controld[1360516]: notice: Transition 
> 114937 (Complete=2, Pending=0, Fired=0, Skipped=0, Incomplete=1, 
> Source=/var/lib/pacemaker/pengine/pe-input-3646.bz2): Complete Nov 24 
> 09:02:34 node1pacemaker-attrd[1360514]: notice: Setting 
> fail-count-SNMP_node1#start_0[node1]: 9 -> 10
>
> Regards,
> S Sathish S

The ocf:pacemaker:ClusterMon agent's start operation runs `su - $OCF_RESKEY_user -c "$CMON_CMD" if the user attribute is set. For the hacluster user, this will fail with the error that you showed above because the hacluster user's default shell is /sbin/nologin.

I'm not sure why it fails with user=root or what error it throws. But if you want to run it as root, you don't need to specify user=root.
You can just omit the user attribute.

If that still doesn't work, please share the logs when starting it as root, and perhaps someone can help further.


>
> -----Original Message-----
> From: Reid Wahl <nwahl at redhat.com>
> Sent: 24 November 2022 16:30
> To: S Sathish S <s.s.sathish at ericsson.com>
> Cc: Cluster Labs - All topics related to open-source clustering 
> welcomed <users at clusterlabs.org>
> Subject: Re: [ClusterLabs] ClusterMon SNMP resource agent unable to 
> start
>
> On Thu, Nov 24, 2022 at 12:14 AM S Sathish S <s.s.sathish at ericsson.com> wrote:
> >
> > Hi Reid Wahl/Team,
> >
> > In below command execution we can see crm_mon --help-all output, so we thought some syntax error while invoke Clustermon resource due that SNMP_node1 resource is not started.
> >
> > [root at node1 ~]# pcs resource enable SNMP_node1 --debug
> >
> > Our Query execute above command SNMP_node1 Clustermon resource is not went to started state.
> >
> > Please let me know if any further input required from my end.
>
> Thanks, Sathish.
>
> pcs is running the `crm_mon --help-all` to find out features are 
> supported in the installed version of Pacemaker. That's expected :)
>
> The `pcs resource enable` command doesn't tell a resource to start. It 
> just un-disables the resource if you've previously disabled it. (More 
> precisely, it unsets the target-role meta attribute, which defaults to
> Started.)
> In this case, Pacemaker is not even trying to start the resource. This is because you've configured symmetric-cluster="false". That makes this an "opt-in" cluster instead of an "opt-out" cluster (the default behavior). You can find further explanation here:
> https://protect2.fireeye.com/v1/url?k=31323334-501d5122-313273af-45444
> 5555731-3d6a989d5c120b4c&q=1&e=979d6b69-25c8-4cab-a2a0-b35edd07af81&u=
> https%3A%2F%2Fclusterlabs.org%2Fpacemaker%2Fdoc%2F2.1%2FPacemaker_Expl
> ained%2Fsinglehtml%2F%23asymmetrical-opt-in-clusters
>
> The simplest solution is to set the symmetric-cluster property to true.
>
>     # pcs property set symmetric-cluster=true
>
> If you want to keep symmetric-cluster=false, then you'll need to create location constraints for the resources that you want to enable.
>
> As a side note, I see that there are some dangerous cluster property settings in this cluster as well, which can lead to corruption and/or undefined behavior.
>
>  enable-startup-probes: false
>  no-quorum-policy: ignore
>  startup-fencing: false
>  stonith-enabled: false
>
> Unless you have good reasons for these, I strongly recommend setting:
>
>     # pcs property set enable-startup-probes=true
>     # pcs property set no-quorum-policy=stop
>     # pcs property set startup-fencing=true
>     # pcs property set stonith-enabled=true
>

<snip>

>
>
>
> --
> Regards,
>
> Reid Wahl (He/Him)
> Senior Software Engineer, Red Hat
> RHEL High Availability - Pacemaker



--
Regards,

Reid Wahl (He/Him)
Senior Software Engineer, Red Hat
RHEL High Availability - Pacemaker