
8.4.2
LDAP Server Start-up Issues
When there is an external network connectivity issue, the configured DNS server(s) on the external network
cannot be reached. This results in a DNS lookup timeout (somewhere from 45 seconds to two minutes, possibly
longer) completing an
su -
to a different user. Similar delays are seen logging into login1 (or other login nodes)
from the SMW. For the most part, the place where this DNS lookup seems to take place is in creating a Kerberos
ticket from a keytab in
kinit
. This takes place in the
pam_cray_kinit.so
PAM module. It is possible that
other networking related problems could arise from this situation as well, since we do not know all of the paths
that could result in network timeouts during LDAP start-up. One consequence of this can be that the
slapd
(LDAP) server on login1 will time out trying to start and fail start-up.
Likely Cause
When there is an external network connectivity issue, the configured DNS server(s) on the external network
cannot be reached. This results in a DNS lookup timeout (somewhere from 45 seconds to two minutes, possibly
longer) completing an
su -
to a different user. Similar delays are seen logging into login1 (or other login nodes)
from the SMW. For the most part, the place where this DNS lookup seems to take place is in creating a Kerberos
ticket from a keytab in
kinit
. This takes place in the
pam_cray_kinit.so
PAM module. It is possible that
other networking related problems could arise from this situation as well, since we do not know all of the paths
that could result in network timeouts during LDAP start-up. One consequence of this can be that the
slapd
(LDAP) server on login1 will time out trying to start and fail start-up.
Resolution
To troubleshooting this issue, check and fix the network connectivity from the login node to the external network
over the BR1 network bridge on the login node.
To check network connectivity, the admin needs to check that the BR1 network bridge is up, has an IP address
configured on it, and is bridging the correct Ethernet device for the external network. Also make sure that the
underlying Ethernet device does NOT have an IP address configured on it. Then verify that the physical network
connection is plugged into Login1 in the correct location and that the Ethernet connection is showing a good link
light. If all of this is true, verify that the DNS servers listed in
/etc/resolv.conf
are reachable (usually this can
be done by pinging them, unless they have ICMP replies disabled). Correct all the issues found until the DNS
connectivity to the configured DNS servers is ensured.
If the problem persists with all of this verified to be working, Contact Support for additional guidance.
8.5
Modify the Secret of a Mesos Framework
Prerequisites
This procedure requires root privileges.
About this task
The
urika-mesos-change-secret
command is used to change the secret of Urika-GX service-level Mesos
secrets, such as,
marathon
,
haproxy
, etc. The following list of items, which is subject to change, needs to be
kept under consideration when creating a new secret for a framework:
Troubleshooting
S3016
256