HP UX System Adstration Configuring cfengine, Using the Configuration Synchronization Wizard

Page 16

synchronization service to groups of remote client systems. Those clients can be standalone systems or Serviceguard clusters. The cluster providing the cfengine service can be a client of itself and also take advantage of cfengine’s configuration synchronization features. A possible but somewhat unusual configuration is to have a fixed member of a Serviceguard cluster act as the master server but no package is configured so cfservd will not be highly available. This configuration is valid but not recommended.

2.3 Configuring cfengine

The following sections provide detailed instructions for setting up a configuration synchronization master server and its clients. The quickest way to get started is to use the Configuration Synchronization Wizard (csync_wizard), described in the next section. Completely manual configurations are also described.

Configuring Synchronization Master (csync master) Server in Cross-Subnet Cluster Environments

In a cluster environment, if all the nodes are within the same subnet, then you can configure a server within that cluster environment as the csync master server.

However, in a cross-subnet cluster environment, the csync master server must be an external system, preferably a quorum server, outside the cross-subnet cluster. A cross-subnet cluster can be configured only as client, with an external system acting as the cfengine master. After you configure an external system as the csync master, you can configure the cross-subnet cluster nodes as cfengine managed clients.

2.3.1 Using the Configuration Synchronization Wizard

The csync_wizard (see csync_wizard(1)) automates the task of setting a configuration synchronization master server and its managed clients. It supports setting up a standalone system or a Serviceguard cluster as the master server. The wizard configures all managed clients to run a cfservd so that cfrun (see cfrun(8)) can be used on the master server.

When you run the csync_wizard on a cross-subnet cluster, the system displays a message indicating that the csync master must be an external system outside the cross-subnet cluster. Depending on whether the csync master is already configured, one of the following is possible:

If the csync master is already configured outside the cross-subnet cluster, the system displays the hostname or the IP address of the csync master.

If the csync master is not configured outside the cross-subnet cluster, then you must configure an external system, preferably a quorum server, as the csync master server and later proceed to run the csync_wizard on the cross-subnet cluster.

With the csync_wizard, you perform the following tasks:

Set up a master server

Add a client

Remove a client

Manage keys for cfengine clients

Display the current configuration

See the appropriate sections below for details. Table 2-1lists the information you will need to gather before running the csync_wizard to set up the master server.

When running the wizard on a Serviceguard cluster, the default is to set up cfengine as a highly available service (Serviceguard package). The administrator must provision the storage environment for the package and the required package IP address and DNS name registration. The wizard supports LVM storage configurations. Non-LVM configurations must be completed manually. The package information that the wizard requires is given in Table 2-1.

16 Configuration Synchronization

Image 16
Contents Distributed Systems Administration Utilities Users Guide Copyright 2009 Hewlett-Packard Development Company, L.P Table of Contents HP-Supported Open Source pdsh Options Index Syslog-ngLog-Forwarding Configuration List of FiguresTarget Node Error Messages Consolidated Logging CommandsList of Tables About this Document Intended AudienceTypographic Conventions Related InformationProduct Support HP Encourages Your Comments Introduction Distributed Systems Administration Utilities Commands Configuration Synchronization CommandConsolidated Logging Commands Command Fanout CommandsUtility Setup Command Open Source cfengine CommandsOpen Source pdsh Commands Open Source ComponentsOpen Source syslog-ng Command Distributed Systems Administration Utilities Manual PagesDsau Manual Page Sections Configuration Synchronization Cfengine OverviewCfengine Daemons and Commands Configuration SynchronizationCfengine Master Server Deployment Models Cfengine OverviewConfiguring cfengine Using the Configuration Synchronization Wizard# /opt/dsau/sbin/csyncwizard Configuration Data for csyncwizardWizard displays the following introductory screen Wizard proceeds to configure the system as a master server # /opt/dsau/sbin/csyncwizard Configuration Synchronization Configuring cfengine Would you like to manage clients? N Cluster Configuration Notes for cfengine Serviceguard Automation FeaturesVar/opt/dsau/cfengine/inputs directory Using the Wizard to Configure a Synchronization Client Opt/dsau/bin/csyncdispatcher Memberadded newhostManual Configuration When prompted, enter the name of the client to addStart by creating the directory Manually Configuring a Standalone Synchronization Server# mkdir -p /var/opt/dsau/cfenginemaster/inputs # /opt/dsau/sbin/cfkey # /var/opt/dsau/cfengine/ppkeys # cp localhost.pub root-10.0.0.5.pub# /sbin/init.d/cfservd start # cfagent --no-lock --verbose --no-splay# cfrun -- --inform # cfrun -v -- --verboseInitial Serviceguard Package Preparation # mkdir -p /csync/dsau/cfenginemaster/masterfilesPolicyhost = csync.abc.xyz.com List Managed Clients in cfrun.hostsEdit the cfservd.conf File # /opt/dsau/sbin/cfkey# ccp /etc/rc.config.d/cfservd /etc/rc.config.d/cfservd # cp localhost.pub root-192.10.25.12.pub# ccp * /var/opt/dsau/cfengine/ppkeys # cexec /sbin/init.d/cfservd startTest the configuration by performing the following steps # ccp csync csync.conf /etc/cmcluster/csyncApply the package and start it # cmapplyconf -P csync.conf # cmmodpkg -e csyncConfiguring a Synchronization Managed Client On a managed client, use the commandSecurity Notes Choosing a Synchronization Invocation MethodKey Exchange Csync Network Port UsageEncryption Encryption Checksum alertsDisabling Use of cfengine Logging OptionsChecksum Alerts # /sbin/init.d/cfservd stopCfengine Troubleshooting Syntax error due to missing or superfluous spaces#cfagent -K Unable to connect to a cfengine client or masterCfagent -d, -d1, -d2, or -d3 cfservd Cfrun Consolidated Logging Introduction to syslogSyslog Message Format 2describes syslog Facilities MessagesMessage Filtering Log Consolidation OverviewImproved Log Consolidation Syslog Co-existence Etc/cmcluster/package-name/package-name.log Log Consolidation Configuration Syslog-ng Log Consolidator ConfigurationConfiguration Data for clogwizard Using the Log Consolidation WizardOpt/dsau/sbin/clogwizard Answer yes y or press Enter. The next question is Where N is the expected number of clientsAnswer yes y. The wizard then prompts If these choices are correct, continue Next prompt is Log files that reside on this cluster can be consolidated Consolidated package logs would be located here Cluster Configuration Notes for clog Minimizing Message Loss During Failover Configuring a Log Forwarding Client Using clogwizard Or press Enter. The next question isEnter the ssh port to be used for port forwarding Manually Configuring Log Consolidation Manually Configuring a Standalone Log Consolidation ServerReplace the %UDPLOOPBACKLOG% token with # /sbin/init.d/syslogd stop # /sbin/init.d/syslogd startFor example, for TCP Create the following symbolic link Change the Clogconfigured line toIf using the TCP protocol, add Add the following linesLog Consolidation Configuration SYSLOGDOPTS=-D -N KEEPALIVE% tokens with appropriate values UDPLOOPBACKSOURCE% and %UDPLOOPBACKLOG% tokens If consolidating package logs of this cluster, add Creating the clog PackageIf using VxVM, comment out the LVM Volume Group line Distribute it cluster-wide Testing and Starting the clog PackageThen use cmviewcl to make sure it is running Using VxVM Instead of LVM Manually Configuring Log Forwarding ClientsManually Configuring a Standalone Log Forwarding Client Ln -sf /etc/syslog-ng.conf.client /etc/syslog-ng.conf # /sbin/init.d/syslog-ng start # cpp /etc/rc.config.d/syslogd /etc/rc.config.d Destination dsyslog%TYPE% %TYPE%%IP%port%PORT% If using the TCP protocol, add the following lines If using ssh port forwarding, addOtherwise, if using the UDP protocol, add Create the following symbolic link on each cluster memberStart syslog-ngon all cluster members using Forwarding Ascii Log DataFor the destination line For the filter lineConsolidating Package Logs on the Log Consolidation Server For the log linePerform the following steps to disable log consolidation Disabling Log ConsolidationDisabling a Standalone Log Consolidation System #/sbin/init.d/syslogd stopDisabling a Serviceguard Cluster Log Consolidation System Disabling a Standalone Log Forwarding Client#/sbin/init.d/syslogd start # /sbin/init.d/syslog-ng stopDisabling a Serviceguard Cluster Log Forwarding Client #/sbin/init.d/syslogd stop #/sbin/init.d/syslogd startLog File Protections Securing Consolidated LogsSsh Port Forwarding Clog Network Port Usage Using Bastille to Harden the System# cd /opt/ssh/etc # ccp sshhost* /opt/ssh/etc Using the System and Consolidated Log Viewer Viewing System and Consolidated LogsStarting System Management Homepage To log in to the System Management Homepage, navigate toViewing System and Consolidated Logs Page Command Fanout Parallel Distributed ShellPdsh Utility Wrappers All nodesSystems Cwall displays a wall1M broadcast message on multiple hostsSecurity Configuration Remote Shell Security SetupSsh Security Setup # csshsetup -r -f memberslist.txtCommand Fanout Troubleshooting Ssh Command MessagesRsh Command Messages Target Node Error MessagesHP-Supported Open Source pdsh Options Page Index CfanouthostsLVM UDP