iscsi cluster disaster

[terry712]

2 node isci cluster - the msa cluster in a box
ie 2 hp dl380's - shared scsi storage and then setup as an isci cluster

serviced packed from 6.5 sp3 to 6.5 sp5
in nssmu i can see the device and the partition but nothing else

if i load the ion.ncf and then the tin.ncf

i can see isci library noral and then the context
then a warning from the iscsi target saying

ldap credentials have not been initialised on this server.

and then from the iscsitar - i see

bad taget name "iqn.1984-08.com.novell:iscsi-805e8dbe-b3b0-d811-8b7b-ffffffff.leith.blah"

login command failed

we were getting a bit about the secret dtore which we renamed the file and then try to set in remote manager

we set this up ages ago and use the doc from cool solutions so can remeber any of this ldap settings before

a list devices doesnt should the device

any thoughts

we did backrev support pack but no joy
reapplied to 5 and then updated the isci patches as well
the nds object has default rights and both servers are in it

this was the last server to be sp'd so i suspect that it may not be anything to do with that - it seems ldap related or?

i think at 9am we are going to raise a novell call anyway but if i can try anything - i'm all ears

 

[terry712]

seems ldap related

tried tid 10087815 and 10091093

 

[marvhuffaker]

Is your LDAP configs working for other things? Is Tomcat loading? it won't load if LDAP is broke?

Did your certificates expire causing LDAP to fail? Any other errors related to LDAP you could post?


I've seen this... Server is up for ages.. 2 years or more... Gets rebooted, whatever. Everything fails. The Default Certificates expired (default certificates are configured to expire in 2 years) and now none of the PKI stuff will load including the portal, tomcat, apache, etc.. Just fix the certs with pkidiag and you're back in business.

Marvin Huffaker, MCNE

http://www.redjuju.com

 

[terry712]

redid the cert anyway
pkdiags is clean
portal , tomcat and all that work ok

just not the iscsi
going to call novell in an hour anyway

 

[marvhuffaker]

Terry, what ever happened with this? Did you call Novell?

Marvin Huffaker, MCNE

http://www.redjuju.com

 

[terry712]

yep raise a call
fixed but took a day

it was a cert issue
the ton had been loaded for about 6 months so may have been an issue for a while

had to delete the ldpa objects, and recert server then we could get the ton loaded

 

[marvhuffaker]

So PKIDIAG showed it was clean, but you still have to create new certs?

Marvin Huffaker, MCNE

http://www.redjuju.com

 

[terry712]

yep pkidiag clean as a whistle
all other products worked ok - tomcat all that loaded no probs
if you did a nds export and use secure port and point to cert it failed with an ldap bind. it was like it was getting corrupted some how

the ldap objects needed recreated as well though as the cert wasnt enough

weird but fixed