tomcat and ldap users

When those users doesn't exist on the server, on the CE you will see errors like the following

2012-04-24 15:37:29 lcg-info-dynamic-scheduler: LRMS backend command returned nonzero exit status
2012-04-24 15:37:29 lcg-info-dynamic-scheduler: Exiting without output, GIP will use static values
Can not obtain pbs version from host
[...]

instead, on the torque server:

04/24/2012 14:00:46;0080;PBS_Server;Req;req_reject;Reject reply code=15021(Invalid credential), aux=0, type=StatusJob, from tomcat@cream-01.cnaf.infn.it
04/24/2012 14:01:02;0080;PBS_Server;Req;req_reject;Reject reply code=15021(Invalid credential), aux=0, type=StatusJob, from ldap@cream-01.cnaf.infn.it

Solution is to add tomcat and ldap users/groups to torque host and restart pbs_server - as they exists only on CreamCE host.

# echo 'tomcat:x:91:91:Tomcat:/usr/share/tomcat5:/bin/sh' >> /etc/passwd
# echo 'ldap:x:55:55:LDAP User:/var/lib/ldap:/bin/false' >> /etc/passwd
# echo 'tomcat:x:91:' >> /etc/group
# echo 'ldap:x:55:' >> /etc/group

Service configuration

VOS="comput-er.it dteam igi.italiangrid.it infngrid ops gridit" QUEUES="cert prod" CERT_GROUP_ENABLE="dteam infngrid ops /dteam/ROLE=lcgadmin /dteam/ROLE=production /ops/ROLE=lcgadmin /ops/ROLE=pilot /infngrid/ROLE=SoftwareManager /infngrid/ROLE=pilot" PROD_GROUP_ENABLE="comput-er.it gridit igi.italiangrid.it /comput-er.it/ROLE=SoftwareManager /gridit/ROLE=SoftwareManager /igi.italiangrid.it/ROLE=SoftwareManager"

WN_LIST="/root/siteinfo/wn-list.conf" MUNGE_KEY_FILE=/etc/munge/munge.key CONFIG_MAUI="no"

WN list

# less /root/siteinfo/wn-list.conf
wn05.cnaf.infn.it
wn06.cnaf.infn.it

TORQUE checks

• check the pbs settings:

• check the WNs state

# pbsnodes -a

maui settings

• In order to reserve a job slot for test jobs, you need to apply some settings in the maui configuration (/var/spool/maui/maui.cfg). Suppose you have enabled the test VOs (ops, dteam and infngrid) on the "cert" queue and that you have 8 job slots available. Add the following lines in the maui.cfg files:

• In order to avoid that yaim overwrites this file during the host reconfiguration, set:

CONFIG_MAUI="no" 

vo.d

https://forge.cnaf.infn.it/plugins/scmsvn/viewcvs.php/branches/BRANCH-4_0_X/ig-yaim/examples/siteinfo/vo.d/?root=igrelease

users and groups

https://forge.cnaf.infn.it/plugins/scmsvn/viewcvs.php/branches/BRANCH-4_0_X/ig-yaim/examples/?rev=6231&root=igrelease#dirlist

munge configuration

• generate a key by launching /usr/sbin/create-munge-key

# ls -ltr /etc/munge/
total 4
-r-------- 1 munge munge 1024 Jan 13 14:32 munge.key

• Copy the key, /etc/munge/munge.key to every host of your cluster, adjusting the permissions:

# chown munge:munge /etc/munge/munge.key

• Start the munge daemon on each node:

# service munge start
Starting MUNGE:                                            [  OK  ]

# chkconfig munge on

Notes about Installation and Configuration of a Torque server (no cream) - EMI-2 - SL6 x86_64

• These notes are provided by site admins on a best effort base as a contribution to the IGI communities and MUST not be considered as a subsitute of the Official IGI documentation.
• This document is addressed to site administrators responsible for middleware installation and configuration.
• The goal of this page is to provide some hints and examples on how to install and configure an EMI torque server based on EMI-2 middleware.

References

1. About IGI - Italian Grid infrastructure
2. About IGI Release
3. EMI-2 Release
4. Yaim Guide
5. TOBE CHANGED - site-info.def yaim variables
6. TOBE CHANGED - site-BDII yaim variables
7. Troubleshooting Guide for Operational Errors on EGI Sites
8. Grid Administration FAQs page

Service installation

O.S. and Repos

• Starts from a fresh installation of Scientific Linux 6.x (x86_64).

# cat /etc/redhat-release 
Scientific Linux release 6.2 (Carbon)

* Install the additional repositories: EPEL, Certification Authority, EMI-2

# yum install yum-priorities yum-protectbase epel-release
# rpm -ivh http://emisoft.web.cern.ch/emisoft/dist/EMI/2/sl6/x86_64/base/emi-release-2.0.0-1.sl6.noarch.rpm

# cd /etc/yum.repos.d/
# wget http://repo-pd.italiangrid.it/mrepo/repos/egi-trustanchors.repo

• Be sure that SELINUX is disabled (or permissive). Details on how to disable SELINUX are here:

# getenforce 
Disabled

yum install

# yum clean all
Loaded plugins: downloadonly, kernel-module, priorities, protect-packages, protectbase, security, verify, versionlock
Cleaning up Everything

# yum install ca-policy-egi-core
# yum install emi-torque-server emi-torque-utils 

Service configuration TOBECHANGED FROM HERE

# cp -r /opt/glite/yaim/examples/siteinfo/* .

site-info.def

################################
# BDII configuration variables #
################################

# Hostname of the site BDII
SITE_BDII_HOST=bdii-01.$MY_DOMAIN

################################
# Site configuration variables #
################################

# Human-readable name of your site
SITE_NAME=IGI-BOLOGNA

# The contact e-mail of your site.
# A coma separated list of email addresses. 
SITE_EMAIL="grid-operations@lists.cnaf.infn.it"

# It is the position of your site north or south of the equator 
# measured from -90. to 90. with positive values going north and 
# negative values going south. 
SITE_LAT=44.4948

# It is the position of the site east or west of Greenwich, England 
# measured from -180. to 180. with positive values going east and 
# negative values going west.  
SITE_LONG=11.3417

services/glite-bdii_site

# cat siteinfo/services/glite-bdii_site 
################################
# Site-wide settings

SITE_DESC="IGI resource center in Bologna"
SITE_SUPPORT_EMAIL="grid-operations@lists.cnaf.infn.it"
SITE_SECURITY_EMAIL="grid-sec@cnaf.infn.it"
SITE_LOC="Bologna, Italy"
SITE_WEB="http://igi.cnaf.infn.it"

SITE_OTHER_GRID="EGI"
SITE_OTHER_EGI_NGI="NGI_IT"

# Available values: [prod|pps|cert]
SITE_OTHER_EGEE_SERVICE="prod"

# List of hosts where there are services that want to publish into the BDII
#BDII_REGIONS="host-id-1 [host-id-2 [...]]"    
BDII_REGIONS="MONIT TOPBDII SBDII CREAM01 CREAM02 STORM LFC PX VOMS VOMS2 VOMSMANIA WMSMULTI WMSCMS"

# The following example is valid for hosts using BDII. 
# If your host is using MDS instead (all 3.0 nodes)
# change the port to 2135 and mds-vo-name=local
#BDII_host-id-1_URL="ldap://host-id-1-hostname:2170/mds-vo-name=resource,o=grid"
BDII_MONIT_URL="ldap://mon-it.cnaf.infn.it:2170/mds-vo-name=resource,o=grid"
BDII_TOPBDII_URL="ldap://egee-bdii.cnaf.infn.it:2170/mds-vo-name=resource,o=grid"
BDII_SBDII_URL="ldap://bdii.grid.cnaf.infn.it:2170/mds-vo-name=resource,o=grid"
BDII_CREAM01_URL="ldap://cream-01.cnaf.infn.it:2170/mds-vo-name=resource,o=grid"
BDII_CREAM02_URL="ldap://cream-02.cnaf.infn.it:2170/mds-vo-name=resource,o=grid"
BDII_STORM_URL="ldap://darkstorm.cnaf.infn.it:2170/mds-vo-name=resource,o=grid"
BDII_PX_URL="ldap://$PX_HOST:2170/mds-vo-name=resource,o=grid"
BDII_VOMS_URL="ldap://voms.cnaf.infn.it:2170/mds-vo-name=resource,o=grid"
BDII_VOMS2_URL="ldap://voms2.cnaf.infn.it:2170/mds-vo-name=resource,o=grid"
BDII_VOMSMANIA_URL="ldap://vomsmania.cnaf.infn.it:2170/mds-vo-name=resource,o=grid"
BDII_LFC_URL="ldap://lfcserver.cnaf.infn.it:2170/mds-vo-name=resource,o=grid"
BDII_LFC2_URL="ldap://lfcitaliangrid.it:2170/mds-vo-name=resource,o=grid"
BDII_WMSMULTI_URL="ldap://wms-multi.grid.cnaf.infn.it:2170/mds-vo-name=resource,o=grid"
BDII_WMSCMS_URL="ldap://wms-cms-analisys..grid.cnaf.infn.it:2170/mds-vo-name=resource,o=grid"

yaim check

# chmod -R 600 /root/siteinfo

#  /opt/glite/yaim/bin/yaim -v -s siteinfo/site-info.def -n BDII_site
   INFO: Configuring HOST: bdii-01.cnaf.infn.it
   INFO: Using site configuration file: siteinfo/site-info.def
   INFO: Sourcing service specific configuration file: siteinfo/services/glite-bdii_site
   INFO: 
         ###################################################################
         
         .             /'.-. ')
         .     yA,-"-,( ,m,:/ )   .oo.     oo    o      ooo  o.     .oo
         .    /      .-Y a  a Y-.     8. .8'    8'8.     8    8b   d'8
         .   /           ~ ~ /         8'    .8oo88.     8    8  8'  8
         . (_/         '===='          8    .8'     8.   8    8  Y   8
         .   Y,-''-,Yy,-.,/           o8o  o8o    o88o  o8o  o8o    o8o
         .    I_))_) I_))_)
         
         
         current working directory: /root
         site-info.def date: May 24 14:38 siteinfo/site-info.def
         yaim command: -v -s siteinfo/site-info.def -n BDII_site
         log file: /opt/glite/yaim/bin/../log/yaimlog
         Thu May 24 15:19:45 CEST 2012 : /opt/glite/yaim/bin/yaim
         
         Installed YAIM versions:
         glite-yaim-bdii 4.3.9-1
         glite-yaim-core 5.1.0-1
         
         ####################################################################
   INFO: The default location of the grid-env.(c)sh files will be: /usr/libexec
   INFO: Sourcing the utilities in /opt/glite/yaim/functions/utils
   INFO: Detecting environment
   INFO: Executing function: config_gip_site_check 
   INFO: Executing function: config_gip_bdii_site_check 
   INFO: Executing function: config_info_service_bdii_site_check 
   INFO: Executing function: config_bdii_5.2_check 
   INFO: Checking is done.
   INFO: All the necessary variables to configure BDII_site are defined in your configuration files.
   INFO: Please, bear in mind that YAIM only guarantees the definition of variables
   INFO: controlled in the _check functions.
   INFO: YAIM terminated succesfully.

yaim config

# /opt/glite/yaim/bin/yaim -c -s site-info_bdii-01.def -n BDII_site
   INFO: Using site configuration file: site-info_bdii-01.def
   [...]
   INFO: YAIM terminated succesfully.

Service Checks

BDII checks

• check the information published by launching simple ldap queries

ldapsearch -x -LLL -H ldap://bdii-01.cnaf.infn.it:2170 -b mds-vo-name=resource,o=grid 'objectClass=GlueSite'
dn: GlueSiteUniqueID=IGI-BOLOGNA,Mds-Vo-name=resource,o=grid
GlueSiteDescription: IGI resource center in Bologna
GlueSiteSecurityContact: mailto:grid-sec@cnaf.infn.it
GlueSiteSponsor: none
objectClass: GlueTop
objectClass: GlueSite
objectClass: GlueKey
objectClass: GlueSchemaVersion
GlueSiteSysAdminContact: mailto:grid-operations@lists.cnaf.infn.it
GlueSiteName: IGI-BOLOGNA
GlueSiteUniqueID: IGI-BOLOGNA
GlueSchemaVersionMinor: 3
GlueSiteLongitude: 11.3417
GlueSiteLatitude: 44.4948
GlueSchemaVersionMajor: 1
GlueSiteOtherInfo: CONFIG=yaim
GlueSiteOtherInfo: EGEE_SERVICE=prod
GlueSiteOtherInfo: EGI_NGI=NGI_IT
GlueSiteOtherInfo: GRID=EGI
GlueSiteUserSupportContact: mailto:grid-operations@lists.cnaf.infn.it
GlueSiteWeb: http://igi.cnaf.infn.it
GlueSiteEmailContact: mailto:grid-operations@lists.cnaf.infn.it
GlueSiteLocation: Bologna, Italy

• check that all the services are published

$ ldapsearch -x -LLL -H ldap://bdii-01.cnaf.infn.it:2170 -b mds-vo-name=IGI-BOLOGNA,o=grid 'objectClass=GlueService' GlueServiceUniqueID
[...]

Revisions

-- PaoloVeronesi - 2012-05-24

-- PaoloVeronesi - 2012-05-25