Tags:
,
view all tags
---+!! Troubleshooting guide for CREAM %TOC% ---# Checks to be done after installation and configuration ---## Check via browser Open your browser (where a valid certificate must be installed) to =https://hostname-of-cream-ce:8443/ce-cream/services= A page with link to the CREAM WSDL should be shown ---## Check the CREAM log file Check in the CREAM log file ( =/var/log/cream/glite-ce-cream.log=) for the following strings: <verbatim> CREAM started! (BLParserClient) Connection with BLParser (xxx) correctly established </verbatim> (Replace xxx with the name of your management system: lsf or pbs) If they are not there, it means that CREAM has not started properly ---## Test glexec * Log on the CREAM CE * =su tomcat -= * Consider a user proxy (e.g. =/tmp/user.proxy=) for a user authorized to use that CREAM CE. This proxy file must belong to =tomcat.tomcat= * Issue the following: <verbatim> export GLEXEC_MODE="lcmaps_get_account" export GLEXEC_CLIENT_CERT=/tmp/user.proxy /usr/sbin/glexec /usr/bin/id </verbatim> This should return the id of the local user mapped to that Grid user. Please note that this test makes sense only when the CREAM CE is configured to NOT use Argus. When the CREAM CE is instead configured to use Argus, glexec is not used at all in the CREAM CE node. ---## Test gridftp Try a gsiftp (e.g. =using globus-url-copy= or =uberftp=) towards that CREAM CE. E.g.: <verbatim> uberftp hostname-of-cream-ce> "ls /etc" </verbatim> ---## Check if submissions are enabled Try the following command from a UI: <verbatim> glite-ce-allowed-submission <<hostname-of-cream-ce>>:8443 </verbatim> It should return: <verbatim> Job Submission to this CREAM CE is enabled </verbatim> ---## Try a direct submission Try a submission to that CE using the =glite-ce-job-submit command=, e.g.: <verbatim> $ /bin/cat test.jdl [ executable="/bin/sleep"; arguments="1"; ] $ glite-ce-job-submit -a -r alice16.spbu.ru:8443/cream-pbs-dteam test.jdl https://alice16.spbu.ru:8443/CREAM336256203 </verbatim> Check the status of that job, which eventually should be DONE-OK: <verbatim> $ glite-ce-job-status https://alice16.spbu.ru:8443/CREAM336256203 ****** JobID=[https://alice16.spbu.ru:8443/CREAM336256203] Status = [DONE-OK] ExitCode = [0] </verbatim> ---## Try a job cancellation Try a submission to that CE using the =glite-ce-job-submit= command, and then try to cancel it (using the =glite-ce-job-cancel= command). <verbatim> $ /bin/cat test.jdl [ executable="/bin/sleep"; arguments="1000"; ] $ glite-ce-job-submit -a -r alice16.spbu.ru:8443/cream-pbs-dteam test.jdl https://alice16.spbu.ru:8443/CREAM510970530 $ glite-ce-job-cancel https://alice16.spbu.ru:8443/CREAM510970530 </verbatim> Check the status of that job, which eventually should be =CANCELLED=: <verbatim> $ glite-ce-job-status https://alice16.spbu.ru:8443/CREAM510970530 ****** JobID=[https://alice16.spbu.ru:8443/CREAM510970530 Status = [CANCELLED] ExitCode = [] Description = [Cancelled by user] </verbatim> ---## Try a submission through the WMS Try a submission to that CE through the WMS, i.e. using the =glite-wms-job-submit= command ---# Log files In case of problems first of all check the log files. See http://wiki.italiangrid.org/twiki/bin/view/CREAM/ServiceReferenceCard#Logfile_locations_and_management for relevant information ---# Error messages ---## Batch system xxx not supported Example: <verbatim> $ glite-ce-job-submit -a -r cert-26.pd.infn.it:8443/cream-pbs-cream oo.jdl 2008-01-15 13:46:18,167 FATAL - MethodName=[jobRegister] Timestamp=[Tue 15 Jan 2008 13:46:18] ErrorCode=[0] Description=[system error] FaultCause=[Batch System pbs not supported!] </verbatim> This means that: * the batch system specified in the used CREAM CE id is not supported by that CREAM CE (this can be also because a wrong setting of the =JOB_MANAGER= variable, e.g. =lcgpbs= instead of =pbs=) or * when CREAM has been started, its BLParser was not running. In this case a error message is printed in the CREAM log file =/var/log/cream/glite-ce-cream.log*=) describing the problem. This message is something like: <verbatim> org.glite.ce.cream.jobmanagement.cmdexecutor.blah.BLParserClient - initializeConnection: getting info about BLParser (xxx) from BLAH (retry count=yy/zz) ... org.glite.ce.cream.jobmanagement.cmdexecutor.blah.BLParserClient - initializeConnection error: cannot get BLParser (lsf) HOST:PORT information from BLAH. Please, be sure that BLAH is properly configured and RESTART the CREAM service. </verbatim> As batch system it is meant the value specified as =JOB_MANAGER= in the =siteinfo.def=. Please note that valid values are lsf, pbs and condor (and not lcgpbs, lcglsf, lcgcondor). This value is reported in the =/etc/blah.config file= (attribute =supported_lrms=). Suppose that you have lsf as this value. As user tomcat from the CE node try the following: <verbatim> $ /usr/bin/blahpd $GahpVersion: 1.14.0 Mar 31 2008 INFN\ blahpd\ (poly,new_esc_format) $ BLAH_GET_HOSTPORT lsf </verbatim> This should return: <verbatim> S </verbatim> Then type: <verbatim> results </verbatim> It should return something like <verbatim> lsf 0 lsf/cream-35.pd.infn.it:56565 </verbatim> If this is the case (i.e. you are getting a value such as this one) your problem is likely the second one (i.e. the blparser was not running when tomcat was started). For LSF, check also in the =/etc/blah.config= if the path of =lsf.profile= is correct. ---## The job cannot be submitted because the blparser service is not alive Check if the BLAH blparser is running. If it is supposed to run but it is not running, check in its log file(s) ( =/var/log/cream/glite-xxxparser.log= for the old parser, =/var/log/cream/glite-ce-bnotifier.log= and =/var/log/cream/glite-ce-bupdater.log= for the new one) if something interesting is reported. In case (re)start it ( =/etc/init.d/glite-ce-blparser restart= for the old one, =/etc/init.d/glite-ce-blahparser restart= for the new one) and then restart tomcat ( =service tomcat5 restart=) In case your blparser node servers multiple CREAM CEs, please be sure to have followed the instructions reported at http://wiki.italiangrid.org/twiki/bin/view/CREAM/SystemAdministratorGuideForEMI1#1_4_5_1_Configuration_of_the_old ---## Delegation error: the proxy delegationID "xx" is not more valid! Example: <verbatim> $ glite-ce-job-submit -D de2 -r cream-02.pd.infn.it:8443/cream-lsf-cream prren1.jdl 2008-01-28 11:27:04,859 FATAL - MethodName=[jobRegister] Timestamp=[Mon 28 Jan 2008 11:27:04] ErrorCode=[0] Description=[delegation error: the proxy delegationID "de2" is not more valid!;] FaultCause=[delegation proxy expired!] </verbatim> This means that the used delegationID was found on the target CREAM CE, but it is not more valid (i.e. the proxy expired) ---## job id list file error: File [xxx] is not a CREAM job list file Example: <verbatim> $ glite-ce-job-status -i job_ids 2008-04-24 09:59:54,963 FATAL - File [job_ids] is not a CREAM job list file. Stop. </verbatim> This means the [job_ids] file passed in the command line has not the right format Here's an example of a file in the right format: <verbatim> $ cat job_ids ##CREAMJOBS## https://devel03.cnaf.infn.it:8443/CREAM683051516 https://devel03.cnaf.infn.it:8443/CREAM481684356 https://devel03.cnaf.infn.it:8443/CREAM333841302 https://devel03.cnaf.infn.it:8443/CREAM279829555 https://devel03.cnaf.infn.it:8443/CREAM334653961 </verbatim> ---## bad UID for job execution If your job fails with an error such as: <verbatim> ****** JobID=[https://ppsce03.pic.es:8443/CREAM880596078] Status = [ABORTED] ExitCode = [] FailureReason = [BLAH error: submission command failed (exit code = 1) (stdout:) (stderr:qsub: Bad UID for job execution MSG=ruserok failed validating dteam017/dteam017 from ppsce03.pic.es-) N/A (jobId = CREAM880596078)] </verbatim> notesthat the torque_server node has to contain the submission hosts (the CREAM CEs) in its =/etc/hosts.equiv=. Or in recent versions of torque consider the =acl_hosts= and =acl_hosts_enable= attributes in the Torque server configuration (see http://www.clusterresources.com/torquedocs21/a.bserverparameters.shtml#open) ---## org.glite.security.delegation.storage.GrDPStorageException Example: <verbatim> 2009-09-10 15:48:16,082 ERROR - Received NULL fault; the error is due to another cause: FaultString=[org.glite.security.delegation.storage.GrDPStorageException: Configuration error: delegation_factorynull] - FaultCode=[SOAP-ENV:Server.userException] - FaultSubCode=[SOAP-ENV:Server.userException] - FaultDetail=[<ns1:hostname>vtb-generic-64.cern.ch</ns1:hostname>] </verbatim> This is likely a problem with the mysql DB (e.g. mysql not accessible, problems with grants, etc.) ---## sudo: 0 incorrect password attempts This means that there is an error in the =sudoers= file (e.g. the mapped user is not "enabled") created by yaim-cream-ce). So this is very likely a configuration problem. ---## Authorization error: Failed to get the local user id via glexec This usually means an error while running glexec to get the local userid Check therefore the glexec log files (syslog or the log files defined in =/etc/glexec.conf=). You might also need to increase (setting to 5) the glexec/lcas/lcmaps debug levels in =/etc/glexec.conf=. ---## Cannot find grid-proxy-info This means that the job wrapper running on the WN could not find the =grid-proxy-info= executable. This could be due to several reasons.The most common ones are: * the =grid-proxy-info executable= is not installed on the WN * the =grid-proxy-info executable= is not found (e.g. because it not in the path of the local account executing the job) on the WN * the =which= executable is not installed on the WN ---## Problem to detect the lifetime of the proxy This means that the job wrapper running on the WN could not detect the lifetime of the proxy (using the =grid-proxy-info= command). This could be due to several reasons.The most common ones are: * the proxy for some reason was not staged on the WN * the =grid-proxy-info= executable was not found (or it was not in the path) on the WN * the =which= executable is not installed on the WN ---## Cannot create the job's working directory! [failure reason = ">>> sudoers file: Alias `XYZ' already defined, line ABC <<<"] This means that there is a syntax error in the sudoers file created by yaim-cream-ce. A likely reason if that the same VO as been enabled more than once in the siteinfo.def. ---## Transfer to CREAM failed due to exception: CREAM Register raised std::exception The endpoint is blacklisted This problem can happen when submitting to CREAM through the WMS. This means that the CE was blacklisted by that WMS (in particular by the ICE component) because the connection to this CE from that WMS went in timeout (default value for timeout: 60 secs) for 3 times. The ICE blacklisting of a CREAM CE lasts for 30 minutes. In this period submissions to that CREAM CE by that WMS/ICE are not attempted and fail with this error message. ---## Cannot create the job's working directory! failure reason = "sudo: no tty present and no askpass program specified" The problem happens if there are some problems with the sudoers file, which is created by yaim ---## User ABC not authorized for operation XYZ This means that there was an authorization problem. If the authorization is managed via gJAF, check first of all if the relevant VOMS role has been enabled in the grid-mapfile. Then check if you have all the relevant =.lsc= files in =/etc/grid-security/vomsdir/<VO>= (there must be a file for each "supported" VOMS server for that VO) and if they are correct (please note that the VOMS server certificate in =/etc/grid-security/vomsdir= is not needed anymore and it is used only if the relevant lsc file is not foun)d. If this was not enough, edit =/etc/glite-ce-cream/log4j.properties= replacing: <verbatim> log4j.logger.org.glite=info, fileout </verbatim> with: <verbatim> log4j.logger.org.glite=debug, fileout </verbatim> and comment the following lines: <verbatim> log4j.logger.org.glite.security=off log4j.logger.org.glite.voms=off </verbatim> Then restart tomcat In =glite-ce-cream.log= the reason for the authorization problem should be explained ---## Authorization layer is not configured This error on the client side may be caused by many different errors arising during the startup of the CREAM service. This is a list of possible reasons: * Argus PEP client doesn't support PKCS#8 format for the private key; this can be verified if the CREAM log appears the message <verbatim> No KeyPair object found in file /etc/grid-security/tomcat-key.pem </verbatim>.It is necessary to convert the format of the key to the old one (PKCS#1) with the following commands: <verbatim> openssl rsa -in /etc/grid-security/hostkey.pem -out /etc/grid-security/hostkey.pem.new mv /etc/grid-security/hostkey.pem.new /etc/grid-security/hostkey.pem chmod 400 /etc/grid-security/hostkey.pem </verbatim> and run the YAIM configurator. ---## Failed to create a delegation id for job <jobid>: reason is User <userDN> not authorized for operation <operation> See what reported [[http://wiki.italiangrid.org/twiki/bin/view/CREAM/TroubleshootingGuide#3_14_User_ABC_not_authorized_for][here]] ---## Cannot generate the job wrapper! the problem seems to be related to the jdl: Number mismatch for maxOutputSandboxSize = -1,000000000000000E+00" This happens for submissions through the WMS to a CREAM CE deployed on a machine installed using a non-English ( =en-US=) language. This is because of different representations of decimal numbers. The workaround in this case is to uncomment the line: <verbatim> LANG=en_US </verbatim> in =$CATALINA_HOME/conf/tomcat5.conf= and then restart tomcat ---## Missing property local.user.id On a CREAM-CE using Argus this means that ARGUS was not able to provide the mapping, or CREAM was not able to process it. To check if the mapping is correctly done in Argus, look for a line like this in the Arugs PEP Server =/var/log/argus/pepd/process.log=: <verbatim> 2011-10-10 08:42:44.209Z - INFO [DFPMObligationHandler] - ACCOUNTMAP_OH: DN: CN=Valery Tschopp 9FEE5EE3,O=SWITCH,DC=slcs,DC=switch,DC=ch pFQAN: /dteam FQANs: [/dteam] mapped to POSIX account: PosixAccount{user=dteam024 group=dteam} </verbatim> You might need to set the debug mode on for the obligation handler, editing =/etc/argus/pepd/logging.xml= adding the lines: <verbatim> <logger name="org.glite.authz.pep.obligation.dfpmap"> <level value="DEBUG" /> </logger> </verbatim> You can then restart the PEP server, but normally the logging configuration is automatically reload every 5 minutes. ---## InnoDB: ERROR: the age of the last checkpoint is ... If the following error occurs (see the mysql log file: /var/log/mysqld.log) --- <verbatim> InnoDB: ERROR: the age of the last checkpoint is , InnoDB: which exceeds the log group capacity . InnoDB: If you are using big BLOB or TEXT rows,you must set the InnoDB: combined size of log files at least 10 times bigger than the InnoDB: largest such row. </verbatim> then you must resize the innodb log files. see: http://wiki.italiangrid.org/twiki/bin/view/CREAM/SystemAdministratorGuideForEMI1#3_3_MySQL_database_How_to_resize ---## InnoDB: Problem with the log file sizes. If the following error occurs (see the mysql log file: /var/log/mysqld.log): <verbatim> InnoDB: The log sequence number in ibdata files does not match InnoDB: the log sequence number in the ib_logfiles! </verbatim> or a similar one: <verbatim> InnoDB: Error: log file ./ib_logfile0 is of different size 0 5242880 bytes InnoDB: than specified in the .cnf file 0 67108864 bytes! </verbatim> then the "innodb_log_file_size" property has been changed without moving the log files ib_log* to some place out of the the directory where the log files reside. Follow these steps (see http://wiki.italiangrid.org/twiki/bin/view/CREAM/SystemAdministratorGuideForEMI1#3_3_MySQL_database_How_to_resize): * Stop the server. <verbatim>service mysqld stop</verbatim> * Move the log file sizes ib_log* to some place out of the the directory where the log files reside. Example: <verbatim>mv /var/lib/mysql/ib_logfile* /tmp</verbatim> * Start the server. <verbatim>service mysqld start</verbatim> * Check for errors in /var/log/mysqld.log file * Verify the correct size of the log files <verbatim>ls -lrth /var/lib/mysql/ib_logfile*</verbatim> ---## copyNewProxyToSandbox error: sudo: no tty present and no askpass program specified This means that the sudo operation (which is used to copy the proxy to a user specific directory) failed, very likely because of an an error in the sudoers file (e.g. the relevant users are not authorized). This file is supposed to be filled by yaim. ---# Other problems ---## Dynamic information not published in the BDII If dynamic information is not published in the resource BDII of the CREAM-CE and e.g. =lcg-infosites= reports 444444 as number of waiting jobs, on the CREAM CE tries to manually run the infoprovider script: <verbatim> /sbin/runuser -s /bin/sh ldap -c "/var/lib/bdii/gip/plugin/glite-info-dynamic-ce" </verbatim> and check if some errors are returned. If the information is correctly returned, check the BDII logs if some errors are reported. ---## High load caused by bupdater process This can be because of a too high polling frequency when checking the status of the jobs. Follow [[http://wiki.italiangrid.org/twiki/bin/view/CREAM/SystemAdministratorGuideForEMI1#1_4_7_2_Tune_the_BLAH_BUpdater_p][this link]] for more information. ---## Job failure with reason=999 This can happen with the new BLAH BLparser when it is not able to detect the status of the job for more than =x= seconds. The default value for =x= is 86400. This value can be modified setting the attribute alldone_interval in =/etc/blah.config=, e.g.: <verbatim> alldone_interval=100000 </verbatim> It is then necessary to restart the BLAH blparser: <verbatim> /etc/init.d/glite-ce-blahparser restart </verbatim> ---## Jobs are successfully submitted to Torque, but they stay in W status Torque will put a job in 'W' when it cannot stage the job's input files. Check if grid accounts on your WNs can "scp" without password to the CE and/or the Torque server host. ---## Jobs submitted to LSF fails with errorcode 127 This is likely a problem with staging of files from/to the CE node to/from the WN. Check if the relevant LSF daemons run properly. ---## Jobs submitted to Torque are stuck in W status The 'W' status means "waiting on stagein": that should never happen for grid jobs and signals a misconfiguration of the CE or the batch system. The most likely cause is explained [[https://wiki.egi.eu/wiki/Tools/Manuals/TS60][here]] ---# Other troubleshooting hints ---## Saving the batch job submission script If, for debugging purposes, it is necessary to save the script used by the BLAH component of CREAM to submit the job to the batch system, edit the files =blah_common_submit_functions.sh= and =xxx_submit.sh= (e.g. =pbs_submit.sh=) and comment all the occurrences of: <verbatim> rm -f $bls_tmp_file </verbatim> These scripts are in =/usr/bin= in EMI-1, in =usr/libexec= starting with EMI-2 ---## Saving files on the worker node after job execution For debugging purposes, it is possible to save the stdout, stderr and proxy files on the Worker Node after job execution. This is done setting =blah_debug_save_wn_files= in =/etc/blah.config= on the CREAM CE node to an existing directory (on the WN) where the user running the job has the proper rights for writing. A directory called =XXX.debug= will be created within the specified directory. ---## Check the queue of command/notifications still to be processed If you want to check the queue of commands and notifications still to be processed, the mysql query command to be issued is: * For EMI-1: <verbatim> use creamdb; select count(*), name from command group by name; </verbatim> * For EMI-2: <verbatim> use creamdb; select count(*), name from command_queue group by name; </verbatim> If the CREAM CE is behaving properly, such queue should be always reasonable short. ---## Remove a delegationid If for some reason you need to remove a delegation from the CREAM DB, use the following mysql commands: <verbatim> use delegationdb; delete from t_credential where dlg_id="pippo" and local_user = "pluto"; </verbatim> Of course replace =pippo= and =pluto= with the proper strings. For submissions through the WMS, if a certain delegationid is removed, the ICE component of the WMS will detect it and will create a new delegation. -- Main.MassimoSgaravatto - 2011-04-27
Edit
|
Attach
|
PDF
|
H
istory
:
r28
|
r25
<
r24
<
r23
<
r22
|
B
acklinks
|
V
iew topic
|
More topic actions...
Topic revision: r23 - 2012-07-12
-
PaoloAndreetto
Home
Site map
CEMon web
CREAM web
Cloud web
Cyclops web
DGAS web
EgeeJra1It web
Gows web
GridOversight web
IGIPortal web
IGIRelease web
MPI web
Main web
MarcheCloud web
MarcheCloudPilotaCNAF web
Middleware web
Operations web
Sandbox web
Security web
SiteAdminCorner web
TWiki web
Training web
UserSupport web
VOMS web
WMS web
WMSMonitor web
WeNMR web
General Doc
Functional Description
Batch System Support
CREAM and Information Service
Release Notes
Known Issues
Security in CREAM
Nagios Probes to monitor CREAM and WN
Papers
Presentations
User Doc
CREAM User Guide for EMI-1
CREAM User Guide for EMI-2
CREAM User Guide for EMI-3
CREAM JDL Guide
BLAH User Guide
Troubleshooting Guide
System Administrator Doc
System Administrator Guide for CREAM (EMI-3 release)
System Administrator Guide for CREAM (EMI-2 release)
System Administrator Guide for CREAM (EMI-1 release)
The CREAM configuration file
The CEMonitor configuration file
The CREAM CE Service Reference Card (EMI-2 release)
The CREAM CE Service Reference Card (EMI-1 release)
Batch System related documentation
Troubleshooting Guide
The guide for integrating EMIR in CREAM
]
Developers Doc
CREAM Client API C++ Documentation
CREAM Client API for Python
Other Doc
Contacts
Moving to CREAM from LCG-CE
Testing
Internal Collaboration Information
Credits
CREAM Web utilities
Create New Topic
Index
Search
Changes
Notifications
RSS Feed
Statistics
Preferences
P
View
Raw View
Print version
Find backlinks
History
More topic actions
Edit
Raw edit
Attach file or image
Edit topic preference settings
Set new parent
More topic actions
Account
Log In
Edit
Attach
Copyright © 2008-2024 by the contributing authors. All material on this collaboration platform is the property of the contributing authors.
Ideas, requests, problems regarding TWiki?
Send feedback