SAPCMControl...asic_cluster(7)

📦 version 1.0.0, in opensuse-leap 16.0

💅 SAPCMControlZone_basic_cluster(7) — the one where your cluster actually behaves

okay bestie, welcome to section 7 of the manual, page SAPCMControlZone_basic_cluster from the SAPCMControlZone fam 🫶 this is the whole "basic settings" situation — the stuff that makes SAPCMControlZone actually work instead of just sitting there looking pretty.

✨ NAME ✨

SAPCMControlZone_basic_cluster — basic settings to make SAPCMControlZone work. that's it, that's the vibe check 💖

🌸 DESCRIPTION 🌸

so the Convergent Mediation (CM) ControlZone needs a certain basic cluster configuration. besides the necessary settings, there are also additional configurations that might match your specific needs. both matter, so don't skip the "extra" ones thinking they're optional gossip 👑

🎀 Operating System Basics 🎀

💜 Users and groups

technical users and groups — like "mzadmin" — are defined locally in the Linux system. see manual page passwd(5) and usermod(8). the mzadmin user needs certain environment variables set in ~/.bashrc — see manual page ocf_suse_SAPCMControlZone(7) for the details, iykyk 🧚

🦋 Hostnames

name resolution of the cluster nodes and the virtual IP address must be done locally on all cluster nodes. see manual page hosts(5). no cap, do not outsource this 💅

⭐ Time synchronization

strict time synchronization between the cluster nodes is mandatory, e.g. NTP. see manual page chrony.conf(5). further, the nodes should have configured the same timezone. synchronized clocks are literally the main character of a healthy cluster 🕐✨

🍓 mzadmin´s ~/.bashrc

certain values for the environment variables JAVA_HOME, MZ_HOME and MZ_PLATFORM are needed, depending on the specific setup. see manual page ocf_suse_SAPCMControlZone(7) for details. three little variables, so much power 😭

🌈 NFS mounted filesystem

a shared filesystem for ControlZone data can be statically mounted on both cluster nodes. this filesystem holds work directories, e.g. for batch processing.

⚠️ do not confuse it with the ControlZone application itself. the application is copied from NFS to both cluster nodes into local filesystems.

client-side write caching has to be disabled for the NFS shares containing customer data — that's not a suggestion, that's the law 💀 see manual page fstab(5) and the example below.

🔥 CRM Basics 🔥

👑 stonith-enabled = true

the cib bootstrap option stonith-enabled is crucial for any reliable pacemaker cluster. the value 'true' is one pre-requisite for having a cluster supported. like, the whole support situation hinges on this one, bestie 🫶

🎯 migration-threshold = 3

the crm rsc_default parameter migration-threshold defines how many errors on a resource can be detected before this resource will be moved to another node. a value greater than 1 is needed for the resource monitor option on-fail=restart. see also failure-timeout. 🧠

👀 record-pending = true

the crm op_default record-pending defines whether the intention of an action upon the resource is recorded in the Cluster Information Base (CIB). setting this parameter to 'true' allows the user to see pending actions like 'starting' and 'stopping' in crm_mon. it's giving transparency, we love to see it 💅

⏳ failure-timeout = 86400

the crm op_default failure-timeout defines how long failed actions will be kept in the CIB. after that time the failure record will be deleted. time unit is seconds. see also migration-threshold. the value '86400' means failure records will be cleaned automatically after one day. self-cleaning CIB? iconic ✨

🛡️ priority-fencing-delay = 30

the optional crm property priority-fencing-delay specifies a delay for the fencings that are targeting the lost nodes with the highest total resource priority, in case we do not have the majority of the nodes in our cluster partition — so that the more significant nodes potentially win any fencing match. this is especially meaningful under split-brain of a 2-node cluster.

a promoted resource instance takes the base priority + 1 on calculation if the base priority is not 0. any delay that is introduced by pcmk_delay_max configured for the corresponding fencing resources will be added to this delay. a meta attribute priority=100 or alike for the ControlZone resource is needed to make this work — see ocf_suse_SAPCMControlZone(7).

the delay should be significantly greater than, or safely twice, pcmk_delay_max. math is math 🧮

🎀 EXAMPLES 🎀

💖 CRM basic configuration

this example has been taken from a two-node cluster SLE-HA 15 SP4 with disk-based SBD. priority fencing is configured and the SBD pcmk_delay_max has been reduced accordingly. the stonith-timeout is adjusted to SBD on-disk msgwait. the migration-threshold is set to 3. the failure-timeout is 86400. literally all of it, together, slaying 🫶

 primitive rsc_stonith_sbd stonith:external/sbd \
  params pcmk_delay_max=15

 property cib-bootstrap-options: \
  cluster-infrastructure=corosync \
  placement-strategy=balanced \
  dc-deadtime=20 \
  stonith-enabled=true \
  stonith-timeout=150 \
  stonith-action=reboot \
  have-watchdog=true \
  priority-fencing-delay=30

 rsc_defaults rsc-options: \
  resource-stickiness=1 \
  migration-threshold=3 \
  failure-timeout=86400

 op_defaults op-options: \
  timeout=120 \
  record-pending=true

🦋 Statically mounted NFS share for ControlZone platform data

below is an fstab example for a shared filesystem holding application data. the filesystem is statically mounted on all nodes of the cluster. the correct mount options are depending on the NFS server — however, client-side write caching has to be disabled in any case. 🔒

 nfs1:/s/c11/platform /mnt/platform nfs4 rw,noac,sync,default 0 0
📌 note: the NFS share might be monitored, but not mounted/umounted by the HA cluster. see ocf_suse_SAPCMControlZone(7) for details.

🧚 Ping cluster resource for checking connectivity

below is an example of an optional ping resource for checking connectivity to the outer world. if the nodes have only one network interface, shared between HA cluster and application, this measure may not improve availability — so don't come for me if it doesn't hit 🙈

ControlZone should run on a node from which more ping targets can be reached than from others. if all nodes are the same, the ControlZone application resource group (e.g. grp_C11) stays where it is. three vital infrastructure servers outside the datacenter are chosen as ping targets. if at least two targets are reachable, the current node is preferred for running ControlZone. the maximum time for detecting connectivity changes is ca. 180 seconds. ⏱️

 primitive rsc_ping ocf:pacemaker:ping \
  params name=ping-okay host_list="proxy1 proxy2 proxy3" \
  op monitor interval=120 timeout=60 start-delay=10 on-fail=ignore

 clone cln_ping rsc_ping

 location loc_connect_C11 grp_C11 \
  rule 90000: ping-okay gt 1

🌸 FILES 🌸

  • /etc/passwd — the local user database
  • /etc/groups — the local group database
  • /etc/hosts — the local hostname resolution database
  • /etc/chrony.conf — the basic configuration for time synchronisation
  • /etc/sysctl.d/*.conf — the OS kernel parameters, e.g. TCP tunables
  • /etc/fstab — the filesystem table, for statically mounted NFS shares
  • ~/.bashrc — the mzadmin´s ~/.bashrc, defining JAVA_HOME, MZ_HOME and MZ_PLATFORM
  • /usr/lib64/jvm/jre-17-openjdk/ — the Java 1.7 runtime environment shipped with the OS, potentially $JAVA_HOME

💀 BUGS 💀

in case of any problem, please use your favourite SAP support process to open a request for the component BC-OP-LNX-SUSE.

please report feedback and suggestions to feedback@suse.com. we're literally listening 🫶

🌈 SEE ALSO 🌈

ocf_suse_SAPCMControlZone(7), ocf_heartbeat_ping(7), crm(8), passwd(5), usermod(8), hosts(5), fstab(5), nfs(5), mount(8), chrony.conf(5), ha_related_suse_tids(7), ha_related_sap_notes(7),

👑 AUTHORS 👑

F.Herschel, L.Pinne — the legends fr fr 💜

(c) 2023-2024 SUSE LLC

SAPCMControlZone comes with ABSOLUTELY NO WARRANTY. for details see the GNU General Public License at http://www.gnu.org/licenses/gpl.html

kisses bestie, this page was last updated 18 Mar 2024 and it's from the SAPCMControlZone manual in section 7 — go forth and configure, you've got this 💅✨🎀🦋

📦 where this page comes from