Storage Foundation Cluster File System High Availability 8.0.2 Configuration and Upgrade Guide - Linux

Last Published:
Product(s): InfoScale & Storage Foundation (8.0.2)
Platform: Linux
  1. Section I. Introduction to SFCFSHA
    1. Introducing Storage Foundation Cluster File System High Availability
      1.  
        About this document
      2.  
        About Storage Foundation Cluster File System High Availability
      3.  
        About Veritas InfoScale Operations Manager
      4.  
        About I/O fencing
      5.  
        About Veritas Services and Operations Readiness Tools (SORT)
      6. About configuring SFCFSHA clusters for data integrity
        1.  
          About I/O fencing for Storage Foundation Cluster File System High Availability in virtual machines that do not support SCSI-3 PR
        2. About I/O fencing components
          1.  
            About data disks
          2.  
            About coordination points
          3.  
            About preferred fencing
  2. Section II. Configuration of SFCFSHA
    1. Preparing to configure
      1. I/O fencing requirements
        1.  
          Coordinator disk requirements for I/O fencing
        2.  
          CP server requirements
        3.  
          Non-SCSI-3 I/O fencing requirements
    2. Preparing to configure SFCFSHA clusters for data integrity
      1. About planning to configure I/O fencing
        1.  
          Typical SFCFSHA cluster configuration with server-based I/O fencing
        2.  
          Recommended CP server configurations
      2. Setting up the CP server
        1.  
          Planning your CP server setup
        2.  
          Installing the CP server using the installer
        3.  
          Configuring the CP server cluster in secure mode
        4.  
          Setting up shared storage for the CP server database
        5.  
          Configuring the CP server using the installer program
        6. Configuring the CP server manually
          1.  
            Configuring the CP server manually for HTTPS-based communication
          2.  
            Generating the key and certificates manually for the CP server
          3.  
            Completing the CP server configuration
        7.  
          Verifying the CP server configuration
    3. Configuring SFCFSHA
      1.  
        Overview of tasks to configure SFCFSHA using the product installer
      2.  
        Starting the software configuration
      3.  
        Specifying systems for configuration
      4.  
        Configuring the cluster name
      5.  
        Configuring private heartbeat links
      6.  
        Configuring the virtual IP of the cluster
      7.  
        Configuring SFCFSHA in secure mode
      8. Configuring a secure cluster node by node
        1.  
          Configuring the first node
        2.  
          Configuring the remaining nodes
        3.  
          Completing the secure cluster configuration
      9.  
        Adding VCS users
      10.  
        Configuring SMTP email notification
      11.  
        Configuring SNMP trap notification
      12.  
        Configuring global clusters
      13. Completing the SFCFSHA configuration
        1.  
          Verifying the NIC configuration
      14.  
        About Veritas License Audit Tool
      15. Verifying and updating licenses on the system
        1.  
          Checking licensing information on the system
        2.  
          Replacing a SFCFSHA keyless license with another keyless license
        3.  
          Replacing a SFCFSHA keyless license with a permanent license
      16.  
        Configuring SFDB
    4. Configuring SFCFSHA clusters for data integrity
      1. Setting up disk-based I/O fencing using installer
        1.  
          Configuring disk-based I/O fencing using installer
        2.  
          Initializing disks as VxVM disks
        3. Checking shared disks for I/O fencing
          1.  
            Verifying Array Support Library (ASL)
          2.  
            Verifying that the nodes have access to the same disk
          3.  
            Testing the disks using vxfentsthdw utility
        4.  
          Refreshing keys or registrations on the existing coordination points for disk-based fencing using the installer
      2. Setting up server-based I/O fencing using installer
        1.  
          Refreshing keys or registrations on the existing coordination points for server-based fencing using the installer
        2. Setting the order of existing coordination points for server-based fencing using the installer
          1.  
            About deciding the order of existing coordination points
          2.  
            Setting the order of existing coordination points using the installer
      3.  
        Setting up non-SCSI-3 I/O fencing in virtual environments using installer
      4.  
        Setting up majority-based I/O fencing using installer
      5.  
        Enabling or disabling the preferred fencing policy
    5. Performing an automated SFCFSHA configuration using response files
      1.  
        Configuring SFCFSHA using response files
      2.  
        Response file variables to configure SFCFSHA
      3.  
        Sample response file for SFCFSHA configuration
    6. Performing an automated I/O fencing configuration using response files
      1.  
        Configuring I/O fencing using response files
      2.  
        Response file variables to configure disk-based I/O fencing
      3.  
        Sample response file for configuring disk-based I/O fencing
      4. Configuring CP server using response files
        1.  
          Response file variables to configure CP server
        2.  
          Sample response file for configuring the CP server on single node VCS cluster
        3.  
          Sample response file for configuring the CP server on SFHA cluster
      5.  
        Response file variables to configure server-based I/O fencing
      6.  
        Sample response file for configuring server-based I/O fencing
      7.  
        Response file variables to configure non-SCSI-3 I/O fencing
      8.  
        Sample response file for configuring non-SCSI-3 I/O fencing
      9.  
        Response file variables to configure majority-based I/O fencing
      10.  
        Sample response file for configuring majority-based I/O fencing
    7. Manually configuring SFCFSHA clusters for data integrity
      1. Setting up disk-based I/O fencing manually
        1.  
          Identifying disks to use as coordinator disks
        2.  
          Setting up coordinator disk groups
        3.  
          Creating I/O fencing configuration files
        4.  
          Modifying VCS configuration to use I/O fencing
        5.  
          Verifying I/O fencing configuration
      2. Setting up server-based I/O fencing manually
        1.  
          Preparing the CP servers manually for use by the SFCFSHA cluster
        2.  
          Generating the client key and certificates manually on the client nodes
        3. Configuring server-based fencing on the SFCFSHA cluster manually
          1.  
            Sample vxfenmode file output for server-based fencing
        4.  
          Configuring CoordPoint agent to monitor coordination points
        5.  
          Verifying server-based I/O fencing configuration
      3. Setting up non-SCSI-3 fencing in virtual environments manually
        1.  
          Sample /etc/vxfenmode file for non-SCSI-3 fencing
      4. Setting up majority-based I/O fencing manually
        1.  
          Creating I/O fencing configuration files
        2.  
          Modifying VCS configuration to use I/O fencing
        3.  
          Verifying I/O fencing configuration
  3. Section III. Upgrade of SFCFSHA
    1. Planning to upgrade SFCFSHA
      1.  
        About the upgrade
      2.  
        Supported upgrade paths
      3.  
        Transitioning between the Veritas products
      4.  
        Considerations for upgrading SFCFSHA to 8.0.2 on systems configured with an Oracle resource
      5. Preparing to upgrade SFCFSHA
        1.  
          Getting ready for the upgrade
        2.  
          Creating backups
        3.  
          Determining if the root disk is encapsulated
        4. Pre-upgrade planning when VVR is configured
          1. Planning an upgrade from the previous VVR version
            1.  
              Planning and upgrading VVR to use IPv6 as connection protocol
          2.  
            Considerations for upgrading SFCFSHA to 7.4 or later on systems with an ongoing or a paused replication
        5. Preparing to upgrade VVR when VCS agents are configured
          1. Freezing the service groups and stopping all the applications
            1.  
              Determining the nodes on which disk groups are online
          2.  
            Preparing for the upgrade when VCS agents are configured
        6.  
          Upgrading the array support
      6.  
        Considerations for upgrading REST server
      7.  
        Using Install Bundles to simultaneously install or upgrade full releases (base, maintenance, rolling patch), and individual patches
    2. Performing a full upgrade of SFCFSHA using the installer
      1. Performing a full upgrade using the product installer
        1.  
          Ensuring the file systems are clean
        2. Performing the upgrade
          1.  
            Updating the configuration and confirming startup
        3.  
          Upgrading the operating system
      2.  
        Upgrading SFDB
    3. Performing a rolling upgrade of SFCFSHA
      1.  
        About rolling upgrade
      2.  
        Performing a rolling upgrade of SFCFSHA using the product installer
      3.  
        Performing a rolling upgrade of SFCFSHA from 7.4.2 or later to 8.0.2
      4.  
        Performing rolling upgrades in CVR environments
    4. Performing a phased upgrade of SFCFSHA
      1. About phased upgrade
        1.  
          Prerequisites for a phased upgrade
        2.  
          Planning for a phased upgrade
        3.  
          Phased upgrade limitations
        4.  
          Phased upgrade example
        5.  
          Phased upgrade example overview
      2. Performing a phased upgrade using the product installer
        1.  
          Moving the service groups to the second subcluster
        2.  
          Upgrading the operating system on the first subcluster
        3.  
          Upgrading the SFCFSHA stack on the first subcluster
        4.  
          Preparing the second subcluster
        5.  
          Activating the first subcluster
        6.  
          Upgrading the operating system on the second subcluster
        7.  
          Upgrading the second subcluster
        8.  
          Completing the phased upgrade
    5. Performing an automated SFCFSHA upgrade using response files
      1.  
        Upgrading SFCFSHA using response files
      2.  
        Response file variables to upgrade SFCFSHA
      3.  
        Sample response file for full upgrade of SFCFSHA
      4.  
        Sample response file for rolling upgrade of SFCFSHA
      5.  
        Sample response file for rolling upgrade of SFCFSHA from 7.4.2 or later to 8.0.2
    6. Upgrading Volume Replicator
      1.  
        Upgrading Volume Replicator
      2. Upgrading VVR without disrupting replication
        1.  
          Upgrading VVR sites for InfoScale 7.3.1
        2.  
          Upgrading VVR sites with InfoScale 7.4 or later
        3.  
          Upgrading VVR sites in VCS control for InfoScale 7.3.1
        4.  
          Upgrading VVR sites in VCS control for InfoScale 7.4 or later
        5.  
          Post-upgrade tasks for VVR sites
    7. Upgrading VirtualStore
      1.  
        Supported upgrade paths
      2.  
        Upgrading SVS to SFCFSHA 8.0.2
    8. Performing post-upgrade tasks
      1.  
        Resetting DAS disk names to include host name in FSS environments
      2.  
        Re-joining the backup boot disk group into the current disk group
      3.  
        Reverting to the backup boot disk group after an unsuccessful upgrade
      4.  
        CVM master node needs to assume the logowner role for VCS managed VVR resources
  4. Section IV. Post-configuration tasks
    1. Performing post configuration tasks
      1.  
        Upgrading disk layout versions
      2.  
        Switching on Quotas
      3. About enabling LDAP authentication for clusters that run in secure mode
        1.  
          Enabling LDAP authentication for clusters that run in secure mode
      4. About configuring authentication for SFDB tools
        1.  
          Configuring vxdbd for SFDB tools authentication
      5.  
        Enabling data encryption over wire
  5. Section V. Configuration of disaster recovery environments
    1. Configuring disaster recovery environments
      1.  
        Disaster recovery options for SFCFSHA
      2.  
        About setting up a campus cluster for disaster recovery
      3.  
        About setting up a global cluster environment for SFCFSHA
      4.  
        About configuring a parallel global cluster using Volume Replicator (VVR) for replication
  6. Section VI. Adding and removing nodes
    1. Adding a node to SFCFSHA clusters
      1.  
        About adding a node to a cluster
      2.  
        Before adding a node to a cluster
      3.  
        Adding a node to a cluster using the Veritas InfoScale installer
      4. Adding the node to a cluster manually
        1.  
          Starting Veritas Volume Manager (VxVM) on the new node
        2.  
          Configuring cluster processes on the new node
        3. Setting up the node to run in secure mode
          1.  
            Configuring the authentication broker on node sys5
        4.  
          Starting fencing on the new node
        5.  
          After adding the new node
        6.  
          Configuring Cluster Volume Manager (CVM) and Cluster File System (CFS) on the new node
        7.  
          Configuring the ClusterService group for the new node
      5. Adding a node using response files
        1.  
          Response file variables to add a node to a SFCFSHA cluster
        2.  
          Sample response file for adding a node to a SFCFSHA cluster
      6. Configuring server-based fencing on the new node
        1.  
          Adding the new node to the vxfen service group
      7.  
        Adding nodes to a cluster that is using authentication for SFDB tools
      8.  
        Updating the Storage Foundation for Databases (SFDB) repository after adding a node
      9.  
        Sample configuration file for adding a node to the cluster
    2. Removing a node from SFCFSHA clusters
      1.  
        About removing a node from a cluster
      2.  
        Removing a node from a cluster
      3.  
        Modifying the VCS configuration files on existing nodes
      4.  
        Modifying the Cluster Volume Manager (CVM) configuration on the existing nodes to remove references to the deleted node
      5.  
        Removing the node configuration from the CP server
      6.  
        Removing security credentials from the leaving node
      7.  
        Updating the Storage Foundation for Databases (SFDB) repository after removing a node
      8.  
        Sample configuration file for removing a node from the cluster
  7. Section VII. Configuration and Upgrade reference
    1. Appendix A. Installation scripts
      1.  
        Installation script options
      2.  
        About using the postcheck option
    2. Appendix B. Configuration files
      1.  
        About the LLT and GAB configuration files
      2.  
        About the AMF configuration files
      3.  
        About I/O fencing configuration files
      4. Sample configuration files for CP server
        1.  
          Sample main.cf file for CP server hosted on a single node that runs VCS
        2.  
          Sample main.cf file for CP server hosted on a two-node SFHA cluster
        3.  
          Sample CP server configuration (/etc/vxcps.conf) file output
    3. Appendix C. Configuring the secure shell or the remote shell for communications
      1.  
        About configuring secure shell or remote shell communication modes before installing products
      2.  
        Manually configuring passwordless ssh
      3.  
        Setting up ssh and rsh connection using the installer -comsetup command
      4.  
        Setting up ssh and rsh connection using the pwdutil.pl utility
      5.  
        Restarting the ssh session
      6.  
        Enabling rsh for Linux
    4. Appendix D. High availability agent information
      1. About agents
        1.  
          VCS agents included within SFCFSHA
      2. Enabling and disabling intelligent resource monitoring for agents manually
        1.  
          Administering the AMF kernel driver
      3. CVMCluster agent
        1.  
          Entry points for CVMCluster agent
        2.  
          Attribute definition for CVMCluster agent
        3.  
          CVMCluster agent type definition
        4.  
          CVMCluster agent sample configuration
      4. CVMVxconfigd agent
        1.  
          Entry points for CVMVxconfigd agent
        2.  
          Attribute definition for CVMVxconfigd agent
        3.  
          CVMVxconfigd agent type definition
        4.  
          CVMVxconfigd agent sample configuration
      5. CVMVolDg agent
        1.  
          Entry points for CVMVolDg agent
        2.  
          Attribute definition for CVMVolDg agent
        3.  
          CVMVolDg agent type definition
        4.  
          CVMVolDg agent sample configuration
      6. CFSMount agent
        1.  
          Entry points for CFSMount agent
        2.  
          Attribute definition for CFSMount agent
        3.  
          CFSMount agent type definition
        4.  
          CFSMount agent sample configuration
      7. CFSfsckd agent
        1.  
          Entry points for CFSfsckd agent
        2.  
          Attribute definition for CFSfsckd agent
        3.  
          CFSfsckd agent type definition
        4.  
          CFSfsckd agent sample configuration
    5. Appendix E. Sample SFCFSHA cluster setup diagrams for CP server-based I/O fencing
      1. Configuration diagrams for setting up server-based I/O fencing
        1.  
          Two unique client clusters served by 3 CP servers
        2.  
          Client cluster served by highly available CPS and 2 SCSI-3 disks
        3.  
          Two node campus cluster served by remote CP server and 2 SCSI-3 disks
        4.  
          Multiple client clusters served by highly available CP server and 2 SCSI-3 disks
    6. Appendix F. Configuring LLT over UDP
      1. Using the UDP layer for LLT
        1.  
          When to use LLT over UDP
      2. Manually configuring LLT over UDP using IPv4
        1.  
          Broadcast address in the /etc/llttab file
        2.  
          The link command in the /etc/llttab file
        3.  
          The set-addr command in the /etc/llttab file
        4.  
          Selecting UDP ports
        5.  
          Configuring the netmask for LLT
        6.  
          Configuring the broadcast address for LLT
        7.  
          Sample configuration: direct-attached links
        8.  
          Sample configuration: links crossing IP routers
      3. Using the UDP layer of IPv6 for LLT
        1.  
          When to use LLT over UDP
      4. Manually configuring LLT over UDP using IPv6
        1.  
          The link command in the /etc/llttab file
        2.  
          The set-addr command in the /etc/llttab file
        3.  
          Selecting UDP ports
        4.  
          Sample configuration: direct-attached links
        5.  
          Sample configuration: links crossing IP routers
      5. About configuring LLT over UDP multiport
        1.  
          Manually configuring LLT over UDP multiport
        2.  
          Enabling LLT ports in firewall
        3.  
          Disabling the UDP multiport feature
    7. Appendix G. Using LLT over RDMA
      1.  
        Using LLT over RDMA
      2.  
        About RDMA over RoCE or InfiniBand networks in a clustering environment
      3.  
        How LLT supports RDMA capability for faster interconnects between applications
      4.  
        Using LLT over RDMA: supported use cases
      5. Configuring LLT over RDMA
        1.  
          Choosing supported hardware for LLT over RDMA
        2.  
          Installing RDMA, InfiniBand or Ethernet drivers and utilities
        3. Configuring RDMA over an Ethernet network
          1.  
            Enable RDMA over Converged Ethernet (RoCE)
          2.  
            Configuring RDMA and Ethernet drivers
          3.  
            Configuring IP addresses over Ethernet Interfaces
        4. Configuring RDMA over an InfiniBand network
          1.  
            Configuring RDMA and InfiniBand drivers
          2.  
            Configuring the OpenSM service
          3.  
            Configuring IP addresses over InfiniBand Interfaces
        5. Tuning system performance
          1.  
            Tuning the CPU frequency
          2.  
            Tuning the boot parameter settings
        6. Manually configuring LLT over RDMA
          1.  
            Broadcast address in the /etc/llttab file
          2.  
            The link command in the /etc/llttab file
          3.  
            Selecting UDP ports
          4.  
            Configuring the netmask for LLT
          5.  
            Sample configuration: direct-attached links
        7.  
          LLT over RDMA sample /etc/llttab
        8.  
          Verifying LLT configuration
      6. Troubleshooting LLT over RDMA
        1.  
          IP addresses associated to the RDMA NICs do not automatically plumb on node restart
        2.  
          Ping test fails for the IP addresses configured over InfiniBand interfaces
        3.  
          After a node restart, by default the Mellanox card with Virtual Protocol Interconnect (VPI) gets configured in InfiniBand mode
        4.  
          The LLT module fails to start

Enabling data encryption over wire

Post VVR upgrade, if you want to set up replication with encrypted data volumes, ensure that you meet the following prerequisites:

  • Install the user certificates on all nodes, in the /etc/vx/vvr/ directory, to establish SSL socket communication between user space utilities (vxrsyncd and vradmind). Secure communication between user space utilities is created using certificate-based SSL socket.

    Certificate location

    Description

    /etc/vx/vvr/key.pem

    Specifies the location of the private key. The user space utilities uses the private key in a Privacy Enhanced Mail (PEM) format.

    /etc/vx/vvr/cert.pem

    Specifies the location of the certificates. The user space utilities uses the certificates in PEM format.

    /etc/vx/vvr/cacert.pem

    Specifies the location of the root certificate. The user space utilities uses the root certificate for mutual authentication in Privacy Enhanced Mail (PEM) format.

  • Restart the VVR utilities using the following commands for the certificate to take effect:

    • /usr/sbin/vxstart_vvr stop

    • /usr/sbin/vxstart_vvr start

After you install the user certificates and restart the VVR utilities, perform the following steps:

Note:

Ensure that you have upgraded VVR at both the sites. Failing this, the vradmin startrep and the addsec commands may fail with -encrypted option.

  1. Stop replication to the Secondary using the following command:

    vradmin -g diskgroup -f stoprep rvgname

  2. Dissociate the Primary and Secondary Rlinks using the following command:

    vradmin -g diskgroup delsec local_rvgname sec_hostname/ip

    The vradmin delsec command performs the following by default:

    • Dissociates the data volumes and SRL from the Secondary RVG.

    • Removes the Secondary RVG from its RDS, deletes the Secondary RVG, and deletes the associated Primary and Secondary RLINKs.

  3. Add the Secondary to the RDS using the following command on the Primary:

    vradmin -g diskgroup -encrypted addsec local_rvgname pri_hostname \ sec_hostname

    It also creates an encrypted Rlink between primary and secondary host.

  4. Synchronize the Secondary and start replication using automatic synchronization, using the following command:

    vradmin -g diskgroup -encrypted -a startrep local_rvgname sec_hostname

For more information about enabling data encryption over the wire, see, Veritas InfoScale Replication Administrator's Guide