クライアント証明書の期限切れにより、Active IQ Unified Managerでクラスタを追加できない、または既存クラスタの取得に失敗する
環境
- Active IQ Unified Manager（AIQUM）9.x
- ONTAP 9
- Active IQ Unified ManagerとONTAPクラスタは同じNTP設定を使用して時刻同期されています
- Active IQ Unified Managerは5年以上前にインストールされています
注：インストール日はInstall_Upgrade.logで確認できます
------ postinst start Sat Feb 9 10:10:20 UTC 2019 ------
問題
- AIQUMへのONTAPクラスタの追加に失敗する：
Unable to add cluster data source. This can occur if the clocks on the systems are not synchronized and the Active IQ Unified Manager HTTPS certificate start date is later than the date on the cluster, or if the cluster has reached the maximum number of EMS notification destinations./server/ocumserver.login AIQUM は HTTP 500 をFailed to add the datasourceで示します
INFO [admin] [default task-22] [c.n.d.o.o.s.z.OntapSecurityCertificateZapiService] Installing self-signed client certicate on ONTAP
..
ERROR [admin] [default task-22] [c.n.d.c.h.DatasourcesHttpClientManager] Failed to add the datasource
com.onaro.commons.exception.ConfigurationException: Server returned HTTP status 500.HTTP error message :{"timestamp":"<TIMESTAMP>","status":500,"error":"Internal Server Error","path":"/acquisition-api/server/datasource"}
at com.netapp.mega//com.onaro.commons.framework.mgmt.HTTPClientManager.logHTTPErrorStatusWithMessage(HTTPClientManager.java:120)
at deployment.dfm-app.war//com.netapp.dfm.collector.httpclient.DatasourcesHttpClientManager.addDS(DatasourcesHttpClientManager.java:243)
at deployment.dfm-app.war//com.netapp.dfm.collector.OcieAcquisitionFacade.addDataSource(OcieAcquisitionFacade.java:287)
at deployment.dfm-app.war//com.netapp.dfm.collector.AbstractDataSourceManager.addDataSource(AbstractDataSourceManager.java:53)
at deployment.dfm-app.war//com.netapp.dfm.collector.AbstractDataSourceManager$$FastClassBySpringCGLIB$$babcc85.invoke(<generated>)
..
/etc/log/mlog/audit.logONTAPクラスタで、証明書の有効期限切れによりインストールが失敗したことを示します
[kern_audit:info:3167] 8503e80000dac04e :: clustername:ontapi :: xx.xxx.xxx.xx:52938 :: clustername:user :: security-certificate-install :: Error: The certificate has expired./jboss/server_acq.logAIQUM は証明書の有効期限が切れていることを示します
ERROR [default task-6260] c.n.s.a.s.r.s.i.AcquisitionFacadeSessionServiceImpl (AcquisitionFacadeSessionServiceImpl.java:843) - Fail to add data source for acquisitionUnitName: local, dataSourceName: <cluster name>, vendor:NetApp OCI Essentials, model: NetApp OCI Essentials, datasourceTypeId: 91, manual: 1, isActive: false, attrs: -- listing properties --
<truncated>
: com.netapp.oci.netapp.client.interfaces.data.EmsManagerException: The certificate has expired. (errno=61105) (errno=
..
ERROR [default task-340653] c.o.s.a.s.AcquisitionFacadeUtil (AcquisitionFacadeUtil.java:202) - failed to register EMS: : com.netapp.oci.netapp.client.interfaces.data.EmsManagerException: The certificate has expired. (errno=61105)
または
: com.netapp.oci.netapp.client.interfaces.data.EmsManagerException: Failed to install security certificate, response code = 400 (errno=0) (errno=0) (errno=0)