3 Replies Latest reply on Apr 14, 2015 10:00 AM by btkarp

    SIEM Event Receivers - HA Issues


      Hello all,


      I am currently dealing with a pretty significant HA issue with the our production Event Receivers (ERC-1260s) sitting at 9.4.2 in HA.


      Our first issue regarding HA happened when a fail-over to the secondary would occur. The secondary correctly assumed the role of primary, however, once the original primary was back up and we attempted to move that receiver back to the primary role, we would run into issues.


      The second issue regarding HA related to the health error "Failed to successfully ping the other receiver's IPMI chip (0)" We have been working with McAfee Support on this as well. We have ensured IP / Network / Cable configurations are all correct. The ERs have neighboring IPs and all indications support a correct configuration.


      Finally, our third (and newest) problem with HA has just occurred last Friday. In an attempt to correct the IPMI issue stated above, I re-keyed both receivers in the pair (using the same key), once this occurred, the secondary event receiver does not populate any information under the Receiver Properties section. The entire side is blank along with the status. Platinum support checked all settings via Command Line and could not find any configuration settings that were incorrect. ha_status, ifconfig and all related .conf files were normal and properly configured. However, whenever I attempt a manual "Standby" or "Return to Service" I get 2 errors, one right after the next,


      "High Availability Sync Receiver Settings was unsuccessful. Error: High Availability has been disabled (ER700). Please view the Help contents or contact Support for troubleshooting information as applicable."


      "The device was unsuccessfully brought back online. Error: High Availability has been disabled (ER700)...."


      Has anyone else had similar problems with their HA environment? It seems strange that there are so many issue surrounding HA for our environment that was running stable at 9.4.0. I will try to update this with a resolution if one is ever found in case anyone else runs into any issues in the future.





        • 1. Re: SIEM Event Receivers - HA Issues
          Peter M

          Moved to SIEM for a faster response.




          • 2. Re: SIEM Event Receivers - HA Issues

            Wow, I feel like looking at my own situation a month ago.


            Our customer has the same exact issues like you have. All of them has been resolved though.


            1. IPMI ping issue: this is nothing that you need to worry about. The HA pair still working correctly even if this issue persist. This is a bug. Upgrade to 9.5.0 MR2 to take care of it. In 9.5.0 MR2, the developer turned this alert off.
            2. Your third issue - after you rekey the device. This is also a bug. What happened is that when you re-key the HA pair, the encryption key got corrupt. If you try to issue ha_status command, it will return error. This issue is also fixed in 9.5.0 MR2. After upgraded, you need to use this command to reset IPMI password: setipmipwd root yourpassword
            3. The first issue I think related to the other issue. Upgrade to 9.5.0 and see if it fixes the issue.
            • 3. Re: SIEM Event Receivers - HA Issues

              Thank you very much for the response. I am actually relieved to hear a similar case.


              We are currently testing 9.5.0 in the lab and discovered a bug in the HA there as well - McAfee is looking into a fix. Hopefully we can upgrade our environment to 9.5.0 soon.