Hana database server cannot reach CVO
Applies to
- Cloud Volumes ONTAP (CVO)
- Kerberos
Issue
HANA Database servers indicates that there is an issue reaching ONTAP storage
Cause
- The issue was identified as an expired Kerberos ticket on the client side
- Kerberos tickets have a default lifespan of 10 hours, after which they need to be renewed
- The client did not renew the ticket in time, leading to authentication failures and NFS connectivity issues
Solution
If the issue is observed again, collect packet traces and work with a NAS resource to identify potential Kerberos timeouts
Partner Notes
partnerNotes_text
Additional Information
These are additional options that can be used to help mitigate the risk of the Kerberos ticket expiring:
- Ensure that the client system renews Kerberos tickets before expiration:
- This can be achieved by configuring automatic ticket renewal on the client side
- Use the following commands to verify Kerberos configuration:
::> kerberos interface show::> kerberos realm show
- Use the following commands to verify Kerberos configuration:
- This can be achieved by configuring automatic ticket renewal on the client side
- Increase Kerberos ticket lifetime:
- Adjust the Kerberos ticket lifetime settings to extend beyond the default 10 hours if feasible for your environment
- Monitor and capture logs:
- Implement proactive monitoring to detect Kerberos ticket expiration issues in real-time
- Enable packet tracing to capture network traffic during future occurrences for deeper analysis
Internal Notes
These are two options that can be used to attempt to quickly resolve the connection:
- Purge existing Kerberos tickets and acquire new ones using the following steps:
- Run `
klist purge` on the client system - Log out and log back into the system, or reboot the client machine
- Run `
- Temporarily disable Kerberos authentication if business continuity is critical, and switch to an alternative authentication method
Note: This has was not used for this case, because the issue resolved itself
