CAIQUM-6090: Partial functionality with AIQUM monitoring on a specific cluster

Last updated
Save as PDF
Share
1. Share
2. Tweet
3. Share

Views:: 4,089

Visibility:: Public

Votes:: 2

Category:: active-iq-unified-manager

Specialty:: om

Last Updated:

Issue

Active IQ Unified Manager (AIQUM) gathers most inventory information, but acquisition shows Failed in Cluster Setup.
The issue can occur after adding a cluster or regenerating the mutual TLS (mTLS) certificate.
Some inventory data, such as volumes, might be missing even when acquisition completes.
Performance data is not collected, resulting in gaps in performance graphs.
Restoring files from AIQUM fails with the following error:

Connection error to storage system :Error writing to server

The ONTAP audit log reports Message (null) on HTTP from the AIQUM address.
sample.log under root within an acquisition recording or ocumserver.log reports:

WARN [oncommand] [reconciliation-0] [c.n.d.c.ClusterStatusListener] Acquisition Failed for cluster : message : Cannot store non-PrivateKeys

The cluster cannot be removed. No error is displayed in the UI. When removal is attempted using the um cli, it reports:

ERROR: Cannot store non-PrivateKeys

The following file does not exist for an affected cluster:

/opt/netapp/essentials/jboss/server/onaro/cert/aiqum_mtls_<cluster_name/IP>.keystore

ocumserver.log reports:

Unable to fetch the mututal TLS certificate
INFO [admin] [default task-1485] [c.n.o.r.c.s.i.v.ClusterConnectionService] Unable to fetch the mututal TLS certificate for alias aiqum-mtls-...
Connection error to Storage System : PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors

au.log reports:

Wrapped by: java.lang.RuntimeException: javax.net.ssl.SSLHandshakeException:
PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid
certification path to requested target
ERROR [common-pool-2] c.n.u.KeyStoreUtils (KeyStoreUtils.java:147) - Error creating KeyStore File With Single Certificate used for mutual TLS communication java.security.KeyStoreException: Cannot store non-PrivateKeys
 at sun.security.provider.JavaKeyStore.engineSetKeyEntry(JavaKeyStore.java:264) ~[?:?]
 at sun.security.util.KeyStoreDelegator.engineSetKeyEntry(KeyStoreDelegator.java:111) ~[?:?]
 at java.security.KeyStore.setKeyEntry(KeyStore.java:1174) ~[?:?]
 at com.netapp.util.KeyStoreUtils.getKeyStoreFileWithSingleCertificate(KeyStoreUtils.java:139) ~[server-au.jar:9.16.0-2024.11.J9]
  :
ERROR [common-pool-2] c.o.s.a.f.d.BaseDataSource (DataSourceErrorException.java:246) - <cluster_mgmt_ip_address> [Error connecting] - Failed to connect to <cluster_mgmt_ip_address> ([Device name General Device]: Cannot store non-PrivateKeys

Alerts are not generated because cluster monitoring fails.
The Cluster Operation State shows "Failed" and generates the following event:

The cluster is not reachable. The cluster cannot be reached. Ensure there is network connectivity to the cluster and the API has not timed out. the following settings must also be configured correctly for the cluster hostname or cluster-management IP address, protocol, and port.