rac开启系统防火墙导致其中一个节点无法启动

dm5250 2025-03-03

由于审计需要，系统需要启动防火墙，但是启动后只能启动一个节点，防火墙规则如下：

资源状态如下，可以发现节点一的资源明显有问题：

检查oraagent_grid.log日志：

[grid@flap_restore_db_dev_2050 flap_restore_db_dev_2050]$ tail -100f /u01/app/11.2.0/grid/log/flap_restore_db_dev_2050/agent/ohasd/oraagent_grid/oraagent_grid.log |more

检查ocssd.log日志：

[grid@flap_restore_db_dev_2050 cssd]$ tail -100f ocssd.log |more

检查ohasd.log日志：

[grid@flap_restore_db_dev_2050 ohasd]$ tail -100f ohasd.log |more

看上去是网络问题，刚好利用原厂的工具测一下网卡的多播：

查看evmd.log日志，看上去还是网络的问题：

[grid@flap_restore_db_dev_2050 evmd]$ tail -50f evmd.log |more

于是回归根本，检查ip地址和防火墙规则，检查发现这个虚拟机自带的私网地址没有加到防火墙规则里面，只加了节点二的地址，没有加节点一的地址：

增加防火墙规则，启动crs，顺利启动节点一集群：

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="169.254.22.54" accept'

[root@flap_restore_db_dev_2050 ~]# firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="169.254.22.54" accept'
success
[root@flap_restore_db_dev_2050 ~]# firewall-cmd --reload
success

[root@flap_restore_db_dev_2051 ~]# firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="169.254.22.54" accept'
success
[root@flap_restore_db_dev_2051 ~]# firewall-cmd --reload
success

[root@flap_restore_db_dev_2050 bin]# ps -ef|grep pmon
root      68846  58898  0 18:05 pts/3    00:00:00 grep --color=auto pmon
[root@flap_restore_db_dev_2050 bin]# ./crsctl stop crs -f
CRS-2791: Starting shutdown of Oracle High Availability Services-managed resources on 'flap_restore_db_dev_2050'
CRS-2673: Attempting to stop 'ora.mdnsd' on 'flap_restore_db_dev_2050'
CRS-2673: Attempting to stop 'ora.ctssd' on 'flap_restore_db_dev_2050'
CRS-2673: Attempting to stop 'ora.evmd' on 'flap_restore_db_dev_2050'
CRS-2673: Attempting to stop 'ora.cluster_interconnect.haip' on 'flap_restore_db_dev_2050'
CRS-2677: Stop of 'ora.cluster_interconnect.haip' on 'flap_restore_db_dev_2050' succeeded
CRS-2677: Stop of 'ora.mdnsd' on 'flap_restore_db_dev_2050' succeeded
CRS-2677: Stop of 'ora.evmd' on 'flap_restore_db_dev_2050' succeeded
CRS-2677: Stop of 'ora.ctssd' on 'flap_restore_db_dev_2050' succeeded
CRS-2673: Attempting to stop 'ora.cssd' on 'flap_restore_db_dev_2050'
CRS-2677: Stop of 'ora.cssd' on 'flap_restore_db_dev_2050' succeeded
CRS-2673: Attempting to stop 'ora.crf' on 'flap_restore_db_dev_2050'
CRS-2677: Stop of 'ora.crf' on 'flap_restore_db_dev_2050' succeeded
CRS-2673: Attempting to stop 'ora.gipcd' on 'flap_restore_db_dev_2050'
CRS-2677: Stop of 'ora.gipcd' on 'flap_restore_db_dev_2050' succeeded
CRS-2673: Attempting to stop 'ora.gpnpd' on 'flap_restore_db_dev_2050'
CRS-2677: Stop of 'ora.gpnpd' on 'flap_restore_db_dev_2050' succeeded
CRS-2793: Shutdown of Oracle High Availability Services-managed resources on 'flap_restore_db_dev_2050' has completed
CRS-4133: Oracle High Availability Services has been stopped.
[root@flap_restore_db_dev_2050 bin]# ./crsctl start crs
CRS-4123: Oracle High Availability Services has been started.

[root@flap_restore_db_dev_2050 bin]# ps -ef|grep pmon
grid      69385      1  0 18:06 ?        00:00:00 asm_pmon_+ASM1
oracle    69764      1  1 18:07 ?        00:00:00 ora_pmon_flapdb1
root      69850  58898  0 18:07 pts/3    00:00:00 grep --color=auto pmon

成功启动。不是什么难题，但是一开始的方向就错了，简单的记录一下～

oracle数据库

「喜欢这篇文章，您的关注和赞赏是给作者最好的鼓励」

关注作者

rac开启系统防火墙导致其中一个节点无法启动

评论