AWS sap documentation change
Summary
Formatting fixes, parameterization of hostnames, and uncommented SNS alert configuration steps for Pacemaker cluster monitoring
Security assessment
The change uncomments and activates instructions for configuring AWS SNS alerts in Pacemaker clusters, improving documentation for security monitoring. While this enhances operational security practices, there is no evidence it addresses a specific known vulnerability.
Diff
diff --git a/sap/latest/sap-AnyDB/ase-sles-ha-operations-topics.md b/sap/latest/sap-AnyDB/ase-sles-ha-operations-topics.md index 596db3ff8..d5dfb23a1 100644 --- a//sap/latest/sap-AnyDB/ase-sles-ha-operations-topics.md +++ b//sap/latest/sap-AnyDB/ase-sles-ha-operations-topics.md @@ -47 +47 @@ Sample output: - slxdbhost01:~ # crm status + slxdbhost01:~ crm status @@ -104 +104 @@ There are different options to perform planned maintenance on nodes, resources, -###### Options +###### Topics @@ -122,2 +122 @@ On -Use one of the following commands to turn on maintenance mode. - + * Use one of the following commands to turn on maintenance mode. @@ -133,2 +135 @@ Off -Use one of the following commands to turn off maintenance mode. - + * Use one of the following commands to turn off maintenance mode. @@ -146 +150 @@ To perform maintenance on the cluster without system outage, the recommended met - crm node standby slxdbhost01 + crm node standby <slxdbhost01> @@ -151 +155 @@ The cluster will cleanly relocate resources, and you can perform activities, inc - crm node online slxdbhost01 + crm node online <slxdbhost01> @@ -158 +162 @@ Moving individual resources is not recommended because of the migration or move - slxdbhost01:~ # crm resource move grp_ASD_ASEDB force + slxdbhost01:~ crm resource move grp_ASD_ASEDB force @@ -166 +169 @@ Use the following command once the resources have relocated to their target loca - slxdbhost01:~ # crm resource clear grp_ASD_ASEDB + <slxdbhost01>:~ crm resource clear grp_ASD_ASEDB @@ -209 +212 @@ If failed actions are reported using the `crm status` command, and if they have -It is recommended that failed (or fenced) nodes are not automatically restarted. It gives operators a chance to investigate the failure, and ensure that the cluster doesn't make assumptions about the state of resources. +It is recommended that failed (or fenced) nodes are not automatically restarted. It gives operators a chance to investigate the failure, and ensure that the cluster doesn’t make assumptions about the state of resources. @@ -238 +241 @@ The agents can then be configured to send emails, log to a file, update a monito - # + @@ -241 +244 @@ The agents can then be configured to send emails, log to a file, update a monito - # + @@ -244,7 +247,7 @@ The agents can then be configured to send emails, log to a file, update a monito - # * Create an SNS Topic and subscribe email or chatbot - # * Note down the ARN for the SNS topic - # * Give the IAM Role attached to both Instances permission to publish to the SNS Topic - # * Ensure the aws cli is installed - # * Copy this file to /usr/share/pacemaker/alerts/alert_sns.sh or other location on BOTH nodes - # * Ensure the permissions allow for hacluster and root to execute the script - # * Run the following as root (modify file location if necessary and replace SNS ARN): + * Create an SNS Topic and subscribe email or chatbot + * Note down the ARN for the SNS topic + * Give the IAM Role attached to both Instances permission to publish to the SNS Topic + * Ensure the aws cli is installed + * Copy this file to /usr/share/pacemaker/alerts/alert_sns.sh or other location on BOTH nodes + * Ensure the permissions allow for hacluster and root to execute the script + * Run the following as root (modify file location if necessary and replace SNS ARN): @@ -253 +256 @@ The agents can then be configured to send emails, log to a file, update a monito - # crm configure alert aws_sns_alert /usr/share/pacemaker/alerts/alert_sns.sh meta timeout=30s timestamp-format="%Y-%m-%d_%H:%M:%S" to { arn:aws:sns:region:account-id:myPacemakerAlerts } + crm configure alert aws_sns_alert /usr/share/pacemaker/alerts/alert_sns.sh meta timeout=30s timestamp-format="%Y-%m-%d_%H:%M:%S" to { arn:aws:sns:region:account-id:myPacemakerAlerts } @@ -255,2 +258,2 @@ The agents can then be configured to send emails, log to a file, update a monito - # pcs alert create id=aws_sns_alert path=/usr/share/pacemaker/alerts/alert_sns.sh meta timeout=30s timestamp-format="%Y-%m-%d_%H:%M:%S" - # pcs alert recipient add aws_sns_alert value=arn:aws:sns:region:account-id:myPacemakerAlerts + pcs alert create id=aws_sns_alert path=/usr/share/pacemaker/alerts/alert_sns.sh meta timeout=30s timestamp-format="%Y-%m-%d_%H:%M:%S" + pcs alert recipient add aws_sns_alert value=<arn:aws:sns:region:account-id:myPacemakerAlerts>