AWS sap documentation change
Summary
Updated documentation formatting, command examples, and hostname placeholders; added SNS alert configuration details
Security assessment
The changes primarily improve documentation clarity (e.g., using placeholders like <rhxhost01>, command formatting). The addition of SNS alert configuration instructions (IAM permissions, secure alert setup) documents security-related monitoring features but does not address a specific vulnerability. No evidence of patching a security issue exists in the diff.
Diff
diff --git a/sap/latest/sap-netweaver/rhel-netweaver-ha-operations-topics.md b/sap/latest/sap-netweaver/rhel-netweaver-ha-operations-topics.md index 005937e14..8f4ddcc4f 100644 --- a//sap/latest/sap-netweaver/rhel-netweaver-ha-operations-topics.md +++ b//sap/latest/sap-netweaver/rhel-netweaver-ha-operations-topics.md @@ -33 +33 @@ There are multiple operating system commands that can be run as root or as a use - # pcs status + pcs status @@ -38 +38 @@ Sample output: - # pcs status + pcs status @@ -41 +41 @@ Sample output: - Current DC: rhxhost01 (version 1.1.23-1.el7_9.1-9acf116022) - partition with quorum + Current DC: <rhxhost01> (version 1.1.23-1.el7_9.1-9acf116022) - partition with quorum @@ -43 +43 @@ Sample output: - Last change: Sat Jan 14 17:45:40 2023 by hacluster via crmd on rhxhost01 + Last change: Sat Jan 14 17:45:40 2023 by hacluster via crmd on <rhxhost01> @@ -48 +48 @@ Sample output: - Online: [ rhxhost01 rhxhost02 ] + Online: [ <rhxhost01> <rhxhost02> ] @@ -52 +52 @@ Sample output: - rsc_aws_stonith_RHX (stonith:fence_aws): Started rhxhost01 + rsc_aws_stonith_RHX (stonith:fence_aws): Started <rhxhost01> @@ -54,3 +54,3 @@ Sample output: - rsc_fs_RHX_ASCS00 (ocf::heartbeat:Filesystem): Started rhxhost01 - rsc_ip_RHX_ASCS00 (ocf::heartbeat:aws-vpc-move-ip): Started rhxhost01 - rsc_sap_RHX_ASCS00 (ocf::heartbeat:SAPInstance): Started rhxhost01 + rsc_fs_RHX_ASCS00 (ocf::heartbeat:Filesystem): Started <rhxhost01> + rsc_ip_RHX_ASCS00 (ocf::heartbeat:aws-vpc-move-ip): Started <rhxhost01> + rsc_sap_RHX_ASCS00 (ocf::heartbeat:SAPInstance): Started <rhxhost01> @@ -58,3 +58,3 @@ Sample output: - rsc_fs_RHX_ERS10 (ocf::heartbeat:Filesystem): Started rhxhost02 - rsc_ip_RHX_ERS10 (ocf::heartbeat:aws-vpc-move-ip): Started rhxhost02 - rsc_sap_RHX_ERS10 (ocf::heartbeat:SAPInstance): Started rhxhost02 + rsc_fs_RHX_ERS10 (ocf::heartbeat:Filesystem): Started <rhxhost02> + rsc_ip_RHX_ERS10 (ocf::heartbeat:aws-vpc-move-ip): Started <rhxhost02> + rsc_sap_RHX_ERS10 (ocf::heartbeat:SAPInstance): Started <rhxhost02> @@ -84 +83 @@ There are different options to perform planned maintenance on nodes, resources, -###### Options +###### Topics @@ -102 +101,4 @@ On -Use the following command to turn on maintenance mode. + * Use the following command to turn on maintenance mode. + + pcs property set maintenance-mode="true" + @@ -105 +106,0 @@ Use the following command to turn on maintenance mode. - # pcs property set maintenance-mode="true" @@ -110 +111,4 @@ Off -Use the following command to turn off maintenance mode. + * Use the following command to turn off maintenance mode. + + pcs property set maintenance-mode="false" + @@ -113 +116,0 @@ Use the following command to turn off maintenance mode. - # pcs property set maintenance-mode="false" @@ -120 +123 @@ To perform maintenance on the cluster without system outage, the recommended met - # pcs node standby rhxhost01 + pcs node standby <rhxhost01> @@ -125 +128 @@ The cluster will cleanly relocate resources, and you can perform activities, inc - # pcs node unstandby rhxhost01 + pcs node unstandby <rhxhost01> @@ -132,4 +135 @@ Moving individual resources is not recommended because of the migration or move - rhxhost01:~ # pcs resource move grp_RHX_ASCS00 rhxhost02 - - Note: Move constraint created for grp_RHX_ASCS00 to rhxhost02 - Note: Use “pcs constraint location remove cli-prefer-grp_RHX_ASCS00” to remove this constraint. + <rhxhost01>:~ pcs resource move <grp_RHX_ASCS00 rhxhost02> @@ -136,0 +137,2 @@ Moving individual resources is not recommended because of the migration or move + Note: Move constraint created for <grp_RHX_ASCS00 to rhxhost02> + Note: Use “pcs constraint location remove cli-prefer-<grp_RHX_ASCS00>” to remove this constraint. @@ -186 +188 @@ Use the help command to understand the impact of these commands. -It is recommended that failed (or fenced) nodes are not automatically restarted. It gives operators a chance to investigate the failure, and ensure that the cluster doesn't make assumptions about the state of resources. +It is recommended that failed (or fenced) nodes are not automatically restarted. It gives operators a chance to investigate the failure, and ensure that the cluster doesn’t make assumptions about the state of resources. @@ -237,4 +239,4 @@ The agents can then be configured to send emails, log to a file, update a monito - # - # alert_sns.sh - # modified from /usr/share/pacemaker/alerts/alert_smtp.sh.sample - # + + alert_sns.sh + modified from /usr/share/pacemaker/alerts/alert_smtp.sh.sample + @@ -243,7 +245,7 @@ The agents can then be configured to send emails, log to a file, update a monito - # * Create an SNS Topic and subscribe email or chatbot - # * Note down the ARN for the SNS topic - # * Give the IAM Role attached to both Instances permission to publish to the SNS Topic - # * Ensure the aws cli is installed - # * Copy this file to /usr/share/pacemaker/alerts/alert_sns.sh or other location on BOTH nodes - # * Ensure the permissions allow for hacluster and root to execute the script - # * Run the following as root (modify file location if necessary and replace SNS ARN): + * Create an SNS Topic and subscribe email or chatbot + * Note down the ARN for the SNS topic + * Give the IAM Role attached to both Instances permission to publish to the SNS Topic + * Ensure the aws cli is installed + * Copy this file to /usr/share/pacemaker/alerts/alert_sns.sh or other location on BOTH nodes + * Ensure the permissions allow for hacluster and root to execute the script + * Run the following as root (modify file location if necessary and replace SNS ARN): @@ -252 +254 @@ The agents can then be configured to send emails, log to a file, update a monito - # crm configure alert aws_sns_alert /usr/share/pacemaker/alerts/alert_sns.sh meta timeout=30s timestamp-format="%Y-%m-%d_%H:%M:%S" to { arn:aws:sns:region:account-id:myPacemakerAlerts } + crm configure alert aws_sns_alert /usr/share/pacemaker/alerts/alert_sns.sh meta timeout=30s timestamp-format="%Y-%m-%d_%H:%M:%S" to <{ arn:aws:sns:region:account-id:myPacemakerAlerts }> @@ -254,2 +256,2 @@ The agents can then be configured to send emails, log to a file, update a monito - # pcs alert create id=aws_sns_alert path=/usr/share/pacemaker/alerts/alert_sns.sh meta timeout=30s timestamp-format="%Y-%m-%d_%H:%M:%S" - # pcs alert recipient add aws_sns_alert value=arn:aws:sns:region:account-id:myPacemakerAlerts + pcs alert create id=aws_sns_alert path=/usr/share/pacemaker/alerts/alert_sns.sh meta timeout=30s timestamp-format="%Y-%m-%d_%H:%M:%S" + pcs alert recipient add aws_sns_alert value=<arn:aws:sns:region:account-id:myPacemakerAlerts>