Hi All, I have a few newly configured NetApp clusters that are not reporting in grafana. This clusters are configured as docker instances on harvest. I am getting the "auth failed => 401 Unauthorized" error in the docker logs. I know it would be easy to think this is a case of incorrect credentials but over the last day, I have :
#error="auth failed => 401 Unauthorized"
covert coral
(i) Ensured that the credentials are correct by repeatedly changing passwords
(ii) Ensured that the harvest is configured to use REST - this is ontap 9.14.1
(iii) Ensured that the user is using REST and has read-only credentials which has the same role permissions to the other clusters that are working
(iv) The targets file, the harvest.yml and the harvest-compose,yml are configured correctly
Is there anything that could be tried to find out where this is going wrong ? I will send the logs on email.
cunning igloo
@covert coral Could you try running the following curl and see if it succeeds with the credentials set in Harvest for the relevant cluster?
curl -s -k -u USER:PASS 'https://CLUSTER_IP/api/cluster?fields=*'
{"error":{"code":"6691623", "message":"User is not authorized."}}
I ger an unauthorized error, rahul.
xxxxxxxxxx::> security login role show -vserver xxxxxxxxx -role readonly
Role Command/ Access
Vserver Name Directory Query Level
xxxxxxx readonly DEFAULT readonly
security readonly
security login password all
security login publickey all
security login role show-user-capability all
security login totp all
set all
cunning igloo
Okay. In that case, we can isolate the issue from Harvest. You will need to check on the ONTAP side to determine why that is happening.
covert coral
Apart from ensuring that the password is correct, I have also checked that the permissions are reasonable
austere sable
Can you make sure that you have created a rest role too? https://netapp.github.io/harvest/nightly/prepare-cdot-clusters/#create-rest-role and then associate that role with the harvest user
cunning igloo
xxxxxxxxxx::> security login role show -vserver xxxxxxxxx -role readonly
...
You may be missing /api permissions for your rest-role?
covert coral
yes, exists as below Chris :
netapp-harvest ontapi password readonly no none
austere sable
that means the rest role is missing - your paste shows only the ZAPI role (ontapi)
can you try the link I pasted above to create the rest role?
https://netapp.github.io/harvest/nightly/prepare-cdot-clusters/#create-rest-role