#Permission denied for NvmMirror collection

1 messages · Page 1 of 1 (latest)

misty moat
#

I am getting an error for permission denied when attempting to collect for NvmMirror. I checked and I have /api/private/cli set to RO for the Role I created. What else do I need to check? How do I get a list of possible /api/private/cli sub categories?

time=2026-03-12T22:42:59.584Z level=ERROR source=collector.go:435 msg="Entering standby mode" Poller=fas01-po collector=StatPerf:NvmMirror error="error in POST request: StatusCode: 403, Error: Permission denied, Message: not authorized for that command, API: /api/private/cli" task=counter

keen oxide
misty moat
agile harbor
misty moat
#

Okay, so since we don't have FlexCache, I've decided to drop the StatPerf from my harvest.yaml config.

#

That will solve the permission denied for private cli

agile harbor
#

are you still using ZAPIs to collect metrics?

misty moat
#

So that's the real question, I thought ZAPI was phasing out but how the docs read, it seems that it is still needed to some degree. I'd love to lean out how many calls harvest has to make so I can be efficient

# 
  collectors:
    - Rest
    - RestPerf
    - Ems
    - KeyPerf
#

Oh, well I feel silly now, I don't even have it in my config

#

I'm evidnetly providing comic relief now

agile harbor
misty moat
#

So I did just remove StatPerf about 10 min ago

#

I guess I could ask...what I have now in my config, is that a fairly good combo?

#

Based on Capacity and Performance?

agile harbor
#

Yes, that's a solid config. You may be missing some perf metrics from these objects since these objects are not fully supported by RestPerf

image.png
misty moat
#

So I know NvmMirror and FlexCache throw errors when enabled and I'd have to look back more but it's possible NicCommon did too. I see on the Role requriments that I'd have include -application ssh with pubkey auth. I prefer just being purely cert based auth...I'll look to see if I am missing any worth having

agile harbor
misty moat
#

If I am reading this correctly, there are two Roles created here and additional key/pub sets for the application ssh ```security login role create -role harvest2-role -access all -cmddirname "set"
security login role create -role harvest2-role -access readonly -cmddirname "statistics"

security login rest-role create -role harvest-rest-role -access readonly -api /api/cluster
security login rest-role create -role harvest-rest-role -access read_create -api /api/private/cli
security login create -user-or-group-name harvest2 -application ssh -authentication-method password -role harvest2-role
security login create -user-or-group-name harvest2 -application http -authentication-method password -role harvest-rest-role

If you also want to use certificate authentication for the StatPerf collector, run these commands as well

security login create -user-or-group-name harvest2 -application ssh -authentication-method publickey -role harvest2-role
security login create -user-or-group-name harvest2 -application http -authentication-method cert -role harvest-rest-role```

#

I only have the http cert model implemented

#

Don't I have to run this additional command? publickey create -username harvest_ro_user -application ssh -publickey

keen oxide
#

@misty moat Commands documented work for me and other user who was using cert auth. Please check
#1475646791922876541 message
Are you still getting any error after providing these permissions?

misty moat
#

@keen oxide Okay, so I think I understand now, the ssh login create entry is only there as a helper of sorts and that a publickey is not needed. I do not see the rrors now

#

I can open a new thread but since this included /api/private/cli I see that since updating to the nightly version that my SVM Grafana dashboard shows NO DATA. I see that there is nothing being collected for svm_vol_* ...not sure why this would have went away.

keen oxide
#

Yes, Please open a new thread for this.

misty moat