ERP 6.0 EHP7 fail to add <sapid>adm to dba group on HP

[Former Member]

Hello experts,

I hit a failure during ERP 6.0 EHP7 Oracle installation on HP.

The installation failed at second step: create users and group.

Unable to create account group "dba".

I checked the group on the HP machine and found it's a NIS group.

I changed my environment HOME to / and launch the installer again.

This time the dba group can be detected. Still installer failed at later step to create the <sapid>adm user.

Anyone knows how to work around this?

[867] % ypcat group|grep dba
ne_dba:*:2000:neoracle,nesybase
dba:*:60:dbac,oracle,sabnis,sybase,vicm
dbaplay:*:67:
dba_syb:*:133:prodsys
dba_su:*:132:aimee,jlove,lyleung,mkusma,tomoo,uchallap

[868] % cat /etc/nsswitch.conf
passwd: files nis vas4
group: files nis vas4

I cannot manually create this group as well.

[410] % sudo groupadd dba
Password:
Group 'dba' not unique

[411] % sudo groupdel dba
Group 'dba' does not exist

I changed my environment HOME to / and launch the installer again.

This time the dba group can be detected as following:

TRACE      2015-04-10 00:25:29.29 [syuxcgroup.cpp:775]
          bool CSyUserImpl::isExistingOnOS() lib=syslib module=syslib
checking existence of account group="dba" gid="60" succeeded with true.

TRACE      2015-04-10 00:25:29.29 [syxxccache.cpp:419]
          CSyAccountCache::addToCache(const IaPtr<CSyAccountImpl> account)
          lib=syslib module=syslib
inserted account (dba, 60, GROUP) into the accountcache.

Then installer can go one more step to create the <sapid>adm user.

TRACE      2015-04-10 00:25:31.789 [syuxcuser.cpp:1965]
          bool CSyUserImpl::isExistingOnOS() lib=syslib module=syslib
checking existence of account user="dp7adm" succeeded with false.

TRACE      2015-04-10 00:25:31.789 [syuxcuser.cpp:2761]
          CSyUserImpl::useraddArgs(PSyUserDataInt data, bool createHome) const
          lib=syslib module=syslib
calling: /usr/sbin/useradd  -c "SAP System Administrator" -r yes -m -g "sapsys" -G "sapinst,dba,oper" -s "/bin/csh" dp7adm

TRACE      2015-04-10 00:25:31.899 [syuxctask.cpp:239]
          CChildApplicationImpl::doStart() lib=syslib module=syslib
A child process has been started. Pid = 23469

TRACE      2015-04-10 00:25:34.129 [syuxctask.cpp:600]
          CUnixProcessManager::sap_waitpid(pid_t pid, int * pStatus, int options)
          lib=syslib module=syslib
Child process 23469 returned 10

ERROR      2015-04-10 00:25:34.129 [syuxcuser.cpp:2112]
          CSyUserImpl::addToOS(PSyUserDataInt, ISyProgressObserver* )
          lib=syslib module=syslib
FSL-01002  Unable to create account user="dp7adm". Cannot modify /etc/group file, /etc/passwd was modified (return code 10)

If I added the dba group in /etc/group file and retry the installer.

The installer crashed.

Appreciate your kindly help!

Best Regards,

Stella

[Former Member · Accepted solution]

Hello Stella,

1. Check the permissions on /etc/group and /etc/passwd.

2. Create dp7adm manually (as root) with "/usr/sbin/useradd  -c "SAP System Administrator" -r yes -m -g "sapsys" -G "sapinst,dba,oper" -s "/bin/csh" dp7adm"

KR,

Amerjit

[Former Member · Accepted solution]

Hi Amerjit,

Thank you so much for your suggestion.

I could manually create dp7adm using sudo but still the -G "dba" report below ERROR:

sudo usermod -G "dba" dp7adm

Cannot modify /etc/group file, /etc/passwd was modified

HP document explains the error message:

NIS
      The usermod command is aware of NIS user and group entries.  Only
      local users and groups may be modified with this command.  Attempts to
      modify an NIS user or group will result in an error.  NIS users and
      groups must be administered from the NIS server.  This command may
      fail with the error

           login x does not exist

      (return value 6) if the user specified is an NIS user (see passwd(4)).
      However, NIS users are checked when verifying uniqueness of the new

      UID or the new user name.  Also, the error

           Cannot modify /etc/group file, /etc/passwd was modified

      (return value 10) may be returned if a group specified with either the
      -g option or the -G option is an NIS group (see group(4)).

It looks the usermod/useradd cannot add the local user to a NIS group "dba".

To attempt work around this, I manually create an entry in /etc/group for dba group.

[867] % ypcat group|grep dba

ne_dba:*:2000:neoracle,nesybase

dba:*:60:dbac,oracle,sabnis,sybase,vicm

dbaplay:*:67:

dba_syb:*:133:prodsys

dba_su:*:132:aimee,jlove,lyleung,mkusma,tomoo,uchallap

[861] % sudo vi /etc/group

dba::60:

After adding this line to /etc/group, the user dp7adm can be added to group dba.

sudo usermod -G "dba" dp7adm

cat /etc/group | grep dba
dba::60:dp7adm

However the sapinst crashed when I continue the installation.

I've no idea on how to proceed this issue. It looks a bug in sapinst to me.

Thanks

Stella

[Former Member · Accepted solution]

Hello Stella,

As per SAP guidelines ...

As per the suggestion above, please deactivate NIS temporarily and ensure precaution regarding the UIDs/GIDs once you reactivate NIS.

or

Ask your NIS admin to add the required user/group to NIS manually. That way sapinst will detect the user/group assignment already exists and  skip the step.

KR,

Amerjit

[Former Member · Accepted solution]

Hi Amerjit,

Thank you for the nice suggestions.

I've forwarded your suggestions to IT.

We will try and let you know if it works.

Best Regards,

Stella

[Former Member · Accepted solution]

Stella,

You're welcome.

Also have a look at this old posting:

It's old but it gives you an idea of your problem and how to move forward.

To stop the NIS client:

/sbin/init.d/nis.client stop

To start the NIS client.

/sbin/init.d/nis.client start

For this kind of thing I generally don't mess around (even though I know how to do it) as the sys admin would be very unhappy to say the least.

Cheers,

A.

[Former Member · Accepted solution]

Hi Amerjit,

I'm able to proceed with the installation on HP machine after stop the NIS client.

However the install fail at step to start ASC instance.

I checked the sapinst.log and found the message server and enqueue server not started successfully.

/usr/sap/DP8/ASCS02/exe/sapcontrol -prot NI_HTTP -nr 02 -function GetProcessList

14.04.2015 21:50:04
GetProcessList
OK
name, description, dispstatus, textstatus, starttime, elapsedtime, pid
msg_server, MessageServer, GRAY, Stopped, , , 24098
enserver, EnqueueServer, GRAY, Stopped, , , 24015

Trace from message server

--------------------------------------

[Thr 01] Tue Apr 14 21:49:49 2015

[Thr 01] ***LOG Q0I=> NiPGetServByName: 'sapmsDP8' not found: getaddrinfo (9: Bad file number) [/bas/742_REL/src/base/ni/niuxi.c 1823]

[Thr 01] *** ERROR => MsSCommInit: NiBufListen(sapmsDP8) (rc=NIESERV_UNKNOWN) [msxxserv.c   12751]

[Thr 01] *** ERROR => MsSInit: MsSCommInit [msxxserv.c   2548]

[Thr 01] *** ERROR => MsSInit failed, see dev_ms.new for details [msxxserv.c   7817]

[Thr 01] Server state SHUTDOWN

[Thr 01] ***LOG Q02=> MsSHalt, MSStop (Msg Server 24098) [msxxserv.c   7946]

[Thr 01] Good Bye .....

As per notes 896973 suggestion, I checked /etc/services file to make sure the entry for sapmsDP8 was there.

/etc/services

sapmsDP8        3602/tcp        # SAP System Message Server Port

The port number 3602 matches my instance number and the port is not in use on the machine.

I restarted the machine and rechecked the service name by niping -v -S sapmsDP8. The issue is still there. The service cannot be found by niping tool.

Have you ever seen this?

Thanks

Stella

[Former Member · Accepted solution]

Hello Stella,

Is your NIS client running again ? If it is, then please check that the entry you find in your local /etc/services is also in your NIS.

eg: ypcat services | grep -i dp8

Could you also post the output of your /etc/nsswitch.conf here so that we can see exactly what is managed by NIS and the lookup order.

KR,

Amerjit

[Former Member · Accepted solution]

Hi Amerjit,

Yes, the NIS client is running after last time reboot machine.

I checked the ypcat services | grep -I dp8 before I stop the NIS client again.

It looks there is no conflicts in NIS.

However the niping can lookup the sapmsdp8 after NIS client stopped.

cat /etc/nsswitch.conf

passwd: files nis vas4

group: files nis vas4

Does it mean I cannot start the NIS client anymore?

Thanks

Stella

[Former Member · Accepted solution]

Hi Stella,

At least it's what I suspected.

1. Add the following entry to your /etc/nsswitch.conf:

services: files nis vas4

2. Test niping again after step #1 and starting the NIS client (just a cross check).

3. Stop the NIS client and continue your installation.

4. After your installation is complete, align your NIS (passwd,group,services) with the entries that will have been created in the local files.

5. Start NIS.

And that's it ...

Enjoy .....

Amerjit

[Former Member · Accepted solution]

Hi Amerjit,

Thank you so much for your nice suggestions.

I think this is what I need to follow exactly.

Cheers

-Stella