Re: [HTCondor-users] HTCondor-CE: mapping rule for local submission?

[Brian Lin <blin@xxxxxxxxxxx>]

    Hi Thomas,
    
    The `condor_ce_trace` error message can probably be improved. You'll
    want to run `condor_ce_status -any` to verify that you have the
    appropriate daemons running for a minimal CE [1].
    
    If that's the entirety of uncommented lines in your mapfile, it
    looks like you're using HTCondor-CE 3 and you may be missing the
    line necessary for daemons to authenticate 
    with each other [2].
    
    If that's not the case, you'll want to ensure that your group of CE
    processes include the "condor_collector" and check
    /var/log/condor-ce/CollectorLog for hints of any errors. If the logs
    aren't clear, you may benefit from bumping the verbosity of the
    logs:
https://opensciencegrid.org/docs/compute-element/troubleshoot-htcondor-ce/#htcondor-ce-troubleshooting-items
    
    Thanks,
    Brian
    
    [1] 
    
    # condor_ce_status -any
    MyType             TargetType        
    Name                                              
    
    Collector          None               My Pool -
    fermicloud068.fnal.gov@fermiclo         
    Scheduler          None              
    fermicloud068.fnal.gov                            
    DaemonMaster       None              
    fermicloud068.fnal.gov                            
    Job_Router         None              
    htcondor-ce@xxxxxxxxxxxxxxxxxxxxxx 
    
    [2]
    
    # To configure authorization between HTCondor-CE daemons, uncomment
    and replace
    # <HOST CERT DISTINGUISHED NAME> and <HOSTNAME>,
    (escaping any '/' with '\/')
    # in the following line:
    #
    # GSI "^<HOST CERT DISTINGUISHED NAME>$"
    <HOSTNAME>@daemon.htcondor.org

On 6/25/20 7:19 AM, Thomas Hartmann wrote:

Hi all,

I am trying to check locally the status of a CondorCE and ideally submit
test jobs. However, my local user seem not to see the CE -
condor_ce_status as well as condor_ce_trace seem not to see the CE [1].

My suspicion is, that the authorization somehow fails - while I see
authz errors in the CE's MasterLog and SchedLog like [2], they are not
in sync with my tries.

I have been hoping, that the authorization through the filesystem would
work [3], but tbh I am not sure, if I understood the authz correctly.

i.e., is there anything to consider to grid submit locally on a CondorCE?

Cheers,
  Thomas



[1]
desyusr000@grid-vm08: [~] condor_ce_status -debug
desyusr000@grid-vm08: [~] echo $?
0


desyusr000@grid-vm08: [~] condor_ce_trace --debug grid-vm08.desy.de
06/25/20 14:12:38 Result of reading /etc/issue:  \S

06/25/20 14:12:38 Result of reading /etc/redhat-release:  CentOS Linux
release 7.8.2003 (Core)

06/25/20 14:12:38 Using processor count: 1 processors, 1 CPUs, 0 HTs
06/25/20 14:12:38 Enumerating interfaces: lo 127.0.0.1 up
06/25/20 14:12:38 Enumerating interfaces: eth0 131.169.223.234 up
06/25/20 14:12:38 Enumerating interfaces: lo ::1 up
06/25/20 14:12:38 Enumerating interfaces: eth0 2001:638:700:10df::1:ea up
06/25/20 14:12:38 Enumerating interfaces: eth0 fe80::11:69ff:fe22:3234 up
06/25/20 14:12:38 Will use TCP to update collector grid-vm08.desy.de
<131.169.223.234:9619>
06/25/20 14:12:38 Trying to query collector <131.169.223.234:9619>
06/25/20 14:12:38 Trying to query collector <131.169.223.234:9619>
********************************************************************************
2020-06-25 14:12:38 ERROR: Could not find CE schedd at grid-vm08.desy.de.
Verify that the schedd daemon is up with `condor_ce_status`.
********************************************************************************


[2]
06/25/20 14:11:10 SECMAN: FAILED: Received "DENIED" from server for user
/CN=grid-vm08.desy.de@xxxxxxxxxxxxxxxxxxxxx using method GSI.
06/25/20 14:11:10 ERROR: SECMAN:2010:Received "DENIED" from server for
user /CN=grid-vm08.desy.de@xxxxxxxxxxxxxxxxxxxxx using method GSI.
06/25/20 14:11:10 Failed to start non-blocking update to
<131.169.223.234:9619>.


[3]

cat /etc/condor-ce/condor_mapfile

...
GSI ".*,\/ops" opsusr003

##########################################################################################

GSI "(/CN=[-.A-Za-z0-9/= ]+)" \1@xxxxxxxxxxxxxxxxxxxxx
CLAIMTOBE .* anonymous@claimtobe
FS (.*) \1

_______________________________________________
HTCondor-users mailing list
To unsubscribe, send a message to htcondor-users-request@xxxxxxxxxxx with a
subject: Unsubscribe
You can also unsubscribe by visiting
https://lists.cs.wisc.edu/mailman/listinfo/htcondor-users

The archives can be found at:
https://lists.cs.wisc.edu/archive/htcondor-users/