ALM-45655 Flink HA Certificate File Has Expired

Alarm Description

Flink checks whether the HA certificate file has expired in the first health check or at 01:00:00 every day. This alarm is generated when the HA certificate has expired. This alarm is automatically cleared when the certificate file becomes valid again.

Alarm Attributes

Alarm ID	Alarm Severity	Alarm Type	Service Type	Auto Cleared
45655	Major	Overlimit	Flink	Yes

Alarm Parameters

Type	Parameter	Description
Location Information	Source	Specifies the cluster for which the alarm is generated.
	ServiceName	Specifies the service for which the alarm is generated.
	RoleName	Specifies the role for which the alarm is generated.
	HostName	Specifies the host for which the alarm is generated.

Impact on the System

FlinkServer in active/standby mode cannot provide services for external systems, and Flink jobs cannot be submitted on the FlinkServer.

Possible Causes

The HA certificate file has expired.

Handling Procedure

View alarm information.

Log in to FusionInsight Manager, choose O&M > Alarm > Alarms > ALM-45655 Flink HA Certificate File Has Expired, view Location, obtain the name of the host for which the alarm is generated, and click the host name to view its IP address.

Check whether the HA certificate file in the system is valid. If it is not, generate a new one.

Log in to the host for which the alarm is generated as user omm.
Run the cd ${BIGDATA_HOME}/FusionInsight_Flink_*/install/FusionInsight-Flink-*/ha/local/cert command to go to the directory where the HA certificate is stored.
Run the openssl x509 -noout -text -in server.crt command to query the effective time and due time of the HA certificate and check whether the HA certificate file is valid.
- If yes, go to 9.
- If no, go to 5.
Run the cd ${BIGDATA_HOME}/FusionInsight_Flink_*/install/FusionInsight-Flink-*/flink/sbin command to go to the Flink script directory.
Run the sh proceed_ha_ssl_cert.sh command to generate a new HA certificate. Then, check whether the alarm is cleared 1 minute later.
- If yes, go to 8.
- If no, go to 7.
On the node where the standby FlinkServer instance is located, repeat 5 to 6. Then, check whether the alarm is cleared 1 minute later.
- If yes, go to 8.
- If no, go to 9.
Check whether this alarm is generated again during periodic system check.
- If yes, go to 9.
- If no, no further action is required.

Collect fault information.

On FusionInsight Manager, choose O&M. In the navigation pane on the left, choose Log > Download.
Expand the Service drop-down list, and select Flink for the target cluster.
Click in the upper right corner, and set Start Date and End Date for log collection to 10 minutes ahead of and after the alarm generation time, respectively. Then, click Download.
Contact O&M engineers and provide the collected logs.