ALM-12040 Insufficient OS Entropy

Alarm Description

The system checks whether the rng-tools or haveged tool has been enabled and correctly configured every 5 minutes. If neither tool is configured, this alarm is generated. If either is configured, the system continues to check the entropy. If the entropy is less than 100 for five consecutive times, this alarm is generated.

This alarm is cleared when rng-tools or haveged has been installed and enabled on the target node and the entropy of the OS is greater than or equal to 100 in at least one of five entropy checks.

Alarm Attributes

Alarm Parameters

Impact on the System

The entropy of the operating system of the node is insufficient. As a result, commands such as encryption and decryption are executed slowly on the node. As a result, the service processing performance of each instance deteriorates, and even service processes cannot be executed properly.

Possible Causes

• rng-tools or haveged has not been installed or started.
• The entropy of the OS is smaller than 100 for multiple consecutive times.

Handling Procedure

Check whether haveged or rng-tools has been installed or started.

1. Log in to FusionInsight Manager and choose O&M > Alarm > Alarms.
2. Check the value of HostName in the Location area to obtain the name of the host for which the alarm is generated.
3. Log in to the node for which the alarm is generated as user root.
4. Run the /bin/rpm -qa | grep -w "haveged" command to check the haveged installation status and check whether the command output is empty.
   • If yes, go to 6.
   • If no, go to 5.

5. Run the /sbin/service haveged status |grep "running" command and check the command output.
   • If the command is executed successfully, haveged has been installed and configured correctly and is running properly. Go to 8.
   • If the command fails to execute, haveged is not running properly. Run the following command to manually restart haveged and go to 9:

     systemctl restart haveged.service

6. Run the /bin/rpm -qa | grep -w "rng-tools" command to check the rng-tools installation and check whether the command output is empty.
   • If yes, contact the OS vendor to install and start haveged or rng-tools. Then go to 9.
   • If no, go to 7.

7. Run the ps -ef | grep -v "grep" | grep rngd | tr -d " " | grep "\-r/dev/urandom" command and check the command output.
   • If the command is executed successfully, rngd has been installed and configured correctly and is running properly. Go to 8.
   • If the command fails to execute, rngd is not running properly. Run the following command to manually restart rngd and go to 9:

     systemctl restart rngd.service

Check the entropy of the OS.

8. Manually check the entropy of the OS.

   Log in to the target node as user root and run the cat /proc/sys/kernel/random/entropy_avail command to check whether the entropy of the OS meets cluster installation requirements (no less than 100).

   • If yes, the entropy of the OS is not less than 100. Go to 9.
   • If no, the entropy of the OS is less than 100. Use either of the following methods and go to 9.
     • Method 1: Use haveged (true random number mode). Contact the OS vendor to install and start haveged.
     • Method 2: Use rng-tools (pseudo-random number mode). Contact the OS vendor to install and start rng-tools and configure it based on the OS type.

9. Wait until the system to check the entropy at 00:00 on the following day and check whether the alarm is cleared.
   • If yes, no further action is required.
   • If no, go to 10.

Collect fault information.

10. On FusionInsight Manager, choose O&M. In the navigation pane on the left, choose Log > Download.
11. Expand the Service drop-down list, select NodeAgent for the target cluster, and click OK.
12. Click the edit icon in the upper right corner, and set Start Date and End Date for log collection to 10 minutes ahead of and after the alarm generation time, respectively. Then, click Download.
13. Contact O&M engineers and provide the collected logs.

Alarm Clearance

This alarm is automatically cleared after the fault is rectified.

Related Information

None.