PowerScale：OneFS：缺少與 SmartConnect 區域名稱 （SCZN） 不相符的 SPN 警示
Summary: 叢集回報 AD 伺服器在服務主體名稱 （SPN） 的 Superna 容錯移轉或故障復原後，與任何叢集 SmartConnect 區域名稱相符時，缺少所需的 SPN。
This article applies to
This article does not apply to
This article is not tied to any specific product.
Not all product versions are identified in this article.
Symptoms
完成 Superna 容錯移轉/故障復原程序以指定主要 PowerScale 叢集後，您可能會在次要叢集上看到下列錯誤。
2.365102 10/21 09:26 I 0 729106 AD server missing needed SPN(s) HOST/eyeglasstest.example.org, HOST/eyeglasstest, nfs/eyeglasstest.example.org, nfs/eyeglasstest; try 'isi auth ads spn check EXAMPLE.ORG' 2.365089 10/21 09:11 I 0 729106 AD server missing needed SPN(s) HOST/eyeglasstest.example.org, HOST/eyeglasstest, nfs/eyeglasstest.example.org, nfs/eyeglasstest; try 'isi auth ads spn check EXAMPLE.ORG'
經過調查，您可能會發現缺少的SPN與輔助群集上的任何網路池名稱不同。
例如，如果 PowerScale 叢集 A 顯示遺失的 SPN 警示：
叢集名稱：clusterA
SPN 檢查報告缺少的 SPN：
clusterA-1# isi auth ads spn check EXAMPLE.ORG Possible missing SPNs: HOST/eyeglasstest.example.org HOST/eyeglasstest nfs/eyeglasstest.example.org nfs/eyeglasstest Possible extra SPNs: nfs/igls-original-eyeglasstest
沒有任何網路集區名稱相符，並以「isi 網路集區清單 -v」顯示。缺少的SPN和網路池名稱必須完全匹配。包含部分缺失的SPN的不相關、相似的名稱不計算在內。
叢集 A 的網路集區：
clusterA-1# isi network pools list -v ID: groupnet0.subnet0.pool0 Groupnet: groupnet0 Subnet: subnet0 Name: pool0 Rules: rule0 Access Zone: System Allocation Method: static Aggregation Mode: lacp Description: Initial 10gige-1 pool Firewall Policy: default_pools_policy Ifaces: 1:10gige-agg-1, 2:10gige-agg-1, 3:10gige-agg-1, 4:10gige-agg-1, 5:10gige-agg-1, 6:10gige-agg-1 IP Ranges: 172.20.14.41-172.20.14.46 IPv6 Perform DAD: No Rebalance Policy: auto SC Failover Policy: round_robin Static Routes: - NFSv3 RDMA RRoCE only: No SC Suspended Nodes: - SC Connect Policy: round_robin SC Zone: d8fs14.example.org SC DNS Zone Aliases: igls-ignore-vlan14.example.org SC Subnet: subnet0 SC TTL: 0 -------------------------------------------------------------------------------- ID: groupnet0.subnet1.Eyeglass_Pool Groupnet: groupnet0 Subnet: subnet1 Name: Eyeglass_Pool Rules: - Access Zone: EyeglassRunbookRobot Allocation Method: static Aggregation Mode: lacp Description: Firewall Policy: default_pools_policy Ifaces: 1:10gige-agg-1 IP Ranges: 172.20.15.6-172.20.15.6 IPv6 Perform DAD: No Rebalance Policy: auto SC Failover Policy: round_robin Static Routes: - NFSv3 RDMA RRoCE only: No SC Suspended Nodes: - SC Connect Policy: round_robin SC Zone: igls-original-eyeglasstest.example.org SC DNS Zone Aliases: igls-robot-oco.example.org SC Subnet: subnet1 SC TTL: 0 -------------------------------------------------------------------------------- ID: groupnet0.subnet1.pool0 Groupnet: groupnet0 Subnet: subnet1 Name: pool0 Rules: - Access Zone: prod Allocation Method: static Aggregation Mode: lacp Description: Firewall Policy: default_pools_policy Ifaces: 1:10gige-agg-1, 2:10gige-agg-1, 3:10gige-agg-1, 4:10gige-agg-1, 5:10gige-agg-1, 6:10gige-agg-1 IP Ranges: 172.20.15.41-172.20.15.46 IPv6 Perform DAD: No Rebalance Policy: auto SC Failover Policy: round_robin Static Routes: - NFSv3 RDMA RRoCE only: No SC Suspended Nodes: - SC Connect Policy: round_robin SC Zone: igls-original.example.org SC DNS Zone Aliases: igls-prod.example.org SC Subnet: subnet1 SC TTL: 0
檢查新的主要叢集 clusterB 時，您可以找到與遺失的 SPN 相符的 SmartConnect Pool 名稱。這是在輔助群集 clusterA 上的警報中引用的 SPN。
叢集名稱：clusterB
具有該 SPN + 池名稱的生產群集：
clusterB-1# isi auth ads spn list EXAMPLE.ORG | grep -i eyeglasstest SPN ---------------------------------------------------- nfs/eyeglasstest nfs/eyeglasstest.example.org HOST/eyeglasstest HOST/eyeglasstest.example.org
主要叢集的網路集區名稱
clusterB-1# isi network pools list -v ID: groupnet0.subnet1.Eyeglass_Pool Groupnet: groupnet0 Subnet: subnet1 Name: Eyeglass_Pool Rules: - Access Zone: EyeglassRunbookRobot Allocation Method: static Aggregation Mode: lacp Description: Used for Eyeglass test failover Firewall Policy: default_pools_policy Ifaces: 1:10gige-agg-1 IP Ranges: 172.29.28.5-172.29.28.5 IPv6 Perform DAD: No Rebalance Policy: auto SC Failover Policy: round_robin Static Routes: - NFSv3 RDMA RRoCE only: No SC Suspended Nodes: - SC Connect Policy: round_robin SC Zone: eyeglasstest.example.org <<<<<<<<<<<<<<<<<<< SC DNS Zone Aliases: igls-robot-rco.example.org SC Subnet: subnet1 SC TTL: 0
Cause
Superna 使用下列命令來新增和移除 SPN。它們還指定與AD域中的SPN關聯的計算機帳戶。
2025-02-04T09:33:03,953 SSH /172.20.14.37 echo '[REDACTED]' | sudo -S -k -p "" isi auth ads spn delete EXAMPLE.ORG HOST/eyeglasstest.example.org --machine-account clusterA$ 2>&1;echo 0 2025-02-04T09:33:05,568 SSH /172.20.14.37 echo '[REDACTED]' | sudo -S -k -p "" isi auth ads spn delete EXAMPLE.ORG HOST/eyeglasstest --machine-account clusterA$ 2>&1;echo 0 2025-02-04T09:33:07,180 SSH /172.20.14.37 echo '[REDACTED]' | sudo -S -k -p "" isi auth ads spn delete EXAMPLE.ORG nfs/eyeglasstest.example.org --machine-account clusterA$ 2>&1;echo 0
在 OneFS 9.5.1.1 中推出的「--machine-account」選項可未如預期運作。使用時，設置了標誌的命令不會從輔助群集中刪除額外的SPN。
Resolution
解決方法是使用該群集的 CLI 從受影響的第二個群集中手動刪除該群集的 SPN。在 Superna 容錯移轉/故障復原後，必須在沒有「--machine-account」選項的情況下完成此作業。也可以安全地忽略這些消息，因為如果沒有關聯的 SmartConnect 池名稱，輔助群集上就不需要丟失 SPN。
# isi auth ads spn delete <SPN 名稱> --zone=<zone name>
Affected Products
Isilon, PowerScale OneFSProducts
Isilon Gen6.5Article Properties
Article Number: 000285197
Article Type: Solution
Last Modified: 11 Aug 2025
Version: 2
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.