Re: [HTCondor-users] All Jobs Idle

[Todd Tannenbaum <tannenba@xxxxxxxxxxx>]

On 3/10/2020 12:06 PM, Justin Fisher wrote:
> Hi.
>
> I wonder if someone might be able to point me in the right direction? I submit a job to condor and it just sits idle. 
> Using Centos 7, my SELINUX is disabled and my firewall is off on all machines.
>
> condor_version
> $CondorVersion: 8.8.7 Dec 24 2019 BuildID: 493225 PackageID: 8.8.7-1 $
> $CondorPlatform: x86_64_RedHat7
>
> condor_status tells me that all my machines are unclaimed.
>
> My negotiator log is telling me to check my ALLOW settings, but I don't know what to look for here.
>
> Here is some relevant data:

Hi Justin,

After doing a quick look at the logs you sent below, here is my guess as to what is happening:  You have CONDOR_HOST set 
to be "jfisher.ingenazure.com", and my guess is there is no reverse address lookup on your server that would allow 
HTCondor to convert the IP address 192.168.0.206 to "jfisher.ingenazure.com".  So when the condor_negotiator is 
attempting to connect to the condor_schedd, the schedd refuses the connection because ALLOW_NEGOTIATOR is set to 
$(CONDOR_HOST), the schedd fails to convert 192.168.0.206 into a hostname (because the reverse address lookup fails), 
and thus the schedd refused the connection.

Suggestions on how to fix:

1. Fix inverse address mapping on your server(s).  If you are unable to do this or it is difficult in your setup, see 
alternate suggestions below.... How accomplish this depends on your setup (host files? dns? NIS? ldap? edit 
/etc/nsswitch.conf? ), but maybe adding to /etc/hosts
   192.168.0.206 jfisher.ingenazure.com

OR

2. In your condor_config, change
   CONDOR_HOST = jfisher.ingenazure.com
to instead be
   CONDOR_HOST = 192.168.0.206

OR

3. Add IP addresses (or address ranges) to ALLOW_NEGOTIATOR.

Hope the above helps.

BTW, if you are running an HTCondor pool on just one server (looks like perhaps you are?), perhaps you want to yum 
install the minicondor package instead of the condor package.  The minicondor package is all pre-configured to work 
securely on just one host.

Hope the above helps,
Todd