obbinlog创建后一直为convert_running: No

[AntTech_HSANCN]

大佬，请问下，我创建obbinlog后状态一直为convert_running: No，怎么回事，我的observer版本是oceanbase-ce. 4.2.5.7 obproxy-ce .4.3.5.0 obbinlog-ce.4.3.5
binlog_instance.log (149.1 KB)
libobcdc.log (2.7 MB)
,创建语句
CREATE BINLOG FOR TENANT obcluster.jwwl TO USER root PASSWORD xxxx WITH CLUSTER URL http://10.209.66.49:8080/services?Action=ObRootServiceInfo&ObCluster=obcluster, REPLICATE NUM 2;

[AntTech_HSANCN]

官方大佬，有解决办法莫

[淇铭]

看日志信息是libobcdc 在拉 tenant jwwl（tenant_id=1002）的 sys LS（ls_id=1）data dict 时，按时间戳找起始 LSN 失败 你把同时间的observer.log日志发一下

ob上查一下这个信息

SHOW PARAMETERS LIKE ‘%rpc%authentication%’;

SHOW PARAMETERS LIKE ‘ssl_client_authentication’;

[AntTech_HSANCN]

obclient(root@jwwl)[oceanbase]> SHOW PARAMETERS LIKE ‘%rpc%authentication%’;
±------±---------±-------------±---------±---------------------------------±----------±------±--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------±---------±--------±--------±------------------±--------------±----------+
| zone | svr_type | svr_ip | svr_port | name | data_type | value | info | section | scope | source | edit_level | default_value | isdefault |
±------±---------±-------------±---------±---------------------------------±----------±------±--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------±---------±--------±--------±------------------±--------------±----------+
| zone1 | observer | 10.209.66.49 | 2882 | rpc_server_authentication_method | NULL | ALL | specifies rpc server authentication method. ALL: support all authentication methods. NONE: without authentication. SSL_NO_ENCRYPT: authentication by SSL handshake but not encrypt the communication channel. SSL_IO: authentication by SSL handshake and encrypt the communication channel | OBSERVER | CLUSTER | DEFAULT | DYNAMIC_EFFECTIVE | ALL | 1 |
| zone1 | observer | 10.209.66.49 | 2882 | rpc_client_authentication_method | NULL | NONE | specifies rpc client authentication method. NONE: without authentication. SSL_NO_ENCRYPT: authentication by SSL handshake but not encrypt the communication channel. SSL_IO: authentication by SSL handshake and encrypt the communication channel | OBSERVER | CLUSTER | DEFAULT | DYNAMIC_EFFECTIVE | NONE | 1 |
±------±---------±-------------±---------±---------------------------------±----------±------±--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------±---------±--------±--------±------------------±--------------±----------+
2 rows in set (0.013 sec)

obclient(root@jwwl)[oceanbase]> SHOW PARAMETERS LIKE ‘ssl_client_authentication’;
±------±---------±-------------±---------±--------------------------±----------±------±-----------------------------------------------------------------------------------------±---------±--------±--------±------------------±--------------±----------+
| zone | svr_type | svr_ip | svr_port | name | data_type | value | info | section | scope | source | edit_level | default_value | isdefault |
±------±---------±-------------±---------±--------------------------±----------±------±-----------------------------------------------------------------------------------------±---------±--------±--------±------------------±--------------±----------+
| zone1 | observer | 10.209.66.49 | 2882 | ssl_client_authentication | NULL | True | enable server SSL support. Takes effect after ca/cert/key file is configured correctly. | OBSERVER | CLUSTER | DEFAULT | DYNAMIC_EFFECTIVE | False | 0 |
±------±---------±-------------±---------±--------------------------±----------±------±-----------------------------------------------------------------------------------------±---------±--------±--------±------------------±--------------±----------+
1 row in set (0.013 sec)
observer.log (32.8 MB)

[淇铭]

应该给你配置的RPC 鉴权有关系

在 sys 租户执行：

ALTER SYSTEM SET ssl_client_authentication = False;
SHOW PARAMETERS LIKE 'ssl_invited_nodes';
-- 若 value 是 ALL，改成 NONE，避免仍强制 SSL
ALTER SYSTEM SET ssl_invited_nodes = 'NONE';

改完重建/重启 obbinlog 看看是否还有问题

[AntTech_HSANCN]

ALTER SYSTEM SET ssl_client_authentication = False;这个修改了，倒是，成功了，安全要求开启ssl。请问下4.4.2有这个问题没得？

[淇铭]

如果要求开启 那你给 libobcdc 打开 SSL，并配上与 Observer 同一套 ca/cert/key，例如：
ssl_client_authentication=1

rpc_client_authentication_method=SSL_NO_ENCRYPT
证书路径按你们 Observer 的 ssl_external_kms_info / wallet 配置，obbinlog不会自动从 OB 把这些项灌进 libobcdc，需要在创建 obbinlog 的 extra config 里显式带上。

[AntTech_HSANCN]

我是用的obd命令方式部署的obbinlog， libobcdc 打开 SSL有没有相关的指导文档叻？

[淇铭]

https://www.oceanbase.com/docs/common-oceanbase-database-cn-1000000006619156 你看看这个文档 cdc配置项
https://www.oceanbase.com/docs/common-oblogproxy-doc-1000000006282204 binlog的配置 结合看看

[AntTech_HSANCN]

好的，感谢

[AntTech_HSANCN]

我把证书放到obbinlog目录里

ALTER BINLOG obcluster.jwwl SET EXTRA_OBCDC_CFG=ssl_client_authentication=1;
用这个修改报错

ALTER BINLOG bowhkrdfr3 SET EXTRA_OBCDC_CFG=ssl_client_authentication=1;
ALTER BINLOG jz8c9yje04 SET EXTRA_OBCDC_CFG=ssl_client_authentication=1;
我去修改了这个ssl_client_authentication参数，没生效

是我处理方式不对吗？

[淇铭]

不能只写一个参数，需要把 SSL 相关的完整配置一起写进去：
ALTER BINLOG obcluster.jwwl SET EXTRA_OBCDC_CFG=‘ssl_client_authentication=1 rpc_client_authentication_method=SSL_NO_ENCRYPT ssl_ca_file=/data/oceanbase/obbinlog-ce/wallet/ca.pem ssl_cert_file=/data/oceanbase/obbinlog-ce/wallet/client-cert.pem ssl_key_file=/data/oceanbase/obbinlog-ce/wallet/client-key.pem’;
修改后必须重启实例
STOP BINLOG INSTANCE ‘<instance_name>’;
START BINLOG INSTANCE ‘<instance_name>’;

[AntTech_HSANCN]

ALTER BINLOG obcluster.jwwl SET EXTRA_OBCDC_CFG=ssl_client_authentication=1 rpc_client_authentication_method=SSL_NO_ENCRYPT ssl_ca_file=/data/oceanbase/obbinlog-ce/wallet/ca.pem ssl_cert_file=/data/oceanbase/obbinlog-ce/wallet/client-cert.pem ssl_key_file=/data/oceanbase/obbinlog-ce/wallet/client-key.pem;
用上面的这条命令修改任务，报错

ALTER BINLOG bowhkrdfr3 SET EXTRA_OBCDC_CFG=ssl_client_authentication=1 rpc_client_authentication_method=SSL_NO_ENCRYPT ssl_ca_file=/data/oceanbase/obbinlog-ce/wallet/ca.pem ssl_cert_file=/data/oceanbase/obbinlog-ce/wallet/client-cert.pem ssl_key_file=/data/oceanbase/obbinlog-ce/wallet/client-key.pem;
ALTER BINLOG jz8c9yje04 SET EXTRA_OBCDC_CFG=ssl_client_authentication=1 rpc_client_authentication_method=SSL_NO_ENCRYPT ssl_ca_file=/data/oceanbase/obbinlog-ce/wallet/ca.pem ssl_cert_file=/data/oceanbase/obbinlog-ce/wallet/client-cert.pem ssl_key_file=/data/oceanbase/obbinlog-ce/wallet/client-key.pem;
用上面这两个修改实例，执行没得问题，但是下面两条命令重启报下面的错误
start BINLOG INSTANCE bowhkrdfr3;
start BINLOG INSTANCE jz8c9yje04;

[淇铭]

你这个是怎么连接修改 你发一下连接串 把日志也发一下

[AntTech_HSANCN]

我是登陆到obclient -h10.209.66.49 -P2983去修改的
libobcdc (2).log (1.3 MB)
binlog_instance.log (14.4 KB)
observer.log (31.0 MB)

[淇铭]

SHOW BINLOG INSTANCES;

你查一下 状态看看

[AntTech_HSANCN]

obclient(root@sys@sys)[(none)]> SHOW BINLOG INSTANCES;
±-----------±-----------±----------±-------------±-----±-----±-------±------±--------±--------±--------------±------------±-------------±----------------±--------------±------------±------------±-------------±---------------------------±----------------------------±--------±----------------------------±-----------------------------------------------±---------+
| name | ob_cluster | ob_tenant | ip | port | zone | region | group | running | state | obcdc_running | obcdc_state | service_mode | convert_running | convert_delay | convert_rps | convert_eps | convert_iops | convert_checkpoint_current | convert_checkpoint_earliest | dumpers | last_dumper_disconnect_time | version | odp_addr |
±-----------±-----------±----------±-------------±-----±-----±-------±------±--------±--------±--------------±------------±-------------±----------------±--------------±------------±------------±-------------±---------------------------±----------------------------±--------±----------------------------±-----------------------------------------------±---------+
| jz8c9yje04 | obcluster | jwwl | 10.209.66.49 | 8143 | | | | No | Offline | No | Offline | disabled | No | NULL | NULL | NULL | NULL | NULL | NULL | NULL | NULL | 4.3.5-836e752c3cfc137ae8606584d667681fc8fa50db | NULL |
| bowhkrdfr3 | obcluster | jwwl | 10.209.66.49 | 8142 | | | | No | Offline | No | Offline | disabled | No | NULL | NULL | NULL | NULL | NULL | NULL | NULL | NULL | 4.3.5-836e752c3cfc137ae8606584d667681fc8fa50db | NULL |
±-----------±-----------±----------±-------------±-----±-----±-------±------±--------±--------±--------------±------------±-------------±----------------±--------------±------------±------------±-------------±---------------------------±----------------------------±--------±----------------------------±-----------------------------------------------±---------+

[AntTech_HSANCN]

我看observer有包这个错，但是我用证书登陆是正常的。

[淇铭]

证书放到每个实例 work path下的 wallet/下```

ALTER BINLOG obcluster.jwwl SET EXTRA_OBCDC_CFG=
ssl_client_authentication=1 ssl_external_kms_info=file rpc_client_authentication_method=SSL_NO_ENCRYPT;

你这样执行 看看 之前的命令 可能有问题

[AntTech_HSANCN]

可以了，感谢官方大佬支持，谢谢。