creation failed on byol template

[giulianozor]

Hi, I'm trying yo deploy the BYOL template using the quickstart docs. After 54 minutes the deployment fails with this error This happens with v.5.22 from official docs links and with v.5.27 from github

Timestamp	Logical ID	Status	Status reason
2019-09-27 13:24:40 UTC+0900	MasterMP	DELETE_IN_PROGRESS	-
2019-09-27 13:24:28 UTC+0900	Deep-Security	ROLLBACK_IN_PROGRESS	The following resource(s) failed to create: [MasterMP]. . Rollback requested by user.
2019-09-27 13:24:27 UTC+0900	MasterMP	CREATE_FAILED	Embedded stack arn:aws:cloudformation:ap-northeast-1:521406273796:stack/Deep-Security-MasterMP-9F5D63BVBSY3/1a8253d0-e0d7-11e9-91eb-06fa24220ee8 was not successfully created: The following resource(s) failed to create: [DSM1CompleteWaitCondition].
2019-09-27 12:30:09 UTC+0900	MasterMP	CREATE_IN_PROGRESS	Resource creation Initiated
2019-09-27 12:30:07 UTC+0900	MasterMP	CREATE_IN_PROGRESS	-
2019-09-27 12:30:00 UTC+0900	Deep-Security	CREATE_IN_PROGRESS	User Initiated

Any idea on how to fix this ? I could not find a more helpful log... User has full administrator access

thanks

[bryantice]

Hi ,

Could I get some additional info from you please? In which region were you creating the environment? Would you be able to share the parameters you used (except passwords of course).

Did the template roll back the other nested templates and the infrastructure? If it did, the data we need to diagnose was probably deleted. Could you run the template again but under Stack Create Options on the last page could you please switch the Rollback on Failure to Disabled?

If the environment is still there, or you've run it again this is some of the info we're looking for.

Sometimes the nested template were the failure happened will have another error message. I don't remember if the DSMNode1 template will show an error if it times out, but it might. That's the first place to look.

In the outputs for the master template you should see a DeepSecurityConsole entry (it should be the only one). It will have the elb name. Could you please go to that ELB in the EC2 console and see if the instance behind it is In Service? If it is not, could you please ssh into that instance. We're looking for

1. make sure /opt/dsm is present
2. output of service dsm_s status (need to be root or sudo)
3. the install.log and the server*.log if they exist in /opt/dsm.

Thank you!

[bryantice]

Hi,

There are a few other files we can look at if you can ssh into that first instance:

/tmp/dsmInstallLog

/var/log/cfn-init.log /var/log/cfn-init-cmd.log /var/log/cloud-init.log

/etc/cfn/dsmConfiguration.properties
(please note this includes the customer input from the CF stack options. please remove any username, passwords or other data that might be considered sensitive.

/tmp/4-check-service /tmp/internallistener.log /tmp/set-lbSettings.log /etc/cfn/reactivate-manager.log /cfn-rh-helper.log

/tmp/listener.log /mgract.log

Thanks!

[giulianozor]

Hello, region is ap-northeast-1. I recreated everything without the rollback, using the templates/quickstart/Infrastructure.template for the vpn and the /templates/quickstart/trendmicro-deepsecurity-byol-master.template for the DSM.

The parameters I've changed from default:

• stack name
• admin password
• vpc and networks created by the infrastructure template
• DB as postgresql, admin password
• automatic rollback on failure

and now it worked... No idea why. I started the deployment, then had something else to do. When I returned it was compleded...

[bryantice]

Hi,

That is odd, but glad it worked. Let me know if you have any other questions, but if I don't hear back from you by eod tomorrow, I'll close out this case as done.

Thanks!