I cannot reproduce the problem. I tried it with a cib larger than 10404672 bytes and with a cib larger than 20944671 bytes too. Command `pcs resource create` succeeded. Command `pcs resource enable` failed because the command `crm_mon` failed:


[ant ~] $ rpm -q pcs python-libs python-lxml libxml2
pcs-0.9.158-6.el7.x86_64
python-libs-2.7.5-58.el7.x86_64
python-lxml-3.2.1-4.el7.x86_64
libxml2-2.9.1-6.el7_2.3.x86_64

[ant ~] $ wc testing.xml 
  220012   480014 10404672 testing.xml
[ant ~] $ pcs resource create A ocf:heartbeat:Dummy -f testing.xml
[ant ~] $ echo $?
0
[ant ~] $ wc testing.xml                                                                                                             
  200017   480037 11185048 testing.xml
  
[ant ~] $ pcs resource enable A -f testing.xml --debug > testing.log
Error: error running crm_mon, is pacemaker running?
[ant ~] $ cat testing.log|grep "Running: /usr/sbin/crm_mon" -A6
Running: /usr/sbin/crm_mon --one-shot --as-xml --inactive
Environment:
  CIB_file=/tmp/tmpfilNbQ.pcs
  LC_ALL=C

Finished running: /usr/sbin/crm_mon --one-shot --as-xml --inactive
Return value: -9

[ant ~] $ CIB_file=testing.xml crm_mon --one-shot --as-xml --inactive                                                                
zsh: killed     CIB_file=testing.xml crm_mon --one-shot --as-xml --inactive
[ant ~] $ echo $?
137

Could you please provide your cib and versions of python-lxml and libxml2?

Interesting. I don't get that far.
--debug just shows the cibadmin being requested and the parsing failing.

versions:

[root@c09-h05-r630 pcs]# rpm -qa python-lxml libxml2
libxml2-2.9.1-6.el7_2.3.x86_64
python-lxml-3.2.1-4.el7.x86_64

(In reply to Andrew Beekhof from comment #3)
> Interesting. I don't get that far.
> --debug just shows the cibadmin being requested and the parsing failing.
> 
Could you please provide your cib and output of --debug?


We found out that for 20 MB cib the cibadmin allocated about 600 MB of memory. When there was not enough memory, cibadmin was killed. We tried to set the amount of memory in such a way that cibadmin would finish and pcs would failed. But we did not manage it. How many free memory do you have when you run the failing command?

Will attach the whole cib.


[root@c09-h05-r630 pcs]# pcs --debug resource disable scale49-bundle-4
Running: /usr/sbin/cibadmin --local --query
Environment:
  LC_ALL=C

Finished running: /usr/sbin/cibadmin --local --query
Return value: 0
--Debug Stdout Start--
<cib crm_feature_set="3.0.14" validate-with="pacemaker-2.8" epoch="4648" num_updates="23" admin_epoch="0" cib-last-written="Mon Oct 30 05:42:59 2017" update-origin="c09-h06-r630" update-client="crmd" update-user="hacluster" have-quorum="1" dc-uuid="2">
  <configuration>
    <crm_config>
...
    </node_state>
  </status>
</cib>

--Debug Stdout End--
--Debug Stderr Start--

--Debug Stderr End--

Error: unable to get cib, xml does not conform to the schema

Created attachment 1345677 [details]
Full output of pcs resource disable

Also, putting the xml from that output into a file and running:

[12:05 PM] beekhof@fedora ~/Development/sources/pacemaker/devel ☺ # xmllint --relaxng /usr/share/pacemaker/pacemaker-2.10.rng full.xml

Results in: "full.xml validates"

The issue is reproducible with the cib extracted from given log.
The following script shows the cause of the problem:

import sys
from lxml import etree
with open(sys.argv[1], "r") as xml_file:
    etree.fromstring(xml_file.read().encode("utf-8"))
    
[ant ~] $ python reproducer.py cib.big.xml
Traceback (most recent call last):
  File "reproducer.py", line 6, in <module>
    etree.fromstring(xml_file.read().encode("utf-8"))
  File "lxml.etree.pyx", line 2993, in lxml.etree.fromstring (src/lxml/lxml.etree.c:63070)
  File "parser.pxi", line 1617, in lxml.etree._parseMemoryDocument (src/lxml/lxml.etree.c:93194)
  File "parser.pxi", line 1495, in lxml.etree._parseDoc (src/lxml/lxml.etree.c:92003)
  File "parser.pxi", line 1011, in lxml.etree._BaseParser._parseDoc (src/lxml/lxml.etree.c:88660)
  File "parser.pxi", line 577, in lxml.etree._ParserContext._handleParseResultDoc (src/lxml/lxml.etree.c:84385)
  File "parser.pxi", line 676, in lxml.etree._handleParseResult (src/lxml/lxml.etree.c:85488)
  File "parser.pxi", line 616, in lxml.etree._raiseParseError (src/lxml/lxml.etree.c:84811)
lxml.etree.XMLSyntaxError: internal error: Huge input lookup, line 87985, column 184
  
It is possible to fix it by:
etree.fromstring(xml_file.read().encode("utf-8"), etree.XMLParser(huge_tree=True))
    
    
From some reasons the lxml parsing succeeds with the huge cib that I generated.

    
Note that the error message

"Error: unable to get cib, xml does not conform to the schema"

should be corrected.

(In reply to Ivan Devat from comment #8)
> From some reasons the lxml parsing succeeds with the huge cib that I
> generated.

Quite weird that!

Thanks for tracking this one down, glad there's an easy fix

Created attachment 1348965 [details]
proposed fix

After fix:
[root@rhel75-node1 ~]# rpm -q pcs
pcs-0.9.162-1.el7.x86_64

> cib from attachment 1345677 [details] is in file provided-cib.xml
[root@rhel75-node1 ~]# wc provided-cib.xml 
   87994   720882 19545180 provided-cib.xml
[root@rhel75-node1 ~]# pcs -f provided-cib.xml resource disable c09-h11-r630
[root@rhel75-node1 ~]# echo $?
0

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0866