Christian – Page 26

zypper-update-report (was: patch2mail for SLES10)

August 16, 2008August 8, 2014 Christian 2 Comments

Well, after some more refining I think I finally have a script I ain’t never gonna touch again (unless something breaks, which can happen quick as we all know).

The script now uses a sysconfig file for the common settings (like sender, receipents, categories to scan for), so it may be deployed en mass.

/etc/sysconfig/zypper-update-report

## Type: string
## Default: root
## Config: ""
#
# Sender address for the update report
FROM="Yourupdatemonkey "

## Type: string
## Default: root
## Config: ""
#
# Receiver address for the update report
#RECEIPENTS="tehsysadmin@barfoo.org"

## Type: string
## Default: "securty recommended optional"
## Config: ""
#
# List of groups, to include in the report
CLASSES="security recommended optional"

## Type: string

## Default: root

## Config: ""

# Sender address for the update report

FROM="Yourupdatemonkey "

## Type: string

## Default: root

## Config: ""

# Receiver address for the update report

#RECEIPENTS="tehsysadmin@barfoo.org"

## Type: string

## Default: "securty recommended optional"

## Config: ""

# List of groups, to include in the report

CLASSES="security recommended optional"

/usr/local/sbin/zypper-update-report

#!/bin/bash

# Checks the output of `zypper pch` for security/recommended/optional updates
# and prepares a detailed report to be mailed to the administrators

[ -f /etc/sysconfig/update-report ] || exit 1

source /etc/sysconfig/update-report

# Temporary files
TMPDIR="$( mktemp -d /tmp/update-report.XXXXXX )"
ZYPP_LIST="$TMPDIR/zypper-list"
ZYPP_DETAILS="$TMPDIR/zypper-details"
ZYPP_REPORT="$TMPDIR/zypper-report"
zypper pch 2&gt;/dev/null &gt; $ZYPP_LIST

# Figure out how much updates are still pending
PENDING="$( cat $ZYPP_LIST | grep "| Needed" | wc -l )"

if [ $PENDING -eq 0 ] ; then
  exit 0
fi

echo &gt; $ZYPP_REPORT
echo " Pending updates for $( domainname -f ) on $( date )" &gt;&gt; $ZYPP_REPORT

for severity in $CLASSES; do
  PACKAGES="$( cat $ZYPP_LIST | egrep "${severity}(.*)| Needed" | cut -d| -f2 | sed "s,^ ,," | sort -u )"
  [ -n "$PACKAGES" ] &amp;&amp; echo
  [ -n "$PACKAGES" ] &amp;&amp; echo "  Category: $severity"
  for package in $PACKAGES; do
    zypper patch-info $package 2&gt;/dev/null &gt; $ZYPP_DETAILS
    echo ""
    echo "  * Patch: $package"
    echo "    Needs reboot: $( cat $ZYPP_DETAILS | grep "Reboot Required:" | sed -e "s,Reboot Required: ,," )"
    echo "    Affected packages: "
    for atom in $( cat $ZYPP_DETAILS | grep "^atom:" | cut -d  -f2 | sort ); do
      # Let's check whether or not the package listed in atom is installed ...
      # If installed, echo the atom, otherwise don't as we don't need to update
      # the package.
      RPM_STATUS=$( rpm -qi $atom )
      if [ "$RPM_STATUS" != "package $atom is not installed" ] ; then
        echo "    - $atom "
      fi
    done
  done
done &gt;&gt; $ZYPP_REPORT

if [ -n "$RECEIPENTS" ] ; then
  cat $ZYPP_REPORT | mail -r "$FROM" -s "[$( date +%F )] Update report for $( domainname -f )" $RECEIPENTS
fi

trap "rm -rf "$TMPDIR" &gt;/dev/null 2&gt;&amp;1" ERR EXIT
# vim: set tw=80 ts=2 sw=2 et softtabstop=2

#!/bin/bash

# Checks the output of `zypper pch` for security/recommended/optional updates

# and prepares a detailed report to be mailed to the administrators

[ -f /etc/sysconfig/update-report ] || exit 1

source /etc/sysconfig/update-report

# Temporary files

TMPDIR="$( mktemp -d /tmp/update-report.XXXXXX )"

ZYPP_LIST="$TMPDIR/zypper-list"

ZYPP_DETAILS="$TMPDIR/zypper-details"

ZYPP_REPORT="$TMPDIR/zypper-report"

zypper pch 2>/dev/null > $ZYPP_LIST

# Figure out how much updates are still pending

PENDING="$( cat $ZYPP_LIST | grep "| Needed" | wc -l )"

if [ $PENDING -eq 0 ] ; then

exit 0

echo > $ZYPP_REPORT

echo " Pending updates for $( domainname -f ) on $( date )" >> $ZYPP_REPORT

for severity in $CLASSES; do

PACKAGES="$( cat $ZYPP_LIST | egrep "${severity}(.*)| Needed" | cut -d| -f2 | sed "s,^ ,," | sort -u )"

[ -n "$PACKAGES" ] && echo

[ -n "$PACKAGES" ] && echo " Category: $severity"

for package in $PACKAGES; do

zypper patch-info $package 2>/dev/null > $ZYPP_DETAILS

echo ""

echo " * Patch: $package"

echo " Needs reboot: $( cat $ZYPP_DETAILS | grep "Reboot Required:" | sed -e "s,Reboot Required: ,," )"

echo " Affected packages: "

for atom in $( cat $ZYPP_DETAILS | grep "^atom:" | cut -d -f2 | sort ); do

# Let's check whether or not the package listed in atom is installed ...

# If installed, echo the atom, otherwise don't as we don't need to update

# the package.

RPM_STATUS=$( rpm -qi $atom )

if [ "$RPM_STATUS" != "package $atom is not installed" ] ; then

echo " - $atom "

done

done >> $ZYPP_REPORT

if [ -n "$RECEIPENTS" ] ; then

cat $ZYPP_REPORT | mail -r "$FROM" -s "[$( date +%F )] Update report for $( domainname -f )" $RECEIPENTS

trap "rm -rf "$TMPDIR" >/dev/null 2>&1" ERR EXIT

# vim: set tw=80 ts=2 sw=2 et softtabstop=2

Debugging “rug”

August 15, 2008June 21, 2013 Christian Leave a comment

Well, it’s 7pm. I’m sitting at home and thinking about why in gods name rug isn’t adding my update repository. I can add the service using yast inst_source, but when yast then syncs with ZenWorks, it tells me something like:

Failed to get repomd/repodata.xml; Reason: 530 – Access denied

So my fellow co-worker turned on the debug-logging and we quickly found out why: rug isn’t using the command line credentials I was passing.

Now I only need to find out, why rug isn’t using them, and how I’m able to pass username and password to rug .. Or not, after looking through the Novell community, I found bug 204741 in Novell’s bugzilla. Guess, what .. It’s marked WONTFIX (or whatever, I can’t view the duplicate bug).

Suspected NRPE weirdness

August 10, 2008June 21, 2013 Christian Leave a comment

Well, I just noticed a really weird thing, when you have command line arguments enabled.

Here’s a snippet from my nrpe.cfg:

dont_blame_nrpe=1
command[check_disk]=/usr/lib/nagios/plugins/check_disk -E -w $ARG1$ -c $ARG2$ -p $ARG3$

1 2	dont_blame_nrpe=1 command[check_disk]=/usr/lib/nagios/plugins/check_disk -E -w $ARG1$ -c $ARG2$ -p $ARG3$

Now, if you’d check the free space for the root, it ain’t gonna show any inode percentage (that one isn’t what I’m talking about). But if you have to use bind mounts like I do (Tivoli needs a separate “domain” — that is a separate mount point for each domain), you might wanna check the free space on the *real* device, rather than the free space on the bind mount (which is gonna show you the free space of the parent file system – in my case the root fs).

Let’s take a look at what I’m talking about. If you use the check_disk locally like this:

./check_disk -w 20% -c 10% -p /apache/
DISK OK - free space: /apache 11090 MB (36% inode=36%);| /apache=19629MB;24575;27647;0;30719

1 2	./check_disk -w 20% -c 10% -p /apache/ DISK OK - free space: /apache 11090 MB (36% inode=36%);\| /apache=19629MB;24575;27647;0;30719

Means, everything is okay, you have to pass the extra trailing slash to the –partition argument, as otherwise it would pick up the bind mount at /backup.

Now, if we do the above by means of NRPE, that’s gonna get you a different result. As I showed above, I have the check_disk command in my nrpe.cfg, I also specifically enabled command arguments during compile time.

./check_nrpe -H nagios.home.barfoo.org -c check_disk -a 20% 5% /apache/
DISK CRITICAL: /apache/ not found

1 2	./check_nrpe -H nagios.home.barfoo.org -c check_disk -a 20% 5% /apache/ DISK CRITICAL: /apache/ not found

Now, why the hell isn’t it picking up the *original* mount point of the file system ? Guess why … Because I added -E to the command, because it didn’t use the original mount point but rather the bind mount in /backup. Removing the -E and it picks up the *original* mount point without any trouble *shrug*.

Nagios 3 and hostgroup inheritance

August 8, 2008August 8, 2014 Christian Leave a comment

As I wrote some time ago, I was trying to utilize Nagios 3.x’s neat feature of “nested” hostgroups. Well, as it turned out I thought it worked differently; basically like this:

define hostgroup {
        hostgroup_name      a-parent-hostgroup
        alias               Our toplevel parent hostgroup
}

define service {
       use                  generic-service
       check_command        check_dummy!0!
       service_description  SSH
       hostgroup_name       a-parent-hostgroup
}

define hostgroup {
        hostgroup_name      a-child-hostgroup
        hostgroup_members   a-parent-hostgroup
        alias               Our child hostgroup
}

define service {
       use                  generic-service
       check_command        check_dummy!0!
       service_description  LOAD
       hostgroup_name       a-child-hostgroup
}

define hostgroup {

hostgroup_name a-parent-hostgroup

alias Our toplevel parent hostgroup

}

define service {

use generic-service

check_command check_dummy!0!

service_description SSH

hostgroup_name a-parent-hostgroup

}

define hostgroup {

hostgroup_name a-child-hostgroup

hostgroup_members a-parent-hostgroup

alias Our child hostgroup

}

define service {

use generic-service

check_command check_dummy!0!

service_description LOAD

hostgroup_name a-child-hostgroup

}

As you can cleary see on line 14, I thought you define the relation between two hostgroups in the child hostgroup. The problem with it was basically (as I said in the earlier posts), that all the services defined for the child hostgroups are handed on upwards to the parent hostgroup(s).

But after talking to Tobi, I quickly found out, that the relation is in fact defined within the parent hostgroup. So if you simply put hostgroup_members within the parent hostgroup and define all child hostgroups which should inherit from the parent one, you should be just fine.

Nagios 3.x and check_pcmeasure.pl

August 7, 2008August 8, 2014 Christian Leave a comment

Recently we purchased a MessPC station for our server room, and my co-worker and myself had the wish it to be integrated within Nagios. Well, so far so good. The first I did was put both keywords into Google.

That pretty fast brought up the manufacturer’s page (sorry it’s German only) about the device supporting Nagios by means of either SNMP or a specific plugin called pcmeasure. So I went ahead and tried both ways.

Using SNMP has the advantage that it’s quickly integrated into Nagios and it doesn’t need a separate plugin for that to work. But it also has a huge disadvantage. check_snmp doesn’t support performance data, which is quite handy if you do want to do graphing from Nagios’ results.

Next I tried the pcmeasure plugin. At first it worked great (that is from plain command line), but then I tried to integrate it into Nagios (well, I did integrate it); but got “Plugin did not exit properly”.

Today, after I had the plugin commented out for about two weeks, I finally had time to look at the issue again. First I thought, simply using utils.pm’s error values would be sufficient for ePN to quit yapping, but apparently it had *real* problems with the pod2usage used within.

So I basically rewrote the plugin (well, not really; it’s still the same – but without the pod2usage and working in Nagios 3.0.3).

More VirtualCenter troubles (fini)

August 7, 2008August 16, 2014 Christian Leave a comment

Well, today the support request came back. Seems one of the originally linked VMTN dicussions really is the only way:

Export the customization specification
Edit the XML file
Import it again

The related part inside the customization specification should then look like this:

&lt;type&gt;vim.vm.customization.Password&lt;/type&gt;
&lt;plainText&gt;true&lt;/plainText&gt;
&lt;value&gt;Password01&lt;/value&gt;
&lt;/password&gt;

<type>vim.vm.customization.Password</type>

<value>Password01</value>

</password>

So if you ever think about switching the default VirtualCenter certificate (for whatever reason), make sure you use the above workaround. Otherwise VirtualCenter is gonna fail miserably during the customization phase of the cloning process.

More VirtualCenter troubles

August 4, 2008June 21, 2013 Christian 1 Comment

Well, after my co-worker switched the VirtualCenter certificates with one produced by our RA a few days ago, I can’t clone anything using a customization specification anymore.

Unable to decrypt passwords in customization specification

Guess, we’re shit outa luck. At least both of those linked VMTN discussions don’t contain any (that is for us) workable solution (well besides storing the password in cleartext in the spec — which ain’t sooo good). Gonna bug him tomorrow to open up a VMware support request, maybe that’ll help somewhat. I sure hope so.

SUSE Linux Enterprise Server 10 on VMware ESX (finished)

July 30, 2008August 16, 2014 Christian Leave a comment

As I pointed out in my past posts, I was having some weird errors with SLES10 regarding mounting CD images inside the guest (as well, as it turned out, on the physical hardware).

Now, finally, after about a week or so Novell finally released an updated kernel package today. So the error per se is fixed, I can use my CD drives again, as well as update my virtual machines by means of virtual center, without the trickery of copying the linux.iso from /vmimages/tools to the guest and mount it by means of mount -o loop.

Yet another VMware error

July 30, 2008June 21, 2013 Christian Leave a comment

Today I was moving a pretty standard SLES10 virtual machine to another host, when the migration dialog showed me this:

And if you now think, the virtual machine is something special take a look at those settings:

I don’t know what to think about that error message. Googling for it doesn’t reveal that much about it. If anyone out there got an idea, I’m open for suggestions.

Fixing vmkernel symlinks

July 30, 2008June 21, 2013 Christian Leave a comment

Since I do happen to be in the situation pretty often where the kernel inside a VM is newer than what VMware currently has in their tools (as in the SUSE kernel is newer than the binary modules built by VMware), here’s a quick reminder for myself on how to to fix the .ko symlinks.

for file in /lib/modules/$( uname -r )/misc/*.ko ; 
do
 rm $file &amp;&amp; 
 ln -s /lib/modules/$( uname -r )/misc/${file/.ko/.o} $file 
done

for file in /lib/modules/$( uname -r )/misc/*.ko ;

rm $file &&

ln -s /lib/modules/$( uname -r )/misc/${file/.ko/.o} $file

done