Bug 40605 - UMC system diagnostic module should run samba-tool dbcheck
UMC system diagnostic module should run samba-tool dbcheck
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: UMC - System diagnostic
UCS 4.2
Other Linux
: P5 enhancement (vote)
: UCS 4.2-2-errata
Assigned To: Lukas Oyen
Arvid Requate
:
Depends on:
Blocks: 45277
  Show dependency treegraph
 
Reported: 2016-02-08 21:09 CET by Stefan Gohmann
Modified: 2017-09-20 15:03 CEST (History)
6 users (show)

See Also:
What kind of report is it?: Feature Request
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Ticket number:
Bug group (optional):
Max CVSS v3 score:
oyen: Patch_Available+


Attachments
samba_tool_dbcheck.py (948 bytes, text/plain)
2016-09-30 14:04 CEST, Julius Hinrichs
Details
40605-diagnostic-samba-tool-dbcheck-420.patch (10.29 KB, patch)
2017-06-01 18:09 CEST, Lukas Oyen
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Stefan Gohmann univentionstaff 2016-02-08 21:09:57 CET
samba-tool dbcheck should be added to the UMC system diagnostic module.
Comment 1 Julius Hinrichs univentionstaff 2016-09-30 14:04:10 CEST
Created attachment 8058 [details]
samba_tool_dbcheck.py
Comment 2 Lukas Oyen univentionstaff 2017-06-01 18:09:43 CEST
Created attachment 8895 [details]
40605-diagnostic-samba-tool-dbcheck-420.patch

The attached patch refines Julius' version of the `samba-tool dbcheck`
diagnostic plugin: It is only run, if `Samba 4` is active as a service. In case
of an error, execution of `samba-tool dbcheck --fix --yes` is offered.
Comment 3 Lukas Oyen univentionstaff 2017-08-01 16:33:50 CEST
Committed in r81631 - r81633 (advisory r81649).
Comment 5 Lukas Oyen univentionstaff 2017-08-02 14:42:43 CEST
(In reply to Florian Best from comment #4)
> Could you have a look why it fails on a regular Samba 4 DC Master:
> http://jenkins.knut.univention.de:8080/job/UCS-4.2/job/UCS-4.2-1/job/
> AutotestJoin/52/SambaVersion=s4,Systemrolle=master/testReport/60_umc/
> 106_diagnosic_checks/test/

I have no idea. This is not specific to the diagnostic test, but `samba-tool dbcheck`, I get the following an a clean UCS 4.2-1 with Samba4:

root@ucs-master50:~# samba-tool dbcheck
Checking 224 objects
ERROR: incorrect DN SID component for member in object CN=Domain Users,CN=Groups,DC=loyen,DC=intranet - <GUID=aa9afab4-1ec4-44c1-b877-aa5c369d1124>;<RMD_ADDTIME=131387260330000000>;<RMD_CHANGETIME=131387260330000000>;<RMD_FLAGS=0>;<RMD_INVOCID=a2071df6-2b17-41a9-bb68-d7adb3afe95c>;<RMD_LOCAL_USN=3732>;<RMD_ORIGINATING_USN=3732>;<RMD_VERSION=0>;CN=Administrator,CN=Users,DC=loyen,DC=intranet
Not fixing SID component mismatch
Please use --fix to fix these errors
Checked 224 objects (1 errors)
Comment 6 Arvid Requate univentionstaff 2017-08-02 14:50:48 CEST
The test case should not assume that this diagnostic check always signals that everything is ok. Instead it should check if the diagnostic check works.

In this case that means: If it fails, run samba-tool dbcheck --cross-ncs --fix --yes and after that check the return code of samba-tool dbcheck --quiet. If that is ok, the test should run the diagnostic module again. If that still fails then test may decide to report that as an error.
Comment 7 Lukas Oyen univentionstaff 2017-08-02 15:13:56 CEST
(In reply to Arvid Requate from comment #6)

> In this case that means: If it fails, run samba-tool dbcheck --cross-ncs
> --fix --yes and after that check the return code of samba-tool dbcheck
> --quiet. If that is ok, the test should run the diagnostic module again. If
> that still fails then test may decide to report that as an error.

r81709: use --cross-ncs in samba-tool dbcheck diagnostic fix
Comment 8 Florian Best univentionstaff 2017-08-02 16:21:26 CEST
Typo in german translation "Teste die locale AD Datenbank auf Fehler"
s/locale/lokale/
Comment 9 Lukas Oyen univentionstaff 2017-08-02 16:38:51 CEST
(In reply to Florian Best from comment #8)
> Typo in german translation "Teste die locale AD Datenbank auf Fehler"
> s/locale/lokale/

Fixed in r81715.
Comment 10 Florian Best univentionstaff 2017-08-02 16:48:24 CEST
When trying to fix the problem the following traceback occurs:

Traceback (most recent call last):
  File "/usr/lib/pymodules/python2.7/univention/management/console/modules/diagnostic/__init__.py", line 263, in execute
    result = execute(umc_module, **kwargs)
  File "/usr/lib/pymodules/python2.7/univention/management/console/modules/diagnostic/plugins/samba_tool_dbcheck.py", line 59, in run_samba_tool_dbcheck_fix
    run(umc_instance, rerun=True, fix_log='\n'.join(fix_log))
  File "/usr/lib/python2.7/encodings/utf_8.py", line 16, in decode
    return codecs.utf_8_decode(input, errors, True)
UnicodeDecodeError: 'utf8' codec can't decode byte 0xf0 in position 6659: invalid continuation byte
Comment 11 Florian Best univentionstaff 2017-08-02 17:07:02 CEST
Suggestion (it seems samba-tool prints non-utf-8 characters!):
-»   fix_log.append(output)
+»   fix_log.append(output.decode('utf-8', 'replace'))
Comment 12 Florian Best univentionstaff 2017-08-02 17:11:15 CEST
(In reply to Arvid Requate from comment #6)
> The test case should not assume that this diagnostic check always signals
> that everything is ok. Instead it should check if the diagnostic check works.
> 
> In this case that means: If it fails, run samba-tool dbcheck --cross-ncs
> --fix --yes and after that check the return code of samba-tool dbcheck
> --quiet. If that is ok, the test should run the diagnostic module again. If
> that still fails then test may decide to report that as an error.

There is not generic "repair" function in the checks. Each check does something individual. I don't think it's good in ucs-test to execute that repair logic - it might introduce other bugs, it might fix bugs we then don't recognize.

I can blacklist this test for the test case if you want. IMO a new installed UCS should not have any problems which are detected by the diagnostic module.
Comment 13 Lukas Oyen univentionstaff 2017-08-02 17:18:38 CEST
(In reply to Florian Best from comment #11)
> Suggestion (it seems samba-tool prints non-utf-8 characters!):
> -»   fix_log.append(output)
> +»   fix_log.append(output.decode('utf-8', 'replace'))

Did that in r81718. Lets hope for the best.
Comment 14 Arvid Requate univentionstaff 2017-08-02 17:40:56 CEST
> There is not generic "repair" function in the checks

What I'm saying is, that the ucs-test case must only check the functionality of the test, not it's result. If it depends on a positive result, it needs to take care of that by running dbcheck --cross-ncs --fix --yes. The ucs-test cases do things to samba which leave it in a state where dbcheck identifies errors. That's a fact.
Comment 15 Florian Best univentionstaff 2017-08-02 18:12:48 CEST
(In reply to Arvid Requate from comment #14)
> > There is not generic "repair" function in the checks
> 
> What I'm saying is, that the ucs-test case must only check the functionality
> of the test, not it's result. If it depends on a positive result, it needs
> to take care of that by running dbcheck --cross-ncs --fix --yes. The
> ucs-test cases do things to samba which leave it in a state where dbcheck
> identifies errors. That's a fact.

Yes, I see your point. But I don't want to check if the diagnosis tool works. I want to identify if specific checks are broken (so that the QA for all those tests now is easier because one need to execute them on all server roles in all constellations (S4/AD/@school)) or reveal broken UCS standard installations. We should write our ucs-tests so that they cleanup after they ran.

I will ignore this specific check in the ucs-test case.
Comment 16 Stefan Gohmann univentionstaff 2017-08-03 08:47:21 CEST
(In reply to Florian Best from comment #15)
> Yes, I see your point. But I don't want to check if the diagnosis tool
> works. I want to identify if specific checks are broken (so that the QA for
> all those tests now is easier because one need to execute them on all server
> roles in all constellations (S4/AD/@school)) or reveal broken UCS standard
> installations. We should write our ucs-tests so that they cleanup after they
> ran.
> 
> I will ignore this specific check in the ucs-test case.

Our you move the test case to 00_checks/.
Comment 17 Florian Best univentionstaff 2017-08-04 15:08:52 CEST
(In reply to Stefan Gohmann from comment #16)
> Our you move the test case to 00_checks/.
Good idea, done in r81794.
Comment 18 Arvid Requate univentionstaff 2017-08-24 21:30:17 CEST
Ok, works.
Comment 19 Arvid Requate univentionstaff 2017-08-29 10:34:59 CEST
The Jenkins-Job still fails:

[2017-08-29 00:15:51.016341] =================================== FAILURES ===================================
[2017-08-29 00:15:51.016419] __________________________ test_run_diagnostic_checks __________________________
[2017-08-29 00:15:51.016474] 
[2017-08-29 00:15:51.016548]     def test_run_diagnostic_checks():
[2017-08-29 00:15:51.016614]     	client = Client.get_test_connection()
[2017-08-29 00:15:51.016680]     	plugins = client.umc_command('diagnostic/query').result
[2017-08-29 00:15:51.016743]     	failures = []
[2017-08-29 00:15:51.016808]     	for plugin in plugins:
[2017-08-29 00:15:51.016873]     		result = client.umc_command('diagnostic/run', {'plugin': plugin['id']}).result
[2017-08-29 00:15:51.031748]     		if result['type'] != 'success':
[2017-08-29 00:15:51.031779]     			failures.append(result)
[2017-08-29 00:15:51.031791]     	error = ''.join('###############\n%s\n%s###############\n\n' % (x['title'], x['description']) for x in failures)
[2017-08-29 00:15:51.031800]     	if failures:
[2017-08-29 00:15:51.031809] >   		raise Exception(error)
[2017-08-29 00:15:51.031817] E     Exception: ###############
[2017-08-29 00:15:51.031825] E     Teste die lokale AD Datenbank auf Fehler
[2017-08-29 00:15:51.031834] E     `samba-tool dbcheck` fand Probleme mit der lokalen AD Datenbank.
[2017-08-29 00:15:51.031842] E     
[2017-08-29 00:15:51.031850] E     STDOUT:
[2017-08-29 00:15:51.031857] E     Checking 226 objects
[2017-08-29 00:15:51.031873] E     ERROR: incorrect DN SID component for member in object CN=Domain Users,CN=Groups,DC=autotest091,DC=local - <GUID=ff392550-f71c-4801-87a1-e7af1a892d53>;<RMD_ADDTIME=131484315130000000>;<RMD_CHANGETIME=131484315130000000>;<RMD_FLAGS=0>;<RMD_INVOCID=56258900-02c8-4b92-9773-299b6994038a>;<RMD_LOCAL_USN=3729>;<RMD_ORIGINATING_USN=3729>;<RMD_VERSION=0>;CN=Administrator,CN=Users,DC=autotest091,DC=local
[2017-08-29 00:15:51.031883] E     Not fixing SID component mismatch
[2017-08-29 00:15:51.031891] E     Please use --fix to fix these errors
[2017-08-29 00:15:51.031899] E     Checked 226 objects (1 errors)
[2017-08-29 00:15:51.031906] E     
[2017-08-29 00:15:51.031931] E     Sie können `samba-tool dbcheck --fix` ausführen um die Probleme zu beheben.###############
[2017-08-29 00:15:51.031942] 81_diagnostic_checks.py:19: Exception
Comment 20 Arvid Requate univentionstaff 2017-08-29 11:17:12 CEST
I've split that off as Bug #45277.
Comment 21 Erik Damrose univentionstaff 2017-09-20 15:03:49 CEST
<http://errata.software-univention.de/ucs/4.2/166.html>