Univention Bugzilla – Bug 50676
Regression: Nagios Check for ad-connector Reports False Error
Last modified: 2020-01-30 17:38:55 CET
With the latest change in univention-ad-connector in bug #49168 the line changed from /usr/bin/python2.7 -W ignore /usr/share/pyshared/univention/connector/ad/main.py to /usr/bin/python2.7 -W ignore -m univention.connector.ad.main "$@" Unfortunately the Nagios check /usr/lib/nagios/plugins/check_univention_ad_connector does not honor the "$@" which is given. and therefore fails and reports a false alarm: # check wether the AD connector is running; for this, get the exact command # that was used to launch the process; remove multiple whitespaces and quotes # in order to match the command via check_procs cmd=$(grep /usr/bin/python /usr/sbin/univention-ad-${CONNECTOR} | sed 's/\s\{1,\}/ /g; s/["'"'"']//g') /usr/lib/nagios/plugins/check_procs -w :1 -c 1: --ereg-argument-array "^${cmd}\$" >/dev/null 2>&1 ret="$?" The check_progs does not see a process with "$@" at the end.
Possible solution: Strip "$@" and space at the end by this line in check_univention_ad_connector: cmd=$(grep /usr/bin/python /usr/sbin/univention-ad-connector | sed 's/$@//g' | sed 's/\s\{1,\}/ /g; s/["'"'"']//g'| sed 's/\ $//g' ) Disadvantage if any parameter is given to the ad-connector this won't work.
In the S4-Connector we worked around this, I didn't see that there is a nagios check for the AD connector as well. We can apply this: See git:21bf24c4d7233377fd4e73e37bb41e8a03a4d592 and apply this to the AD-Connector as well.
Hi That regression has caused us some thorough head scratching here after the upgrade to 4.4-3 as we definitely rely on that check for the state the AD connector. Updating from 4.4-2 to 4.4-3 renders the check useless in both our production as well as a freshly installed 4.4-2 that is then updated to 4.4-3. I've made an attempt at a pull request that tries to mimic the patch by Florian Best for the S4 connector: https://github.com/univention/univention-corporate-server/pull/15 The process title is only an example but it leads to: univention-ad-connector # /usr/lib/pymodules/python2.7/univention/connector/ad/main.p I lack the expertise in regular expressions so please consider it as a proposal. However I like the fact that it shows the instance name and the location of main.py (like you already do for the S4 connector). Both the connector code as well as the check for the AD connector look like they are able to take instance names (like univention-ad-foo instead of -connector). It looks like this applies to the S4 connector as well, have you checked if S4 connector still works if you have any another than the default instance name? Regards Mathieu Simon
Getting urgent, meanwhile the next ticket regarding this issue. Customers updating will all be disappointed when something does not work after an upgrade!
Hi Unless this is fixed before the Univention Summit, we could discuss the PR during the Summit in the "hallway track" as some may say. See you in Bremen next week. Regards Mathieu
(In reply to Mathieu Simon from comment #3) > Hi > > That regression has caused us some thorough head scratching here after the > upgrade to 4.4-3 as we definitely rely on that check for the state the AD > connector. > > Updating from 4.4-2 to 4.4-3 renders the check useless in both our > production as well as a freshly installed 4.4-2 that is then updated to > 4.4-3. > > I've made an attempt at a pull request that tries to mimic the patch by > Florian Best for the S4 connector: > > https://github.com/univention/univention-corporate-server/pull/15 > > The process title is only an example but it leads to: > univention-ad-connector # > /usr/lib/pymodules/python2.7/univention/connector/ad/main.p > > I lack the expertise in regular expressions so please consider it as a > proposal. However I like the fact that it shows the instance name and the > location of main.py (like you already do for the S4 connector). > > > Both the connector code as well as the check for the AD connector look like > they are able to take instance names (like univention-ad-foo instead of > -connector). > > It looks like this applies to the S4 connector as well, have you checked if > S4 connector still works if you have any another than the default instance > name? > > Regards > Mathieu Simon Thank you for your pull request. I don't think we need to rename the process title here. In case the nagios check is updated the ad connector should have been updated as well. I adjusted the changes to only update the nagios check with the new process name. [4.4-3 2028d0ba59] Bug #50676: Fix ad connector process name Package: univention-nagios-ad-connector Version: 8.0.1-2A~4.4.0.202001281137 Branch: ucs_4.4-0 Scope: errata4.4-3
OK: Before upgrade: /usr/lib/nagios/plugins/check_univention_ad_connector ADCONNECTOR CRITICAL: AD connector is not running! After upgrade: /usr/lib/nagios/plugins/check_univention_ad_connector ADCONNECTOR OK: System operational. OK: yaml (82b3018c3b Bug #50676: yaml) -> verified
<http://errata.software-univention.de/ucs/4.4/430.html>
Hi Jürn Thank you for the explanation, I'm definitely not enough into the UCS codebase to make the best proposition. Either works as long as the check returns valid results, which is what is important. We've deployed the fixed package version yesterday and I can confirm that it does now work again as expected. I've retracted the PR since you didn't refuse it over on Github. Regards Mathieu