False positives for hobbit-plugins libs test
Hi folks,
In my environment we use the following:
- Debian stretch with xymon 4.3.28-2
- Debian stretch with xymon-client 4.3.28-2 and hobbit-plugins 20170219
- Debian wheezy with xymon-client 4.3.0~beta2.dfsg-9.1+deb7u1 and
hobbit-plugins 20120532
It all works fine, except that hobbit-plugins often gives false
positives in the 'libs' column, indicating that certain "processes
have libs linked that were upgraded". However, in those cases it makes
no difference whether the processes are restarted, or even if the
machine is rebooted: the processes continue to be flagged falsely.
Examples include libvirt-qemu and mysql. It's the same on both of the
platforms indicated above.
Is there a fix or a reasonable workaround for this problem?
Thanks,
Jaap
Hi Jaap,
On Mon, Jul 09, 2018 at 07:47:33PM +0000, Jaap Winius wrote:
- Debian stretch with xymon-client 4.3.28-2 and hobbit-plugins 20170219
- Debian wheezy with xymon-client 4.3.0~beta2.dfsg-9.1+deb7u1 and hobbit-plugins 20120532
It all works fine, except that hobbit-plugins often gives false positives in the 'libs' column, indicating that certain "processes have libs linked that were upgraded". However, in those cases it makes no difference whether the processes are restarted, or even if the machine is rebooted: the processes continue to be flagged falsely. Examples include libvirt-qemu and mysql. It's the same on both of the platforms indicated above.
At least the mysql case should be fixed in hobbit-plugins 20180610, see https://bugs.debian.org/873838. The according changelog item:
- Whitelist multipath-related /[aio] false positives for mysql/mariadb servers in libs check. Thanks to Daniel Rieken for the bug report! (Closes: #873838)
Don't know what causes libvirt-qemu case. If the fix for mysql mentioned doesn't fix it for libvirt-qemu, too, the output of "lsof -p <pid-of-libvirt-qemu-binary>" might give some hints.
Kind regards, Axel (one of Debian's hobbit-plugins and xymon maintainers)
PGP: 2FF9CD59612616B5 /~\ Plain Text Ribbon Campaign, http://arc.pasp.de/ Mail: abe at deuxchevaux.org \ / Say No to HTML in E-Mail and Usenet Mail+Jabber: abe at noone.org X https://axel.beckert.ch/ / \ I love long mails: https://email.is-not-s.ms/
Quoting Axel Beckert <abe at deuxchevaux.org>:
At least the mysql case should be fixed in hobbit-plugins 20180610, see https://bugs.debian.org/873838. The according changelog item:
- Whitelist multipath-related /[aio] false positives for mysql/mariadb servers in libs check. Thanks to Daniel Rieken for the bug report! (Closes: #873838)
Don't know what causes libvirt-qemu case. If the fix for mysql mentioned doesn't fix it for libvirt-qemu, too, the output of "lsof -p <pid-of-libvirt-qemu-binary>" might give some hints.
Hi Axel,
Thanks very much! On all of the Debian stretch systems affected by the
mysql issue, I could fix it by creating /etc/xymon/libs.local.yaml
with the following contents:
local config file for the libs test
whitelist: /usr/sbin/mysqld: - '^/\[aio\]$'
It looks like the same problem causes the libvirt-qemu issue, but I
was only able to fix it on one of the two affected Debian stretch
systems by adding similar content to the same file:
local config file for the libs test
whitelist: /usr/bin/qemu-system-x86_64: - '^/\[aio\]$'
On that system, Xymon was reporting:
The following processes have libs linked that were upgraded:
libvirt-qemu: /usr/bin/qemu-system-x86_64 (4561)
(Even though there were almost a dozen qemu-system-x86_64 processes
running on this system).
However, on the system where this whitelist configuration had no
effect, the message was also different:
The following processes have libs linked that were upgraded:
libvirt-qemu:
/usr/bin/qemu-system-x86_64 (deleted) (3779 3852 3933 4008 4081
4155 4229 4304 4376 4496 4683 4809)
'(deleted)'? Could this have something to do with it? On that system I also tried this variation:
local config file for the libs test
whitelist: /usr/bin/qemu-system-x86_64: - '.*'
... but that didn't work either.
As for the Debian wheezy systems, although they don't have the same
.yaml files, is there another way to solve the same problem on these
systems?
Thanks again!
Cheers,
Jaap
Quoting Jaap Winius <jwinius at umrk.nl>:
... the same problem causes the libvirt-qemu issue, but I was only
able to fix it on one of the two affected Debian stretch systems by
adding similar content to the same file:local config file for the libs test
whitelist: /usr/bin/qemu-system-x86_64: - '^/\[aio\]$'
I can now report that this also worked on the other Debian stretch
system after it was reboot.
Still no idea on how I would go about doing this on a Debian wheezy system.
Cheers,
Jaap
Hi Jaap,
On Tue, Jul 10, 2018 at 04:11:54PM +0000, Jaap Winius wrote:
/usr/bin/qemu-system-x86_64: - '^/\[aio\]$'
I can now report that this also worked on the other Debian stretch system after it was reboot.
Probably because it wasn't a false positive but a true possitive.
Still no idea on how I would go about doing this on a Debian wheezy system.
Inside the hobbit-plugins package there are some scripts which can be used to build a backported version for Wheezy systems and earlier.
Have a look at debian/rules in the source package:
If the first changelog entry says the package is targeted for wheezy-backports, the build should automatically adjust the dependencies, paths, variables and so on.
But I haven't used them for years now, so I don't know if they still work.
Example workflow on buster to build the buster hobbit-plugins as wheezy backport (untested):
On buster:
$ apt-get source -d hobbit-plugins
Then copy the hobbit-plugins_20180610* files to a wheezy box.
Alternatively do a
$ git clone https://salsa.debian.org/debian/hobbit-plugins.git
on the wheezy box.
On the wheezy box do:
$ dpkg-source -x hobbit-plugins_20180610.dsc $ cd hobbit-plugins-20180610 $ dch -v "20180610~bpo7+1" --distribution wheezy-backports-sloppy 'Rebuild for wheezy-backports-sloppy' $ dpkg-buildpackage
Kind regards, Axel
-- PGP: 2FF9CD59612616B5 /~\ Plain Text Ribbon Campaign, http://arc.pasp.de/ Mail: abe at deuxchevaux.org \ / Say No to HTML in E-Mail and Usenet Mail+Jabber: abe at noone.org X https://axel.beckert.ch/ / \ I love long mails: https://email.is-not-s.ms/
Quoting Axel Beckert <abe at deuxchevaux.org>:
On buster:
$ apt-get source -d hobbit-plugins
Then copy the hobbit-plugins_20180610* files to a wheezy box.
...
On the wheezy box do:
$ dpkg-source -x hobbit-plugins_20180610.dsc $ cd hobbit-plugins-20180610 $ dch -v "20180610~bpo7+1" --distribution wheezy-backports-sloppy
'Rebuild for wheezy-backports-sloppy' $ dpkg-buildpackage
Unfortunately, although I was able to compile this package on wheezy,
I wasn't able to install it:
hobbit-plugins depends on xymon-client (>= 4.3.17-2~); however: Version of xymon-client on system is 4.3.0~beta2.dfsg-9.1+deb7u1.
I tried to compile xymon-4.3.17 as well, but then that one depends on
further packages that I eventually could not compile, such as
apache2_2.4.10 (which contains apache2-dev, which provides
dh-apache2). Oh, well.
So, it was worth a try, but I don't have many wheezy systems left and
they will be replaced soon enough anyway.
And, more importantly, now that I know how to whitelist the mysqld and
qemu-system-x86_64 processes for the libs test, all of my systems will
soon be green!
Thanks again for your help!
Cheers,
Jaap
Hi,
On Tue, Jul 10, 2018 at 09:18:35PM +0000, Jaap Winius wrote:
Unfortunately, although I was able to compile this package on wheezy, I wasn't able to install it:
hobbit-plugins depends on xymon-client (>= 4.3.17-2~); however: Version of xymon-client on system is 4.3.0~beta2.dfsg-9.1+deb7u1.
Hrm. This probably means that the backporting script no more works probably, because it should do an
sed -e 's/(>= 4.3.17-2~)/(<< 4.3.7-1~)/g' -i debian/control
besides other things.
So, it was worth a try, but I don't have many wheezy systems left and they will be replaced soon enough anyway.
Sounds familiar, too. :-)
Kind regards, Axel
-- PGP: 2FF9CD59612616B5 /~\ Plain Text Ribbon Campaign, http://arc.pasp.de/ Mail: abe at deuxchevaux.org \ / Say No to HTML in E-Mail and Usenet Mail+Jabber: abe at noone.org X https://axel.beckert.ch/ / \ I love long mails: https://email.is-not-s.ms/
participants (2)
-
abe@deuxchevaux.org
-
jwinius@umrk.nl