Zenoss: filtering the icons on the Infrastructure tree

This is the next article about my small hacks of Zenoss.

This time I will show how I filter the events which are taken for represent event severities with the appropriate Device Class, Group, System and Location at the Infrastructure->Devices page . The main reason for this, is that I have added in zenoss all systems from ours "Server" networks. These servers could be in "Test", "Pre-production", "Maintenance" and even "Decommissioned" state. Thus, there is number of events we could ignore. Moreover, on the "Production" systems we could have some events which we already aware of. If not filter these events, the icons on the Infrastructure tree element does not show us the real state of our infrastructure, and we have almost all tree filled with Warning, Error or Critical icons.

Unfortunately, because of poor knowledge of Python, the filter is hardcoded. Nevertheless - it works :)

[zenoss@zenoss infos]$ pwd
/opt/zenoss/Products/Zuul/infos
[zenoss@zenoss infos]$  diff ./device.py.orig ./device.py -u
--- ./device.py.orig    2011-12-06 19:08:19.000000000 +0000
+++ ./device.py 2011-12-06 18:59:06.000000000 +0000
@@ -100,7 +100,10 @@
         f = getFacade('event')
         root = self.root.uid.split('/')[3]
         orgcol = ORGTYPES[root]
-        q = 'select %s, max(severity) from status group by %s' % (orgcol,
+       """
+       Added "where eventState = '0'" to suppress error icon in tree on acknowledged events
+       """
+        q = "select %s, max(severity) from status where eventState = '0' and prodState > '499' group by %s" % (orgcol,
                                                                   orgcol)
         result = {}
         for org, sev in f._run_query(q, ()):

You can see my tree with- (left) and without (right) the filter applied. (Yep, there are event some critical events in Production. Will solve them tomorrow... if lucky... )

 

Hope this will help.
Stay tuned :)

Subversion "fun"

Well, although git is seems to be better from subversion even for our needs, we still use and will be using subversion in order to provide a long-term support for our customers, those who might require some changes in some old projects to be made... Anyway, the story is not about that...


"It was a rainy Thursday". As we could rely on our monitoring system, nobody was expecting some sudden troubles and I was doing some usual stuff... Suddenly... Suddenly we receive several calls at one time. All users reported some problem with accessing the SVN server. In a few second monitoring system reported: 100% use of the / (root) partition. WTH?! There should be two thresholds warnings before 90% and 95%! Well, login in, check.. Well... subversion repos are on another partition, so it's some system stuff... Logs are normal size - logrotate is configured for that. Aha!.. Several gigs in /tmp.... in a single file... Well, # lsof|grep filenname and we have a guilty. It was the svnsync process (we put it on postcommit hook to keep remote mirror synchronized), fortunately with a path to the repository to sync.

Now, let's see what was the number of the last synchronized revision on remote server (let's call it N), and then take a look on the N+1 revision. A single file was committed, named other_repo_name.tar.gz. With size of few gigs...

First of all block the synchronization to remote mirrors and block all commits (exit 1 in the pre-commit hook. Don't forget to put some message for users, sth like `echo "Commits are blocked, please contact support for more details" 1>&2`). Seems like we will need to cut this commit from the DB. Now, when further risks are eliminated, let's call to talk with the user.

- Hi Mike (let's call him Mike), this is John Smith (let's call me John :)) from the IT dept. We noticed that you have committed a few gigs file to the XXXX repo, didn't you?
- Hi, yes I did.
- But do you know that we have other services to store archives, like _service1_ and _service2_? Instead, our SVN servers are used as a version control system.
- Yes I know, that's why I put there a copy of the repository YYYY (Note: YYYY is an another repo on the same server), but since it was too big in sources I have compressed it to not take too much space on the server...
- ... *confused... (describing users the basics of work with services like SVN is far from my responsibility). Well, Mike, I understand. Thank you for description. Just to inform you, XXXX repo will be not available for commits for few hours. Bye...


Next, I called to Mike's department boss. Not to claim, but just to describe the situation and to ask him to inform his team that repo will be unavailable for commits for few hours (dump/recover), and that one commit that has been made after the huge one will have to be re-committed gain.

The moral of the story: On the important servers keep /tmp on a separate partition! I do now :)

CentOS 6 rpm sign issue (V4 signature is used by default)

Well, the problem I'm going to write about is known and the appropriate bug-reports exists. But I didn't found the proper threads on at the first pages of search results while googling by the error messages. So, I hope, this post will help somebody to find out what is happening when "rpm --checksig" returns "Header V3 DSA signature: OK, key ID xxxxxxxx" when "signature: OK" is expected.

I faced the problem when was deploying a Spacewalk server. I choose CentOS 6.0 to be the OS on that server and I was simply following install instructions (many thanks to the Spacewalk community, it was really easy to install the server) until I tried to create a custom Software Channel for some individual packages.

In fact, instructions about how to sign RPMs is the same on most of the howto pages... let's remind them (simple version):

gpg --gen-key

gpg --export -a XXXXXXX > RPM-GPG-KEY-Mycompany

put to ~/.rpmmacros:

%_signature gpg
%_gpg_name XXXXXXXX

and then just use:

rpm --resign some-package.rpm

On the client system it's enough to get the public key and import it by rpm command:

rpm --import /path/to/RPM-GPG-KEY-Mycompany

This was a very simplified recipe without expected outputs, but if everything is going  well there shouldn't be any unexpected questions.

After all is done, rpm --checksign some-package.rpm should return something like that:
some-package.rpm: rsa sha1 (md5) pgp md5 OK

And it was like that on the CentOS 6 server... But when I tried to install the package via yum on CentOS 5.7, I've received the following error:

error: rpmts_HdrFromFdno: Header V4 RSA/SHA1 signature: BAD, key ID XXXXXXXX

And rpm -v --checksig some-package.rpm was returning:

    Header V4 RSA/SHA1 signature: BAD, key ID xxxxxxxx
    Header SHA1 digest: OK (835b77fb70d2a6075c428b9eb57bbfcdc2a0d1ce)
    V4 RSA/SHA1 signature: BAD, key ID xxxxxxxx
    MD5 digest: OK (ede2464b724b0bafef0db4a53c02c1d0)
 

More weird thing, is that when I sign it with the same key on CentOS 5.7 the rpm was OK.
It was my first time signing the RPMs, so I have spent some time while found out the difference from the package with proper signature:

$ rpm -v --checksig rpmforge-release-0.5.1-1.el5.rf.i386.rpm
    Header V3 DSA signature: OK, key ID 6b8d79e6
    Header SHA1 digest: OK (56871fe945ed2b2c868430b0002bb47dc129e981)
    MD5 digest: OK (69c4cbf8229ba4b319d58f99ddebddf3)
    V3 DSA signature: OK, key ID 6b8d79e6

So, with that insight I found an old bug with a description how to force GPG signature version to v3. To do that your ~/.rpmmacros should look like this:

%_signature gpg
%_gpg_name  XXXXXXXX
%__gpg_sign_cmd %{__gpg} \
    gpg --force-v3-sigs --digest-algo=sha1 --batch --no-verbose --no-armor \
    --passphrase-fd 3 --no-secmem-warning -u "%{_gpg_name}" \
    -sbo %{__signature_filename} %{__plaintext_filename}

Seems like the "rpm --resign" command  uses GPG signature V4 by default, despite to the following text in rpm manual page:

For compatibility with older versions of GPG, PGP, and rpm, only V3 OpenPGP signature packets should be configured.  Either DSA or RSA  verification algorithms can be used, but DSA is preferred.

Hope this helps...

Zenoss: hiding the page header

I didn't have time for the last couple month to write anything to this blog. So I decided to write some short article for now. And this time it will be again about Zenoss.


Quite long ago at Zenoss Community Forum I've posted a request for a portlet for Zenoss 3.0.* that shows nothing but the filtered events. As I have mentioned in my post, I've made a trick with the Site Window portlet in Zenoss 2.5.2, but in v.3.0.* this possibility disappeared. After some time, because of no response on my post, I've decided to try to do something by myself. Actually, I'm not a programmer, and am a completely newbie in python, but I was curios to make it work. And I did it!

Maybe my solution is not very good, but it is as it is.
So, I've changed a file:
/opt/zenoss/Products/ZenUI3/browser/templates/base-new.pt
diff -u:

@@ -35,6 +35,10 @@
             href="/++resource++zenui/css/zenoss.css" />
         <link rel="stylesheet" type="text/css"
             href="/++resource++zenui/css/zenui3.css" />
+        <tal:block tal:condition="python:request.get('noheader',False)">
+            <link rel="stylesheet" type="text/css"
+            href="/++resource++zenui/css/noheader.css" />
+        </tal:block>
         <tal:block tal:content="structure provider:js-security"/>
         <tal:block tal:content="structure provider:all-js"/>
         <script tal:define="container context/getPrimaryParent" tal:content="string:

And create another one:
/opt/zenoss/Products/ZenUI3/browser/resources/css/noheader.css:

/**
 * HEADER
 */
#header {
    height: 0px !important;
    visibility:hidden ; }

Now, when you add "?noheader=1" to your URL to any Zenoss page, the header will not be displayed.

Here is an example of the Site Window on my Dashboard with URL to the filtered Event View: