Jeff Strunk's questions

Our logs are sent from our applications to rsyslog running on the same host. Rsyslog then forwards the messages to Sumo Logic.

We need to add some metadata to our log messages in the structured data field. Some of our applications already use structured data, so we can't simply replace the structured data property in our template.

Also, the %STRUCTURED-DATA% property includes the opening and closing brackets, so we can't just put something like [%STRUCTURED-DATA% newmetadata] in the template.

According to the property replacer documentation, our options are to use FromChar and ToChar or regular expressions. I checked the source and confirmed that ToChar can't count backwards from the end.

I used the rsyslog regex tool to create the following template:

template(name="metadata_syslog" type="string" string="<%PRI%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% %MSGID% [%STRUCTURED-DATA:R,ERE,1,FIELD:\[([^]]*)\]--end% extrafield=value] %msg%\n")

From the following example event

<142>1 2016-03-31T17:30:20.007Z some.host.name service/prod/app/foo_v2 - Audit [mdc@xxxxx category="io.service.segment.IndexIO$DefaultIndexIOHandler" thread="foo_v2-incremental-persist"] Processing file[dim_device.drd]

the regex tool correctly parsed out the structured data without the brackets.

When I used this template in rsyslog, I get a syntax error about the %PRI% part(debug output):

Reading a token: 9936.286569660:main thread : Called LogMsg, msg: error during parsing file /etc/rsyslog.d/21-logging.conf, on or before line 4: invalid character '"' in object definition - is there an invalid escape sequence somewhere? rsyslogd: error during parsing file /etc/rsyslog.d/21-logging.conf, on or before line 4: invalid character '"' in object definition - is there an invalid escape sequence somewhere? [v8.17.0 try http://www.rsyslog.com/e/2207 ] 9936.286590559:main thread : Called LogMsg, msg: error during parsing file /etc/rsyslog.d/21-logging.conf, on or before line 4: invalid character '<' in object definition - is there an invalid escape sequence somewhere? rsyslogd: error during parsing file /etc/rsyslog.d/21-logging.conf, on or before line 4: invalid character '<' in object definition - is there an invalid escape sequence somewhere? [v8.17.0 try http://www.rsyslog.com/e/2207 ] 9936.286606008:main thread : Called LogMsg, msg: error during parsing file /etc/rsyslog.d/21-logging.conf, on or before line 4: invalid character '%' in object definition - is there an invalid escape sequence somewhere? rsyslogd: error during parsing file /etc/rsyslog.d/21-logging.conf, on or before line 4: invalid character '%' in object definition - is there an invalid escape sequence somewhere? [v8.17.0 try http://www.rsyslog.com/e/2207 ] Next token is token NAME () 9936.286632522:main thread : Called LogMsg, msg: error during parsing file /etc/rsyslog.d/21-logging.conf, on or before line 4: syntax error on token 'PRI' rsyslogd: error during parsing file /etc/rsyslog.d/21-logging.conf, on or before line 4: syntax error on token 'PRI' [v8.17.0 try http://www.rsyslog.com/e/2207 ] Error: popping token '=' () Stack now 0 1 5 28 52 Error: popping token NAME () Stack now 0 1 5 28 Error: popping nterm nvlst () Stack now 0 1 5 Error: popping token BEGIN_TPL () Stack now 0 1 Error: popping nterm conf () Stack now 0 Cleanup: discarding lookahead token NAME () Stack now 0 9936.286780810:main thread : Called LogMsg, msg: CONFIG ERROR: could not interpret master config file '/etc/rsyslog.conf'. rsyslogd: CONFIG ERROR: could not interpret master config file '/etc/rsyslog.conf'. [v8.17.0 try http://www.rsyslog.com/e/2207 ]

We have two applications that require a long time(between 20 minutes and 7 days) to finish processing their data and deprovision properly. We still want to manage them in Autoscaling groups with Cloudformation.

The problem is that if we want to scale down the cluster, we need to be able to tell autoscaling to terminate a specific instance and reduce the size of the cluster by one. This is possible outside of Cloudformation, but that would interfere with the ability to update the autoscaling group with Cloudformation.

It would be nice to use Austoscaling Lifecyle Hooks, but they have a 48 hour maximum wait.

What other options are there?

We have our production environment on EC2 classic, and we have a lease on some servers in a managed hosting environment. We would like to put a portion of our backend service in the data center, but there is no security built into the application yet, so we need to rely on private networks and VPN. I think this will be easier once we migrate to VPC as AWS already provides this kind of service, but we are not there yet.

Network Description

EC2 Classic puts all instances in 10.0.0.0/8. Our data center also has a subnet within that range, but I suspect we can change that. There are two routers at the data center that can connect an IPSEC VPN.

Service Description

The services running in the data center need to be able to initiate connections to services in EC2 and also receive connections initiated by services in EC2.

Ideas

I'm sure that if our services at the data center only needed to initiate connections to services in EC2, then it would just be a matter of setting up VPN endpoints in EC2 for the routers at the data center to connect to, use a different subnet in the data center, and finally, route all connections to 10.0.0.0/8 over the VPN.

For the other direction, is the best option to configure an extra route on all EC2 instances that need to initiate connections to services in the data center?

Is it possible to make salt require that a particular file was appended to as opposed to the file merely existing?

It seems like I can only require a file state. The source looks like it strips out any method names from a require attribute.

In the example below, I only want the foo service to run if my lines have been appended to /etc/security/limits.conf.

file.append:
  - name: /etc/security/limits.conf
  - text:
    - root hard nofile 65535
    - root soft nofile 65535

foo:
  service.running:
    - enable: True
    - require:
      - file.append: /etc/security/limits.conf

I have installed puppet 3.1.1 from the Puppet Labs APT repository on Ubuntu 12.04. I installed the ploperations-puppet module from Puppet Forge to manage the puppet agent config and package installations on my client systems. I had some issues so I scaled back to write my own but still use the ploperations-puppetlabs_apt and stahnma-puppetlabs_yum modules to manage the repositories.

For the following tests the agent is on the master.

Now with the following site.pp

node default {
    class { "puppetlabs_apt":
    }
}

I get the following error:

# puppet agent --test
Info: Retrieving plugin
Notice: /File[/var/lib/puppet/lib/puppet]/ensure: removed
Notice: /File[/var/lib/puppet/lib/facter/puppet_path.rb]/ensure: removed
Notice: /File[/var/lib/puppet/lib/facter/util]/ensure: removed
Notice: /File[/var/lib/puppet/lib/facter/certname.rb]/ensure: removed
Notice: /File[/var/lib/puppet/lib/facter/root_home.rb]/ensure: removed
Notice: /File[/var/lib/puppet/lib/facter/puppet_vardir.rb]/ensure: removed
Notice: /File[/var/lib/puppet/lib/facter/pe_version.rb]/ensure: removed
Notice: /File[/var/lib/puppet/lib/facter/concat_basedir.rb]/ensure: removed
Notice: /File[/var/lib/puppet/lib/facter/confenv.rb]/ensure: removed
Notice: /File[/var/lib/puppet/lib/facter/puppet_semantic_version.rb]/ensure: removed
Info: Loading facts in /etc/puppet/modules/puppetlabs_yum/lib/facter/os_maj_version.rb
Info: Loading facts in /var/lib/puppet/lib/facter/os_maj_version.rb
Error: Could not retrieve catalog from remote server: Error 400 on SERVER: Puppet::Parser::AST::Resource failed with error ArgumentError: Could not find declared class puppetlabs_apt at /etc/puppet/manifests/site.pp:3 on node mgmt.example.com
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run

Testing with the ricardogarcia-helloworld and the puppetlabs_yum module is successful. Furthermore, the following test with puppet apply is successful(site.pp is identical to above):

# puppet apply /etc/puppet/manifests/site.pp   
WARN: Fri Apr 19 16:43:32 +0000 2013: Not using Hiera::Puppet_logger. It does not report itself to be suitable.
DEBUG: Fri Apr 19 16:43:32 +0000 2013: Hiera YAML backend starting
DEBUG: Fri Apr 19 16:43:32 +0000 2013: Looking up puppetlabs_apt::enable_devel in YAML backend
DEBUG: Fri Apr 19 16:43:32 +0000 2013: Looking for data source mgmt.example.com
DEBUG: Fri Apr 19 16:43:32 +0000 2013: Cannot find datafile /etc/puppet/hieradata/mgmt.example.com.yaml, skipping
DEBUG: Fri Apr 19 16:43:32 +0000 2013: Looking for data source common
DEBUG: Fri Apr 19 16:43:32 +0000 2013: Hiera JSON backend starting
DEBUG: Fri Apr 19 16:43:32 +0000 2013: Looking up puppetlabs_apt::enable_devel in JSON backend
DEBUG: Fri Apr 19 16:43:32 +0000 2013: Looking for data source mgmt.example.com
DEBUG: Fri Apr 19 16:43:32 +0000 2013: Cannot find datafile /etc/puppet/hieradata/mgmt.example.com.json, skipping
DEBUG: Fri Apr 19 16:43:32 +0000 2013: Looking for data source common
DEBUG: Fri Apr 19 16:43:32 +0000 2013: Cannot find datafile /etc/puppet/hieradata/common.json, skipping
Notice: Finished catalog run in 0.16 seconds

Finally, debugging the master gives the follwoing output when the puppet agent is run:

# puppet master --debug --no-daemonize
Debug: Failed to load library 'selinux' for feature 'selinux'
Debug: Using settings: adding file resource 'libdir': 'File[/var/lib/puppet/lib]{:links=>:follow, :ensure=>:directory, :backup=>false, :loglevel=>:debug, :path=>"/var/lib/puppet/lib"}'
Debug: Using settings: adding file resource 'vardir': 'File[/var/lib/puppet]{:links=>:follow, :ensure=>:directory, :backup=>false, :loglevel=>:debug, :path=>"/var/lib/puppet"}'
Debug: Puppet::Type::User::ProviderPw: file pw does not exist
Debug: Puppet::Type::User::ProviderUser_role_add: file roleadd does not exist
Debug: Puppet::Type::User::ProviderDirectoryservice: file /usr/bin/uuidgen does not exist
Debug: Failed to load library 'ldap' for feature 'ldap'
Debug: Puppet::Type::User::ProviderLdap: feature ldap is missing
Debug: Puppet::Type::Group::ProviderPw: file pw does not exist
Debug: Puppet::Type::Group::ProviderDirectoryservice: file /usr/bin/dscl does not exist
Debug: Failed to load library 'ldap' for feature 'ldap'
Debug: Puppet::Type::Group::ProviderLdap: feature ldap is missing
Debug: Using settings: adding file resource 'server_datadir': 'File[/var/lib/puppet/server_data]{:links=>:follow, :group=>"puppet", :ensure=>:directory, :backup=>false, :owner=>"puppet", :mode=>"750", :loglevel=>:debug, :path=>"/var/lib/puppet/server_data"}'
Debug: Using settings: adding file resource 'hostpubkey': 'File[/var/lib/puppet/ssl/public_keys/mgmt.example.com.pem]{:links=>:follow, :ensure=>:file, :backup=>false, :owner=>"puppet", :mode=>"644", :loglevel=>:debug, :path=>"/var/lib/puppet/ssl/public_keys/mgmt.example.com.pem"}'
Debug: Using settings: adding file resource 'rundir': 'File[/var/run/puppet]{:links=>:follow, :ensure=>:directory, :backup=>false, :mode=>"1777", :loglevel=>:debug, :path=>"/var/run/puppet"}'
Debug: Using settings: adding file resource 'manifestdir': 'File[/etc/puppet/manifests]{:links=>:follow, :ensure=>:directory, :backup=>false, :loglevel=>:debug, :path=>"/etc/puppet/manifests"}'
Debug: Using settings: adding file resource 'publickeydir': 'File[/var/lib/puppet/ssl/public_keys]{:links=>:follow, :ensure=>:directory, :backup=>false, :owner=>"puppet", :loglevel=>:debug, :path=>"/var/lib/puppet/ssl/public_keys"}'
Debug: Using settings: adding file resource 'masterhttplog': 'File[/var/log/puppet/masterhttp.log]{:links=>:follow, :group=>"puppet", :ensure=>:file, :backup=>false, :owner=>"puppet", :mode=>"660", :loglevel=>:debug, :path=>"/var/log/puppet/masterhttp.log"}'
Debug: Using settings: adding file resource 'bucketdir': 'File[/var/lib/puppet/bucket]{:links=>:follow, :group=>"puppet", :ensure=>:directory, :backup=>false, :owner=>"puppet", :mode=>"750", :loglevel=>:debug, :path=>"/var/lib/puppet/bucket"}'
Debug: Using settings: adding file resource 'privatedir': 'File[/var/lib/puppet/ssl/private]{:links=>:follow, :ensure=>:directory, :backup=>false, :owner=>"puppet", :mode=>"750", :loglevel=>:debug, :path=>"/var/lib/puppet/ssl/private"}'
Debug: Using settings: adding file resource 'hostcert': 'File[/var/lib/puppet/ssl/certs/mgmt.example.com.pem]{:links=>:follow, :ensure=>:file, :backup=>false, :owner=>"puppet", :mode=>"644", :loglevel=>:debug, :path=>"/var/lib/puppet/ssl/certs/mgmt.example.com.pem"}'
Debug: Using settings: adding file resource 'hiera_config': 'File[/etc/puppet/hiera.yaml]{:links=>:follow, :ensure=>:file, :backup=>false, :loglevel=>:debug, :path=>"/etc/puppet/hiera.yaml"}'
Debug: Using settings: adding file resource 'logdir': 'File[/var/log/puppet]{:links=>:follow, :group=>"puppet", :ensure=>:directory, :backup=>false, :owner=>"puppet", :mode=>"750", :loglevel=>:debug, :path=>"/var/log/puppet"}'
Debug: Using settings: adding file resource 'localcacert': 'File[/var/lib/puppet/ssl/certs/ca.pem]{:links=>:follow, :ensure=>:file, :backup=>false, :owner=>"puppet", :mode=>"644", :loglevel=>:debug, :path=>"/var/lib/puppet/ssl/certs/ca.pem"}'
Debug: Using settings: adding file resource 'fileserverconfig': 'File[/etc/puppet/fileserver.conf]{:links=>:follow, :ensure=>:file, :backup=>false, :loglevel=>:debug, :path=>"/etc/puppet/fileserver.conf"}'
Debug: Using settings: adding file resource 'hostcrl': 'File[/var/lib/puppet/ssl/crl.pem]{:links=>:follow, :ensure=>:file, :backup=>false, :owner=>"puppet", :mode=>"644", :loglevel=>:debug, :path=>"/var/lib/puppet/ssl/crl.pem"}'
Debug: Using settings: adding file resource 'rrddir': 'File[/var/lib/puppet/rrd]{:links=>:follow, :group=>"puppet", :ensure=>:directory, :backup=>false, :owner=>"puppet", :mode=>"750", :loglevel=>:debug, :path=>"/var/lib/puppet/rrd"}'
Debug: Using settings: adding file resource 'manifest': 'File[/etc/puppet/manifests/site.pp]{:links=>:follow, :ensure=>:file, :backup=>false, :loglevel=>:debug, :path=>"/etc/puppet/manifests/site.pp"}'
Debug: Using settings: adding file resource 'certdir': 'File[/var/lib/puppet/ssl/certs]{:links=>:follow, :ensure=>:directory, :backup=>false, :owner=>"puppet", :loglevel=>:debug, :path=>"/var/lib/puppet/ssl/certs"}'
Debug: Using settings: adding file resource 'requestdir': 'File[/var/lib/puppet/ssl/certificate_requests]{:links=>:follow, :ensure=>:directory, :backup=>false, :owner=>"puppet", :loglevel=>:debug, :path=>"/var/lib/puppet/ssl/certificate_requests"}'
Debug: Using settings: adding file resource 'rest_authconfig': 'File[/etc/puppet/auth.conf]{:links=>:follow, :ensure=>:file, :backup=>false, :loglevel=>:debug, :path=>"/etc/puppet/auth.conf"}'
Debug: Using settings: adding file resource 'confdir': 'File[/etc/puppet]{:links=>:follow, :ensure=>:directory, :backup=>false, :loglevel=>:debug, :path=>"/etc/puppet"}'
Debug: Using settings: adding file resource 'yamldir': 'File[/var/lib/puppet/yaml]{:links=>:follow, :group=>"puppet", :ensure=>:directory, :backup=>false, :owner=>"puppet", :mode=>"750", :loglevel=>:debug, :path=>"/var/lib/puppet/yaml"}'
Debug: Using settings: adding file resource 'hostprivkey': 'File[/var/lib/puppet/ssl/private_keys/mgmt.example.com.pem]{:links=>:follow, :ensure=>:file, :backup=>false, :owner=>"puppet", :mode=>"600", :loglevel=>:debug, :path=>"/var/lib/puppet/ssl/private_keys/mgmt.example.com.pem"}'
Debug: Using settings: adding file resource 'reportdir': 'File[/var/lib/puppet/reports]{:links=>:follow, :group=>"puppet", :ensure=>:directory, :backup=>false, :owner=>"puppet", :mode=>"750", :loglevel=>:debug, :path=>"/var/lib/puppet/reports"}'
Debug: Using settings: adding file resource 'statedir': 'File[/var/lib/puppet/state]{:links=>:follow, :ensure=>:directory, :backup=>false, :mode=>"1755", :loglevel=>:debug, :path=>"/var/lib/puppet/state"}'
Debug: Using settings: adding file resource 'ssldir': 'File[/var/lib/puppet/ssl]{:links=>:follow, :ensure=>:directory, :backup=>false, :owner=>"puppet", :mode=>"771", :loglevel=>:debug, :path=>"/var/lib/puppet/ssl"}'
Debug: Using settings: adding file resource 'privatekeydir': 'File[/var/lib/puppet/ssl/private_keys]{:links=>:follow, :ensure=>:directory, :backup=>false, :owner=>"puppet", :mode=>"750", :loglevel=>:debug, :path=>"/var/lib/puppet/ssl/private_keys"}'
Debug: /File[/var/lib/puppet/ssl/certs/ca.pem]: Autorequiring File[/var/lib/puppet/ssl/certs]
Debug: /File[/etc/puppet/auth.conf]: Autorequiring File[/etc/puppet]
Debug: /File[/var/lib/puppet/ssl/certificate_requests]: Autorequiring File[/var/lib/puppet/ssl]
Debug: /File[/var/lib/puppet/ssl]: Autorequiring File[/var/lib/puppet]
Debug: /File[/etc/puppet/manifests]: Autorequiring File[/etc/puppet]
Debug: /File[/var/log/puppet/masterhttp.log]: Autorequiring File[/var/log/puppet]
Debug: /File[/var/lib/puppet/ssl/private]: Autorequiring File[/var/lib/puppet/ssl]
Debug: /File[/var/lib/puppet/ssl/crl.pem]: Autorequiring File[/var/lib/puppet/ssl]
Debug: /File[/var/lib/puppet/ssl/public_keys]: Autorequiring File[/var/lib/puppet/ssl]
Debug: /File[/var/lib/puppet/lib]: Autorequiring File[/var/lib/puppet]
Debug: /File[/var/lib/puppet/ssl/private_keys/mgmt.example.com.pem]: Autorequiring File[/var/lib/puppet/ssl/private_keys]
Debug: /File[/var/lib/puppet/ssl/certs/mgmt.example.com.pem]: Autorequiring File[/var/lib/puppet/ssl/certs]
Debug: /File[/var/lib/puppet/bucket]: Autorequiring File[/var/lib/puppet]
Debug: /File[/var/lib/puppet/server_data]: Autorequiring File[/var/lib/puppet]
Debug: /File[/var/lib/puppet/state]: Autorequiring File[/var/lib/puppet]
Debug: /File[/var/lib/puppet/ssl/certs]: Autorequiring File[/var/lib/puppet/ssl]
Debug: /File[/var/lib/puppet/ssl/public_keys/mgmt.example.com.pem]: Autorequiring File[/var/lib/puppet/ssl/public_keys]
Debug: /File[/var/lib/puppet/yaml]: Autorequiring File[/var/lib/puppet]
Debug: /File[/etc/puppet/fileserver.conf]: Autorequiring File[/etc/puppet]
Debug: /File[/etc/puppet/manifests/site.pp]: Autorequiring File[/etc/puppet/manifests]
Debug: /File[/var/lib/puppet/ssl/private_keys]: Autorequiring File[/var/lib/puppet/ssl]
Debug: /File[/etc/puppet/hiera.yaml]: Autorequiring File[/etc/puppet]
Debug: /File[/var/lib/puppet/reports]: Autorequiring File[/var/lib/puppet]
Debug: /File[/var/lib/puppet/rrd]: Autorequiring File[/var/lib/puppet]
Debug: Finishing transaction 70187171513100
Debug: Using settings: adding file resource 'csrdir': 'File[/var/lib/puppet/ssl/ca/requests]{:links=>:follow, :group=>"puppet", :ensure=>:directory, :backup=>false, :owner=>"puppet", :loglevel=>:debug, :path=>"/var/lib/puppet/ssl/ca/requests"}'
Debug: Using settings: adding file resource 'cacert': 'File[/var/lib/puppet/ssl/ca/ca_crt.pem]{:links=>:follow, :group=>"puppet", :ensure=>:file, :backup=>false, :owner=>"puppet", :mode=>"660", :loglevel=>:debug, :path=>"/var/lib/puppet/ssl/ca/ca_crt.pem"}'
Debug: Using settings: adding file resource 'cacrl': 'File[/var/lib/puppet/ssl/ca/ca_crl.pem]{:links=>:follow, :group=>"puppet", :ensure=>:file, :backup=>false, :owner=>"puppet", :mode=>"664", :loglevel=>:debug, :path=>"/var/lib/puppet/ssl/ca/ca_crl.pem"}'
Debug: Using settings: adding file resource 'signeddir': 'File[/var/lib/puppet/ssl/ca/signed]{:links=>:follow, :group=>"puppet", :ensure=>:directory, :backup=>false, :owner=>"puppet", :mode=>"770", :loglevel=>:debug, :path=>"/var/lib/puppet/ssl/ca/signed"}'
Debug: Using settings: adding file resource 'serial': 'File[/var/lib/puppet/ssl/ca/serial]{:links=>:follow, :group=>"puppet", :ensure=>:file, :backup=>false, :owner=>"puppet", :mode=>"644", :loglevel=>:debug, :path=>"/var/lib/puppet/ssl/ca/serial"}'
Debug: Using settings: adding file resource 'cakey': 'File[/var/lib/puppet/ssl/ca/ca_key.pem]{:links=>:follow, :group=>"puppet", :ensure=>:file, :backup=>false, :owner=>"puppet", :mode=>"660", :loglevel=>:debug, :path=>"/var/lib/puppet/ssl/ca/ca_key.pem"}'
Debug: Using settings: adding file resource 'caprivatedir': 'File[/var/lib/puppet/ssl/ca/private]{:links=>:follow, :group=>"puppet", :ensure=>:directory, :backup=>false, :owner=>"puppet", :mode=>"770", :loglevel=>:debug, :path=>"/var/lib/puppet/ssl/ca/private"}'
Debug: Using settings: adding file resource 'capass': 'File[/var/lib/puppet/ssl/ca/private/ca.pass]{:links=>:follow, :group=>"puppet", :ensure=>:file, :backup=>false, :owner=>"puppet", :mode=>"660", :loglevel=>:debug, :path=>"/var/lib/puppet/ssl/ca/private/ca.pass"}'
Debug: Using settings: adding file resource 'cert_inventory': 'File[/var/lib/puppet/ssl/ca/inventory.txt]{:links=>:follow, :group=>"puppet", :ensure=>:file, :backup=>false, :owner=>"puppet", :mode=>"644", :loglevel=>:debug, :path=>"/var/lib/puppet/ssl/ca/inventory.txt"}'
Debug: Using settings: adding file resource 'cadir': 'File[/var/lib/puppet/ssl/ca]{:links=>:follow, :group=>"puppet", :ensure=>:directory, :backup=>false, :owner=>"puppet", :mode=>"770", :loglevel=>:debug, :path=>"/var/lib/puppet/ssl/ca"}'
Debug: Using settings: adding file resource 'capub': 'File[/var/lib/puppet/ssl/ca/ca_pub.pem]{:links=>:follow, :group=>"puppet", :ensure=>:file, :backup=>false, :owner=>"puppet", :loglevel=>:debug, :path=>"/var/lib/puppet/ssl/ca/ca_pub.pem"}'
Debug: /File[/var/lib/puppet/ssl/ca/ca_key.pem]: Autorequiring File[/var/lib/puppet/ssl/ca]
Debug: /File[/var/lib/puppet/ssl/ca/requests]: Autorequiring File[/var/lib/puppet/ssl/ca]
Debug: /File[/var/lib/puppet/ssl/ca/serial]: Autorequiring File[/var/lib/puppet/ssl/ca]
Debug: /File[/var/lib/puppet/ssl/ca/ca_pub.pem]: Autorequiring File[/var/lib/puppet/ssl/ca]
Debug: /File[/var/lib/puppet/ssl/ca/private/ca.pass]: Autorequiring File[/var/lib/puppet/ssl/ca/private]
Debug: /File[/var/lib/puppet/ssl/ca/ca_crt.pem]: Autorequiring File[/var/lib/puppet/ssl/ca]
Debug: /File[/var/lib/puppet/ssl/ca/ca_crl.pem]: Autorequiring File[/var/lib/puppet/ssl/ca]
Debug: /File[/var/lib/puppet/ssl/ca/inventory.txt]: Autorequiring File[/var/lib/puppet/ssl/ca]
Debug: /File[/var/lib/puppet/ssl/ca/private]: Autorequiring File[/var/lib/puppet/ssl/ca]
Debug: /File[/var/lib/puppet/ssl/ca/signed]: Autorequiring File[/var/lib/puppet/ssl/ca]
Debug: Finishing transaction 70187171795120
Debug: Using cached certificate for ca
Debug: Using cached certificate for ca
Debug: Using cached certificate for mgmt.example.com
Debug: Using settings: adding file resource 'config': 'File[/etc/puppet/puppet.conf]{:links=>:follow, :ensure=>:file, :backup=>false, :loglevel=>:debug, :path=>"/etc/puppet/puppet.conf"}'
Debug: Finishing transaction 70187170837620
Notice: Starting Puppet master version 3.1.1
Info: access[^/catalog/([^/]+)$]: allowing 'method' find
Info: access[^/catalog/([^/]+)$]: allowing $1 access
Info: access[^/node/([^/]+)$]: allowing 'method' find
Info: access[^/node/([^/]+)$]: allowing $1 access
Info: access[/certificate_revocation_list/ca]: allowing 'method' find
Info: access[/certificate_revocation_list/ca]: allowing * access
Info: access[^/report/([^/]+)$]: allowing 'method' save
Info: access[^/report/([^/]+)$]: allowing $1 access
Info: access[/file]: allowing * access
Info: access[/certificate/ca]: adding authentication any
Info: access[/certificate/ca]: allowing 'method' find
Info: access[/certificate/ca]: allowing * access
Info: access[/certificate/]: adding authentication any
Info: access[/certificate/]: allowing 'method' find
Info: access[/certificate/]: allowing * access
Info: access[/certificate_request]: adding authentication any
Info: access[/certificate_request]: allowing 'method' find
Info: access[/certificate_request]: allowing 'method' save
Info: access[/certificate_request]: allowing * access
Info: access[/]: adding authentication any
Info: Inserting default '/status' (auth true) ACL
Info: Caching node for mgmt.example.com
Debug: No plugins found in subpath '/etc/puppet/modules/ntp/lib' (file / directory does not exist)
Debug: No plugins found in subpath '/etc/puppet/modules/helloworld/lib' (file / directory does not exist)
Debug: No plugins found in subpath '/etc/puppet/modules/apt/lib' (file / directory does not exist)
Debug: No plugins found in subpath '/etc/puppet/modules/puppetlabs_apt/lib' (file / directory does not exist)
Info: Caching node for mgmt.example.com
Error: Puppet::Parser::AST::Resource failed with error ArgumentError: Could not find declared class puppetlabs_apt at /etc/puppet/manifests/site.pp:3 on node mgmt.example.com
Error: Puppet::Parser::AST::Resource failed with error ArgumentError: Could not find declared class puppetlabs_apt at /etc/puppet/manifests/site.pp:3 on node mgmt.example.com
Error: Puppet::Parser::AST::Resource failed with error ArgumentError: Could not find declared class puppetlabs_apt at /etc/puppet/manifests/site.pp:3 on node mgmt.example.com
Debug: Finishing transaction 70187171703400
Debug: Received report to process from mgmt.example.com
Debug: Processing report from mgmt.example.com with processor Puppet::Reports::Store

I have also attempted using include puppetlabs_apt in place of the class manner.

What else can I do to find out why the master can't find this module, but it can find other ones installed in the same location?

We have a few Dell servers with iDrac express, and we would like to start using the iDrac features. Our network is separated into a few VLANs for our different subnets. Our management subnet is on VLAN 28, and our data subnet is on VLAN 29. I have set up iDrac express to use VLAN 28.

How can I configure the switchport to have VLAN 29 traffic untagged and also accept traffic tagged with VLAN 28?

Background

We have a primarily Linux environment, but we have 40 Macs to support. I'm trying to integrate them into our standardized print system. We have about 50 printers shared from a CUPS server with CUPS Browsing.

Current Status

I have modified /printers/etc/cupsd.conf by removing the BrowseLocalProtocols line and adding the line BrowseProtocols CUPS. Now I can see all of our printers when I open the Print & Scan pane in System Preferences. Unfortunately, none of the printers show up in the print dialog for any applications.

I can add printers to the list by clicking the + to add a printer in Print & Scan, selecting a printer, and clicking add. I get a dialog asking if I want to continue since a printer with the same name already exists. I'm not sure how modifying the printer on the CUPS server will affect the clients.

Is there any way to just have all cups shared printers show up in the user's printer list? Is there a way to add these printers on the command line or in a login script? Should I add them all on a system running Workgroup Manager and distribute them with MCX?

In both Workgroup Manager and Profile Manager, you can drop in arbitrary plist files to be delivered to clients. If an application gets its preferences from MCX will it automatically work with Profiles?

We are a Linux shop with about 30 Macs to support. We have our Leopard and Snow Leopard systems set up with LDAP authentication and automounted NFSv3 home directories so our staff have the same login and file whether they use OS X or Ubuntu. The only issue we have is that with NFSv3, we can't use Firefox >= 4. That issue still exists in Lion.

Now that OS X supports NFSv4 in Lion, I decided to try that out. It failed rapidly. I am unable to open applications. When I log in with ssh, many commands related to file operations hang.

On Linux NFSv4 clients, you must set up a domain name for mapping usernames between the client and the server in /etc/idmpad.conf. Is there anything like that in Lion? Are there any other configuration setting I need to check?

I have also tried using the latest version of Netatalk, but after a while, Microsoft Word starts saying files are read only.

Updated information

We discovered that using async in NFSv3 solved our problem with Firefox. Unfortunately, async does not solve the problem with NFSv4.

That turned out to be a misunderstanding of the problem. async does not solve the problem for either NFSv3 or NFSv4.

Testing Method

We have a couple of test accounts in our LDAP server with autofs entries pointing to an NFSv4 server on Ubuntu. I test by logging in via the login window or by ssh. In the GUI, I try opening applications and editing text files. Via ssh, I try editing text files with vim.

For the NFS Manager suggestion, I used su to become one of those users and tried editing a file with vim.

Server Settings

This is the /etc/exports from my testing nfsv4 server. The settings are the same as the production NFSv3 servers.

/var/lib/nfs/v4root @utm(ro,fsid=0,root_squash,insecure,no_subtree_check,async) @admin(ro,fsid=0,no_root_squash,insecure,no_subtree_check,async)

/var/lib/nfs/v4root/d2/export/fac @utm(fsid=31,rw,async,root_squash,no_subtree_check,insecure) @admin(fsid=31,rw,async,no_root_squash,no_subtree_check,insecure)
/var/lib/nfs/v4root/d2/export/grad @utm(fsid=32,rw,async,root_squash,no_subtree_check,insecure) @admin(fsid=32,rw,async,no_root_squash,no_subtree_check,insecure)
/var/lib/nfs/v4root/d2/export/staff @utm(fsid=33,rw,async,root_squash,no_subtree_check,insecure) @admin(fsid=33,rw,async,no_root_squash,no_subtree_check,insecure)

/d2/export/fac @utm(fsid=41,rw,async,root_squash,no_subtree_check,insecure) @admin(fsid=41,rw,async,no_root_squash,no_subtree_check,insecure)
/d2/export/grad @utm(fsid=42,rw,async,root_squash,no_subtree_check,insecure) @admin(fsid=42,rw,async,no_root_squash,no_subtree_check,insecure)
/d2/export/staff @utm(fsid=43,rw,async,root_squash,no_subtree_check,insecure) @admin(fsid=43,rw,async,no_root_squash,no_subtree_check,insecure)

Client mount options

The clients use autofs in LDAP to mount the filesystem. The options follow:

intr,tcp,rw,vers=4,timeo=20

I have tried with just vers=4, but I get the same results.

Network

For this test, the client and the server are on different subnets. The traffic goes through 100 Mbps cisco switches with gigabit connections to the cisco route switch. Throughput tests show consistent 91 Mbps transfers with low .3 ms pings. This network has been appropriate for NFSv3 for many years.

Solution

Wait for 10.7.3. I am pleased to report that this was a bug in 10.7.2, and the 10.7.3 prerelease fixes it.

According to the cupsd.conf documentation, one should be able to "require authentication for remote access, but allow local access without authentication." There doesn't appear to be any other documentation on this subject.

I tried putting the following in my cupsd.conf:

<Location />
  # Restrict access to the server...
  Allow from 192.168.1.0/24
  Require valid-user
  Satisfy any
  Order allow,deny
</Location>

It doesn't work for me.

Has anyone gotten this to work? Is there an example cupsd.conf available with this configuration?

We have an NFS export for any of our users to install and maintain useful software for the network mounted at /public on our clients. On the NFS server, this directory is world writable with the sticky bit set(like /tmp).

One of the users of this service has a symbolic link in /public to an executable file. Since we upgraded our workstations from Ubuntu 9.04 to 10.10, we get permission denied when we try to execute this file via the symbolic link. If we remove the sticky bit, we no longer get permission denied.

I haven't found anything in our logs or dmesg. Is this an app armor feature or a bug introduced between Ubuntu 9.04 and 10.10?

It seems to me that data=journal prevents file system inconsistency in the case of power failure. Using it with a dedicated journal device mitigates the performance penalty of writing the data twice. A power outage would still lose the data that is currently being written to the journal, but the file system on disk would always be consistent.

If that amount of loss is acceptable, is a RAID controller with battery backed cache really worthwhile?