False positives for hobbit-plugins libs test 🔗 link

Hi folks,

In my environment we use the following:

   * Debian stretch with xymon 4.3.28-2
   * Debian stretch with xymon-client 4.3.28-2 and hobbit-plugins 20170219
   * Debian wheezy with xymon-client 4.3.0~beta2.dfsg-9.1+deb7u1 and  hobbit-plugins 20120532

It all works fine, except that hobbit-plugins often gives false  positives in the 'libs' column, indicating that certain "processes  have libs linked that were upgraded". However, in those cases it makes  no difference whether the processes are restarted, or even if the  machine is rebooted: the processes continue to be flagged falsely.  Examples include libvirt-qemu and mysql. It's the same on both of the  platforms indicated above.

Is there a fix or a reasonable workaround for this problem?

Thanks,

Jaap

Hi Jaap,

On Mon, Jul 09, 2018 at 07:47:33PM +0000, Jaap Winius wrote:

At least the mysql case should be fixed in hobbit-plugins 20180610,
see https://bugs.debian.org/873838. The according changelog item:

  * Whitelist multipath-related /[aio] false positives for mysql/mariadb
    servers in libs check. Thanks to Daniel Rieken for the bug report!
    (Closes: #873838)

Don't know what causes libvirt-qemu case. If the fix for mysql
mentioned doesn't fix it for libvirt-qemu, too, the output of "lsof -p
<pid-of-libvirt-qemu-binary>" might give some hints.

  Kind regards, Axel (one of Debian's hobbit-plugins and xymon maintainers)
-- 
PGP: 2FF9CD59612616B5      /~\  Plain Text Ribbon Campaign, http://arc.pasp.de/
Mail: user-bc188e45dae4@xymon.invalid  \ /  Say No to HTML in E-Mail and Usenet
Mail+Jabber: user-0064bde8d49d@xymon.invalid  X
https://axel.beckert.ch/   / \  I love long mails: https://email.is-not-s.ms/

Quoting Axel Beckert <user-bc188e45dae4@xymon.invalid>:

Hi Axel,

Thanks very much! On all of the Debian stretch systems affected by the  mysql issue, I could fix it by creating /etc/xymon/libs.local.yaml  with the following contents:

   # local config file for the libs test
   ---
   whitelist:
     /usr/sbin/mysqld:
       - '^/\[aio\]$'

It looks like the same problem causes the libvirt-qemu issue, but I  was only able to fix it on one of the two affected Debian stretch  systems by adding similar content to the same file:

   # local config file for the libs test
   ---
   whitelist:
     /usr/bin/qemu-system-x86_64:
       - '^/\[aio\]$'

On that system, Xymon was reporting:

   The following processes have libs linked that were upgraded:

   libvirt-qemu:
     /usr/bin/qemu-system-x86_64 (4561)

(Even though there were almost a dozen qemu-system-x86_64 processes  running on this system).
However, on the system where this whitelist configuration had no  effect, the message was also different:

   The following processes have libs linked that were upgraded:

   libvirt-qemu:
     /usr/bin/qemu-system-x86_64 (deleted) (3779 3852 3933 4008 4081  4155 4229 4304 4376 4496 4683 4809)

'(deleted)'? Could this have something to do with it?
On that system I also tried this variation:

   # local config file for the libs test
   ---
   whitelist:
     /usr/bin/qemu-system-x86_64:
       - '.*'

... but that didn't work either.

As for the Debian wheezy systems, although they don't have the same  .yaml files, is there another way to solve the same problem on these  systems?

Thanks again!

Cheers,

Jaap

Quoting Jaap Winius <user-16708c3648e1@xymon.invalid>:

I can now report that this also worked on the other Debian stretch  system after it was reboot.

Still no idea on how I would go about doing this on a Debian wheezy system.

Cheers,

Jaap

Hi Jaap,

On Tue, Jul 10, 2018 at 04:11:54PM +0000, Jaap Winius wrote:

Probably because it wasn't a false positive but a true possitive.

Inside the hobbit-plugins package there are some scripts which can be
used to build a backported version for Wheezy systems and earlier.

Have a look at debian/rules in the source package:

If the first changelog entry says the package is targeted for
wheezy-backports, the build should automatically adjust the
dependencies, paths, variables and so on.

But I haven't used them for years now, so I don't know if they still
work.

Example workflow on buster to build the buster hobbit-plugins as wheezy
backport (untested):

On buster:

$ apt-get source -d hobbit-plugins

Then copy the hobbit-plugins_20180610* files to a wheezy box.

Alternatively do a

$ git clone https://salsa.debian.org/debian/hobbit-plugins.git

on the wheezy box.

On the wheezy box do:

$ dpkg-source -x hobbit-plugins_20180610.dsc
$ cd hobbit-plugins-20180610
$ dch -v "20180610~bpo7+1" --distribution wheezy-backports-sloppy 'Rebuild for wheezy-backports-sloppy'
$ dpkg-buildpackage

		Kind regards, Axel

-- 
PGP: 2FF9CD59612616B5      /~\  Plain Text Ribbon Campaign, http://arc.pasp.de/
Mail: user-bc188e45dae4@xymon.invalid  \ /  Say No to HTML in E-Mail and Usenet
Mail+Jabber: user-0064bde8d49d@xymon.invalid  X
https://axel.beckert.ch/   / \  I love long mails: https://email.is-not-s.ms/

Quoting Axel Beckert <user-bc188e45dae4@xymon.invalid>:

...

Unfortunately, although I was able to compile this package on wheezy,  I wasn't able to install it:

  hobbit-plugins depends on xymon-client (>= 4.3.17-2~); however:
   Version of xymon-client on system is 4.3.0~beta2.dfsg-9.1+deb7u1.

I tried to compile xymon-4.3.17 as well, but then that one depends on  further packages that I eventually could not compile, such as  apache2_2.4.10 (which contains apache2-dev, which provides  dh-apache2). Oh, well.

So, it was worth a try, but I don't have many wheezy systems left and  they will be replaced soon enough anyway.
And, more importantly, now that I know how to whitelist the mysqld and  qemu-system-x86_64 processes for the libs test, all of my systems will  soon be green!

Thanks again for your help!

Cheers,

Jaap

Hi,

On Tue, Jul 10, 2018 at 09:18:35PM +0000, Jaap Winius wrote:

Hrm. This probably means that the backporting script no more works
probably, because it should do an

    sed -e 's/(>= 4.3.17-2~)/(<< 4.3.7-1~)/g' -i debian/control

besides other things.

Sounds familiar, too. :-)

		Kind regards, Axel
-- 
PGP: 2FF9CD59612616B5      /~\  Plain Text Ribbon Campaign, http://arc.pasp.de/
Mail: user-bc188e45dae4@xymon.invalid  \ /  Say No to HTML in E-Mail and Usenet
Mail+Jabber: user-0064bde8d49d@xymon.invalid  X
https://axel.beckert.ch/   / \  I love long mails: https://email.is-not-s.ms/