thr3ads.net - Puppet users - puppet ldap issue [Sep 2007]

If this information is useful, please help other people find it:
Share via:

Edward Bailey

2007-Sep-04 19:10 UTC

puppet ldap issue

Hi,

I have run into an issue using puppet in an ldap environment and I am
wondering if anyone else has run into the same issue.

A number of the puppet clients in my testing environment are failing to
apply new configurations because the puppet client is getting an ldap error.
Currently, I am attempting to push a new bash_profile to my home directory
and then set my username/group to then own the new file. This setting worked
out of the box for about half the clients. The other half have the error
below. If I reload the puppet client then the new configuration is applied
immediately. Any help or ideas are greatly appreciated.

FYI - i can login to each server without any issues, run "getent
group" or
any other ldap related command. Also the other applications on the server
are not exhibiting the error.



Sep  4 14:56:25 tucapd158.vsi.com puppetd[26677]: Finished
configuration run in 371.12 seconds

Sep  4 14:56:25 tucapd158.vsi.com puppetd[26677]: Finished configuration run
in 371.12 seconds
Sep  4 14:56:25 tucapd158.vsi.com puppetd[26677]:
(//default/bash_profile/File[/home/ebailey/.bash_profile]) Failed to
retrieve current state of resource: Could not find group sysadmin
Sep  4 14:56:25 tucapd158.vsi.com last message repeated 2 times
Sep  4 14:56:25 tucapd158.vsi.com puppetd[26677]: nss_ldap: could not get
LDAP result - Can''t contact LDAP server
Sep  4 14:50:14 tucapd158.vsi.com puppetd[26677]: nss_ldap: reconnected to
LDAP server after 1 attempt(s)
Sep  4 14:50:14 tucapd158.vsi.com puppetd[26677]: nss_ldap: reconnecting to
LDAP server...
Sep  4 14:50:14 tucapd158.vsi.com puppetd[26677]: Starting configuration run


_______________________________________________
Puppet-users mailing list
Puppet-users@madstop.com
https://mail.madstop.com/mailman/listinfo/puppet-users

Edward Bailey

2007-Sep-04 20:35 UTC

head link

puppet ldap issue

Hi,

I have run into an issue using puppet in an ldap environment and I am
wondering if anyone else has run into the same issue.

A number of the puppet clients in my testing environment are failing to
apply new configurations because the puppet client is getting an ldap error.
Currently, I am attempting to push a new bash_profile to my home directory
and then set my username/group to then own the new file. This setting worked
out of the box for about half the clients. The other half have the error
below. If I reload the puppet client then the new configuration is applied
immediately. Any help or ideas are greatly appreciated.

FYI - i can login to each server without any issues, run "getent
group" or
any other ldap related command. Also the other applications on the server
are not exhibiting the error.



Sep  4 14:56:
25 tucapd158.vsi.com
puppetd[26677]: Finished configuration run
in 371.12 seconds

Sep  4 14:56:25 tucapd158.vsi.com puppetd[26677]: Finished configuration run
in 371.12 seconds
Sep  4 14:56:25 tucapd158.vsi.com puppetd[26677]:
(//default/bash_profile/File[/home/ebailey/.bash_profile]) Failed to
retrieve current state of resource: Could not find group sysadmin
Sep  4 14:56:25 tucapd158.vsi.com last message repeated 2 times
Sep  4 14:56:25 tucapd158.vsi.com puppetd[26677]: nss_ldap: could not get
LDAP result - Can''t contact LDAP server
Sep  4 14:50:14 tucapd158.vsi.com puppetd[26677]: nss_ldap: reconnected to
LDAP server after 1 attempt(s)
Sep  4 14:50:14 tucapd158.vsi.com puppetd[26677]: nss_ldap: reconnecting to
LDAP server...
Sep  4 14:50:14 tucapd158.vsi.com puppetd[26677]: Starting configuration run


_______________________________________________
Puppet-users mailing list
Puppet-users@madstop.com
https://mail.madstop.com/mailman/listinfo/puppet-users

Luke Kanies

2007-Sep-04 21:21 UTC

head link

Re: puppet ldap issue

On Sep 4, 2007, at 3:35 PM, Edward Bailey wrote:
> Hi,
>
> I have run into an issue using puppet in an ldap environment and I  
> am wondering if anyone else has run into the same issue.
>
> A number of the puppet clients in my testing environment are  
> failing to apply new configurations because the puppet client is  
> getting an ldap error. Currently, I am attempting to push a new  
> bash_profile to my home directory and then set my username/group to  
> then own the new file. This setting worked out of the box for about  
> half the clients. The other half have the error below. If I reload  
> the puppet client then the new configuration is applied  
> immediately. Any help or ideas are greatly appreciated.
You''ll have to do straces or something to track down how your client  
is interacting with the ldap server.  It looks like there''s maybe  
something Puppet is doing that''s breaking this communication, but it  
works fine with passwd files so it must be some combination of puppet  
and ldap.

It''d be great if someone else using ldap could try to reproduce.

  --
  What''s the good of having mastery over cosmic balance and knowing the
  secrets of fate if you can''t blow something up?
                  -- Terry Pratchett, "Reaper Man"
  ---------------------------------------------------------------------
  Luke Kanies | http://reductivelabs.com | http://madstop.com

Edward Bailey

2007-Sep-05 01:52 UTC

head link

Re: puppet ldap issue

i will run strace and see what happens. Thanks!

Ed

On 9/4/07, Luke Kanies <luke@madstop.com> wrote:>
> On Sep 4, 2007, at 3:35 PM, Edward Bailey wrote:
>
> > Hi,
> >
> > I have run into an issue using puppet in an ldap environment and I
> > am wondering if anyone else has run into the same issue.
> >
> > A number of the puppet clients in my testing environment are
> > failing to apply new configurations because the puppet client is
> > getting an ldap error. Currently, I am attempting to push a new
> > bash_profile to my home directory and then set my username/group to
> > then own the new file. This setting worked out of the box for about
> > half the clients. The other half have the error below. If I reload
> > the puppet client then the new configuration is applied
> > immediately. Any help or ideas are greatly appreciated.
>
> You''ll have to do straces or something to track down how your
client
> is interacting with the ldap server.  It looks like there''s maybe
> something Puppet is doing that''s breaking this communication, but
it
> works fine with passwd files so it must be some combination of puppet
> and ldap.
>
> It''d be great if someone else using ldap could try to reproduce.
>
>   --
>   What''s the good of having mastery over cosmic balance and
knowing the
>   secrets of fate if you can''t blow something up?
>                   -- Terry Pratchett, "Reaper Man"
>   ---------------------------------------------------------------------
>   Luke Kanies | http://reductivelabs.com | http://madstop.com
>
>
> _______________________________________________
> Puppet-users mailing list
> Puppet-users@madstop.com
> https://mail.madstop.com/mailman/listinfo/puppet-users
>

_______________________________________________
Puppet-users mailing list
Puppet-users@madstop.com
https://mail.madstop.com/mailman/listinfo/puppet-users

Edward Bailey

2007-Sep-18 17:08 UTC

head link

Re: puppet ldap issue

This is what I see running strace on a rhel 3 server during the time period
that puppet complains about the ldap server

stat64("/opt/puppet", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
lstat64("/opt/puppet", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
stat64("/opt/puppet", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
open("/etc/passwd", O_RDONLY)           = 8
fcntl64(8, F_GETFD)                     = 0
fcntl64(8, F_SETFD, FD_CLOEXEC)         = 0
fstat64(8, {st_mode=S_IFREG|0644, st_size=1639, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
0xb71a0000
read(8, "root:x:0:0:root:/root:/bin/bash\n"..., 4096) = 1639
close(8)                                = 0
munmap(0xb71a0000, 4096)                = 0
stat64("/opt/puppet", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
_llseek(7, 600, [600], SEEK_SET)        = 0
stat64("/opt/puppet", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
stat64("/opt/puppet", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
gettimeofday({1190134792, 304009}, NULL) = 0
times({tms_utime=115, tms_stime=27, tms_cutime=13, tms_cstime=25}) = 7558251
gettimeofday({1190134792, 305930}, NULL) = 0
times({tms_utime=115, tms_stime=27, tms_cutime=13, tms_cstime=25}) = 7558251
gettimeofday({1190134792, 306744}, NULL) = 0
gettimeofday({1190134792, 307205}, NULL) = 0
times({tms_utime=115, tms_stime=27, tms_cutime=13, tms_cstime=25}) = 7558251
gettimeofday({1190134792, 308077}, NULL) = 0
gettimeofday({1190134792, 308744}, NULL) = 0
times({tms_utime=115, tms_stime=27, tms_cutime=13, tms_cstime=25}) = 7558252
gettimeofday({1190134792, 310684}, NULL) = 0
stat64("/tmp/testfile", {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
lstat64("/tmp/testfile", {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
stat64("/tmp/testfile", {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
open("/etc/passwd", O_RDONLY)           = 8
fcntl64(8, F_GETFD)                     = 0
fcntl64(8, F_SETFD, FD_CLOEXEC)         = 0
fstat64(8, {st_mode=S_IFREG|0644, st_size=1639, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
0xb71a0000
read(8, "root:x:0:0:root:/root:/bin/bash\n"..., 4096) = 1639
close(8)                                = 0
munmap(0xb71a0000, 4096)                = 0
stat64("/tmp/testfile", {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
_llseek(7, 600, [600], SEEK_SET)        = 0
stat64("/tmp/testfile", {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
stat64("/tmp/testfile", {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
stat64("/tmp/testfile", {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
stat64("/tmp/testfile", {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
stat64("/tmp/testfile", {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
gettimeofday({1190134792, 325924}, NULL) = 0
times({tms_utime=117, tms_stime=27, tms_cutime=13, tms_cstime=25}) = 7558253
gettimeofday({1190134792, 327229}, NULL) = 0
times({tms_utime=117, tms_stime=27, tms_cutime=13, tms_cstime=25}) = 7558253
gettimeofday({1190134792, 327901}, NULL) = 0
gettimeofday({1190134792, 328284}, NULL) = 0
gettimeofday({1190134792, 328804}, NULL) = 0
stat64("/var/lib/puppet/state/state.yaml", {st_mode=S_IFREG|0640,
st_size=5634, ...}) = 0
gettimeofday({1190134792, 329520}, NULL) = 0
stat64("/var/lib/puppet/state", {st_mode=S_IFDIR|S_ISVTX|0777,
st_size=4096,
...}) = 0
open("/var/lib/puppet/state/state.yaml",
O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE, 0660) = 8
fcntl64(8, F_GETFL)                     = 0x8001 (flags
O_WRONLY|O_LARGEFILE)
fstat64(8, {st_mode=S_IFREG|0640, st_size=0, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
0xb71a0000
_llseek(8, 0, [0], SEEK_CUR)            = 0
flock(8, LOCK_EX)                       = 0
open("/var/lib/puppet/state/state.yaml.tmp",
O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE, 0660) = 9
fcntl64(9, F_GETFL)                     = 0x8001 (flags
O_WRONLY|O_LARGEFILE)
fstat64(9, {st_mode=S_IFREG|0640, st_size=0, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
0xb719f000
_llseek(9, 0, [0], SEEK_CUR)            = 0
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
write(9, "--- \nFile[/opt/puppet]: \n  !ruby"..., 4096) = 4096
write(9, "4:00\nFile[/var/lib/puppet/facts]"..., 1538) = 1538
close(9)                                = 0
munmap(0xb719f000, 4096)                = 0
rename("/var/lib/puppet/state/state.yaml.tmp",
"/var/lib/puppet/state/state.yaml") = 0
flock(8, LOCK_UN)                       = 0
close(8)                                = 0
munmap(0xb71a0000, 4096)                = 0
gettimeofday({1190134792, 447841}, NULL) = 0
gettimeofday({1190134792, 448232}, NULL) = 0
times({tms_utime=123, tms_stime=29, tms_cutime=13, tms_cstime=25}) = 7558265
gettimeofday({1190134792, 448668}, NULL) = 0
gettimeofday({1190134792, 449555}, NULL) = 0
time([1190134792])                      = 1190134792
getpid()                                = 22052
send(5, "<29>Sep 18 12:59:52 puppetd[2205"..., 80, MSG_NOSIGNAL)
= 80
getpid()                                = 22052
stat64("/var/lib/puppet/state/puppetdlock", {st_mode=S_IFREG|0644,
st_size=5, ...}) = 0
open("/var/lib/puppet/state/puppetdlock", O_RDONLY|O_LARGEFILE) = 8
fstat64(8, {st_mode=S_IFREG|0644, st_size=5, ...}) = 0
fstat64(8, {st_mode=S_IFREG|0644, st_size=5, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
0xb71a0000
_llseek(8, 0, [0], SEEK_CUR)            = 0
read(8, "22052", 4096)                  = 5
read(8, "", 4096)                       = 0
close(8)                                = 0
munmap(0xb71a0000, 4096)                = 0
unlink("/var/lib/puppet/state/puppetdlock") = 0
stat64("/var/lib/puppet/state/puppetdlock", 0xbffe9d20) = -1 ENOENT
(No such
file or directory)
stat64("/var/lib/puppet/state/puppetdlock", 0xbffebdc0) = -1 ENOENT
(No such
file or directory)
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
brk(0)                                  = 0x8bb6000
brk(0x8bd7000)                          = 0x8bd7000
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
gettimeofday({1190134792, 541641}, NULL) = 0
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
gettimeofday({1190134792, 553575}, NULL) = 0
gettimeofday({1190134792, 553931}, NULL) = 0
gettimeofday({1190134792, 554147}, NULL) = 0
gettimeofday({1190134792, 554267}, NULL) = 0
gettimeofday({1190134792, 554415}, NULL) = 0
gettimeofday({1190134792, 554782}, NULL) = 0
select(4, [3], [], [], {0, 0})          = 0 (Timeout)
gettimeofday({1190134792, 555276}, NULL) = 0
gettimeofday({1190134792, 555713}, NULL) = 0
gettimeofday({1190134792, 556007}, NULL) = 0
gettimeofday({1190134792, 556140}, NULL) = 0
gettimeofday({1190134792, 556318}, NULL) = 0
gettimeofday({1190134792, 556443}, NULL) = 0
gettimeofday({1190134792, 556582}, NULL) = 0
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
--- SIGVTALRM (Virtual timer expired) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
gettimeofday({1190134792, 721231}, NULL) = 0
select(4, [3], [], [], {14, 999689} <unfinished ...>
Process 22052 detached

On 9/4/07, Edward Bailey <eds.mailing.list.account@gmail.com>
wrote:>
> i will run strace and see what happens. Thanks!
>
> Ed
>
> On 9/4/07, Luke Kanies <luke@madstop.com> wrote:
> >
> > On Sep 4, 2007, at 3:35 PM, Edward Bailey wrote:
> >
> > > Hi,
> > >
> > > I have run into an issue using puppet in an ldap environment and
I
> > > am wondering if anyone else has run into the same issue.
> > >
> > > A number of the puppet clients in my testing environment are
> > > failing to apply new configurations because the puppet client is
> > > getting an ldap error. Currently, I am attempting to push a new
> > > bash_profile to my home directory and then set my username/group
to
> > > then own the new file. This setting worked out of the box for
about
> > > half the clients. The other half have the error below. If I
reload
> > > the puppet client then the new configuration is applied
> > > immediately. Any help or ideas are greatly appreciated.
> >
> > You''ll have to do straces or something to track down how your
client
> > is interacting with the ldap server.  It looks like there''s
maybe
> > something Puppet is doing that''s breaking this communication,
but it
> > works fine with passwd files so it must be some combination of puppet
> > and ldap.
> >
> > It''d be great if someone else using ldap could try to
reproduce.
> >
> >   --
> >   What''s the good of having mastery over cosmic balance and
knowing the
> >   secrets of fate if you can''t blow something up?
> >                   -- Terry Pratchett, "Reaper Man"
> >  
---------------------------------------------------------------------
> >   Luke Kanies | http://reductivelabs.com | http://madstop.com
> >
> >
> > _______________________________________________
> > Puppet-users mailing list
> > Puppet-users@madstop.com
> > https://mail.madstop.com/mailman/listinfo/puppet-users
> >
>
>

_______________________________________________
Puppet-users mailing list
Puppet-users@madstop.com
https://mail.madstop.com/mailman/listinfo/puppet-users

Luke Kanies

2007-Sep-24 05:11 UTC

head link

Re: puppet ldap issue

On Sep 18, 2007, at 12:08 PM, Edward Bailey wrote:
> This is what I see running strace on a rhel 3 server during the  
> time period that puppet complains about the ldap server
I can''t see anything specifically that points to the problem.

It could be that Puppet is doing too many queries of some kind and  
overloading the ldap support as a result, but given what I''ve seen,  
that would be a *lot* of queries.

At this point it''s a question of debugging ldap support vs. anything  
specifically in Puppet, from what I can tell.

  --
  The Ninety-Ninety Rule of Project Schedules:
    The first 90% of the task takes 90% of the time, and the last
    10% takes the other 90%.
  ---------------------------------------------------------------------
  Luke Kanies | http://reductivelabs.com | http://madstop.com

Edward Bailey

2007-Sep-28 04:52 UTC

head link

Re: puppet ldap issue

thanks for taking a look - I did not see anything from the output either. I
am going to upgrade the version of ruby we are using and the upgrade to the
latest version of puppet and see if that makes a difference.

Thanks

Ed

On 9/24/07, Luke Kanies <luke@madstop.com> wrote:>
> On Sep 18, 2007, at 12:08 PM, Edward Bailey wrote:
>
> > This is what I see running strace on a rhel 3 server during the
> > time period that puppet complains about the ldap server
>
> I can''t see anything specifically that points to the problem.
>
> It could be that Puppet is doing too many queries of some kind and
> overloading the ldap support as a result, but given what I''ve
seen,
> that would be a *lot* of queries.
>
> At this point it''s a question of debugging ldap support vs.
anything
> specifically in Puppet, from what I can tell.
>
>   --
>   The Ninety-Ninety Rule of Project Schedules:
>     The first 90% of the task takes 90% of the time, and the last
>     10% takes the other 90%.
>   ---------------------------------------------------------------------
>   Luke Kanies | http://reductivelabs.com | http://madstop.com
>
>
> _______________________________________________
> Puppet-users mailing list
> Puppet-users@madstop.com
> https://mail.madstop.com/mailman/listinfo/puppet-users
>

_______________________________________________
Puppet-users mailing list
Puppet-users@madstop.com
https://mail.madstop.com/mailman/listinfo/puppet-users

Apparently Analagous Threads

Search for more reasonably related threads

Puppet users - Sep 2007 - puppet ldap issue

puppet ldap issue

puppet ldap issue

Re: puppet ldap issue

Re: puppet ldap issue

Re: puppet ldap issue

Re: puppet ldap issue

Re: puppet ldap issue

Apparently Analagous Threads