Outils pour utilisateurs

Outils du site


blog

AAP Diagnostic supervision et métrologie

Diagnostic d'un job

sudo -u awx -i
awx-manage shell_plus --ipython
j=UnifiedJob.objects.filter(id=211242)
j[0].status
j.values_list()[0]
 
UnifiedJob.objects.filter(id=211242).values_list()[0]
 
UnifiedJob.objects.filter(id=211242)[0].result_stdout
 
for j in  UnifiedJob.objects.filter(name='Template_name' , status='failed').values_list():
     print(
     ';'.join([
             str(j[0]),
             str(j[2].isoformat(timespec='minutes')),
             j[12],
             j[27]
             ]
         )
         )
 
UnifiedJob.objects.filter(name='Template_name' , status='error').values_list()

Voir aussi

  • /api/v2/jobs/211242/
  • /api/v2/jobs/211242/stdout/

Supervision

awx-manage --help | egrep "check|test"

Générique supervision

https://www.redhat.com/sysadmin/monitor-users-linux

  • Vérif que le ReadOnly des points de montage remonte bien en erreur
  • Heure NTP
  • Test et temps de la résolution DNS

Pb

Erreur 502

/etc/nginx/nginx.conf

    upstream daphne {
        server unix:/var/run/tower/daphne.sock;
    }

/etc/nginx/nginx.conf

        location /websocket {
            # Pass request to the upstream alias
            proxy_pass http://daphne;
            # Require http version 1.1 to allow for upgrade requests
            proxy_http_version 1.1;
            # We want proxy_buffering off for proxying to websockets.
            proxy_buffering off;
            # http://en.wikipedia.org/wiki/X-Forwarded-For
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            # enable this if you use HTTPS:
            proxy_set_header X-Forwarded-Proto https;
            # pass the Host: header from the client for the sake of redirects
            proxy_set_header Host $http_host;
            # We've set the Host header, so we don't need Nginx to muddle
            # about with redirects
            proxy_redirect off;
            # Depending on the request value, set the Upgrade and
            # connection headers
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
        }

/var/log/nginx/access.log

192.168.6.57 - - [16/Oct/2023:09:03:31 +0000] "GET /websocket/ HTTP/1.1" 502 552 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36" "-"
192.168.213.56 - - [16/Oct/2023:09:03:32 +0000] "GET /websocket/broadcast/ HTTP/1.1" 502 150 "-" "Python/3.9 aiohttp/3.7.4" "-"
192.168.6.57 - - [16/Oct/2023:09:03:36 +0000] "GET /websocket/ HTTP/1.1" 502 552 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36" "-"
192.168.6.57 - - [16/Oct/2023:09:03:41 +0000] "GET /websocket/ HTTP/1.1" 502 552 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36" "-"
192.168.213.56 - - [16/Oct/2023:09:03:42 +0000] "GET /websocket/broadcast/ HTTP/1.1" 502 150 "-" "Python/3.9 aiohttp/3.7.4" "-"
192.168.6.57 - - [16/Oct/2023:09:03:46 +0000] "GET /websocket/ HTTP/1.1" 502 552 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36" "-"
192.168.6.57 - - [16/Oct/2023:09:03:51 +0000] "GET /websocket/ HTTP/1.1" 502 552 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36" "-"
192.168.213.56 - - [16/Oct/2023:09:03:52 +0000] "GET /websocket/broadcast/ HTTP/1.1" 502 150 "-" "Python/3.9 aiohttp/3.7.4" "-"
# fuser -v /var/run/tower/daphne.sock
                     USER        PID ACCESS COMMAND
/run/tower/daphne.sock:
                     awx       452944 F.... python3

# ps -f -p 452944
UID          PID    PPID  C STIME TTY          TIME CMD
awx       452944    1641  0 08:20 ?        00:01:13 python3 /var/lib/awx/venv/awx/bin/daphne -u /var/run/tower/daphne.sock awx.asgi:channel_layer
Solution

Le problème était du à la lenteur de la résolution DNS

2025/03/24 15:06

Limiter le nombre de console TTY SystemD

Sous Debian Jessie

systemctl mask getty@tty1.service

/etc/systemd/logind.conf

[Login]
NAutoVTs=0

Ne pas oublier de restreindre : /etc/securetty

2025/03/24 15:06

Libvirt iptables réseau changement d'interface Wifi à la place de eth0

Note : iptables est remplacé maintenant par nftables

Problématique

J'ai emporté un peu de boulot en vacances, j'ai l'habitude pour mes tests d'utiliser libvirt.
Tiens plus d'accès à internet depuis mes VM
Eurêka ! C'est parce que je suis en Wifi, alors que d'habitude je suis en filaire

A faire : Écrire un script du style : iptables-sed 's/eth0/wlan0/'

1ere approche

A vérifier

Table filter (table par défaut)

iptables -S > iptables-filter.txt
cat iptables-filter.txt  |grep eth0 |sed -e 's/^-A/-D/' > iptables-filter.sh
cat iptables-filter.txt  |grep eth0 |sed -e 's/^-A/-I/' -e 's/eth0/wlan0/g' >> iptables-filter.sh
sed -i -e 's/^/iptables /' iptables-filter.sh

Table NAT

iptables -S -t nat > iptables-nat.txt
cat iptables-nat.txt  |grep eth0 |sed -e 's/^-A/-D/' > iptables-nat.sh
cat iptables-nat.txt  |grep eth0 |sed -e 's/^-A/-I/' -e 's/eth0/wlan0/g' >> iptables-nat.sh
sed -i -e 's/^/iptables -t nat /' iptables-nat.sh

c'est partie

bash iptables-filter.sh
bash iptables-nat.sh

2eme aproche

On remet à zero les compteurs de paquets

iptables -Z

On regarde

iptables -L -n -v
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  virbr1 virbr1  0.0.0.0/0            0.0.0.0/0           
    0     0 REJECT     all  --  *      virbr1  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  virbr1 *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 ACCEPT     all  --  virbr0 virbr0  0.0.0.0/0            0.0.0.0/0           
    0     0 REJECT     all  --  *      virbr0  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
   39  2460 REJECT     all  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 DOCKER     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  docker0 docker0  0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  wlan0  virbr0  0.0.0.0/0            192.168.100.0/24     ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  virbr0 wlan0   192.168.100.0/24     0.0.0.0/0 

Ya pas de doute, c'est :

   39  2460 REJECT     all  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable

On cherche la règle concernée

iptables -S |grep REJECT |grep virbr0

On trouve 2 règles REJECT

-A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachabl

On les virent (on remplace -A par -D)

iptables -D FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
iptables -D FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
2025/03/24 15:06

Libvirt firewalld firewall-cmd iptables

Voir Firewalld Lockdown

Voir :

Voir aussi :

A la place de la ligne iptables commentée ci-dessus, j'essaye firewall-cmd

#iptables -t nat -I PREROUTING -p tcp -d 172.18.98.74 --dport 64001  -j DNAT --to-destination 192.168.122.95:22
firewall-cmd --zone=public --add-masquerade
firewall-cmd --add-forward-port=port=64001:proto=tcp:toport=22:toaddr=192.168.122.95

Mais ça n'est pas suffisant.

Note : iptables est remplacé maintenant par nftables

Pour que ca marche, j'ai je choix entre :

iptables -I FORWARD -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

ou

iptables -D FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable

ou mieux

#firewall-cmd --direct --passthrough ipv4 -D FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
firewall-cmd --direct --passthrough ipv4 -I FORWARD -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
2025/03/24 15:06

LibreSSL

Voir aussi :

  • mbedtls
git clone https://github.com/libressl-portable/portable
mv portable libressl
cd libressl

Les dépendances suivantes sont nécessaires :

  • automake
  • autoconf
  • bash
  • git
  • libtool
  • perl
  • pod2man
./autogen.sh
 
./configure
make -j $(nproc)
make check
sudo make install

Message d'erreur

openssl: error while loading shared libraries: libssl.so.32: cannot open shared object file: No such file or directory

Solution

export LD_LIBRARY_PATH=/usr/local/lib

dnsutils # dig
libtool # compil
perl
sudo apt-get build-dep openssl
sudo apt-get install automake autoconf libtool perl pod2pdf
 
git clone https://github.com/libressl-portable/portable
mv portable libressl
cd libressl
# Comme indiqué dans le fichier README :
./autogen.sh
./configure
make check
sudo make install
 
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/lib

/etc/profile.d/var_export_lib.sh

export LD_LIBRARY_PATH=/usr/local/lib
sudo chmod +x /etc/profile.d/var_export_lib.sh
2025/03/24 15:06
blog.txt · Dernière modification : de 127.0.0.1

Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki