Re: Failsafe.cf in cfengine 3.18
thierry thunot <[email protected]>
| Newsgroups | gmane.comp.sysutils.cfengine.general |
|---|---|
| Message-ID | <[email protected]> |
Hello Nick first of all thank you for your quick response. In fact in some Cfengine doc it is mentioned that we can force the update of client promises by the command cf-agent- KIf /var/cfengine/input/failsafe.cf to avoid waiting for the update automatic cfengine, to save time in debugging. I must have made a bad interpretation .... I will try to use update.cf Thank you again for your advice and explanation, have a good day!! Le mercredi 3 novembre 2021 à 19:15:41 UTC+1, Nick Anderson a écrit : > Thierry, > > perhaps this change of default behavior for purging non-existant files is > the behavior change you see: https://tracker.mender.io/browse/CFE-3662 > > On Wed, Nov 3, 2021 at 12:08 PM Nick Anderson <[email protected]> > wrote: > >> thierry thunot <[email protected]> writes: >> >> Hello all ;) i have a question about cfengine 3.18 and the automatic >>> generation of failsafe.cf in /var/cfengine/input. How can I generate >>> this file on 3.18, does it work differently? >>> >> Hi Thierry, >> >> failsafe.cf is generated when non-interactive policy runs fail syntax >> validation. >> >> For example, here we can see that: >> >> - >> >> Initially failsafe.cf does *not* exist in inputs. >> >> [root@hub ~]# ls /var/cfengine/inputs/ >> cfbs cfe_internal cf_promises_release_id cf_promises_validated controls def.json inventory lib modules promises.cf services standalone_self_upgrade.cf templates update.cf >> >> - >> >> We break the policy >> >> [root@hub ~]# echo BROKEN >> /var/cfengine/masterfiles/promises.cf >> >> - >> >> We initiate cf-execd to run once, it detects failure, but skips >> generation of failsafe.cf since interactive mode is detected. >> >> [root@hub ~]# cf-execd -KIFO >> /var/cfengine/inputs/promises.cf:393:7: error: syntax error >> BROKEN >> ^ >> /var/cfengine/inputs/promises.cf:393:7: error: Expected 'bundle' or 'body' keyword, wrong input 'BROKEN' >> BROKEN >> ^ >> error: There are syntax errors in policy files >> error: Policy failed validation with command '"/var/cfengine/bin/cf-promises" -c "/var/cfengine/inputs/promises.cf"' >> error: Failsafe condition triggered. Interactive session detected, skipping failsafe.cf execution. >> error: Error reading CFEngine policy. Exiting... >> >> - >> >> Indeed, no failsafe.cf is present in inputs >> >> [root@hub ~]# ls /var/cfengine/inputs/ >> cfbs cfe_internal cf_promises_release_id cf_promises_validated controls def.json inventory lib modules promises.cf services standalone_self_upgrade.cf templates update.cf >> >> - >> >> We wait for an unattended, non-interactive execution and check again >> seeing that indeed, there is a failsafe.cf present >> >> [root@hub ~]# sleep 300; ls /var/cfengine/inputs >> cfbs cf_promises_release_id cf_promises_validated controls failsafe.cf lib promises.cf standalone_self_upgrade.cf update.cf >> cfe_internal cf_promises_release_id.cfsaved cf_promises_validated.cfsaved def.json inventory modules services templates >> >> >> Note: cf-agent --bootstrap leverages the internal failsafe.cf, and you >> can find it in our source here >> <https://github.com/cfengine/core/blob/master/libpromises/failsafe.cf>. >> >> I would expect the policy update to be handled by update.cf. Can you >> explain how you use failsafe.cf to update your policy? >> >> Have you ever noticed this behavior? >>> >> I try to avoid committing broken policy that results in failsafe.cf >> being used. I have memory that there may be some bug or desired feature >> around not using a generated failsafe.cf if a custom one is present but >> I am unsure if that's actually a bug or a feature request or if there is a >> ticket for it or even how it could be accomplished to reliably allow a >> custom failsafe.cf to be used instead (i guess we could look for a >> preferred_failsafe.cf and use that if present instead of the internally >> generated one). >> > -- >> Nick Anderson | Doer of Things | (+1) 785-550-1767 <(785)%20550-1767> | >> https://northern.tech >> > -- You received this message because you are subscribed to the Google Groups "help-cfengine" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/8aeeeeb7-35d8-4153-afa0-c016c143f882n%40googlegroups.com.