NRPE charm creates conntrack check for LXD units
Bug #1659728 reported by
Xav Paice
This bug report is a duplicate of:
Bug #1673064: Conntrack check does not work in LXD containers.
Edit
Remove
This bug affects 1 person
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
NRPE Charm |
In Progress
|
Medium
|
Paul Gear | ||
nrpe (Juju Charms Collection) |
In Progress
|
Medium
|
Paul Gear |
Bug Description
When applying the nrpe charm to an LXD unit, the charm creates a check_conntrack service. That's great, but for LXD the check itself falls over. The check finds the conntrack module, and then can't find nf_conntrack_max.
It's happier if I add:
if ! [ -f /proc/sys/
echo "OK: no conntrack max present"
exit $STATE_OK
fi
I'd prefer to be able to just disable the check with a setting.
Related branches
~xavpaice/charm-nrpe:fix_conntrack
- James Hebden (community): Approve
-
Diff: 16 lines (+5/-0)1 file modifiedfiles/plugins/check_conntrack.sh (+5/-0)
~paulgear/charm-nrpe/+git/nrpe-charm:master
- Haw Loeung: Approve
-
Diff: 52 lines (+16/-6)2 files modifiedfiles/plugins/check_conntrack.sh (+10/-2)
hooks/nrpe_helpers.py (+6/-4)
~xavpaice/charm-nrpe:lp-1659728
Rejected
for merging
into
~nrpe-charmers/charm-nrpe:master
- NRPE charm developers: Pending requested
-
Diff: 15 lines (+5/-0)1 file modifiedfiles/plugins/check_conntrack.sh (+5/-0)
tags: | added: canonical-bootstack |
Changed in nrpe (Juju Charms Collection): | |
status: | New → Confirmed |
Changed in nrpe-charm: | |
status: | New → Confirmed |
Changed in nrpe-charm: | |
assignee: | nobody → Paul Gear (paulgear) |
Changed in nrpe (Juju Charms Collection): | |
assignee: | nobody → Paul Gear (paulgear) |
Changed in nrpe-charm: | |
status: | Confirmed → In Progress |
Changed in nrpe (Juju Charms Collection): | |
status: | Confirmed → In Progress |
Changed in nrpe-charm: | |
importance: | Undecided → Medium |
Changed in nrpe (Juju Charms Collection): | |
importance: | Undecided → Medium |
To post a comment you must log in.
Fix was committed in response to https:/ /bugs.launchpad .net/nrpe- charm/+ bug/1673064 but this doesn't work on every occasion. I'm struggling to find a smoking gun for what's different but the fix committed checks for the conntrack module, which is loaded on these lxd containers:
ubuntu@ juju-a8345d- 0-lxd-9: ~$ lsmod | grep conntrack ipt_REJECT, iptable_ mangle, ip_tables, ebtables, iptable_ filter, xt_tcpudp, iptable_ raw,ipt_ MASQUERADE, xt_connmark, ip6table_ mangle, xt_CHECKSUM, ip6table_ filter, ip6table_ raw,xt_ conntrack, ip6_tables ipv6,openvswitc h ipv6,openvswitc h,nf_conntrack_ ipv4,xt_ connmark, nf_nat_ ipv6,nf_ nat_masquerade_ ipv4,xt_ conntrack, nf_nat_ ipv4,nf_ nat
xt_conntrack 16384 0
x_tables 36864 16 xt_comment,
nf_conntrack_ipv6 20480 3
nf_conntrack_ipv4 16384 5
nf_defrag_ipv4 16384 1 nf_conntrack_ipv4
nf_defrag_ipv6 36864 2 nf_conntrack_
nf_conntrack 110592 9 nf_conntrack_
However, the actual check shows that nf_conntrack_max doesn't exist: juju-a8345d- 0-lxd-9: ~$ sysctl net.netfilter. nf_conntrack_ max net/netfilter/ nf_conntrack_ max: No such file or directory
ubuntu@
sysctl: cannot stat /proc/sys/