Choose timezone
Your profile timezone:
Deployment team
→
Europe/Zurich
EVO - GridPP Deployment team meeting
EVO - GridPP Deployment team meeting
Description
- This is the weekly DTEAM meeting
- The intention is to run the meeting in EVO: http://evo.caltech.edu/evoGate/. Join the meeting in the GridPP Community area
minutes for 25 Sept 2007
present
======
Jens Jensen, [left early for anoyther meeting]
Mingchao Ma,
Jeremy Coles (chair)
Graeme Stewart,
Andrew Elwell
Derek Ross
Stephen Burke,
Frederic Brochu
Barney Garret,
Dave Newbold,
Alessandara Forti
Pete Gronbech
Apologies - Raja, Greig
UK root CA key - update from Jens
=====================
2 copies disappeared (still not sure if this was writing failure / sticks swapped / malicious deliberate) -
does not affect escience CA
Don't know exactly what happened hence treat as security incident
Will rekey root
Can't explot this - May affect Java as it doesn't check signing files
root CA is in distributiuon to build chain, but it isn't accredited (can't issue certs)
Netscape bug *may* affect us, but VO side should be simple as the name isn't changing
Timescale - Weeks (delayed slightly following redesign of security policy - new safe perhaps)
Overall 'Don't Panic!' - key protected by strong passphrase if it went maliciously
investigations ongoing - no certain trail of events yet.
Will check if he can use the mailing address of individual grid cert owners in UK
Experiment updates
============
LHCb
-------
Crashing jobs - Poss envornment issue at T1 causing jobs to crash
CMS [Dave Newbold]
----
csa07 - should havce started yesterday [dave newbold]
DPM issues in UK - T2 4 sites - imperial, brunel, PPD, bristol
no issue with dcache, DPM needs to be fixewd in the cms application software next week - needs to be told wich rfio type is used
T1 meeting - scheduled for December 3rd (ish) at RAL
T2 meetings = Requested that they attend, not sure if they need to - UK t2s are 'known' and well connected
Non-UK T2's estonia, Finland - just coming on stream
Other T2 sites - rest of UK will probably run MC - they still have ussues with software installs - They would rather concentrate on the Main 4 sites for now.
'rogue' CMS jobs - they prefer they use the official cms tools - users who can run on the non-std software / data / etc. They use the CMS VO but not the 'preferred' way - mop up other CMS fairshares at sites.
CMS resources - Hundreds of TB of datasets - 40TB to PPD. Significant resouucrces at sites - for analysis. MC lower sitye resource requirements
barrier for entry to Analysis... Transfer test Phedex etc T1-T2 needs
links are classed as decomissioned - comissioned depending on reliability,
Real data will only go over comissioned tagged links
50-60 links are presently there - seems to drop out when network bod stops intervening
T1 - CASTOR appears to be adequate. High load but robust and stays up! (yay)
Now coming to issiues with mysterious FTS errors
certificate problem - many services running under personal certificates (renewal etc)
They need some system in place
VO box services that need myproxy - should it be personal or server certs? (discuss! - SB thnks it should be server - Check with Jens - DN will)
debugging FTS / Phedex / CASTOR / SRM - PITA as there are no people who have high level overview of the whole logs - setting FTS retry and backoff off. Seems to be better (if an abuse of FTS design)
problen aren't 'network' problems per se, but more likely to be interactions between the middleware layers
All RAL traffic going through site Janet firewall - why not through the OPN (Andrew Samsum knows and is aware)
the T2 data challenges aren't anywhere near the gigabit levels - 3MB/s is the threshold to stay up = and many aren't.
would we be better extending the transfer tests to be longer duration rather than bandwith max challenge,
ATLAS
------
UK - overall - No data sets gone to T2's in last 7 days. eg, glasgow has ~4 files from M4
RAL issue? - could be VO box cron job? - VO box will be updated as part of thje new DDM software.
ATLAS -- CASTOR - not sure of latest status. Assume OK.
The SL4_64 recipies *do* work - on the gridpp wiki - Atlass software jobs running OK
biomed
--------
horribly inefficent - 50-75% jobs don't start correctly - we don't automatically kill at Glasgow - needs (manpower intensive) sysadmin intervention
Glasgow - review of the switch of the individual USER jobs to a max of 1000 rather than per VO limit of 1000 (which hit the atlas SAM / steve lloyd jobs)
ROC updates -
========
No meeting in sept - mostly admin in egee meeting
tickets - 7 open
few still open against olivier - follow up offline with Dace Colling
pps - update 6
lcg-rm - zero maint mode
atlas - several probs with the info published per VO cf the overall. ... Graeme / Pete -= will investigate
vo views information provider bug - will eventually need to go to Jeff Templon - will need info from sites as to why some sites don't work
Security
======
* Root CA - see above
* Changing ownership of gridmapdir - prcocessed as vuln and followed up OK.
* OSCT incident handling procedure - Mingchao - sent it out last week - Policy dated 10 Sept - no sig difference but we need to define a security incident contact for the UKI ROC
* XSS problems - potential ones are GOCDB (NGS), GridPP (mcr) and VOMS (mcr) - not a 'vuln' but needs code audit to be sure we're safe. (romain) - Andrew McNab has already fixed.
HEPSYSMAN
========
* date confirmed as 31 oct - oone day event - 10am start or so
- no site report s in Autumn meeting - Chris Brew, AE prepared to talk. - Ian neilson avail to talk too.
trasfer tests - / gridmon
===============
AE to arramge milestones for testing
need to concentrate on longer term tests
support of gridmon boxes
actions
=====
fewer than before JC took a hol
EGEE
====
GS, AF, PG, MM, SB, JC going
SL4 on WN's
=========
* Oxford - new machines running SL4
* Glasgow - alewdy done
* Manchester - some WN's SL4 - one of the CE's to be upgraded. Colin Morey now away
* Lancs already upgraded.
* Shef / Liv have other issues just now
* Birm = Some SL4 in testing - prod syaying for now
* Bris - devel with SL4
* Camb - Se's SL4, WN still 3
* RalPPd - >50% sl4 already
* T1 - 60-80% SL4 just now
Condor Vulns
========
Pete will make sure santanu aware
AOB
===
UKI roc meeting thurs
anything to raise let JC know
There are minutes attached to this event.
Show them.