SLC5 status

Monday 8 Dec 2008, 14:00 → 15:00 Europe/Zurich

513-1-021 (CERN)

Let's have a last meeting on SLC5 before Christmas. I propose to discuss pending issues (if any) on: - Services (lxplus/lxbatch) - ZUUL - CDB templates structure and namespaces - package lists and defauts - LEAF/HMS - SMS - Virtualisation (?) - aob Current machines running SLC5 are: 13 afs 2 castordev 3 dmtb 2 lxbatch 5 lxbuild 3 lxburn 2 lxcmgmt 10 lxdev 2 lxplus 2 lxserv 105 lxspare 1 lxvmpool 10 lxxen 10 proctest 2 svnweb 2 vobox

Slides ELFMS_SLC5_status_with_Quattor.pdf ELFMS_SLC5_status_with_Quattor.ppt

Present: Peter Kelemen, Ulrich Schwickerath, Matthias Schroder, Ewan Roche, Veronique Lefebure (chair and minutes), Jan van Eldik, Alex Iribarren, Jan Iven, Manuel Guijarro, Giacomo Tenaglia

Status review of slc5 installation and configuration with Quattor.

See slides on the agenda page

• Installation:
  • PrepareInstall:
    • now supports both filesystem CDB schemas (os-independently, but the new schema is used by default on SLC5 machines. Using it on SLC4 machines is tricky and requires using a special namespace (usertest/oldfilesystem), which is discouraged.
    • LVM are handled by the ncm-filesystem component, after installation.
    • Ulrich: would like/need to use the new schema on slc4 batch nodes. Will discuss it offline with Jan vE.
• Selinux
  • There has been an issue on lxbatch for ROOT, which has been understood and fixed (patch to ROOT) (this affected ATLAS. Running older SLC4 ROOT releases on SLC5 is still an open issue. Workaround is to selectively disable one SELinux check.)
  • On lxbuild, selinux needs to be switched off partially
• Swrep
  • Runs on slc5
  • Iptables need to be configured. Selinux in permissive mode for now.
• Package lists
  • We currently have the package lists provided by Jan I. which have never been updated.
  • Matthias will provide new lists to be entered in CDB by Veronique and tested by Ulrich
  • Later we can put in place an automatic update of the lists.
  • We keep the same naming convention (name from the comps.xml group) but Matthias should put a comment in each template about how the template was defined.
• ZUUL
  • PK: The nscd crash *might* be related to reaching it's preset cache limit. We have no proof. This is difficult to debug. Increasing the maxdb size would simply push the problem further. "paranoia" restart does not help. This problem affects DNS lookup, group membership checks etc. Redhat has been contacted. Timescale to get a fix: 3 months ?
  • JvE: ZUUL replaces the regisclient functionnality of creating the passwd file. The passwd.header file stored in SINDES is still used (by the ncm-sin2pwd component) to handle passwds. One can give an egroup as input argument to ZUUL to limit the set of users on a machine. The current default is that all users have interactive access to a machine (slc5). This should be changed to default = no user. Jan vE will look into that.
  • Ulrich uses the ncm-interactive limits on lxbatch to close access to users.
  • MS: how to give access for ex. To one group plus a few users ? JvE will provide doc.
• Ncm-components new namespace:
  • Veronique to prepare empty namespaces for the components that still need to be migrated, with proper acls.
• Lemon:
  • it was foreseen that lemon sensors do not run as root where possible, on slc5 machines. This is configurable in CDB, but the default is still root. To be reviewed in January.
• Hw templates that need to be migrated from old to new schema can be requested to Alex via cdb.support@cern.ch. Alex will provide a tool "hwvpd2cdb" which creates or updates vpd files. (This tool is now available in hwvpd2cdb. It will work only against SLC5 nodes, you must have root access to them and you must have permission to commit files in the vpd/ namespace.)