Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just can't seem to get this to work at all. I want to have puppet send a log message that shows up in the reports whenever a file changes. This seems so simple from what I've heard and read, but nothing works at all.

Here is the init.pp file:

# sudo init.pp

# 21 Sep 2011: Changed to test for notification only

class sudo {
    package { 'sudo':
        ensure  => present,
        before  => File['/etc/sudoers'],
    }

    file { '/etc/sudoers':
        ensure  => file,
        mode    => 440,
        owner   => root,
        group   => root,
        source  => 'puppet:///modules/sudo/sudoers',
        replace => false,
        audit   => content,
    }

#   exec { "/bin/date":
#       cwd => "/tmp",
#       subscribe => File['/etc/sudoers'],
#       refreshonly => true,
#   }

#   notify { "sudoers has been changed.":
#       refreshonly => true,
#   }
}

If I add the exec, nothing happens. If I add the notify, it complains about the refreshonly parameter.

If I remove all of the options for the file except audit, then the file permissions change from 440 to 644.

If I remove replace then puppet overwrites the file.

My test has been:

  1. Run puppet agent --test
  2. Change file (/etc/sudo)
  3. Rerun puppet agent --test (possibly with a touch site.pp or a service apache2 reload first)

I have yet to see any messages from audit. I'm running puppet v2.6.3 on Ubuntu Lucid Lynx server 10.04.

share|improve this question
add comment

2 Answers

Yes, this is very possible. What you need to use is the "notify" metaparameter, which will tell the file resource to cause another resource to run if it is triggered. Some resource types care about being notified ("refreshed" in the documentation); service and exec resources are the most useful ones. You can then build an exec resource with refreshonly => true that writes to a log or to stdout.

I would implement your config above like so:

class sudo {
    package { 'sudo':
        ensure  => present,
        before  => File['/etc/sudoers'],
    }

    file { '/etc/sudoers':
        ensure  => file,
        mode    => 440,
        owner   => root,
        group   => root,
        source  => 'puppet:///modules/sudo/sudoers',
        replace => false,
        notify  => Exec["sudoers_changed"],
    }

    exec { "sudoers_changed":
       command => "/bin/echo '/etc/sudoers has changed...'",
       refreshonly => true,
       loglevel => "alert",
       logoutput => true,
   }
}

The loglevel and logoutput parameters to the exec will just make it more clear about where the output is going while you're experimenting; you can certainly tweak them to your needs.

share|improve this answer
    
This logs to stdout or to syslog; how do I log to the puppet logs? I assumed that audit would take care of this... Doing it this way keeps the info out of the puppet reports (which currently are mailed to important people). –  Mei Sep 23 '11 at 16:23
    
Doesn't this also log a change each and every time puppet runs? Whereas, I thought an audit statement only logged a change when it happens. –  Mei Sep 29 '11 at 18:42
    
Since the exec resource has "refreshonly" set to true, it will only run when it's triggered. –  Handyman5 Sep 29 '11 at 23:33
add comment

You should be able to notify any type, so you can notify the notify type.

exec { "foo":
  notify => Notify["exec-alert"],
}

notify { "exec-alert":
  message => "sudoers has changed"
}

the fact that the file changes is logged to the puppet logs anyway, it's marked as a change.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.