4

We are doing basic management of some servers via puppet - The servers themselves run as part of a clustered system that handles other aspects like user accounts etc and includes a monitoring script that detects changes in key files (/etc/passwd and the like). If puppet updates a package it potentially changes these key files triggering the monitoring system. (which is not unintentional)

The monitoring system has a command that can be manually run to clear the state and we have to do this each time puppet applies any changes, When we start getting emails!

We could define an exec that runs in a post run_stage to run the command but this by default would fire every time puppet runs, and then our reports will always show as puppet made changes regardless of whether changes were made or not.

Is there a way we can set the exec so that it only runs if puppet has applied other changes?

  • Hard to say without actual code example, but why not something like notify => Exec['clear-file-signature'], in the File or Package declaration? – faker Jul 9 '14 at 11:28
  • the point is that puppet isn't directly changing these files (its via package updates etc) – anthonysomerset Jul 9 '14 at 11:29
  • 1
    Have you considered doing this as a yum plugin? – Michael Hampton Jul 9 '14 at 11:34
  • @MichaelHampton no i hadn't but this sounds like the perfect solution! do point me in the right direction for more info – anthonysomerset Jul 9 '14 at 11:42
3

If the exec resource has a dedicated stage, you can implement the desired behavior by having it subscribe to all other stages, e.g.

exec { "pacify-rkhunter":
    ...
    subscribe   => Stage['pre','main','aux'],
    refreshonly => true,
}
| improve this answer | |
  • this sounds exactly like what i need, let me give it a try – anthonysomerset Jul 9 '14 at 19:28
  • 1
    I'm not sure what alternative to offer, but stages are problematic. eg if you want something to have to happen after the exec, then it can't really be part of any of the usual stages, and so this can't work as part of a module that might be depended on by anything else. – mc0e Jul 15 '14 at 15:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.