We are doing basic management of some servers via puppet - The servers themselves run as part of a clustered system that handles other aspects like user accounts etc and includes a monitoring script that detects changes in key files (/etc/passwd and the like). If puppet updates a package it potentially changes these key files triggering the monitoring system. (which is not unintentional)

The monitoring system has a command that can be manually run to clear the state and we have to do this each time puppet applies any changes, When we start getting emails!

We could define an exec that runs in a post run_stage to run the command but this by default would fire every time puppet runs, and then our reports will always show as puppet made changes regardless of whether changes were made or not.

Is there a way we can set the exec so that it only runs if puppet has applied other changes?

  • Hard to say without actual code example, but why not something like notify => Exec['clear-file-signature'], in the File or Package declaration?
    – faker
    Jul 9, 2014 at 11:28
  • the point is that puppet isn't directly changing these files (its via package updates etc) Jul 9, 2014 at 11:29
  • 1
    Have you considered doing this as a yum plugin? Jul 9, 2014 at 11:34
  • @MichaelHampton no i hadn't but this sounds like the perfect solution! do point me in the right direction for more info Jul 9, 2014 at 11:42

1 Answer 1


If the exec resource has a dedicated stage, you can implement the desired behavior by having it subscribe to all other stages, e.g.

exec { "pacify-rkhunter":
    subscribe   => Stage['pre','main','aux'],
    refreshonly => true,
  • this sounds exactly like what i need, let me give it a try Jul 9, 2014 at 19:28
  • 1
    I'm not sure what alternative to offer, but stages are problematic. eg if you want something to have to happen after the exec, then it can't really be part of any of the usual stages, and so this can't work as part of a module that might be depended on by anything else.
    – mc0e
    Jul 15, 2014 at 15:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .