NCPA update

[bennyboy]

Hi,
I just test the update of NCPA agent and it's not the first time I see that result. I already send an email couple week ago about the same problem and we don't find a solution. (I don't really finish the test Nagios Support ask me to do) I decide to open a thread to exchange about that problem.

First, I use Redhat Satellite to syncronize your Nagios Repo localy and send the update to our RHEL Server. I already make sure you GPG key is automaticaly deploy to our server. http://repo.nagios.com/RPM-GPG-KEY-NAGIOS.

I already install ncpa by yum with our local repo and we syncronize you repo to our local repo wirh Redhat Satellite each night. I just test the yum update ncpa

Code: Select all

[root@servername ~]# yum update ncpa
Loaded plugins: product-id, rhnplugin, search-disabled-repos, subscription-manager
This system is receiving updates from RHN Classic or RHN Satellite.
Setting up Update Process
non_prd_nagios-6-noarch                                                                                                                                                                                                 |  871 B     00:00     
non_prd_saq_custom                                                                                                                                                                                                      | 1.0 kB     00:00     
non_production_rhn-tools-rhel-x86_64-server-6                                                                                                                                                                           | 1.3 kB     00:00     
Resolving Dependencies
--> Running transaction check
---> Package ncpa.x86_64 0:2.0.1-1.el6 will be updated
---> Package ncpa.x86_64 0:2.0.3-1.el6 will be an update
--> Finished Dependency Resolution

Dependencies Resolved

===============================================================================================================================================================================================================================================
 Package                                            Arch                                                 Version                                                   Repository                                                             Size
===============================================================================================================================================================================================================================================
Updating:
 ncpa                                               x86_64                                               2.0.3-1.el6                                               non_prd_nagios-6-noarch                                               6.5 M

Transaction Summary
===============================================================================================================================================================================================================================================
Upgrade       1 Package(s)

Total download size: 6.5 M
Is this ok [y/N]: y
Downloading Packages:
ncpa-2.0.3-1.el6.x86_64.rpm                                                                                                                                                                                             | 6.5 MB     00:00    


Preparing...                ########################################### [100%]
   1:ncpa                   warning: /usr/local/ncpa/etc/ncpa.cfg created as /usr/local/ncpa/etc/ncpa.cfg.rpmnew
########################################### [100%]
Starting NCPA Listener: [  OK  ]
Starting NCPA Passive:  [  OK  ]
Stopping NCPA Listener: pid 27374 did not die
[FAILED]
Stopping NCPA Passive:  [  OK  ]

I confirm the update work fine but I don't understand why the post script of RPM start/stop instead of stop/start.
The final result if a brand new version of NCPA but the process is down

I stop the deployment because I have to write a script to workaround that problem. Can you reproduce the problem and fix it please.

Thanks a lot

[bennyboy]

Can you also confirm you --addsign your gpgkey to your package because I don't see it.

Code: Select all

rpm -Kv /var/cache/yum/x86_64/6Server/non_prd_nagios-6-noarch/packages/ncpa-2.0.3-1.el6.x86_64.rpm
/var/cache/yum/x86_64/6Server/non_prd_nagios-6-noarch/packages/ncpa-2.0.3-1.el6.x86_64.rpm:
    Header SHA1 digest: OK (1951b07cbf21146cf870d14a41c8880f84a7a578)
    MD5 digest: OK (96843fb9515038a30953776f011001a0)

[bennyboy]

Can you confirm the Yum Repository Checksum Type of repo.nagios.com

I think it's sha1.

Thanks in advance!

[bennyboy]

Can you confirm the Yum Repository Checksum Type of repo.nagios.com

I think it's sha1.

Thanks in advance!

I find the information in http://repo.nagios.com/nagios/6/repodata/repomd.xml and it's sha256.

[bennyboy]

I'm confuse ... Now I think it's SHA1.

Code: Select all

rpm -qip ncpa-2.0.3.el7.x86_64.rpm 
warning: ncpa-2.0.3.el7.x86_64.rpm: Header V4 RSA/SHA1 Signature, key ID 1e924cb3: NOKEY
Name        : ncpa
Version     : 2.0.3
Release     : 1.el7.centos
Architecture: x86_64
Install Date: (not installed)
Group       : Network/Monitoring
Size        : 14951873
License     : Nagios Open Software License Version 1.3
Signature   : RSA/SHA1, Tue 21 Mar 2017 11:17:50 AM EDT, Key ID f084fca81e924cb3
Source RPM  : ncpa-2.0.3-1.el7.centos.src.rpm
Build Date  : Fri 17 Mar 2017 03:55:45 PM EDT
Build Host  : centos7x64
Relocations : /usr/local 
Vendor      : Nagios Enterprises, LLC
URL         : https://www.nagios.org/ncpa/help.php
Summary     : A cross-platform active and passive monitoring agent
Description :
The Nagios Cross-Platform Agent is used with Nagios XI and Nagios Core to run active
and/or passive checks on any operating system. Installs with zero requirements using a
bundled version of Python.

[cdienger]

H Bennyboy,

I think there are a couple similar but different things going on here. First, the public key available at repo.nagios.com/RPM-GPG-KEY-NAGIOS is used to verify the sha1 signature of the package. This just means that key(which should be trusted because it's on our site) has signed the package.

Second, the sha256 checksum is used to verify the integrity of a file. Repomd.xml points to "repodata/62bc8af6bdf8d9160e8418d3f99dbb58cd419188a3905c5240f8e3e35bbf1f34-other.xml.gz" and if you download this file, it contains a list of checksums for the ncpa packages and shows a sha256 checksum of eebe4ce829910748b50379d2d4e1c28d4ff436a2184bbd1ffc96da9f8e81f8fb for ncpa 2.0.3. This should match what you downloaded and you can verify by running "sha256sum ncpa-2.0.3.el7.x86_64.rpm".

Last, I believe it starts then stops the service as a check to make sure everything installed correctly but doesn't want to assume that you necessarily want it running right away. It should be relatively easy to script something to start it after the upgrade though or maybe just run "yum update ncpa;service ncpa restart".

[bennyboy]

Can you ask to change that start and after stop the service. When I schedule an update with Satellite I don't run a script. I just ask Redhat Satellite to apply all the patch I need. Normaly the RPM is responsible to recycle the service. Can you please modify the rpm to handle the rpm-Uvh or yum update and don't stop it self. I understand I can workaround that with a little script but normaly I don't have to do that with 99.99999% of other rpm package updating itself.

Thank in advance !

[cdienger]

I'll ping dev about a feature request for this.

Did the other information make sense? Did you have any further questions?

[cdienger]

Passed this by dev and the start/stop behavior will be added as a bug likely to be fixed after 2.0.4. You can see more on Github https://github.com/NagiosEnterprises/ncpa/issues/329.

[bennyboy]

Good job Thanks a lot