This message was deleted.
# puppets
Slackbot
06/07/2023, 7:36 AMThis message was deleted.
b
bastelfreak
06/07/2023, 7:56 AM"failures appear in the file last_run_summary.yaml" what kind of failures? Can you share them?
r
Raz
06/07/2023, 10:07 AMI won't be able to share files - sorry (air-gapped environment)
But the line at the end of the yaml that is title events can show failure: > 0
On the server I am currently examinig - failure is 4 yet puppet ran in te last 1/2 hour.
In the puppet.log I have the following entries:
Unable to fethc my node defiition, but the agent will continue:
SSL_connect returned=1 error=0 state=error: sslv3 alert certificate unknown
....
Could not retrieve catalog from remote server: SSL_connect returned=1 error=0 state=error: sslv3 alert certificate unknown
....
Applied catalog in 8.58 seconds (edited)
Now if I run the command "puppet agent -t" if will be successful and perform an update.
What's the difference?
After running from te command line then the puppet.log is now completely different:
Using configured environment 'Production'
Retrieving pluginfacts
Retrieving plugin
Retrieving locales
Loading facts
Caching catlog for hostname
Applying configuration version 'NUMBER'
Applied catalog in 8.98 seconds
The last_run_summary.yaml has 'failure: 0'
Nothing was canged on the server or client
This is just an example of course.
b
bastelfreak
06/07/2023, 10:09 AMsounds like certificate errors. Do all runs fail from the puppet service? Do you have multiple compilers?
bastelfreak
06/07/2023, 10:09 AMUsually that error only appears sometimes and indicates a broken compiler/loadbalancer
r
Raz
06/07/2023, 10:17 AMWhy does the puppet sevice fail but the command line succeed?
b
bastelfreak
06/07/2023, 10:17 AMthats why I asked if the service always fails
bastelfreak
06/07/2023, 10:18 AMmaybe its just a coincidence that your command kine succeeded
r
Raz
06/07/2023, 10:51 AMNo - that's the usual case. I.e when the puppet service isn't working then the command line does. This doesn't mean that the service will run corerectly next time, though.
b
bastelfreak
06/07/2023, 10:53 AMyes, but does the service never work?
r
Raz
06/07/2023, 12:07 PMIn this case the service is up and runnig - is that what you're asking?
b
bastelfreak
06/07/2023, 12:10 PMno. puppet runs as daemon in the background. every X minutes it requests a catalog and tries to apply it. you mention you see errors in the puppet agent log file. Do all requests fail with that TLS error or do some succeed?
r
Raz
06/07/2023, 12:14 PMthere are no TLS errors when I run the command 'puppet agent -t'. My question is what's the difference between the command line and the service?
b
bastelfreak
06/07/2023, 12:17 PMyour environment variables
bastelfreak
06/07/2023, 12:18 PMso again: are there always TLS errors in the log or does the service sometimes succeed?
bastelfreak
06/07/2023, 12:18 PMif it always fails it's a local error because of the differences in your shell vs the service (for example a http_proxy environment variable)
r
Raz
06/07/2023, 12:25 PMI have 100s of servers where this is failing in the same fashion. How can I check what is happening across my environment? As I said, its not a single machine
b
bastelfreak
06/07/2023, 12:25 PMsorry, but I asked you this multiple times. Are there always TLS errors in the log or does the service sometimes succeed?
bastelfreak
06/07/2023, 12:26 PMAnd I also asked "Do you have multiple compilers?". How is your infrastructure setup? do you have any loadbalancer/dns round robin for the puppetserver?
r
Raz
06/07/2023, 1:02 PMThre is no LB or RR in front of the Puppet server. I'm checking out the "multiple compilers" (I didn't create this envirnment - just trying to fix it
r
rusty
06/13/2023, 3:23 AMrestart the service, perhaps something is cached. I had this after updating an expired cert