1175291 - disable freshclam on OSX builders

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: CIDuty, task)

Comment 1

[Alin Selagea [:aselagea]]

Attachment: disable_freshclam.patch

Comment 2

[Kim Moir [:kmoir] ET]

Comment on attachment 8650491 [details] [diff] [review]
disable_freshclam.patch

Please remove the 
 # refreshonly => true ; 
statement since it's not needed

a clearer statement for the unless line to just do something like
/usr/bin/grep 'Checks 0' /etc/freshclam.conf
and leave out the cat statement

Comment 3

[Alin Selagea [:aselagea]]

Attachment: disable_freshclam_v2.patch

Comment 4

[Kim Moir [:kmoir] ET]

Comment on attachment 8650537 [details] [diff] [review]
disable_freshclam_v2.patch

You need to line up
"disable-freshclam" :
with 
"remove-index"

(remove whitespace)

Also, I noticed that freshclam is not installed on test machines so we need to limit this so it only runs on lion bld machines

Comment 5

[Dustin J. Mitchell [:dustin] (he/him)]

Better to make that condition "is freshclam installed" rather than build vs. test.  That could be as easy as using `[ -f /etc/freshclam.conf ]` in the `unless` property.

Comment 6

[Kim Moir [:kmoir] ET]

thanks Dustin, this is a better appraoch

Comment 7

[Alin Selagea [:aselagea]]

Attachment: disable_freshclam_v3.patch

Also tested the patch after I re-imaged the machine (bld-lion-r5-078) and worked without any issues.

Comment 8

[Kim Moir [:kmoir] ET]

Comment on attachment 8651126 [details] [diff] [review]
disable_freshclam_v3.patch

Looks good

If you want you could get someone (Callek?) to land it for you on Monday and merge it to the production branch.  As a general rule, I try not to land things on Friday afternoons in case of unforseen breakage.

Comment 9

[Justin Wood (:Callek)]

Landed and merged to prod

https://hg.mozilla.org/build/puppet/rev/d2fa812218d2
https://hg.mozilla.org/build/puppet/rev/fdfcdf5b2fc4

Comment 10

[Justin Wood (:Callek)]

https://hg.mozilla.org/build/puppet/rev/3292f1442ce6
https://hg.mozilla.org/build/puppet/rev/9c377fd742be

Comment 11

[Justin Wood (:Callek)]

Backout for failing on snow and yosemite with:

Mon Aug 24 07:18:30 -0700 2015 Puppet (err): /usr/bin/sed -i -e 's/Checks [0-9]*/Checks 0/g' /etc/freshclam.conf returned 1 instead of one of [0]
Mon Aug 24 07:18:30 -0700 2015 /Stage[main]/Disableservices::Common/Exec[disable-freshclam]/returns (err): change from notrun to 0 failed: /usr/bin/sed -i -e 's/Checks [0-9]*/Checks 0/g' /etc/freshclam.conf returned 1 instead of one of [0]

Comment 12

[Amy Rich [:arr] [:arich]]

It looks like freshclam is already disabled on all of the builders (by looking at the plists in /System/Library/LaunchDaemons/org.clamav*

Was having the daemon disabled not sufficient for the purposes of this bug, e.g. was there some other process running that was ignoring those plists?

I ask, because the recommended method for disabling would be to just add the services to the disabled lists, ala:

         Darwin : {
             case $::macosx_productversion_major {
+                10.7 {
+                    service {
+                        [
+                            'org.clamav.clamd',
+                            'org.clamav.freshclam-init',
+                            'org.clamav.freshclam',
+                        ]:
+                            enable => false,
+                            ensure => stopped,
+                    }
+                }
+            }
+        }

Probably in the slave.pp manifest, unless we want to disable it on servers, too.

Comment 13

[Amy Rich [:arr] [:arich]]

Ah, I see that org.clamav.freshclam-init.plist has RunAtLoad set to true, so it runs it as soon as the plist is loaded. So I think the lines above should disable that.

Comment 14

[Amy Rich [:arr] [:arich]]

I killed off the puppetize.sh process on the test machine since it kept sending frequent error mail.

Comment 15

[Alin Selagea [:aselagea]]

Attachment: disable_freshclam_v4.patch

Tested the patch on bld-lion-r5-078, t-yosemite-r5-0090 and t-snow-r4-0156 and worked without issues.

Comment 16

[Amy Rich [:arr] [:arich]]

Comment on attachment 8654136 [details] [diff] [review]
disable_freshclam_v4.patch

Review of attachment 8654136 [details] [diff] [review]:
-----------------------------------------------------------------

You just need to clean up the indentation (it should look like comment 12), and you're good to land.

Comment 17

[Alin Selagea [:aselagea]]

Attachment: disable_freshclam_v5.patch

Indentation corrected.

Comment 18

[Kim Moir [:kmoir] ET]

Comment on attachment 8654159 [details] [diff] [review]
disable_freshclam_v5.patch

Realized this was not landed because Alin doesn't have commit rights.  Merged to production too

Comment 19

[Kim Moir [:kmoir] ET]

Checked a builder machine and this change has been deployed
Sep  4 08:20:45 bld-lion-r5-002 puppet-agent[160]: (/Stage[main]/Disableservices::Slave/Service[org.clamav.freshclam-init]/ensure) ensure changed 'running' to 'stopped'