Closed Bug 1175291 Opened 9 years ago Closed 9 years ago

disable freshclam on OSX builders

Categories

(Infrastructure & Operations Graveyard :: CIDuty, task)

task
Not set
normal

Tracking

(Not tracked)

RESOLVED FIXED

People

(Reporter: catlee, Assigned: aselagea)

Details

Attachments

(3 files, 2 obsolete files)

      No description provided.
Attached patch disable_freshclam.patch (obsolete) — Splinter Review
Attachment #8650491 - Flags: review?(kmoir)
Comment on attachment 8650491 [details] [diff] [review]
disable_freshclam.patch

Please remove the 
 # refreshonly => true ; 
statement since it's not needed

a clearer statement for the unless line to just do something like
/usr/bin/grep 'Checks 0' /etc/freshclam.conf
and leave out the cat statement
Attached patch disable_freshclam_v2.patch (obsolete) — Splinter Review
Attachment #8650537 - Flags: review?(kmoir)
Comment on attachment 8650537 [details] [diff] [review]
disable_freshclam_v2.patch

You need to line up
"disable-freshclam" :
with 
"remove-index"

(remove whitespace)

Also, I noticed that freshclam is not installed on test machines so we need to limit this so it only runs on lion bld machines
Better to make that condition "is freshclam installed" rather than build vs. test.  That could be as easy as using `[ -f /etc/freshclam.conf ]` in the `unless` property.
thanks Dustin, this is a better appraoch
Also tested the patch after I re-imaged the machine (bld-lion-r5-078) and worked without any issues.
Attachment #8651126 - Flags: review?(kmoir)
Attachment #8650491 - Attachment is obsolete: true
Attachment #8650491 - Flags: review?(kmoir)
Attachment #8650537 - Attachment is obsolete: true
Attachment #8650537 - Flags: review?(kmoir)
Comment on attachment 8651126 [details] [diff] [review]
disable_freshclam_v3.patch

Looks good

If you want you could get someone (Callek?) to land it for you on Monday and merge it to the production branch.  As a general rule, I try not to land things on Friday afternoons in case of unforseen breakage.
Attachment #8651126 - Flags: review?(kmoir) → review+
Landed and merged to prod

https://hg.mozilla.org/build/puppet/rev/d2fa812218d2
https://hg.mozilla.org/build/puppet/rev/fdfcdf5b2fc4
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Backout for failing on snow and yosemite with:

Mon Aug 24 07:18:30 -0700 2015 Puppet (err): /usr/bin/sed -i -e 's/Checks [0-9]*/Checks 0/g' /etc/freshclam.conf returned 1 instead of one of [0]
Mon Aug 24 07:18:30 -0700 2015 /Stage[main]/Disableservices::Common/Exec[disable-freshclam]/returns (err): change from notrun to 0 failed: /usr/bin/sed -i -e 's/Checks [0-9]*/Checks 0/g' /etc/freshclam.conf returned 1 instead of one of [0]
It looks like freshclam is already disabled on all of the builders (by looking at the plists in /System/Library/LaunchDaemons/org.clamav*

Was having the daemon disabled not sufficient for the purposes of this bug, e.g. was there some other process running that was ignoring those plists?

I ask, because the recommended method for disabling would be to just add the services to the disabled lists, ala:

         Darwin : {
             case $::macosx_productversion_major {
+                10.7 {
+                    service {
+                        [
+                            'org.clamav.clamd',
+                            'org.clamav.freshclam-init',
+                            'org.clamav.freshclam',
+                        ]:
+                            enable => false,
+                            ensure => stopped,
+                    }
+                }
+            }
+        }

Probably in the slave.pp manifest, unless we want to disable it on servers, too.
Ah, I see that org.clamav.freshclam-init.plist has RunAtLoad set to true, so it runs it as soon as the plist is loaded. So I think the lines above should disable that.
I killed off the puppetize.sh process on the test machine since it kept sending frequent error mail.
Tested the patch on bld-lion-r5-078, t-yosemite-r5-0090 and t-snow-r4-0156 and worked without issues.
Attachment #8654136 - Flags: review?(arich)
Comment on attachment 8654136 [details] [diff] [review]
disable_freshclam_v4.patch

Review of attachment 8654136 [details] [diff] [review]:
-----------------------------------------------------------------

You just need to clean up the indentation (it should look like comment 12), and you're good to land.
Attachment #8654136 - Flags: review?(arich) → review+
Indentation corrected.
Attachment #8654159 - Flags: review?(arich)
Attachment #8654159 - Flags: review?(arich) → review+
Assignee: nobody → alin.selagea
Comment on attachment 8654159 [details] [diff] [review]
disable_freshclam_v5.patch

Realized this was not landed because Alin doesn't have commit rights.  Merged to production too
Attachment #8654159 - Flags: checked-in+
Checked a builder machine and this change has been deployed
Sep  4 08:20:45 bld-lion-r5-002 puppet-agent[160]: (/Stage[main]/Disableservices::Slave/Service[org.clamav.freshclam-init]/ensure) ensure changed 'running' to 'stopped'
Status: REOPENED → RESOLVED
Closed: 9 years ago9 years ago
Resolution: --- → FIXED
Component: Platform Support → Buildduty
Product: Release Engineering → Infrastructure & Operations
Product: Infrastructure & Operations → Infrastructure & Operations Graveyard
You need to log in before you can comment on or make changes to this bug.