Jira (PUP-6041) puppet inspect fails to report changes to resources on the agent

[William Hopper (JIRA)]

Title: Message Title

William Hopper created an issue   Puppet / PUP-6041 puppet inspect fails to report changes to resources on the agent Issue Type: Bug Affects Versions: PUP 4.3.2, PUP 3.5.1 Assignee: Unassigned Created: 2016/03/10 1:45 PM Priority: Normal Reporter: William Hopper When auditing resources in a manifest, one would expect the puppet inspect tool to send reports which detail local changes to said resources outside of puppet runs. While inspect does properly identify resources which have the audit bit set, changes are never picked up and thus audit reports contain false negatives. The following are a series of comments from Jo Rhett and myself relating to this issue, which was discovered after working on PUP-5233: Jo: Puppet inspect runs successfully, and it does properly determine which resources in the catalog have the audit attribute set, but it does not pick up on changes to the resources locally. # puppet inspect --verbose Notice: Finished inspection in 3.99 seconds Here's the output of the report (the summary at the bottom contains enough): out_of_sync: false changed: false resource_type: File title: /tmp/testfile.txt skipped: false failed: false containment_path: - Stage[main] - Main - File[/tmp/testfile.txt] host: client.example.com And yet running the agent observes the file changes, and reports the issues: # puppet agent --test Info: Using configured environment 'production' Info: Retrieving pluginfacts Info: Retrieving plugin Info: Loading facts Info: Caching catalog for client.example.com Info: Applying configuration version '1456228739' Notice: /Stage[main]/Main/File[/tmp/testfile.txt]/content: --- /tmp/testfile.txt 2016-02-23 11:55:43.037373981 +0000 +++ /tmp/puppet-file20160223-25544-zao9ck 2016-02-23 11:59:00.141887058 +0000 @@ -1,1 +1 @@ -I hacked this change in +jackrabbit! \ No newline at end of file Info: Computing checksum on file /tmp/testfile.txt Info: FileBucket got a duplicate file {md5}a84bd775b3d654ff165d86e9b733ef6e Info: /Stage[main]/Main/File[/tmp/testfile.txt]: Filebucketed /tmp/testfile.txt to puppet with sum a84bd775b3d654ff165d86e9b733ef6e Notice: /Stage[main]/Main/File[/tmp/testfile.txt]/content: content changed '{md5}a84bd775b3d654ff165d86e9b733ef6e' to '{md5}000a70d0ebea2001153c885c63cd2c23' Notice: /Stage[main]/Main/File[/tmp/testfile.txt]/owner: audit change: previously recorded value vagrant has been changed to root Notice: /Stage[main]/Main/File[/tmp/testfile.txt]/ctime: audit change: previously recorded value 2016-02-23 11:46:16 +0000 has been changed to 2016-02-23 11:55:43 +0000 Notice: /Stage[main]/Main/File[/tmp/testfile.txt]/mtime: audit change: previously recorded value 2016-02-23 11:46:09 +0000 has been changed to 2016-02-23 11:55:43 +0000 Notice: Applied catalog in 0.38 seconds So audit continues to work, but puppet inspect is blithely unaware of changes. Me: Ah, I think I see now. When I setup a scenario like the one you described and do a regular puppet run, my report will contain audit notices such as: message: "content changed '{md5}ec1bebaea2c042beb68f7679ddd106a4' to '{md5}025f253325b46929cd34f2a7c3c55e7c' (previously recorded value was {md5}025f253325b46929cd34f2a7c3c55e7c)" ... message: "audit change: previously recorded value 2016-03-10 10:20:03 -0800 has been changed to 2016-03-10 10:23:02 -0800" ... out_of_sync: true changed: true resource_type: File title: /tmp/test ... while an inspect run on an agent which has an altered file doesn't give any indication whatsoever that anything has changed, thus completely defeating the purpose of the audit: - !ruby/object:Puppet::Transaction::Event audited: true property: content previous_value: "{md5}ec1bebaea2c042beb68f7679ddd106a4" desired_value: historical_value: message: "inspected value is \x22{md5}ec1bebaea2c042beb68f7679ddd106a4\x22" <-- this does not take into account what the puppet-defined checksum *should* be, 025f253325b46929cd34f2a7c3c55e7c status: audit time: 2016-03-10 10:23:05.649029 -08:00 ... out_of_sync: false changed: false resource_type: File title: /tmp/test So in summary, inspect is pretty horribly broken even beyond not finding the cached catalog, and has been since before Puppet 3.5.1 (which I used in the above tests). Add Comment   This message was sent by Atlassian JIRA (v6.4.12#64027-sha1:e3691cc) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.