Thursday, October 31, 2013

CFEngine 3 template based editing - snmp and syslog auto configuration

Recently, we have some requirement to modify our system logging. I created a short bundle in CFEngine and added also an update for snmpd configuration. Here's the bundle:
#############################################
bundle agent syslog_snmp_conf {
vars:

rhel5_site1::
    "syslog_rhost"     string => "10.aaa.bbb.cc";
    "snmp_location"    string => "DC1";
    "snmp_server"    string => "AAA.GGG.HHH.III";

rhel5_site2::
    "syslog_rhost"     string => "10.xxx.yyy.zzz";
    "snmp_location"    string => "DC2";
    "snmp_server"    string => "AAA.GGG.HHH.JJJ";

redhat_5||centos_5::
    "isap_req_packages" slist => {
        "net-snmp", "net-snmp-libs", "net-snmp-utils", "sharutils", "sysklogd"
    };

packages:
redhat_5||centos_5::
"$(isap_req_packages)"
     package_policy => "add",
     package_method => yum;

files:
"/etc/syslog.conf"
    comment       => "Syslog config",
    create        => "true",
    edit_template => "$(g.master_modules)/linux/template-syslog.conf",
    perms         => set_mog_perms("0644", "root"),
    classes       => if_repaired("syslog_restart");

"/etc/snmp/snmpd.conf"
    comment       => "SNMPD config",
    create        => "true",
    edit_template => "$(g.master_modules)/linux/template-snmpd.conf",
    perms         => set_mog_perms("0644", "root"),
    classes       => if_repaired("snmpd_restart");

commands:
    syslog_restart::
       "/sbin/service syslog restart"
       comment   =>   "syslog restart";

    snmpd_restart::
       "/sbin/service snmpd restart"
       comment   =>   "snmpd restart";

} # END  bundle agent syslog_snmp_conf
#############################################

TEMPLATE FILES:

1. /var/cfengine/modules/linux/template-syslog.conf

### ANY CHANGES YOU MAKE HERE WILL BE OVERWRITTEN
### THIS FILE IS MANAGED BY CFEngine
[%CFEngine BEGIN %]
*.alert         @$(syslog_snmp_conf.syslog_rhost)
*.crit          @$(syslog_snmp_conf.syslog_rhost)
*.debug         @$(syslog_snmp_conf.syslog_rhost)
*.err           @$(syslog_snmp_conf.syslog_rhost)
*.emerg         @$(syslog_snmp_conf.syslog_rhost)
*.notice        @$(syslog_snmp_conf.syslog_rhost)
*.info          @$(syslog_snmp_conf.syslog_rhost)
### END of LOG to REMOTE HOST
[%CFEngine END %]

### LOCAL LOGGING
*.info;mail.none;authpriv.none;cron.none                /var/log/messages
mail.*                                                  -/var/log/maillog
cron.*                                                  /var/log/cron
*.emerg                                                 *
uucp,news.crit                                          /var/log/spooler
local7.*                                                /var/log/boot.log
### THIS FILE IS MANAGED BY CFEngine

2. /var/cfengine/modules/linux/template-snmpd.conf

### ANY CHANGES YOU MAKE HERE WILL BE OVERWRITTEN
### THIS FILE IS MANAGED BY CFEngine
[%CFEngine BEGIN %]
rocommunity  ISAPmrtg $(syslog_snmp_conf.snmp_server)
syslocation  $(syslog_snmp_conf.snmp_location)
[%CFEngine END %]
syscontact Root 
### THIS FILE IS MANAGED BY CFEngine
so what does it do? CFEngine 3 has a file editing feature that uses templates. variables in the block enclosed by
[%CFEngine BEGIN %]

[%CFEngine END %]
will expand so you can customize it based on whatever you define inside your bundle. the variables used in this example are defined as:
rhel5_site1::
    "syslog_rhost"     string => "10.aaa.bbb.cc";
    "snmp_location"    string => "DC1";
    "snmp_server"    string => "AAA.GGG.HHH.III";

rhel5_site2::
    "syslog_rhost"     string => "10.xxx.yyy.zzz";
    "snmp_location"    string => "DC2";
    "snmp_server"    string => "AAA.GGG.HHH.JJJ";
take note of how they are defined in the template files. these are user defined so they are referenced using the bundle. if you are using special variable, like $(sys.host), you define them as is.

TEST RUN

On a machine under the group rhel5_site2:

Regular expression error "nothing to repeat" in expression "*.alert         @10.xxx.yyy.zzz" at 0
Regular expression error "nothing to repeat" in expression "*.info;mail.none;authpriv.none;cron.none                /var/log/messages" at 0
Regular expression error "nothing to repeat" in expression "*.emerg                                                 *" at 0
 -> Edited file /etc/syslog.conf
 -> Edited file /etc/snmp/snmpd.conf
 -> Executing '/sbin/service syslog restart' ... (no timeout)
 !! Finished command related to promiser "/sbin/service syslog restart" -- an error occurred (returned 1)
Q: "...in/service sysl": syslog: unrecognized service
I: Last 1 quoted lines were generated by promiser "/sbin/service syslog restart"
 -> Completed execution of /sbin/service syslog restart
 -> Executing '/sbin/service snmpd restart' ... (no timeout)
Q: "...in/service snmp": Stopping snmpd:                   [  OK  ]
Q: "...in/service snmp": Starting snmpd:                   [  OK  ]
I: Last 2 quoted lines were generated by promiser "/sbin/service snmpd restart"
 -> Completed execution of /sbin/service snmpd restart
and this will produce:

# cat /etc/syslog.conf

### ANY CHANGES YOU MAKE HERE WILL BE OVERWRITTEN
### THIS FILE IS MANAGED BY CFEngine
*.alert         @10.xxx.yyy.zzz
*.crit          @10.xxx.yyy.zzz
*.debug         @10.xxx.yyy.zzz
*.err           @10.xxx.yyy.zzz
*.emerg         @10.xxx.yyy.zzz
*.notice        @10.xxx.yyy.zzz
*.info          @10.xxx.yyy.zzz
### END of LOG to REMOTE HOST

### LOCAL LOGGING
*.info;mail.none;authpriv.none;cron.none                /var/log/messages
mail.*                                                  -/var/log/maillog
cron.*                                                  /var/log/cron
*.emerg                                                 *
uucp,news.crit                                          /var/log/spooler
local7.*                                                /var/log/boot.log

# cat /etc/snmp/snmpd.conf

### ANY CHANGES YOU MAKE HERE WILL BE OVERWRITTEN
### THIS FILE IS MANAGED BY CFEngine
rocommunity  ISAPmrtg AAA.GGG.HHH.JJJ
syslocation  DC2
syscontact Root 
'til next time.