From dfcdce9176a18679aef900b953623c263555117d Mon Sep 17 00:00:00 2001 From: Heikki Levanto Date: Tue, 22 Mar 2011 16:22:48 +0100 Subject: [PATCH] Added check for manually installed pkgs --- aptcheck/aptcheck.pl | 178 +++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 147 insertions(+), 31 deletions(-) diff --git a/aptcheck/aptcheck.pl b/aptcheck/aptcheck.pl index ad72adb..b3e7927 100755 --- a/aptcheck/aptcheck.pl +++ b/aptcheck/aptcheck.pl @@ -5,48 +5,111 @@ # Depends heavily on having ssh key authentication set up to all # boxes. That's why I run it on my own workstation. # +# Regular debian upgrades are detected by running +# apt-get upgrade -s +# on every machine, and parsing the output. + +# We have decided to maintain some packages manually on some +# machines, so that system-level upgrades will not disturb +# applications, which may need more hand-holding. These are +# extracted from our apt repository, and queried on every +# server with apt-cache policy. This way, as soon as a package +# is released on our repo, it will get listed here. +# # 11-Mar-2011 Heikki: Started this +# 22-Mar-2011 Heikki: Adding manually maintained packages +# +# TODO: Assumes that we release our restricted packages for all versions +# and architectures at the same time. Gets only the highest version from +# all, and reports anything less than this. #### Init +use strict; my $debug= $ARGV[0] || 0; # 0=none, 1=some, 2=more, 3=much my $year =`date +%Y`; my $wikilink = 'http://twiki.indexdata.dk/cgi-bin/twiki/view/ID/'; +my $restrictedpackages = "ssh -q kebab cat /home/ftp/pub/debian/dists/*/restricted/*/Packages"; #### Get list of hosts # I could use a hard-coded list, but I would forget to maintain it. -# Nagios knows most of our hosts. +# Nagios knows most of our hosts. It even knows which are worth +# checking, they have a command to check apts! my $hostlist = `ssh nagios grep -l Apt /etc/nagios3/indexdata-conf.d/*.cfg` or die "Could not get host list"; print "Got list:\n$hostlist\n" if $debug>2; +###### Get list of packages that can be manually maintained +print "getting restricted package versions\n" if $debug; +my %restrpkgs; +my $restplines = `$restrictedpackages` + or die "Could not get the list of restricted packages " . + "from $restrictedpackages: $! "; +print "Got package list: \n$restplines\n" if $debug>2; +my $pname; +my $pver; +for my $pline ( split("\n",$restplines) ) { + chomp($pline); + $pname = $1 if $pline =~ /^Package:\s+(\S*)\s*$/; + $pver = $1 if $pline =~ /^Version:\s+(\S*)\s*$/; + print "$pline: p=$pname v=$pver\n" if $debug>2; + if ( $pname && $pver ) { + print "\nPackage $pname version $pver \n" if $debug>2; + if ( ! $restrpkgs{$pname} ) { + $restrpkgs{$pname} = $pver; + print "found $pname, first version $pver\n" if $debug>1; + } else { + my $bver = $restrpkgs{$pname}; + `dpkg --compare-versions $bver lt $pver`; + if ( ! $? ) { + print "found $pname, better version $pver (better than $bver)\n" + if $debug>1; + $restrpkgs{$pname} = $pver; + } else { + print "found $pname, but version $pver is no better than $bver\n" + if $debug>2; + } + } + $pname = ""; # clear for the next one. + $pver = ""; + } +} + +if ( $debug >1 ) { + print "got " . scalar(keys(%restrpkgs)) . " restricted packages\n"; + for $pname ( sort (keys(%restrpkgs)) ) { + print " $pname " . $restrpkgs{$pname} . "\n"; + } +} + # Statistics my %summary; -my %sechosts; -my %secpkgs; -my %ownhosts; -my %ownpkgs; -my %normhosts; -my %normpkgs; +my ( %sechosts, %secpkgs ); +my ( %ownhosts, %ownpkgs ); +my ( %manhosts, %manpkgs ); +my ( %normhosts, %normpkgs ); my %okhosts; my %skiphosts; my %allhosts; my $sectot = 0; my $owntot = 0; +my $mantot = 0; my $normtot = 0; my $table = "\n"; -for $hline ( split("\n",$hostlist) ) { +for my $hline ( split("\n",$hostlist) ) { next unless ( $hline =~ /\/([a-z0-9-]+)\.cfg$/ ); my $H = $1; next if ($H =~ /^commands/ ); next if ($H =~ /^servicegroups/ ); print "Checking $H\n" if $debug; $allhosts{$H}=1; - my $apt = `ssh $H apt-get upgrade -s -o 'Debug::NoLocking=true' `; + my $cmd1 = "apt-cache -q policy " . join(" ",sort(keys(%restrpkgs))); + my $cmd2 = "apt-get upgrade -s -o 'Debug::NoLocking=true' "; # Note, do not append -qq, we want some output even when nothing to do + my $apt = `ssh -q $H "$cmd1 ; $cmd2 " 2>/dev/null`; if ( !$apt ) { $table .= "\n"; $table .= ""; + $det .= ""; + $det .= ""; + $det .= ""; + $det .= "\n"; + if ( !$summary{$restrname} ) { + $summary{$restrname} = ""; + } + $summary{$restrname} .= "$H "; + } + } + $restrname = ""; # clear for next round + $restrinst = ""; + $restrcand = ""; + } next unless $p =~ /^Inst ([^ ]+) \[([^]]+)\] \(([^ ]+) ([^:]+):/; my ( $pkg,$cur,$new,$src ) = ( $1,$2,$3,$4 ); @@ -68,8 +168,8 @@ for $hline ( split("\n",$hostlist) ) { my $key = $pkg; if ( $src =~ /Security/ ) { $det .= "$pkg (s) "; - $sechosts{$H}=1; - $secpkgs{$pkg}=1; + $sechosts{$H} = 1; + $secpkgs{$pkg} = 1; $secs++; $sectot++; } elsif ( $src =~ /Indexdata/ ) { @@ -100,7 +200,8 @@ for $hline ( split("\n",$hostlist) ) { if ( $pkgs ) { $table .= "$pkgs packages to upgrade. "; $table .= "$secs security. " if $secs; - $table .= " $own from indexdata " if $own; + $table .= " $own from indexdata. " if $own; + $table .= " $man manual. " if $man; } else { $table .= "ok"; $okhosts{$H} = 1; @@ -139,12 +240,12 @@ if ( $sectot ) { print F "\n" ; print F ""; print F ""; @@ -154,12 +255,27 @@ if ( $owntot ) { print F "\n" ; print F ""; + print F ""; + print F "\n"; +} +if ( $mantot ) { + print F "\n" ; + print F ""; print F ""; @@ -169,12 +285,12 @@ if ( $normtot ) { print F "\n" ; print F ""; print F ""; @@ -183,7 +299,7 @@ if ( $normtot ) { if ( %skiphosts ) { print F "\n"; print F "\n"; @@ -191,7 +307,7 @@ if ( %skiphosts ) { if ( %okhosts ) { print F "\n"; print F "\n"; @@ -205,13 +321,13 @@ print F $table; # Package table print F "

Packages\n"; print F "

 
$H (skipped)\n"; @@ -54,11 +117,48 @@ for $hline ( split("\n",$hostlist) ) { next; } print "Got apts for $H: \n$apt\n" if $debug>2; - my $det = ""; + my $det = ""; # detail lines my $pkgs = 0; my $secs = 0; my $own = 0; - for $p ( split("\n",$apt) ) { + my $man = 0; + my $restrname = ""; + my $restrinst = ""; + my $restrcand = ""; + for my $p ( split("\n",$apt) ) { + # parse apt-cache output + $restrname = $1 if $p =~ /^(\S+):$/; + $restrinst = $1 if $p =~ /^\s+Installed:\s+(\S+)$/; + $restrcand = $1 if $p =~ /^\s+Candidate:\s+(\S+)$/; + if ( $p =~ /^\s+Version table:/ ) { # have all for that package + my $bver = $restrpkgs{$restrname}; + if ( ( $restrinst eq $restrcand ) && + ( $restrinst ne $bver ) ) { + # if different, it is a regular apt upgrade, and will be seen + # later. AND we want to have a different version in our repo + `dpkg --compare-versions $bver lt $restrinst`; + if ( $? ) { # It was not a downgrade + # manual packages may be ahead of the repo! + $mantot++; + $man++; + $pkgs++; + $manhosts{$H} = 1; + $manpkgs{$restrname} = 1; + $det .= "
  $restrname (M)". strdiff($bver,$restrinst)."". strdiff($restrinst,$bver)."
Security
" . scalar(keys(%sechosts)) . " / " . scalar(keys(%secpkgs)) . " / $sectot 		"; - for $HH ( sort(keys(%sechosts)) ) { + for my $HH ( sort(keys(%sechosts)) ) { print F "$HH "; } print F ""; - for $PP ( sort(keys(%secpkgs)) ) { + for my $PP ( sort(keys(%secpkgs)) ) { print F "$PP "; } print F "
Indexdata
" . scalar(keys(%ownhosts)) . " / " . scalar(keys(%ownpkgs)) . " / $owntot 		"; - for $HH ( sort(keys(%ownhosts)) ) { + for my $HH ( sort(keys(%ownhosts)) ) { + print F "$HH "; + } + print F ""; + for my $PP ( sort(keys(%ownpkgs)) ) { + print F "$PP "; + } + print F "
Manual
" . scalar(keys(%manhosts)) . + " / " . scalar(keys(%manpkgs)) . " / $mantot 		"; + for my $HH ( sort(keys(%manhosts)) ) { print F "$HH "; } print F ""; - for $PP ( sort(keys(%ownpkgs)) ) { + for my $PP ( sort(keys(%manpkgs)) ) { print F "$PP "; } print F "
Normal
" . scalar(keys(%normhosts)) . " / " . scalar(keys(%normpkgs)) . " / $normtot 		"; - for $HH ( sort(keys(%normhosts)) ) { + for my $HH ( sort(keys(%normhosts)) ) { print F "$HH "; } print F ""; - for $PP ( sort(keys(%normpkgs)) ) { + for my $PP ( sort(keys(%normpkgs)) ) { print F "$PP "; } print F "
Skipped " . scalar(keys(%skiphosts)) . ""; - for $HH ( sort(keys(%skiphosts)) ) { + for my $HH ( sort(keys(%skiphosts)) ) { print F "$HH "; } print F "
Ok " . scalar(keys(%okhosts)) . ""; - for $HH ( sort(keys(%okhosts)) ) { + for my $HH ( sort(keys(%okhosts)) ) { print F "$HH "; } print F "
\n"; -for $P ( sort(keys(%summary)) ) { +for my $P ( sort(keys(%summary)) ) { my $PN = $P; $PN = "$P (s)" if ($secpkgs{$P}); $PN = "$P (id)" if ($ownpkgs{$P}); print F "\n"; print F "\n"; @@ -236,7 +352,7 @@ exit(0); sub strdiff { my $x = shift; my $y = shift; - print "strdiff: '$x' '$y' \n" if $debug>1; + print "strdiff: '$x' '$y' \n" if $debug>2; if ( $x eq $y ) { return "$x ??"; } @@ -254,14 +370,14 @@ sub strdiff { $b++; } my $c = length($y) - $b +1; - print "strdiff: a=$a " . substr($y,0,$a) ."\n" if $debug>1; - print "strdiff: b=$b " . "\n" if $debug>1; - print "strdiff: c=$c " . substr($y,$c) ."\n" if $debug>1; - print "strdiff: " . substr($y,$a, $c-$a) ."\n" if $debug>1; + print "strdiff: a=$a " . substr($y,0,$a) ."\n" if $debug>2; + print "strdiff: b=$b " . "\n" if $debug>2; + print "strdiff: c=$c " . substr($y,$c) ."\n" if $debug>2; + print "strdiff: " . substr($y,$a, $c-$a) ."\n" if $debug>2; my $z = substr($y,0,$a) . "" . substr($y,$a, $c-$a) . "" . substr($y,$c); - print "strdiff: " . $z ."\n" if $debug>1; - print "\n" if $debug>1; + print "strdiff: " . $z ."\n" if $debug>2; + print "\n" if $debug>2; return $z; } -- 1.7.10.4
$PN"; - for $HH ( split(' ',$summary{$P} )) { + for my $HH ( split(' ',$summary{$P} )) { print F "$HH "; } print F "