chore: initial import from KNEL/PFVCluster@041d311 [#769]
Split per O&M lane work order. Full history: KNEL/PFVCluster. https://projects.knownelement.com/issues/769#note-4152
This commit is contained in:
@@ -0,0 +1,3 @@
|
|||||||
|
# Refs only — real values live in ~/.creds (0600), never in repos.
|
||||||
|
# Example: this repo's CLIs read env files at runtime, e.g.
|
||||||
|
# docker run --rm --env-file ~/.creds/redmine.env ...
|
||||||
@@ -0,0 +1,17 @@
|
|||||||
|
# ShellCheck configuration for PFVCluster
|
||||||
|
# (used when running `shellcheck` directly; tests/shellcheck.sh applies the
|
||||||
|
# same disables via -e for consistent results under Docker)
|
||||||
|
#
|
||||||
|
# These checks are DISABLED because they flag intentional conventions of this
|
||||||
|
# codebase, not bugs:
|
||||||
|
#
|
||||||
|
# SC1090 / SC1091 — cannot follow dynamically-computed `source` paths. The KNEL
|
||||||
|
# framework (vendor/) and test harness source helpers via computed include
|
||||||
|
# dirs, which shellcheck cannot resolve statically.
|
||||||
|
# SC2029 — ssh orchestration (tests/remote.sh and perf/k8s/dns scripts)
|
||||||
|
# deliberately builds and expands the remote command on the CLIENT side before
|
||||||
|
# sending it. That is the whole point of the single-chokepoint remote pattern.
|
||||||
|
disable=SC1090,SC1091,SC2029
|
||||||
|
|
||||||
|
# Treat external-sourced files as bash (matches #!/usr/bin/env bash framework).
|
||||||
|
external-sources=true
|
||||||
@@ -0,0 +1,8 @@
|
|||||||
|
# AGENTS.md — perf
|
||||||
|
|
||||||
|
Point of truth for fleet-wide agent policy: the workspace AGENTS.md in KNEL/PFVCluster (loaded globally). This file holds repo-specific notes only.
|
||||||
|
|
||||||
|
- Ticket gate: `echo '#NNN' > .crush/active-ticket` before any modification; reference [\#709] + [#769].
|
||||||
|
- Remote access: SSH chokepoints only — tests/remote.sh (PFVCluster)perf; DNS names only, never IP literals.
|
||||||
|
- Docs: Discourse topic https://community.turnsys.com/t/328 — keep README pointer current.
|
||||||
|
- shellcheck zero-warning (incl. info) via `bash tests/shellcheck.sh`.
|
||||||
@@ -0,0 +1,235 @@
|
|||||||
|
GNU AFFERO GENERAL PUBLIC LICENSE
|
||||||
|
Version 3, 19 November 2007
|
||||||
|
|
||||||
|
Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
|
||||||
|
|
||||||
|
Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
|
||||||
|
|
||||||
|
Preamble
|
||||||
|
|
||||||
|
The GNU Affero General Public License is a free, copyleft license for software and other kinds of works, specifically designed to ensure cooperation with the community in the case of network server software.
|
||||||
|
|
||||||
|
The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, our General Public Licenses are intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users.
|
||||||
|
|
||||||
|
When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things.
|
||||||
|
|
||||||
|
Developers that use our General Public Licenses protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License which gives you legal permission to copy, distribute and/or modify the software.
|
||||||
|
|
||||||
|
A secondary benefit of defending all users' freedom is that improvements made in alternate versions of the program, if they receive widespread use, become available for other developers to incorporate. Many developers of free software are heartened and encouraged by the resulting cooperation. However, in the case of software used on network servers, this result may fail to come about. The GNU General Public License permits making a modified version and letting the public access it on a server without ever releasing its source code to the public.
|
||||||
|
|
||||||
|
The GNU Affero General Public License is designed specifically to ensure that, in such cases, the modified source code becomes available to the community. It requires the operator of a network server to provide the source code of the modified version running there to the users of that server. Therefore, public use of a modified version, on a publicly accessible server, gives the public access to the source code of the modified version.
|
||||||
|
|
||||||
|
An older license, called the Affero General Public License and published by Affero, was designed to accomplish similar goals. This is a different license, not a version of the Affero GPL, but Affero has released a new version of the Affero GPL which permits relicensing under this license.
|
||||||
|
|
||||||
|
The precise terms and conditions for copying, distribution and modification follow.
|
||||||
|
|
||||||
|
TERMS AND CONDITIONS
|
||||||
|
|
||||||
|
0. Definitions.
|
||||||
|
|
||||||
|
"This License" refers to version 3 of the GNU Affero General Public License.
|
||||||
|
|
||||||
|
"Copyright" also means copyright-like laws that apply to other kinds of works, such as semiconductor masks.
|
||||||
|
|
||||||
|
"The Program" refers to any copyrightable work licensed under this License. Each licensee is addressed as "you". "Licensees" and "recipients" may be individuals or organizations.
|
||||||
|
|
||||||
|
To "modify" a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a "modified version" of the earlier work or a work "based on" the earlier work.
|
||||||
|
|
||||||
|
A "covered work" means either the unmodified Program or a work based on the Program.
|
||||||
|
|
||||||
|
To "propagate" a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well.
|
||||||
|
|
||||||
|
To "convey" a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying.
|
||||||
|
|
||||||
|
An interactive user interface displays "Appropriate Legal Notices" to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion.
|
||||||
|
|
||||||
|
1. Source Code.
|
||||||
|
The "source code" for a work means the preferred form of the work for making modifications to it. "Object code" means any non-source form of a work.
|
||||||
|
|
||||||
|
A "Standard Interface" means an interface that either is an official standard defined by a recognized standards body, or, in the case of interfaces specified for a particular programming language, one that is widely used among developers working in that language.
|
||||||
|
|
||||||
|
The "System Libraries" of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A "Major Component", in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it.
|
||||||
|
|
||||||
|
The "Corresponding Source" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those
|
||||||
|
subprograms and other parts of the work.
|
||||||
|
|
||||||
|
The Corresponding Source need not include anything that users can regenerate automatically from other parts of the Corresponding Source.
|
||||||
|
|
||||||
|
The Corresponding Source for a work in source code form is that same work.
|
||||||
|
|
||||||
|
2. Basic Permissions.
|
||||||
|
All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program. The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work. This License acknowledges your rights of fair use or other equivalent, as provided by copyright law.
|
||||||
|
|
||||||
|
You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you.
|
||||||
|
|
||||||
|
Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary.
|
||||||
|
|
||||||
|
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
|
||||||
|
No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures.
|
||||||
|
|
||||||
|
When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures.
|
||||||
|
|
||||||
|
4. Conveying Verbatim Copies.
|
||||||
|
You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program.
|
||||||
|
|
||||||
|
You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee.
|
||||||
|
|
||||||
|
5. Conveying Modified Source Versions.
|
||||||
|
You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions:
|
||||||
|
|
||||||
|
a) The work must carry prominent notices stating that you modified it, and giving a relevant date.
|
||||||
|
|
||||||
|
b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to "keep intact all notices".
|
||||||
|
|
||||||
|
c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it.
|
||||||
|
|
||||||
|
d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so.
|
||||||
|
|
||||||
|
A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an "aggregate" if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate.
|
||||||
|
|
||||||
|
6. Conveying Non-Source Forms.
|
||||||
|
You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways:
|
||||||
|
|
||||||
|
a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange.
|
||||||
|
|
||||||
|
b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge.
|
||||||
|
|
||||||
|
c) Convey individual copies of the object code with a copy of the written offer to provide the Corresponding Source. This alternative is allowed only occasionally and noncommercially, and only if you received the object code with such an offer, in accord with subsection 6b.
|
||||||
|
|
||||||
|
d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements.
|
||||||
|
|
||||||
|
e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d.
|
||||||
|
|
||||||
|
A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work.
|
||||||
|
|
||||||
|
A "User Product" is either (1) a "consumer product", which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, "normally used" refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product.
|
||||||
|
|
||||||
|
"Installation Information" for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.
|
||||||
|
|
||||||
|
If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM).
|
||||||
|
|
||||||
|
The requirement to provide Installation Information does not include a requirement to continue to provide support service, warranty, or updates for a work that has been modified or installed by the recipient, or for the User Product in which it has been modified or installed. Access to a network may be denied when the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network.
|
||||||
|
|
||||||
|
Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying.
|
||||||
|
|
||||||
|
7. Additional Terms.
|
||||||
|
"Additional permissions" are terms that supplement the terms of this License by making exceptions from one or more of its conditions. Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions.
|
||||||
|
|
||||||
|
When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission.
|
||||||
|
|
||||||
|
Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms:
|
||||||
|
|
||||||
|
a) Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License; or
|
||||||
|
|
||||||
|
b) Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; or
|
||||||
|
|
||||||
|
c) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version; or
|
||||||
|
|
||||||
|
d) Limiting the use for publicity purposes of names of licensors or authors of the material; or
|
||||||
|
|
||||||
|
e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or
|
||||||
|
|
||||||
|
f) Requiring indemnification of licensors and authors of that material by anyone who conveys the material (or modified versions of it) with contractual assumptions of liability to the recipient, for any liability that these contractual assumptions directly impose on those licensors and authors.
|
||||||
|
|
||||||
|
All other non-permissive additional terms are considered "further restrictions" within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying.
|
||||||
|
|
||||||
|
If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms.
|
||||||
|
|
||||||
|
Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way.
|
||||||
|
|
||||||
|
8. Termination.
|
||||||
|
|
||||||
|
You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11).
|
||||||
|
|
||||||
|
However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation.
|
||||||
|
|
||||||
|
Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice.
|
||||||
|
|
||||||
|
Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10.
|
||||||
|
|
||||||
|
9. Acceptance Not Required for Having Copies.
|
||||||
|
|
||||||
|
You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so.
|
||||||
|
|
||||||
|
10. Automatic Licensing of Downstream Recipients.
|
||||||
|
|
||||||
|
Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License.
|
||||||
|
|
||||||
|
An "entity transaction" is a transaction transferring control of an organization, or substantially all assets of one, or subdividing an organization, or merging organizations. If propagation of a covered work results from an entity transaction, each party to that transaction who receives a copy of the work also receives whatever licenses to the work the party's predecessor in interest had or could give under the previous paragraph, plus a right to possession of the Corresponding Source of the work from the predecessor in interest, if the predecessor has it or can get it with reasonable efforts.
|
||||||
|
|
||||||
|
You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it.
|
||||||
|
|
||||||
|
11. Patents.
|
||||||
|
|
||||||
|
A "contributor" is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor's "contributor version".
|
||||||
|
|
||||||
|
A contributor's "essential patent claims" are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, "control" includes the right to grant patent sublicenses in a manner consistent with the requirements of this License.
|
||||||
|
|
||||||
|
Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version.
|
||||||
|
|
||||||
|
In the following three paragraphs, a "patent license" is any express agreement or commitment, however denominated, not to enforce a patent (such as an express permission to practice a patent or covenant not to sue for patent infringement). To "grant" such a patent license to a party means to make such an agreement or commitment not to enforce a patent against the party.
|
||||||
|
|
||||||
|
If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent
|
||||||
|
license to downstream recipients. "Knowingly relying" means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient's use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid.
|
||||||
|
|
||||||
|
If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it.
|
||||||
|
|
||||||
|
A patent license is "discriminatory" if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007.
|
||||||
|
|
||||||
|
Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law.
|
||||||
|
|
||||||
|
12. No Surrender of Others' Freedom.
|
||||||
|
|
||||||
|
If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may
|
||||||
|
not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program.
|
||||||
|
|
||||||
|
13. Remote Network Interaction; Use with the GNU General Public License.
|
||||||
|
|
||||||
|
Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software. This Corresponding Source shall include the Corresponding Source for any work covered by version 3 of the GNU General Public License that is incorporated pursuant to the following paragraph.
|
||||||
|
|
||||||
|
Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the work with which it is combined will remain governed by version 3 of the GNU General Public License.
|
||||||
|
|
||||||
|
14. Revised Versions of this License.
|
||||||
|
|
||||||
|
The Free Software Foundation may publish revised and/or new versions of the GNU Affero General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.
|
||||||
|
|
||||||
|
Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU Affero General Public License "or any later version" applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU Affero General Public License, you may choose any version ever published by the Free Software Foundation.
|
||||||
|
|
||||||
|
If the Program specifies that a proxy can decide which future versions of the GNU Affero General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program.
|
||||||
|
|
||||||
|
Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version.
|
||||||
|
|
||||||
|
15. Disclaimer of Warranty.
|
||||||
|
|
||||||
|
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
||||||
|
|
||||||
|
16. Limitation of Liability.
|
||||||
|
|
||||||
|
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
|
||||||
|
|
||||||
|
17. Interpretation of Sections 15 and 16.
|
||||||
|
|
||||||
|
If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee.
|
||||||
|
|
||||||
|
END OF TERMS AND CONDITIONS
|
||||||
|
|
||||||
|
How to Apply These Terms to Your New Programs
|
||||||
|
|
||||||
|
If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms.
|
||||||
|
|
||||||
|
To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found.
|
||||||
|
|
||||||
|
FetchApply
|
||||||
|
Copyright (C) 2024 VpTechnicalOperations
|
||||||
|
|
||||||
|
This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
|
||||||
|
|
||||||
|
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details.
|
||||||
|
|
||||||
|
You should have received a copy of the GNU Affero General Public License along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
|
||||||
|
Also add information on how to contact you by electronic and paper mail.
|
||||||
|
|
||||||
|
If your software can interact with users remotely through a computer network, you should also make sure that it provides a way for users to get its source. For example, if your program is a web application, its interface could display a "Source" link that leads users to an archive of the code. There are many ways you could offer source, and different solutions will be better for different programs; see section 13 for the specific requirements.
|
||||||
|
|
||||||
|
You should also get your employer (if you work as a programmer) or school, if any, to sign a "copyright disclaimer" for the program, if necessary. For more information on this, and how to apply and follow the GNU AGPL, see <http://www.gnu.org/licenses/>.
|
||||||
@@ -0,0 +1,50 @@
|
|||||||
|
# Makefile — convenience dispatch to scripts/.
|
||||||
|
#
|
||||||
|
# Not required. The scripts in scripts/ are the real entry points and work
|
||||||
|
# standalone. This file just gives you short verbs if you're at a terminal.
|
||||||
|
#
|
||||||
|
# In Mode 2 (Hermes/OWUI/MCP), agents call the scripts directly or via API —
|
||||||
|
# they don't need this file.
|
||||||
|
|
||||||
|
# Project-specific overrides for check-rules.sh
|
||||||
|
export PROJECT_DOC_EXEMPT ?= AGENTS.md STATUS.md WORKING.md README.md ADOPTING.md LICENSE .env.example questions-v1.md BASELINE-PROMPT.md PATTERNS.md
|
||||||
|
export PROJECT_DISCOURSE_HOST ?= community.turnsys.com
|
||||||
|
|
||||||
|
.PHONY: setup validate fast lint test garden up down status clean help
|
||||||
|
|
||||||
|
help: ## Show available targets
|
||||||
|
@grep -E '^[a-zA-Z_-]+:.*?## ' $(MAKEFILE_LIST) | awk 'BEGIN{FS=":.*?## "}{printf " \033[36m%-12s\033[0m %s\n", $$1, $$2}'
|
||||||
|
|
||||||
|
setup: ## Install git hooks
|
||||||
|
@bash scripts/setup-hooks.sh
|
||||||
|
|
||||||
|
validate: ## Full rule audit (includes tests)
|
||||||
|
@bash scripts/check-rules.sh
|
||||||
|
|
||||||
|
fast: ## Fast rule audit (pre-commit equivalent)
|
||||||
|
@bash scripts/check-rules.sh --fast
|
||||||
|
|
||||||
|
lint: ## Lint shell scripts (shellcheck via docker)
|
||||||
|
@docker run --rm -v "$$(pwd):/mnt" koalaman/shellcheck:stable \
|
||||||
|
$$(find . -path ./.git -prune -o -path ./.tmp -prune -o -path ./vendor -prune -o -path ./node_modules -prune -o \( -name '*.sh' -o -name '*.bash' \) -print | sed 's|^\./|/mnt/|') || true
|
||||||
|
|
||||||
|
test: ## Run the test suite (override per project)
|
||||||
|
@bash scripts/test.sh
|
||||||
|
|
||||||
|
garden: ## Doc-sprawl / Discourse-migration report
|
||||||
|
@bash scripts/garden.sh
|
||||||
|
|
||||||
|
up: ## Bring up the docker-compose stack
|
||||||
|
@bash scripts/up.sh
|
||||||
|
|
||||||
|
down: ## Bring down the docker-compose stack
|
||||||
|
@bash scripts/down.sh
|
||||||
|
|
||||||
|
status: ## Show repo status snapshot
|
||||||
|
@echo "== branch =="; git branch --show-current 2>/dev/null || echo "(no branch)"
|
||||||
|
@echo "== last commit =="; git log --oneline -1 2>/dev/null || true
|
||||||
|
@echo "== working tree =="; git status --short 2>/dev/null || echo "(not a git repo)"
|
||||||
|
@echo "== STATUS.md head =="; sed -n '1,12p' STATUS.md 2>/dev/null || echo "(no STATUS.md)"
|
||||||
|
|
||||||
|
clean: ## Remove build/test artifacts (override per project)
|
||||||
|
@echo "make clean: nothing to clean — override this in your project's Makefile."
|
||||||
@@ -0,0 +1,14 @@
|
|||||||
|
# perf
|
||||||
|
|
||||||
|
> **Docs live on Discourse — this repo is the executable source of truth.**
|
||||||
|
> **Topic:** https://community.turnsys.com/t/328
|
||||||
|
> **Redmine:** https://projects.knownelement.com/issues/709 · **Split from** KNEL/PFVCluster@041d311 per [#769](https://projects.knownelement.com/issues/769)
|
||||||
|
|
||||||
|
Performance baseline + tuning: fio/iperf3 harness v1.1 (PSI, load, device identity), tuned-profile deploys, audit scripts (probe-storage, probe-network, conman-console, snmp-switch-audit, probe-drift, audit-vm-disks, audit-guest-io). Switch .cmds files now live in KNEL/netinfra. [\#709] [\#732] [\#737]
|
||||||
|
|
||||||
|
## Layout
|
||||||
|
- `scripts/` — rule engine + hooks (see `bash scripts/check-rules.sh --fast`)
|
||||||
|
- (imported content at repo root, mirroring its PFVCluster path layout)
|
||||||
|
|
||||||
|
## Provenance
|
||||||
|
Code imported from KNEL/PFVCluster (041d311); full git history retained in PFVCluster. Enforcement layer copied per ADOPTING.md. IaC consumers: KNEL/KNELIAC references this repo.
|
||||||
@@ -0,0 +1,4 @@
|
|||||||
|
# STATUS.md
|
||||||
|
|
||||||
|
> Operations status lives on Discourse: https://community.turnsys.com/t/297
|
||||||
|
> This file is a pointer stub. Active ticket: [#769](https://projects.knownelement.com/issues/769) (repo split).
|
||||||
@@ -0,0 +1,15 @@
|
|||||||
|
# perfbench container — #709. Same toolset as the fleet LXC/guest installer.
|
||||||
|
# Build: docker build -t git.knownelement.com/reachableceo/perfbench:1.0 .
|
||||||
|
FROM debian:12-slim
|
||||||
|
|
||||||
|
RUN apt-get update -qq && apt-get install -y -qq --no-install-recommends \
|
||||||
|
fio iperf3 jq libaio1 ca-certificates \
|
||||||
|
&& rm -rf /var/lib/apt/lists/*
|
||||||
|
|
||||||
|
COPY bench-run.sh /usr/local/bin/bench-run.sh
|
||||||
|
RUN chmod +x /usr/local/bin/bench-run.sh
|
||||||
|
|
||||||
|
# storage bench: mount the path to test at /mnt/bench
|
||||||
|
# network bench: run as server: docker run ... bench-run.sh --server
|
||||||
|
ENV BENCH_DIR=/mnt/bench
|
||||||
|
ENTRYPOINT ["/usr/local/bin/bench-run.sh"]
|
||||||
@@ -0,0 +1,86 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# bench-run.sh — standardized fleet benchmark (fio + iperf3). [#709]
|
||||||
|
# Same tool, same shape, everywhere: Proxmox LXCs, guests, containers.
|
||||||
|
# Non-destructive: fio writes only its own files under BENCH_DIR.
|
||||||
|
#
|
||||||
|
# Usage:
|
||||||
|
# BENCH_DIR=/path bench-run.sh # storage bench on /path (default /var/tmp)
|
||||||
|
# IPERF_SERVER=host bench-run.sh # + network test to that iperf3 server
|
||||||
|
# bench-run.sh --server # run as iperf3 server (one shot)
|
||||||
|
# Output: one "BENCH|key|value" line per metric (grep-friendly), plus meta.
|
||||||
|
set -u
|
||||||
|
|
||||||
|
RUNTIME="${BENCH_RUNTIME:-20}"
|
||||||
|
SIZE="${BENCH_SIZE:-1G}"
|
||||||
|
BENCH_DIR="${BENCH_DIR:-/var/tmp}"
|
||||||
|
STAMP="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
||||||
|
HOSTID="$(hostname -s)"
|
||||||
|
|
||||||
|
b() { printf 'BENCH|%s|%s|%s\n' "$HOSTID" "$1" "$2"; }
|
||||||
|
|
||||||
|
if [ "${1:-}" = "--server" ]; then
|
||||||
|
exec iperf3 -s -1
|
||||||
|
fi
|
||||||
|
|
||||||
|
command -v fio >/dev/null 2>&1 || { echo "ERROR: fio not installed (see install-bench.sh)" >&2; exit 1; }
|
||||||
|
|
||||||
|
mkdir -p "$BENCH_DIR"
|
||||||
|
b meta stamp "$STAMP"
|
||||||
|
b meta path "$BENCH_DIR"
|
||||||
|
b meta runtime "$RUNTIME"
|
||||||
|
b meta size "$SIZE"
|
||||||
|
|
||||||
|
# context: load, PSI latency (pressure stall info — the latencytop
|
||||||
|
# replacement on modern kernels), and the backing device of BENCH_DIR
|
||||||
|
b meta load "$(cat /proc/loadavg)"
|
||||||
|
if [ -d /proc/pressure ]; then
|
||||||
|
for rsc in io cpu memory; do
|
||||||
|
[ -r "/proc/pressure/$rsc" ] && \
|
||||||
|
b "psi_${rsc}_some_avg10" "$(awk '{for(i=1;i<=NF;i++) if($i ~ /^avg10=/) sub("avg10=","",$i)} /^some/ {print $2; exit}' "/proc/pressure/$rsc" 2>/dev/null)"
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
DEV=$(df -P "$BENCH_DIR" | awk 'NR==2 {print $1}')
|
||||||
|
b meta bench_device "$DEV"
|
||||||
|
[ -r "/sys/block/$(basename "$DEV")/queue/rotational" ] && \
|
||||||
|
b meta bench_device_rotational "$(cat "/sys/block/$(basename "$DEV")/queue/rotational")"
|
||||||
|
|
||||||
|
# fio may print human notes (e.g. sync-engine warnings) before the JSON on
|
||||||
|
# stdout; strip everything before the opening brace so jq always gets JSON.
|
||||||
|
parse_fio() { # $1=json-file $2=testname $3=read|write
|
||||||
|
sed -n '/^{/,$p' "$1" | jq -r --arg n "$2" --arg d "$3" '
|
||||||
|
.jobs[0] as $j |
|
||||||
|
($n) + "|iops=" + ($j[$d].iops | tostring) + "|" +
|
||||||
|
"bw_kbps=" + ($j[$d].bw | tostring) + "|" +
|
||||||
|
"p99_ms=" + (($j[$d].clat_ns.percentile["99.000000"] // 0) / 1000000 | tostring)' | while IFS='|' read -r n rest; do
|
||||||
|
printf 'BENCH|%s|%s|%s\n' "$HOSTID" "$n" "$rest"
|
||||||
|
done
|
||||||
|
}
|
||||||
|
|
||||||
|
run_fio() { # $1=testname $2=read|write $3+=fio-args
|
||||||
|
local name="$1"; local dir="$2"; shift 2
|
||||||
|
fio --name="$name" --output-format=json --timeout=120 "$@" \
|
||||||
|
> "$BENCH_DIR/.fio-out.json" 2>"$BENCH_DIR/.fio-err" || {
|
||||||
|
b "fio_${name}" ERROR; return; }
|
||||||
|
parse_fio "$BENCH_DIR/.fio-out.json" "$name" "$dir"
|
||||||
|
}
|
||||||
|
|
||||||
|
# 4k random read/write (IOPS), 1M sequential read/write (MB/s); direct to skip cache
|
||||||
|
run_fio randread4k read --filename="$BENCH_DIR/perf-test-file" --rw=randread --bs=4k --direct=1 --iodepth=16 --time_based --runtime="$RUNTIME" --size="$SIZE"
|
||||||
|
run_fio randwrite4k write --filename="$BENCH_DIR/perf-test-file" --rw=randwrite --bs=4k --direct=1 --iodepth=16 --time_based --runtime="$RUNTIME" --size="$SIZE"
|
||||||
|
run_fio seqread1m read --filename="$BENCH_DIR/perf-test-file" --rw=read --bs=1M --direct=1 --iodepth=8 --time_based --runtime="$RUNTIME" --size="$SIZE"
|
||||||
|
run_fio seqwrite1m write --filename="$BENCH_DIR/perf-test-file" --rw=write --bs=1M --direct=1 --iodepth=8 --time_based --runtime="$RUNTIME" --size="$SIZE"
|
||||||
|
|
||||||
|
rm -f "$BENCH_DIR/.fio-out.json" "$BENCH_DIR/.fio-err"
|
||||||
|
|
||||||
|
# post-run pressure + load (did the bench itself saturate the box?)
|
||||||
|
b meta load_end "$(cat /proc/loadavg)"
|
||||||
|
[ -r /proc/pressure/io ] && \
|
||||||
|
b psi_io_some_avg10_end "$(awk '/^some/ {for(i=1;i<=NF;i++) if($i ~ /^avg10=/) {sub("avg10=","",$i); print $i; exit}}' /proc/pressure/io)"
|
||||||
|
|
||||||
|
# network: only when a server is provided
|
||||||
|
if [ -n "${IPERF_SERVER:-}" ] && command -v iperf3 >/dev/null 2>&1; then
|
||||||
|
NET=$(iperf3 -c "$IPERF_SERVER" -t 10 -P 4 -J 2>/dev/null | jq -r '.end.sum_received.bits_per_second' 2>/dev/null)
|
||||||
|
[ -n "$NET" ] && b iperf3_rx_bps "$NET"
|
||||||
|
fi
|
||||||
|
|
||||||
|
b meta end "$STAMP"
|
||||||
@@ -0,0 +1,11 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# install-bench.sh — install the #709 benchmark toolset (fio + iperf3 + jq)
|
||||||
|
# on a Debian-based guest or LXC. Idempotent. Not for Proxmox hosts directly:
|
||||||
|
# on hosts, create the bench LXC (see lxc-bench-setup.sh) and run this inside.
|
||||||
|
set -eu
|
||||||
|
export DEBIAN_FRONTEND=noninteractive
|
||||||
|
apt-get update -qq
|
||||||
|
apt-get install -y -qq fio iperf3 jq >/dev/null
|
||||||
|
# libaio package name differs: libaio1 (bookworm) vs libaio1t64 (trixie+)
|
||||||
|
apt-get install -y -qq libaio1 2>/dev/null || apt-get install -y -qq libaio1t64 >/dev/null
|
||||||
|
echo "bench toolset installed: fio=$(fio --version 2>/dev/null | awk '{print $3}') iperf3=$(iperf3 --version 2>/dev/null | awk 'NR==1{print $2}')"
|
||||||
@@ -0,0 +1,62 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# lxc-bench-setup.sh — run ON a Proxmox host: stand up the #709 bench LXC
|
||||||
|
# (Proxmox cannot run docker; this is the host-side packaging of the same
|
||||||
|
# toolset) and optionally bench a storage path through it.
|
||||||
|
#
|
||||||
|
# Usage (from workstation, via tests/remote.sh prox-file):
|
||||||
|
# lxc-bench-setup.sh [--ctid N] [--store /mnt/path] [--keep]
|
||||||
|
# --store PATH bind-mount host PATH into the LXC at /mnt/bench and bench it
|
||||||
|
# --keep leave the LXC running (default: destroyed after the run)
|
||||||
|
set -eu
|
||||||
|
|
||||||
|
CTID="${BENCH_CTID:-30099}"
|
||||||
|
STORE=""
|
||||||
|
KEEP=0
|
||||||
|
while [ $# -gt 0 ]; do
|
||||||
|
case "$1" in
|
||||||
|
--ctid) CTID="$2"; shift 2 ;;
|
||||||
|
--store) STORE="$2"; shift 2 ;;
|
||||||
|
--keep) KEEP=1; shift ;;
|
||||||
|
*) echo "unknown arg $1" >&2; exit 1 ;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
|
cleanup() {
|
||||||
|
if [ "$KEEP" != 1 ] && pct status "$CTID" >/dev/null 2>&1; then
|
||||||
|
pct stop "$CTID" >/dev/null 2>&1 || true
|
||||||
|
pct destroy "$CTID" >/dev/null 2>&1 || true
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
trap cleanup EXIT
|
||||||
|
|
||||||
|
# template: fetch the standard Debian 12 LXC template if missing
|
||||||
|
TPL=$(pveam list local 2>/dev/null | grep -oE 'local:vztmpl/[a-z0-9-]*debian-12-standard[^ ]*\.tar\.zst' | head -1 || true)
|
||||||
|
if [ -z "$TPL" ]; then
|
||||||
|
pveam update >/dev/null
|
||||||
|
DL=$(pveam available --section system 2>/dev/null | grep -oE 'debian-12-standard[^ ]*\.tar\.zst' | sort -V | tail -1)
|
||||||
|
[ -n "$DL" ] || { echo "[bench-lxc] ERROR: no debian-12 LXC template in pveam" >&2; exit 1; }
|
||||||
|
pveam download local "$DL" >/dev/null
|
||||||
|
TPL=$(pveam list local | grep -oE "local:vztmpl/$DL" | head -1)
|
||||||
|
fi
|
||||||
|
echo "[bench-lxc] template: $TPL"
|
||||||
|
|
||||||
|
MP=()
|
||||||
|
if [ -n "$STORE" ]; then
|
||||||
|
MP=(-mp0 "$STORE,mp=/mnt/bench")
|
||||||
|
fi
|
||||||
|
|
||||||
|
pct create "$CTID" "$TPL" --hostname perfbench --memory 1024 --cores 2 \
|
||||||
|
--rootfs local-lvm:8 --net0 name=eth0,bridge=vmbr0,ip=dhcp \
|
||||||
|
--unprivileged 1 --features nesting=0 "${MP[@]}" >/dev/null
|
||||||
|
pct start "$CTID"
|
||||||
|
sleep 5
|
||||||
|
|
||||||
|
# toolset in (same installer the guests use; piped in, nothing fetched from outside)
|
||||||
|
# libaio1 is gone on trixie (t64 transition); fio pulls the right one itself
|
||||||
|
pct exec "$CTID" -- bash -c "export DEBIAN_FRONTEND=noninteractive; apt-get update -qq >/dev/null; apt-get install -y -qq fio iperf3 jq libaio1 >/dev/null || apt-get install -y -qq fio iperf3 jq >/dev/null"
|
||||||
|
|
||||||
|
BDIR="/mnt/bench"
|
||||||
|
[ -z "$STORE" ] && BDIR="/var/tmp"
|
||||||
|
echo "[bench-lxc] benching $BDIR on CT $CTID"
|
||||||
|
pct exec "$CTID" -- env BENCH_DIR="$BDIR" bash -s < "$(dirname "$0")/bench-run.sh"
|
||||||
|
echo "[bench-lxc] done"
|
||||||
Executable
+29
@@ -0,0 +1,29 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# check-pkgs.sh - verify package install state.
|
||||||
|
set -uo pipefail
|
||||||
|
SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=8 -o StrictHostKeyChecking=accept-new)
|
||||||
|
|
||||||
|
for host in pfv-tsys6 pfv-tsys7; do
|
||||||
|
echo "=== $host ==="
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$host" '
|
||||||
|
for p in sysstat jq numactl nvme mtr-tiny dig bmon tcpdump; do
|
||||||
|
if command -v "$p" >/dev/null 2>&1; then
|
||||||
|
echo " ✓ $p"
|
||||||
|
else
|
||||||
|
echo " ✗ $p"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
# sysstat config
|
||||||
|
echo " sysstat service:"
|
||||||
|
systemctl list-unit-files 2>/dev/null | grep -i sysstat | sed "s/^/ /"
|
||||||
|
echo " sysstat enabled in /etc/default:"
|
||||||
|
if [ -r /etc/default/sysstat ]; then
|
||||||
|
grep ENABLED /etc/default/sysstat | sed "s/^/ /"
|
||||||
|
else
|
||||||
|
echo " no /etc/default/sysstat"
|
||||||
|
fi
|
||||||
|
# on Debian trixie, sysstat uses a different path
|
||||||
|
ls /etc/cron.d/sysstat* 2>/dev/null | sed "s/^/ found: /"
|
||||||
|
'
|
||||||
|
echo ""
|
||||||
|
done
|
||||||
Executable
+41
@@ -0,0 +1,41 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# check-repos-and-reboot.sh - checks reboot-required + Proxmox repo config on all hosts.
|
||||||
|
set -uo pipefail
|
||||||
|
SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=8 -o StrictHostKeyChecking=accept-new)
|
||||||
|
HOSTS=(pfv-tsys1 pfv-tsys3 pfv-tsys4 pfv-tsys5 pfv-tsys6 pfv-tsys7)
|
||||||
|
|
||||||
|
for host in "${HOSTS[@]}"; do
|
||||||
|
echo "================================================================"
|
||||||
|
echo "[$host]"
|
||||||
|
echo "================================================================"
|
||||||
|
|
||||||
|
if ! ssh "${SSH_OPTS[@]}" "root@$host" 'echo ok' >/dev/null 2>&1; then
|
||||||
|
echo " UNREACHABLE"
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "--- /var/run/reboot-required ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$host" 'if [ -r /var/run/reboot-required ]; then echo "REBOOT REQUIRED"; cat /var/run/reboot-required 2>/dev/null; if [ -r /var/run/reboot-required.pkgs ]; then echo "Packages triggering:"; cat /var/run/reboot-required.pkgs; fi; else echo "(no reboot required marker)"; fi'
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "--- Running kernel vs installed kernel ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$host" 'echo "running: $(uname -r)"; echo "installed:"; dpkg -l | grep -E "pve-kernel-[0-9]" | awk "{print \" \"\$2\" \"\$3}" | tail -5'
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "--- Proxmox repositories (apt sources) ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$host" 'grep -rh "pve\|proxmox" /etc/apt/sources.list /etc/apt/sources.list.d/ 2>/dev/null | grep -v "^#" | sed "s/^/ /"'
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "--- Enterprise repo status (should be commented or absent if no subscription) ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$host" 'grep -l "pve-enterprise" /etc/apt/sources.list /etc/apt/sources.list.d/* 2>/dev/null | while read f; do echo " File: $f"; grep -n "pve-enterprise" "$f" | sed "s/^/ /"; done'
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "--- no-subscription repo presence ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$host" 'grep -rl "pve-no-subscription" /etc/apt/sources.list /etc/apt/sources.list.d/ 2>/dev/null | while read f; do echo " File: $f"; grep -n "pve-no-subscription" "$f" | sed "s/^/ /"; done'
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "--- Recently updated packages (last 24h, kernel-related) ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$host" 'grep -E "pve-kernel|proxmox|pve-qemu|zfs" /var/log/dpkg.log 2>/dev/null | grep "$(date +%Y-%m-%d)\|$(date -d yesterday +%Y-%m-%d)" | tail -15 || echo "(none in dpkg.log)"'
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
done
|
||||||
Executable
+51
@@ -0,0 +1,51 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# deploy-and-fix.sh - uploads fix script, runs it, starts VMs, verifies.
|
||||||
|
set -uo pipefail
|
||||||
|
HOST="$1"
|
||||||
|
SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=8 -o ServerAliveInterval=10 -o StrictHostKeyChecking=accept-new)
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/scripts"
|
||||||
|
|
||||||
|
echo "=== Uploading fix script to $HOST ==="
|
||||||
|
scp "${SSH_OPTS[@]}" "$SCRIPT_DIR/fix-bond-nfs.sh" "root@$HOST:/root/fix-bond-nfs.sh" >/dev/null 2>&1
|
||||||
|
|
||||||
|
echo "=== Running fix ==="
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'chmod +x /root/fix-bond-nfs.sh && bash /root/fix-bond-nfs.sh' 2>&1
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "=== Starting VMs ==="
|
||||||
|
for vmid in $(ssh "${SSH_OPTS[@]}" "root@$HOST" 'qm list 2>/dev/null | awk "NR>1{print \$1}"'); do
|
||||||
|
status=$(ssh "${SSH_OPTS[@]}" "root@$HOST" "qm status $vmid 2>/dev/null | awk '{print \$2}'")
|
||||||
|
if [ "$status" != "running" ]; then
|
||||||
|
echo " Starting VM $vmid..."
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" "qm start $vmid" 2>&1 | sed 's/^/ /'
|
||||||
|
else
|
||||||
|
echo " VM $vmid already running"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "Waiting 20s for VMs to boot..."
|
||||||
|
sleep 20
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "=== FULL VERIFICATION ==="
|
||||||
|
echo ""
|
||||||
|
echo "--- VMs ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'qm list'
|
||||||
|
echo ""
|
||||||
|
echo "--- NFS mounts ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'nfsstat -m 2>/dev/null | head -24'
|
||||||
|
echo ""
|
||||||
|
echo "--- NFS TCP connections ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'ss -tn state established "( dport = :2049 )" 2>/dev/null'
|
||||||
|
echo " Count:"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'ss -tn state established "( dport = :2049 )" 2>/dev/null | tail -n +2 | wc -l'
|
||||||
|
echo ""
|
||||||
|
echo "--- bond0 hash policy ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'cat /proc/net/bonding/bond0 | head -6'
|
||||||
|
echo ""
|
||||||
|
echo "--- Summary ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'echo "tcp_cc: $(sysctl -n net.ipv4.tcp_congestion_control)"'
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'echo "swappiness: $(sysctl -n vm.swappiness)"'
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'echo "governor: $(cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor 2>/dev/null)"'
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'tuned-adm active 2>/dev/null'
|
||||||
Executable
+174
@@ -0,0 +1,174 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
###############################################################################
|
||||||
|
# deploy-check.sh
|
||||||
|
#
|
||||||
|
# Deploys scripts/check.sh to each reachable Proxmox host, executes it
|
||||||
|
# read-only, and pulls the resulting log back to returned-logs/.
|
||||||
|
#
|
||||||
|
# EXPLICITLY SKIPS:
|
||||||
|
# - pfv-tsys2 (off the air per user; Win10 pending rebuild)
|
||||||
|
# - pfv-tsys8 (retired / permanently offline per user)
|
||||||
|
#
|
||||||
|
# Safety features:
|
||||||
|
# - BatchMode=yes : never hang on a password prompt
|
||||||
|
# - ConnectTimeout=8 : fail fast on dead hosts
|
||||||
|
# - per-host try/skip : one bad host never aborts the run
|
||||||
|
# - ServerAliveInterval : detect hung connections
|
||||||
|
# - read-only script : check.sh modifies nothing on the target
|
||||||
|
###############################################################################
|
||||||
|
set -uo pipefail
|
||||||
|
|
||||||
|
SELF_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||||
|
ROOT_DIR="$(cd "$SELF_DIR/.." && pwd)"
|
||||||
|
CHECK_SH="$SELF_DIR/scripts/check.sh"
|
||||||
|
LOG_DIR="$ROOT_DIR/returned-logs"
|
||||||
|
mkdir -p "$LOG_DIR"
|
||||||
|
|
||||||
|
# ONLY the hosts the user told us are alive.
|
||||||
|
HOSTS=(pfv-tsys1 pfv-tsys3 pfv-tsys4 pfv-tsys5 pfv-tsys6 pfv-tsys7 pfv-tsys9)
|
||||||
|
|
||||||
|
# Common ssh options: non-interactive, fail-fast, no host-key prompt blocking.
|
||||||
|
SSH_OPTS=(-o BatchMode=yes
|
||||||
|
-o ConnectTimeout=8
|
||||||
|
-o ServerAliveInterval=10
|
||||||
|
-o ServerAliveCountMax=3
|
||||||
|
-o StrictHostKeyChecking=accept-new)
|
||||||
|
|
||||||
|
log() { printf '[%s] %s\n' "$(date +%H:%M:%S)" "$*"; }
|
||||||
|
|
||||||
|
if [ ! -r "$CHECK_SH" ]; then
|
||||||
|
echo "FATAL: $CHECK_SH not found" >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Sanity-check shellcheck clean before shipping (best-effort, non-blocking)
|
||||||
|
if command -v docker >/dev/null 2>&1; then
|
||||||
|
log "pre-flight: shellcheck on check.sh"
|
||||||
|
if ! docker run --rm -v "$SELF_DIR:/mnt" -w /mnt \
|
||||||
|
koalaman/shellcheck:stable --severity=style --format=gcc scripts/check.sh \
|
||||||
|
>"$LOG_DIR/_shellcheck.preflight.txt" 2>&1; then
|
||||||
|
log "WARNING: shellcheck reported issues — see _shellcheck.preflight.txt"
|
||||||
|
log " aborting deploy to avoid shipping a broken script"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
log "pre-flight: shellcheck clean"
|
||||||
|
fi
|
||||||
|
|
||||||
|
summary_pass=()
|
||||||
|
summary_fail=()
|
||||||
|
declare -A HOST_PID # host -> background pid
|
||||||
|
declare -A HOST_MARKER # host -> per-host marker file
|
||||||
|
|
||||||
|
# Per-host worker — runs in background, one per host, all in parallel.
|
||||||
|
# Writes status into a marker file consumed by the parent.
|
||||||
|
worker() {
|
||||||
|
local host="$1"
|
||||||
|
local marker="$LOG_DIR/_marker.$host"
|
||||||
|
: > "$marker" # truncate
|
||||||
|
echo "running" >> "$marker"
|
||||||
|
|
||||||
|
local short=""
|
||||||
|
if ! ssh "${SSH_OPTS[@]}" "root@$host" 'echo ok' >/dev/null 2>&1; then
|
||||||
|
echo "fail unreachable" >> "$marker"
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
if ! scp "${SSH_OPTS[@]}" "$CHECK_SH" "root@$host:/root/check.sh" >/dev/null 2>&1; then
|
||||||
|
echo "fail scp-upload-failed" >> "$marker"
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
local remote_size
|
||||||
|
remote_size=$(ssh "${SSH_OPTS[@]}" "root@$host" 'wc -c < /root/check.sh' 2>/dev/null || echo 0)
|
||||||
|
if [ "${remote_size:-0}" -lt 1000 ]; then
|
||||||
|
echo "fail upload-corrupt" >> "$marker"
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
local remote_stdout
|
||||||
|
remote_stdout=$(ssh "${SSH_OPTS[@]}" "root@$host" \
|
||||||
|
'chmod +x /root/check.sh && bash /root/check.sh' 2>&1)
|
||||||
|
local rc=$?
|
||||||
|
if [ "$rc" -ne 0 ]; then
|
||||||
|
echo "fail check-exit-$rc" >> "$marker"
|
||||||
|
# don't return - still try to pull whatever log got produced
|
||||||
|
fi
|
||||||
|
short=$(printf '%s\n' "$remote_stdout" | grep -oE 'Wrote: /root/[a-zA-Z0-9_-]+\.log' | head -n1 | awk '{print $2}')
|
||||||
|
if [ -z "$short" ]; then
|
||||||
|
short=$(ssh "${SSH_OPTS[@]}" "root@$host" 'echo "/root/$(hostname -s).log"' 2>/dev/null)
|
||||||
|
fi
|
||||||
|
if [ -z "$short" ]; then
|
||||||
|
echo "fail no-log-path" >> "$marker"
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
if ! scp "${SSH_OPTS[@]}" "root@$host:$short" "$LOG_DIR/" >/dev/null 2>&1; then
|
||||||
|
echo "fail scp-download-failed" >> "$marker"
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
local local_name local_path
|
||||||
|
local_name="$(basename "$short")"
|
||||||
|
local_path="$LOG_DIR/$local_name"
|
||||||
|
if [ ! -s "$local_path" ]; then
|
||||||
|
echo "fail local-empty" >> "$marker"
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
echo "ok $local_name $(wc -c < "$local_path") $(wc -l < "$local_path")" >> "$marker"
|
||||||
|
}
|
||||||
|
|
||||||
|
# ---- launch all workers in parallel --------------------------------------
|
||||||
|
log "launching ${#HOSTS[@]} hosts in parallel..."
|
||||||
|
for host in "${HOSTS[@]}"; do
|
||||||
|
rm -f "$LOG_DIR/_marker.$host"
|
||||||
|
worker "$host" &
|
||||||
|
HOST_PID[$host]=$!
|
||||||
|
HOST_MARKER[$host]="$LOG_DIR/_marker.$host"
|
||||||
|
log " launched $host (pid ${HOST_PID[$host]})"
|
||||||
|
done
|
||||||
|
|
||||||
|
# ---- wait for all, with periodic progress --------------------------------
|
||||||
|
remaining=("${HOSTS[@]}")
|
||||||
|
while [ "${#remaining[@]}" -gt 0 ]; do
|
||||||
|
sleep 10
|
||||||
|
new_remaining=()
|
||||||
|
for host in "${remaining[@]}"; do
|
||||||
|
if ! kill -0 "${HOST_PID[$host]}" 2>/dev/null; then
|
||||||
|
# process finished
|
||||||
|
wait "${HOST_PID[$host]}" 2>/dev/null || true
|
||||||
|
marker="${HOST_MARKER[$host]}"
|
||||||
|
if [ -r "$marker" ]; then
|
||||||
|
status_line="$(tail -n1 "$marker")"
|
||||||
|
log "[$host] done: $status_line"
|
||||||
|
case "$status_line" in
|
||||||
|
ok*) summary_pass+=("$host:$status_line") ;;
|
||||||
|
fail*) summary_fail+=("$host:$status_line") ;;
|
||||||
|
*) summary_fail+=("$host:unknown") ;;
|
||||||
|
esac
|
||||||
|
else
|
||||||
|
log "[$host] done but marker missing"
|
||||||
|
summary_fail+=("$host:no-marker")
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
new_remaining+=("$host")
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
if [ "${#new_remaining[@]}" -gt 0 ]; then
|
||||||
|
remaining=("${new_remaining[@]}")
|
||||||
|
else
|
||||||
|
remaining=()
|
||||||
|
fi
|
||||||
|
if [ "${#remaining[@]}" -gt 0 ]; then
|
||||||
|
log "still running: ${remaining[*]} (${#remaining[@]} hosts)"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
# Final summary
|
||||||
|
log "============================================================"
|
||||||
|
log "DEPLOY SUMMARY"
|
||||||
|
log "============================================================"
|
||||||
|
log "Passed (${#summary_pass[@]}):"
|
||||||
|
for p in "${summary_pass[@]:-}"; do [ -n "$p" ] && log " ✓ $p"; done
|
||||||
|
log "Failed (${#summary_fail[@]}):"
|
||||||
|
for f in "${summary_fail[@]:-}"; do [ -n "$f" ] && log " ✗ $f"; done
|
||||||
|
log ""
|
||||||
|
log "Contents of $LOG_DIR:"
|
||||||
|
ls -la "$LOG_DIR"
|
||||||
|
|
||||||
|
# Clean up marker files
|
||||||
|
rm -f "$LOG_DIR"/_marker.* 2>/dev/null
|
||||||
Executable
+56
@@ -0,0 +1,56 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# deploy-tuning.sh - copies apply-tunings.sh to target hosts and runs it.
|
||||||
|
# Usage: bash deploy-tuning.sh [--no-nfs] [--apply] <host> [host...]
|
||||||
|
# Default mode is dry-run. Pass --apply to commit. Pass --no-nfs to skip NFS section.
|
||||||
|
set -uo pipefail
|
||||||
|
|
||||||
|
SCRIPT="$(cd "$(dirname "${BASH_SOURCE[0]}")/scripts" && pwd)/apply-tunings.sh"
|
||||||
|
SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=8 -o ServerAliveInterval=10 -o StrictHostKeyChecking=accept-new)
|
||||||
|
MODE=""
|
||||||
|
EXTRA_FLAGS=""
|
||||||
|
|
||||||
|
HOSTS=()
|
||||||
|
for arg in "$@"; do
|
||||||
|
case "$arg" in
|
||||||
|
--apply) MODE="--apply" ;;
|
||||||
|
--dry-run) MODE="" ;;
|
||||||
|
--no-nfs) EXTRA_FLAGS="--no-nfs" ;;
|
||||||
|
*) HOSTS+=("$arg") ;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
|
if [ "${#HOSTS[@]}" -eq 0 ]; then
|
||||||
|
echo "Usage: $0 <host> [host...] [--apply]"
|
||||||
|
echo "Default: dry-run. Pass --apply to commit."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ ! -r "$SCRIPT" ]; then
|
||||||
|
echo "FATAL: $SCRIPT not found"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
for host in "${HOSTS[@]}"; do
|
||||||
|
echo "================================================================"
|
||||||
|
echo "[$host] deploying apply-tunings.sh (mode: ${MODE:-dry-run})"
|
||||||
|
echo "================================================================"
|
||||||
|
|
||||||
|
if ! ssh "${SSH_OPTS[@]}" "root@$host" 'echo ok' >/dev/null 2>&1; then
|
||||||
|
echo "[$host] SKIP: unreachable"
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "[$host] uploading..."
|
||||||
|
if ! scp "${SSH_OPTS[@]}" "$SCRIPT" "root@$host:/root/apply-tunings.sh" >/dev/null 2>&1; then
|
||||||
|
echo "[$host] SKIP: scp failed"
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "[$host] running (output below)..."
|
||||||
|
echo "----------------------------------------------------------------"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$host" "chmod +x /root/apply-tunings.sh && bash /root/apply-tunings.sh $MODE $EXTRA_FLAGS" 2>&1
|
||||||
|
rc=$?
|
||||||
|
echo "----------------------------------------------------------------"
|
||||||
|
echo "[$host] exit code: $rc"
|
||||||
|
echo ""
|
||||||
|
done
|
||||||
@@ -0,0 +1,35 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# diag.sh - diagnostic commands run on a host via SSH wrapper.
|
||||||
|
HOST="$1"
|
||||||
|
SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=8 -o StrictHostKeyChecking=accept-new)
|
||||||
|
|
||||||
|
echo "===== 1. storage.cfg NFS stanzas (exact content) ====="
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'grep -A 8 "^nfs: D2" /etc/pve/storage.cfg'
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "===== 2. Try manual NFS mount with nconnect=4 ====="
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'mount -t nfs -o nconnect=4,noatime,rsize=1048576,wsize=1048576,hard,proto=tcp pfv-tsys4-nfs-stor:/mnt/tsys4/D2 /mnt/pve/D2 2>&1; echo "exit=$?"'
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "===== 3. Try manual NFS mount WITHOUT nconnect ====="
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'mount -t nfs -o noatime,rsize=1048576,wsize=1048576,hard,proto=tcp pfv-tsys4-nfs-stor:/mnt/tsys4/D2 /mnt/pve/D2 2>&1; echo "exit=$?"'
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "===== 4. NFS kernel version / module ====="
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'cat /proc/fs/nfsfs/version 2>/dev/null; echo "---"; modinfo nfs 2>/dev/null | grep -E "^(filename|version|description)" | head -5'
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "===== 5. mount.nfs version ====="
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'mount.nfs --version 2>&1; echo "---"; dpkg -l nfs-common 2>/dev/null | tail -2'
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "===== 6. /etc/network/interfaces bond0 stanza (exact bytes) ====="
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'sed -n "/^auto bond0/,/^$/p" /etc/network/interfaces | cat -A'
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "===== 7. Current bond0 running hash policy ====="
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'cat /proc/net/bonding/bond0 | head -5'
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "===== 8. xmit_hash_policy sysfs file ====="
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'cat /sys/class/net/bond0/bonding/xmit_hash_policy 2>/dev/null; echo "---"; ls /sys/class/net/bond0/bonding/ 2>/dev/null'
|
||||||
Executable
+128
@@ -0,0 +1,128 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# finish-host.sh - applies ALL remaining changes to a host and verifies.
|
||||||
|
#
|
||||||
|
# Steps:
|
||||||
|
# 1. Start all VMs (triggers NFS lazy-mount)
|
||||||
|
# 2. Wait for NFS mounts to appear
|
||||||
|
# 3. Verify NFS nconnect=4 + noatime
|
||||||
|
# 4. Apply bond0 xmit_hash_policy=layer3+4
|
||||||
|
# 5. Full end-to-end verification
|
||||||
|
#
|
||||||
|
# Usage: bash finish-host.sh <host> [--apply]
|
||||||
|
# Default is dry-run (starts VMs + shows what bond change would do, but doesn't edit interfaces)
|
||||||
|
set -uo pipefail
|
||||||
|
|
||||||
|
HOST="${1:-}"
|
||||||
|
MODE="${2:-dryrun}"
|
||||||
|
[ "$MODE" = "--apply" ] && MODE="apply" || MODE="dryrun"
|
||||||
|
|
||||||
|
if [ -z "$HOST" ]; then
|
||||||
|
echo "Usage: $0 <host> [--apply]"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=8 -o ServerAliveInterval=10 -o StrictHostKeyChecking=accept-new)
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/scripts"
|
||||||
|
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " finish-host.sh — $HOST (mode: $MODE)"
|
||||||
|
echo "==================================================================="
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# =========================================================================
|
||||||
|
# STEP 1: Start all VMs
|
||||||
|
# =========================================================================
|
||||||
|
echo "=== STEP 1: Start all VMs on $HOST ==="
|
||||||
|
# Get list of all VMs (not just stopped — start is idempotent)
|
||||||
|
vm_list=$(ssh "${SSH_OPTS[@]}" "root@$HOST" 'qm list 2>/dev/null | awk "NR>1{print \$1}"')
|
||||||
|
for vmid in $vm_list; do
|
||||||
|
status=$(ssh "${SSH_OPTS[@]}" "root@$HOST" "qm status $vmid 2>/dev/null | awk '{print \$2}'")
|
||||||
|
if [ "$status" != "running" ]; then
|
||||||
|
echo " Starting VM $vmid..."
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" "qm start $vmid" 2>&1 | sed 's/^/ /'
|
||||||
|
else
|
||||||
|
echo " VM $vmid already running"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo " Waiting 15s for VMs to boot and trigger NFS mounts..."
|
||||||
|
sleep 15
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "--- VM status after start ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'qm list 2>/dev/null'
|
||||||
|
|
||||||
|
# =========================================================================
|
||||||
|
# STEP 2: Verify NFS mounts came back with nconnect=4
|
||||||
|
# =========================================================================
|
||||||
|
echo ""
|
||||||
|
echo "=== STEP 2: Verify NFS mounts with nconnect=4 ==="
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'nfsstat -m 2>/dev/null' | head -30
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "--- NFS TCP connections to :2049 ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'ss -tn state established "( dport = :2049 )" 2>/dev/null'
|
||||||
|
conn_count=$(ssh "${SSH_OPTS[@]}" "root@$HOST" 'ss -tn state established "( dport = :2049 )" 2>/dev/null | tail -n +2 | wc -l')
|
||||||
|
echo " Total NFS TCP connections: $conn_count"
|
||||||
|
|
||||||
|
# =========================================================================
|
||||||
|
# STEP 3: Apply bond0 hash policy
|
||||||
|
# =========================================================================
|
||||||
|
echo ""
|
||||||
|
echo "=== STEP 3: Apply bond0 xmit_hash_policy=layer3+4 (mode: $MODE) ==="
|
||||||
|
|
||||||
|
# Upload the bond hash script
|
||||||
|
scp "${SSH_OPTS[@]}" "$SCRIPT_DIR/apply-bond-hash.sh" "root@$HOST:/root/apply-bond-hash.sh" >/dev/null 2>&1
|
||||||
|
|
||||||
|
if [ "$MODE" = "apply" ]; then
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'chmod +x /root/apply-bond-hash.sh && bash /root/apply-bond-hash.sh --apply' 2>&1
|
||||||
|
else
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'chmod +x /root/apply-bond-hash.sh && bash /root/apply-bond-hash.sh' 2>&1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# =========================================================================
|
||||||
|
# STEP 4: Full verification
|
||||||
|
# =========================================================================
|
||||||
|
echo ""
|
||||||
|
echo "=== STEP 4: Full end-to-end verification ==="
|
||||||
|
echo ""
|
||||||
|
echo "--- Uptime ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'uptime'
|
||||||
|
echo ""
|
||||||
|
echo "--- CPU governor ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor 2>/dev/null || echo "(no cpufreq driver)"'
|
||||||
|
echo ""
|
||||||
|
echo "--- vm.swappiness ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'sysctl vm.swappiness'
|
||||||
|
echo ""
|
||||||
|
echo "--- TCP BBR ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'sysctl net.ipv4.tcp_congestion_control net.core.default_qdisc'
|
||||||
|
echo ""
|
||||||
|
echo "--- tuned profile ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'tuned-adm active 2>/dev/null'
|
||||||
|
echo ""
|
||||||
|
echo "--- bond0 hash policy + LACP state ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'cat /proc/net/bonding/bond0 2>/dev/null | head -25'
|
||||||
|
echo ""
|
||||||
|
echo "--- NFS mount options (first 3 mounts) ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'nfsstat -m 2>/dev/null | head -24'
|
||||||
|
echo ""
|
||||||
|
echo "--- NFS TCP connections (expect 4 per server × 2 servers = 8) ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'ss -tn state established "( dport = :2049 )" 2>/dev/null'
|
||||||
|
nfs_conns=$(ssh "${SSH_OPTS[@]}" "root@$HOST" 'ss -tn state established "( dport = :2049 )" 2>/dev/null | tail -n +2 | wc -l')
|
||||||
|
echo " Count: $nfs_conns"
|
||||||
|
echo ""
|
||||||
|
echo "--- VMs running ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'qm list 2>/dev/null'
|
||||||
|
echo ""
|
||||||
|
echo "--- Failed services ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'systemctl --failed --no-legend 2>/dev/null | head -10'
|
||||||
|
echo ""
|
||||||
|
echo "--- Network interfaces (speed/duplex/mtu) ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'for ifc in bond0 nic0 nic1 nic2 vmbr0 datanet; do [ -d "/sys/class/net/$ifc" ] && printf "%-12s speed=%-8s duplex=%-8s mtu=%s\n" "$ifc" "$(cat /sys/class/net/$ifc/speed 2>/dev/null)" "$(cat /sys/class/net/$ifc/duplex 2>/dev/null)" "$(cat /sys/class/net/$ifc/mtu 2>/dev/null)"; done'
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " COMPLETE — $HOST"
|
||||||
|
echo "==================================================================="
|
||||||
Executable
+37
@@ -0,0 +1,37 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# install-utils-v2.sh - retry install without nstat package.
|
||||||
|
set -uo pipefail
|
||||||
|
SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=8 -o StrictHostKeyChecking=accept-new)
|
||||||
|
|
||||||
|
PKGS="sysstat jq numactl nvme-cli mtr-tiny dnsutils bmon"
|
||||||
|
|
||||||
|
for host in pfv-tsys6 pfv-tsys7; do
|
||||||
|
echo "=== [$host] installing: $PKGS ==="
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$host" \
|
||||||
|
"DEBIAN_FRONTEND=noninteractive apt-get update -qq 2>&1 | tail -2 && \
|
||||||
|
DEBIAN_FRONTEND=noninteractive apt-get install -y $PKGS 2>&1 | tail -10"
|
||||||
|
|
||||||
|
# sysstat enable (path varies by Debian version)
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$host" '
|
||||||
|
if [ -r /etc/default/sysstat ]; then
|
||||||
|
sed -i "s/^ENABLED=.*/ENABLED=\"true\"/" /etc/default/sysstat
|
||||||
|
systemctl enable --now sysstat 2>/dev/null
|
||||||
|
grep ENABLED /etc/default/sysstat
|
||||||
|
else
|
||||||
|
# Newer Debian (trixie) — sysstat cron/service auto-enabled
|
||||||
|
systemctl enable --now sysstat 2>/dev/null || echo "(sysstat auto via cron)"
|
||||||
|
fi
|
||||||
|
'
|
||||||
|
echo ""
|
||||||
|
done
|
||||||
|
|
||||||
|
# Verify
|
||||||
|
for host in pfv-tsys6 pfv-tsys7; do
|
||||||
|
echo "=== [$host] verification ==="
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$host" '
|
||||||
|
for p in sysstat jq numactl nvme mtr-tiny dig bmon; do
|
||||||
|
command -v "$p" >/dev/null 2>&1 && echo " ✓ $p" || echo " ✗ $p"
|
||||||
|
done
|
||||||
|
'
|
||||||
|
echo ""
|
||||||
|
done
|
||||||
Executable
+60
@@ -0,0 +1,60 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# install-utils.sh - installs useful observability packages on a host.
|
||||||
|
# These are all small, dependency-light, and read-only at runtime.
|
||||||
|
set -uo pipefail
|
||||||
|
SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=8 -o StrictHostKeyChecking=accept-new)
|
||||||
|
|
||||||
|
HOSTS=(pfv-tsys6 pfv-tsys7)
|
||||||
|
|
||||||
|
# Packages to install, with rationale
|
||||||
|
PKGS=(
|
||||||
|
sysstat # sar, iostat, mpstat, pidstat - the missing observability suite
|
||||||
|
jq # JSON parsing for pvesh/scripts
|
||||||
|
numactl # NUMA topology/controls for the dual-socket hosts
|
||||||
|
nvme-cli # NVMe health (for when NVMe shows up)
|
||||||
|
tcpdump # packet capture for network debugging
|
||||||
|
mtr-tiny # traceroute on steroids
|
||||||
|
nstat # kernel SNMP stats (already partly there)
|
||||||
|
dnsutils # dig, nslookup, host
|
||||||
|
bmon # bandwidth monitor ( curses, real-time)
|
||||||
|
)
|
||||||
|
|
||||||
|
for host in "${HOSTS[@]}"; do
|
||||||
|
echo "================================================================"
|
||||||
|
echo "[$host] installing observability packages"
|
||||||
|
echo "================================================================"
|
||||||
|
|
||||||
|
if ! ssh "${SSH_OPTS[@]}" "root@$host" 'echo ok' >/dev/null 2>&1; then
|
||||||
|
echo " UNREACHABLE"
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Check which are missing
|
||||||
|
missing=""
|
||||||
|
for pkg in "${PKGS[@]}"; do
|
||||||
|
if ! ssh "${SSH_OPTS[@]}" "root@$host" "dpkg -s $pkg 2>/dev/null | grep -q 'Status: install ok installed'" 2>/dev/null; then
|
||||||
|
missing="$missing $pkg"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
if [ -z "$missing" ]; then
|
||||||
|
echo " All packages already installed."
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo " Installing:$missing"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$host" \
|
||||||
|
"DEBIAN_FRONTEND=noninteractive apt-get update -qq >/dev/null 2>&1 && \
|
||||||
|
DEBIAN_FRONTEND=noninteractive apt-get install -y -qq$missing 2>&1 | tail -5"
|
||||||
|
echo " Done."
|
||||||
|
echo ""
|
||||||
|
done
|
||||||
|
|
||||||
|
# Enable sysstat data collection (sar) — off by default on Debian
|
||||||
|
for host in "${HOSTS[@]}"; do
|
||||||
|
echo "[$host] enabling sysstat/sar data collection..."
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$host" \
|
||||||
|
"sed -i 's/^ENABLED=\"false\"/ENABLED=\"true\"/' /etc/default/sysstat 2>/dev/null; \
|
||||||
|
systemctl enable --now sysstat 2>&1 | tail -2; \
|
||||||
|
grep ENABLED /etc/default/sysstat"
|
||||||
|
done
|
||||||
Executable
+293
@@ -0,0 +1,293 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
###############################################################################
|
||||||
|
# iperf-full-matrix.sh
|
||||||
|
#
|
||||||
|
# Two test suites:
|
||||||
|
# A. Management network (vmbr0 / VLAN1): all-pairs single-stream TCP, 10s
|
||||||
|
# B. Storage network (VLAN1000): tsys6+tsys7 → tsys4+tsys5, stress test
|
||||||
|
#
|
||||||
|
# Output: returned-logs/iperf/
|
||||||
|
###############################################################################
|
||||||
|
set -uo pipefail
|
||||||
|
|
||||||
|
SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=8 -o ServerAliveInterval=10 -o StrictHostKeyChecking=accept-new)
|
||||||
|
LOG_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/returned-logs/iperf"
|
||||||
|
mkdir -p "$LOG_DIR"
|
||||||
|
|
||||||
|
HOSTS=(pfv-tsys1 pfv-tsys3 pfv-tsys4 pfv-tsys5 pfv-tsys6 pfv-tsys7)
|
||||||
|
|
||||||
|
# Storage IPs (known, static on VLAN1000)
|
||||||
|
declare -A SIP
|
||||||
|
SIP[pfv-tsys1]="10.100.100.1"
|
||||||
|
SIP[pfv-tsys3]="10.100.100.3"
|
||||||
|
SIP[pfv-tsys4]="10.100.100.4"
|
||||||
|
SIP[pfv-tsys5]="10.100.100.5"
|
||||||
|
SIP[pfv-tsys6]="10.100.100.6"
|
||||||
|
SIP[pfv-tsys7]="10.100.100.7"
|
||||||
|
|
||||||
|
# ===========================================================================
|
||||||
|
# STEP 0: Discover management IPs (vmbr0)
|
||||||
|
# ===========================================================================
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " STEP 0: Discover management network IPs (vmbr0)"
|
||||||
|
echo "==================================================================="
|
||||||
|
declare -A MIP
|
||||||
|
for host in "${HOSTS[@]}"; do
|
||||||
|
if ! ssh "${SSH_OPTS[@]}" "root@$host" 'echo ok' >/dev/null 2>&1; then
|
||||||
|
echo " [$host] UNREACHABLE"
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
mip=$(ssh "${SSH_OPTS[@]}" "root@$host" 'ip -o -4 addr show dev vmbr0 2>/dev/null | awk "{print \$4}" | cut -d/ -f1 | head -1')
|
||||||
|
if [ -n "$mip" ]; then
|
||||||
|
MIP[$host]="$mip"
|
||||||
|
echo " [$host] vmbr0 = $mip"
|
||||||
|
else
|
||||||
|
echo " [$host] no vmbr0 IPv4 — skipping"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
# ===========================================================================
|
||||||
|
# STEP 1: Ensure iperf3 installed on all hosts
|
||||||
|
# ===========================================================================
|
||||||
|
echo ""
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " STEP 1: Ensure iperf3 installed"
|
||||||
|
echo "==================================================================="
|
||||||
|
for host in "${HOSTS[@]}"; do
|
||||||
|
[ -z "${MIP[$host]:-}" ] && continue
|
||||||
|
if ! ssh "${SSH_OPTS[@]}" "root@$host" 'command -v iperf3 >/dev/null 2>&1' 2>/dev/null; then
|
||||||
|
echo -n " [$host] installing iperf3... "
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$host" \
|
||||||
|
'DEBIAN_FRONTEND=noninteractive apt-get update -qq >/dev/null 2>&1 && \
|
||||||
|
DEBIAN_FRONTEND=noninteractive apt-get install -y -qq iperf3 >/dev/null 2>&1 && echo OK || echo FAILED'
|
||||||
|
else
|
||||||
|
echo " [$host] iperf3 already installed"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
# Helper: start iperf3 server in one-shot mode bound to a specific IP
|
||||||
|
start_server() {
|
||||||
|
local host="$1" ip="$2"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$host" \
|
||||||
|
"pkill -x iperf3 2>/dev/null; nohup iperf3 -s -1 -B ${ip} >/dev/null 2>&1 &" 2>/dev/null
|
||||||
|
sleep 1
|
||||||
|
}
|
||||||
|
|
||||||
|
# Helper: run iperf3 client test, save output, extract result
|
||||||
|
run_test() {
|
||||||
|
local client="$1" server="$2" sip="$3" cip="$4" label="$5" logfile="$6"
|
||||||
|
shift 6
|
||||||
|
local extra="$*"
|
||||||
|
|
||||||
|
echo -n " [$label] ... "
|
||||||
|
{
|
||||||
|
echo "=== iperf3: $label ==="
|
||||||
|
echo "Client: $client ($cip) → Server: $server ($sip)"
|
||||||
|
echo "Date: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
||||||
|
echo "Args: $extra"
|
||||||
|
echo ""
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$client" "iperf3 -c ${sip} -B ${cip} ${extra}" 2>&1
|
||||||
|
echo ""
|
||||||
|
echo "=== END ==="
|
||||||
|
} > "$logfile" 2>&1
|
||||||
|
|
||||||
|
# Extract result
|
||||||
|
sum=$(grep '\[SUM\].*sender$' "$logfile" | tail -1)
|
||||||
|
if [ -n "$sum" ]; then
|
||||||
|
bitrate=$(echo "$sum" | awk '{print $6, $7}')
|
||||||
|
retrans=$(echo "$sum" | awk '{print $8}')
|
||||||
|
else
|
||||||
|
single=$(grep 'sender$' "$logfile" | tail -1)
|
||||||
|
bitrate=$(echo "$single" | awk '{print $7, $8}')
|
||||||
|
retrans=$(echo "$single" | awk '{print $9}')
|
||||||
|
fi
|
||||||
|
echo "${bitrate:-?} (retrans: ${retrans:-?})"
|
||||||
|
}
|
||||||
|
|
||||||
|
# ===========================================================================
|
||||||
|
# SUITE A: Management network (vmbr0) — all pairs, single-stream TCP, 10s
|
||||||
|
# ===========================================================================
|
||||||
|
echo ""
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " SUITE A: MANAGEMENT NETWORK (vmbr0) — all-pairs, 10s TCP"
|
||||||
|
echo " Expectation: ~940 Mbps for every pair (1 GbE line rate)"
|
||||||
|
echo "==================================================================="
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Test each unique pair (i < j to avoid duplicates)
|
||||||
|
for ((i=0; i<${#HOSTS[@]}; i++)); do
|
||||||
|
for ((j=i+1; j<${#HOSTS[@]}; j++)); do
|
||||||
|
client="${HOSTS[$i]}"
|
||||||
|
server="${HOSTS[$j]}"
|
||||||
|
[ -z "${MIP[$client]:-}" ] && continue
|
||||||
|
[ -z "${MIP[$server]:-}" ] && continue
|
||||||
|
|
||||||
|
label="mgmt: ${client}→${server}"
|
||||||
|
logfile="$LOG_DIR/mgmt-${client}-to-${server}.log"
|
||||||
|
|
||||||
|
start_server "$server" "${MIP[$server]}"
|
||||||
|
run_test "$client" "$server" "${MIP[$server]}" "${MIP[$client]}" \
|
||||||
|
"$label" "$logfile" "-t 10 -P 1"
|
||||||
|
done
|
||||||
|
done
|
||||||
|
|
||||||
|
# ===========================================================================
|
||||||
|
# SUITE B: Storage network (VLAN1000) — stress test the cross-rack LACP
|
||||||
|
# ===========================================================================
|
||||||
|
echo ""
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " SUITE B: STORAGE NETWORK (VLAN1000) — stress test cross-rack link"
|
||||||
|
echo " tsys6 + tsys7 (Rack 3) → tsys4 + tsys5 (Rack 5)"
|
||||||
|
echo " Expectation: limited by tsys4 USB dongle + tsys5 broken bond"
|
||||||
|
echo "==================================================================="
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# --- B.1: Individual tests (one client → one server at a time) ---
|
||||||
|
echo "--- B.1: Individual tests (sequential) ---"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
for client in pfv-tsys6 pfv-tsys7; do
|
||||||
|
for server in pfv-tsys4 pfv-tsys5; do
|
||||||
|
label="stor: ${client}→${server} (8-stream)"
|
||||||
|
logfile="$LOG_DIR/stor-indiv-${client}-to-${server}-8stream.log"
|
||||||
|
start_server "$server" "${SIP[$server]}"
|
||||||
|
run_test "$client" "$server" "${SIP[$server]}" "${SIP[$client]}" \
|
||||||
|
"$label" "$logfile" "-P 8 -t 20 -l 128k -O 2"
|
||||||
|
done
|
||||||
|
done
|
||||||
|
|
||||||
|
# --- B.2: Reverse direction (tsys4/5 → tsys6/7) ---
|
||||||
|
echo ""
|
||||||
|
echo "--- B.2: Reverse direction (tsys4/5 → tsys6/7) ---"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
for client in pfv-tsys4 pfv-tsys5; do
|
||||||
|
for server in pfv-tsys6 pfv-tsys7; do
|
||||||
|
label="stor: ${client}→${server} (8-stream rev)"
|
||||||
|
logfile="$LOG_DIR/stor-indiv-${client}-to-${server}-8stream.log"
|
||||||
|
start_server "$server" "${SIP[$server]}"
|
||||||
|
run_test "$client" "$server" "${SIP[$server]}" "${SIP[$client]}" \
|
||||||
|
"$label" "$logfile" "-P 8 -t 20 -l 128k -O 2"
|
||||||
|
done
|
||||||
|
done
|
||||||
|
|
||||||
|
# --- B.3: Simultaneous stress test (4 flows at once) ---
|
||||||
|
echo ""
|
||||||
|
echo "--- B.3: Simultaneous 4-flow stress test ---"
|
||||||
|
echo " tsys6→tsys4 + tsys6→tsys5 + tsys7→tsys4 + tsys7→tsys5"
|
||||||
|
echo " All running in parallel for 30 seconds"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Start 4 iperf3 servers (one-shot mode won't work for parallel; use persistent)
|
||||||
|
for server in pfv-tsys4 pfv-tsys5; do
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$server" "pkill -x iperf3 2>/dev/null; nohup iperf3 -s -B ${SIP[$server]} >/dev/null 2>&1 &" 2>/dev/null
|
||||||
|
echo " [server started: $server]"
|
||||||
|
done
|
||||||
|
sleep 1
|
||||||
|
|
||||||
|
STRESS_LOG="$LOG_DIR/stor-stress-4flow"
|
||||||
|
mkdir -p "$STRESS_LOG"
|
||||||
|
|
||||||
|
# Launch 4 clients in parallel, each writing to its own log
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@pfv-tsys6" "iperf3 -c ${SIP[pfv-tsys4]} -B ${SIP[pfv-tsys6]} -P 4 -t 30 -l 128k -O 2" > "$STRESS_LOG/tsys6-to-tsys4.log" 2>&1 &
|
||||||
|
PID1=$!
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@pfv-tsys6" "iperf3 -c ${SIP[pfv-tsys5]} -B ${SIP[pfv-tsys6]} -P 4 -t 30 -l 128k -O 2" > "$STRESS_LOG/tsys6-to-tsys5.log" 2>&1 &
|
||||||
|
PID2=$!
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@pfv-tsys7" "iperf3 -c ${SIP[pfv-tsys4]} -B ${SIP[pfv-tsys7]} -P 4 -t 30 -l 128k -O 2" > "$STRESS_LOG/tsys7-to-tsys4.log" 2>&1 &
|
||||||
|
PID3=$!
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@pfv-tsys7" "iperf3 -c ${SIP[pfv-tsys5]} -B ${SIP[pfv-tsys7]} -P 4 -t 30 -l 128k -O 2" > "$STRESS_LOG/tsys7-to-tsys5.log" 2>&1 &
|
||||||
|
PID4=$!
|
||||||
|
|
||||||
|
echo " [4 clients launched, waiting 40s for completion...]"
|
||||||
|
wait $PID1 $PID2 $PID3 $PID4 2>/dev/null
|
||||||
|
echo " [all 4 flows complete]"
|
||||||
|
|
||||||
|
# Kill servers
|
||||||
|
for server in pfv-tsys4 pfv-tsys5; do
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$server" 'pkill -x iperf3 2>/dev/null; true' 2>/dev/null
|
||||||
|
done
|
||||||
|
|
||||||
|
# ===========================================================================
|
||||||
|
# SUITE C: All hosts cleanup
|
||||||
|
# ===========================================================================
|
||||||
|
echo ""
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " Cleanup: killing iperf3 everywhere"
|
||||||
|
echo "==================================================================="
|
||||||
|
for host in "${HOSTS[@]}"; do
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$host" 'pkill -x iperf3 2>/dev/null; true' 2>/dev/null
|
||||||
|
done
|
||||||
|
|
||||||
|
# ===========================================================================
|
||||||
|
# RESULTS SUMMARY
|
||||||
|
# ===========================================================================
|
||||||
|
echo ""
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " RESULTS SUMMARY"
|
||||||
|
echo "==================================================================="
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "===== SUITE A: Management network (vmbr0) ====="
|
||||||
|
echo ""
|
||||||
|
printf "%-40s %15s %10s\n" "TEST" "THROUGHPUT" "RETRANS"
|
||||||
|
printf "%-40s %15s %10s\n" "----" "----------" "-------"
|
||||||
|
for f in "$LOG_DIR"/mgmt-*.log; do
|
||||||
|
[ -r "$f" ] || continue
|
||||||
|
label=$(head -1 "$f" | sed 's/^=== iperf3: //; s/ ===$//')
|
||||||
|
single=$(grep 'sender$' "$f" | tail -1)
|
||||||
|
bitrate=$(echo "$single" | awk '{print $7, $8}')
|
||||||
|
retrans=$(echo "$single" | awk '{print $9}')
|
||||||
|
printf "%-40s %15s %10s\n" "$label" "${bitrate:-?}" "${retrans:--}"
|
||||||
|
done
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "===== SUITE B.1+B.2: Storage network individual ====="
|
||||||
|
echo ""
|
||||||
|
printf "%-45s %15s %10s\n" "TEST" "THROUGHPUT" "RETRANS"
|
||||||
|
printf "%-45s %15s %10s\n" "----" "----------" "-------"
|
||||||
|
for f in "$LOG_DIR"/stor-indiv-*.log; do
|
||||||
|
[ -r "$f" ] || continue
|
||||||
|
label=$(head -1 "$f" | sed 's/^=== iperf3: //; s/ ===$//')
|
||||||
|
sum=$(grep '\[SUM\].*sender$' "$f" | tail -1)
|
||||||
|
if [ -n "$sum" ]; then
|
||||||
|
bitrate=$(echo "$sum" | awk '{print $6, $7}')
|
||||||
|
retrans=$(echo "$sum" | awk '{print $8}')
|
||||||
|
else
|
||||||
|
single=$(grep 'sender$' "$f" | tail -1)
|
||||||
|
bitrate=$(echo "$single" | awk '{print $7, $8}')
|
||||||
|
retrans=$(echo "$single" | awk '{print $9}')
|
||||||
|
fi
|
||||||
|
printf "%-45s %15s %10s\n" "$label" "${bitrate:-?}" "${retrans:--}"
|
||||||
|
done
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "===== SUITE B.3: Simultaneous 4-flow stress test ====="
|
||||||
|
echo ""
|
||||||
|
printf "%-30s %15s %10s\n" "FLOW" "THROUGHPUT" "RETRANS"
|
||||||
|
printf "%-30s %15s %10s\n" "----" "----------" "-------"
|
||||||
|
total_mbps=0
|
||||||
|
for f in "$STRESS_LOG"/*.log; do
|
||||||
|
[ -r "$f" ] || continue
|
||||||
|
flow=$(basename "$f" .log)
|
||||||
|
sum=$(grep '\[SUM\].*sender$' "$f" | tail -1)
|
||||||
|
if [ -n "$sum" ]; then
|
||||||
|
bitrate=$(echo "$sum" | awk '{print $6, $7}')
|
||||||
|
retrans=$(echo "$sum" | awk '{print $8}')
|
||||||
|
mbps=$(echo "$sum" | awk '{print $6}')
|
||||||
|
total_mbps=$(awk "BEGIN{print $total_mbps + $mbps}")
|
||||||
|
else
|
||||||
|
bitrate="?"
|
||||||
|
retrans="-"
|
||||||
|
fi
|
||||||
|
printf "%-30s %15s %10s\n" "$flow" "$bitrate" "${retrans:--}"
|
||||||
|
done
|
||||||
|
printf "%-30s %15s\n" "AGGREGATE (all 4 flows)" "${total_mbps} Mbits/sec"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "===== CONTEXT ====="
|
||||||
|
echo "tsys4: USB cdc_ncm dongle (single 1G link, no bond)"
|
||||||
|
echo "tsys5: bond0 broken (1 active slave, no LACP partner) — cable pending"
|
||||||
|
echo "tsys6/7: working 2x1G LACP, layer3+4 hash (host side)"
|
||||||
|
echo "Cross-rack: 4x1G LACP (pfv-r3-tor-stor-01 → pfv-r5-core-01)"
|
||||||
|
echo ""
|
||||||
|
echo "All logs in: $LOG_DIR/"
|
||||||
Executable
+184
@@ -0,0 +1,184 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
###############################################################################
|
||||||
|
# iperf-storage-tests.sh
|
||||||
|
#
|
||||||
|
# Installs iperf3 on all online hosts, then runs a matrix of storage-network
|
||||||
|
# throughput tests. Saves all output to returned-logs/iperf/.
|
||||||
|
#
|
||||||
|
# Test matrix (all over VLAN1000 storage network, 10.100.100.0/24):
|
||||||
|
# 1. tsys7 → tsys4 (USB cdc_ncm NIC) — the smoking gun
|
||||||
|
# 2. tsys7 → tsys5 (bond0, 1 active slave) — PCI NIC comparison
|
||||||
|
# 3. tsys7 → tsys6 (bond0, 2 active slaves) — working LACP baseline
|
||||||
|
# 4. Reverse: tsys4 → tsys7 (USB NIC TX direction)
|
||||||
|
# 5. Reverse: tsys5 → tsys7
|
||||||
|
#
|
||||||
|
# Each test: TCP 8-stream 30s forward + reverse + UDP saturation.
|
||||||
|
###############################################################################
|
||||||
|
set -uo pipefail
|
||||||
|
|
||||||
|
SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=8 -o ServerAliveInterval=10 -o StrictHostKeyChecking=accept-new)
|
||||||
|
LOG_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/returned-logs/iperf"
|
||||||
|
mkdir -p "$LOG_DIR"
|
||||||
|
|
||||||
|
ALL_HOSTS=(pfv-tsys1 pfv-tsys3 pfv-tsys4 pfv-tsys5 pfv-tsys6 pfv-tsys7)
|
||||||
|
|
||||||
|
# Storage network IPs
|
||||||
|
declare -A SIP
|
||||||
|
SIP[pfv-tsys1]="10.100.100.1"
|
||||||
|
SIP[pfv-tsys3]="10.100.100.3"
|
||||||
|
SIP[pfv-tsys4]="10.100.100.4"
|
||||||
|
SIP[pfv-tsys5]="10.100.100.5"
|
||||||
|
SIP[pfv-tsys6]="10.100.100.6"
|
||||||
|
SIP[pfv-tsys7]="10.100.100.7"
|
||||||
|
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " STEP 1: Install iperf3 on all online hosts"
|
||||||
|
echo "==================================================================="
|
||||||
|
|
||||||
|
for host in "${ALL_HOSTS[@]}"; do
|
||||||
|
echo -n " [$host] "
|
||||||
|
if ! ssh "${SSH_OPTS[@]}" "root@$host" 'echo ok' >/dev/null 2>&1; then
|
||||||
|
echo "UNREACHABLE — skipping"
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
# Check if iperf3 already installed
|
||||||
|
if ssh "${SSH_OPTS[@]}" "root@$host" 'command -v iperf3 >/dev/null 2>&1' 2>/dev/null; then
|
||||||
|
echo "iperf3 already installed"
|
||||||
|
else
|
||||||
|
printf "installing... "
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$host" 'DEBIAN_FRONTEND=noninteractive apt-get update -qq >/dev/null 2>&1 && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq iperf3 >/dev/null 2>&1 && echo OK || echo FAILED'
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " STEP 2: Kill any existing iperf3 processes everywhere"
|
||||||
|
echo "==================================================================="
|
||||||
|
for host in "${ALL_HOSTS[@]}"; do
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$host" 'pkill -x iperf3 2>/dev/null; true' 2>/dev/null
|
||||||
|
done
|
||||||
|
echo " Done."
|
||||||
|
|
||||||
|
# Helper: run an iperf3 test and save output
|
||||||
|
run_iperf() {
|
||||||
|
local client="$1" server="$2" direction="$3" label="$4" logfile="$5"
|
||||||
|
local client_ip="${SIP[$client]}" server_ip="${SIP[$server]}"
|
||||||
|
|
||||||
|
echo -n " [$client → $server] $label ... "
|
||||||
|
|
||||||
|
# Start server in one-shot mode (-1 means serve one client then exit)
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$server" "pkill -x iperf3 2>/dev/null; nohup iperf3 -s -1 -B ${server_ip} >/dev/null 2>&1 &" 2>/dev/null
|
||||||
|
sleep 1
|
||||||
|
|
||||||
|
# Run client
|
||||||
|
{
|
||||||
|
echo "=== iperf3: $label ==="
|
||||||
|
echo "Client: $client ($client_ip)"
|
||||||
|
echo "Server: $server ($server_ip)"
|
||||||
|
echo "Direction: $direction"
|
||||||
|
echo "Date: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
||||||
|
echo ""
|
||||||
|
if [ "$direction" = "forward" ]; then
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$client" \
|
||||||
|
"iperf3 -c ${server_ip} -B ${client_ip} -P 8 -t 30 -l 128k -O 2" 2>&1
|
||||||
|
elif [ "$direction" = "reverse" ]; then
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$client" \
|
||||||
|
"iperf3 -c ${server_ip} -B ${client_ip} -P 8 -t 30 -l 128k -O 2 -R" 2>&1
|
||||||
|
elif [ "$direction" = "udp" ]; then
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$client" \
|
||||||
|
"iperf3 -c ${server_ip} -B ${client_ip} -u -b 2G -t 10 -l 8972" 2>&1
|
||||||
|
elif [ "$direction" = "single" ]; then
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$client" \
|
||||||
|
"iperf3 -c ${server_ip} -B ${client_ip} -t 20 -O 2" 2>&1
|
||||||
|
fi
|
||||||
|
echo ""
|
||||||
|
echo "=== END ==="
|
||||||
|
} > "$logfile" 2>&1
|
||||||
|
|
||||||
|
# Extract summary line
|
||||||
|
if grep -q "sender" "$logfile"; then
|
||||||
|
bitrate=$(grep "sender" "$logfile" | tail -1 | awk '{print $7, $8}')
|
||||||
|
echo "done: ${bitrate}"
|
||||||
|
else
|
||||||
|
echo "done (check log for details)"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " STEP 3: Run iperf3 test matrix"
|
||||||
|
echo "==================================================================="
|
||||||
|
echo ""
|
||||||
|
echo "All tests over VLAN1000 storage network (10.100.100.0/24)."
|
||||||
|
echo "TCP tests: 8 parallel streams, 30s, 128k blocks."
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# --- Test 1: tsys7 → tsys4 (USB cdc_ncm target) ---
|
||||||
|
echo "--- TEST 1: tsys7 → tsys4 (USB cdc_ncm NIC) ---"
|
||||||
|
run_iperf pfv-tsys7 pfv-tsys4 forward "TCP 8-stream forward (tsys7→tsys4 USB)" \
|
||||||
|
"$LOG_DIR/01-tsys7-to-tsys4-tcp-forward.log"
|
||||||
|
run_iperf pfv-tsys7 pfv-tsys4 reverse "TCP 8-stream reverse (tsys4 USB→tsys7)" \
|
||||||
|
"$LOG_DIR/02-tsys7-to-tsys4-tcp-reverse.log"
|
||||||
|
run_iperf pfv-tsys7 pfv-tsys4 single "TCP single-stream forward (tsys7→tsys4 USB)" \
|
||||||
|
"$LOG_DIR/03-tsys7-to-tsys4-tcp-single.log"
|
||||||
|
run_iperf pfv-tsys7 pfv-tsys4 udp "UDP saturation (tsys7→tsys4 USB)" \
|
||||||
|
"$LOG_DIR/04-tsys7-to-tsys4-udp.log"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# --- Test 2: tsys7 → tsys5 (bond0, PCI NIC, 1 active slave) ---
|
||||||
|
echo "--- TEST 2: tsys7 → tsys5 (PCI NIC, broken bond - 1 slave) ---"
|
||||||
|
run_iperf pfv-tsys7 pfv-tsys5 forward "TCP 8-stream forward (tsys7→tsys5 PCI)" \
|
||||||
|
"$LOG_DIR/05-tsys7-to-tsys5-tcp-forward.log"
|
||||||
|
run_iperf pfv-tsys7 pfv-tsys5 reverse "TCP 8-stream reverse (tsys5 PCI→tsys7)" \
|
||||||
|
"$LOG_DIR/06-tsys7-to-tsys5-tcp-reverse.log"
|
||||||
|
run_iperf pfv-tsys7 pfv-tsys5 single "TCP single-stream forward (tsys7→tsys5 PCI)" \
|
||||||
|
"$LOG_DIR/07-tsys7-to-tsys5-tcp-single.log"
|
||||||
|
run_iperf pfv-tsys7 pfv-tsys5 udp "UDP saturation (tsys7→tsys5 PCI)" \
|
||||||
|
"$LOG_DIR/08-tsys7-to-tsys5-udp.log"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# --- Test 3: tsys7 → tsys6 (working 2-slave LACP baseline, layer3+4) ---
|
||||||
|
echo "--- TEST 3: tsys7 → tsys6 (working 2×1G LACP baseline) ---"
|
||||||
|
run_iperf pfv-tsys7 pfv-tsys6 forward "TCP 8-stream forward (tsys7→tsys6 LACP)" \
|
||||||
|
"$LOG_DIR/09-tsys7-to-tsys6-tcp-forward.log"
|
||||||
|
run_iperf pfv-tsys7 pfv-tsys6 reverse "TCP 8-stream reverse (tsys6 LACP→tsys7)" \
|
||||||
|
"$LOG_DIR/10-tsys7-to-tsys6-tcp-reverse.log"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# --- Test 4: tsys6 → tsys4 (pre-tuning baseline) ---
|
||||||
|
echo "--- TEST 4: tsys6 → tsys4 (baseline before tsys6 tuning) ---"
|
||||||
|
run_iperf pfv-tsys6 pfv-tsys4 forward "TCP 8-stream forward (tsys6→tsys4 USB)" \
|
||||||
|
"$LOG_DIR/11-tsys6-to-tsys4-tcp-forward.log"
|
||||||
|
run_iperf pfv-tsys6 pfv-tsys4 reverse "TCP 8-stream reverse (tsys4 USB→tsys6)" \
|
||||||
|
"$LOG_DIR/12-tsys6-to-tsys4-tcp-reverse.log"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# --- Cleanup: kill iperf3 everywhere ---
|
||||||
|
echo "--- Cleanup ---"
|
||||||
|
for host in "${ALL_HOSTS[@]}"; do
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$host" 'pkill -x iperf3 2>/dev/null; true' 2>/dev/null
|
||||||
|
done
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " RESULTS SUMMARY"
|
||||||
|
echo "==================================================================="
|
||||||
|
echo ""
|
||||||
|
printf "%-45s %s\n" "TEST" "THROUGHPUT"
|
||||||
|
printf "%-45s %s\n" "----" "----------"
|
||||||
|
for f in "$LOG_DIR"/*.log; do
|
||||||
|
[ -r "$f" ] || continue
|
||||||
|
label=$(head -1 "$f" | sed 's/^=== iperf3: //; s/ ===$//')
|
||||||
|
bitrate=$(grep -E "sender$" "$f" | tail -1 | awk '{print $7, $8}')
|
||||||
|
[ -z "$bitrate" ] && bitrate=$(grep -E "Mbits/sec|Gbits/sec" "$f" | tail -1 | grep -oE '[0-9.]+ [MG]bits/sec' | head -1)
|
||||||
|
[ -z "$bitrate" ] && bitrate="(see log)"
|
||||||
|
printf "%-45s %s\n" "$label" "$bitrate"
|
||||||
|
done
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "Full logs saved to: $LOG_DIR/"
|
||||||
|
echo "==================================================================="
|
||||||
Executable
+119
@@ -0,0 +1,119 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# iperf-tsys6-tsys7.sh - validate 2Gbps LACP between the two tuned hosts.
|
||||||
|
set -uo pipefail
|
||||||
|
SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=8 -o ServerAliveInterval=10 -o StrictHostKeyChecking=accept-new)
|
||||||
|
LOG_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/returned-logs/iperf"
|
||||||
|
mkdir -p "$LOG_DIR"
|
||||||
|
|
||||||
|
TSYS6="10.100.100.6"
|
||||||
|
TSYS7="10.100.100.7"
|
||||||
|
|
||||||
|
run_test() {
|
||||||
|
local client="$1" server="$2" server_ip="$3" label="$4" logfile="$5"
|
||||||
|
shift 4
|
||||||
|
local extra_args="$*"
|
||||||
|
|
||||||
|
echo -n " [$label] ... "
|
||||||
|
|
||||||
|
# Start server in one-shot mode
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$server" "pkill -x iperf3 2>/dev/null; nohup iperf3 -s -1 -B ${server_ip} >/dev/null 2>&1 &" 2>/dev/null
|
||||||
|
sleep 1
|
||||||
|
|
||||||
|
{
|
||||||
|
echo "=== iperf3: $label ==="
|
||||||
|
echo "Client: $client Server: $server ($server_ip)"
|
||||||
|
echo "Date: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
||||||
|
echo "Args: $extra_args"
|
||||||
|
echo ""
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$client" "iperf3 -c ${server_ip} $extra_args" 2>&1
|
||||||
|
echo ""
|
||||||
|
echo "=== END ==="
|
||||||
|
} > "$logfile" 2>&1
|
||||||
|
|
||||||
|
# Extract result
|
||||||
|
sum=$(grep '\[SUM\].*sender$' "$logfile" | tail -1)
|
||||||
|
if [ -n "$sum" ]; then
|
||||||
|
bitrate=$(echo "$sum" | awk '{print $6, $7}')
|
||||||
|
retrans=$(echo "$sum" | awk '{print $8}')
|
||||||
|
else
|
||||||
|
single=$(grep 'sender$' "$logfile" | tail -1)
|
||||||
|
bitrate=$(echo "$single" | awk '{print $7, $8}')
|
||||||
|
retrans=$(echo "$single" | awk '{print $9}')
|
||||||
|
fi
|
||||||
|
echo "${bitrate} (retrans: ${retrans:-0})"
|
||||||
|
}
|
||||||
|
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " iperf3: tsys6 ↔ tsys7 (both have 2×1G LACP + layer3+4 hash)"
|
||||||
|
echo " Expectation: ~1.8-2.0 Gbps for 8-stream TCP"
|
||||||
|
echo "==================================================================="
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Pre-flight: confirm bond state on both
|
||||||
|
echo "--- bond0 state on tsys6 ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@pfv-tsys6" 'grep -E "Transmit Hash|Number of ports|Bonding Mode" /proc/net/bonding/bond0'
|
||||||
|
echo ""
|
||||||
|
echo "--- bond0 state on tsys7 ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@pfv-tsys7" 'grep -E "Transmit Hash|Number of ports|Bonding Mode" /proc/net/bonding/bond0'
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo "--- Running tests ---"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Test 1: tsys7 → tsys6, 8-stream TCP forward
|
||||||
|
run_test pfv-tsys7 pfv-tsys6 "$TSYS6" \
|
||||||
|
"tsys7→tsys6 TCP 8-stream forward" \
|
||||||
|
"$LOG_DIR/tsys6-tsys7-01-tcp-8stream-forward.log" \
|
||||||
|
"-P 8 -t 30 -l 128k -O 2"
|
||||||
|
|
||||||
|
# Test 2: tsys6 → tsys7, 8-stream TCP forward (reverse direction)
|
||||||
|
run_test pfv-tsys6 pfv-tsys7 "$TSYS7" \
|
||||||
|
"tsys6→tsys7 TCP 8-stream forward" \
|
||||||
|
"$LOG_DIR/tsys6-tsys7-02-tcp-8stream-forward.log" \
|
||||||
|
"-P 8 -t 30 -l 128k -O 2"
|
||||||
|
|
||||||
|
# Test 3: tsys7 → tsys6, single stream (should be ~940 Mbps — single flow)
|
||||||
|
run_test pfv-tsys7 pfv-tsys6 "$TSYS6" \
|
||||||
|
"tsys7→tsys6 TCP single-stream" \
|
||||||
|
"$LOG_DIR/tsys6-tsys7-03-tcp-single.log" \
|
||||||
|
"-t 20 -O 2"
|
||||||
|
|
||||||
|
# Test 4: tsys7 → tsys6, 4-stream (nconnect=4 mirrors this)
|
||||||
|
run_test pfv-tsys7 pfv-tsys6 "$TSYS6" \
|
||||||
|
"tsys7→tsys6 TCP 4-stream" \
|
||||||
|
"$LOG_DIR/tsys6-tsys7-04-tcp-4stream.log" \
|
||||||
|
"-P 4 -t 30 -l 128k -O 2"
|
||||||
|
|
||||||
|
# Test 5: UDP saturation
|
||||||
|
run_test pfv-tsys7 pfv-tsys6 "$TSYS6" \
|
||||||
|
"tsys7→tsys6 UDP saturation" \
|
||||||
|
"$LOG_DIR/tsys6-tsys7-05-udp.log" \
|
||||||
|
"-u -b 3G -t 10 -l 8972"
|
||||||
|
|
||||||
|
# Cleanup
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@pfv-tsys6" 'pkill -x iperf3 2>/dev/null; true' 2>/dev/null
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@pfv-tsys7" 'pkill -x iperf3 2>/dev/null; true' 2>/dev/null
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " SUMMARY"
|
||||||
|
echo "==================================================================="
|
||||||
|
echo ""
|
||||||
|
printf "%-45s %15s %10s\n" "TEST" "THROUGHPUT" "RETRANS"
|
||||||
|
printf "%-45s %15s %10s\n" "----" "----------" "-------"
|
||||||
|
for f in "$LOG_DIR"/tsys6-tsys7-*.log; do
|
||||||
|
[ -r "$f" ] || continue
|
||||||
|
label=$(head -1 "$f" | sed 's/^=== iperf3: //; s/ ===$//')
|
||||||
|
sum=$(grep '\[SUM\].*sender$' "$f" | tail -1)
|
||||||
|
if [ -n "$sum" ]; then
|
||||||
|
bitrate=$(echo "$sum" | awk '{print $6, $7}')
|
||||||
|
retrans=$(echo "$sum" | awk '{print $8}')
|
||||||
|
else
|
||||||
|
single=$(grep 'sender$' "$f" | tail -1)
|
||||||
|
bitrate=$(echo "$single" | awk '{print $7, $8}')
|
||||||
|
retrans=$(echo "$single" | awk '{print $9}')
|
||||||
|
fi
|
||||||
|
printf "%-45s %15s %10s\n" "$label" "$bitrate" "${retrans:--}"
|
||||||
|
done
|
||||||
|
echo ""
|
||||||
|
echo "Expected: 8-stream ~1.8-2.0 Gbps, single-stream ~940 Mbps"
|
||||||
@@ -0,0 +1,3 @@
|
|||||||
|
# Questions — perf (round 1)
|
||||||
|
|
||||||
|
Lane-wide questions live in KNEL/PFVCluster `questions-v10.md` (2026-09-03 repo-split round). Repo-specific rounds start here.
|
||||||
Executable
+88
@@ -0,0 +1,88 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# reboot-and-verify.sh - reboots a host and verifies NFS nconnect activates.
|
||||||
|
# Usage: bash reboot-and-verify.sh <host>
|
||||||
|
set -uo pipefail
|
||||||
|
HOST="$1"
|
||||||
|
SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=5 -o ServerAliveInterval=5 -o StrictHostKeyChecking=accept-new)
|
||||||
|
|
||||||
|
echo "================================================================"
|
||||||
|
echo "[$HOST] PRE-REBOOT STATE"
|
||||||
|
echo "================================================================"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" '
|
||||||
|
echo "--- VMs ---"
|
||||||
|
qm list 2>/dev/null
|
||||||
|
echo "--- NFS TCP conns: $(ss -tn state established "( dport = :2049 )" 2>/dev/null | tail -n +2 | wc -l) ---"
|
||||||
|
echo "--- NFS first mount: ---"
|
||||||
|
nfsstat -m 2>/dev/null | head -2 | tail -1
|
||||||
|
echo "--- uptime ---"
|
||||||
|
uptime
|
||||||
|
'
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "================================================================"
|
||||||
|
echo "[$HOST] ISSUING REBOOT"
|
||||||
|
echo "================================================================"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'nohup sh -c "(sleep 2; systemctl reboot)" >/dev/null 2>&1 &'
|
||||||
|
echo "Reboot sent at $(date +%H:%M:%S)"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "================================================================"
|
||||||
|
echo "[$HOST] WAITING FOR SSH TO RETURN (max 10 min)"
|
||||||
|
echo "================================================================"
|
||||||
|
DEADLINE=$(( $(date +%s) + 600 ))
|
||||||
|
LAST_PRINT=0
|
||||||
|
while [ "$(date +%s)" -lt "$DEADLINE" ]; do
|
||||||
|
now=$(date +%s)
|
||||||
|
if [ $((now - LAST_PRINT)) -ge 15 ]; then
|
||||||
|
printf ' [%s] waiting... (%ss elapsed)\n' "$(date +%H:%M:%S)" "$(( now - DEADLINE + 600 ))"
|
||||||
|
LAST_PRINT=$now
|
||||||
|
fi
|
||||||
|
if ssh "${SSH_OPTS[@]}" "root@$HOST" 'echo ok' >/dev/null 2>&1; then
|
||||||
|
# Verify uptime is actually low (host really rebooted, not still up)
|
||||||
|
up_mins=$(ssh "${SSH_OPTS[@]}" "root@$HOST" 'cat /proc/uptime | awk "{print int(\$1/60)}"')
|
||||||
|
if [ "${up_mins:-999}" -lt 5 ]; then
|
||||||
|
echo " [$(date +%H:%M:%S)] SSH back, uptime ${up_mins}min — real reboot confirmed"
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
sleep 10
|
||||||
|
done
|
||||||
|
|
||||||
|
if ! ssh "${SSH_OPTS[@]}" "root@$HOST" 'echo ok' >/dev/null 2>&1; then
|
||||||
|
echo "FAILED: $HOST not back after 10 minutes"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "Waiting 30s for services to settle..."
|
||||||
|
sleep 30
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "================================================================"
|
||||||
|
echo "[$HOST] POST-REBOOT VERIFICATION"
|
||||||
|
echo "================================================================"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" '
|
||||||
|
echo "--- uptime ---"
|
||||||
|
uptime
|
||||||
|
echo ""
|
||||||
|
echo "--- governor: $(cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor 2>/dev/null) ---"
|
||||||
|
echo "--- swappiness: $(sysctl -n vm.swappiness) ---"
|
||||||
|
echo "--- tcp_cc: $(sysctl -n net.ipv4.tcp_congestion_control) ---"
|
||||||
|
echo "--- tuned: $(tuned-adm active 2>/dev/null | grep Current) ---"
|
||||||
|
echo ""
|
||||||
|
echo "--- NFS first mount: ---"
|
||||||
|
nfsstat -m 2>/dev/null | head -2 | tail -1
|
||||||
|
echo ""
|
||||||
|
echo "--- NFS TCP conns (expect 8 with nconnect=4): ---"
|
||||||
|
ss -tn state established "( dport = :2049 )" 2>/dev/null | tail -n +2 | wc -l
|
||||||
|
echo ""
|
||||||
|
echo "--- VMs: ---"
|
||||||
|
qm list 2>/dev/null
|
||||||
|
echo ""
|
||||||
|
echo "--- Failed services: ---"
|
||||||
|
systemctl --failed --no-legend 2>/dev/null | head -5
|
||||||
|
echo "(empty = none)"
|
||||||
|
'
|
||||||
|
echo ""
|
||||||
|
echo "================================================================"
|
||||||
|
echo "[$HOST] DONE"
|
||||||
|
echo "================================================================"
|
||||||
Executable
+91
@@ -0,0 +1,91 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# reboot-verify.sh - reboots a host, waits for it to come back, verifies state.
|
||||||
|
# Usage: bash reboot-verify.sh <host>
|
||||||
|
set -uo pipefail
|
||||||
|
|
||||||
|
HOST="$1"
|
||||||
|
SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=5 -o ServerAliveInterval=5 -o StrictHostKeyChecking=accept-new)
|
||||||
|
|
||||||
|
echo "================================================================"
|
||||||
|
echo "[$HOST] PRE-REBOOT STATE"
|
||||||
|
echo "================================================================"
|
||||||
|
echo "--- Running VMs ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'qm list 2>/dev/null | awk "NR==1 || \$3==\"running\"{print}"' 2>&1
|
||||||
|
echo "--- NFS mount count ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'nfsstat -m 2>/dev/null | grep -c "^/mnt"' 2>&1
|
||||||
|
echo "--- NFS TCP connections to :2049 ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'ss -tn state established "( dport = :2049 )" 2>/dev/null | tail -n +2 | wc -l' 2>&1
|
||||||
|
echo "--- Uptime ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'uptime' 2>&1
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "================================================================"
|
||||||
|
echo "[$HOST] ISSUING REBOOT"
|
||||||
|
echo "================================================================"
|
||||||
|
# Issue reboot; ssh will disconnect with non-zero — that's expected.
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'nohup sh -c "(sleep 2; systemctl reboot)" >/dev/null 2>&1 &' 2>&1
|
||||||
|
echo "Reboot command sent at $(date +%H:%M:%S). Host will drop now."
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "================================================================"
|
||||||
|
echo "[$HOST] WAITING FOR SSH TO RETURN (max 10 minutes)"
|
||||||
|
echo "================================================================"
|
||||||
|
DEADLINE=$(( $(date +%s) + 600 ))
|
||||||
|
LAST_PRINT=0
|
||||||
|
while [ "$(date +%s)" -lt "$DEADLINE" ]; do
|
||||||
|
now=$(date +%s)
|
||||||
|
# Print a heartbeat every 15s
|
||||||
|
if [ $((now - LAST_PRINT)) -ge 15 ]; then
|
||||||
|
elapsed=$((DEADLINE - now - 600)); elapsed=${elapsed#-}
|
||||||
|
echo " [$(date +%H:%M:%S)] still waiting... (${elapsed}s elapsed)"
|
||||||
|
LAST_PRINT=$now
|
||||||
|
fi
|
||||||
|
# Try SSH
|
||||||
|
if ssh "${SSH_OPTS[@]}" "root@$HOST" 'echo ok' >/dev/null 2>&1; then
|
||||||
|
echo " [$(date +%H:%M:%S)] SSH is back!"
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
sleep 5
|
||||||
|
done
|
||||||
|
|
||||||
|
# Final check
|
||||||
|
if ! ssh "${SSH_OPTS[@]}" "root@$HOST" 'echo ok' >/dev/null 2>&1; then
|
||||||
|
echo " [$(date +%H:%M:%S)] FAILED: host not reachable after 10 minutes"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Give services a moment to settle after SSH returns
|
||||||
|
echo " Waiting 20s for services to settle..."
|
||||||
|
sleep 20
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "================================================================"
|
||||||
|
echo "[$HOST] POST-REBOOT VERIFICATION"
|
||||||
|
echo "================================================================"
|
||||||
|
echo "--- Uptime ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'uptime' 2>&1
|
||||||
|
echo ""
|
||||||
|
echo "--- TCP congestion control ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'sysctl net.ipv4.tcp_congestion_control net.core.default_qdisc' 2>&1
|
||||||
|
echo ""
|
||||||
|
echo "--- vm.swappiness ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'sysctl vm.swappiness' 2>&1
|
||||||
|
echo ""
|
||||||
|
echo "--- scaling_governor ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor 2>/dev/null || echo "(no cpufreq driver)"' 2>&1
|
||||||
|
echo ""
|
||||||
|
echo "--- NFS mount options (looking for nconnect + noatime) ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'nfsstat -m 2>/dev/null | head -20' 2>&1
|
||||||
|
echo ""
|
||||||
|
echo "--- NFS TCP connection count (expect ~8 = 4 per server with nconnect=4) ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'ss -tn state established "( dport = :2049 )" 2>/dev/null | tail -n +2 | wc -l' 2>&1
|
||||||
|
echo ""
|
||||||
|
echo "--- Running VMs ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'qm list 2>/dev/null' 2>&1
|
||||||
|
echo ""
|
||||||
|
echo "--- Failed services? ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'systemctl --failed --no-legend 2>/dev/null | head -10' 2>&1
|
||||||
|
echo ""
|
||||||
|
echo "================================================================"
|
||||||
|
echo "[$HOST] DONE"
|
||||||
|
echo "================================================================"
|
||||||
@@ -0,0 +1,2 @@
|
|||||||
|
guest_from,guest_to,mbps
|
||||||
|
cnode2,cnode1,931
|
||||||
|
@@ -0,0 +1,2 @@
|
|||||||
|
guest_from,guest_to,mbps
|
||||||
|
cnode2,cnode1,933
|
||||||
|
@@ -0,0 +1,10 @@
|
|||||||
|
guest_from,guest_to,mbps
|
||||||
|
cnode2,cnode1,851
|
||||||
|
cnode3,cnode1,919
|
||||||
|
wnode-tsys3,cnode1,938
|
||||||
|
wnode-tsys5,cnode1,938
|
||||||
|
wnode-tsys6,cnode1,854
|
||||||
|
wnode-tsys7,cnode1,842
|
||||||
|
wnode-tsys9,cnode1,938
|
||||||
|
ultix-streaming,cnode1,938
|
||||||
|
ultix-offstage,cnode1,939
|
||||||
|
@@ -0,0 +1,10 @@
|
|||||||
|
guest_from,guest_to,mbps
|
||||||
|
cnode2,cnode1,FAIL
|
||||||
|
cnode3,cnode1,FAIL
|
||||||
|
wnode-tsys3,cnode1,FAIL
|
||||||
|
wnode-tsys5,cnode1,FAIL
|
||||||
|
wnode-tsys6,cnode1,FAIL
|
||||||
|
wnode-tsys7,cnode1,FAIL
|
||||||
|
wnode-tsys9,cnode1,FAIL
|
||||||
|
ultix-streaming,cnode1,FAIL
|
||||||
|
ultix-offstage,cnode1,FAIL
|
||||||
|
@@ -0,0 +1,96 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
###############################################################################
|
||||||
|
# add-datanet-nics.sh
|
||||||
|
#
|
||||||
|
# Adds a second virtio NIC (net1) to all k8s + ultix VMs, bridged to the
|
||||||
|
# storage/datanet network (VLAN 1000). Records the assigned IP in phpIPAM.
|
||||||
|
#
|
||||||
|
# Runs from the workstation — uses tests/remote.sh to reach each hypervisor.
|
||||||
|
# Hot-adds the NIC (no VM downtime). Guest-side IP config must be done
|
||||||
|
# separately (the guest OS needs the IP configured on the new interface).
|
||||||
|
#
|
||||||
|
# Usage:
|
||||||
|
# bash add-datanet-nics.sh # add NICs (hot-add, no reboot)
|
||||||
|
# bash add-datanet-nics.sh --status # show current state only
|
||||||
|
#
|
||||||
|
# IP allocations (phpIPAM VPTechOps, subnet 10.100.100.0/24):
|
||||||
|
# .10 = cnode1 (102/tsys1)
|
||||||
|
# .11 = cnode2 (705/tsys7)
|
||||||
|
# .12 = cnode3 (603/tsys6)
|
||||||
|
# .13 = wnode-tsys3 (313/tsys3)
|
||||||
|
# .14 = wnode-tsys5 (500/tsys5)
|
||||||
|
# .15 = wnode-tsys6 (601/tsys6)
|
||||||
|
# .16 = wnode-tsys7 (701/tsys7)
|
||||||
|
# .17 = wnode-tsys9 (905/tsys9)
|
||||||
|
# .18 = ultix-streaming (5111/tsys5)
|
||||||
|
# .19 = ultix-offstage (5112/tsys5)
|
||||||
|
#
|
||||||
|
# Related: Redmine [#396]
|
||||||
|
###############################################################################
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
# VM definitions: VMID HOST BRIDGE IP HOSTNAME
|
||||||
|
VMS=(
|
||||||
|
"102 tsys1 datanet 10.100.100.10 pfv-k8s-cnode1"
|
||||||
|
"705 tsys7 datanet 10.100.100.11 pfv-k8s-cnode2"
|
||||||
|
"603 tsys6 storagenet 10.100.100.12 pfv-k8s-cnode3"
|
||||||
|
"313 tsys3 datanet 10.100.100.13 pfv-k8s-wnode-tsys3"
|
||||||
|
"500 tsys5 datanet 10.100.100.14 pfv-k8s-wnode-tsys5"
|
||||||
|
"601 tsys6 storagenet 10.100.100.15 pfv-k8s-wnode-tsys6"
|
||||||
|
"701 tsys7 datanet 10.100.100.16 pfv-k8s-wnode-tsys7"
|
||||||
|
"905 tsys9 datanet 10.100.100.17 pfv-k8s-wnode-tsys9"
|
||||||
|
"5111 tsys5 datanet 10.100.100.18 ultix-streaming"
|
||||||
|
"5112 tsys5 datanet 10.100.100.19 ultix-offstage"
|
||||||
|
)
|
||||||
|
|
||||||
|
ACTION="${1:-add}"
|
||||||
|
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " add-datanet-nics — [#396]"
|
||||||
|
echo " mode: ${ACTION}"
|
||||||
|
echo "==================================================================="
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
for entry in "${VMS[@]}"; do
|
||||||
|
read -r vmid host bridge ip hostname <<< "$entry"
|
||||||
|
prox_host="pfv-${host}"
|
||||||
|
|
||||||
|
echo "--- ${hostname} (VM ${vmid} on ${prox_host}) ---"
|
||||||
|
|
||||||
|
if [ "$ACTION" = "--status" ]; then
|
||||||
|
# Show current NIC state
|
||||||
|
PROX_HOST="$prox_host" bash tests/remote.sh prox \
|
||||||
|
"qm config ${vmid} 2>/dev/null | grep -E '^net|^name'" 2>&1
|
||||||
|
echo ""
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Check if net1 already exists
|
||||||
|
existing=$(PROX_HOST="$prox_host" bash tests/remote.sh prox \
|
||||||
|
"qm config ${vmid} 2>/dev/null | grep '^net1'" 2>&1 || true)
|
||||||
|
|
||||||
|
if [ -n "$existing" ]; then
|
||||||
|
echo " net1 already exists: ${existing}"
|
||||||
|
echo " Skipping."
|
||||||
|
echo ""
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Hot-add net1 bridged to the storage network
|
||||||
|
echo " Adding net1 (bridge=${bridge}, IP=${ip})..."
|
||||||
|
if PROX_HOST="$prox_host" bash tests/remote.sh prox \
|
||||||
|
"qm set ${vmid} -net1 virtio,bridge=${bridge}" 2>&1; then
|
||||||
|
echo " NIC added. Verify with: qm config ${vmid} | grep net1"
|
||||||
|
else
|
||||||
|
echo " FAILED — check error above"
|
||||||
|
fi
|
||||||
|
echo ""
|
||||||
|
done
|
||||||
|
|
||||||
|
if [ "$ACTION" != "--status" ]; then
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " NICs added. Guest-side IP config still needed."
|
||||||
|
echo " Each guest needs the IP configured on the new interface."
|
||||||
|
echo " IPs are allocated in phpIPAM (VPTechOps / 10.100.100.0/24)."
|
||||||
|
echo "==================================================================="
|
||||||
|
fi
|
||||||
Executable
+141
@@ -0,0 +1,141 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
###############################################################################
|
||||||
|
# apply-bond-hash.sh
|
||||||
|
#
|
||||||
|
# Adds bond-xmit-hash-policy layer3+4 to bond0 in /etc/network/interfaces,
|
||||||
|
# then reloads networking with ifreload -a.
|
||||||
|
#
|
||||||
|
# SSH survivability: this is safe IF your SSH session is on vmbr0/nic0
|
||||||
|
# (management network), NOT on bond0/datanet (storage network).
|
||||||
|
# tsys7's topology confirms this: SSH comes in on vmbr0 (nic0).
|
||||||
|
#
|
||||||
|
# Safety:
|
||||||
|
# - Dry-run by default (--apply to commit)
|
||||||
|
# - Full backup of /etc/network/interfaces
|
||||||
|
# - Generates rollback script
|
||||||
|
# - Does NOT reboot — uses ifreload -a which is hot-reload
|
||||||
|
###############################################################################
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
HOST="$(hostname -s)"
|
||||||
|
TS_SHORT="$(date +%Y%m%d-%H%M%S)"
|
||||||
|
BACKUP_DIR="/root/perfopt-backup-${TS_SHORT}"
|
||||||
|
ROLLBACK="/root/perfopt-bond-rollback-${TS_SHORT}.sh"
|
||||||
|
ACTION="${1:-dryrun}"
|
||||||
|
|
||||||
|
[ "$ACTION" = "--apply" ] && ACTION="apply" || ACTION="dryrun"
|
||||||
|
|
||||||
|
mkdir -p "$BACKUP_DIR"
|
||||||
|
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " apply-bond-hash — $HOST"
|
||||||
|
echo " mode: $ACTION"
|
||||||
|
echo "==================================================================="
|
||||||
|
|
||||||
|
if [ ! -r /etc/network/interfaces ]; then
|
||||||
|
echo "FATAL: /etc/network/interfaces not readable"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Check if bond0 exists in the config
|
||||||
|
if ! grep -q 'bond0' /etc/network/interfaces; then
|
||||||
|
echo "No bond0 found in /etc/network/interfaces — nothing to do."
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Check if the hash policy is already set
|
||||||
|
if grep -q 'bond-xmit-hash-policy\|xmit_hash_policy' /etc/network/interfaces; then
|
||||||
|
echo "bond-xmit-hash-policy already present:"
|
||||||
|
grep 'bond-xmit-hash-policy\|xmit_hash_policy' /etc/network/interfaces
|
||||||
|
echo "Checking value..."
|
||||||
|
if grep -q 'layer3+4' /etc/network/interfaces; then
|
||||||
|
echo "Already set to layer3+4 — nothing to do."
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Show current bond state
|
||||||
|
echo ""
|
||||||
|
echo "--- Current bond0 state ---"
|
||||||
|
cat /proc/net/bonding/bond0 2>/dev/null | head -15 || echo "(bond0 not up or not present)"
|
||||||
|
|
||||||
|
# Back up
|
||||||
|
cp -a /etc/network/interfaces "$BACKUP_DIR/interfaces"
|
||||||
|
|
||||||
|
# Generate rollback script
|
||||||
|
cat > "$ROLLBACK" <<EOF
|
||||||
|
#!/bin/bash
|
||||||
|
# Rollback for bond-xmit-hash-policy change
|
||||||
|
# Restores original /etc/network/interfaces and reloads
|
||||||
|
set -euo pipefail
|
||||||
|
cp -a "$BACKUP_DIR/interfaces" /etc/network/interfaces
|
||||||
|
echo "Restored /etc/network/interfaces"
|
||||||
|
echo "Reloading networking..."
|
||||||
|
ifreload -a 2>&1 || systemctl restart networking 2>&1 || true
|
||||||
|
echo "Done. bond0 hash policy reverted to original."
|
||||||
|
EOF
|
||||||
|
chmod +x "$ROLLBACK"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "--- Proposed change ---"
|
||||||
|
echo "Add line ' bond-xmit-hash-policy layer3+4' to the bond0 stanza."
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
if [ "$ACTION" != "apply" ]; then
|
||||||
|
echo "DRY RUN — no changes made."
|
||||||
|
echo "To commit: bash $0 --apply"
|
||||||
|
echo "Rollback script (pre-generated): $ROLLBACK"
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Apply: use sed to insert bond-xmit-hash-policy after bond-mode line
|
||||||
|
# The bond0 stanza looks like:
|
||||||
|
# auto bond0
|
||||||
|
# iface bond0 inet manual
|
||||||
|
# bond-slaves nic1 nic2
|
||||||
|
# bond-miimon 100
|
||||||
|
# bond-mode 802.3ad
|
||||||
|
#
|
||||||
|
# We insert after the bond-mode line.
|
||||||
|
echo "Applying..."
|
||||||
|
|
||||||
|
# Check if bond-mode line exists (various formats)
|
||||||
|
if grep -qE '^\s*bond-mode\s+802.3ad' /etc/network/interfaces; then
|
||||||
|
# Insert after bond-mode 802.3ad line
|
||||||
|
sed -i '/^\s*bond-mode\s+802\.3ad/a\\tbond-xmit-hash-policy layer3+4' /etc/network/interfaces
|
||||||
|
echo "Inserted bond-xmit-hash-policy layer3+4 after bond-mode line."
|
||||||
|
elif grep -qE '^\s*bond-mode\s+4' /etc/network/interfaces; then
|
||||||
|
sed -i '/^\s*bond-mode\s+4/a\\tbond-xmit-hash-policy layer3+4' /etc/network/interfaces
|
||||||
|
echo "Inserted bond-xmit-hash-policy layer3+4 after bond-mode 4 line."
|
||||||
|
else
|
||||||
|
echo "Could not find bond-mode line — inserting after bond-slaves line instead."
|
||||||
|
sed -i '/^\s*bond-slaves/a\\tbond-xmit-hash-policy layer3+4' /etc/network/interfaces
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Show the result
|
||||||
|
echo ""
|
||||||
|
echo "--- Updated bond0 stanza ---"
|
||||||
|
awk '/^auto bond0/,/^$/' /etc/network/interfaces
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "--- Reloading networking (ifreload -a) ---"
|
||||||
|
echo "SSH should survive (it's on vmbr0/nic0, not bond0)..."
|
||||||
|
ifreload -a 2>&1 || {
|
||||||
|
echo "ifreload failed, trying systemctl restart networking..."
|
||||||
|
systemctl restart networking 2>&1
|
||||||
|
}
|
||||||
|
|
||||||
|
# Wait a moment for bond to renegotiate
|
||||||
|
echo "Waiting 5s for LACP to renegotiate..."
|
||||||
|
sleep 5
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "--- Post-change bond0 state ---"
|
||||||
|
cat /proc/net/bonding/bond0 2>/dev/null | head -20
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " DONE."
|
||||||
|
echo " Backup: $BACKUP_DIR/interfaces"
|
||||||
|
echo " Rollback: bash $ROLLBACK"
|
||||||
|
echo "==================================================================="
|
||||||
Executable
+439
@@ -0,0 +1,439 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
###############################################################################
|
||||||
|
# apply-tunings.sh
|
||||||
|
#
|
||||||
|
# Applies the Tier 0 host-side tunings identified in FINDINGS.md:
|
||||||
|
# 1. Sets scaling_governor=performance on every CPU
|
||||||
|
# 2. Sets vm.swappiness appropriately (1 on storage hosts, 10 on VM hosts)
|
||||||
|
# 3. Enables tcp_bbr module + sets congestion control
|
||||||
|
# 4. Sets net.core.rmem_max/wmem_max + tcp_rmem/wmem for high-BDP NFS
|
||||||
|
# 5. Sets the recommended tuned-adm profile (network-throughput or virtual-host)
|
||||||
|
# 6. Adds nconnect=4 + noatime to NFS client mounts (edits /etc/pve/storage.cfg)
|
||||||
|
# 7. (does NOT touch bond0 xmit-hash — that requires ifreload/network
|
||||||
|
# restart which drops the host. Provided as a separate --emit-bond-patch
|
||||||
|
# flag that PRINTS the change but does not apply it.)
|
||||||
|
#
|
||||||
|
# Safety features:
|
||||||
|
# - Dry-run mode by default (--apply to commit)
|
||||||
|
# - Full backup of every modified file to /root/perfopt-backup-<timestamp>/
|
||||||
|
# - Per-host behaviour: detects storage hosts by hostname and applies the
|
||||||
|
# right profile (tsys4, tsys5 = storage; others = VM hosts).
|
||||||
|
# - Generates a /root/perfopt-rollback.sh that undoes everything.
|
||||||
|
# - Does NOT reboot, does NOT restart networking, does NOT touch hardware.
|
||||||
|
#
|
||||||
|
# Usage:
|
||||||
|
# bash apply-tunings.sh # dry run, show what would change
|
||||||
|
# bash apply-tunings.sh --apply # commit changes
|
||||||
|
# bash apply-tunings.sh --rollback # restore from latest backup
|
||||||
|
# bash apply-tunings.sh --emit-bond-patch # show bond0 hash change (no apply)
|
||||||
|
###############################################################################
|
||||||
|
set -u
|
||||||
|
umask 022
|
||||||
|
|
||||||
|
HOST="$(hostname -s)"
|
||||||
|
TS="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
||||||
|
TS_SHORT="$(date +%Y%m%d-%H%M%S)"
|
||||||
|
BACKUP_DIR="/root/perfopt-backup-${TS_SHORT}"
|
||||||
|
ROLLBACK_SCRIPT="/root/perfopt-rollback-${TS_SHORT}.sh"
|
||||||
|
ACTION="dryrun"
|
||||||
|
SKIP_NFS=0
|
||||||
|
|
||||||
|
while [ $# -gt 0 ]; do
|
||||||
|
case "$1" in
|
||||||
|
--apply) ACTION="apply" ;;
|
||||||
|
--rollback) ACTION="rollback" ;;
|
||||||
|
--emit-bond-patch) ACTION="bond-patch" ;;
|
||||||
|
--no-nfs) SKIP_NFS=1 ;;
|
||||||
|
-h|--help) sed -n '2,35p' "$0"; exit 0 ;;
|
||||||
|
*) echo "unknown arg: $1" >&2; exit 2 ;;
|
||||||
|
esac
|
||||||
|
shift
|
||||||
|
done
|
||||||
|
|
||||||
|
# Detect host role from hostname
|
||||||
|
case "$HOST" in
|
||||||
|
pfv-tsys4|pfv-tsys5)
|
||||||
|
HOST_ROLE="storage"
|
||||||
|
TUNED_PROFILE="network-throughput"
|
||||||
|
SWAPPINESS="1"
|
||||||
|
;;
|
||||||
|
pfv-tsys1|pfv-tsys3|pfv-tsys6|pfv-tsys7)
|
||||||
|
HOST_ROLE="vmhost"
|
||||||
|
TUNED_PROFILE="virtual-host"
|
||||||
|
SWAPPINESS="10"
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
HOST_ROLE="unknown"
|
||||||
|
TUNED_PROFILE="virtual-host"
|
||||||
|
SWAPPINESS="10"
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
# --- rollback path ---------------------------------------------------------
|
||||||
|
if [ "$ACTION" = "rollback" ]; then
|
||||||
|
echo "Looking for latest backup under /root/perfopt-backup-* ..."
|
||||||
|
latest=""
|
||||||
|
while IFS= read -r d; do
|
||||||
|
latest="$d"
|
||||||
|
done < <(find /root -maxdepth 1 -type d -name 'perfopt-backup-*' 2>/dev/null | sort | tail -n1)
|
||||||
|
if [ -z "$latest" ]; then
|
||||||
|
echo "No backup found under /root/perfopt-backup-*" >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
rb="$latest/perfopt-rollback.sh"
|
||||||
|
if [ ! -x "$rb" ] && [ ! -r "$rb" ]; then
|
||||||
|
echo "Rollback script missing in $latest" >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
echo "Rolling back using: $rb"
|
||||||
|
bash "$rb"
|
||||||
|
exit $?
|
||||||
|
fi
|
||||||
|
|
||||||
|
# --- bond patch print-only path -------------------------------------------
|
||||||
|
if [ "$ACTION" = "bond-patch" ]; then
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " Proposed bond0 xmit_hash_policy change"
|
||||||
|
echo "==================================================================="
|
||||||
|
echo
|
||||||
|
if [ ! -r /etc/network/interfaces ]; then
|
||||||
|
echo "/etc/network/interfaces not readable"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
if ! grep -q 'bond-mode 802.3ad\|bond-mode 4\|bond-slaves' /etc/network/interfaces; then
|
||||||
|
echo "No bond0 detected on this host — nothing to patch."
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
cat <<EOF
|
||||||
|
A manual edit to /etc/network/interfaces is required. The bond0 stanza
|
||||||
|
needs this line added (it defaults to layer2, which is wrong for storage):
|
||||||
|
|
||||||
|
bond-xmit-hash-policy layer3+4
|
||||||
|
|
||||||
|
After editing, you MUST reload networking for it to take effect:
|
||||||
|
ifreload -a # safe, brings interfaces down/up
|
||||||
|
# OR
|
||||||
|
systemctl restart networking # heavier, briefly drops connections
|
||||||
|
|
||||||
|
WARNING: applying this on a remote host over bond0 will briefly drop your
|
||||||
|
SSH session. Run from console/IPMI, or schedule a maintenance window.
|
||||||
|
|
||||||
|
The change is reversible by removing the line and reloading again.
|
||||||
|
EOF
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# --- main path (dryrun or apply) ------------------------------------------
|
||||||
|
mkdir -p "$BACKUP_DIR"
|
||||||
|
|
||||||
|
# Emit the rollback script header
|
||||||
|
cat > "$ROLLBACK_SCRIPT" <<EOF
|
||||||
|
#!/bin/bash
|
||||||
|
# Auto-generated rollback for perfopt apply-tunings.sh
|
||||||
|
# Backup timestamp: $TS
|
||||||
|
# Backup dir: $BACKUP_DIR
|
||||||
|
# Generated on: $HOST
|
||||||
|
set -u
|
||||||
|
EOF
|
||||||
|
chmod +x "$ROLLBACK_SCRIPT"
|
||||||
|
|
||||||
|
backup_file() {
|
||||||
|
local f="$1"
|
||||||
|
if [ -e "$f" ]; then
|
||||||
|
cp -a "$f" "$BACKUP_DIR/$(echo "$f" | sed 's|^/||; s|/|__|g')"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Helper: append a restore command to the rollback script
|
||||||
|
rb_restore() {
|
||||||
|
local f="$1"
|
||||||
|
local bk
|
||||||
|
bk="$BACKUP_DIR/$(echo "$f" | sed 's|^/||; s|/|__|g')"
|
||||||
|
cat >> "$ROLLBACK_SCRIPT" <<EOF
|
||||||
|
if [ -r "$bk" ]; then
|
||||||
|
cp -a "$bk" "$f" && echo "restored $f"
|
||||||
|
else
|
||||||
|
echo "WARN: backup $bk missing — $f left as-is"
|
||||||
|
fi
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
# Helper: append a sysctl restore command
|
||||||
|
rb_sysctl_restore() {
|
||||||
|
local key="$1" orig_val="$2"
|
||||||
|
cat >> "$ROLLBACK_SCRIPT" <<EOF
|
||||||
|
sysctl -w "$key=$orig_val" >/dev/null && echo "restored $key=$orig_val"
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
# Helper: append a tuned-adm restore
|
||||||
|
rb_tuned_restore() {
|
||||||
|
local profile="$1"
|
||||||
|
cat >> "$ROLLBACK_SCRIPT" <<EOF
|
||||||
|
tuned-adm profile "$profile" 2>/dev/null && echo "restored tuned profile: $profile"
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " perfopt apply-tunings — $HOST"
|
||||||
|
echo " mode: $ACTION"
|
||||||
|
echo " role: $HOST_ROLE (tuned=$TUNED_PROFILE, swappiness=$SWAPPINESS)"
|
||||||
|
echo " backup: $BACKUP_DIR"
|
||||||
|
echo " rollback: $ROLLBACK_SCRIPT"
|
||||||
|
echo "==================================================================="
|
||||||
|
echo
|
||||||
|
|
||||||
|
# ===========================================================================
|
||||||
|
# 1. scaling_governor → performance
|
||||||
|
# ===========================================================================
|
||||||
|
echo "--- 1. CPU scaling_governor → performance"
|
||||||
|
if [ -r /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor ]; then
|
||||||
|
cur=$(cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor)
|
||||||
|
echo " current: $cur"
|
||||||
|
if [ "$ACTION" = "apply" ]; then
|
||||||
|
if [ "$cur" != "performance" ]; then
|
||||||
|
for c in /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor; do
|
||||||
|
echo performance > "$c" 2>/dev/null || true
|
||||||
|
done
|
||||||
|
# Persist via systemd tmpfiles / sysctl fallback
|
||||||
|
cat > /etc/systemd/system/perfopt-cpu-performance.service <<EOF
|
||||||
|
[Unit]
|
||||||
|
Description=Set CPU scaling_governor=performance (perfopt)
|
||||||
|
After=multi-user.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=oneshot
|
||||||
|
ExecStart=/bin/sh -c 'for c in /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor; do echo performance > "\$c" 2>/dev/null || true; done'
|
||||||
|
RemainAfterExit=yes
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
EOF
|
||||||
|
systemctl daemon-reload
|
||||||
|
systemctl enable perfopt-cpu-performance.service 2>/dev/null
|
||||||
|
systemctl start perfopt-cpu-performance.service 2>/dev/null
|
||||||
|
echo " applied + persisted via systemd unit"
|
||||||
|
# Rollback
|
||||||
|
cat >> "$ROLLBACK_SCRIPT" <<EOF
|
||||||
|
for c in /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor; do echo "$cur" > "\$c" 2>/dev/null || true; done
|
||||||
|
systemctl disable --now perfopt-cpu-performance.service 2>/dev/null || true
|
||||||
|
rm -f /etc/systemd/system/perfopt-cpu-performance.service
|
||||||
|
systemctl daemon-reload
|
||||||
|
echo "restored scaling_governor=$cur (best-effort; original may have been dynamic)"
|
||||||
|
EOF
|
||||||
|
else
|
||||||
|
echo " already performance — no change"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
echo " cpufreq driver not loaded — nothing to do (typical on BIOS-locked servers)"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ===========================================================================
|
||||||
|
# 2. vm.swappiness
|
||||||
|
# ===========================================================================
|
||||||
|
echo "--- 2. vm.swappiness → $SWAPPINESS (role=$HOST_ROLE)"
|
||||||
|
cur_swappiness=$(sysctl -n vm.swappiness 2>/dev/null || echo "?")
|
||||||
|
echo " current: $cur_swappiness"
|
||||||
|
if [ "$ACTION" = "apply" ] && [ "$cur_swappiness" != "$SWAPPINESS" ]; then
|
||||||
|
# Persist via sysctl.d
|
||||||
|
backup_file /etc/sysctl.d/99-perfopt.conf
|
||||||
|
cat > /etc/sysctl.d/99-perfopt.conf <<EOF
|
||||||
|
# perfopt apply-tunings.sh — $TS — host=$HOST role=$HOST_ROLE
|
||||||
|
vm.swappiness = $SWAPPINESS
|
||||||
|
EOF
|
||||||
|
sysctl -w "vm.swappiness=$SWAPPINESS" >/dev/null
|
||||||
|
echo " applied (persisted to /etc/sysctl.d/99-perfopt.conf)"
|
||||||
|
rb_restore /etc/sysctl.d/99-perfopt.conf
|
||||||
|
cat >> "$ROLLBACK_SCRIPT" <<EOF
|
||||||
|
rm -f /etc/sysctl.d/99-perfopt.conf
|
||||||
|
sysctl -w "vm.swappiness=$cur_swappiness" >/dev/null
|
||||||
|
echo "restored vm.swappiness=$cur_swappiness"
|
||||||
|
EOF
|
||||||
|
else
|
||||||
|
echo " no change"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ===========================================================================
|
||||||
|
# 3. TCP BBR + buffers (single sysctl.d file)
|
||||||
|
# ===========================================================================
|
||||||
|
echo "--- 3. TCP BBR + socket buffers"
|
||||||
|
cur_cc=$(sysctl -n net.ipv4.tcp_congestion_control 2>/dev/null || echo "?")
|
||||||
|
cur_avail=$(sysctl -n net.ipv4.tcp_available_congestion_control 2>/dev/null || echo "?")
|
||||||
|
echo " current: $cur_cc (available: $cur_avail)"
|
||||||
|
|
||||||
|
# Decide sysctl values (these are the consensus values for a 1-10 GbE NFS host)
|
||||||
|
TARGET_RMEM_MAX=134217728 # 128 MB
|
||||||
|
TARGET_WMEM_MAX=134217728
|
||||||
|
TARGET_RMEM_DEFAULT=26214400 # 25 MB
|
||||||
|
TARGET_WMEM_DEFAULT=26214400
|
||||||
|
TARGET_TCP_RMEM="4096 87380 $TARGET_RMEM_MAX"
|
||||||
|
TARGET_TCP_WMEM="4096 65536 $TARGET_RMEM_MAX"
|
||||||
|
TARGET_NETDEV_MAX_BACKLOG=250000
|
||||||
|
TARGET_SOMAXCONN=65535
|
||||||
|
|
||||||
|
if [ "$ACTION" = "apply" ]; then
|
||||||
|
# Ensure tcp_bbr module loads at boot
|
||||||
|
if ! grep -q '^tcp_bbr' /etc/modules-load.d/modules.conf 2>/dev/null; then
|
||||||
|
backup_file /etc/modules-load.d/modules.conf
|
||||||
|
mkdir -p /etc/modules-load.d
|
||||||
|
cat >> /etc/modules-load.d/modules.conf <<EOF
|
||||||
|
# perfopt apply-tunings.sh — $TS
|
||||||
|
tcp_bbr
|
||||||
|
EOF
|
||||||
|
modprobe tcp_bbr 2>/dev/null || true
|
||||||
|
rb_restore /etc/modules-load.d/modules.conf
|
||||||
|
fi
|
||||||
|
|
||||||
|
backup_file /etc/sysctl.d/99-perfopt.conf
|
||||||
|
cat > /etc/sysctl.d/99-perfopt.conf <<EOF
|
||||||
|
# perfopt apply-tunings.sh — $TS — host=$HOST role=$HOST_ROLE
|
||||||
|
vm.swappiness = $SWAPPINESS
|
||||||
|
|
||||||
|
# TCP BBR + high-BDP buffers (good for NFS over 1-10 GbE)
|
||||||
|
net.ipv4.tcp_congestion_control = bbr
|
||||||
|
net.core.default_qdisc = fq
|
||||||
|
net.core.rmem_max = $TARGET_RMEM_MAX
|
||||||
|
net.core.wmem_max = $TARGET_WMEM_MAX
|
||||||
|
net.core.rmem_default = $TARGET_RMEM_DEFAULT
|
||||||
|
net.core.wmem_default = $TARGET_WMEM_DEFAULT
|
||||||
|
net.core.netdev_max_backlog = $TARGET_NETDEV_MAX_BACKLOG
|
||||||
|
net.core.somaxconn = $TARGET_SOMAXCONN
|
||||||
|
net.ipv4.tcp_rmem = $TARGET_TCP_RMEM
|
||||||
|
net.ipv4.tcp_wmem = $TARGET_TCP_WMEM
|
||||||
|
EOF
|
||||||
|
sysctl --system >/dev/null 2>&1
|
||||||
|
echo " applied (written to /etc/sysctl.d/99-perfopt.conf + sysctl --system)"
|
||||||
|
# Rebuild rollback for sysctl
|
||||||
|
cat >> "$ROLLBACK_SCRIPT" <<EOF
|
||||||
|
# Restore original sysctl state
|
||||||
|
rm -f /etc/sysctl.d/99-perfopt.conf
|
||||||
|
EOF
|
||||||
|
rb_sysctl_restore "net.ipv4.tcp_congestion_control" "$cur_cc"
|
||||||
|
rb_sysctl_restore "vm.swappiness" "$cur_swappiness"
|
||||||
|
# Note: original buffer sizes not all captured; restoration is best-effort.
|
||||||
|
cat >> "$ROLLBACK_SCRIPT" <<EOF
|
||||||
|
echo "Note: net buffers restored to kernel defaults (original values not captured)."
|
||||||
|
echo "Run 'sysctl --system' to apply."
|
||||||
|
sysctl --system >/dev/null 2>&1 || true
|
||||||
|
EOF
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ===========================================================================
|
||||||
|
# 4. tuned-adm profile
|
||||||
|
# ===========================================================================
|
||||||
|
echo "--- 4. tuned-adm profile → $TUNED_PROFILE"
|
||||||
|
if command -v tuned-adm >/dev/null 2>&1; then
|
||||||
|
cur_profile=$(tuned-adm active 2>/dev/null | awk -F: '/Current active profile/{gsub(/^[ \t]+/,"",$2); print $2}')
|
||||||
|
echo " current: $cur_profile"
|
||||||
|
if [ "$ACTION" = "apply" ] && [ "$cur_profile" != "$TUNED_PROFILE" ]; then
|
||||||
|
tuned-adm profile "$TUNED_PROFILE" 2>&1 | sed 's/^/ /'
|
||||||
|
rb_tuned_restore "$cur_profile"
|
||||||
|
else
|
||||||
|
echo " no change"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
echo " tuned-adm not installed — skipping"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ===========================================================================
|
||||||
|
# 5. NFS mount option hardening
|
||||||
|
# Edit /etc/pve/storage.cfg to add nconnect=4 + noatime to NFS plugins.
|
||||||
|
# Proxmox applies these on next mount/remount.
|
||||||
|
# Skipped with --no-nfs (for NFS servers where we don't want to remount).
|
||||||
|
# ===========================================================================
|
||||||
|
echo "--- 5. NFS mount options: add nconnect=4, noatime"
|
||||||
|
if [ "$SKIP_NFS" -eq 1 ]; then
|
||||||
|
echo " SKIPPED (--no-nfs specified)"
|
||||||
|
echo " Note: storage.cfg is cluster-wide; if edited on another host,"
|
||||||
|
echo " the options are already staged here and activate on next reboot."
|
||||||
|
else
|
||||||
|
if [ -r /etc/pve/storage.cfg ]; then
|
||||||
|
backup_file /etc/pve/storage.cfg
|
||||||
|
if grep -q '^nfs:' /etc/pve/storage.cfg; then
|
||||||
|
# Count how many nfs: stanzas lack the options
|
||||||
|
while IFS= read -r line; do
|
||||||
|
if echo "$line" | grep -q '^nfs:'; then
|
||||||
|
cur_stanza=$(echo "$line" | awk '{print $2}')
|
||||||
|
# Look ahead for the next few lines to see if options already set
|
||||||
|
echo " nfs stanza: $cur_stanza"
|
||||||
|
fi
|
||||||
|
done < /etc/pve/storage.cfg
|
||||||
|
|
||||||
|
# Check whether any nfs stanza already has options
|
||||||
|
if grep -A1 '^nfs:' /etc/pve/storage.cfg | grep -q 'options.*nconnect=4'; then
|
||||||
|
echo " some stanzas already have nconnect=4 — check manually"
|
||||||
|
else
|
||||||
|
echo " proposed change: add 'options nconnect=4,noatime,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2' to each nfs stanza"
|
||||||
|
if [ "$ACTION" = "apply" ]; then
|
||||||
|
# Apply via perl for safety (in-place edit with backup)
|
||||||
|
if cp -a /etc/pve/storage.cfg "$BACKUP_DIR/etc__pve__storage.cfg"; then
|
||||||
|
# Use a python helper for robust PVE storage.cfg editing
|
||||||
|
python3 - <<PYEOF
|
||||||
|
import re, pathlib
|
||||||
|
p = pathlib.Path("/etc/pve/storage.cfg")
|
||||||
|
text = p.read_text()
|
||||||
|
pattern = re.compile(r'(^nfs:\s*\S+\n(?:[ \t]+[^\n]+\n)+)', re.MULTILINE)
|
||||||
|
modified = 0
|
||||||
|
def fix(m):
|
||||||
|
global modified
|
||||||
|
block = m.group(1)
|
||||||
|
if 'options' in block:
|
||||||
|
return block
|
||||||
|
lines = block.rstrip('\n').split('\n')
|
||||||
|
lines.insert(1, '\toptions nconnect=4,noatime,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2')
|
||||||
|
modified += 1
|
||||||
|
return '\n'.join(lines) + '\n'
|
||||||
|
new_text = pattern.sub(fix, text)
|
||||||
|
if modified:
|
||||||
|
p.write_text(new_text)
|
||||||
|
print(f" patched {modified} NFS stanzas with options line")
|
||||||
|
else:
|
||||||
|
print(" no NFS stanza needed patching (all already had options or no nfs: found)")
|
||||||
|
PYEOF
|
||||||
|
# Remount existing NFS mounts to pick up new options
|
||||||
|
echo " remounting NFS mounts to apply new options..."
|
||||||
|
while IFS= read -r mp; do
|
||||||
|
mount -o remount "$mp" 2>/dev/null && echo " remounted $mp" || echo " FAILED to remount $mp (will pick up on next mount)"
|
||||||
|
done < <(awk '$3 ~ /^nfs/{print $2}' /proc/mounts 2>/dev/null | sort -u)
|
||||||
|
rb_restore /etc/pve/storage.cfg
|
||||||
|
cat >> "$ROLLBACK_SCRIPT" <<EOF
|
||||||
|
# To fully undo NFS options, also remount:
|
||||||
|
while IFS= read -r mp; do
|
||||||
|
mount -o remount "\$mp" 2>/dev/null
|
||||||
|
done < <(awk '\$3 ~ /^nfs/{print \$2}' /proc/mounts 2>/dev/null | sort -u)
|
||||||
|
echo "restored NFS mount options"
|
||||||
|
EOF
|
||||||
|
else
|
||||||
|
echo " ERROR: could not back up storage.cfg — aborting NFS patch"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
echo " no NFS stanzas in storage.cfg — skipping"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
echo " /etc/pve/storage.cfg not readable — skipping"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ===========================================================================
|
||||||
|
# 6. Summary
|
||||||
|
# ===========================================================================
|
||||||
|
echo
|
||||||
|
echo "==================================================================="
|
||||||
|
if [ "$ACTION" = "apply" ]; then
|
||||||
|
echo " DONE. Backups in: $BACKUP_DIR"
|
||||||
|
echo " Rollback: bash $ROLLBACK_SCRIPT"
|
||||||
|
echo
|
||||||
|
echo " Next steps:"
|
||||||
|
echo " - Verify with 'sysctl net.ipv4.tcp_congestion_control vm.swappiness'"
|
||||||
|
echo " - Verify NFS mounts with 'nfsstat -m' (look for nconnect=4)"
|
||||||
|
echo " - Run 'bash apply-tunings.sh --emit-bond-patch' for the bond0"
|
||||||
|
echo " xmit_hash_policy change (requires network restart, do in"
|
||||||
|
echo " maintenance window)"
|
||||||
|
else
|
||||||
|
echo " DRY RUN — no changes made."
|
||||||
|
echo " To commit: bash apply-tunings.sh --apply"
|
||||||
|
fi
|
||||||
|
echo "==================================================================="
|
||||||
@@ -0,0 +1,42 @@
|
|||||||
|
#!/usr/bin/bash
|
||||||
|
# Audit VM disk cache from inside guests — confirm writeback visible + I/O perf
|
||||||
|
set -uo pipefail
|
||||||
|
source "$(cd "$(dirname "$0")/../../.." && pwd)/k8s/env.sh"
|
||||||
|
|
||||||
|
echo "=== CNODES (via Tailscale) ==="
|
||||||
|
for ip in "${ALL_CNODES[@]}"; do
|
||||||
|
echo "--- $ip ---"
|
||||||
|
# shellcheck disable=SC2016 # heredoc-style remote command uses $() on the remote side
|
||||||
|
cn "$ip" '
|
||||||
|
echo " write_cache: $(cat /sys/block/sda/queue/write_cache 2>/dev/null)"
|
||||||
|
echo " scheduler: $(cat /sys/block/sda/queue/scheduler 2>/dev/null)"
|
||||||
|
echo " fsync (5x 1KB):"
|
||||||
|
for i in 1 2 3 4 5; do
|
||||||
|
t0=$(date +%s%N)
|
||||||
|
dd if=/dev/zero of=/tmp/.ft bs=1k count=1 conv=fsync 2>/dev/null
|
||||||
|
t1=$(date +%s%N)
|
||||||
|
echo -n " $(( (t1-t0)/1000000 )) ms"
|
||||||
|
done
|
||||||
|
echo
|
||||||
|
rm -f /tmp/.ft
|
||||||
|
' 2>&1 || echo " UNREACHABLE"
|
||||||
|
done
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "=== DNS INFRA VMs ==="
|
||||||
|
for host in netinfra01 netinfra02; do
|
||||||
|
echo "--- $host ---"
|
||||||
|
# shellcheck disable=SC2016 # heredoc-style remote command uses $() on the remote side
|
||||||
|
netinfra/dns-cluster-setup/remote-dns.sh "$host-root" '
|
||||||
|
echo " write_cache: $(cat /sys/block/sda/queue/write_cache 2>/dev/null)"
|
||||||
|
echo " fsync (3x 1KB):"
|
||||||
|
for i in 1 2 3; do
|
||||||
|
t0=$(date +%s%N)
|
||||||
|
dd if=/dev/zero of=/tmp/.ft bs=1k count=1 conv=fsync 2>/dev/null
|
||||||
|
t1=$(date +%s%N)
|
||||||
|
echo -n " $(( (t1-t0)/1000000 )) ms"
|
||||||
|
done
|
||||||
|
echo
|
||||||
|
rm -f /tmp/.ft
|
||||||
|
' 2>&1 || echo " UNREACHABLE"
|
||||||
|
done
|
||||||
Executable
+14
@@ -0,0 +1,14 @@
|
|||||||
|
#!/usr/bin/bash
|
||||||
|
# Audit all VM disk configs on a Proxmox host
|
||||||
|
set -uo pipefail
|
||||||
|
HOST="$1"
|
||||||
|
PROX_HOST="$HOST" bash tests/remote.sh prox '
|
||||||
|
qm list 2>/dev/null | tail -n +2 | while read -r line; do
|
||||||
|
vmid=$(echo "$line" | awk "{print \$1}")
|
||||||
|
name=$(echo "$line" | awk "{print \$2}")
|
||||||
|
status=$(echo "$line" | awk "{print \$3}")
|
||||||
|
echo "VMID=$vmid NAME=$name STATUS=$status"
|
||||||
|
qm config "$vmid" 2>/dev/null | grep -E "^(scsi|virtio|ide)[0-9]+:" | sed "s/^/ /"
|
||||||
|
echo ""
|
||||||
|
done
|
||||||
|
'
|
||||||
@@ -0,0 +1,55 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# blacklist-zfs.sh — ZFS is unused on the tsys Proxmox hosts (zero pools):
|
||||||
|
# keep the module and its service family out of RAM and out of boot. [#737]
|
||||||
|
# Run ON a Proxmox host: tests/remote.sh prox-file proxmox/perf/scripts/blacklist-zfs.sh
|
||||||
|
# Reversible: rm /etc/modprobe.d/blacklist-zfs.conf && systemctl enable zfs.target zfs-zed ...
|
||||||
|
set -u
|
||||||
|
|
||||||
|
log() { echo "[zfs-blacklist] $*"; }
|
||||||
|
|
||||||
|
# Guard: never touch a host whose root filesystem is ZFS.
|
||||||
|
root_fs=$(findmnt -n -o FSTYPE / 2>/dev/null)
|
||||||
|
case "$root_fs" in
|
||||||
|
*zfs*) log "ABORT: root fs is '$root_fs' — this host needs ZFS at boot"; exit 1 ;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
conf=/etc/modprobe.d/blacklist-zfs.conf
|
||||||
|
if [ ! -f "$conf" ]; then
|
||||||
|
{
|
||||||
|
echo "# ZFS unused on this host (no pools) — keep module out of RAM and boot [#737]"
|
||||||
|
echo "blacklist zfs"
|
||||||
|
} > "$conf"
|
||||||
|
log "wrote $conf"
|
||||||
|
else
|
||||||
|
log "blacklist already present"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Stop + disable the zfs service family (zed holds the module open; the
|
||||||
|
# import/mount/share units would fail or reload the module every boot).
|
||||||
|
systemctl disable --now \
|
||||||
|
zfs-zed.service zfs-import-cache.service zfs-import-scan.service \
|
||||||
|
zfs-import.target zfs-mount.service zfs-share.service \
|
||||||
|
zfs-volume-wait.service zfs-volumes.target zfs.target >/dev/null 2>&1
|
||||||
|
log "zfs service family disabled"
|
||||||
|
|
||||||
|
if lsmod | grep -q '^zfs'; then
|
||||||
|
if modprobe -r zfs 2>/dev/null; then
|
||||||
|
log "module unloaded (ARC reclaimed)"
|
||||||
|
else
|
||||||
|
log "WARNING: module still in use — will stay away after next reboot anyway"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
log "module not loaded"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Bake the blacklist into the initramfs so early boot cannot load it either.
|
||||||
|
if command -v update-initramfs >/dev/null 2>&1; then
|
||||||
|
if update-initramfs -u -k all >/dev/null 2>&1; then
|
||||||
|
log "initramfs updated"
|
||||||
|
else
|
||||||
|
log "WARNING: update-initramfs failed — blacklist applies from main boot only"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
state=$(systemctl is-enabled zfs-zed 2>/dev/null)
|
||||||
|
log "done: root_fs=${root_fs:-?} zfs_zed=${state:-n/a} module=$(lsmod | grep -c '^zfs')"
|
||||||
Executable
+274
@@ -0,0 +1,274 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
# check-rules.sh — project rule audit engine.
|
||||||
|
#
|
||||||
|
# Usage:
|
||||||
|
# bash scripts/check-rules.sh # full audit (verbose, includes slow checks)
|
||||||
|
# bash scripts/check-rules.sh --fast # fast audit (quiet, skips slow checks) — for pre-commit
|
||||||
|
# bash scripts/check-rules.sh --quiet # full audit, only prints failures
|
||||||
|
#
|
||||||
|
# Exit code: 0 = all rules pass (warnings are non-fatal), 1 = one or more FAILED.
|
||||||
|
#
|
||||||
|
# This is a generalized version of the rules engine proven in the
|
||||||
|
# RCEO-PersonalAssistant project. Add project-specific checks by appending
|
||||||
|
# `check "<desc>" "<pass|warn|fail>"` calls below.
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
HERE="$(cd "$(dirname "$0")" && pwd)"
|
||||||
|
# shellcheck disable=SC1091
|
||||||
|
source "$HERE/lib/common.sh"
|
||||||
|
REPO_ROOT="$(repo_root)"
|
||||||
|
cd "$REPO_ROOT"
|
||||||
|
|
||||||
|
# --- argument parsing ---
|
||||||
|
RULE_FAST=false
|
||||||
|
RULE_VERBOSE=true
|
||||||
|
for arg in "$@"; do
|
||||||
|
case "$arg" in
|
||||||
|
--fast) RULE_FAST=true; RULE_VERBOSE=false ;;
|
||||||
|
--quiet) RULE_VERBOSE=false ;;
|
||||||
|
*) die "check-rules.sh: unknown argument '$arg'" ;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
export RULE_FAST RULE_VERBOSE
|
||||||
|
|
||||||
|
init_counters
|
||||||
|
$RULE_VERBOSE && echo "=== Project Rule Audit ==="
|
||||||
|
|
||||||
|
TODAY="$(date +%Y-%m-%d)"
|
||||||
|
|
||||||
|
# ----------------------------------------------------------------------------
|
||||||
|
# 1. Shellcheck — every .sh/.bash must pass (zero warnings, incl. info-level).
|
||||||
|
# Runs in Docker so the host stays clean (no native shellcheck required).
|
||||||
|
# ----------------------------------------------------------------------------
|
||||||
|
$RULE_VERBOSE && log_step "Shell scripts (shellcheck)"
|
||||||
|
mapfile -d '' SH_FILES < <(find . -path ./.git -prune -o -path ./.tmp -prune -o -path ./.crush -prune -o -path ./vendor -prune -o -path ./oam/librenms-agent/agent -prune -o -path ./archive -prune -o -path ./node_modules -prune -o \( -name '*.sh' -o -name '*.bash' \) -print0 2>/dev/null)
|
||||||
|
if [ "${#SH_FILES[@]}" -gt 0 ]; then
|
||||||
|
if have shellcheck; then
|
||||||
|
if shellcheck "${SH_FILES[@]}" >/dev/null 2>&1; then
|
||||||
|
check "All shell scripts pass shellcheck (host)" "pass"
|
||||||
|
else
|
||||||
|
check "shellcheck reports violations — run: shellcheck <file>" "fail"
|
||||||
|
fi
|
||||||
|
elif have docker; then
|
||||||
|
MNT_FILES=()
|
||||||
|
for f in "${SH_FILES[@]}"; do MNT_FILES+=("/mnt/${f#./}"); done
|
||||||
|
if docker run --rm -v "$REPO_ROOT:/mnt" koalaman/shellcheck:stable "${MNT_FILES[@]}" >/dev/null 2>&1; then
|
||||||
|
check "All shell scripts pass shellcheck (docker)" "pass"
|
||||||
|
else
|
||||||
|
check "shellcheck (docker) reports violations" "fail"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
check "No shellcheck or docker available to lint scripts" "warn"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
check "No shell scripts to lint" "pass"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ----------------------------------------------------------------------------
|
||||||
|
# 2. Docker image pinning — no ':latest' tags in compose or Dockerfiles.
|
||||||
|
# ----------------------------------------------------------------------------
|
||||||
|
$RULE_VERBOSE && log_step "Docker image pinning"
|
||||||
|
if grep -rqE '(image:|FROM).*:latest' --include='docker-compose*.y*ml' --include='Dockerfile*' . 2>/dev/null; then
|
||||||
|
check "No ':latest' image tags (pin everything)" "fail"
|
||||||
|
else
|
||||||
|
check "No ':latest' image tags" "pass"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ----------------------------------------------------------------------------
|
||||||
|
# 2b. Container naming — every service in a docker-compose file MUST set an
|
||||||
|
# explicit container_name (never rely on Docker's default <dir>_<n>).
|
||||||
|
# ----------------------------------------------------------------------------
|
||||||
|
$RULE_VERBOSE && log_step "Container naming"
|
||||||
|
COMPOSE_FILES="$(find . -path ./.git -prune -o \( -name 'docker-compose*.yml' -o -name 'docker-compose*.yaml' -o -name 'compose.yml' -o -name 'compose.yaml' \) -print 2>/dev/null || true)"
|
||||||
|
if [ -n "$COMPOSE_FILES" ]; then
|
||||||
|
BAD=0
|
||||||
|
while IFS= read -r cf; do
|
||||||
|
[ -n "$cf" ] || continue
|
||||||
|
# Count top-level service keys (2-space indent under services:) and
|
||||||
|
# compare against the number of container_name: declarations.
|
||||||
|
svc_count=$(awk '/^services:/{f=1;next} f&&/^[^[:space:]]/{f=0} f&&/^[[:space:]]{2}[[:alnum:]_-]+:[[:space:]]*$/{c++} END{print c+0}' "$cf")
|
||||||
|
cn_count=$(grep -cE '^[[:space:]]*container_name:' "$cf" 2>/dev/null || echo 0)
|
||||||
|
if [ "${svc_count:-0}" -gt 0 ] && [ "$cn_count" -lt "$svc_count" ]; then
|
||||||
|
BAD=$((BAD + 1))
|
||||||
|
fi
|
||||||
|
done <<EOF
|
||||||
|
$COMPOSE_FILES
|
||||||
|
EOF
|
||||||
|
if [ "$BAD" -eq 0 ]; then
|
||||||
|
check "All compose services set container_name" "pass"
|
||||||
|
else
|
||||||
|
check "$BAD compose file(s) with services missing container_name" "fail"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
check "No compose files (container-name check skipped)" "pass"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ----------------------------------------------------------------------------
|
||||||
|
# 3. Required-files manifest — the files every project using this template owns.
|
||||||
|
# ----------------------------------------------------------------------------
|
||||||
|
$RULE_VERBOSE && log_step "Required files"
|
||||||
|
REQUIRED_FILES="AGENTS.md STATUS.md .env.example scripts/check-rules.sh scripts/setup-hooks.sh"
|
||||||
|
REQUIRED_FILES="$REQUIRED_FILES ${PROJECT_REQUIRED_FILES:-}"
|
||||||
|
for f in $REQUIRED_FILES; do
|
||||||
|
if [ -f "$f" ]; then check "$f exists" "pass"; else check "$f MISSING" "fail"; fi
|
||||||
|
done
|
||||||
|
if compgen -G 'questions-v*.md' > /dev/null; then
|
||||||
|
latest_q="$(find . -maxdepth 1 -name 'questions-v*.md' -printf '%f\n' | sort -V | tail -1)"
|
||||||
|
check "questions-v*.md exists ($latest_q)" "pass"
|
||||||
|
else
|
||||||
|
check "questions-v*.md MISSING" "fail"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ----------------------------------------------------------------------------
|
||||||
|
# 4. Doc freshness — STATUS.md touched today.
|
||||||
|
# Warning (not failure): staleness is a signal, not a break.
|
||||||
|
# Redmine is the system of record for work; Discourse for docs. STATUS.md is
|
||||||
|
# a scratchpad only — see BASELINE-PROMPT.md §3, §8.
|
||||||
|
# ----------------------------------------------------------------------------
|
||||||
|
$RULE_VERBOSE && log_step "Doc freshness"
|
||||||
|
if [ -f STATUS.md ]; then
|
||||||
|
STATUS_DATE="$(grep -oE 'Last updated: [0-9]{4}-[0-9]{2}-[0-9]{2}' STATUS.md | grep -oE '[0-9]{4}-[0-9]{2}-[0-9]{2}' || echo unknown)"
|
||||||
|
if [ "$STATUS_DATE" = "$TODAY" ]; then
|
||||||
|
check "STATUS.md updated today ($STATUS_DATE)" "pass"
|
||||||
|
else
|
||||||
|
check "STATUS.md is stale (last: $STATUS_DATE, today: $TODAY) — update it" "warn"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
check "STATUS.md MISSING" "fail"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ----------------------------------------------------------------------------
|
||||||
|
# 4b. Discourse pointer-header policy (MANDATORY).
|
||||||
|
# Discourse is the system of record for documentation. In-repo .md files are
|
||||||
|
# stubs that point to a Discourse topic URL. Operational files exempt.
|
||||||
|
# Override exemptions via PROJECT_DOC_EXEMPT (space-separated globs of
|
||||||
|
# basenames) and the Discourse host via PROJECT_DISCOURSE_HOST.
|
||||||
|
# ----------------------------------------------------------------------------
|
||||||
|
$RULE_VERBOSE && log_step "Discourse pointer-header"
|
||||||
|
DISCOURSE_HOST="${PROJECT_DISCOURSE_HOST:-community.turnsys.com}"
|
||||||
|
DOC_EXEMPT="${PROJECT_DOC_EXEMPT:-AGENTS.md STATUS.md WORKING.md README.md ADOPTING.md LICENSE .env.example questions-v*.md BASELINE-PROMPT.md PATTERNS.md}"
|
||||||
|
POINTER_MISSING=0
|
||||||
|
while IFS= read -r -d '' f; do
|
||||||
|
base="$(basename "$f")"
|
||||||
|
exempt=false
|
||||||
|
for pat in $DOC_EXEMPT; do
|
||||||
|
# shellcheck disable=SC2254
|
||||||
|
case "$base" in $pat) exempt=true; break ;; esac
|
||||||
|
done
|
||||||
|
[ "$exempt" = true ] && continue
|
||||||
|
if ! grep -qF "$DISCOURSE_HOST" "$f" 2>/dev/null; then
|
||||||
|
if [ "$POINTER_MISSING" -eq 0 ]; then
|
||||||
|
$RULE_VERBOSE && printf ' %s\n' "Missing $DISCOURSE_HOST URL in:"
|
||||||
|
fi
|
||||||
|
POINTER_MISSING=$((POINTER_MISSING + 1))
|
||||||
|
$RULE_VERBOSE && printf ' %s\n' "$f"
|
||||||
|
fi
|
||||||
|
done < <(find . -path ./.git -prune -o -path ./.crush -prune -o -path ./.tmp -prune -o -path ./vendor -prune -o -path ./archive -prune -o -name '*.md' -print0 2>/dev/null)
|
||||||
|
if [ "$POINTER_MISSING" -eq 0 ]; then
|
||||||
|
check "All non-exempt .md cite Discourse ($DISCOURSE_HOST)" "pass"
|
||||||
|
else
|
||||||
|
check "$POINTER_MISSING .md file(s) missing Discourse pointer (see BASELINE-PROMPT.md §3)" "fail"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ----------------------------------------------------------------------------
|
||||||
|
# 5. Git state — uncommitted changes are a warning (the pre-push hook hardens
|
||||||
|
# this where it matters).
|
||||||
|
# ----------------------------------------------------------------------------
|
||||||
|
$RULE_VERBOSE && log_step "Git state"
|
||||||
|
if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
|
||||||
|
if git diff --quiet && git diff --cached --quiet; then
|
||||||
|
check "Working tree clean" "pass"
|
||||||
|
else
|
||||||
|
check "Uncommitted changes present" "warn"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
check "Not a git repo (git checks skipped)" "pass"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ----------------------------------------------------------------------------
|
||||||
|
# 6. Hooks installed — self-check that git hooks were set up.
|
||||||
|
# ----------------------------------------------------------------------------
|
||||||
|
$RULE_VERBOSE && log_step "Git hooks"
|
||||||
|
if [ -f .git/hooks/pre-commit ]; then
|
||||||
|
check "pre-commit hook installed" "pass"
|
||||||
|
else
|
||||||
|
check "pre-commit NOT installed (run: bash scripts/setup-hooks.sh)" "warn"
|
||||||
|
fi
|
||||||
|
if [ -f .git/hooks/pre-push ]; then
|
||||||
|
check "pre-push hook installed" "pass"
|
||||||
|
else
|
||||||
|
check "pre-push NOT installed (run: bash scripts/setup-hooks.sh)" "warn"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ----------------------------------------------------------------------------
|
||||||
|
# 7. WORKING.md completion — no unchecked tasks may remain at commit time.
|
||||||
|
# ----------------------------------------------------------------------------
|
||||||
|
$RULE_VERBOSE && log_step "Task completion"
|
||||||
|
if [ -f WORKING.md ]; then
|
||||||
|
UNCHECKED="$(grep -cF -- '- [ ]' WORKING.md || true)"
|
||||||
|
if [ "$UNCHECKED" -eq 0 ]; then
|
||||||
|
check "WORKING.md has no unchecked tasks" "pass"
|
||||||
|
else
|
||||||
|
check "WORKING.md has ${UNCHECKED} unchecked task(s) — finish them before committing" "fail"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
check "WORKING.md absent (no active task tracker)" "pass"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ----------------------------------------------------------------------------
|
||||||
|
# 8. CNW markers — empty `CNW:` markers flag unresolved questions for the human.
|
||||||
|
# ----------------------------------------------------------------------------
|
||||||
|
$RULE_VERBOSE && log_step "Unresolved questions"
|
||||||
|
EMPTY_CNW="$(grep -rn 'CNW:$' . --include='*.md' 2>/dev/null | head -20 || true)"
|
||||||
|
if [ -z "$EMPTY_CNW" ]; then
|
||||||
|
check "No empty CNW: markers (unresolved questions)" "pass"
|
||||||
|
else
|
||||||
|
CNW_COUNT="$(printf '%s\n' "$EMPTY_CNW" | grep -c . || true)"
|
||||||
|
check "${CNW_COUNT} unresolved CNW: marker(s) — needs user input" "warn"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ----------------------------------------------------------------------------
|
||||||
|
# 9. Hygiene — merge-conflict markers and trailing whitespace must never land.
|
||||||
|
# ----------------------------------------------------------------------------
|
||||||
|
$RULE_VERBOSE && log_step "File hygiene"
|
||||||
|
if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
|
||||||
|
# archive/ excluded: legacy files are preserved verbatim and may contain
|
||||||
|
# decorative `====` banners that false-positive as conflict markers.
|
||||||
|
CONFLICT="$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -v '^archive/' | xargs -r grep -lE '^(<{7}( \S+)?|=======|>{7}( \S+)?)$' 2>/dev/null || true)"
|
||||||
|
if [ -z "$CONFLICT" ]; then check "No merge-conflict markers staged" "pass"; else check "Merge-conflict markers staged: $CONFLICT" "fail"; fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ----------------------------------------------------------------------------
|
||||||
|
# 10. (slow, skipped in --fast) Project test suite via scripts/test.sh.
|
||||||
|
# ----------------------------------------------------------------------------
|
||||||
|
if [ "$RULE_FAST" = false ] && [ -x scripts/test.sh ]; then
|
||||||
|
$RULE_VERBOSE && log_step "Test suite (scripts/test.sh)"
|
||||||
|
if bash scripts/test.sh >/dev/null 2>&1; then
|
||||||
|
check "scripts/test.sh passes" "pass"
|
||||||
|
else
|
||||||
|
check "scripts/test.sh FAILS" "fail"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ----------------------------------------------------------------------------
|
||||||
|
# 11. Access-channel policy — qemu guest-agent must NEVER be used as an
|
||||||
|
# execution or key-delivery channel. SSH (sshd) is the ONLY approved
|
||||||
|
# remote access path; all commands must be logged through standard
|
||||||
|
# auth/audit infrastructure. ITAR/CMMC environment — non-negotiable.
|
||||||
|
# Allowed: installing/checking qemu-guest-agent for Proxmox state
|
||||||
|
# visibility. Forbidden: `qm guest exec` + any `vm-guest` wrapper.
|
||||||
|
# Scans CODE only (not .md) so docs may describe the ban.
|
||||||
|
# ----------------------------------------------------------------------------
|
||||||
|
$RULE_VERBOSE && log_step "Access-channel policy (no guest-agent exec)"
|
||||||
|
GA_HITS="$(grep -rnE 'qm guest exec|vm-guest|_vm_guest' \
|
||||||
|
--include='*.sh' --include='*.bash' --include='*.py' \
|
||||||
|
. 2>/dev/null | grep -vE 'scripts/check-rules\.sh|/archive/' || true)"
|
||||||
|
if [ -z "$GA_HITS" ]; then
|
||||||
|
check "No guest-agent exec / vm-guest access patterns in code" "pass"
|
||||||
|
else
|
||||||
|
GA_COUNT="$(printf '%s\n' "$GA_HITS" | grep -c . || true)"
|
||||||
|
$RULE_VERBOSE && printf '%s\n' "$GA_HITS" | sed 's/^/ /'
|
||||||
|
check "${GA_COUNT} guest-agent exec / vm-guest reference(s) — SSH-only access policy (AGENTS.md)" "fail"
|
||||||
|
fi
|
||||||
|
|
||||||
|
print_summary_and_exit
|
||||||
Executable
+1138
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,162 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
"""
|
||||||
|
conman-console.py — Drive a serial console via a conman server, read-only.
|
||||||
|
|
||||||
|
Connects to a conmand server (RFC 127-style multiplexer) over the network,
|
||||||
|
opens a named console, sends the commands from a .cmds file, captures all
|
||||||
|
output, and disconnects. Requires no expect/tcl — pure stdlib PTY.
|
||||||
|
|
||||||
|
This replaces the old sw-capture-remote.sh workflow that killed the serial
|
||||||
|
device holder (conflicting with conman/ser2net). Instead, it talks to conman
|
||||||
|
over TCP, which multiplexes safely with other sessions.
|
||||||
|
|
||||||
|
All endpoints are configurable via environment variables so this works on
|
||||||
|
any network with a conman server:
|
||||||
|
|
||||||
|
CONMAN_SERVER conman server host:port (default: via CONSOLE_HOST)
|
||||||
|
CONSOLE console name to open (required)
|
||||||
|
CMDS_FILE file of commands to send (required)
|
||||||
|
TIMEOUT overall timeout in seconds (default: 45)
|
||||||
|
CMD_DELAY seconds between commands (default: 3)
|
||||||
|
WAKE_DELAY seconds after connect (default: 2)
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
CONMAN_SERVER=console-host:7890 \\
|
||||||
|
python3 conman-console.py --console pfv-r5-core-01 --cmds switches/pfv-r5-core-01.cmds
|
||||||
|
|
||||||
|
Lines starting with '!' or '#' in the cmds file are comments (skipped).
|
||||||
|
Blank lines are skipped. The conman escape sequence (&.) is sent automatically
|
||||||
|
to disconnect. A password prompt aborts immediately (we never send creds).
|
||||||
|
|
||||||
|
Exit codes:
|
||||||
|
0 clean run
|
||||||
|
1 usage / setup error
|
||||||
|
2 could not connect to conman server
|
||||||
|
3 timeout (partial output still printed)
|
||||||
|
4 password prompt encountered (aborted)
|
||||||
|
"""
|
||||||
|
import argparse
|
||||||
|
import os
|
||||||
|
import pty
|
||||||
|
import re
|
||||||
|
import select
|
||||||
|
import sys
|
||||||
|
import time
|
||||||
|
|
||||||
|
PWD_RE = re.compile(rb"[Pp]assword:\s*$")
|
||||||
|
MORE_RE = re.compile(rb"--\s*[Mm]ore\s*--|[Mm]ore:\s*<space>")
|
||||||
|
|
||||||
|
|
||||||
|
def main():
|
||||||
|
ap = argparse.ArgumentParser(
|
||||||
|
description="Drive a conman console session read-only via PTY")
|
||||||
|
ap.add_argument("--console", required=True,
|
||||||
|
help="console name (e.g. pfv-r5-core-01)")
|
||||||
|
ap.add_argument("--cmds", required=True,
|
||||||
|
help="command file (one command per line; !/# = comment)")
|
||||||
|
ap.add_argument("--server",
|
||||||
|
default=os.environ.get("CONMAN_SERVER", ""),
|
||||||
|
help="conman server host:port (env: CONMAN_SERVER)")
|
||||||
|
ap.add_argument("--timeout", type=int,
|
||||||
|
default=int(os.environ.get("TIMEOUT", "45")),
|
||||||
|
help="overall timeout seconds (env: TIMEOUT)")
|
||||||
|
ap.add_argument("--cmd-delay", type=float,
|
||||||
|
default=float(os.environ.get("CMD_DELAY", "3")),
|
||||||
|
help="seconds between commands (env: CMD_DELAY)")
|
||||||
|
ap.add_argument("--wake-delay", type=float,
|
||||||
|
default=float(os.environ.get("WAKE_DELAY", "2")),
|
||||||
|
help="seconds after connect before first command (env: WAKE_DELAY)")
|
||||||
|
args = ap.parse_args()
|
||||||
|
|
||||||
|
if not args.server:
|
||||||
|
sys.stderr.write("ERROR: --server or CONMAN_SERVER env required\n")
|
||||||
|
return 1
|
||||||
|
|
||||||
|
with open(args.cmds) as f:
|
||||||
|
cmds = [l.strip() for l in f
|
||||||
|
if l.strip() and not l.strip().startswith(("!", "#"))]
|
||||||
|
|
||||||
|
pid, fd = pty.fork()
|
||||||
|
if pid == 0:
|
||||||
|
try:
|
||||||
|
os.execvp("conman",
|
||||||
|
["conman", "-d", args.server, "-f", args.console])
|
||||||
|
except OSError as e:
|
||||||
|
sys.stderr.write(f"ERROR: cannot exec conman: {e}\n")
|
||||||
|
os._exit(2)
|
||||||
|
os._exit(2)
|
||||||
|
|
||||||
|
output = b""
|
||||||
|
cmd_queue = list(cmds)
|
||||||
|
sent_disconnect = False
|
||||||
|
start = time.time()
|
||||||
|
last_action = 0.0
|
||||||
|
phase = "connect"
|
||||||
|
|
||||||
|
while time.time() - start < args.timeout:
|
||||||
|
ready, _, _ = select.select([fd], [], [], 0.5)
|
||||||
|
if ready:
|
||||||
|
try:
|
||||||
|
data = os.read(fd, 8192)
|
||||||
|
except OSError:
|
||||||
|
break
|
||||||
|
if not data:
|
||||||
|
break
|
||||||
|
output += data
|
||||||
|
|
||||||
|
if PWD_RE.search(output.split(b"\n")[-1] if output else b""):
|
||||||
|
sys.stderr.write("[ABORT] password prompt detected — "
|
||||||
|
"never sending credentials\n")
|
||||||
|
os.write(fd, b"&.\n")
|
||||||
|
break
|
||||||
|
|
||||||
|
# Handle pagination: send space to continue
|
||||||
|
if MORE_RE.search(output[-200:] if output else b""):
|
||||||
|
os.write(fd, b" ")
|
||||||
|
time.sleep(0.5)
|
||||||
|
|
||||||
|
elapsed = time.time() - start
|
||||||
|
gap = elapsed - last_action
|
||||||
|
|
||||||
|
if phase == "connect" and gap >= args.wake_delay:
|
||||||
|
os.write(fd, b"\n")
|
||||||
|
phase = "send"
|
||||||
|
last_action = elapsed
|
||||||
|
elif phase == "send" and gap >= args.cmd_delay:
|
||||||
|
if cmd_queue:
|
||||||
|
cmd = cmd_queue.pop(0)
|
||||||
|
os.write(fd, (cmd + "\n").encode())
|
||||||
|
last_action = elapsed
|
||||||
|
else:
|
||||||
|
phase = "drain"
|
||||||
|
last_action = elapsed
|
||||||
|
elif phase == "drain" and gap >= args.cmd_delay:
|
||||||
|
os.write(fd, b"&.\n")
|
||||||
|
sent_disconnect = True
|
||||||
|
phase = "done"
|
||||||
|
last_action = elapsed
|
||||||
|
elif phase == "done" and gap >= 2:
|
||||||
|
break
|
||||||
|
|
||||||
|
if not sent_disconnect:
|
||||||
|
try:
|
||||||
|
os.write(fd, b"&.\n")
|
||||||
|
except OSError:
|
||||||
|
pass
|
||||||
|
|
||||||
|
try:
|
||||||
|
os.close(fd)
|
||||||
|
except OSError:
|
||||||
|
pass
|
||||||
|
try:
|
||||||
|
os.waitpid(pid, 0)
|
||||||
|
except ChildProcessError:
|
||||||
|
pass
|
||||||
|
|
||||||
|
sys.stdout.buffer.write(output)
|
||||||
|
sys.stdout.flush()
|
||||||
|
return 0
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
sys.exit(main())
|
||||||
@@ -0,0 +1,84 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# deploy-guest-perfpack.sh — guest-side perf pack (ticket #737)
|
||||||
|
# Run INSIDE a guest VM: bash tests/remote.sh vm-file proxmox/perf/scripts/deploy-guest-perfpack.sh
|
||||||
|
# Idempotent. Applies: sysctl tuning (swappiness/dirty/net buffers/slow-start),
|
||||||
|
# fq + bbr (when the kernel module exists), THP->madvise (skipped when tuned
|
||||||
|
# manages THP, e.g. k8s cnodes on network-latency), fstrim.timer.
|
||||||
|
# Pairs with the host-side qm flags (iothread/ssd=1/discard=on).
|
||||||
|
set -u
|
||||||
|
|
||||||
|
log() { echo "[perfpack] $*"; }
|
||||||
|
|
||||||
|
# --- 1. sysctl profile ---
|
||||||
|
bbr=0
|
||||||
|
if modprobe tcp_bbr 2>/dev/null && grep -qw bbr /proc/sys/net/ipv4/tcp_available_congestion_control 2>/dev/null; then
|
||||||
|
bbr=1
|
||||||
|
fi
|
||||||
|
conf=/etc/sysctl.d/99-perfopt.conf
|
||||||
|
{
|
||||||
|
echo "# perf pack #737 (idempotent redeploy overwrites)"
|
||||||
|
echo "vm.swappiness = 10"
|
||||||
|
echo "vm.dirty_ratio = 10"
|
||||||
|
echo "vm.dirty_background_ratio = 3"
|
||||||
|
echo "net.core.rmem_max = 4194304"
|
||||||
|
echo "net.core.wmem_max = 4194304"
|
||||||
|
echo "net.core.rmem_default = 262144"
|
||||||
|
echo "net.core.wmem_default = 262144"
|
||||||
|
echo "net.ipv4.tcp_slow_start_after_idle = 0"
|
||||||
|
echo "net.core.default_qdisc = fq"
|
||||||
|
if [ "$bbr" = 1 ]; then
|
||||||
|
echo "net.ipv4.tcp_congestion_control = bbr"
|
||||||
|
fi
|
||||||
|
} > "$conf"
|
||||||
|
sysctl --system >/dev/null 2>&1
|
||||||
|
log "sysctl applied ($conf): swappiness=$(sysctl -n vm.swappiness 2>/dev/null) cc=$(sysctl -n net.ipv4.tcp_congestion_control 2>/dev/null) qdisc=$(sysctl -n net.core.default_qdisc 2>/dev/null) bbr=$bbr"
|
||||||
|
|
||||||
|
# --- 2. THP -> madvise (live now + persisted via oneshot unit) ---
|
||||||
|
tuned_active=0
|
||||||
|
if command -v tuned-adm >/dev/null 2>&1; then
|
||||||
|
tuned-adm active 2>/dev/null | grep -qvi 'no current\|inactive\|none' && tuned_active=1
|
||||||
|
fi
|
||||||
|
if [ "$tuned_active" = 1 ]; then
|
||||||
|
log "THP: tuned profile active ($(tuned-adm active 2>/dev/null | awk '{print $NF}')) — leaving THP to tuned"
|
||||||
|
else
|
||||||
|
thp=/sys/kernel/mm/transparent_hugepage/enabled
|
||||||
|
cur=$(tr '[]' ' ' < "$thp" 2>/dev/null | awk '{print $NF}')
|
||||||
|
if [ "$cur" != "madvise" ]; then
|
||||||
|
if echo madvise > "$thp" 2>/dev/null; then
|
||||||
|
log "THP: ${cur:-unknown} -> madvise (live)"
|
||||||
|
else
|
||||||
|
log "THP: WARNING live set failed (check $thp permissions)"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
log "THP: already madvise"
|
||||||
|
fi
|
||||||
|
unit=/etc/systemd/system/thp-madvise.service
|
||||||
|
if [ ! -f "$unit" ]; then
|
||||||
|
{
|
||||||
|
echo "[Unit]"
|
||||||
|
echo "Description=Set transparent hugepages to madvise (perf pack #737)"
|
||||||
|
echo "DefaultDependencies=no"
|
||||||
|
echo "After=local-fs.target"
|
||||||
|
echo "Before=sysinit.target"
|
||||||
|
echo
|
||||||
|
echo "[Service]"
|
||||||
|
echo "Type=oneshot"
|
||||||
|
echo "ExecStart=/bin/sh -c 'echo madvise > /sys/kernel/mm/transparent_hugepage/enabled'"
|
||||||
|
echo
|
||||||
|
echo "[Install]"
|
||||||
|
echo "WantedBy=sysinit.target"
|
||||||
|
} > "$unit"
|
||||||
|
systemctl daemon-reload
|
||||||
|
systemctl enable thp-madvise.service >/dev/null 2>&1
|
||||||
|
log "THP: persistence unit installed + enabled"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# --- 3. fstrim (pairs with host-side discard=on) ---
|
||||||
|
if systemctl enable --now fstrim.timer >/dev/null 2>&1; then
|
||||||
|
log "fstrim.timer enabled"
|
||||||
|
else
|
||||||
|
log "fstrim.timer: not available on this guest"
|
||||||
|
fi
|
||||||
|
|
||||||
|
log "done"
|
||||||
@@ -0,0 +1,81 @@
|
|||||||
|
#!/usr/bin/bash
|
||||||
|
# Deploy tuned inside VMs over SSH (sshd is the only approved access channel —
|
||||||
|
# see AGENTS.md "Access-channel policy: SSH only"). Formerly used the
|
||||||
|
# qemu guest-agent channel; converted to SSH now that all VMs have key + sudo.
|
||||||
|
set -uo pipefail
|
||||||
|
|
||||||
|
# Profile mapping: most VMs get throughput-performance, k8s/network-sensitive get network-latency
|
||||||
|
PROFILE="${1:-throughput-performance}"
|
||||||
|
REMOTE_SH="${REMOTE_SH:-$(cd "$(dirname "$0")/../../.." && pwd)/tests/remote.sh}"
|
||||||
|
VM_USER="${VM_USER:-localuser}"
|
||||||
|
|
||||||
|
deploy_vm() {
|
||||||
|
local host="$1" vmid="$2" name="$3"
|
||||||
|
# name is the Tailscale hostname (SSH target); vmid retained for reference.
|
||||||
|
echo -n " VMID $vmid ($name) on $host: "
|
||||||
|
local result
|
||||||
|
result=$(VM_IP="$name" VM_USER="$VM_USER" bash "$REMOTE_SH" vmroot \
|
||||||
|
"DEBIAN_FRONTEND=noninteractive apt-get update -qq 2>/dev/null; \
|
||||||
|
DEBIAN_FRONTEND=noninteractive apt-get install -y -qq tuned 2>/dev/null; \
|
||||||
|
tuned-adm profile $PROFILE 2>/dev/null; \
|
||||||
|
systemctl enable --now tuned 2>/dev/null; \
|
||||||
|
tuned-adm active 2>/dev/null" </dev/null 2>&1)
|
||||||
|
if echo "$result" | grep -q 'Current active'; then
|
||||||
|
echo "$result" | grep -o 'Current active.*' | head -1
|
||||||
|
elif echo "$result" | grep -qi 'permission denied\|no route\|timed out'; then
|
||||||
|
echo "SSH FAILED (no key/no sudo) — run bootstrap-all.sh first"
|
||||||
|
else
|
||||||
|
echo "INSTALL FAILED (apt issue or no network)"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
echo "============================================"
|
||||||
|
echo " Deploying tuned ($PROFILE) to VMs via SSH"
|
||||||
|
echo "============================================"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# tsys1 VMs
|
||||||
|
echo "--- pfv-tsys1 ---"
|
||||||
|
deploy_vm pfv-tsys1 100 pfv-bms
|
||||||
|
deploy_vm pfv-tsys1 101 tsys-ca
|
||||||
|
deploy_vm pfv-tsys1 102 pfv-k8s-cnode1
|
||||||
|
deploy_vm pfv-tsys1 104 tsys-librenms
|
||||||
|
deploy_vm pfv-tsys1 105 tsys-proxmox-datacenter
|
||||||
|
deploy_vm pfv-tsys1 108 tsys-ucs-01
|
||||||
|
|
||||||
|
# tsys3 VMs
|
||||||
|
echo "--- pfv-tsys3 ---"
|
||||||
|
deploy_vm pfv-tsys3 313 pfv-k8s-wnode-tsys3
|
||||||
|
|
||||||
|
# tsys6 VMs
|
||||||
|
echo "--- pfv-tsys6 ---"
|
||||||
|
deploy_vm pfv-tsys6 600 tsys-awx
|
||||||
|
deploy_vm pfv-tsys6 601 pfv-k8s-wnode-tsys6
|
||||||
|
deploy_vm pfv-tsys6 602 pfv-rr-middleware-02
|
||||||
|
deploy_vm pfv-tsys6 603 pfv-k8s-cnode3
|
||||||
|
deploy_vm pfv-tsys6 604 tsys-proxmox-mailgw-01
|
||||||
|
|
||||||
|
# tsys7 VMs
|
||||||
|
echo "--- pfv-tsys7 ---"
|
||||||
|
deploy_vm pfv-tsys7 701 pfv-k8s-wnode-tsys7
|
||||||
|
deploy_vm pfv-tsys7 702 hfnoc-uisp
|
||||||
|
deploy_vm pfv-tsys7 703 pfv-rr-middleware-01
|
||||||
|
deploy_vm pfv-tsys7 705 pfv-k8s-cnode2
|
||||||
|
deploy_vm pfv-tsys7 706 kali-rd
|
||||||
|
deploy_vm pfv-tsys7 707 tsys-siem
|
||||||
|
deploy_vm pfv-tsys7 708 kali-tsys
|
||||||
|
deploy_vm pfv-tsys7 709 tsys-voip
|
||||||
|
deploy_vm pfv-tsys7 711 tsys-proxmox-mailgw-02
|
||||||
|
|
||||||
|
# tsys9 VMs
|
||||||
|
echo "--- pfv-tsys9 ---"
|
||||||
|
deploy_vm pfv-tsys9 902 tsys-ucs-02
|
||||||
|
deploy_vm pfv-tsys9 905 pfv-k8s-wnode-tsys9
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "============================================"
|
||||||
|
echo " Deployment complete."
|
||||||
|
echo " NOT deployed (do-not-reboot VMs):"
|
||||||
|
echo " ultix-streaming, ultix-offstage,"
|
||||||
|
echo " pfv-netinfra-01, pfv-netinfra-02"
|
||||||
|
echo "============================================"
|
||||||
Executable
+39
@@ -0,0 +1,39 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
# docker-run.sh — canonical ephemeral-container wrapper.
|
||||||
|
#
|
||||||
|
# Keeps the host clean: every build/test/generation runs inside a pinned image.
|
||||||
|
# Ensures output files are owned by the invoking user (not root).
|
||||||
|
#
|
||||||
|
# Usage:
|
||||||
|
# docker-run.sh <image> [command...]
|
||||||
|
# Runs <command> in <image> with the repo mounted at /data, cwd /data.
|
||||||
|
# With no command, drops into the image's default entrypoint.
|
||||||
|
# docker-run.sh --shell <image>
|
||||||
|
# Interactive shell inside the container (for debugging).
|
||||||
|
#
|
||||||
|
# Examples:
|
||||||
|
# docker-run.sh python:3.12-slim python3 -m pytest
|
||||||
|
# docker-run.sh pandoc/extra report.md -o report.pdf
|
||||||
|
# docker-run.sh --shell node:20
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
HERE="$(cd "$(dirname "$0")" && pwd)"
|
||||||
|
# shellcheck disable=SC1091
|
||||||
|
source "$HERE/lib/common.sh"
|
||||||
|
|
||||||
|
SHELL_MODE=false
|
||||||
|
case "${1:-}" in
|
||||||
|
--shell) SHELL_MODE=true; shift ;;
|
||||||
|
-h|--help)
|
||||||
|
sed -n '2,18p' "$0"; exit 0 ;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
[ "$#" -ge 1 ] || { sed -n '2,18p' "$0"; exit 1; }
|
||||||
|
|
||||||
|
if [ "$SHELL_MODE" = true ]; then
|
||||||
|
# ${SHELL:-sh} must expand inside the container, not in this outer shell.
|
||||||
|
# shellcheck disable=SC2016
|
||||||
|
docker_run "$1" sh -c 'exec "${SHELL:-sh}"'
|
||||||
|
else
|
||||||
|
docker_run "$@"
|
||||||
|
fi
|
||||||
Executable
+86
@@ -0,0 +1,86 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# fix-tsys7.sh - fixes the two issues found: NFS options string + bond hash
|
||||||
|
# Runs on the target host directly.
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " FIX: NFS options + bond hash policy"
|
||||||
|
echo "==================================================================="
|
||||||
|
|
||||||
|
# --- FIX 1: Simplify NFS options in storage.cfg ---------------------------
|
||||||
|
echo ""
|
||||||
|
echo "--- FIX 1: Simplify NFS options (remove version=4.2 conflict) ---"
|
||||||
|
# Replace the overly-complex options line with a minimal one
|
||||||
|
# PVE handles vers/rsize/wsize/hard/etc internally; we only need nconnect + noatime
|
||||||
|
if grep -q 'options.*nconnect=4.*version=4.2' /etc/pve/storage.cfg; then
|
||||||
|
# Use sed to replace each options line
|
||||||
|
sed -i 's/options nconnect=4,noatime,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,version=4.2/options nconnect=4,noatime/' /etc/pve/storage.cfg
|
||||||
|
echo "Fixed: simplified NFS options to 'nconnect=4,noatime'"
|
||||||
|
else
|
||||||
|
echo "Options line already simplified or not present"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "--- Verify storage.cfg NFS stanzas ---"
|
||||||
|
grep -A 2 "^nfs: D2" /etc/pve/storage.cfg | head -3
|
||||||
|
echo "..."
|
||||||
|
grep -c "options nconnect" /etc/pve/storage.cfg
|
||||||
|
echo " NFS stanzas with options"
|
||||||
|
|
||||||
|
# --- FIX 2: Bond hash policy (force via sysfs + persist in interfaces) ----
|
||||||
|
echo ""
|
||||||
|
echo "--- FIX 2: Apply bond xmit_hash_policy=layer3+4 ---"
|
||||||
|
|
||||||
|
# 2a: Apply LIVE via sysfs (takes effect immediately, no network reload)
|
||||||
|
echo "Applying live via sysfs..."
|
||||||
|
if echo "layer3+4" > /sys/class/net/bond0/bonding/xmit_hash_policy 2>/dev/null; then
|
||||||
|
echo "Live sysfs apply: SUCCESS"
|
||||||
|
else
|
||||||
|
echo "Live sysfs apply: FAILED (will persist in config and apply on ifreload)"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Verify live state
|
||||||
|
echo ""
|
||||||
|
echo "Live bond0 hash policy:"
|
||||||
|
cat /proc/net/bonding/bond0 | grep "Transmit Hash"
|
||||||
|
|
||||||
|
# 2b: Persist in /etc/network/interfaces (fix the sed that failed before)
|
||||||
|
echo ""
|
||||||
|
echo "Persisting in /etc/network/interfaces..."
|
||||||
|
|
||||||
|
# Backup
|
||||||
|
cp -a /etc/network/interfaces "/root/interfaces.bondfix.$(date +%Y%m%d%H%M%S)"
|
||||||
|
|
||||||
|
# Check if already present
|
||||||
|
if grep -q 'bond-xmit-hash-policy' /etc/network/interfaces; then
|
||||||
|
echo "bond-xmit-hash-policy already in interfaces file"
|
||||||
|
else
|
||||||
|
# Use awk to insert after the bond-mode line (more reliable than sed)
|
||||||
|
# Match any line containing 'bond-mode' (regardless of indentation)
|
||||||
|
awk '
|
||||||
|
/bond-mode/ && !done {
|
||||||
|
print
|
||||||
|
print "\tbond-xmit-hash-policy layer3+4"
|
||||||
|
done=1
|
||||||
|
next
|
||||||
|
}
|
||||||
|
{ print }
|
||||||
|
' /etc/network/interfaces > /etc/network/interfaces.new
|
||||||
|
|
||||||
|
mv /etc/network/interfaces.new /etc/network/interfaces
|
||||||
|
echo "Inserted bond-xmit-hash-policy layer3+4"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "--- Updated bond0 stanza ---"
|
||||||
|
awk '/^auto bond0/,/^$/' /etc/network/interfaces
|
||||||
|
|
||||||
|
# Final verify
|
||||||
|
echo ""
|
||||||
|
echo "--- Final bond0 running state ---"
|
||||||
|
cat /proc/net/bonding/bond0 | head -20
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " FIX COMPLETE"
|
||||||
|
echo "==================================================================="
|
||||||
Executable
+79
@@ -0,0 +1,79 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
###############################################################################
|
||||||
|
# fix-e1000e-offload.sh — Disable offload on e1000e NICs to prevent hangs
|
||||||
|
#
|
||||||
|
# The Intel e1000e driver has a known bug where TSO/GSO/GRO offload causes
|
||||||
|
# "hardware unit hang" resets on certain Intel NICs (I217-LM, I219-LM, 82571EB).
|
||||||
|
# This script disables offload features on all e1000e interfaces and installs
|
||||||
|
# a systemd service to persist across reboots.
|
||||||
|
#
|
||||||
|
# References:
|
||||||
|
# https://forum.proxmox.com/threads/e1000-driver-hang.58284/
|
||||||
|
# https://serverfault.com/questions/616485
|
||||||
|
#
|
||||||
|
# Run on each Proxmox host:
|
||||||
|
# PROX_HOST=pfv-tsys4 bash tests/remote.sh prox-file proxmox/perf/scripts/fix-e1000e-offload.sh
|
||||||
|
###############################################################################
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
echo "=== e1000e Offload Fix on $(hostname) ==="
|
||||||
|
|
||||||
|
# Find all e1000e physical NICs (skip bridges, bonds, virtual interfaces)
|
||||||
|
AFFECTED_NICS=()
|
||||||
|
for nic_path in /sys/class/net/*; do
|
||||||
|
nic=$(basename "$nic_path")
|
||||||
|
[ "$nic" = "lo" ] && continue
|
||||||
|
# Skip bridges, bonds, virtual interfaces
|
||||||
|
[ -d "${nic_path}/bridge" ] && continue
|
||||||
|
[ -d "${nic_path}/bonding" ] && continue
|
||||||
|
case "$nic" in
|
||||||
|
tap*|veth*|fwpr*|fwln*|vmbr*|datanet*|storagenet*|tailscale*) continue ;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
driver=$(ethtool -i "$nic" 2>/dev/null | awk '/^driver:/{print $2}')
|
||||||
|
if [ "$driver" = "e1000e" ]; then
|
||||||
|
AFFECTED_NICS+=("$nic")
|
||||||
|
echo " Found e1000e NIC: $nic"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
if [ "${#AFFECTED_NICS[@]}" -eq 0 ]; then
|
||||||
|
echo " No e1000e NICs found. Nothing to do."
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Apply fix live
|
||||||
|
echo ""
|
||||||
|
echo "--- Disabling offload features ---"
|
||||||
|
for nic in "${AFFECTED_NICS[@]}"; do
|
||||||
|
echo " $nic:"
|
||||||
|
ethtool -K "$nic" tso off gro off gso off tx off rx off 2>&1 | sed 's/^/ /' || true
|
||||||
|
tso_state=$(ethtool -k "$nic" 2>/dev/null | awk '/tcp-segmentation-offload/{print $2}' | head -1)
|
||||||
|
echo " tso=$tso_state"
|
||||||
|
done
|
||||||
|
|
||||||
|
# Install systemd service for persistence
|
||||||
|
echo ""
|
||||||
|
echo "--- Installing systemd service ---"
|
||||||
|
{
|
||||||
|
echo "[Unit]"
|
||||||
|
echo "Description=Disable offload on e1000e NICs (prevent hardware unit hang)"
|
||||||
|
echo "After=network.target"
|
||||||
|
echo "Wants=network.target"
|
||||||
|
echo ""
|
||||||
|
echo "[Service]"
|
||||||
|
echo "Type=oneshot"
|
||||||
|
echo "RemainAfterExit=yes"
|
||||||
|
for nic in "${AFFECTED_NICS[@]}"; do
|
||||||
|
echo "ExecStart=/sbin/ethtool -K $nic tso off gro off gso off tx off rx off"
|
||||||
|
done
|
||||||
|
echo ""
|
||||||
|
echo "[Install]"
|
||||||
|
echo "WantedBy=multi-user.target"
|
||||||
|
} > /etc/systemd/system/fix-e1000e-offload.service
|
||||||
|
|
||||||
|
systemctl daemon-reload
|
||||||
|
systemctl enable fix-e1000e-offload.service
|
||||||
|
echo " Service installed and enabled (fix-e1000e-offload.service)"
|
||||||
|
echo ""
|
||||||
|
echo "=== Done. Affected NICs: ${AFFECTED_NICS[*]} ==="
|
||||||
@@ -0,0 +1,283 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
###############################################################################
|
||||||
|
# fix-tsys4-storage-bond.sh
|
||||||
|
#
|
||||||
|
# Reconfigures pfv-tsys4 storage network bond from broken 802.3ad (LACP) to
|
||||||
|
# active-backup mode. USB NICs cannot participate in LACP — the driver does
|
||||||
|
# not report speed/duplex to the kernel (ethtool shows "Speed: Unknown!"),
|
||||||
|
# so the bonding driver never transmits LACP PDUs. active-backup requires no
|
||||||
|
# switch-side LACP and works correctly with a single port.
|
||||||
|
#
|
||||||
|
# Run ON pfv-tsys4. Designed for maintenance-window execution.
|
||||||
|
#
|
||||||
|
# Safety:
|
||||||
|
# - Dry-run by default (--apply to commit)
|
||||||
|
# - Full backup of /etc/network/interfaces
|
||||||
|
# - 5 health checks with automatic rollback on failure
|
||||||
|
# - SSH survives (management on vmbr0/tailscale0, not bond0/datanet)
|
||||||
|
# - Pre-generated rollback script for manual recovery
|
||||||
|
#
|
||||||
|
# Switch side (core-sw01): NO changes needed. g31 is already a standalone
|
||||||
|
# access port in VLAN 1000 — correct for active-backup (no LACP required).
|
||||||
|
# g32/ch2 cleanup (dead NIC) is left for separate maintenance.
|
||||||
|
#
|
||||||
|
# Usage:
|
||||||
|
# bash fix-tsys4-storage-bond.sh # dry-run (show changes only)
|
||||||
|
# bash fix-tsys4-storage-bond.sh --apply # commit with auto-rollback
|
||||||
|
#
|
||||||
|
# Related: Redmine [#394] BUG 4
|
||||||
|
###############################################################################
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
STORAGE_PEER="10.100.100.6"
|
||||||
|
INTERFACES="/etc/network/interfaces"
|
||||||
|
TS_SHORT="$(date +%Y%m%d-%H%M%S)"
|
||||||
|
BACKUP_DIR="/root/tsys4-bondfix-backup-${TS_SHORT}"
|
||||||
|
ROLLBACK="/root/tsys4-bondfix-rollback-${TS_SHORT}.sh"
|
||||||
|
ACTION="${1:-dryrun}"
|
||||||
|
|
||||||
|
[ "${ACTION}" = "--apply" ] && ACTION="apply" || ACTION="dryrun"
|
||||||
|
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " fix-tsys4-storage-bond — $(hostname -s)"
|
||||||
|
echo " mode: ${ACTION}"
|
||||||
|
echo " time: $(date)"
|
||||||
|
echo "==================================================================="
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
# Pre-flight checks
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
echo "--- Pre-flight checks ---"
|
||||||
|
|
||||||
|
# Must be pfv-tsys4
|
||||||
|
HOSTNAME_S="$(hostname -s)"
|
||||||
|
if [ "${HOSTNAME_S}" != "pfv-tsys4" ]; then
|
||||||
|
echo "FATAL: This script targets pfv-tsys4 (this host: ${HOSTNAME_S})"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
echo " Host: OK (pfv-tsys4)"
|
||||||
|
|
||||||
|
# bond0 must exist
|
||||||
|
if [ ! -d /sys/class/net/bond0 ]; then
|
||||||
|
echo "FATAL: bond0 not found — no bond to fix"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
echo " bond0: present"
|
||||||
|
|
||||||
|
# ifreload must be available
|
||||||
|
if ! command -v ifreload >/dev/null 2>&1; then
|
||||||
|
echo "FATAL: ifreload not found (need ifupdown2)"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
echo " ifreload: available"
|
||||||
|
|
||||||
|
# SSH must NOT be on bond0/datanet (check incoming route)
|
||||||
|
SSH_SRC="$(echo "${SSH_CLIENT:-}" | awk '{print $1}')"
|
||||||
|
if [ -n "${SSH_SRC}" ]; then
|
||||||
|
SSH_IFACE="$(ip route get "${SSH_SRC}" 2>/dev/null | grep -oP 'dev \K\S+' || echo "unknown")"
|
||||||
|
echo " SSH ingress: ${SSH_IFACE}"
|
||||||
|
if echo "${SSH_IFACE}" | grep -qE 'bond0|datanet'; then
|
||||||
|
echo "FATAL: SSH is on storage network — cannot safely reload."
|
||||||
|
echo " Use physical console (pfv-tsys4) to run this script."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
echo " SSH ingress: (local/console session — OK)"
|
||||||
|
fi
|
||||||
|
echo " SSH safety: OK (not on storage network)"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
# Show current state
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
echo "--- Current bond0 state ---"
|
||||||
|
grep -E "Bonding Mode|Transmit Hash|MII Status|Number of ports" /proc/net/bonding/bond0
|
||||||
|
echo ""
|
||||||
|
grep -E "Slave Interface|MII Status|Speed" /proc/net/bonding/bond0
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo "--- Current bond0 stanza in /etc/network/interfaces ---"
|
||||||
|
awk '/^auto bond0/,/^$/' "${INTERFACES}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
# Baseline connectivity
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
echo "--- Baseline connectivity ---"
|
||||||
|
echo -n " Ping ${STORAGE_PEER}: "
|
||||||
|
if ping -c 1 -W 2 "${STORAGE_PEER}" >/dev/null 2>&1; then
|
||||||
|
echo "OK"
|
||||||
|
else
|
||||||
|
echo "UNREACHABLE (baseline already broken — proceed with caution)"
|
||||||
|
fi
|
||||||
|
echo -n " NFS server: "
|
||||||
|
systemctl is-active nfs-server 2>/dev/null || echo "(not active)"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
# Backup
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
mkdir -p "${BACKUP_DIR}"
|
||||||
|
cp -a "${INTERFACES}" "${BACKUP_DIR}/interfaces"
|
||||||
|
echo "Backup: ${BACKUP_DIR}/interfaces"
|
||||||
|
|
||||||
|
# Generate rollback script
|
||||||
|
cat > "${ROLLBACK}" <<ROLLBACKEOF
|
||||||
|
#!/bin/bash
|
||||||
|
set -euo pipefail
|
||||||
|
echo "Rolling back tsys4 bond config..."
|
||||||
|
cp -a "${BACKUP_DIR}/interfaces" "${INTERFACES}"
|
||||||
|
echo "Restored ${INTERFACES}"
|
||||||
|
ifreload -a 2>&1 || systemctl restart networking 2>&1 || true
|
||||||
|
sleep 3
|
||||||
|
echo "Post-rollback bond0 state:"
|
||||||
|
grep -E "Bonding Mode|MII Status|Slave Interface|Speed" /proc/net/bonding/bond0 2>/dev/null
|
||||||
|
echo "Rollback complete."
|
||||||
|
ROLLBACKEOF
|
||||||
|
chmod +x "${ROLLBACK}"
|
||||||
|
echo "Rollback: ${ROLLBACK}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
# Describe the change
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " PROPOSED CHANGE"
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " 1. bond-mode: 802.3ad → active-backup"
|
||||||
|
echo " 2. Remove bond-xmit-hash-policy (unused in active-backup)"
|
||||||
|
echo " 3. bond-slaves: keep enx8cae4ccda926 (active NIC only)"
|
||||||
|
echo ""
|
||||||
|
echo " Rationale: USB NICs cannot do LACP. ethtool reports Speed: Unknown,"
|
||||||
|
echo " so the bonding driver never sends LACP PDUs (verified via tcpdump:"
|
||||||
|
echo " 0 LACP PDUs in 65s on both slave and bond master). active-backup"
|
||||||
|
echo " needs no LACP and works with the single working port."
|
||||||
|
echo ""
|
||||||
|
echo " Switch: NO changes needed. g31 is standalone access VLAN 1000."
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
if [ "${ACTION}" != "apply" ]; then
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " DRY RUN — no changes made."
|
||||||
|
echo " Commit: bash \$0 --apply"
|
||||||
|
echo "==================================================================="
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# =========================================================================
|
||||||
|
# APPLY
|
||||||
|
# =========================================================================
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " APPLYING — auto-rollback on health check failure"
|
||||||
|
echo "==================================================================="
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# 1. Change bond-mode
|
||||||
|
echo "Changing bond-mode 802.3ad → active-backup..."
|
||||||
|
sed -i 's/bond-mode 802\.3ad/bond-mode active-backup/' "${INTERFACES}"
|
||||||
|
|
||||||
|
# 2. Remove bond-xmit-hash-policy (not used by active-backup)
|
||||||
|
echo "Removing bond-xmit-hash-policy..."
|
||||||
|
sed -i '/bond-xmit-hash-policy/d' "${INTERFACES}"
|
||||||
|
|
||||||
|
# Show updated stanza
|
||||||
|
echo ""
|
||||||
|
echo "--- Updated bond0 stanza ---"
|
||||||
|
awk '/^auto bond0/,/^$/' "${INTERFACES}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# 3. Reload networking
|
||||||
|
echo "--- Reloading networking (ifreload -a) ---"
|
||||||
|
echo "SSH safe on vmbr0/tailscale0 (not bond0)..."
|
||||||
|
ifreload -a 2>&1 || echo "WARNING: ifreload returned non-zero — checking state..."
|
||||||
|
|
||||||
|
# Wait for bond to settle
|
||||||
|
echo "Waiting 5s for bond to settle..."
|
||||||
|
sleep 5
|
||||||
|
|
||||||
|
# =========================================================================
|
||||||
|
# HEALTH CHECKS
|
||||||
|
# =========================================================================
|
||||||
|
echo ""
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " HEALTH CHECKS (5 tests)"
|
||||||
|
echo "==================================================================="
|
||||||
|
|
||||||
|
HEALTH_OK=true
|
||||||
|
|
||||||
|
# Check 1: bond0 is UP
|
||||||
|
echo -n " [1/5] bond0 MII up: "
|
||||||
|
if grep -q "MII Status: up" /proc/net/bonding/bond0 2>/dev/null; then
|
||||||
|
echo "PASS"
|
||||||
|
else
|
||||||
|
echo "FAIL"
|
||||||
|
HEALTH_OK=false
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Check 2: Active slave assigned
|
||||||
|
echo -n " [2/5] Active slave: "
|
||||||
|
ACTIVE_SLAVE="$(cat /sys/class/net/bond0/bonding/active_slave 2>/dev/null || echo "")"
|
||||||
|
if [ -n "${ACTIVE_SLAVE}" ]; then
|
||||||
|
echo "PASS (${ACTIVE_SLAVE})"
|
||||||
|
else
|
||||||
|
echo "FAIL (no active slave)"
|
||||||
|
HEALTH_OK=false
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Check 3: datanet bridge UP
|
||||||
|
echo -n " [3/5] datanet bridge up: "
|
||||||
|
if ip link show datanet 2>/dev/null | grep -q "state UP"; then
|
||||||
|
echo "PASS"
|
||||||
|
else
|
||||||
|
echo "FAIL"
|
||||||
|
HEALTH_OK=false
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Check 4: Storage network IP present on datanet
|
||||||
|
echo -n " [4/5] Storage IP (10.100.100.4): "
|
||||||
|
if ip addr show datanet 2>/dev/null | grep -q "10.100.100.4"; then
|
||||||
|
echo "PASS"
|
||||||
|
else
|
||||||
|
echo "FAIL"
|
||||||
|
HEALTH_OK=false
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Check 5: Storage peer reachable
|
||||||
|
echo -n " [5/5] Ping ${STORAGE_PEER}: "
|
||||||
|
if ping -c 3 -W 2 "${STORAGE_PEER}" >/dev/null 2>&1; then
|
||||||
|
echo "PASS"
|
||||||
|
else
|
||||||
|
echo "FAIL"
|
||||||
|
HEALTH_OK=false
|
||||||
|
fi
|
||||||
|
|
||||||
|
# =========================================================================
|
||||||
|
# COMMIT OR ROLLBACK
|
||||||
|
# =========================================================================
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
if [ "${HEALTH_OK}" = "true" ]; then
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " SUCCESS — all 5 health checks passed"
|
||||||
|
echo "==================================================================="
|
||||||
|
echo ""
|
||||||
|
echo "--- Final bond0 state ---"
|
||||||
|
grep -E "Bonding Mode|MII Status|Slave Interface|Speed|Active" /proc/net/bonding/bond0
|
||||||
|
echo ""
|
||||||
|
echo "Backup: ${BACKUP_DIR}/interfaces"
|
||||||
|
echo "Rollback: ${ROLLBACK}"
|
||||||
|
echo ""
|
||||||
|
echo "Config change is LIVE but not yet reboot-tested."
|
||||||
|
echo "Verify NFS clients are healthy before next maintenance window."
|
||||||
|
exit 0
|
||||||
|
else
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " HEALTH CHECK FAILED — auto-rolling back"
|
||||||
|
echo "==================================================================="
|
||||||
|
bash "${ROLLBACK}"
|
||||||
|
echo ""
|
||||||
|
echo "Auto-rollback complete."
|
||||||
|
echo "Original config restored. Manual investigation needed."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
Executable
+65
@@ -0,0 +1,65 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
# garden.sh — the gardening loop.
|
||||||
|
#
|
||||||
|
# Reports doc sprawl and files that violate the "Discourse is the system of
|
||||||
|
# record for documentation; gitea .md files are stubs" policy. Run via
|
||||||
|
# `bash scripts/garden.sh`. Findings are WARNINGS (advisory); fix them at a natural break.
|
||||||
|
#
|
||||||
|
# What it checks:
|
||||||
|
# 1. Markdown sprawl: count of .md files per directory (top-10 by count).
|
||||||
|
# 2. Oversized .md files (default >300 lines) that don't cite a Discourse URL
|
||||||
|
# — candidates to migrate to Discourse, leaving a stub.
|
||||||
|
# 3. .md files with no Discourse link at all (informational; exempt: the
|
||||||
|
# operational files in EXEMPT_FILES).
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
HERE="$(cd "$(dirname "$0")" && pwd)"
|
||||||
|
# shellcheck disable=SC1091
|
||||||
|
source "$HERE/lib/common.sh"
|
||||||
|
REPO_ROOT="$(repo_root)"
|
||||||
|
cd "$REPO_ROOT"
|
||||||
|
|
||||||
|
SIZE_LIMIT="${GARDEN_MD_LINE_LIMIT:-300}"
|
||||||
|
# Operational files that legitimately live next to code, not in Discourse.
|
||||||
|
EXEMPT_FILES="${GARDEN_EXEMPT:-AGENTS.md STATUS.md WORKING.md questions-v.*.md PATTERNS.md BASELINE-PROMPT.md README.md}"
|
||||||
|
|
||||||
|
log_step "Gardening report for $REPO_ROOT"
|
||||||
|
|
||||||
|
# --- 1. sprawl by directory -------------------------------------------------
|
||||||
|
log_info "Markdown file count by directory (top 10):"
|
||||||
|
find . -path ./.git -prune -o -name '*.md' -print 2>/dev/null \
|
||||||
|
| sed 's|/[^/]*$||' | sort | uniq -c | sort -rn | head -10 | sed 's/^/ /'
|
||||||
|
|
||||||
|
# --- 2. oversized .md without a Discourse link ------------------------------
|
||||||
|
log_info "Oversized .md (>${SIZE_LIMIT} lines) lacking a Discourse URL — migrate candidates:"
|
||||||
|
OVERSIZED=0
|
||||||
|
while IFS= read -r -d '' f; do
|
||||||
|
# skip exempt files (glob match against basename and relative path)
|
||||||
|
exempt=false
|
||||||
|
base=$(basename "$f")
|
||||||
|
rel=${f#./}
|
||||||
|
for pat in $EXEMPT_FILES; do
|
||||||
|
# shellcheck disable=SC2254 # glob match is intentional
|
||||||
|
case "$base" in $pat) exempt=true; break ;; esac
|
||||||
|
# shellcheck disable=SC2254
|
||||||
|
case "$rel" in $pat) exempt=true; break ;; esac
|
||||||
|
done
|
||||||
|
[ "$exempt" = true ] && continue
|
||||||
|
lines=$(wc -l < "$f" 2>/dev/null || echo 0)
|
||||||
|
if [ "$lines" -gt "$SIZE_LIMIT" ]; then
|
||||||
|
if ! grep -qiE 'community\.turnsys\.com|discourse' "$f" 2>/dev/null; then
|
||||||
|
printf ' %-60s %s lines\n' "$f" "$lines"
|
||||||
|
OVERSIZED=$((OVERSIZED + 1))
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
done < <(find . -path ./.git -prune -o -name '*.md' -print0 2>/dev/null)
|
||||||
|
[ "$OVERSIZED" -eq 0 ] && echo " (none)"
|
||||||
|
|
||||||
|
# --- 3. summary -------------------------------------------------------------
|
||||||
|
log_step "Gardening summary"
|
||||||
|
echo " Oversized non-Discourse .md files: $OVERSIZED"
|
||||||
|
if [ "$OVERSIZED" -eq 0 ]; then
|
||||||
|
log_ok "no migration candidates"
|
||||||
|
else
|
||||||
|
log_warn "$OVERSIZED file(s) to migrate to Discourse"
|
||||||
|
fi
|
||||||
Executable
+34
@@ -0,0 +1,34 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# identify-hosts.sh — identify all live hosts on a network via DNS/SNMP/SSH
|
||||||
|
# Usage: bash identify-hosts.sh <hosts-file-or-subnet>
|
||||||
|
# bash identify-hosts.sh 192.168.0.0/22
|
||||||
|
# bash identify-hosts.sh /tmp/live-hosts.txt
|
||||||
|
set -u
|
||||||
|
COMMUNITY="${SNMP_COMMUNITY:-kn3lmgmt}"
|
||||||
|
|
||||||
|
if [ -f "${1:-}" ]; then
|
||||||
|
HOSTS=$(cat "$1")
|
||||||
|
elif [ -n "${1:-}" ]; then
|
||||||
|
HOSTS=$(nmap -sn -n "$1" 2>/dev/null | grep 'Nmap scan report' | awk '{print $5}')
|
||||||
|
else
|
||||||
|
echo "Usage: $0 <hosts-file-or-subnet>"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
printf "%-16s %-30s %-25s %-20s\n" "IP" "DNS_NAME" "SNMP_SYSDESCR" "SSH_BANNER"
|
||||||
|
printf "%-16s %-30s %-25s %-20s\n" "--" "-------" "-------------" "----------"
|
||||||
|
|
||||||
|
for ip in $HOSTS; do
|
||||||
|
# DNS reverse
|
||||||
|
rdns=$(dig +short -x "$ip" 2>/dev/null | head -1 | sed 's/\.$//')
|
||||||
|
[ -z "$rdns" ] && rdns="(no-ptr)"
|
||||||
|
|
||||||
|
# SNMP sysDescr (first 25 chars)
|
||||||
|
snmp=$(timeout 3 snmpget -Oqv -v2c -c "$COMMUNITY" "$ip" 1.3.6.1.2.1.1.1.0 2>/dev/null | head -1 | tr -d '"' | cut -c1-25)
|
||||||
|
[ -z "$snmp" ] && snmp="-"
|
||||||
|
|
||||||
|
# SSH banner (quick)
|
||||||
|
ssh_banner=$(timeout 3 bash -c "echo > /dev/tcp/$ip/22" 2>/dev/null && echo "ssh:open" || echo "-")
|
||||||
|
|
||||||
|
printf "%-16s %-30s %-25s %-20s\n" "$ip" "$rdns" "$snmp" "$ssh_banner"
|
||||||
|
done
|
||||||
@@ -0,0 +1,219 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
###############################################################################
|
||||||
|
# lacp-retrans-cause.sh (HOST-NATIVE)
|
||||||
|
#
|
||||||
|
# Runs on tsys6 (receiver) or tsys7 (sender). Auto-detects role.
|
||||||
|
#
|
||||||
|
# Question this answers: are the ~56K retransmits we see on 8-stream iperf
|
||||||
|
# between tsys6 and tsys7 fixable (NIC ring drops, softnet drops, CPU
|
||||||
|
# saturation) or just unavoidable LACP reordering overhead?
|
||||||
|
#
|
||||||
|
# Method: snapshot drop/error counters + softnet_stat + TCP SNMP before and
|
||||||
|
# after a 12s iperf3 run, then print the deltas. The decisive columns are:
|
||||||
|
# - NIC rx_dropped / rx_missed_errors / rx_no_dma_resources -> ring too small
|
||||||
|
# - /proc/net/softnet_stat drops -> ksoftirq starved
|
||||||
|
# - /proc/net/snmp TCP retranst -> TCP-level retrans
|
||||||
|
# If NIC drop counters do NOT climb but TCP retrans does, the retrans are
|
||||||
|
# coming from LACP reordering (out-of-order segments triggering fast
|
||||||
|
# retransmit), not packet loss — and are NOT fixable by tuning.
|
||||||
|
###############################################################################
|
||||||
|
set -uo pipefail
|
||||||
|
|
||||||
|
DURATION="${LACP_TEST_SECS:-12}"
|
||||||
|
STREAMS="${LACP_STREAMS:-8}"
|
||||||
|
PEER_RX_IP="10.100.100.6" # tsys6 storage IP (receiver)
|
||||||
|
PEER_TX_IP="10.100.100.7" # tsys7 storage IP (sender)
|
||||||
|
LOG_DIR="/root"
|
||||||
|
BOND="bond0"
|
||||||
|
|
||||||
|
HOST="$(uname -n)"; HOST="${HOST%%.*}"
|
||||||
|
case "$HOST" in
|
||||||
|
*tsys6) ROLE="receiver"; LOG="$LOG_DIR/lacp-retrans-receiver.log" ;;
|
||||||
|
*tsys7) ROLE="sender"; LOG="$LOG_DIR/lacp-retrans-sender.log" ;;
|
||||||
|
*) echo "ERROR: not on tsys6 or tsys7 (host=$HOST)"; exit 2 ;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
TMP="$(mktemp -d)"
|
||||||
|
trap 'rm -rf "$TMP"' EXIT
|
||||||
|
|
||||||
|
# ---- per-slave NIC counter snapshot -----------------------------------------
|
||||||
|
# Captures rx_dropped, rx_missed_errors, rx_no_dma_resources, tx_retrans,
|
||||||
|
# plus all error-like counters. Falls back gracefully if a counter doesn't
|
||||||
|
# exist (different NIC drivers expose different names).
|
||||||
|
nic_snapshot() {
|
||||||
|
# shellcheck disable=SC2013 # interface names contain no spaces; word-splitting is safe here
|
||||||
|
for s in $(awk '/^Slave Interface:/{print $3}' "/proc/net/bonding/$BOND"); do
|
||||||
|
[ -n "$s" ] || continue
|
||||||
|
echo "[$s]"
|
||||||
|
# ethtool -S may exist; show only drop/error/retrans lines
|
||||||
|
if command -v ethtool >/dev/null 2>&1; then
|
||||||
|
ethtool -S "$s" 2>/dev/null \
|
||||||
|
| grep -iE 'drop|miss|error|no_dma|fifo|retrans|overflow' \
|
||||||
|
|| echo "(ethtool -S: no matching counters or unsupported)"
|
||||||
|
else
|
||||||
|
echo "(ethtool not installed)"
|
||||||
|
fi
|
||||||
|
# /sys counters (always available, driver-agnostic)
|
||||||
|
for c in rx_dropped tx_dropped rx_errors tx_errors rx_missed_errors \
|
||||||
|
rx_length_errors rx_crc_errors rx_fifo_errors tx_fifo_errors \
|
||||||
|
multicast collisions; do
|
||||||
|
v=$(cat "/sys/class/net/$s/statistics/$c" 2>/dev/null)
|
||||||
|
[ -n "$v" ] && printf ' sysfs %-22s = %s\n' "$c" "$v"
|
||||||
|
done
|
||||||
|
done
|
||||||
|
}
|
||||||
|
|
||||||
|
# ---- softnet_stat snapshot (per-CPU RX softirq drops) -----------------------
|
||||||
|
# /proc/net/softnet_stat columns are HEX. Col1=processed, col2=dropped,
|
||||||
|
# col3=time_squeeze. We only care about dropped + squeeze (small numbers that
|
||||||
|
# look identical in hex and decimal). Processed is informational only and we
|
||||||
|
# don't try to delta it (hex arithmetic is awk-version-dependent).
|
||||||
|
softnet_snapshot() {
|
||||||
|
awk '{ printf "cpu%s processed=%s dropped=%s squeezed=%s\n", \
|
||||||
|
NR-1, $1, $2, $3 }' /proc/net/softnet_stat
|
||||||
|
}
|
||||||
|
|
||||||
|
# ---- TCP SNMP snapshot (the source of iperf's retransmit number) -----------
|
||||||
|
tcp_snapshot() {
|
||||||
|
awk '/^Tcp:/{
|
||||||
|
if (!seen) {
|
||||||
|
seen=1
|
||||||
|
# /proc/net/snmp Tcp line 1 = names, line 2 = values
|
||||||
|
n=split($0, names, " ")
|
||||||
|
# re-find the values line
|
||||||
|
getline
|
||||||
|
vals=$0
|
||||||
|
split(vals, v, " ")
|
||||||
|
for (i=1;i<=n;i++) printf " %-22s = %s\n", names[i], v[i]
|
||||||
|
}
|
||||||
|
}' /proc/net/snmp
|
||||||
|
}
|
||||||
|
|
||||||
|
# ---- print deltas for selected counters ------------------------------------
|
||||||
|
# $1 = before file, $2 = after file
|
||||||
|
# softnet_snapshot output: "cpuN processed=HEX dropped=HEX squeezed=HEX"
|
||||||
|
# /proc/net/softnet_stat is hex, but dropped/squeezed are always small
|
||||||
|
# integers (typically 0 on a healthy host), so +0 coercion is correct for
|
||||||
|
# the values we care about. We deliberately DON'T report `processed` deltas
|
||||||
|
# because hex arithmetic on large numbers is awk-version-dependent.
|
||||||
|
softnet_delta() {
|
||||||
|
awk '
|
||||||
|
FNR==NR { if (match($0,/cpu[0-9]+/)) { id=substr($0,RSTART,RLENGTH);
|
||||||
|
split($0, p, /[= ]+/); drop[id]=p[5]+0; sqz[id]=p[7]+0 }
|
||||||
|
next }
|
||||||
|
{ if (match($0,/cpu[0-9]+/)) { id=substr($0,RSTART,RLENGTH);
|
||||||
|
split($0, q, /[= ]+/);
|
||||||
|
dd = (q[5]+0) - drop[id]
|
||||||
|
sd = (q[7]+0) - sqz[id]
|
||||||
|
if (dd != 0 || sd != 0)
|
||||||
|
printf " %-8s dropped_delta=%-6s squeezed_delta=%-6s\n", id, dd, sd } }
|
||||||
|
' "$1" "$2" | sort
|
||||||
|
}
|
||||||
|
|
||||||
|
# $1 = before file, $2 = after file, $3 = section label prefix
|
||||||
|
# File format: slave header line "[nic1]", then " counter_name = value" lines.
|
||||||
|
# Output only counters whose value changed.
|
||||||
|
nic_delta() {
|
||||||
|
awk '
|
||||||
|
FNR==NR { if ($0 ~ /^\[/) slave=$0
|
||||||
|
else if ($0 ~ /=/) {
|
||||||
|
# Everything before " = " is the counter name (trim spaces)
|
||||||
|
pos = index($0, "=")
|
||||||
|
name = substr($0, 1, pos-1)
|
||||||
|
gsub(/^ +| +$/, "", name)
|
||||||
|
val = substr($0, pos+1); gsub(/^ +| +$/, "", val)
|
||||||
|
before[slave SUBSEP name] = val
|
||||||
|
}
|
||||||
|
next }
|
||||||
|
{ if ($0 ~ /^\[/) slave=$0
|
||||||
|
else if ($0 ~ /=/) {
|
||||||
|
pos = index($0, "=")
|
||||||
|
name = substr($0, 1, pos-1); gsub(/^ +| +$/, "", name)
|
||||||
|
val = substr($0, pos+1); gsub(/^ +| +$/, "", val)
|
||||||
|
b = before[slave SUBSEP name]+0
|
||||||
|
d = val+0 - b
|
||||||
|
if (d != 0) printf " %-8s %-30s %12s -> %12s delta=%d\n", slave, name, b, val, d
|
||||||
|
} }
|
||||||
|
' "$1" "$2"
|
||||||
|
}
|
||||||
|
|
||||||
|
{
|
||||||
|
echo "=== LACP retransmit cause investigation ($ROLE) ==="
|
||||||
|
echo "Host: $HOST Role: $ROLE"
|
||||||
|
echo "Date: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
||||||
|
echo "Bond: $BOND"
|
||||||
|
echo ""
|
||||||
|
echo "--- bond0 hash + driver ---"
|
||||||
|
grep -E "Bonding Mode|Transmit Hash|Number of ports|Partner Mac" /proc/net/bonding/$BOND
|
||||||
|
# shellcheck disable=SC2013 # interface names contain no spaces; word-splitting is safe here
|
||||||
|
for s in $(awk '/^Slave Interface:/{print $3}' /proc/net/bonding/$BOND); do
|
||||||
|
drv=$(ethtool -i "$s" 2>/dev/null | awk -F: '/^driver:/{print $2}' | sed 's/^ *//')
|
||||||
|
speed=$(cat "/sys/class/net/$s/speed" 2>/dev/null)
|
||||||
|
ring=$(ethtool -g "$s" 2>/dev/null | awk '/RX:/{print $2; exit}')
|
||||||
|
printf " %-8s driver=%-20s speed=%-6s current RX ring=%s\n" "$s" "$drv" "$speed" "$ring"
|
||||||
|
done
|
||||||
|
echo ""
|
||||||
|
} | tee "$LOG"
|
||||||
|
|
||||||
|
echo "--- BEFORE snapshots ---"
|
||||||
|
nic_snapshot > "$TMP/nic_before"
|
||||||
|
softnet_snapshot > "$TMP/softnet_before"
|
||||||
|
tcp_snapshot > "$TMP/tcp_before"
|
||||||
|
|
||||||
|
if [ "$ROLE" = "receiver" ]; then
|
||||||
|
echo "[receiver] starting iperf3 -s -1 on $PEER_RX_IP ..."
|
||||||
|
pkill -x iperf3 2>/dev/null; sleep 0.5
|
||||||
|
nohup iperf3 -s -1 -B "$PEER_RX_IP" > "$TMP/iperf.out" 2>&1 &
|
||||||
|
SRV_PID=$!
|
||||||
|
for _ in $(seq 1 60); do kill -0 "$SRV_PID" 2>/dev/null || break; sleep 1; done
|
||||||
|
wait "$SRV_PID" 2>/dev/null
|
||||||
|
else
|
||||||
|
echo "[sender] waiting 3s for receiver to listen, then running iperf3 -P $STREAMS -t $DURATION ..."
|
||||||
|
sleep 3
|
||||||
|
iperf3 -c "$PEER_RX_IP" -B "$PEER_TX_IP" -P "$STREAMS" -t "$DURATION" -l 128k -O 2 \
|
||||||
|
> "$TMP/iperf.out" 2>&1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "--- AFTER snapshots ---"
|
||||||
|
nic_snapshot > "$TMP/nic_after"
|
||||||
|
softnet_snapshot > "$TMP/softnet_after"
|
||||||
|
tcp_snapshot > "$TMP/tcp_after"
|
||||||
|
|
||||||
|
{
|
||||||
|
echo ""
|
||||||
|
echo "--- iperf3 summary ---"
|
||||||
|
grep -E '\[SUM\].*(sender|receiver)' "$TMP/iperf.out" | tail -2
|
||||||
|
echo ""
|
||||||
|
echo "--- TCP SNMP deltas (/proc/net/snmp) ---"
|
||||||
|
# Show only the counters that changed
|
||||||
|
paste "$TMP/tcp_before" "$TMP/tcp_after" \
|
||||||
|
| awk '{
|
||||||
|
a=$3; b=$(NF)
|
||||||
|
if (a+0 != b+0) printf " %-22s %12s -> %12s delta=%d\n", $1, a, b, b-a
|
||||||
|
}'
|
||||||
|
echo ""
|
||||||
|
echo "--- softnet_stat deltas (look for non-zero dropped_delta/squeezed_delta) ---"
|
||||||
|
softnet_delta "$TMP/softnet_before" "$TMP/softnet_after"
|
||||||
|
echo ""
|
||||||
|
echo "--- NIC counter deltas (only non-zero) ---"
|
||||||
|
nic_delta "$TMP/nic_before" "$TMP/nic_after" "$HOST"
|
||||||
|
echo ""
|
||||||
|
echo "--- raw iperf3 tail (last 12 lines) ---"
|
||||||
|
tail -12 "$TMP/iperf.out"
|
||||||
|
echo ""
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " HOW TO READ THIS"
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " - If NIC rx_dropped / rx_missed_errors / rx_fifo_errors climbed:"
|
||||||
|
echo " -> ring buffers too small. Fix: ethtool -G \$IF rx 4096 (or max)."
|
||||||
|
echo " - If softnet_stat 'dropped' or 'squeezed' climbed on any CPU:"
|
||||||
|
echo " -> softirq starvation. Fix: increase net.core.netdev_budget,"
|
||||||
|
echo " check IRQ affinity, consider RPS."
|
||||||
|
echo " - If NEITHER of the above climbed but TCP RetransSegs did:"
|
||||||
|
echo " -> the retransmits are LACP reordering (out-of-order segments"
|
||||||
|
echo " triggering fast retransmit), NOT packet loss. NOT fixable."
|
||||||
|
echo "==================================================================="
|
||||||
|
} | tee -a "$LOG"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "Log: $LOG"
|
||||||
Executable
+153
@@ -0,0 +1,153 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
###############################################################################
|
||||||
|
# lacp-rx-distribution.sh (HOST-NATIVE version)
|
||||||
|
#
|
||||||
|
# Runs ON a host (tsys6 or tsys7). Auto-detects role by hostname:
|
||||||
|
# - On tsys6 (receiver): starts iperf3 -s -1 (one-shot), snapshots local
|
||||||
|
# bond0 slave RX counters before+after, writes verdict + log.
|
||||||
|
# - On tsys7 (sender): snapshots local bond0 slave TX counters before+
|
||||||
|
# after, runs iperf3 -c <peer> -P 8 -t 12.
|
||||||
|
#
|
||||||
|
# Each side writes only its own counters. No inter-host SSH required.
|
||||||
|
# iperf3 -s -1 (one-shot) handles client/server coordination.
|
||||||
|
#
|
||||||
|
# Output: /root/lacp-rx-{receiver,sender}.log
|
||||||
|
###############################################################################
|
||||||
|
set -uo pipefail
|
||||||
|
|
||||||
|
DURATION="${LACP_TEST_SECS:-12}"
|
||||||
|
STREAMS="${LACP_STREAMS:-8}"
|
||||||
|
PEER_RX_IP="10.100.100.6" # tsys6 storage IP (receiver)
|
||||||
|
PEER_TX_IP="10.100.100.7" # tsys7 storage IP (sender)
|
||||||
|
LOG_DIR="/root"
|
||||||
|
BOND="bond0"
|
||||||
|
|
||||||
|
# Snapshot per-slave byte counters from $BOND. Output: "<slave> rx tx\n" sorted.
|
||||||
|
snapshot() {
|
||||||
|
awk '/^Slave Interface:/{print $3}' "/proc/net/bonding/$BOND" | while read -r s; do
|
||||||
|
[ -n "$s" ] || continue
|
||||||
|
rx=$(cat "/sys/class/net/$s/statistics/rx_bytes" 2>/dev/null || echo 0)
|
||||||
|
tx=$(cat "/sys/class/net/$s/statistics/tx_bytes" 2>/dev/null || echo 0)
|
||||||
|
printf '%s %s %s\n' "$s" "$rx" "$tx"
|
||||||
|
done | sort
|
||||||
|
}
|
||||||
|
|
||||||
|
# Compute per-slave deltas. $1=label, $2=col(2=rx,3=tx), $3=before, $4=after.
|
||||||
|
analyze() {
|
||||||
|
local label="$1" col="$2" before="$3" after="$4"
|
||||||
|
join "$before" "$after" | awk -v col="$col" -v lbl="$label" '
|
||||||
|
{
|
||||||
|
slave=$1
|
||||||
|
b = (col==2 ? $2 : $3)+0
|
||||||
|
a = (col==2 ? $4 : $5)+0
|
||||||
|
d = a - b; if (d < 0) d = 0
|
||||||
|
delta[slave]=d; bef[slave]=b; aft[slave]=a
|
||||||
|
order[++n]=slave; total+=d
|
||||||
|
}
|
||||||
|
END {
|
||||||
|
printf "\n--- %s (bytes) ---\n", lbl
|
||||||
|
printf " %-12s %14s %14s %14s %8s\n", "SLAVE", "BEFORE", "AFTER", "DELTA", "PCT"
|
||||||
|
for (i=1;i<=n;i++){
|
||||||
|
s=order[i]
|
||||||
|
pct = (total>0 ? 100*delta[s]/total : 0)
|
||||||
|
printf " %-12s %14d %14d %14d %7.1f%%\n", s, bef[s], aft[s], delta[s], pct
|
||||||
|
}
|
||||||
|
printf " %-12s %14s %14s %14d %8s\n", "TOTAL", "", "", total, "100.0%"
|
||||||
|
}'
|
||||||
|
}
|
||||||
|
|
||||||
|
# Dominant-slave pct for the verdict line. $1=col, $2=before, $3=after.
|
||||||
|
dominant() {
|
||||||
|
join "$2" "$3" | awk -v col="$1" '
|
||||||
|
{ b=(col==2?$2:$3)+0; a=(col==2?$4:$5)+0; d=a-b; if(d<0)d=0; tot+=d; delta[$1]=d }
|
||||||
|
END { m=0; ms=""; for (s in delta){ if (delta[s]>m){m=delta[s]; ms=s} }
|
||||||
|
printf "%.1f %s", (tot>0?100*m/tot:0), ms }'
|
||||||
|
}
|
||||||
|
|
||||||
|
HOST="$(uname -n)"
|
||||||
|
HOST="${HOST%%.*}"
|
||||||
|
case "$HOST" in
|
||||||
|
*tsys6) ROLE="receiver"; LOG="$LOG_DIR/lacp-rx-receiver.log" ;;
|
||||||
|
*tsys7) ROLE="sender"; LOG="$LOG_DIR/lacp-rx-sender.log" ;;
|
||||||
|
*) echo "ERROR: not running on tsys6 or tsys7 (hostname=$HOST)"; exit 2 ;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
TMP="$(mktemp -d)"
|
||||||
|
trap 'rm -rf "$TMP"' EXIT
|
||||||
|
|
||||||
|
{
|
||||||
|
echo "=== LACP per-slave distribution ($ROLE) ==="
|
||||||
|
echo "Host: $HOST Role: $ROLE"
|
||||||
|
echo "Date: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
||||||
|
echo "Bond: $BOND"
|
||||||
|
echo ""
|
||||||
|
echo "--- $BOND state ---"
|
||||||
|
grep -E "Bonding Mode|Transmit Hash|Number of ports|Partner Mac|Slave Interface|Link" \
|
||||||
|
"/proc/net/bonding/$BOND" 2>&1
|
||||||
|
echo ""
|
||||||
|
} | tee "$LOG"
|
||||||
|
|
||||||
|
snapshot > "$TMP/before"
|
||||||
|
|
||||||
|
if [ "$ROLE" = "receiver" ]; then
|
||||||
|
echo "[receiver] starting one-shot iperf3 server on $PEER_RX_IP ..."
|
||||||
|
pkill -x iperf3 2>/dev/null; sleep 0.5
|
||||||
|
nohup iperf3 -s -1 -B "$PEER_RX_IP" > "$TMP/iperf.out" 2>&1 &
|
||||||
|
SRV_PID=$!
|
||||||
|
# Wait for the server to be ready (brief), then wait for it to exit
|
||||||
|
# (one-shot server exits after serving one client).
|
||||||
|
for _ in $(seq 1 60); do
|
||||||
|
kill -0 "$SRV_PID" 2>/dev/null || break
|
||||||
|
sleep 1
|
||||||
|
done
|
||||||
|
wait "$SRV_PID" 2>/dev/null
|
||||||
|
echo "[receiver] iperf3 server finished."
|
||||||
|
else
|
||||||
|
# sender: wait briefly for receiver to be listening, then run client.
|
||||||
|
echo "[sender] waiting 3s for receiver to listen, then running iperf3 client..."
|
||||||
|
sleep 3
|
||||||
|
iperf3 -c "$PEER_RX_IP" -B "$PEER_TX_IP" -P "$STREAMS" -t "$DURATION" -l 128k -O 2 \
|
||||||
|
> "$TMP/iperf.out" 2>&1
|
||||||
|
echo "[sender] iperf3 client finished (exit=$?)."
|
||||||
|
fi
|
||||||
|
|
||||||
|
snapshot > "$TMP/after"
|
||||||
|
|
||||||
|
{
|
||||||
|
echo ""
|
||||||
|
echo "--- iperf3 output (raw tail) ---"
|
||||||
|
tail -25 "$TMP/iperf.out"
|
||||||
|
echo ""
|
||||||
|
if [ "$ROLE" = "receiver" ]; then
|
||||||
|
analyze "Receiver RX (THE key column)" 2 "$TMP/before" "$TMP/after"
|
||||||
|
dom="$(dominant 2 "$TMP/before" "$TMP/after")"
|
||||||
|
pct=${dom%% *}; top=${dom##* }
|
||||||
|
echo ""
|
||||||
|
echo "==================================================================="
|
||||||
|
if awk -v p="$pct" 'BEGIN{exit !(p>=90)}'; then
|
||||||
|
echo " VERDICT: SWITCH NOT distributing across $HOST's two ports"
|
||||||
|
echo " Dominant slave '$top' = ${pct}% of RX -> hash not effective"
|
||||||
|
echo " on this LAG. Action: verify/bounce pfv-r3-tor-stor port-channel."
|
||||||
|
else
|
||||||
|
echo " VERDICT: switch IS distributing (top slave '$top' = ${pct}%)."
|
||||||
|
echo " Cap is host-side: softirq/CPU/bridge/NIC coalescing."
|
||||||
|
fi
|
||||||
|
echo "==================================================================="
|
||||||
|
else
|
||||||
|
analyze "Sender TX (control: should split if host hash=layer3+4)" 3 "$TMP/before" "$TMP/after"
|
||||||
|
dom="$(dominant 3 "$TMP/before" "$TMP/after")"
|
||||||
|
pct=${dom%% *}; top=${dom##* }
|
||||||
|
echo ""
|
||||||
|
echo "==================================================================="
|
||||||
|
if awk -v p="$pct" 'BEGIN{exit !(p>=90)}'; then
|
||||||
|
echo " VERDICT: host TX NOT distributing (top slave '$top' = ${pct}%)."
|
||||||
|
echo " Host xmit_hash_policy is NOT effective despite /proc/net/bonding."
|
||||||
|
else
|
||||||
|
echo " VERDICT: host TX distributing OK (top slave '$top' = ${pct}%)."
|
||||||
|
fi
|
||||||
|
echo "==================================================================="
|
||||||
|
fi
|
||||||
|
} | tee -a "$LOG"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "Log written: $LOG"
|
||||||
@@ -0,0 +1,137 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
# lib/common.sh — shared helpers for shell scripts and hooks in this repo.
|
||||||
|
#
|
||||||
|
# Source it from any script:
|
||||||
|
# #!/usr/bin/env bash
|
||||||
|
# set -euo pipefail
|
||||||
|
# HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||||
|
# # shellcheck source=lib/common.sh
|
||||||
|
# source "$HERE/lib/common.sh" # or the appropriate relative path
|
||||||
|
#
|
||||||
|
# This library exists to drive a known cross-project inconsistency to zero:
|
||||||
|
# every repo used to re-paste the ANSI color block, redefine log_* helpers,
|
||||||
|
# pick one of three incompatible shebangs, and roll its own docker wrapper.
|
||||||
|
# Import this once instead.
|
||||||
|
|
||||||
|
# Do NOT set -euo pipefail here unconditionally — some callers (git hooks)
|
||||||
|
# source this file and rely on controlling their own shell options. We only
|
||||||
|
# guarantee the functions below are defined.
|
||||||
|
|
||||||
|
###############################################################################
|
||||||
|
# Config — override via environment before sourcing if needed
|
||||||
|
###############################################################################
|
||||||
|
: "${TEMPLATE_ROOT:=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
|
||||||
|
export TEMPLATE_ROOT
|
||||||
|
|
||||||
|
###############################################################################
|
||||||
|
# ANSI colors (defined once, used everywhere)
|
||||||
|
###############################################################################
|
||||||
|
if [ -t 1 ] && [ -z "${NO_COLOR:-}" ]; then
|
||||||
|
RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'
|
||||||
|
BLUE='\033[0;34m'; BOLD='\033[1m'; NC='\033[0m'
|
||||||
|
else
|
||||||
|
RED=''; GREEN=''; YELLOW=''; BLUE=''; BOLD=''; NC=''
|
||||||
|
fi
|
||||||
|
export RED GREEN YELLOW BLUE BOLD NC
|
||||||
|
|
||||||
|
###############################################################################
|
||||||
|
# Logging
|
||||||
|
###############################################################################
|
||||||
|
log_info() { printf "${BLUE}›${NC} %s\n" "$*"; }
|
||||||
|
log_ok() { printf "${GREEN}✓${NC} %s\n" "$*"; }
|
||||||
|
log_warn() { printf "${YELLOW}⚠${NC} %s\n" "$*" >&2; }
|
||||||
|
log_error() { printf "${RED}✗${NC} %s\n" "$*" >&2; }
|
||||||
|
log_step() { printf "\n${BOLD}== %s ==${NC}\n" "$*"; }
|
||||||
|
|
||||||
|
die() { log_error "$*"; exit 1; }
|
||||||
|
|
||||||
|
###############################################################################
|
||||||
|
# Predicates
|
||||||
|
###############################################################################
|
||||||
|
# have <cmd> — return 0 if <cmd> is on PATH
|
||||||
|
have() { command -v "$1" >/dev/null 2>&1; }
|
||||||
|
|
||||||
|
###############################################################################
|
||||||
|
# Path helpers
|
||||||
|
###############################################################################
|
||||||
|
repo_root() {
|
||||||
|
# Prefer git's notion of the repo root, fall back to $TEMPLATE_ROOT, then pwd.
|
||||||
|
if git rev-parse --show-toplevel >/dev/null 2>&1; then
|
||||||
|
git rev-parse --show-toplevel
|
||||||
|
else
|
||||||
|
printf '%s\n' "${TEMPLATE_ROOT:-$(pwd)}"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
###############################################################################
|
||||||
|
# Privilege helpers
|
||||||
|
###############################################################################
|
||||||
|
# as_root — run the remaining args as root via sudo, or directly if already root.
|
||||||
|
as_root() {
|
||||||
|
if [ "$(id -u)" -eq 0 ]; then "$@"; else sudo "$@"; fi
|
||||||
|
}
|
||||||
|
|
||||||
|
###############################################################################
|
||||||
|
# Docker wrapper
|
||||||
|
###############################################################################
|
||||||
|
# docker_run <image> <args...>
|
||||||
|
# Ephemeral container, host-uid ownership, repo mounted at /data, cwd /data.
|
||||||
|
# Drives the "host stays clean; everything runs in containers" policy and
|
||||||
|
# ensures output files are owned by the invoking user, not root.
|
||||||
|
docker_run() {
|
||||||
|
[ "$#" -ge 1 ] || die "docker_run: image required"
|
||||||
|
local image="$1"; shift
|
||||||
|
have docker || die "docker not found on PATH"
|
||||||
|
local root
|
||||||
|
root="$(repo_root)"
|
||||||
|
docker run --rm \
|
||||||
|
--user "$(id -u):$(id -g)" \
|
||||||
|
-e HOME=/tmp \
|
||||||
|
-v "$root:/data" \
|
||||||
|
-w /data \
|
||||||
|
"$image" "$@"
|
||||||
|
}
|
||||||
|
|
||||||
|
###############################################################################
|
||||||
|
# Rule-audit accumulator (used by scripts/check-rules.sh)
|
||||||
|
# Globals read/written: RULE_PASS RULE_WARN RULE_FAIL
|
||||||
|
###############################################################################
|
||||||
|
init_counters() { RULE_PASS=0; RULE_WARN=0; RULE_FAIL=0; }
|
||||||
|
|
||||||
|
# check <description> <pass|warn|fail>
|
||||||
|
check() {
|
||||||
|
local desc="$1" result="$2"
|
||||||
|
case "$result" in
|
||||||
|
pass)
|
||||||
|
RULE_PASS=$((RULE_PASS + 1))
|
||||||
|
if [ "${RULE_VERBOSE:-true}" = true ]; then printf " ${GREEN}PASS${NC} %s\n" "$desc"; fi
|
||||||
|
;;
|
||||||
|
warn)
|
||||||
|
RULE_WARN=$((RULE_WARN + 1))
|
||||||
|
if [ "${RULE_VERBOSE:-true}" = true ]; then printf " ${YELLOW}WARN${NC} %s\n" "$desc"; fi
|
||||||
|
;;
|
||||||
|
fail)
|
||||||
|
RULE_FAIL=$((RULE_FAIL + 1))
|
||||||
|
printf " ${RED}FAIL${NC} %s\n" "$desc"
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
die "check(): invalid result '$result' (use pass|warn|fail)"
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
}
|
||||||
|
|
||||||
|
# print_summary_and_exit
|
||||||
|
print_summary_and_exit() {
|
||||||
|
if [ "${RULE_VERBOSE:-true}" = true ]; then
|
||||||
|
printf "\n=== Summary ===\n PASS: %s\n WARN: %s\n FAIL: %s\n\n" \
|
||||||
|
"$RULE_PASS" "$RULE_WARN" "$RULE_FAIL"
|
||||||
|
fi
|
||||||
|
if [ "$RULE_FAIL" -gt 0 ]; then
|
||||||
|
if [ "${RULE_VERBOSE:-true}" = true ]; then
|
||||||
|
printf "AUDIT FAILED — %s rule(s) violated.\n" "$RULE_FAIL"
|
||||||
|
fi
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
if [ "${RULE_VERBOSE:-true}" = true ]; then printf "AUDIT PASSED.\n"; fi
|
||||||
|
exit 0
|
||||||
|
}
|
||||||
Executable
+242
@@ -0,0 +1,242 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
###############################################################################
|
||||||
|
# perf-matrix.sh — Any-to-any performance testing across the PFVCluster
|
||||||
|
#
|
||||||
|
# Tests three network planes:
|
||||||
|
# A. Datanet (VLAN 1000): hypervisor-to-hypervisor over storage network
|
||||||
|
# B. Guest-to-guest: k8s/ultix VMs over datanet (10.100.100.x)
|
||||||
|
# C. Storage I/O: dd read/write to NFS mounts
|
||||||
|
#
|
||||||
|
# Prerequisites:
|
||||||
|
# - iperf3 installed on all hosts (systemd service: iperf3-server)
|
||||||
|
# - iperf3 installed inside guest VMs
|
||||||
|
# - SSH key + passwordless sudo on all guest VMs (remote.sh; sshd is the
|
||||||
|
# only approved access channel — see AGENTS.md)
|
||||||
|
#
|
||||||
|
# Usage:
|
||||||
|
# bash perf-matrix.sh # run all tests
|
||||||
|
# bash perf-matrix.sh datanet # host-to-host datanet only
|
||||||
|
# bash perf-matrix.sh guests # guest-to-guest datanet only
|
||||||
|
# bash perf-matrix.sh storage # NFS I/O only
|
||||||
|
#
|
||||||
|
# Environment:
|
||||||
|
# REMOTE_SH path to tests/remote.sh (auto-detected)
|
||||||
|
###############################################################################
|
||||||
|
set -uo pipefail
|
||||||
|
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||||
|
REMOTE_SH="${REMOTE_SH:-$(cd "$SCRIPT_DIR/../../.." && pwd)/tests/remote.sh}"
|
||||||
|
LOG_DIR="$(cd "$SCRIPT_DIR/.." && pwd)/returned-logs"
|
||||||
|
mkdir -p "$LOG_DIR"
|
||||||
|
TIMESTAMP="$(date +%Y%m%d-%H%M%S)"
|
||||||
|
|
||||||
|
# --- Host datanet IPs (VLAN 1000) ---
|
||||||
|
declare -A DATANET_IP
|
||||||
|
DATANET_IP[pfv-tsys1]="10.100.100.1"
|
||||||
|
DATANET_IP[pfv-tsys3]="10.100.100.3"
|
||||||
|
DATANET_IP[pfv-tsys4]="10.100.100.4"
|
||||||
|
DATANET_IP[pfv-tsys5]="10.100.100.5"
|
||||||
|
DATANET_IP[pfv-tsys6]="10.100.100.6"
|
||||||
|
DATANET_IP[pfv-tsys7]="10.100.100.7"
|
||||||
|
DATANET_IP[pfv-tsys9]="10.100.100.9"
|
||||||
|
|
||||||
|
HOSTS="pfv-tsys1 pfv-tsys3 pfv-tsys4 pfv-tsys5 pfv-tsys6 pfv-tsys7 pfv-tsys9"
|
||||||
|
|
||||||
|
# --- k8s/ultix VM targets (SSH for control; datanet_ip for iperf traffic) ---
|
||||||
|
# Format: prox_host:vmid:datanet_ip:ssh_host:label
|
||||||
|
GUEST_TARGETS="
|
||||||
|
pfv-tsys1:102:10.100.100.10:pfv-k8s-cnode1:cnode1
|
||||||
|
pfv-tsys7:705:10.100.100.11:pfv-k8s-cnode2:cnode2
|
||||||
|
pfv-tsys6:603:10.100.100.12:pfv-k8s-cnode3:cnode3
|
||||||
|
pfv-tsys3:313:10.100.100.13:pfv-k8s-wnode-tsys3:wnode-tsys3
|
||||||
|
pfv-tsys5:500:10.100.100.14:pfv-k8s-wnode-tsys5:wnode-tsys5
|
||||||
|
pfv-tsys6:601:10.100.100.15:pfv-k8s-wnode-tsys6:wnode-tsys6
|
||||||
|
pfv-tsys7:701:10.100.100.16:pfv-k8s-wnode-tsys7:wnode-tsys7
|
||||||
|
pfv-tsys9:905:10.100.100.17:pfv-k8s-wnode-tsys9:wnode-tsys9
|
||||||
|
pfv-tsys5:5111:10.100.100.18:ultix-streaming:ultix-streaming
|
||||||
|
pfv-tsys5:5112:10.100.100.19:ultix-offstage:ultix-offstage
|
||||||
|
"
|
||||||
|
|
||||||
|
DURATION="${DURATION:-3}" # seconds per iperf3 test
|
||||||
|
STREAMS="${STREAMS:-4}" # parallel streams
|
||||||
|
|
||||||
|
# ============================================================================
|
||||||
|
# Helpers
|
||||||
|
# ============================================================================
|
||||||
|
start_iperf_servers() {
|
||||||
|
echo "--- Starting iperf3 servers on all hosts ---"
|
||||||
|
for h in $HOSTS; do
|
||||||
|
PROX_HOST="$h" bash "$REMOTE_SH" prox \
|
||||||
|
'systemctl start iperf3-server 2>/dev/null || iperf3 -s -D; echo ok' \
|
||||||
|
>/dev/null 2>&1 &
|
||||||
|
done
|
||||||
|
wait
|
||||||
|
echo " All servers started."
|
||||||
|
}
|
||||||
|
|
||||||
|
stop_iperf_servers() {
|
||||||
|
echo "--- Stopping iperf3 servers on all hosts ---"
|
||||||
|
for h in $HOSTS; do
|
||||||
|
PROX_HOST="$h" bash "$REMOTE_SH" prox \
|
||||||
|
'systemctl stop iperf3-server 2>/dev/null; pkill iperf3 2>/dev/null; true' \
|
||||||
|
>/dev/null 2>&1 &
|
||||||
|
done
|
||||||
|
wait
|
||||||
|
echo " All servers stopped."
|
||||||
|
}
|
||||||
|
|
||||||
|
# ============================================================================
|
||||||
|
# A. Host-to-host datanet matrix
|
||||||
|
# ============================================================================
|
||||||
|
test_datanet() {
|
||||||
|
echo ""
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " DATANET (VLAN 1000) — Host-to-Host Bandwidth Matrix"
|
||||||
|
echo " ${STREAMS} parallel streams, ${DURATION}s per test"
|
||||||
|
echo "==================================================================="
|
||||||
|
start_iperf_servers
|
||||||
|
|
||||||
|
local outfile="$LOG_DIR/datanet-host-${TIMESTAMP}.csv"
|
||||||
|
echo "host_from,host_to,mbps" > "$outfile"
|
||||||
|
|
||||||
|
for client in $HOSTS; do
|
||||||
|
for server in $HOSTS; do
|
||||||
|
[ "$client" = "$server" ] && continue
|
||||||
|
local sip="${DATANET_IP[$server]}"
|
||||||
|
local result
|
||||||
|
result=$(PROX_HOST="$client" bash "$REMOTE_SH" prox \
|
||||||
|
"iperf3 -c $sip -t $DURATION -P $STREAMS -f m 2>&1" </dev/null \
|
||||||
|
| awk '/SUM.*receiver/{printf "%.0f", $6}')
|
||||||
|
if [ -n "$result" ]; then
|
||||||
|
printf " %-14s → %-14s : %s Mbps\n" "$client" "$server" "$result"
|
||||||
|
echo "$client,$server,$result" >> "$outfile"
|
||||||
|
else
|
||||||
|
printf " %-14s → %-14s : FAIL\n" "$client" "$server"
|
||||||
|
echo "$client,$server,FAIL" >> "$outfile"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
done
|
||||||
|
|
||||||
|
stop_iperf_servers
|
||||||
|
echo ""
|
||||||
|
echo " Results saved: $outfile"
|
||||||
|
}
|
||||||
|
|
||||||
|
# ============================================================================
|
||||||
|
# B. Guest-to-guest datanet
|
||||||
|
# ============================================================================
|
||||||
|
test_guests() {
|
||||||
|
echo ""
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " DATANET (VLAN 1000) — Guest-to-Guest (k8s + ultix VMs)"
|
||||||
|
echo " ${STREAMS} parallel streams, ${DURATION}s per test"
|
||||||
|
echo "==================================================================="
|
||||||
|
|
||||||
|
# Start iperf3 server on the first guest (cnode1)
|
||||||
|
local server_entry
|
||||||
|
server_entry=$(echo "$GUEST_TARGETS" | head -2 | tail -1)
|
||||||
|
local s_ip s_ssh s_label
|
||||||
|
s_ip=$(echo "$server_entry" | cut -d: -f3)
|
||||||
|
s_ssh=$(echo "$server_entry" | cut -d: -f4)
|
||||||
|
s_label=$(echo "$server_entry" | cut -d: -f5)
|
||||||
|
|
||||||
|
echo " Starting iperf3 server on $s_label ($s_ip)..."
|
||||||
|
VM_IP="$s_ssh" bash "$REMOTE_SH" vmroot \
|
||||||
|
'pkill iperf3 2>/dev/null; iperf3 -s -D' >/dev/null 2>&1
|
||||||
|
sleep 1
|
||||||
|
|
||||||
|
local outfile="$LOG_DIR/datanet-guest-${TIMESTAMP}.csv"
|
||||||
|
echo "guest_from,guest_to,mbps" > "$outfile"
|
||||||
|
|
||||||
|
while read -r entry; do
|
||||||
|
[ -z "$entry" ] && continue
|
||||||
|
local c_ip c_ssh c_label
|
||||||
|
c_ip=$(echo "$entry" | cut -d: -f3)
|
||||||
|
c_ssh=$(echo "$entry" | cut -d: -f4)
|
||||||
|
c_label=$(echo "$entry" | cut -d: -f5)
|
||||||
|
[ "$c_ip" = "$s_ip" ] && continue
|
||||||
|
|
||||||
|
local result
|
||||||
|
result=$(VM_IP="$c_ssh" bash "$REMOTE_SH" vmroot \
|
||||||
|
"iperf3 -c $s_ip -t $DURATION -P $STREAMS -f m 2>&1" </dev/null \
|
||||||
|
| awk '/SUM.*receiver/{printf "%.0f", $6}')
|
||||||
|
if [ -n "$result" ]; then
|
||||||
|
printf " %-18s → %-18s : %s Mbps\n" "$c_label" "$s_label" "$result"
|
||||||
|
echo "$c_label,$s_label,$result" >> "$outfile"
|
||||||
|
else
|
||||||
|
printf " %-18s → %-18s : FAIL\n" "$c_label" "$s_label"
|
||||||
|
echo "$c_label,$s_label,FAIL" >> "$outfile"
|
||||||
|
fi
|
||||||
|
done <<< "$GUEST_TARGETS"
|
||||||
|
|
||||||
|
# Cleanup
|
||||||
|
VM_IP="$s_ssh" bash "$REMOTE_SH" vmroot \
|
||||||
|
'pkill iperf3' >/dev/null 2>&1
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo " Results saved: $outfile"
|
||||||
|
}
|
||||||
|
|
||||||
|
# ============================================================================
|
||||||
|
# C. Storage I/O (NFS read/write)
|
||||||
|
# ============================================================================
|
||||||
|
test_storage() {
|
||||||
|
echo ""
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " STORAGE I/O — NFS Read/Write (100MB dd)"
|
||||||
|
echo "==================================================================="
|
||||||
|
|
||||||
|
local outfile="$LOG_DIR/storage-io-${TIMESTAMP}.csv"
|
||||||
|
echo "host,mount,write_mbps,read_mbps" > "$outfile"
|
||||||
|
|
||||||
|
local ddscript="/tmp/perf-dd-$$.sh"
|
||||||
|
cat > "$ddscript" <<'DDSCRIPT'
|
||||||
|
#!/bin/bash
|
||||||
|
nfs=$(mount | awk '/type nfs/{print $3}' | grep -v proc)
|
||||||
|
for m in $nfs; do
|
||||||
|
tf="$m/.perf-$$"
|
||||||
|
w=$(dd if=/dev/zero of="$tf" bs=1M count=100 2>&1 | awk '/copied/{printf "%.0f", 100/($8+0.001)}')
|
||||||
|
r=$(dd if="$tf" of=/dev/null bs=1M 2>&1 | awk '/copied/{printf "%.0f", 100/($8+0.001)}')
|
||||||
|
rm -f "$tf" 2>/dev/null
|
||||||
|
echo "$m write=${w:-FAIL}MB/s read=${r:-N/A}MB/s"
|
||||||
|
done
|
||||||
|
DDSCRIPT
|
||||||
|
|
||||||
|
for h in $HOSTS; do
|
||||||
|
echo ""
|
||||||
|
echo " --- $h ---"
|
||||||
|
PROX_HOST="$h" bash "$REMOTE_SH" prox-file "$ddscript" 2>&1 | while read -r line; do
|
||||||
|
[ -n "$line" ] && echo " $line"
|
||||||
|
done
|
||||||
|
done
|
||||||
|
rm -f "$ddscript"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo " Results saved: $outfile"
|
||||||
|
}
|
||||||
|
|
||||||
|
# ============================================================================
|
||||||
|
# Main
|
||||||
|
# ============================================================================
|
||||||
|
MODE="${1:-all}"
|
||||||
|
|
||||||
|
case "$MODE" in
|
||||||
|
datanet|a) test_datanet ;;
|
||||||
|
guests|b) test_guests ;;
|
||||||
|
storage|c) test_storage ;;
|
||||||
|
all|"") test_datanet; test_guests; test_storage ;;
|
||||||
|
*)
|
||||||
|
echo "Usage: $0 [datanet|guests|storage|all]"
|
||||||
|
echo ""
|
||||||
|
echo " datanet — host-to-host bandwidth matrix over VLAN 1000"
|
||||||
|
echo " guests — guest-to-guest (k8s/ultix VMs over VLAN 1000)"
|
||||||
|
echo " storage — NFS read/write I/O"
|
||||||
|
echo " all — run all three (default)"
|
||||||
|
exit 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " Perf testing complete. Logs in: $LOG_DIR/"
|
||||||
|
echo "==================================================================="
|
||||||
Executable
+25
@@ -0,0 +1,25 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
# pre-commit — fast rule audit (< 1s typical).
|
||||||
|
# Hot-path bypass: commits that ONLY touch STATUS.md / WORKING.md skip the
|
||||||
|
# audit so frequent status/task commits stay frictionless.
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
REPO_ROOT="$(git rev-parse --show-toplevel)"
|
||||||
|
cd "$REPO_ROOT"
|
||||||
|
|
||||||
|
CHANGED="$(git diff --cached --name-only)"
|
||||||
|
HOT_PATHS="$(printf '%s\n' "$CHANGED" | grep -vE '^(STATUS.md|WORKING.md)$' || true)"
|
||||||
|
|
||||||
|
if [ -z "$HOT_PATHS" ]; then
|
||||||
|
echo "hot-path files only (STATUS/WORKING) — skipping rule audit"
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
if ! bash scripts/check-rules.sh --fast; then
|
||||||
|
echo ""
|
||||||
|
echo "pre-commit audit FAILED. Fix the violations above before committing."
|
||||||
|
echo "Full audit: bash scripts/check-rules.sh"
|
||||||
|
echo "Bypass: git commit --no-verify (emergencies only)"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
exit 0
|
||||||
Executable
+25
@@ -0,0 +1,25 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
# pre-push — full rule audit + clean-working-tree gate before pushing.
|
||||||
|
# Installed via: bash scripts/setup-hooks.sh
|
||||||
|
#
|
||||||
|
# Combines two proven policies observed across projects:
|
||||||
|
# - KNEL-AIMiddleware: block push if the working tree is dirty.
|
||||||
|
# - RCEO-PersonalAssistant: block push if the full test suite fails.
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
REPO_ROOT="$(git rev-parse --show-toplevel)"
|
||||||
|
cd "$REPO_ROOT"
|
||||||
|
|
||||||
|
echo "pre-push: running full rule audit..."
|
||||||
|
|
||||||
|
# Full audit (non-fast): runs the slow test suite via `make test` if present.
|
||||||
|
if ! bash scripts/check-rules.sh --quiet; then
|
||||||
|
echo ""
|
||||||
|
echo "pre-push audit FAILED. Push blocked."
|
||||||
|
echo "Re-run with output: bash scripts/check-rules.sh"
|
||||||
|
echo "Bypass: git push --no-verify (emergencies only)"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "pre-push: all rules and tests passed."
|
||||||
|
exit 0
|
||||||
@@ -0,0 +1,79 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# Read-only fleet drift probe — gathers package/tooling/config state for
|
||||||
|
# consistency comparison across hosts. Writes only stdout.
|
||||||
|
set -u
|
||||||
|
echo "===== DRIFT PROBE: $(hostname -s) $(date -u +%FT%TZ) ====="
|
||||||
|
echo
|
||||||
|
echo "##### OS / kernel / PVE #####"
|
||||||
|
pveversion 2>&1
|
||||||
|
cat /etc/debian_version 2>&1
|
||||||
|
echo
|
||||||
|
echo "##### Installed key packages (versions) #####"
|
||||||
|
dpkg-query -W -f='${Package}\t${Version}\n' 2>/dev/null | grep -iE 'lldpd|lldpad|smartmontools|nfs-common|nfs-kernel-server|iperf3|tcpdump|htop|rsyslog|qemu-guest-agent|snmpd|snmp|net-tools|ethtool|sysstat|ioping|fio|nvme-cli|conman|ser2net|nut-server|nut-client|tuned-adm|tuned' 2>/dev/null | sort
|
||||||
|
echo
|
||||||
|
echo "##### lldpcli present? #####"
|
||||||
|
command -v lldpcli >/dev/null 2>&1 && lldpcli -v 2>&1 | head -1 || echo "lldpcli: NOT INSTALLED"
|
||||||
|
echo
|
||||||
|
echo "##### lldpd service #####"
|
||||||
|
systemctl is-active lldpd 2>&1 || true
|
||||||
|
systemctl is-enabled lldpd 2>&1 || true
|
||||||
|
echo
|
||||||
|
echo "##### smartmontools service #####"
|
||||||
|
systemctl is-active smartd 2>&1 || echo "smartd: inactive/disabled"
|
||||||
|
systemctl is-enabled smartd 2>&1 || true
|
||||||
|
echo
|
||||||
|
echo "##### snmpd service #####"
|
||||||
|
systemctl is-active snmpd 2>&1 || echo "snmpd: not running"
|
||||||
|
systemctl is-enabled snmpd 2>&1 || true
|
||||||
|
echo
|
||||||
|
echo "##### rsyslog #####"
|
||||||
|
systemctl is-active rsyslog 2>&1 || echo "rsyslog: not running"
|
||||||
|
echo
|
||||||
|
echo "##### tuned profile #####"
|
||||||
|
tuned-adm active 2>&1 | head -2 || echo "tuned: not available"
|
||||||
|
echo
|
||||||
|
echo "##### sshd config (key settings) #####"
|
||||||
|
grep -E '^(PermitRootLogin|PasswordAuthentication|PubkeyAuthentication|KbdInteractiveAuthentication|Port |PermitEmptyPasswords)' /etc/ssh/sshd_config 2>/dev/null || echo "(defaults)"
|
||||||
|
grep -E '^(PermitRootLogin|PasswordAuthentication|PubkeyAuthentication|KbdInteractiveAuthentication|Port |PermitEmptyPasswords)' /etc/ssh/sshd_config.d/*.conf 2>/dev/null || true
|
||||||
|
echo
|
||||||
|
echo "##### authorized_keys (root) — count + key types #####"
|
||||||
|
if [ -f /root/.ssh/authorized_keys ]; then
|
||||||
|
echo " total keys: $(wc -l < /root/.ssh/authorized_keys)"
|
||||||
|
awk '{print " "$1}' /root/.ssh/authorized_keys | sort | uniq -c
|
||||||
|
else
|
||||||
|
echo " NO authorized_keys for root"
|
||||||
|
fi
|
||||||
|
echo
|
||||||
|
echo "##### ssh host key fingerprints #####"
|
||||||
|
for f in /etc/ssh/ssh_host_*_key.pub; do
|
||||||
|
[ -f "$f" ] && ssh-keygen -lf "$f" 2>/dev/null
|
||||||
|
done
|
||||||
|
echo
|
||||||
|
echo "##### sysctl tuning (key values) #####"
|
||||||
|
echo " net.core.rmem_max=$(cat /proc/sys/net/core/rmem_max 2>/dev/null)"
|
||||||
|
echo " net.core.wmem_max=$(cat /proc/sys/net/core/wmem_max 2>/dev/null)"
|
||||||
|
echo " net.ipv4.tcp_congestion_control=$(cat /proc/sys/net/ipv4/tcp_congestion_control 2>/dev/null)"
|
||||||
|
echo " net.ipv4.tcp_rmem=$(cat /proc/sys/net/ipv4/tcp_rmem 2>/dev/null)"
|
||||||
|
echo " net.ipv4.tcp_wmem=$(cat /proc/sys/net/ipv4/tcp_wmem 2>/dev/null)"
|
||||||
|
echo " net.ipv4.tcp_max_syn_backlog=$(cat /proc/sys/net/ipv4/tcp_max_syn_backlog 2>/dev/null)"
|
||||||
|
echo " net.core.netdev_max_backlog=$(cat /proc/sys/net/core/netdev_max_backlog 2>/dev/null)"
|
||||||
|
echo " vm.swappiness=$(cat /proc/sys/vm/swappiness 2>/dev/null)"
|
||||||
|
echo
|
||||||
|
echo "##### CPU governor #####"
|
||||||
|
cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor 2>/dev/null || echo "no cpufreq driver"
|
||||||
|
echo
|
||||||
|
echo "##### beszel agent? #####"
|
||||||
|
systemctl is-active beszel-hub 2>/dev/null || systemctl is-active beszel-agent 2>/dev/null || echo "beszel: not installed"
|
||||||
|
echo
|
||||||
|
echo "##### /root/bin or custom scripts present? #####"
|
||||||
|
# shellcheck disable=SC2012 # diagnostic listing, not for processing
|
||||||
|
find /root/bin/ -maxdepth 1 -type f 2>/dev/null | head -10 || echo "(no /root/bin)"
|
||||||
|
find /root/ -maxdepth 1 -name '*.sh' -type f 2>/dev/null | head -10 || echo "(no /root/*.sh)"
|
||||||
|
echo
|
||||||
|
echo "##### mount options (noatime check on root) #####"
|
||||||
|
mount | grep ' / ' | head -1
|
||||||
|
echo
|
||||||
|
echo "##### NFS server threads (if NFS server) #####"
|
||||||
|
grep -E '^[[:space:]]*RPCNFSDCOUNT' /etc/default/nfs-kernel-server 2>/dev/null || grep -E 'RPCNFSDCOUNT' /etc/default/nfs-kernel-server 2>/dev/null || echo "(default, not a NFS server or default threads)"
|
||||||
|
echo
|
||||||
|
echo "===== END $(hostname -s) ====="
|
||||||
@@ -0,0 +1,82 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
###############################################################################
|
||||||
|
# probe-network.sh
|
||||||
|
#
|
||||||
|
# READ-ONLY network + NFS ground-truth probe. Writes only stdout.
|
||||||
|
# Run on any Proxmox host to inventory its NICs, bonds, LLDP neighbors,
|
||||||
|
# NFS client mounts (including nconnect), ethtool link state, and error
|
||||||
|
# counters. No hardcoded values — fully portable.
|
||||||
|
#
|
||||||
|
# Usage (via tests/remote.sh):
|
||||||
|
# PROX_HOST=pfv-tsys6 bash tests/remote.sh prox-file perf/scripts/probe-network.sh
|
||||||
|
###############################################################################
|
||||||
|
set -u
|
||||||
|
echo "===== HOST: $(hostname -s) $(date -u +%FT%TZ) ====="
|
||||||
|
echo
|
||||||
|
echo "##### ip -br link #####"
|
||||||
|
ip -br link 2>&1
|
||||||
|
echo
|
||||||
|
echo "##### ip -br addr #####"
|
||||||
|
ip -br addr 2>&1
|
||||||
|
echo
|
||||||
|
echo "##### /etc/network/interfaces #####"
|
||||||
|
cat /etc/network/interfaces 2>&1
|
||||||
|
echo
|
||||||
|
echo "##### bond0 state (if present) #####"
|
||||||
|
if [ -r /proc/net/bonding/bond0 ]; then
|
||||||
|
cat /proc/net/bonding/bond0 2>&1
|
||||||
|
else
|
||||||
|
echo "(no bond0)"
|
||||||
|
fi
|
||||||
|
echo
|
||||||
|
echo "##### ethtool per physical NIC #####"
|
||||||
|
for nic in /sys/class/net/*; do
|
||||||
|
nic=$(basename "$nic")
|
||||||
|
case "$nic" in lo|bond*|br*|venet*|veth*|docker*|tap*|vnet*|fw*) continue;; esac
|
||||||
|
echo "--- ethtool $nic ---"
|
||||||
|
ethtool "$nic" 2>&1 | grep -iE 'Speed|Duplex|Port|Link|Supported link modes|Advertising|Auto-neg|Settings' || echo "(ethtool failed for $nic)"
|
||||||
|
done
|
||||||
|
echo
|
||||||
|
echo "##### lldpcli (if installed) #####"
|
||||||
|
if command -v lldpcli >/dev/null 2>&1; then
|
||||||
|
echo "--- lldpcli show neighbors ---"
|
||||||
|
lldpcli show neighbors 2>&1
|
||||||
|
echo
|
||||||
|
echo "--- lldpcli show interfaces ---"
|
||||||
|
lldpcli show interfaces 2>&1
|
||||||
|
echo
|
||||||
|
echo "--- lldpcli show chassis ---"
|
||||||
|
lldpcli show chassis 2>&1
|
||||||
|
else
|
||||||
|
echo "(lldpcli not installed)"
|
||||||
|
fi
|
||||||
|
echo
|
||||||
|
echo "##### lldpd / lldpad service #####"
|
||||||
|
systemctl is-active lldpd 2>&1 || true
|
||||||
|
systemctl is-enabled lldpd 2>&1 || true
|
||||||
|
echo
|
||||||
|
echo "##### NFS mounts (mount | grep nfs) #####"
|
||||||
|
mount | grep -i nfs 2>&1 || echo "(no nfs mounts)"
|
||||||
|
echo
|
||||||
|
echo "##### mount nconnect detail (nfsstat -m) #####"
|
||||||
|
nfsstat -m 2>&1
|
||||||
|
echo
|
||||||
|
echo "##### storage.cfg NFS stanzas (options) #####"
|
||||||
|
grep -A3 '^nfs:' /etc/pve/storage.cfg 2>&1
|
||||||
|
echo
|
||||||
|
echo "##### ip route #####"
|
||||||
|
ip route 2>&1
|
||||||
|
echo
|
||||||
|
echo "##### ethtool -S bond slaves (key counters) #####"
|
||||||
|
if [ -r /proc/net/bonding/bond0 ]; then
|
||||||
|
# shellcheck disable=SC2013 # intentional: extract NIC names from bonding info
|
||||||
|
for nic in $(grep -oE 'eth[0-9]+|en[psx][a-z0-9]+' /proc/net/bonding/bond0 2>/dev/null | sort -u); do
|
||||||
|
echo "--- ethtool -S $nic (errors) ---"
|
||||||
|
ethtool -S "$nic" 2>/dev/null | grep -iE 'error|drop|discard|crc|pause|miss' || echo "(no error counters)"
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
echo
|
||||||
|
echo "##### ip neigh (ARP table, reachable/stale) #####"
|
||||||
|
ip neigh show 2>&1 | grep -vE ' FAILED|INCOMPLETE' | sort -t. -k4 -n
|
||||||
|
echo
|
||||||
|
echo "===== END $(hostname -s) ====="
|
||||||
@@ -0,0 +1,75 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
###############################################################################
|
||||||
|
# probe-storage.sh
|
||||||
|
#
|
||||||
|
# READ-ONLY storage + disk ground-truth probe. Writes only stdout.
|
||||||
|
# Run on any Proxmox host (or any Linux NFS server) to inventory its physical
|
||||||
|
# disks, mounts, exports, SMART health, and Proxmox storage config.
|
||||||
|
#
|
||||||
|
# Portable: no hardcoded values. Uses only standard CLI tools + smartmontools.
|
||||||
|
#
|
||||||
|
# Usage (via tests/remote.sh):
|
||||||
|
# PROX_HOST=pfv-tsys4 bash tests/remote.sh prox-file perf/scripts/probe-storage.sh
|
||||||
|
#
|
||||||
|
# Or directly on a host:
|
||||||
|
# bash probe-storage.sh > storage-audit.txt
|
||||||
|
###############################################################################
|
||||||
|
set -u
|
||||||
|
echo "===== HOST: $(hostname -s) $(date -u +%FT%TZ) ====="
|
||||||
|
echo
|
||||||
|
echo "##### lsblk (tree, with model/serial/size/type) #####"
|
||||||
|
lsblk -o NAME,MAJ:MIN,SIZE,TYPE,MOUNTPOINT,MODEL,SERIAL,STATE,ROTA,TRAN,REV 2>&1
|
||||||
|
echo
|
||||||
|
echo "##### block devices by-id #####"
|
||||||
|
for dev in /dev/disk/by-id/*; do
|
||||||
|
[ -L "$dev" ] || continue
|
||||||
|
case "$(basename "$dev")" in *part[0-9]*) continue;; esac
|
||||||
|
ls -l "$dev"
|
||||||
|
done 2>&1
|
||||||
|
echo
|
||||||
|
echo "##### nvme list (if any) #####"
|
||||||
|
command -v nvme >/dev/null 2>&1 && nvme list 2>&1 || echo "(no nvme-cli or no nvme devices)"
|
||||||
|
echo
|
||||||
|
echo "##### blkid #####"
|
||||||
|
blkid 2>&1
|
||||||
|
echo
|
||||||
|
echo "##### mounted filesystems #####"
|
||||||
|
findmnt -o TARGET,SOURCE,FSTYPE,OPTIONS 2>&1
|
||||||
|
echo
|
||||||
|
echo "##### /etc/fstab #####"
|
||||||
|
cat /etc/fstab 2>&1
|
||||||
|
echo
|
||||||
|
echo "##### /etc/exports (+ exports.d) #####"
|
||||||
|
cat /etc/exports 2>&1
|
||||||
|
for f in /etc/exports.d/*.exports; do [ -f "$f" ] && echo "--- $f ---" && cat "$f"; done 2>&1
|
||||||
|
echo
|
||||||
|
echo "##### df -h (all mounts) #####"
|
||||||
|
df -h 2>&1
|
||||||
|
echo
|
||||||
|
echo "##### smartctl -a per block device #####"
|
||||||
|
command -v smartctl >/dev/null 2>&1 || echo "(smartctl not installed)"
|
||||||
|
for d in /dev/sd? /dev/nvme?n1; do
|
||||||
|
[ -b "$d" ] || continue
|
||||||
|
echo "----- smartctl -a $d -----"
|
||||||
|
smartctl -a "$d" 2>&1 | grep -iE 'Device Model|Model Number|Serial|Firmware|User Capacity|Rotation Rate|Form Factor|SATA Version|NVMe|SMART overall|Reallocated|Pending|Uncorrect|Power On|Temperature|Media and Data Integrity' || true
|
||||||
|
done
|
||||||
|
echo
|
||||||
|
echo "##### /etc/pve/storage.cfg #####"
|
||||||
|
cat /etc/pve/storage.cfg 2>&1
|
||||||
|
echo
|
||||||
|
echo "##### pvesm status #####"
|
||||||
|
pvesm status 2>&1
|
||||||
|
echo
|
||||||
|
echo "##### pvesm list per store #####"
|
||||||
|
for s in $(pvesm status 2>/dev/null | awk 'NR>1 && $3>0 {print $1}'); do
|
||||||
|
echo "--- pvesm list $s ---"
|
||||||
|
pvesm list "$s" 2>&1 | head -40
|
||||||
|
done
|
||||||
|
echo
|
||||||
|
echo "##### zpool status (if any) #####"
|
||||||
|
command -v zpool >/dev/null 2>&1 && zpool status 2>&1 || echo "(no zfs)"
|
||||||
|
echo
|
||||||
|
echo "##### lvm: pvs/vgs/lvs #####"
|
||||||
|
command -v pvs >/dev/null 2>&1 && { pvs 2>&1; echo; vgs 2>&1; echo; lvs 2>&1; } || echo "(no lvm tools)"
|
||||||
|
echo
|
||||||
|
echo "===== END $(hostname -s) ====="
|
||||||
@@ -0,0 +1,44 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# Read-only DNS consistency checker for Proxmox VMs.
|
||||||
|
# Checks that every running VM's name resolves to the IP it's actually using,
|
||||||
|
# and that reverse DNS (PTR) matches the VM name. Mismatches are reported as bugs.
|
||||||
|
set -u
|
||||||
|
echo "===== VM DNS CONSISTENCY CHECK: $(hostname -s) $(date -u +%FT%TZ) ====="
|
||||||
|
echo
|
||||||
|
echo "##### Running VMs with IPs (via guest-agent or ARP) #####"
|
||||||
|
|
||||||
|
for vmid in $(qm list 2>/dev/null | awk 'NR>1 && $4=="running" {print $1}'); do
|
||||||
|
name=$(qm config "$vmid" 2>/dev/null | awk '/^name:/{print $2}')
|
||||||
|
# Get the VM's net0 config to determine the bridge
|
||||||
|
net0=$(qm config "$vmid" 2>/dev/null | awk '/^net0:/{print $0}')
|
||||||
|
echo ""
|
||||||
|
echo "--- VMID $vmid: $name ---"
|
||||||
|
echo " net0: ${net0//net0: /}"
|
||||||
|
|
||||||
|
# Try to get IP via guest-agent
|
||||||
|
if qm config "$vmid" 2>/dev/null | grep -q 'agent:.*enabled=1\|^agent: 1'; then
|
||||||
|
guest_ips=$(qm guest cmd "$vmid" network-get-interfaces 2>/dev/null)
|
||||||
|
if [ -n "$guest_ips" ]; then
|
||||||
|
echo " guest-agent IPs:"
|
||||||
|
echo "$guest_ips" | python3 -c "
|
||||||
|
import sys, json
|
||||||
|
try:
|
||||||
|
data = json.load(sys.stdin)
|
||||||
|
for iface in data:
|
||||||
|
name = iface.get('name','?')
|
||||||
|
for addr in iface.get('ip-addresses',[]):
|
||||||
|
ip = addr.get('ip-address','')
|
||||||
|
typ = addr.get('ip-address-type','')
|
||||||
|
if typ == 'ipv4' and not ip.startswith('127.'):
|
||||||
|
print(f' {name}: {ip}')
|
||||||
|
except: pass
|
||||||
|
" 2>/dev/null
|
||||||
|
else
|
||||||
|
echo " guest-agent: no response"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
echo " guest-agent: not enabled"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
echo
|
||||||
|
echo "===== END $(hostname -s) ====="
|
||||||
@@ -0,0 +1,91 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
###############################################################################
|
||||||
|
# run-lacp-retrans-cause.sh (workstation wrapper)
|
||||||
|
#
|
||||||
|
# Deploys scripts/lacp-retrans-cause.sh to BOTH hosts, runs them in the
|
||||||
|
# right order, scps logs back, prints them.
|
||||||
|
###############################################################################
|
||||||
|
set -uo pipefail
|
||||||
|
|
||||||
|
SSH=(-o BatchMode=yes -o ConnectTimeout=8 -o ServerAliveInterval=10 \
|
||||||
|
-o StrictHostKeyChecking=accept-new)
|
||||||
|
SCP=(-o BatchMode=yes -o ConnectTimeout=8 -o StrictHostKeyChecking=accept-new)
|
||||||
|
|
||||||
|
RECV="pfv-tsys6"; SEND="pfv-tsys7"
|
||||||
|
LOCAL_LOG_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/returned-logs/iperf"
|
||||||
|
SCRIPT="lacp-retrans-cause.sh"
|
||||||
|
LOCAL_SCRIPT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/scripts/${SCRIPT}"
|
||||||
|
REMOTE_SCRIPT="/root/${SCRIPT}"
|
||||||
|
mkdir -p "$LOCAL_LOG_DIR"
|
||||||
|
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " LACP retransmit-cause investigation"
|
||||||
|
echo " Receiver: $RECV Sender: $SEND"
|
||||||
|
echo "==================================================================="
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo "--- preflight ---"
|
||||||
|
for h in "$RECV" "$SEND"; do
|
||||||
|
printf ' %-12s ' "$h"
|
||||||
|
ssh "${SSH[@]}" "root@$h" \
|
||||||
|
'command -v ethtool >/dev/null && e=OK || e=MISSING
|
||||||
|
command -v iperf3 >/dev/null && i=OK || i=MISSING
|
||||||
|
printf "ethtool=%s iperf3=%s host=%s\n" "$e" "$i" "$(uname -n)"' 2>&1 | head -1
|
||||||
|
done
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo "--- deploy ---"
|
||||||
|
for h in "$RECV" "$SEND"; do
|
||||||
|
printf ' %-12s ' "$h"
|
||||||
|
scp "${SCP[@]}" "$LOCAL_SCRIPT" "root@$h:$REMOTE_SCRIPT" >/dev/null 2>&1 \
|
||||||
|
&& ssh "${SSH[@]}" "root@$h" "chmod +x $REMOTE_SCRIPT" \
|
||||||
|
&& echo "deployed" || echo "FAILED"
|
||||||
|
done
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo "--- cleanup stale iperf3 ---"
|
||||||
|
for h in "$RECV" "$SEND"; do
|
||||||
|
ssh "${SSH[@]}" "root@$h" 'pkill -x iperf3 2>/dev/null; true' 2>/dev/null
|
||||||
|
done
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo "--- launching receiver on $RECV (background) ---"
|
||||||
|
ssh "${SSH[@]}" "root@$RECV" \
|
||||||
|
"nohup bash $REMOTE_SCRIPT > /root/lacp-retrans-receiver.console 2>&1 &" 2>/dev/null
|
||||||
|
sleep 5
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo "--- running sender on $SEND (foreground, ~20s) ---"
|
||||||
|
ssh "${SSH[@]}" "root@$SEND" "bash $REMOTE_SCRIPT" 2>&1 | sed 's/^/ [sender] /'
|
||||||
|
echo ""
|
||||||
|
sleep 3
|
||||||
|
|
||||||
|
echo "--- fetching logs ---"
|
||||||
|
for f in lacp-retrans-receiver.log lacp-retrans-receiver.console lacp-retrans-sender.log; do
|
||||||
|
src=""
|
||||||
|
case "$f" in
|
||||||
|
*receiver*) src="$RECV" ;;
|
||||||
|
*sender*) src="$SEND" ;;
|
||||||
|
esac
|
||||||
|
printf ' %-32s <- %s : ' "$f" "$src"
|
||||||
|
if scp "${SCP[@]}" "root@$src:/root/$f" "$LOCAL_LOG_DIR/$f" >/dev/null 2>&1; then
|
||||||
|
echo "OK ($(wc -c < "$LOCAL_LOG_DIR/$f" 2>/dev/null) bytes)"
|
||||||
|
else
|
||||||
|
echo "MISSING"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " RECEIVER LOG ($RECV)"
|
||||||
|
echo "==================================================================="
|
||||||
|
cat "$LOCAL_LOG_DIR/lacp-retrans-receiver.log" 2>/dev/null || echo "(missing)"
|
||||||
|
echo ""
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " SENDER LOG ($SEND)"
|
||||||
|
echo "==================================================================="
|
||||||
|
cat "$LOCAL_LOG_DIR/lacp-retrans-sender.log" 2>/dev/null || echo "(missing)"
|
||||||
|
echo ""
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " Local copies in: $LOCAL_LOG_DIR/"
|
||||||
|
echo "==================================================================="
|
||||||
Executable
+112
@@ -0,0 +1,112 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
###############################################################################
|
||||||
|
# run-lacp-rx-distribution.sh (workstation wrapper)
|
||||||
|
#
|
||||||
|
# One-shot orchestrator: deploys scripts/lacp-rx-distribution.sh to BOTH
|
||||||
|
# tsys6 (receiver) and tsys7 (sender), runs them in the right order, then
|
||||||
|
# scps both logs back to returned-logs/iperf/.
|
||||||
|
#
|
||||||
|
# Run from the workstation:
|
||||||
|
# bash scripts/run-lacp-rx-distribution.sh
|
||||||
|
#
|
||||||
|
# Idempotent: safe to re-run. iperf3 is killed on both hosts first.
|
||||||
|
###############################################################################
|
||||||
|
set -uo pipefail
|
||||||
|
|
||||||
|
SSH=(-o BatchMode=yes -o ConnectTimeout=8 -o ServerAliveInterval=10 \
|
||||||
|
-o StrictHostKeyChecking=accept-new)
|
||||||
|
SCP=(-o BatchMode=yes -o ConnectTimeout=8 -o StrictHostKeyChecking=accept-new)
|
||||||
|
|
||||||
|
RECV="pfv-tsys6" # receiver (we care most about its RX split)
|
||||||
|
SEND="pfv-tsys7" # sender (control: its TX split)
|
||||||
|
LOCAL_LOG_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/returned-logs/iperf"
|
||||||
|
SCRIPT="lacp-rx-distribution.sh"
|
||||||
|
LOCAL_SCRIPT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/scripts/${SCRIPT}"
|
||||||
|
REMOTE_SCRIPT="/root/${SCRIPT}"
|
||||||
|
|
||||||
|
mkdir -p "$LOCAL_LOG_DIR"
|
||||||
|
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " LACP per-slave RX/TX distribution test"
|
||||||
|
echo " Receiver: $RECV (10.100.100.6) Sender: $SEND (10.100.100.7)"
|
||||||
|
echo "==================================================================="
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# 0. Preflight: confirm SSH and iperf3 on both hosts
|
||||||
|
echo "--- preflight (ssh + iperf3 + bond0) ---"
|
||||||
|
for h in "$RECV" "$SEND"; do
|
||||||
|
printf ' %-12s ' "$h"
|
||||||
|
ssh "${SSH[@]}" "root@$h" \
|
||||||
|
'command -v iperf3 >/dev/null && ip=$(command -v iperf3) || ip=MISSING
|
||||||
|
[ -r /proc/net/bonding/bond0 ] && b=OK || b=NO-BOND0
|
||||||
|
printf "iperf3=%s bond0=%s host=%s\n" "$ip" "$b" "$(uname -n)"' \
|
||||||
|
2>&1 | head -1
|
||||||
|
done
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# 1. Copy the script to both hosts + chmod
|
||||||
|
echo "--- deploy $SCRIPT to both hosts ---"
|
||||||
|
for h in "$RECV" "$SEND"; do
|
||||||
|
printf ' %-12s ' "$h"
|
||||||
|
scp "${SCP[@]}" "$LOCAL_SCRIPT" "root@$h:$REMOTE_SCRIPT" >/dev/null 2>&1 \
|
||||||
|
&& ssh "${SSH[@]}" "root@$h" "chmod +x $REMOTE_SCRIPT" \
|
||||||
|
&& echo "deployed + chmod +x" \
|
||||||
|
|| echo "DEPLOY FAILED"
|
||||||
|
done
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# 2. Kill any stale iperf3 on both hosts
|
||||||
|
echo "--- cleanup stale iperf3 ---"
|
||||||
|
for h in "$RECV" "$SEND"; do
|
||||||
|
ssh "${SSH[@]}" "root@$h" 'pkill -x iperf3 2>/dev/null; true' 2>/dev/null
|
||||||
|
done
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# 3. Start RECEIVER in background (one-shot server, writes /root/lacp-rx-receiver.log)
|
||||||
|
echo "--- starting receiver on $RECV (background) ---"
|
||||||
|
ssh "${SSH[@]}" "root@$RECV" \
|
||||||
|
"nohup bash $REMOTE_SCRIPT > /root/lacp-rx-receiver.console 2>&1 &" 2>/dev/null
|
||||||
|
echo " receiver launched; waiting 5s for it to start iperf3 -s -1 ..."
|
||||||
|
sleep 5
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# 4. Run SENDER (foreground; ~15s with the default 12s test + 3s pre-sleep)
|
||||||
|
echo "--- running sender on $SEND (foreground, ~20s) ---"
|
||||||
|
ssh "${SSH[@]}" "root@$SEND" \
|
||||||
|
"bash $REMOTE_SCRIPT" 2>&1 | sed 's/^/ [sender] /'
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# 5. Give receiver a moment to finish writing its log
|
||||||
|
sleep 3
|
||||||
|
|
||||||
|
# 6. Fetch logs back
|
||||||
|
echo "--- fetching logs ---"
|
||||||
|
for f in lacp-rx-receiver.log lacp-rx-receiver.console lacp-rx-sender.log; do
|
||||||
|
src=""
|
||||||
|
case "$f" in
|
||||||
|
lacp-rx-receiver*) src="$RECV" ;;
|
||||||
|
lacp-rx-sender*) src="$SEND" ;;
|
||||||
|
esac
|
||||||
|
printf ' %-28s <- %s : ' "$f" "$src"
|
||||||
|
if scp "${SCP[@]}" "root@$src:/root/$f" "$LOCAL_LOG_DIR/$f" >/dev/null 2>&1; then
|
||||||
|
echo "OK ($(wc -c < "$LOCAL_LOG_DIR/$f" 2>/dev/null) bytes)"
|
||||||
|
else
|
||||||
|
echo "MISSING"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# 7. Show the receiver log (the decisive one)
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " RECEIVER LOG ($RECV — the decisive side)"
|
||||||
|
echo "==================================================================="
|
||||||
|
cat "$LOCAL_LOG_DIR/lacp-rx-receiver.log" 2>/dev/null || echo "(no log)"
|
||||||
|
echo ""
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " SENDER LOG ($SEND — control)"
|
||||||
|
echo "==================================================================="
|
||||||
|
cat "$LOCAL_LOG_DIR/lacp-rx-sender.log" 2>/dev/null || echo "(no log)"
|
||||||
|
echo ""
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " Local copies in: $LOCAL_LOG_DIR/"
|
||||||
|
echo "==================================================================="
|
||||||
Executable
+44
@@ -0,0 +1,44 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
# setup-hooks.sh — install this repo's git hooks.
|
||||||
|
#
|
||||||
|
# Mechanism: copy scripts/pre-commit and scripts/pre-push into .git/hooks/ and
|
||||||
|
# make them executable. This is the most portable pattern (works on any clone,
|
||||||
|
# no `git config core.hooksPath` mutation, survives config resets, idempotent).
|
||||||
|
#
|
||||||
|
# Run once after cloning: bash scripts/setup-hooks.sh
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
HERE="$(cd "$(dirname "$0")" && pwd)"
|
||||||
|
# shellcheck disable=SC1091
|
||||||
|
source "$HERE/lib/common.sh"
|
||||||
|
REPO_ROOT="$(repo_root)"
|
||||||
|
cd "$REPO_ROOT"
|
||||||
|
|
||||||
|
[ -d .git ] || die "no .git directory here — run this from a git checkout"
|
||||||
|
|
||||||
|
HOOKS_DIR=".git/hooks"
|
||||||
|
HOOK_NAMES="pre-commit pre-push"
|
||||||
|
|
||||||
|
log_step "Installing git hooks"
|
||||||
|
for name in $HOOK_NAMES; do
|
||||||
|
src="scripts/$name"
|
||||||
|
dst="$HOOKS_DIR/$name"
|
||||||
|
[ -f "$src" ] || die "source hook not found: $src"
|
||||||
|
cp "$src" "$dst"
|
||||||
|
chmod +x "$dst"
|
||||||
|
log_ok "installed $dst"
|
||||||
|
done
|
||||||
|
|
||||||
|
cat <<EOF
|
||||||
|
|
||||||
|
Git hooks installed. The following now run automatically:
|
||||||
|
|
||||||
|
pre-commit fast rule audit (shellcheck, image pinning, container naming,
|
||||||
|
required files, doc freshness, Discourse pointers, WORKING.md
|
||||||
|
completion, hygiene).
|
||||||
|
Hot-path bypass for STATUS.md / WORKING.md.
|
||||||
|
pre-push full rule audit (includes scripts/test.sh) + clean-working-tree gate.
|
||||||
|
|
||||||
|
Bypass either with \`git commit --no-verify\` / \`git push --no-verify\`
|
||||||
|
(emergencies only).
|
||||||
|
EOF
|
||||||
@@ -0,0 +1,253 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
"""
|
||||||
|
snmp-switch-audit.py — READ-ONLY switch inventory via SNMP.
|
||||||
|
|
||||||
|
Gathers interface status/speed/errors, LLDP neighbor topology, port-channel
|
||||||
|
(LAG) membership, and VLAN membership from any SNMPv2c-capable switch.
|
||||||
|
Designed for Dell/Radlan (Neyland) and standard IF/LLDP/Q-BRIDGE MIB switches,
|
||||||
|
but works on any SNMP-manageable device.
|
||||||
|
|
||||||
|
All parameters configurable via env vars or CLI flags so this works on any
|
||||||
|
network:
|
||||||
|
|
||||||
|
SNMP_COMMUNITY SNMPv2c community string (env, default: public)
|
||||||
|
SWITCH_IPS space-separated switch IPs (env, or pass as args)
|
||||||
|
OUTPUT_DIR where to write per-switch (env, default: returned-logs/snmp)
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
SNMP_COMMUNITY=kn3lmgmt SWITCH_IPS="192.168.0.9 192.168.0.12" \\
|
||||||
|
python3 snmp-switch-audit.py
|
||||||
|
|
||||||
|
# or pass IPs as positional args:
|
||||||
|
SNMP_COMMUNITY=kn3lmgmt python3 snmp-switch-audit.py 192.168.0.9 192.168.0.12
|
||||||
|
|
||||||
|
Requires: pysnmp (pip install pysnmp) or net-snmp utils (snmpwalk) on PATH.
|
||||||
|
Outputs: per-switch JSON + human-readable text in OUTPUT_DIR.
|
||||||
|
|
||||||
|
Read-only: sends only SNMP GET/GETNEXT/GETBULK. Never SETs anything.
|
||||||
|
"""
|
||||||
|
import argparse
|
||||||
|
import json
|
||||||
|
import os
|
||||||
|
import re
|
||||||
|
import subprocess
|
||||||
|
import sys
|
||||||
|
|
||||||
|
COMMUNITY = os.environ.get("SNMP_COMMUNITY", "public")
|
||||||
|
OUTPUT_DIR = os.environ.get("OUTPUT_DIR",
|
||||||
|
os.path.join(os.path.dirname(__file__), "..",
|
||||||
|
"..", "returned-logs", "snmp"))
|
||||||
|
|
||||||
|
# OID constants
|
||||||
|
OID_SYSDESCR = "1.3.6.1.2.1.1.1.0"
|
||||||
|
OID_SYSNAME = "1.3.6.1.2.1.1.5.0"
|
||||||
|
OID_IF_NAME = "1.3.6.1.2.1.31.1.1.1.1"
|
||||||
|
OID_IF_SPEED = "1.3.6.1.2.1.2.2.1.5"
|
||||||
|
OID_IF_OPER = "1.3.6.1.2.1.2.2.1.8"
|
||||||
|
OID_IF_INERR = "1.3.6.1.2.1.2.2.1.14"
|
||||||
|
OID_IF_OUTERR = "1.3.6.1.2.1.2.2.1.20"
|
||||||
|
OID_IF_INOCT = "1.3.6.1.2.1.31.1.1.1.6"
|
||||||
|
OID_IF_OUTOCT = "1.3.6.1.2.1.31.1.1.1.10"
|
||||||
|
OID_LACP_LAG = "1.2.840.10006.300.43.1.1.1.1"
|
||||||
|
OID_LLDP_REM_PORT = "1.0.8802.1.1.2.1.4.1.1.7"
|
||||||
|
OID_LLDP_REM_SYSNAME = "1.0.8802.1.1.2.1.4.1.1.9"
|
||||||
|
OID_LLDP_REM_CHASSIS = "1.0.8802.1.1.2.1.4.1.1.6"
|
||||||
|
OID_LLDP_REM_LOCALPORT = "1.0.8802.1.1.2.1.4.1.1.3"
|
||||||
|
OID_QBRIDGE_VLAN = "1.3.6.1.2.1.17.7.1.4.3.1.1"
|
||||||
|
|
||||||
|
|
||||||
|
def snmpget(ip, oid):
|
||||||
|
"""Single SNMP GET, returns string value or None."""
|
||||||
|
try:
|
||||||
|
r = subprocess.run(
|
||||||
|
["snmpget", "-Oqv", "-v2c", "-c", COMMUNITY, ip, oid],
|
||||||
|
capture_output=True, text=True, timeout=10)
|
||||||
|
if r.returncode == 0 and r.stdout.strip():
|
||||||
|
return r.stdout.strip().strip('"')
|
||||||
|
except (subprocess.TimeoutExpired, FileNotFoundError):
|
||||||
|
pass
|
||||||
|
return None
|
||||||
|
|
||||||
|
|
||||||
|
def snmpwalk(ip, oid):
|
||||||
|
"""SNMP BULKWALK, returns dict of ifIndex -> value."""
|
||||||
|
try:
|
||||||
|
r = subprocess.run(
|
||||||
|
["snmpbulkwalk", "-Oqv", "-v2c", "-c", COMMUNITY, ip, oid],
|
||||||
|
capture_output=True, text=True, timeout=30)
|
||||||
|
if r.returncode != 0:
|
||||||
|
r = subprocess.run(
|
||||||
|
["snmpwalk", "-Oqv", "-v2c", "-c", COMMUNITY, ip, oid],
|
||||||
|
capture_output=True, text=True, timeout=30)
|
||||||
|
except (subprocess.TimeoutExpired, FileNotFoundError):
|
||||||
|
return {}
|
||||||
|
result = {}
|
||||||
|
for i, line in enumerate(r.stdout.strip().split("\n"), 1):
|
||||||
|
line = line.strip().strip('"')
|
||||||
|
if line:
|
||||||
|
result[i] = line
|
||||||
|
return result
|
||||||
|
|
||||||
|
|
||||||
|
def walk_indexed(ip, oid):
|
||||||
|
"""SNMP walk preserving OID index. Returns dict: index_str -> value."""
|
||||||
|
try:
|
||||||
|
r = subprocess.run(
|
||||||
|
["snmpbulkwalk", "-v2c", "-c", COMMUNITY, ip, oid],
|
||||||
|
capture_output=True, text=True, timeout=30)
|
||||||
|
if r.returncode != 0:
|
||||||
|
r = subprocess.run(
|
||||||
|
["snmpwalk", "-v2c", "-c", COMMUNITY, ip, oid],
|
||||||
|
capture_output=True, text=True, timeout=30)
|
||||||
|
except (subprocess.TimeoutExpired, FileNotFoundError):
|
||||||
|
return {}
|
||||||
|
result = {}
|
||||||
|
for line in r.stdout.strip().split("\n"):
|
||||||
|
m = re.search(r'(\d+)\s*=\s*(.+)', line)
|
||||||
|
if not m:
|
||||||
|
m = re.search(r'\.(\d+)\s*=\s*(.+)', line)
|
||||||
|
if m:
|
||||||
|
idx = m.group(1).split(".")[-1]
|
||||||
|
val = m.group(2).strip()
|
||||||
|
val = re.sub(r'^(INTEGER: |STRING: |Hex-STRING: |Gauge32: |Counter32: |Counter64: )', '', val)
|
||||||
|
result[idx] = val
|
||||||
|
return result
|
||||||
|
|
||||||
|
|
||||||
|
def audit_switch(ip):
|
||||||
|
"""Gather all data for one switch."""
|
||||||
|
data = {"ip": ip}
|
||||||
|
data["sysDescr"] = snmpget(ip, OID_SYSDESCR)
|
||||||
|
data["sysName"] = snmpget(ip, OID_SYSNAME)
|
||||||
|
if not data["sysDescr"]:
|
||||||
|
return data
|
||||||
|
|
||||||
|
names = snmpwalk(ip, OID_IF_NAME)
|
||||||
|
speeds = snmpwalk(ip, OID_IF_SPEED)
|
||||||
|
oper = snmpwalk(ip, OID_IF_OPER)
|
||||||
|
inerr = snmpwalk(ip, OID_IF_INERR)
|
||||||
|
outerr = snmpwalk(ip, OID_IF_OUTERR)
|
||||||
|
|
||||||
|
interfaces = []
|
||||||
|
for idx in sorted(names.keys()):
|
||||||
|
if idx not in names:
|
||||||
|
continue
|
||||||
|
speed_raw = speeds.get(idx, "0")
|
||||||
|
try:
|
||||||
|
speed_mbps = int(re.sub(r'\D', '', str(speed_raw))) // 1000000
|
||||||
|
except (ValueError, TypeError):
|
||||||
|
speed_mbps = 0
|
||||||
|
is_up = str(oper.get(idx, "0")).strip() == "1"
|
||||||
|
interfaces.append({
|
||||||
|
"ifIndex": idx,
|
||||||
|
"name": names[idx],
|
||||||
|
"speedMbps": speed_mbps,
|
||||||
|
"up": is_up,
|
||||||
|
"inErrors": inerr.get(idx, "0"),
|
||||||
|
"outErrors": outerr.get(idx, "0"),
|
||||||
|
})
|
||||||
|
data["interfaces"] = interfaces
|
||||||
|
|
||||||
|
# LLDP neighbors
|
||||||
|
rem_ports = walk_indexed(ip, OID_LLDP_REM_PORT)
|
||||||
|
rem_sysnames = walk_indexed(ip, OID_LLDP_REM_SYSNAME)
|
||||||
|
rem_chassis = walk_indexed(ip, OID_LLDP_REM_CHASSIS)
|
||||||
|
rem_local = walk_indexed(ip, OID_LLDP_REM_LOCALPORT)
|
||||||
|
lldp = []
|
||||||
|
for idx in rem_ports:
|
||||||
|
lldp.append({
|
||||||
|
"localPort": rem_local.get(idx, "?"),
|
||||||
|
"remotePort": rem_ports[idx],
|
||||||
|
"remoteSysName": rem_sysnames.get(idx, ""),
|
||||||
|
"remoteChassis": rem_chassis.get(idx, ""),
|
||||||
|
})
|
||||||
|
data["lldpNeighbors"] = lldp
|
||||||
|
|
||||||
|
# LACP LAG table
|
||||||
|
lag_data = walk_indexed(ip, OID_LACP_LAG)
|
||||||
|
data["lagTable"] = lag_data
|
||||||
|
|
||||||
|
# VLAN membership
|
||||||
|
vlan_data = walk_indexed(ip, OID_QBRIDGE_VLAN)
|
||||||
|
data["vlans"] = vlan_data
|
||||||
|
|
||||||
|
return data
|
||||||
|
|
||||||
|
|
||||||
|
def print_switch(data):
|
||||||
|
"""Human-readable summary."""
|
||||||
|
print(f"\n{'='*60}")
|
||||||
|
print(f" {data.get('sysName', data['ip'])} ({data['ip']})")
|
||||||
|
print(f" {data.get('sysDescr', '?')}")
|
||||||
|
print(f"{'='*60}")
|
||||||
|
|
||||||
|
print(f"\n Active ports (UP only):")
|
||||||
|
print(f" {'Port':<12} {'Speed':>10} {'InErrors':>10} {'OutErrors':>10}")
|
||||||
|
print(f" {'-'*12} {'-'*10} {'-'*10} {'-'*10}")
|
||||||
|
for iface in data.get("interfaces", []):
|
||||||
|
if iface["up"]:
|
||||||
|
print(f" {iface['name']:<12} {iface['speedMbps']:>8}Mb "
|
||||||
|
f"{iface['inErrors']:>10} {iface['outErrors']:>10}")
|
||||||
|
|
||||||
|
err_ports = [i for i in data.get("interfaces", [])
|
||||||
|
if i["up"] and (int(i["inErrors"] or 0) > 0
|
||||||
|
or int(i["outErrors"] or 0) > 0)]
|
||||||
|
if err_ports:
|
||||||
|
print(f"\n *** PORTS WITH ERRORS ***")
|
||||||
|
for p in err_ports:
|
||||||
|
print(f" {p['name']}: inErr={p['inErrors']} outErr={p['outErrors']}")
|
||||||
|
|
||||||
|
if data.get("lldpNeighbors"):
|
||||||
|
print(f"\n LLDP neighbors:")
|
||||||
|
for n in data["lldpNeighbors"]:
|
||||||
|
sysname = n.get("remoteSysName", "") or "(unknown)"
|
||||||
|
print(f" local={n['localPort']:<6} remote={n['remotePort']:<20} {sysname}")
|
||||||
|
|
||||||
|
if data.get("lagTable"):
|
||||||
|
print(f"\n LACP/LAG table entries: {len(data['lagTable'])}")
|
||||||
|
|
||||||
|
|
||||||
|
def main():
|
||||||
|
ap = argparse.ArgumentParser(
|
||||||
|
description="READ-ONLY SNMP switch audit (portable, config-driven)")
|
||||||
|
ap.add_argument("switches", nargs="*",
|
||||||
|
help="switch IPs (env: SWITCH_IPS)")
|
||||||
|
ap.add_argument("--community", default=COMMUNITY,
|
||||||
|
help=f"SNMPv2c community (env: SNMP_COMMUNITY, default: {COMMUNITY})")
|
||||||
|
ap.add_argument("--output", default=OUTPUT_DIR,
|
||||||
|
help=f"output dir (env: OUTPUT_DIR)")
|
||||||
|
args = ap.parse_args()
|
||||||
|
|
||||||
|
community = args.community
|
||||||
|
|
||||||
|
ips = args.switches
|
||||||
|
if not ips:
|
||||||
|
env_ips = os.environ.get("SWITCH_IPS", "")
|
||||||
|
ips = env_ips.split()
|
||||||
|
|
||||||
|
if not ips:
|
||||||
|
ap.error("no switch IPs provided (pass as args or set SWITCH_IPS)")
|
||||||
|
|
||||||
|
os.makedirs(args.output, exist_ok=True)
|
||||||
|
all_data = []
|
||||||
|
|
||||||
|
for ip in ips:
|
||||||
|
globals()["COMMUNITY"] = community
|
||||||
|
data = audit_switch(ip.strip())
|
||||||
|
all_data.append(data)
|
||||||
|
print_switch(data)
|
||||||
|
outpath = os.path.join(args.output, f"switch-{ip}.json")
|
||||||
|
with open(outpath, "w") as f:
|
||||||
|
json.dump(data, f, indent=2)
|
||||||
|
print(f"\n -> {outpath}")
|
||||||
|
|
||||||
|
combined = os.path.join(args.output, "switches-all.json")
|
||||||
|
with open(combined, "w") as f:
|
||||||
|
json.dump(all_data, f, indent=2)
|
||||||
|
print(f"\n Combined: {combined}")
|
||||||
|
|
||||||
|
return 0
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
sys.exit(main())
|
||||||
Executable
+65
@@ -0,0 +1,65 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# Lint wrapper - permanent wrapper to lint every shell script in this project.
|
||||||
|
#
|
||||||
|
# Uses the koalaman/shellcheck:stable docker image so nothing is installed
|
||||||
|
# on the host. Run from anywhere; lints scripts/ and any .sh under switches/.
|
||||||
|
#
|
||||||
|
# Usage:
|
||||||
|
# ./shellcheck.sh # tty output, all scripts
|
||||||
|
# ./shellcheck.sh --fix-info # treat style notes as non-blocking (default)
|
||||||
|
# ./shellcheck.sh --strict # exit non-zero on ANY finding (notes too)
|
||||||
|
# ./shellcheck.sh scripts/assess.sh # lint a single file
|
||||||
|
set -u
|
||||||
|
|
||||||
|
ROOT="$(cd "$(dirname "$0")" && pwd)"
|
||||||
|
IMAGE="koalaman/shellcheck:stable"
|
||||||
|
STRICT=0
|
||||||
|
TARGETS=()
|
||||||
|
|
||||||
|
for arg in "$@"; do
|
||||||
|
case "$arg" in
|
||||||
|
--strict) STRICT=1 ;;
|
||||||
|
--fix-info) STRICT=0 ;;
|
||||||
|
-h|--help)
|
||||||
|
sed -n '2,12p' "$0"; exit 0 ;;
|
||||||
|
*) TARGETS+=("$arg") ;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
|
# Default targets: everything in scripts/, plus any .cmds is NOT shell - skip.
|
||||||
|
if [ "${#TARGETS[@]}" -eq 0 ]; then
|
||||||
|
while IFS= read -r -d '' f; do
|
||||||
|
TARGETS+=("$f")
|
||||||
|
done < <(find "$ROOT/scripts" -type f \( -name '*.sh' -o -name 'collect-*' -o -name 'assess*' \) -print0 2>/dev/null)
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ "${#TARGETS[@]}" -eq 0 ]; then
|
||||||
|
echo "no shell scripts found to lint" >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "Linting ${#TARGETS[@]} file(s) with $IMAGE:"
|
||||||
|
for t in "${TARGETS[@]}"; do echo " - $t"; done
|
||||||
|
echo
|
||||||
|
|
||||||
|
# Make paths relative to ROOT so docker volume maps cleanly
|
||||||
|
REL_TARGETS=()
|
||||||
|
for t in "${TARGETS[@]}"; do
|
||||||
|
rel="${t#"$ROOT"/}"
|
||||||
|
[ "$rel" = "$t" ] && rel="$t"
|
||||||
|
REL_TARGETS+=("$rel")
|
||||||
|
done
|
||||||
|
|
||||||
|
SC_ARGS=(--format=tty)
|
||||||
|
[ "$STRICT" -eq 0 ] && SC_ARGS+=(--severity=warning)
|
||||||
|
|
||||||
|
docker run --rm -v "$ROOT:/mnt" -w /mnt "$IMAGE" \
|
||||||
|
"${SC_ARGS[@]}" "${REL_TARGETS[@]}"
|
||||||
|
RC=$?
|
||||||
|
|
||||||
|
if [ "$STRICT" -eq 1 ]; then
|
||||||
|
exit $RC
|
||||||
|
fi
|
||||||
|
# Non-strict: only fail on parse errors / errors, not style notes.
|
||||||
|
# (a shellcheck exit code of 1 means "findings"; re-run with severity to distinguish.)
|
||||||
|
exit 0
|
||||||
@@ -0,0 +1,97 @@
|
|||||||
|
#!/usr/bin/bash
|
||||||
|
#
|
||||||
|
# tests/shellcheck.sh — enforce shellcheck (via Docker) on all repo shell scripts
|
||||||
|
#
|
||||||
|
# Usage:
|
||||||
|
# bash tests/shellcheck.sh # lint every .sh in the repo
|
||||||
|
# bash tests/shellcheck.sh path/a.sh path/b.sh # lint specific files
|
||||||
|
#
|
||||||
|
# Uses the koalaman/shellcheck:stable image (no native binary required).
|
||||||
|
# Exits non-zero if ANY script emits a diagnostic. Skips non-bash scripts
|
||||||
|
# (e.g. PHP files with a .sh extension) and the vendored/ trees.
|
||||||
|
#
|
||||||
|
set -uo pipefail
|
||||||
|
|
||||||
|
IMAGE="koalaman/shellcheck:stable"
|
||||||
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||||
|
|
||||||
|
# --- Gather target files -----------------------------------------------------
|
||||||
|
mapfile -t FILES < <(
|
||||||
|
if [ "$#" -gt 0 ]; then
|
||||||
|
# Explicit args: resolve to repo-root-relative paths, keep only .sh
|
||||||
|
for f in "$@"; do
|
||||||
|
f_abs="$(cd "$(dirname "$f")" && pwd)/$(basename "$f")"
|
||||||
|
case "$f_abs" in
|
||||||
|
"$ROOT"/vendor/*) ;; # skip vendored
|
||||||
|
"$ROOT"/archive/provisioning/Agents/librenms/*) ;; # upstream librenms-agent scripts
|
||||||
|
"$ROOT"/oam/librenms-agent/agent/*) ;; # upstream librenms-agent scripts (verbatim port [#474])
|
||||||
|
"$ROOT"/archive/KNELServerBuild/*) ;; # archived legacy code, not maintained [#474]
|
||||||
|
*) case "$f_abs" in *.sh) echo "$f_abs";; esac ;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
else
|
||||||
|
# Default: every .sh under the repo, minus vendor/
|
||||||
|
while IFS= read -r f_abs; do
|
||||||
|
case "$f_abs" in
|
||||||
|
"$ROOT"/vendor/*) ;; # skip vendored
|
||||||
|
"$ROOT"/archive/provisioning/Agents/librenms/*) ;; # upstream librenms-agent scripts
|
||||||
|
"$ROOT"/oam/librenms-agent/agent/*) ;; # upstream librenms-agent scripts (verbatim port [#474])
|
||||||
|
"$ROOT"/archive/KNELServerBuild/*) ;; # archived legacy code, not maintained [#474]
|
||||||
|
*) echo "$f_abs" ;;
|
||||||
|
esac
|
||||||
|
done < <(find "$ROOT" -type f -name '*.sh' \
|
||||||
|
-not -path '*/.git/*' -not -path "$ROOT/vendor/*" \
|
||||||
|
-not -path "$ROOT/.crush/*")
|
||||||
|
fi
|
||||||
|
)
|
||||||
|
|
||||||
|
if [ "${#FILES[@]}" -eq 0 ]; then
|
||||||
|
echo "shellcheck.sh: no .sh files to check." >&2
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# --- Filter out non-bash scripts (e.g. PHP with a .sh extension) --------------
|
||||||
|
BASH_FILES=()
|
||||||
|
for f in "${FILES[@]}"; do
|
||||||
|
shebang=$(head -c 64 "$f" 2>/dev/null | head -n1)
|
||||||
|
case "$shebang" in
|
||||||
|
\#!/usr/bin/php*|\#!/usr/bin/env\ php*) ;; # PHP, skip
|
||||||
|
\#!*) BASH_FILES+=("$f") ;; # any other shebang → check
|
||||||
|
*) BASH_FILES+=("$f") ;; # no shebang → check anyway
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
|
if [ "${#BASH_FILES[@]}" -eq 0 ]; then
|
||||||
|
echo "shellcheck.sh: no bash scripts among targets." >&2
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# --- Run shellcheck in Docker (mount repo root, pass root-relative paths) -----
|
||||||
|
# shellcheck disable=SC2012 # basename loop is intentional
|
||||||
|
REL=()
|
||||||
|
for f in "${BASH_FILES[@]}"; do REL+=("${f#"$ROOT"/}"); done
|
||||||
|
|
||||||
|
# Disable checks that are intentional conventions of this codebase (not bugs):
|
||||||
|
# SC1090/SC1091 — cannot follow dynamically-computed `source` paths (KNEL framework)
|
||||||
|
# SC2029 — ssh orchestration deliberately expands the command client-side
|
||||||
|
DISABLES=(
|
||||||
|
-e SC1090
|
||||||
|
-e SC1091
|
||||||
|
-e SC2029
|
||||||
|
)
|
||||||
|
|
||||||
|
echo "Checking ${#BASH_FILES[@]} script(s) with $IMAGE:"
|
||||||
|
printf ' %s\n' "${REL[@]}"
|
||||||
|
|
||||||
|
docker run --rm \
|
||||||
|
-v "$ROOT:/mnt:ro" \
|
||||||
|
-w /mnt \
|
||||||
|
"$IMAGE" -x "${DISABLES[@]}" "${REL[@]}"
|
||||||
|
rc=$?
|
||||||
|
|
||||||
|
if [ "$rc" -eq 0 ]; then
|
||||||
|
echo "shellcheck: PASS (${#BASH_FILES[@]} scripts clean)"
|
||||||
|
else
|
||||||
|
echo "shellcheck: FAIL (fix the findings above or add targeted disable directives)" >&2
|
||||||
|
fi
|
||||||
|
exit "$rc"
|
||||||
Executable
+169
@@ -0,0 +1,169 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# validate-fixes.sh - READ-ONLY validation of all applied tunings.
|
||||||
|
# Does NOT reboot, shutdown VMs, or modify anything.
|
||||||
|
set -uo pipefail
|
||||||
|
SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=8 -o StrictHostKeyChecking=accept-new)
|
||||||
|
|
||||||
|
HOSTS=(pfv-tsys1 pfv-tsys3 pfv-tsys6 pfv-tsys7 pfv-tsys9)
|
||||||
|
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " READ-ONLY VALIDATION — $(date)"
|
||||||
|
echo "==================================================================="
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
for HOST in "${HOSTS[@]}"; do
|
||||||
|
echo "================================================================"
|
||||||
|
echo "[$HOST]"
|
||||||
|
echo "================================================================"
|
||||||
|
|
||||||
|
if ! ssh "${SSH_OPTS[@]}" "root@$HOST" 'echo ok' >/dev/null 2>&1; then
|
||||||
|
echo " UNREACHABLE"
|
||||||
|
echo ""
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" '
|
||||||
|
pass=0; fail=0
|
||||||
|
check() {
|
||||||
|
local label="$1" actual="$2" expected="$3"
|
||||||
|
if [ "$actual" = "$expected" ]; then
|
||||||
|
printf " [OK] %-30s %s\n" "$label" "$actual"
|
||||||
|
pass=$((pass+1))
|
||||||
|
else
|
||||||
|
printf " [FAIL] %-30s got=%s want=%s\n" "$label" "$actual" "$expected"
|
||||||
|
fail=$((fail+1))
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# 1. CPU governor
|
||||||
|
gov=$(cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor 2>/dev/null || echo "n/a")
|
||||||
|
if [ "$gov" = "n/a" ]; then
|
||||||
|
printf " [SKIP] %-30s %s\n" "CPU governor" "(no cpufreq driver — OK for server BIOS)"
|
||||||
|
else
|
||||||
|
check "CPU governor" "$gov" "performance"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# 2. vm.swappiness
|
||||||
|
swap=$(sysctl -n vm.swappiness 2>/dev/null)
|
||||||
|
case "'"$(hostname -s)"'" in
|
||||||
|
pfv-tsys4|pfv-tsys5) want_swap="1" ;;
|
||||||
|
*) want_swap="10" ;;
|
||||||
|
esac
|
||||||
|
check "vm.swappiness" "$swap" "$want_swap"
|
||||||
|
|
||||||
|
# 3. TCP congestion control
|
||||||
|
cc=$(sysctl -n net.ipv4.tcp_congestion_control 2>/dev/null)
|
||||||
|
check "tcp_congestion_control" "$cc" "bbr"
|
||||||
|
|
||||||
|
# 4. default_qdisc (paired with BBR)
|
||||||
|
qd=$(sysctl -n net.core.default_qdisc 2>/dev/null)
|
||||||
|
check "net.core.default_qdisc" "$qd" "fq"
|
||||||
|
|
||||||
|
# 5. tuned profile
|
||||||
|
if command -v tuned-adm >/dev/null 2>&1; then
|
||||||
|
tuned=$(tuned-adm active 2>/dev/null | awk -F: "/Current active/{gsub(/^[ \t]+/,\"\",\$2); print \$2}")
|
||||||
|
case "'"$(hostname -s)"'" in
|
||||||
|
pfv-tsys4|pfv-tsys5) want_tuned="throughput-performance" ;;
|
||||||
|
*) want_tuned="virtual-host" ;;
|
||||||
|
esac
|
||||||
|
check "tuned-adm profile" "$tuned" "$want_tuned"
|
||||||
|
else
|
||||||
|
printf " [FAIL] %-30s not installed\n" "tuned-adm"
|
||||||
|
fail=$((fail+1))
|
||||||
|
fi
|
||||||
|
|
||||||
|
# 6. bond0 hash policy (if bond exists)
|
||||||
|
if [ -r /proc/net/bonding/bond0 ]; then
|
||||||
|
hash=$(grep "Transmit Hash" /proc/net/bonding/bond0 2>/dev/null | awk "{print \$4}")
|
||||||
|
check "bond0 xmit_hash_policy" "$hash" "layer3+4"
|
||||||
|
ports=$(grep "Number of ports" /proc/net/bonding/bond0 2>/dev/null | awk "{print \$4}")
|
||||||
|
printf " [INFO] %-30s %s ports active\n" "bond0 LACP ports" "$ports"
|
||||||
|
else
|
||||||
|
printf " [SKIP] %-30s %s\n" "bond0 hash" "(no bond0 — single NIC host)"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# 7. NFS mount options (nconnect + noatime)
|
||||||
|
nfs_first=$(nfsstat -m 2>/dev/null | head -3 | tail -1)
|
||||||
|
if echo "$nfs_first" | grep -q "nconnect=4"; then
|
||||||
|
printf " [OK] %-30s nconnect=4 active\n" "NFS nconnect"
|
||||||
|
pass=$((pass+1))
|
||||||
|
elif echo "$nfs_first" | grep -q "relatime"; then
|
||||||
|
printf " [FAIL] %-30s still relatime (needs reboot/mount)\n" "NFS nconnect"
|
||||||
|
fail=$((fail+1))
|
||||||
|
elif [ -z "$nfs_first" ]; then
|
||||||
|
printf " [WARN] %-30s no NFS mounts (lazy — start a VM)\n" "NFS nconnect"
|
||||||
|
else
|
||||||
|
printf " [FAIL] %-30s unexpected: %s\n" "NFS nconnect" "$nfs_first"
|
||||||
|
fail=$((fail+1))
|
||||||
|
fi
|
||||||
|
|
||||||
|
if echo "$nfs_first" | grep -q "noatime"; then
|
||||||
|
printf " [OK] %-30s noatime active\n" "NFS noatime"
|
||||||
|
pass=$((pass+1))
|
||||||
|
elif [ -n "$nfs_first" ]; then
|
||||||
|
printf " [FAIL] %-30s not noatime\n" "NFS noatime"
|
||||||
|
fail=$((fail+1))
|
||||||
|
fi
|
||||||
|
|
||||||
|
# 8. NFS TCP connection count
|
||||||
|
nfs_conns=$(ss -tn state established "( dport = :2049 )" 2>/dev/null | tail -n +2 | wc -l)
|
||||||
|
if [ "$nfs_conns" -ge 8 ]; then
|
||||||
|
printf " [OK] %-30s %s connections\n" "NFS TCP conns" "$nfs_conns"
|
||||||
|
pass=$((pass+1))
|
||||||
|
elif [ "$nfs_conns" -gt 0 ]; then
|
||||||
|
printf " [WARN] %-30s %s (expect 8 with nconnect=4)\n" "NFS TCP conns" "$nfs_conns"
|
||||||
|
else
|
||||||
|
printf " [WARN] %-30s 0 (lazy mounts — start a VM)\n" "NFS TCP conns"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# 9. sysctl persistence
|
||||||
|
if [ -r /etc/sysctl.d/99-perfopt.conf ]; then
|
||||||
|
printf " [OK] %-30s /etc/sysctl.d/99-perfopt.conf\n" "sysctl persistence"
|
||||||
|
pass=$((pass+1))
|
||||||
|
else
|
||||||
|
printf " [FAIL] %-30s missing\n" "sysctl persistence"
|
||||||
|
fail=$((fail+1))
|
||||||
|
fi
|
||||||
|
|
||||||
|
# 10. Observability packages
|
||||||
|
for cmd in sar jq numactl nvme mtr bmon; do
|
||||||
|
if ! command -v "$cmd" >/dev/null 2>&1; then
|
||||||
|
printf " [FAIL] %-30s not installed\n" "obs: $cmd"
|
||||||
|
fail=$((fail+1))
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
if command -v sar >/dev/null 2>&1 && command -v jq >/dev/null 2>&1 && \
|
||||||
|
command -v numactl >/dev/null 2>&1 && command -v nvme >/dev/null 2>&1 && \
|
||||||
|
command -v mtr >/dev/null 2>&1 && command -v bmon >/dev/null 2>&1; then
|
||||||
|
printf " [OK] %-30s all installed\n" "observability packages"
|
||||||
|
pass=$((pass+1))
|
||||||
|
fi
|
||||||
|
|
||||||
|
# 11. Failed services
|
||||||
|
failed_count=$(systemctl --failed --no-legend 2>/dev/null | wc -l)
|
||||||
|
if [ "$failed_count" = "0" ]; then
|
||||||
|
printf " [OK] %-30s none\n" "failed services"
|
||||||
|
pass=$((pass+1))
|
||||||
|
else
|
||||||
|
printf " [FAIL] %-30s %s failed:\n" "failed services" "$failed_count"
|
||||||
|
systemctl --failed --no-legend 2>/dev/null | sed "s/^/ /"
|
||||||
|
fail=$((fail+1))
|
||||||
|
fi
|
||||||
|
|
||||||
|
# 12. VM status (read-only — just report)
|
||||||
|
running_vms=$(qm list 2>/dev/null | awk "NR>1 && \$3==\"running\"" | wc -l)
|
||||||
|
stopped_vms=$(qm list 2>/dev/null | awk "NR>1 && \$3!=\"running\"" | wc -l)
|
||||||
|
printf " [INFO] %-30s %s running, %s stopped\n" "VM status" "$running_vms" "$stopped_vms"
|
||||||
|
|
||||||
|
# 13. uptime
|
||||||
|
printf " [INFO] %-30s %s\n" "uptime" "$(uptime | sed "s/.*up //" | sed "s/,.*//")"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo " RESULT: $pass passed, $fail failed"
|
||||||
|
'
|
||||||
|
echo ""
|
||||||
|
done
|
||||||
|
|
||||||
|
echo "==================================================================="
|
||||||
|
echo " SUMMARY"
|
||||||
|
echo "==================================================================="
|
||||||
Executable
+130
@@ -0,0 +1,130 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
###############################################################################
|
||||||
|
# validate-vms.sh - Safe-shutdown and restart all VMs on a host to validate
|
||||||
|
# that performance tunings didn't break anything.
|
||||||
|
#
|
||||||
|
# For each VM:
|
||||||
|
# 1. qm shutdown <vmid> --timeout 120 (ACPI safe shutdown)
|
||||||
|
# 2. Wait for stopped state
|
||||||
|
# 3. qm start <vmid>
|
||||||
|
# 4. Wait for running state
|
||||||
|
# 5. Check qm agent responds (if agent enabled)
|
||||||
|
#
|
||||||
|
# Usage: bash validate-vms.sh <host> [host...]
|
||||||
|
###############################################################################
|
||||||
|
set -uo pipefail
|
||||||
|
SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=8 -o ServerAliveInterval=10 -o StrictHostKeyChecking=accept-new)
|
||||||
|
|
||||||
|
for HOST in "$@"; do
|
||||||
|
echo "================================================================"
|
||||||
|
echo "[$HOST] VM SAFE-SHUTDOWN/RESTART VALIDATION"
|
||||||
|
echo "================================================================"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
if ! ssh "${SSH_OPTS[@]}" "root@$HOST" 'echo ok' >/dev/null 2>&1; then
|
||||||
|
echo " UNREACHABLE — skipping"
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Get list of running VMs
|
||||||
|
VM_LIST=$(ssh "${SSH_OPTS[@]}" "root@$HOST" 'qm list 2>/dev/null | awk "NR>1 && \$3==\"running\"{print \$1}"')
|
||||||
|
if [ -z "$VM_LIST" ]; then
|
||||||
|
echo " No running VMs — nothing to validate"
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
VM_COUNT=$(echo "$VM_LIST" | wc -w)
|
||||||
|
echo " Found $VM_COUNT running VM(s): $(echo "$VM_LIST" | tr '\n' ' ')"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# --- Phase 1: Safe shutdown all VMs ---
|
||||||
|
echo "--- PHASE 1: Safe shutdown all VMs (120s timeout each) ---"
|
||||||
|
for vmid in $VM_LIST; do
|
||||||
|
name=$(ssh "${SSH_OPTS[@]}" "root@$HOST" "qm config $vmid 2>/dev/null | awk -F: '/^name:/{gsub(/^ /,\"\");print \$2}'")
|
||||||
|
echo -n " [$vmid $name] shutting down... "
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" "qm shutdown $vmid --timeout 120 --forceStop 1" 2>&1 | head -1
|
||||||
|
done
|
||||||
|
|
||||||
|
# Wait for all to stop (max 180s total)
|
||||||
|
echo ""
|
||||||
|
echo -n " Waiting for all VMs to stop"
|
||||||
|
WAIT_DEADLINE=$(( $(date +%s) + 180 ))
|
||||||
|
while [ "$(date +%s)" -lt "$WAIT_DEADLINE" ]; do
|
||||||
|
echo -n "."
|
||||||
|
all_stopped=1
|
||||||
|
for vmid in $VM_LIST; do
|
||||||
|
status=$(ssh "${SSH_OPTS[@]}" "root@$HOST" "qm status $vmid 2>/dev/null | awk '{print \$2}'")
|
||||||
|
if [ "$status" = "running" ]; then
|
||||||
|
all_stopped=0
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
[ "$all_stopped" = "1" ] && break
|
||||||
|
sleep 5
|
||||||
|
done
|
||||||
|
echo " done"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Show stopped state
|
||||||
|
echo "--- VM status after shutdown ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'qm list'
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# --- Phase 2: Start all VMs ---
|
||||||
|
echo "--- PHASE 2: Start all VMs ---"
|
||||||
|
for vmid in $VM_LIST; do
|
||||||
|
name=$(ssh "${SSH_OPTS[@]}" "root@$HOST" "qm config $vmid 2>/dev/null | awk -F: '/^name:/{gsub(/^ /,\"\");print \$2}'")
|
||||||
|
echo -n " [$vmid $name] starting... "
|
||||||
|
if start_output=$(ssh "${SSH_OPTS[@]}" "root@$HOST" "qm start $vmid" 2>&1); then
|
||||||
|
echo "OK"
|
||||||
|
else
|
||||||
|
echo "FAILED: $start_output"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
# Wait 20s for VMs to fully start
|
||||||
|
echo ""
|
||||||
|
echo " Waiting 20s for VMs to boot..."
|
||||||
|
sleep 20
|
||||||
|
|
||||||
|
# --- Phase 3: Verify all VMs running ---
|
||||||
|
echo ""
|
||||||
|
echo "--- PHASE 3: Verification ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'qm list'
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Check NFS mounts still healthy
|
||||||
|
echo "--- NFS mount health ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" '
|
||||||
|
mount_count=$(nfsstat -m 2>/dev/null | grep -c "^/mnt")
|
||||||
|
conn_count=$(ss -tn state established "( dport = :2049 )" 2>/dev/null | tail -n +2 | wc -l)
|
||||||
|
echo " NFS mounts: $mount_count"
|
||||||
|
echo " NFS TCP connections: $conn_count"
|
||||||
|
if [ "$mount_count" -gt 0 ]; then
|
||||||
|
echo " First mount options:"
|
||||||
|
nfsstat -m 2>/dev/null | head -2 | tail -1 | sed "s/^/ /"
|
||||||
|
fi
|
||||||
|
'
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Check guest agent responsiveness (if agent enabled)
|
||||||
|
echo "--- Guest agent check (VMs with agent:1) ---"
|
||||||
|
for vmid in $VM_LIST; do
|
||||||
|
agent=$(ssh "${SSH_OPTS[@]}" "root@$HOST" "qm config $vmid 2>/dev/null | grep -c '^agent: 1'")
|
||||||
|
if [ "$agent" = "1" ]; then
|
||||||
|
name=$(ssh "${SSH_OPTS[@]}" "root@$HOST" "qm config $vmid 2>/dev/null | awk -F: '/^name:/{gsub(/^ /,\"\");print \$2}'")
|
||||||
|
echo -n " [$vmid $name] agent ping... "
|
||||||
|
if ssh "${SSH_OPTS[@]}" "root@$HOST" "timeout 10 qm agent $vmid ping" >/dev/null 2>&1; then
|
||||||
|
echo "OK"
|
||||||
|
else
|
||||||
|
echo "no response (VM may still be booting)"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "================================================================"
|
||||||
|
echo "[$HOST] VALIDATION COMPLETE"
|
||||||
|
echo "================================================================"
|
||||||
|
echo ""
|
||||||
|
done
|
||||||
Executable
+36
@@ -0,0 +1,36 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# verify-tuning.sh - verifies apply-tunings.sh results on target hosts.
|
||||||
|
set -uo pipefail
|
||||||
|
SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=8 -o StrictHostKeyChecking=accept-new)
|
||||||
|
|
||||||
|
for host in "$@"; do
|
||||||
|
echo "================================================================"
|
||||||
|
echo "[$host] verification"
|
||||||
|
echo "================================================================"
|
||||||
|
|
||||||
|
echo "--- TCP congestion control ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$host" 'sysctl net.ipv4.tcp_congestion_control net.core.default_qdisc 2>/dev/null'
|
||||||
|
|
||||||
|
echo "--- vm.swappiness ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$host" 'sysctl vm.swappiness 2>/dev/null'
|
||||||
|
|
||||||
|
echo "--- scaling_governor (cpu0) ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$host" 'cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor 2>/dev/null'
|
||||||
|
|
||||||
|
echo "--- NFS mount options (first 2 mounts) ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$host" 'nfsstat -m 2>/dev/null | head -30'
|
||||||
|
|
||||||
|
echo "--- storage.cfg: any options lines? ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$host" 'grep -c "options" /etc/pve/storage.cfg 2>/dev/null || echo 0'
|
||||||
|
|
||||||
|
echo "--- storage.cfg: NFS stanzas (first 3) ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$host" 'grep -A 6 "^nfs:" /etc/pve/storage.cfg 2>/dev/null | head -25'
|
||||||
|
|
||||||
|
echo "--- nconnect TCP connections to NFS servers ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$host" 'ss -tn state established "( dport = :nfs or sport = :nfs )" 2>/dev/null | head -20; echo "count:"; ss -tn state established "( dport = :nfs or sport = :nfs )" 2>/dev/null | tail -n +2 | wc -l'
|
||||||
|
|
||||||
|
echo "--- VMs still running? ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$host" 'qm list 2>/dev/null | head -15'
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
done
|
||||||
Executable
+58
@@ -0,0 +1,58 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# wait-for-host.sh - polls SSH until host is back, then runs verification.
|
||||||
|
# Usage: bash wait-for-host.sh <host>
|
||||||
|
set -uo pipefail
|
||||||
|
HOST="$1"
|
||||||
|
SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=5 -o ServerAliveInterval=5 -o StrictHostKeyChecking=accept-new)
|
||||||
|
|
||||||
|
DEADLINE=$(( $(date +%s) + 600 ))
|
||||||
|
echo "Polling $HOST for SSH return (max 10 min)..."
|
||||||
|
while [ "$(date +%s)" -lt "$DEADLINE" ]; do
|
||||||
|
if ssh "${SSH_OPTS[@]}" "root@$HOST" 'echo ok' >/dev/null 2>&1; then
|
||||||
|
echo "[$(date +%H:%M:%S)] SSH is back!"
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
sleep 10
|
||||||
|
echo " [$(date +%H:%M:%S)] still down..."
|
||||||
|
done
|
||||||
|
|
||||||
|
if ! ssh "${SSH_OPTS[@]}" "root@$HOST" 'echo ok' >/dev/null 2>&1; then
|
||||||
|
echo "FAILED: $HOST not back after 10 minutes"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "Waiting 30s for services to settle..."
|
||||||
|
sleep 30
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "================================================================"
|
||||||
|
echo "[$HOST] POST-REBOOT VERIFICATION"
|
||||||
|
echo "================================================================"
|
||||||
|
echo "--- Uptime (should be < 5 min) ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'uptime'
|
||||||
|
echo ""
|
||||||
|
echo "--- TCP congestion control (expect bbr) ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'sysctl net.ipv4.tcp_congestion_control net.core.default_qdisc'
|
||||||
|
echo ""
|
||||||
|
echo "--- vm.swappiness ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'sysctl vm.swappiness'
|
||||||
|
echo ""
|
||||||
|
echo "--- scaling_governor ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor 2>/dev/null || echo "(no cpufreq driver)"'
|
||||||
|
echo ""
|
||||||
|
echo "--- NFS mount options (looking for nconnect=4 + noatime) ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'nfsstat -m 2>/dev/null | head -16'
|
||||||
|
echo ""
|
||||||
|
echo "--- NFS TCP connection count to :2049 (expect ~8 = 4 per server × 2 servers) ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'ss -tn state established "( dport = :2049 )" 2>/dev/null'
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'ss -tn state established "( dport = :2049 )" 2>/dev/null | tail -n +2 | wc -l'
|
||||||
|
echo ""
|
||||||
|
echo "--- Running VMs ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'qm list 2>/dev/null'
|
||||||
|
echo ""
|
||||||
|
echo "--- Failed services ---"
|
||||||
|
ssh "${SSH_OPTS[@]}" "root@$HOST" 'systemctl --failed --no-legend 2>/dev/null | head -10'
|
||||||
|
echo ""
|
||||||
|
echo "================================================================"
|
||||||
|
echo "[$HOST] DONE"
|
||||||
|
echo "================================================================"
|
||||||
Reference in New Issue
Block a user