[pve-devel] Proxmox 7.0 Beta - Ceph "a password is required" error messages?

[pve-devel] Proxmox 7.0 Beta - Ceph "a password is required" error messages?

[Victor Hooi]

Hi,

I've setup a new Ceph cluster with the Proxmox 7.0 beta

I'm getting notification emails like this:

ceph : a password is required ; PWD=/ ; USER=root ; COMMAND=nvme intel
> smart-log-add --json /dev/nvme0n1


Do you know if this is expected behaviour, or what it means? Is this some
kind of new logging in Ceph 16 or Proxmox 7?

Thanks,
Victor

Re: [pve-devel] Proxmox 7.0 Beta - Ceph "a password is required" error messages?

[Dominik Csapak]

On 6/25/21 03:31, Victor Hooi wrote:
> Hi,
> 
> I've setup a new Ceph cluster with the Proxmox 7.0 beta
> 
> I'm getting notification emails like this:
> 
> ceph : a password is required ; PWD=/ ; USER=root ; COMMAND=nvme intel
>> smart-log-add --json /dev/nvme0n1
> 
> 
> Do you know if this is expected behaviour, or what it means? Is this some
> kind of new logging in Ceph 16 or Proxmox 7?
> 

ceph can check the hardware status with smartctl/nvme

to do this, ceph ships a sudoers.d snippet that allows those two commands

i just checked here, it works as intended

does the file '/etc/sudoers.d/ceph-osd-smartcl' exist in your installation?

did you do any further sudo configuration or changed the 'ceph' user
somehow?

kind regards

Re: [pve-devel] Proxmox 7.0 Beta - Ceph "a password is required" error messages?

[Dominik Csapak]

> 
> does the file '/etc/sudoers.d/ceph-osd-smartcl' exist in your installation?

sorry, typo, should be '/etc/sudoers.d/ceph-osd-smartctl'

Re: [pve-devel] Proxmox 7.0 Beta - Ceph "a password is required" error messages?

[Fabian Ebner]

Am 25.06.21 um 03:31 schrieb Victor Hooi:
> Hi,
> 
> I've setup a new Ceph cluster with the Proxmox 7.0 beta
> 
> I'm getting notification emails like this:
> 
> ceph : a password is required ; PWD=/ ; USER=root ; COMMAND=nvme intel
>> smart-log-add --json /dev/nvme0n1
> 
> 
> Do you know if this is expected behaviour, or what it means? Is this some
> kind of new logging in Ceph 16 or Proxmox 7?
> 
> Thanks,
> Victor
> _______________________________________________
> pve-devel mailing list
> pve-devel@lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
> 
> 

Hi,

in addition to what Dominik said: Is nvme-cli installed?

Best Regards,
Fabi

Re: [pve-devel] Proxmox 7.0 Beta - Ceph "a password is required" error messages?

[Victor Hooi]

Hi,

Yes, I can confirm that file exists on my system:

root@angusmtv-vm01:/etc/sudoers.d# cat ceph-osd-smartctl
> ## allow ceph-osd (which runs as user ceph) to collect device health
> metrics


ceph ALL=NOPASSWD: /usr/sbin/smartctl -x --json=o /dev/*
> ceph ALL=NOPASSWD: /usr/sbin/nvme * smart-log-add --json /dev/*


This was a fresh install of Proxmox 7.0 beta, with Ceph, I haven't really
made any changes outside of setting the Ceph keyring, so that ceph-volume
batch would work:

ceph auth get client.bootstrap-osd >
> /var/lib/ceph/bootstrap-osd/ceph.keyring


The nvme-cli package was *not* installed:

# dpkg -s nvme-cli
> dpkg-query: package 'nvme-cli' is not installed and no information is
> available
> Use dpkg --info (= dpkg-deb --info) to examine archive files.


I've just installed it - should that make those errors go away?

Should we install nvme-cli by default then?

Out of curiosity - where do you see the hardware status via Ceph

Thanks
Victor

On Mon, Jun 28, 2021 at 5:54 PM Fabian Ebner <f.ebner@proxmox.com> wrote:

> Am 25.06.21 um 03:31 schrieb Victor Hooi:
> > Hi,
> >
> > I've setup a new Ceph cluster with the Proxmox 7.0 beta
> >
> > I'm getting notification emails like this:
> >
> > ceph : a password is required ; PWD=/ ; USER=root ; COMMAND=nvme intel
> >> smart-log-add --json /dev/nvme0n1
> >
> >
> > Do you know if this is expected behaviour, or what it means? Is this some
> > kind of new logging in Ceph 16 or Proxmox 7?
> >
> > Thanks,
> > Victor
> > _______________________________________________
> > pve-devel mailing list
> > pve-devel@lists.proxmox.com
> > https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
> >
> >
>
> Hi,
>
> in addition to what Dominik said: Is nvme-cli installed?
>
> Best Regards,
> Fabi
>
>
> _______________________________________________
> pve-devel mailing list
> pve-devel@lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
>
>

Re: [pve-devel] Proxmox 7.0 Beta - Ceph "a password is required" error messages?

[Fabian Ebner]

Am 29.06.21 um 01:19 schrieb Victor Hooi:
> Hi,
> 
> Yes, I can confirm that file exists on my system:
> 
> root@angusmtv-vm01:/etc/sudoers.d# cat ceph-osd-smartctl
>> ## allow ceph-osd (which runs as user ceph) to collect device health
>> metrics
> 
> 
> ceph ALL=NOPASSWD: /usr/sbin/smartctl -x --json=o /dev/*
>> ceph ALL=NOPASSWD: /usr/sbin/nvme * smart-log-add --json /dev/*
> 
> 
> This was a fresh install of Proxmox 7.0 beta, with Ceph, I haven't really
> made any changes outside of setting the Ceph keyring, so that ceph-volume
> batch would work:
> 
> ceph auth get client.bootstrap-osd >
>> /var/lib/ceph/bootstrap-osd/ceph.keyring
> 
> 
> The nvme-cli package was *not* installed:
> 
> # dpkg -s nvme-cli
>> dpkg-query: package 'nvme-cli' is not installed and no information is
>> available
>> Use dpkg --info (= dpkg-deb --info) to examine archive files.
> 
> 
> I've just installed it - should that make those errors go away?
> 

Yes. I now debugged this a bit further: Ceph uses 'sudo nvme ...' when 
executing the command, but if 'nvme' can't be found in the PATH, the 
sudoers rule does not seem to apply, because it is for '/usr/sbin/nvme'.

Seems like something with sudo changed too. Given the same sudoers file 
and not having 'nvme-cli' installed, for an unprivileged user using
     sudo nvme qemu smart-log-add --json /dev/sdc
and Ctrl+D-ing the password prompt results in a notification in PVE 7.0, 
but not in PVE 6.4.

> Should we install nvme-cli by default then?
> 

It is in Recommends for the ceph package, but when installing via the 
API we use 'apt --no-install-recommends' for some reason. Maybe somebody 
else knows why?

> Out of curiosity - where do you see the hardware status via Ceph
>

I think you can use
     ceph device ls
to get the list of devices and then
     ceph device get-health-metrics <DEVICE>

> Thanks
> Victor
> 
> On Mon, Jun 28, 2021 at 5:54 PM Fabian Ebner <f.ebner@proxmox.com> wrote:
> 
>> Am 25.06.21 um 03:31 schrieb Victor Hooi:
>>> Hi,
>>>
>>> I've setup a new Ceph cluster with the Proxmox 7.0 beta
>>>
>>> I'm getting notification emails like this:
>>>
>>> ceph : a password is required ; PWD=/ ; USER=root ; COMMAND=nvme intel
>>>> smart-log-add --json /dev/nvme0n1
>>>
>>>
>>> Do you know if this is expected behaviour, or what it means? Is this some
>>> kind of new logging in Ceph 16 or Proxmox 7?
>>>
>>> Thanks,
>>> Victor
>>> _______________________________________________
>>> pve-devel mailing list
>>> pve-devel@lists.proxmox.com
>>> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
>>>
>>>
>>
>> Hi,
>>
>> in addition to what Dominik said: Is nvme-cli installed?
>>
>> Best Regards,
>> Fabi
>>
>>
>> _______________________________________________
>> pve-devel mailing list
>> pve-devel@lists.proxmox.com
>> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
>>
>>
> _______________________________________________
> pve-devel mailing list
> pve-devel@lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
> 
>