Centos 6.9 iptables

[hglkrijger]

sudo python 12_check_waagent_log.py

waagent.log contains the following ERROR log(s):  [
"2018/01/17 05:50:32.443746 ERROR Command: 'iptables  -t security -L OUTPUT --zero OUTPUT -nxv'", 
'2018/01/17 05:50:32.444169 ERROR Return code: 3',
"2018/01/17 05:50:32.446964 ERROR Result: iptables v1.4.7: can't initialize iptables table `security': iptables who? (do you need to insmod?)"
]

[jzampieron]

Having this issue on CoreOS 1465.7.0 as well.

[boumenot]

The exit code 3 indicates a version problem, which appears to transient failure.. Based on my reading of the iptables code tries to take a snapshot of the rules for a table on startup, and if that fails it assumes it has to insmod a kernel module. If the insmod fails, then we get the error message above.

The code path that failed is used to determine the number of packets affected by the firewall rules for the WireServer. This code runs in the daemon thread, and the enable firewall thread runs in monitor. I am not sure if we should be serializing those two, or we should just protect against this error. There may be a race between the two.

I checked our BVTs, and there are no failures for the currently preserved runs, so I don't know if we only hit an error for this command, or other iptables command.

[boumenot]

We have decided to go with this minimal fix for now. We will monitor the change, and see if we need to invest in a better fix.