This repository has been archived by the owner. It is now read-only.

[dev.icinga.com #4002] new restrictions: overlapping counters wrong in status cronk compared to grid view #1122

Closed
icinga-migration opened this Issue Apr 28, 2013 · 9 comments

Comments

Projects
None yet
1 participant
@icinga-migration
Copy link
Member

icinga-migration commented Apr 28, 2013

This issue has been migrated from Redmine: https://dev.icinga.com/issues/4002

Created by mfriedrich on 2013-04-28 19:35:13 +00:00

Assignee: mfrosch
Status: Resolved (closed on 2013-05-04 12:04:38 +00:00)
Target Version: 1.9
Last Update: 2013-05-04 12:04:38 +00:00 (in Redmine)

Icinga Version: 1.9.0dev
Icinga Web Version: 1.9.0dev
IDO Version: 1.9.0dev
OS Version: Debian 6.0.7 x64
DB Type: Oracle
DB Version: 11.2
Browser Version: any

I'm splitting the issue right now, as the original permission rewrite in #3715 would get bloated.

these tests were done using git next (1.9.0-beta):

  • everything related to service restrictions (servicegroups, service customvars) does not affect the hosts. status cronk counters and views in grids are not limited afterall.
  • host restrictions (hostgroups, host customvars) limit the counters and the grid view, but contain bugs (if hostgroup members are overlapping, the grid view is correct, the counters are not)

example for overlapping servicegroups:

define servicegroup {
        servicegroup_name               3715sg_many
        members                         3715localhost01,3715dummy01,3715localhost02,3715dummy02,3715localhost02,3715dummy03,3715localhost05,3715dummy04,3715localhost02,3715dummy05,3715localhost01,3715dummy06
}

define servicegroup {
        servicegroup_name               3715sg_localhost02
        members                         3715localhost02,3715dummy01,3715localhost02,3715dummy02,3715localhost02,3715dummy03,3715localhost02,3715dummy04,3715localhost02,3715dummy05,3715localhost02,3715dummy06,3715localhost02,3715dummy07
}

which means

  • localhost02 and all services
  • localhost01 with dummy01 and dummy06
  • localhost04 with dummy04

which is considered correct on the screenshot. but the host counters are wrong. i would expect that only

  • localhost01, localhost02 and localhost04

will be shown, so 3 hosts at all. instead, you can access all hosts which i consider wrong in this regards.

icinga_web_1.9_oracle_permissions_sg_overlapping_01.png

example for overlapping hostgroups:

  • each host is linked to 7 dummy services
  • 3715hg_all contains 5 localhosts
  • 3715hg_35 contains localhost03 and localhost05

result:

  • status cronk counter is at 5 hosts and 35 services (5 localhosts with 7 services)
  • grid shows only localhost 01,03,04,05 (02 is missing for some reason i do not understand)

icinga_web_1.9_oracle_permissions_hg_overlapping_01.png

example for overlapping service customvars:

  • all dummy hosts are linked to localhost01-05 (7 * 5 services)
  • _CV_S_3715_1 = dummy01,02,03,07
  • _CV_S_3715_2 = dummy04,05,06,07

result:

  • status cronk counter shows all hosts (which is wrong again!) and 40 services (wrong again)
  • grid shows all service dummies (35, being distinct)

icinga_web_1.9_oracle_permissions_cv_svc_overlapping_01.png

example for overlapping host customvars:

  • all localhosts have 7 dummy services linked
  • _CV_H_3715_1 = localhost02,04,05
  • _CV_H_3715_2 = localhost01,03,05

result:

  • status counter shows 6 hosts (instead of 5 which would be correct), and 47 services (6 7 is incorrect as well, it should be 5 7 = 35)
  • grids show all service dummies (35, being distinct)

icinga_web_1.9_oracle_permissions_cv_host_overlapping_01.png

and the most sophisticated example for hostgroups, servicegroups and customvars combined:

  • hostgroup 35 (localhost03 and 05)
  • servicegroup localhost02 all
  • customvar _CV_H_3715_1 (localhost02,04,05)

result

  • statuscronk counter says 22 hosts and 12 services (02,03,05,05 = 4 hosts, 4 * 7 = 28 services)
  • grid view is empty (!)

conclusion - mixing permissions does not work that well, at least not with oracle.

icinga_web_1.9_oracle_permissions_cv_host_hg_sg_combined_01.png

the complete configuration used for these overlapping tests can be found on core git in 'next' - tests/etc/3715.cfg
https://git.icinga.org/?p=icinga-core.git;a=blob\_plain;f=tests/etc/3715.cfg;hb=refs/heads/next

Attachments

Changesets

2013-04-30 15:44:21 +00:00 by mfrosch b982b4f

Fix duplication problem in StatusSummary Cronk

caused by 1-n credential joins

refs #3715
refs #4002

Relations:

@icinga-migration

This comment has been minimized.

Copy link
Member Author

icinga-migration commented Apr 28, 2013

Updated by mfriedrich on 2013-04-28 20:04:44 +00:00

  • File added icinga_web_1.9_mysql_permissions_hg_overlapping_01.png
  • File added icinga_web_1.9_mysql_permissions_sg_overlapping_01.png
  • File added icinga_web_1.9_mysql_permissions_cv_host_overlapping_01.png
  • File added icinga_web_1.9_mysql_permissions_cv_svc_overlapping_01.png
  • Subject changed from new restrictions: overlapping counters wrong, service restrictions do not affect hosts (oracle) to new restrictions: overlapping counters wrong, service restrictions do not affect hosts

tests with mysql using the exact same configuration and restrictions as mentioned above.

  • overlapping servicegroups

all hosts (wrong again!), 26 services (should be 8 (description above)). grid view is ok.

icinga_web_1.9_mysql_permissions_sg_overlapping_01.png

  • overlapping hostgroups

14 hosts (should be 5), 14*7=89 services (should be 35). grid view is ok.

icinga_web_1.9_mysql_permissions_hg_overlapping_01.png

  • overlapping host CVs

exact same behaviour as oracle, status counters wrong (6 hosts instead of 5, 42 services instead of 35, grid ok

icinga_web_1.9_mysql_permissions_cv_host_overlapping_01.png

  • overlapping service CVs

status counter - all hosts (wrong!), 40 services (instead of 35). grid view is ok.

icinga_web_1.9_mysql_permissions_cv_svc_overlapping_01.png

so basically, this is affects all rdbms (i would guess for pgsql right now, as it's late).

@icinga-migration

This comment has been minimized.

Copy link
Member Author

icinga-migration commented Apr 28, 2013

Updated by mfriedrich on 2013-04-28 20:05:22 +00:00

to summarize:

  • restrictions do not affect distinct count of status cronk, all hosts/services are counted in
  • restrictions on services do not limit the view on hosts
  • tested with oracle and mysql
  • combined restrictions (groups, cvs, ...) seem to be buggy
@icinga-migration

This comment has been minimized.

Copy link
Member Author

icinga-migration commented Apr 28, 2013

Updated by mfriedrich on 2013-04-28 20:06:02 +00:00

  • Category set to Database & Queries
  • Status changed from New to Assigned
  • Assigned to set to mfrosch
  • Priority changed from Normal to High
  • mysql 5.1.66
@icinga-migration

This comment has been minimized.

Copy link
Member Author

icinga-migration commented Apr 30, 2013

Updated by mfrosch on 2013-04-30 15:54:57 +00:00

  • Done % changed from 0 to 50

My Feedback:

  • restrictions do not affect distinct count of status cronk, all hosts/services are counted in

This should be fixed with b982b4f - I fixed the distinct there.

  • restrictions on services do not limit the view on hosts

Thats working as intended, not really possible to limit it with the current API

  • combined restrictions (groups, cvs, ...) seem to be buggy

Could you describe this behavior and maybe retest it with the fixed summary counters?

In addition it will be great to test the contactgroup limitation also.

@icinga-migration

This comment has been minimized.

Copy link
Member Author

icinga-migration commented Apr 30, 2013

Updated by mfriedrich on 2013-04-30 16:11:34 +00:00

i've tested contactgroup restrictions yesterday with oracle - working fine.

regarding the combined restrictions - look for "hostgroups, servicegroups and customvars combined:" in the original issue. did not test any further as this did not work in the first place.

@icinga-migration

This comment has been minimized.

Copy link
Member Author

icinga-migration commented Apr 30, 2013

Updated by mfriedrich on 2013-04-30 16:14:18 +00:00

b982b4f is not available in next nor release/1.9.0 - forgot to push?

@icinga-migration

This comment has been minimized.

Copy link
Member Author

icinga-migration commented Apr 30, 2013

Updated by mfrosch on 2013-04-30 17:34:40 +00:00

Crappy mobile connection, was up a few minutes after your post ;)

@icinga-migration

This comment has been minimized.

Copy link
Member Author

icinga-migration commented May 4, 2013

Updated by mfriedrich on 2013-05-04 11:37:54 +00:00

  • File added icinga_web_1.9_mysql_permissions_sg_overlapping_fixed_01.png
  • File added icinga_web_1.9_mysql_permissions_hg_overlapping_fixed_01.png
  • File added icinga_web_1.9_mysql_permissions_cv_host_overlapping_fixed_01.png
  • File added icinga_web_1.9_mysql_permissions_cv_svc_overlapping_fixed_01.png
  • service restrictions that do not affect hosts - ok, that's true and ok for the counters on the status cronk and the visibility of the hosts themselves (missing link here).

tests with the fix (now mysql)

  • servicegroups overlapping

(x) OK

icinga_web_1.9_mysql_permissions_sg_overlapping_fixed_01.png

  • hostgroups overlapping

(x) OK

icinga_web_1.9_mysql_permissions_hg_overlapping_fixed_01.png

  • host customvar overlapping

(x) OK

icinga_web_1.9_mysql_permissions_cv_host_overlapping_fixed_01.png

  • service customvar overlapping

(x) OK

icinga_web_1.9_mysql_permissions_cv_svc_overlapping_fixed_01.png

tests with oracle will follow soon.

@icinga-migration

This comment has been minimized.

Copy link
Member Author

icinga-migration commented May 4, 2013

Updated by mfriedrich on 2013-05-04 12:04:38 +00:00

  • File added icinga_web_1.9_oracle_permissions_svc_cv_overlapping_fixed_01.png
  • File added icinga_web_1.9_oracle_permissions_host_cv_overlapping_fixed_01.png
  • File added icinga_web_1.9_oracle_permissions_hg_overlapping_missing_3715localhost02.png
  • File added icinga_web_1.9_oracle_permissions_sg_3715localhost02_only01_07.png
  • File added icinga_web_1.9_oracle_permissions_sg_overlapping_missing_3715localhost02_3715dummy04_06.png
  • Subject changed from new restrictions: overlapping counters wrong, service restrictions do not affect hosts to new restrictions: overlapping counters wrong in status cronk compared to grid view
  • Status changed from Assigned to Resolved
  • Done % changed from 50 to 100

good things with oracle first:

  • host and service custom var overlapping works as expected.

  • hostgroups and servicegroups show the same counters for the status cronk and the grid,

but their restrictions are broken. that does not only affect overlapping, but is a general problem. i will open a new issue for that.

basically i think the original issue can be resolved. thanks for your hard work.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.