From me at falz.net  Mon Jul 10 18:30:50 2023
From: me at falz.net (Chris Wopat)
Date: Mon, 10 Jul 2023 13:30:50 -0500
Subject: [rancid] Support for Coriant Groove - has been discussed
 on-list before
In-Reply-To: <CALsLHchNeWOfmL_UUPZXSpUKFtFxu=WNh7JkVNJQnCfqy2P99g@mail.gmail.com>
References: <CALsLHcia3mq3hUJRdRBaBXGLaCoO0gPF746e0dGnihsOVhcFiA@mail.gmail.com>
 <CALsLHchNeWOfmL_UUPZXSpUKFtFxu=WNh7JkVNJQnCfqy2P99g@mail.gmail.com>
Message-ID: <CALsLHcgUts+8JcjtwKnCYuZ3b06nj9wab_kku9xsb615txsBcg@mail.gmail.com>

I ended up doing my own thing here, using a few existing files as defaults.
Downloads and instructions here

https://falz.net/wiki/RANCID_for_Infinera_Coriant_Groove

Feel free to add to source to keep things more clean if desired - willing
to do any further testing for 'cleanliness'



On Mon, Jun 19, 2023 at 8:20?AM Chris Wopat <me at falz.net> wrote:

> Digging up an old question from a few months ago - anyone have code to
> share for Coriant Groove G30 support? It's as though you just have to
> change `exit` to `exit -f` and adjust a few commands, but unsure the
> cleanest way to achieve this.
>
> Cheers,
> Chris
>
>
> On Thu, Jan 5, 2023 at 7:56?AM Chris Wopat <me at falz.net> wrote:
>
>> Curious if anyone out there has existing code to share for Coriant Groove
>> w/ RANCID.
>>
>> This was discussed in the past and it appears to be working, but code
>> wasn't shared:
>>
>> https://shrubbery.net/pipermail/rancid-discuss/2018-January/010026.html
>>
>> I agree generally with the commands listed in that thread as a starting
>> point. I should note that `clogin` works fine, the only gotcha appears to
>> be that if you `exit` you get an `are you sure` prompt:
>>
>> ======================
>> me at o-g30-lab-1> exit
>> Are you sure?  [y/n] y
>> Shutting down the session
>>
>> Connection closed
>> ======================
>>
>> As noted in that thread, `exit -f` omits the prompt. I attempted to do a
>> simple fake-add of device using clogin by putting this in
>> rancid.types.base, but it's hung up on that part. Any way to force this,
>> from rancid.types.base, to send `exit -f` instead of `exit`?
>>
>> If this truly requires a new actual module, what's current best practice
>> here - ie which is a good go-to module to copy as a base? Also, the first
>> command (show shelf) should probably have 'comments' prepending it, like #
>> or ! or something. unsure how that's accomplished
>>
>>
>> coriant;script;rancid -t coriant
>> coriant;login;clogin
>> coriant;module;ios
>> coriant;inloop;ios::inloop
>> coriant;command;ios::ShowVersion;show shelf
>> coriant;command;ios::WriteTerm;show config | display commands
>> coriant;command;ios::WriteTerm;exit -f
>>
>>
>> Thoughts?
>> --Chris
>>
>>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20230710/3f252b5f/attachment.htm>

From weylin at bu.edu  Thu Jul 13 03:26:00 2023
From: weylin at bu.edu (Piegorsch, Weylin William)
Date: Thu, 13 Jul 2023 03:26:00 +0000
Subject: [rancid] RANCiD vs Cisco ACI
In-Reply-To: <MN2PR03MB47510510962DEC56F5840204B72A9@MN2PR03MB4751.namprd03.prod.outlook.com>
References: <MN2PR03MB47510510962DEC56F5840204B72A9@MN2PR03MB4751.namprd03.prod.outlook.com>
Message-ID: <MN2PR03MB47519E9E24DBE520B025BA17B737A@MN2PR03MB4751.namprd03.prod.outlook.com>

Closing the loop on this.


- There does exist a "show running-config" option for the controllers, but not for switches in the fabric

- Any one controller is enough: all controllers have mostly the same running-config, and you have to bootstrap a controller with the unique details before you can restore to it anyway
- the contents of the running-config are not enough to restore a fabric, and anyway that's not the recommended approach if you're using the GUI (https://www.cisco.com/c/en/us/td/docs/dcn/aci/apic/5x/basic-configuration/cisco-apic-basic-configuration-guide-52x/m_apic_configuration_interfaces.html#id_49309)

- there's a JSON dump file one can get, which can be used for restoration, however it's a tarball containing an entire directory structure of JSON files and other stuff (SSL certificates; archive hash; etc)



There are additional commands (not "show" but other commands) that can be run to get JSON output of various components of the Managed Object tree.



Cisco's "official" archive approach is for the system to proactively push a configuration archive to a remote server. This archive is a set of files (JSON, SSL certificates, etc) wrapped as a tarball.  And, there's an SSH interface that is "supposed to" be able to drop a full system archive to the CLI.  In theory it should be possible to either: use this local-CLI feature; or, drop the tarball into a particular location in the rancid file hierarchy, and in theory it should be enough for RANCiD to use it's already-inherent capabilities for backup archive, restoration, and config diff.  I don't have opportunity to develop it, though I'm open to helping with testing.


[signature_1593189312]

Weylin Piegorsch |  Manager, Network Engineering
Boston University Information Services & Technology
weylin at bu.edu<mailto:weylin at bu.edu> | 617.353.8128 | bu.edu/tech<http://www.bu.edu/tech>
Listen. Learn. Lead.







From: Piegorsch, Weylin William
Sent: Thursday, October 20, 2022 12:34 AM
To: rancid-discuss at www.shrubbery.net
Subject: RANCiD vs Cisco ACI

Has anyone had success using RANCiD against Cisco ACI?  I'm running RANCiD v3.4.1.





[signature_1593189312]

Weylin Piegorsch |  Manager, Network Engineering
Boston University Information Services & Technology
weylin at bu.edu<mailto:weylin at bu.edu> | 617.353.8128 | bu.edu/tech<http://www.bu.edu/tech>
Listen. Learn. Lead.




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20230713/c5a4e829/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 1595 bytes
Desc: image001.jpg
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20230713/c5a4e829/attachment.jpg>

From weylin at bu.edu  Thu Jul 13 03:42:29 2023
From: weylin at bu.edu (Piegorsch, Weylin William)
Date: Thu, 13 Jul 2023 03:42:29 +0000
Subject: [rancid] PAR Not Changing Process Counts
In-Reply-To: <F264EE36-B1CD-45BD-BEB5-2B1FE7421AF4@bu.edu>
References: <F264EE36-B1CD-45BD-BEB5-2B1FE7421AF4@bu.edu>
Message-ID: <MN2PR03MB475149F24EFA60535FC24E5DB737A@MN2PR03MB4751.namprd03.prod.outlook.com>

I worked with Heasley (very) sporadically over the past few years on this.  Short version: control-rancid has around line 122:


if [ -z "$ENVFILE" ] ; then

    ENVFILE="${prefix}/etc/rancid.conf"

fi

if [ -f "$ENVFILE" ] ; then

    . $ENVFILE

fi


On my setup, ENVFILE didn?t exist, so the '-z' flag caught and tried to set it.  only problem? ${prefix} also doesn?t exist, so it was trying to find /etc/rancid.conf which yet again also doesn?t exist.

This was all supposed to have been properly set with autoconf during installation.  Near as we can tell, something about my installation made that not stick.  As this is an old problem, an old version of code, and with my fix there are no other identified problems, we didn?t pursue it further.  I manually added prefix=<rancid home directory> just after the copyright notice. This is a solution unique to my setup, but my system now works.





[signature_1593189312]

Weylin Piegorsch |  Manager, Network Engineering
Boston University Information Services & Technology
weylin at bu.edu<mailto:weylin at bu.edu> | 617.353.8128 | bu.edu/tech<http://www.bu.edu/tech>
Listen. Learn. Lead.




From: Piegorsch, Weylin William <weylin at bu.edu>
Sent: Thursday, April 18, 2019 7:15 AM
To: rancid-discuss at shrubbery.net
Subject: PAR Not Changing Process Counts

Hello,

I have PAR_COUNT set to 100 (and uncommented, and ?export?ed) in ~rancid/etc/rancid.conf.  However, I notice that there?s never more than 5 devices being archived at any given time.  My system load is low, and this server is dedicated exclusively to rancid, so it?s unclear to me why I wouldn?t be able to do more at once, or how to troubleshoot?

I?m on rancid 3.4.1.

weylin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20230713/34778c53/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 1595 bytes
Desc: image001.jpg
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20230713/34778c53/attachment.jpg>

From heas at shrubbery.net  Fri Jul 14 15:18:09 2023
From: heas at shrubbery.net (heasley)
Date: Fri, 14 Jul 2023 15:18:09 +0000
Subject: [rancid] PAR Not Changing Process Counts
In-Reply-To: <MN2PR03MB475149F24EFA60535FC24E5DB737A@MN2PR03MB4751.namprd03.prod.outlook.com>
References: <F264EE36-B1CD-45BD-BEB5-2B1FE7421AF4@bu.edu>
 <MN2PR03MB475149F24EFA60535FC24E5DB737A@MN2PR03MB4751.namprd03.prod.outlook.com>
Message-ID: <ZLFnMXt1jO9lADld@shrubbery.net>

Thu, Jul 13, 2023 at 03:42:29AM +0000, Piegorsch, Weylin William:
> I worked with Heasley (very) sporadically over the past few years on this.  Short version: control-rancid has around line 122:
> 
> 
> if [ -z "$ENVFILE" ] ; then
> 
>     ENVFILE="${prefix}/etc/rancid.conf"
> 
> fi
> 
> if [ -f "$ENVFILE" ] ; then
> 
>     . $ENVFILE
> 
> fi
> 
> 
> On my setup, ENVFILE didn?t exist, so the '-z' flag caught and tried to set it.  only problem? ${prefix} also doesn?t exist, so it was trying to find /etc/rancid.conf which yet again also doesn?t exist.

That line should not have been ${prefix}, it should have been
@sysconfdir@ in the original source and that would have been replaced by
the makefile or make process.  And it has been that way since at least
2014, which is long before rancid 3.4.1.

Are you possibly using an installation from a linux package system?.

> This was all supposed to have been properly set with autoconf during installation.  Near as we can tell, something about my installation made that not stick.  As this is an old problem, an old version of code, and with my fix there are no other identified problems, we didn?t pursue it further.  I manually added prefix=<rancid home directory> just after the copyright notice. This is a solution unique to my setup, but my system now works.


From weylin at bu.edu  Sat Jul 15 03:36:49 2023
From: weylin at bu.edu (Piegorsch, Weylin William)
Date: Sat, 15 Jul 2023 03:36:49 +0000
Subject: [rancid] PAR Not Changing Process Counts
In-Reply-To: <ZLFnMXt1jO9lADld@shrubbery.net>
References: <F264EE36-B1CD-45BD-BEB5-2B1FE7421AF4@bu.edu>
 <MN2PR03MB475149F24EFA60535FC24E5DB737A@MN2PR03MB4751.namprd03.prod.outlook.com>
 <ZLFnMXt1jO9lADld@shrubbery.net>
Message-ID: <MN2PR03MB4751A18D0608B62ABC1D5F66B735A@MN2PR03MB4751.namprd03.prod.outlook.com>

> Are you possibly using an installation from a linux package system?.

My installation engineer said he started with a clean install of CentOS 6.10... well, as clean as our organization provides us, not sure what customizations they made.  Anyway, on top of that install, he downloaded the tarball of what was then-current version, and ran through the README to install it.





?
Weylin Piegorsch?|??Manager, Network Engineering
Boston University Information Services & Technology
weylin at bu.edu?| 617.353.8128 |?bu.edu/tech
Listen. Learn. Lead.




-----Original Message-----
From: heasley <heas at shrubbery.net> 
Sent: Friday, July 14, 2023 11:18 AM
To: Piegorsch, Weylin William <weylin at bu.edu>
Cc: rancid-discuss at shrubbery.net
Subject: Re: [rancid] PAR Not Changing Process Counts

Thu, Jul 13, 2023 at 03:42:29AM +0000, Piegorsch, Weylin William:
> I worked with Heasley (very) sporadically over the past few years on this.  Short version: control-rancid has around line 122:
> 
> 
> if [ -z "$ENVFILE" ] ; then
> 
>     ENVFILE="${prefix}/etc/rancid.conf"
> 
> fi
> 
> if [ -f "$ENVFILE" ] ; then
> 
>     . $ENVFILE
> 
> fi
> 
> 
> On my setup, ENVFILE didn?t exist, so the '-z' flag caught and tried to set it.  only problem? ${prefix} also doesn?t exist, so it was trying to find /etc/rancid.conf which yet again also doesn?t exist.

That line should not have been ${prefix}, it should have been @sysconfdir@ in the original source and that would have been replaced by the makefile or make process.  And it has been that way since at least 2014, which is long before rancid 3.4.1.

Are you possibly using an installation from a linux package system?.

> This was all supposed to have been properly set with autoconf during installation.  Near as we can tell, something about my installation made that not stick.  As this is an old problem, an old version of code, and with my fix there are no other identified problems, we didn?t pursue it further.  I manually added prefix=<rancid home directory> just after the copyright notice. This is a solution unique to my setup, but my system now works.

From lepadatu.lucian at gmail.com  Wed Jul 26 13:47:23 2023
From: lepadatu.lucian at gmail.com (Lucian-Ionut Lepadatu)
Date: Wed, 26 Jul 2023 15:47:23 +0200
Subject: [rancid] rancid-run doesn't work from cron for panorama but works
 manually
Message-ID: <CA+vmu05x-EGGh1Tr8GoBxShp68UaCNvCG2=aon_GGFvynqwVzw@mail.gmail.com>

Hello,

I am trying to make rancid pull the configs from a pair of Palo Alto
Panorama devices.
I've installed it on an Alma Linux 9 box with the default package from epel
(rancid.x86_64 3.13-7.el9).
I have in router.db a list of Palo Alto firewalls and a pair of Panorama
devices. Login to all devices works.
If I login with the rancid user and run rancid-run from the shell
([rancid at rancidbox ~]$ /usr/libexec/rancid/rancid-run) it gets the config
for all devices.
If I login as root and run rancid run as the rancid user ("[rancid at rancidbox
~]# sudo -u rancid /usr/libexec/rancid/rancid-run") it also works for all
devices.
But if I try to run it from cron as the user rancid, it works for the
firewalls but not for panorama.

The cron entry looks like this:






*SHELL=/bin/bashPATH=/sbin:/bin:/usr/sbin:/usr/binMAILTO=rootHOME=/var/rancid0
*/8 * * * rancid /usr/libexec/rancid/rancid-run*

In the rancid logs I see:


*missed cmd(s): all commandsEnd of run not foundpanlogin error: Error:
TIMEOUT reached*

I've managed to capture the .raw and .new files for a panorama device when
rancid-run was executed from cron and looks like it connects to the device
but it gets stuck:









































*[rancid at rancidbox ~]$ cat
network-devices/configs/panorama_hostname.internal.domain.rawpanorama_hostname.internal.domainspawn
ssh -x -l rancid_login_user
panorama_hostname.internal.domain*************************************************************************
*
                                                                      * *
           WARNING! Access to this device is restricted             * *
              to those individuals with specific                  * *
      permissions. If you are not an authorized user            * *
                    disconnect now.                           * *
                                                            * *
    Any attempts to gain unauthorized access              * *
      will be prosecuted to the fullest                 * *
            extent of the law.                        * *

* *************************************************************************(rancid_login_user at panorama_hostname.internal.domain)
Password: Last login: Wed Jul 26 11:51:59 2023 from IP.XXX.YYY.ZZZNo entry
for terminal type "network";using dumb terminal settings.Number of failed
attempts since last successful login:
0rancid_login_user at panorama_hostname.internal.domain(primary-active)>
rancid_login_user at panorama_hostname.internal.domain(primary-active)> set
rancid_login_user at panorama_hostname.internal.domain(primary-active)> set
cli rancid_login_user at panorama_hostname.internal.domain(primary-active)>
set cli scripting-mode
rancid_login_user at panorama_hostname.internal.domain(primary-active)> set
cli scripting-mode
onrancid_login_user at panorama_hostname.internal.domain(primary-active)>
[rancid at rancidbox ~]$ [rancid at rancidbox ~]$ cat
network-devices/configs/panorama_hostname.internal.domain.new#RANCID-CONTENT-TYPE:
paloalto#*


If I try to run run rancid instead of rancid-run from cron for panorama it
works (needs a PATH added to be able to find the panlogin script but other
than that it succeeds)

*PATH=/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/usr/libexec/rancid/:/usr/share/perl5/vendor_perl/rancid*
*08 10 * * * rancid /usr/libexec/rancid/rancid -t paloalto
-d panorama_hostname.internal.domain*

I've also got a dump of all environment variables for the rancid user and
put it in cron but same as before: rancid-run always fails for panorama but
works for the firewalls. (it has the same content in the .raw file every
time)

I was thinking that since invoking rancid from cron works but rancid-run
fails, it might have something to do with how control_rancid or rancid-fe
invokes rancid but couldn't see anything obvious in those scripts
that might cause this behaviour.

I am not sure what exactly fails. I appreciate any pointers you might have.

Thanks,
Lucian Lepadatu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20230726/9bf87de4/attachment.htm>

From weylin at bu.edu  Thu Jul 27 04:01:57 2023
From: weylin at bu.edu (Piegorsch, Weylin William)
Date: Thu, 27 Jul 2023 04:01:57 +0000
Subject: [rancid] rancid-run doesn't work from cron for panorama but
 works manually
In-Reply-To: <CA+vmu05x-EGGh1Tr8GoBxShp68UaCNvCG2=aon_GGFvynqwVzw@mail.gmail.com>
References: <CA+vmu05x-EGGh1Tr8GoBxShp68UaCNvCG2=aon_GGFvynqwVzw@mail.gmail.com>
Message-ID: <MN2PR03MB47517AC4E58D806813B10F9BB701A@MN2PR03MB4751.namprd03.prod.outlook.com>

From the CRON file you shared, it looks like you?re executing this in the crontab in /etc?  I find it more reliable to execute system management tasks there (logrotate; updatedb; and so forth), but for rancid?s environment to be setup correctly when using rancid?s personal CRON file.
?sudo su - rancid ; crontab -e?

Just remember that in a user?s crontab you don?t need to specify the user.





[signature_1593189312]

Weylin Piegorsch |  Manager, Network Engineering
Boston University Information Services & Technology
weylin at bu.edu<mailto:weylin at bu.edu> | 617.353.8128 | bu.edu/tech<http://www.bu.edu/tech>
Listen. Learn. Lead.




From: Lucian-Ionut Lepadatu <lepadatu.lucian at gmail.com>
Sent: Wednesday, July 26, 2023 9:47 AM
To: rancid-discuss at www.shrubbery.net
Subject: [rancid] rancid-run doesn't work from cron for panorama but works manually

Hello,

I am trying to make rancid pull the configs from a pair of Palo Alto Panorama devices.
I've installed it on an Alma Linux 9 box with the default package from epel (rancid.x86_64 3.13-7.el9).
I have in router.db a list of Palo Alto firewalls and a pair of Panorama devices. Login to all devices works.
If I login with the rancid user and run rancid-run from the shell ([rancid at rancidbox ~]$ /usr/libexec/rancid/rancid-run) it gets the config for all devices.
If I login as root and run rancid run as the rancid user ("[rancid at rancidbox ~]# sudo -u rancid /usr/libexec/rancid/rancid-run") it also works for all devices.
But if I try to run it from cron as the user rancid, it works for the firewalls but not for panorama.

The cron entry looks like this:

SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
HOME=/var/rancid

0 */8 * * * rancid /usr/libexec/rancid/rancid-run
In the rancid logs I see:
missed cmd(s): all commands
End of run not found
panlogin error: Error: TIMEOUT reached

I've managed to capture the .raw and .new files for a panorama device when rancid-run was executed from cron and looks like it connects to the device but it gets stuck:

[rancid at rancidbox ~]$ cat network-devices/configs/panorama_hostname.internal.domain.raw
panorama_hostname.internal.domain
spawn ssh -x -l rancid_login_user panorama_hostname.internal.domain
*************************************************************************
 *                                                                       *
 *              WARNING! Access to this device is restricted             *
 *                   to those individuals with specific                  *
 *             permissions. If you are not an authorized user            *
 *                             disconnect now.                           *
 *                                                                       *
 *                 Any attempts to gain unauthorized access              *
 *                     will be prosecuted to the fullest                 *
 *                             extent of the law.                        *
 *                                                                       *
 *************************************************************************
(rancid_login_user at panorama_hostname.internal.domain<mailto:rancid_login_user at panorama_hostname.internal.domain>) Password:
Last login: Wed Jul 26 11:51:59 2023 from IP.XXX.YYY.ZZZ
No entry for terminal type "network";
using dumb terminal settings.



Number of failed attempts since last successful login: 0



rancid_login_user at panorama_hostname.internal.domain(primary-active)<mailto:rancid_login_user at panorama_hostname.internal.domain(primary-active)>>
rancid_login_user at panorama_hostname.internal.domain(primary-active)<mailto:rancid_login_user at panorama_hostname.internal.domain(primary-active)>> set
rancid_login_user at panorama_hostname.internal.domain(primary-active)<mailto:rancid_login_user at panorama_hostname.internal.domain(primary-active)>> set cli
rancid_login_user at panorama_hostname.internal.domain(primary-active)<mailto:rancid_login_user at panorama_hostname.internal.domain(primary-active)>> set cli scripting
-mode
rancid_login_user at panorama_hostname.internal.domain(primary-active)<mailto:rancid_login_user at panorama_hostname.internal.domain(primary-active)>> set cli scripting
-mode on
rancid_login_user at panorama_hostname.internal.domain(primary-active)<mailto:rancid_login_user at panorama_hostname.internal.domain(primary-active)>> [rancid at rancidbox ~]$




[rancid at rancidbox ~]$ cat network-devices/configs/panorama_hostname.internal.domain.new
#RANCID-CONTENT-TYPE: paloalto
#

If I try to run run rancid instead of rancid-run from cron for panorama it works (needs a PATH added to be able to find the panlogin script but other than that it succeeds)

PATH=/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/usr/libexec/rancid/:/usr/share/perl5/vendor_perl/rancid
08 10 * * * rancid /usr/libexec/rancid/rancid -t paloalto -d panorama_hostname.internal.domain

I've also got a dump of all environment variables for the rancid user and put it in cron but same as before: rancid-run always fails for panorama but works for the firewalls. (it has the same content in the .raw file every time)

I was thinking that since invoking rancid from cron works but rancid-run fails, it might have something to do with how control_rancid or rancid-fe invokes rancid but couldn't see anything obvious in those scripts that might cause this behaviour.

I am not sure what exactly fails. I appreciate any pointers you might have.

Thanks,
Lucian Lepadatu

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20230727/ad314770/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 1595 bytes
Desc: image001.jpg
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20230727/ad314770/attachment.jpg>

From lepadatu.lucian at gmail.com  Thu Jul 27 11:27:38 2023
From: lepadatu.lucian at gmail.com (Lucian-Ionut Lepadatu)
Date: Thu, 27 Jul 2023 13:27:38 +0200
Subject: [rancid] rancid-run doesn't work from cron for panorama but
 works manually
In-Reply-To: <MN2PR03MB47517AC4E58D806813B10F9BB701A@MN2PR03MB4751.namprd03.prod.outlook.com>
References: <CA+vmu05x-EGGh1Tr8GoBxShp68UaCNvCG2=aon_GGFvynqwVzw@mail.gmail.com>
 <MN2PR03MB47517AC4E58D806813B10F9BB701A@MN2PR03MB4751.namprd03.prod.outlook.com>
Message-ID: <CA+vmu06PDTUftdeE-eDfz50cT_fU7NSvcQn=x7uKijMT=a_rmA@mail.gmail.com>

Indeed, the cron file that I've shared previously was the default one from
the rpm /etc/cron.d/rancid.
I've already tried the rancid user specific crontab but that behaves
exactly the same.
Given the format of the output from the .raw file (*set cli scripting**-mode
on* for example is not on a single line), maybe rancid is having trouble
parsing the output; I've tried adjusting the TERM and COLUMNS env vars and
even changed the hostname to something very short but without success.
That's what's been puzzling me: on one hand it looks like an env issue but
on the other even when run from the rancid user's crontab it still does not
work and I cannot pinpoint what exactly fails.

Thanks,
Lucian Lepadatu

On Thu, Jul 27, 2023 at 6:02?AM Piegorsch, Weylin William <weylin at bu.edu>
wrote:

> From the CRON file you shared, it looks like you?re executing this in the
> crontab in /etc?  I find it more reliable to execute system management
> tasks there (logrotate; updatedb; and so forth), but for rancid?s
> environment to be setup correctly when using rancid?s personal CRON file.
>
> ?sudo su - rancid ; crontab -e?
>
>
>
> Just remember that in a user?s crontab you don?t need to specify the user.
>
>
>
>
>
>
>
>
>
>
>
> [image: signature_1593189312]
>
>
>
> *Weylin Piegorsch *|  Manager, Network Engineering
>
> Boston University Information Services & Technology
> weylin at bu.edu | 617.353.8128 | bu.edu/tech <http://www.bu.edu/tech>
>
> *Listen. Learn. Lead.*
>
>
>
>
>
>
>
>
>
> *From:* Lucian-Ionut Lepadatu <lepadatu.lucian at gmail.com>
> *Sent:* Wednesday, July 26, 2023 9:47 AM
> *To:* rancid-discuss at www.shrubbery.net
> *Subject:* [rancid] rancid-run doesn't work from cron for panorama but
> works manually
>
>
>
> Hello,
>
> I am trying to make rancid pull the configs from a pair of Palo Alto
> Panorama devices.
>
> I've installed it on an Alma Linux 9 box with the default package from
> epel (rancid.x86_64 3.13-7.el9).
> I have in router.db a list of Palo Alto firewalls and a pair of Panorama
> devices. Login to all devices works.
>
> If I login with the rancid user and run rancid-run from the shell
> ([rancid at rancidbox ~]$ /usr/libexec/rancid/rancid-run) it gets the config
> for all devices.
> If I login as root and run rancid run as the rancid user
> ("[rancid at rancidbox ~]# sudo -u rancid /usr/libexec/rancid/rancid-run")
> it also works for all devices.
>
> But if I try to run it from cron as the user rancid, it works for the
> firewalls but not for panorama.
>
>
> The cron entry looks like this:
>
>
>
>
>
>
> *SHELL=/bin/bash PATH=/sbin:/bin:/usr/sbin:/usr/bin MAILTO=root
> HOME=/var/rancid 0 */8 * * * rancid /usr/libexec/rancid/rancid-run*
>
> In the rancid logs I see:
>
>
> *missed cmd(s): all commands End of run not found panlogin error: Error:
> TIMEOUT reached*
>
> I've managed to capture the .raw and .new files for a panorama device when
> rancid-run was executed from cron and looks like it connects to the device
> but it gets stuck:
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
> *[rancid at rancidbox ~]$ cat
> network-devices/configs/panorama_hostname.internal.domain.raw
> panorama_hostname.internal.domain spawn ssh -x -l rancid_login_user
> panorama_hostname.internal.domain
> *************************************************************************
>  *                                                                       *
>  *              WARNING! Access to this device is restricted             *
>  *                   to those individuals with specific                  *
>  *             permissions. If you are not an authorized user            *
>  *                             disconnect now.                           *
>  *                                                                       *
>  *                 Any attempts to gain unauthorized access              *
>  *                     will be prosecuted to the fullest                 *
>  *                             extent of the law.                        *
>  *                                                                       *
>  *************************************************************************
> (rancid_login_user at panorama_hostname.internal.domain
> <rancid_login_user at panorama_hostname.internal.domain>) Password: Last
> login: Wed Jul 26 11:51:59 2023 from IP.XXX.YYY.ZZZ No entry for terminal
> type "network"; using dumb terminal settings. Number of failed attempts
> since last successful login: 0
> rancid_login_user at panorama_hostname.internal.domain(primary-active)
> <rancid_login_user at panorama_hostname.internal.domain(primary-active)>>
> rancid_login_user at panorama_hostname.internal.domain(primary-active)
> <rancid_login_user at panorama_hostname.internal.domain(primary-active)>> set
> rancid_login_user at panorama_hostname.internal.domain(primary-active)
> <rancid_login_user at panorama_hostname.internal.domain(primary-active)>> set
> cli rancid_login_user at panorama_hostname.internal.domain(primary-active)
> <rancid_login_user at panorama_hostname.internal.domain(primary-active)>> set
> cli scripting -mode
> rancid_login_user at panorama_hostname.internal.domain(primary-active)
> <rancid_login_user at panorama_hostname.internal.domain(primary-active)>> set
> cli scripting -mode on
> rancid_login_user at panorama_hostname.internal.domain(primary-active)
> <rancid_login_user at panorama_hostname.internal.domain(primary-active)>>
> [rancid at rancidbox ~]$ [rancid at rancidbox ~]$ cat
> network-devices/configs/panorama_hostname.internal.domain.new
> #RANCID-CONTENT-TYPE: paloalto #*
>
>
>
> If I try to run run rancid instead of rancid-run from cron for panorama it
> works (needs a PATH added to be able to find the panlogin script but other
> than that it succeeds)
>
>
> *PATH=/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/usr/libexec/rancid/:/usr/share/perl5/vendor_perl/rancid*
>
> *08 10 * * * rancid /usr/libexec/rancid/rancid -t paloalto
> -d panorama_hostname.internal.domain*
>
>
>
> I've also got a dump of all environment variables for the rancid user and
> put it in cron but same as before: rancid-run always fails for panorama but
> works for the firewalls. (it has the same content in the .raw file every
> time)
>
> I was thinking that since invoking rancid from cron works but rancid-run
> fails, it might have something to do with how control_rancid or rancid-fe
> invokes rancid but couldn't see anything obvious in those scripts
> that might cause this behaviour.
>
> I am not sure what exactly fails. I appreciate any pointers you might have.
>
> Thanks,
> Lucian Lepadatu
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20230727/2aa1d2c6/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 1595 bytes
Desc: not available
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20230727/2aa1d2c6/attachment.jpg>

From durrani.anwar at gmail.com  Mon Jul 31 08:50:46 2023
From: durrani.anwar at gmail.com (Anwar Durrani)
Date: Mon, 31 Jul 2023 14:20:46 +0530
Subject: [rancid] Rancid configuration - switches The following routers have
 not been successfully contacted for more than 24 hours.
Message-ID: <CAJnNt7O9tBEjmC_BCY5kO=ABbaPhN3u1P3az+5xm5S8qYKKDjw@mail.gmail.com>

Hi Team,
I have added Cisco switches in Rancid, backup is taking place properly but
every 2 days, I am getting the following routers have not been successfully
contacted message, to resolve this issue I have to run the following command

cd /var/lib/rancid/

rm -rf switches/

/usr/lib/rancid/bin/rancid-cvs

A    switches/.cvsignore

A    switches/configs

A    switches/configs/.cvsignore


A    switches/configs/switch2.xxxx.com

A    switches/configs/switch7.xxxx.com

A    switches/configs/switch8.xxxx.xxxx.xxxx.com

A    switches/configs/switch9-xxxx.com

A    switches/configs/switch5.xxxx.com

A    switches/router.db

 U   switches

Checked out revision 50872.

Updating '.':

At revision 50872.

-- 
Thanks & regards,
Anwar M. Durrani
+91-9923205011
<http://in.linkedin.com/pub/anwar-durrani/20/b55/60b>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20230731/c9e6d748/attachment.htm>

From ugob at lubik.ca  Mon Jul 31 23:07:10 2023
From: ugob at lubik.ca (Ugo Bellavance)
Date: Mon, 31 Jul 2023 19:07:10 -0400
Subject: [rancid] Rancid configuration - switches The following routers
 have not been successfully contacted for more than 24 hours.
In-Reply-To: <CAJnNt7O9tBEjmC_BCY5kO=ABbaPhN3u1P3az+5xm5S8qYKKDjw@mail.gmail.com>
References: <CAJnNt7O9tBEjmC_BCY5kO=ABbaPhN3u1P3az+5xm5S8qYKKDjw@mail.gmail.com>
Message-ID: <CACSSk+XuXbfLp95CX_HemnHot7fmQdNC9Vu8-2TuJVJHEPtfJA@mail.gmail.com>

Check your logs.

On Mon, Jul 31, 2023 at 4:51?AM Anwar Durrani <durrani.anwar at gmail.com>
wrote:

> Hi Team,
> I have added Cisco switches in Rancid, backup is taking place properly but
> every 2 days, I am getting the following routers have not been successfully
> contacted message, to resolve this issue I have to run the following command
>
> cd /var/lib/rancid/
>
> rm -rf switches/
>
> /usr/lib/rancid/bin/rancid-cvs
>
> A    switches/.cvsignore
>
> A    switches/configs
>
> A    switches/configs/.cvsignore
>
>
> A    switches/configs/switch2.xxxx.com
>
> A    switches/configs/switch7.xxxx.com
>
> A    switches/configs/switch8.xxxx.xxxx.xxxx.com
>
> A    switches/configs/switch9-xxxx.com
>
> A    switches/configs/switch5.xxxx.com
>
> A    switches/router.db
>
>  U   switches
>
> Checked out revision 50872.
>
> Updating '.':
>
> At revision 50872.
>
> --
> Thanks & regards,
> Anwar M. Durrani
> +91-9923205011
> <http://in.linkedin.com/pub/anwar-durrani/20/b55/60b>
>
>
> _______________________________________________
> Rancid-discuss mailing list
> Rancid-discuss at www.shrubbery.net
> https://www.shrubbery.net/mailman/listinfo/rancid-discuss
>


-- 
Ugo Bellavance (ugob at lubik.ca)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/rancid-discuss/attachments/20230731/ca2e46d5/attachment.htm>