2:22 a.m.
Hello,
On our compute nodes the /var/log/secure log get flooded with the same kind
of messages:
Mar 22 10:17:57 xxx sudo: neutron : TTY=unknown ; PWD=/ ; USER=root ;
COMMAND=/usr/bin/neutron-rootwrap /etc/neutron/rootwrap.conf ovs-ofctl
dump-flows br-int table=22
Mar 22 10:17:59 xxx sudo: neutron : TTY=unknown ; PWD=/ ; USER=root ;
COMMAND=/usr/bin/neutron-rootwrap /etc/neutron/rootwrap.conf ovs-ofctl
dump-flows br-int table=22
Mar 22 10:18:01 xxx sudo: neutron : TTY=unknown ; PWD=/ ; USER=root ;
COMMAND=/usr/bin/neutron-rootwrap /etc/neutron/rootwrap.conf ovs-ofctl
dump-flows br-int table=22
Mar 22 10:18:03 xxx sudo: neutron : TTY=unknown ; PWD=/ ; USER=root ;
COMMAND=/usr/bin/neutron-rootwrap /etc/neutron/rootwrap.conf ovs-ofctl
dump-flows br-int table=22
Mar 22 10:18:05 xxx sudo: neutron : TTY=unknown ; PWD=/ ; USER=root ;
COMMAND=/usr/bin/neutron-rootwrap /etc/neutron/rootwrap.conf ovs-ofctl
dump-flows br-int table=22
Mar 22 10:18:07 xxx sudo: neutron : TTY=unknown ; PWD=/ ; USER=root ;
COMMAND=/usr/bin/neutron-rootwrap /etc/neutron/rootwrap.conf ovs-ofctl
dump-flows br-int table=22
Any hint what's the purpose of this and how to fix it?
Thanks in advance!
Cheers
Chris
2:58 a.m.
On 03/24/2015 08:22 AM, Chris wrote:
Any hint what’s the purpose of this and how to fix it?
By default every sudo call will be logged. I think you can disable the
log messages by adding "Defaults !syslog" to your /etc/sudoers file (use
visudo to edit the /etc/sudoers file).
Christian.
7:52 a.m.
New subject: [Rdo-list] [Openstack] compute node secure message flood rootwrap.conf ovs-ofctl dump-flows br-int table=22
On Tue, Mar 24, 2015 at 02:22:18PM +0700, Chris wrote:
On our compute nodes the /var/log/secure log get flooded with the
same kind
of messages:
Mar 22 10:17:57 xxx sudo: neutron : TTY=unknown ; PWD=/ ; USER=root ;
COMMAND=/usr/bin/neutron-rootwrap /etc/neutron/rootwrap.conf ovs-ofctl
dump-flows br-int table=22
Any hint what's the purpose of this and how to fix it?
The purpose is that neutron is monitoring the flow rules in that
particular table, probably in order ensure they remain correct.
Because neutron is running as an unprivileged user, it needs to use
"sudo" to gain elevated privileges.
The `sudo` command is, by default, quite verbose, which makes sense in
an environment where 'sudo' commands happen rarely as the result of
manual administrator actions. In an environment where it is part of
frequent automated tasks it can be an annoyance.
You can disable these messages for a *particular* user using syntax
like this:
Defaults:neutron !syslog
This will disable syslogging of sudo activity for user "neutron" while
still leaving it enabled for everyone else.
--
Lars Kellogg-Stedman <lars(a)redhat.com> | larsks @ {freenode,twitter,github}
Cloud Engineering / OpenStack | http://blog.oddbit.com/
6:50 p.m.
New subject: [Rdo-list] [Openstack] compute node secure message flood rootwrap.conf ovs-ofctl dump-flows br-int table=22
I see that in Fedora21 pam_unix also logs the sudo session and it
shows up like this:
sudo[17062]: neutron : TTY=unknown ; PWD=/ ; USER=root ;
COMMAND=/bin/neutron-rootwrap /etc/neutron/rootwrap.conf ovs-ofctl
dump-flows br-int table=23
sudo[17062]: pam_unix(sudo:session): session opened for user root by (uid=0)
sudo[17062]: pam_unix(sudo:session): session closed for user root
In that case you can disable the messages by:
Defaults:neutron !syslog, !pam_session
On Tue, Mar 24, 2015 at 1:52 PM, Lars Kellogg-Stedman <lars(a)redhat.com> wrote:
On Tue, Mar 24, 2015 at 02:22:18PM +0700, Chris wrote:
> On our compute nodes the /var/log/secure log get flooded with the same kind
> of messages:
>
> Mar 22 10:17:57 xxx sudo: neutron : TTY=unknown ; PWD=/ ; USER=root ;
> COMMAND=/usr/bin/neutron-rootwrap /etc/neutron/rootwrap.conf ovs-ofctl
> dump-flows br-int table=22
>
> Any hint what's the purpose of this and how to fix it?
The purpose is that neutron is monitoring the flow rules in that
particular table, probably in order ensure they remain correct.
Because neutron is running as an unprivileged user, it needs to use
"sudo" to gain elevated privileges.
The `sudo` command is, by default, quite verbose, which makes sense in
an environment where 'sudo' commands happen rarely as the result of
manual administrator actions. In an environment where it is part of
frequent automated tasks it can be an annoyance.
You can disable these messages for a *particular* user using syntax
like this:
Defaults:neutron !syslog
This will disable syslogging of sudo activity for user "neutron" while
still leaving it enabled for everyone else.
--
Lars Kellogg-Stedman <lars(a)redhat.com> | larsks @ {freenode,twitter,github}
Cloud Engineering / OpenStack | http://blog.oddbit.com/
_______________________________________________
Rdo-list mailing list
Rdo-list(a)redhat.com
https://www.redhat.com/mailman/listinfo/rdo-list
To unsubscribe: rdo-list-unsubscribe(a)redhat.com
10:26 p.m.
New subject: [Rdo-list] [Openstack] compute node secure message flood rootwrap.conf ovs-ofctl dump-flows br-int table=22
Hello Lars,
Thank you for the very detailed explanation, highly appreciated!
Cheers
Chris
-----Original Message-----
From: Lars Kellogg-Stedman [mailto:lars@redhat.com]
Sent: Tuesday, March 24, 2015 19:53
To: Chris
Cc: openstack(a)lists.openstack.org; rdo-list(a)redhat.com
Subject: Re: [Openstack] compute node secure message flood rootwrap.conf
ovs-ofctl dump-flows br-int table=22
On Tue, Mar 24, 2015 at 02:22:18PM +0700, Chris wrote:
On our compute nodes the /var/log/secure log get flooded with the
same
kind of messages:
Mar 22 10:17:57 xxx sudo: neutron : TTY=unknown ; PWD=/ ; USER=root ;
COMMAND=/usr/bin/neutron-rootwrap /etc/neutron/rootwrap.conf ovs-ofctl
dump-flows br-int table=22
Any hint what's the purpose of this and how to fix it?
The purpose is that neutron is monitoring the flow rules in that particular
table, probably in order ensure they remain correct.
Because neutron is running as an unprivileged user, it needs to use "sudo"
to gain elevated privileges.
The `sudo` command is, by default, quite verbose, which makes sense in an
environment where 'sudo' commands happen rarely as the result of manual
administrator actions. In an environment where it is part of frequent
automated tasks it can be an annoyance.
You can disable these messages for a *particular* user using syntax like
this:
Defaults:neutron !syslog
This will disable syslogging of sudo activity for user "neutron" while still
leaving it enabled for everyone else.
--
Lars Kellogg-Stedman <lars(a)redhat.com> | larsks @ {freenode,twitter,github}
Cloud Engineering / OpenStack | http://blog.oddbit.com/
3329
days inactive
3330
days old
4 comments
4 participants
participants (4)
-
Chris -
Christian Berendt -
Lars Kellogg-Stedman -
Marius Cornea