diff --git a/src/module_utils/filesystem_collector.py b/src/module_utils/filesystem_collector.py index 99d9a84f..b963cb73 100644 --- a/src/module_utils/filesystem_collector.py +++ b/src/module_utils/filesystem_collector.py @@ -671,12 +671,18 @@ def gather_lvm_groups_info(self, lvm_groups, vg_to_disk_names, azure_disk_data): total_iops += perf_data.get("iops", 0) total_mbps += perf_data.get("mbps", 0) + totalsize = vg_data.get("total_size", "") + lvm_groups_info.append( { "Name": vg_name, "Disks": vg_data.get("disks", 0), "LogicalVolumes": vg_data.get("logical_volumes", 0), - "TotalSize": vg_data.get("total_size", ""), + "TotalSize": ( + totalsize.replace("g", "GiB").replace("t", "TiB") + if totalsize and isinstance(totalsize, str) + else totalsize + ), "TotalIOPS": total_iops, "TotalMBPS": total_mbps, } @@ -704,6 +710,8 @@ def gather_lvm_volumes_info(self, lvm_volumes): try: for lv_name, lv_data in lvm_volumes.items(): + size = lv_data.get("size", "") + lvm_volumes_info.append( { "Name": lv_name, @@ -711,7 +719,11 @@ def gather_lvm_volumes_info(self, lvm_volumes): "LVPath": lv_data.get("path", ""), "DMPath": lv_data.get("dm_path", ""), "Layout": lv_data.get("layout", ""), - "Size": lv_data.get("size", ""), + "Size": ( + size.replace("g", "GiB").replace("t", "TiB") + if size and isinstance(size, str) + else size + ), "StripeSize": lv_data.get("stripe_size", ""), "Stripes": lv_data.get("stripes", ""), } diff --git a/src/playbook_00_configuration_checks.yml b/src/playbook_00_configuration_checks.yml index 3c828415..e48e614d 100644 --- a/src/playbook_00_configuration_checks.yml +++ b/src/playbook_00_configuration_checks.yml @@ -31,7 +31,6 @@ | map(attribute='value') | first }}" - - hosts: "{{ sap_sid | upper }}_SCS: {{ sap_sid | upper }}_ERS: {{ sap_sid | upper }}_DB: @@ -98,6 +97,12 @@ checks_var: "common_sap_checks", results_var: "common_sap_results" } + - { + name: "Networking", + file_name: "network", + checks_var: "networking_checks", + results_var: "networking_results" + } loop_control: loop_var: check_type @@ -264,6 +269,23 @@ groups[sap_sid | upper + '_PAS']|default([]) }}" when: hostvars[item].common_sap_results is defined + - name: "Collect networking check results" + ansible.builtin.set_fact: + all_results: "{{ all_results + hostvars[item].networking_results + | default([]) }}" + execution_metadata: "{{ execution_metadata + [ + {'host': item, + 'check_type': 'networking', + 'metadata': hostvars[item].networking_results_metadata + | default({})}] }}" + loop: "{{ groups[sap_sid | upper + '_SCS']|default([]) + + groups[sap_sid | upper + '_ERS']|default([]) + + groups[sap_sid | upper + '_DB']|default([]) + + groups[sap_sid | upper + '_APP']|default([]) + + groups[sap_sid | upper + '_WEB']|default([]) + + groups[sap_sid | upper + '_PAS']|default([]) }}" + when: hostvars[item].networking_results is defined + - name: "Collect DB (HANA) check results" ansible.builtin.set_fact: all_results: "{{ all_results + hostvars[item].db_hana_results diff --git a/src/roles/configuration_checks/tasks/disks.yml b/src/roles/configuration_checks/tasks/disks.yml index 603afc30..5556eea0 100644 --- a/src/roles/configuration_checks/tasks/disks.yml +++ b/src/roles/configuration_checks/tasks/disks.yml @@ -95,7 +95,7 @@ az disk show --name {{ item }} \ --subscription {{ compute_metadata.json.compute.subscriptionId }} \ --resource-group {{ compute_metadata.json.compute.resourceGroupName }} \ - --query "{name:name, sku:sku.name, size:sizeGb, encryption:encryption.type, iops:diskIOPSReadWrite, mbps:diskMBpsReadWrite, size:diskSizeGB}" --output json + --query "{name:name, sku:sku.name, size:sizeGb, encryption:encryption.type, iops:diskIOPSReadWrite, mbps:diskMBpsReadWrite, size:diskSizeGB, tier:tier}" --output json - name: Debug azure disks data collected when: azure_disks_metadata_results is defined @@ -103,8 +103,46 @@ var: azure_disks_metadata_results verbosity: 1 + - name: Check if any NFS filesystem is mounted + ansible.builtin.set_fact: + has_nfs_mounts: "{{ mount_info.stdout_lines | select('search', '\\snfs[34]?\\s') | list | length > 0 }}" + + - name: Check for ANF usage in mount_info, looking for IP addresses + when: has_nfs_mounts | bool + ansible.builtin.set_fact: + anf_ip_addresses: "{{ mount_info.stdout_lines + | map('split', ' ') + | map('list') + | selectattr('1', 'defined') + | map(attribute='1') + | select('match', '^(\\d{1,3}\\.){3}\\d{1,3}:') + | map('regex_replace', '^((\\d{1,3}\\.){3}\\d{1,3}):.*', '\\1') + | list + | unique }}" + - name: Debug ANF IP addresses found + when: anf_ip_addresses is defined + ansible.builtin.debug: + var: anf_ip_addresses + + - name: Check for AFS usage in mount_info, looking for storage account names + when: has_nfs_mounts | bool + ansible.builtin.set_fact: + afs_storage_accounts: "{{ mount_info.stdout_lines + | map('split', ' ') + | map(attribute='1') + | select('search', '\\.file\\.core\\.windows\\.net:/') + | map('regex_replace', '^.*:/([^/]+)/.*', '\\1') + | list + | unique }}" + + - name: Debug AFS storage account names found + when: afs_storage_accounts is defined + ansible.builtin.debug: + var: afs_storage_accounts + - name: Collect ANF storage data if NFS is used when: + - has_nfs_mounts | bool - NFS_provider is defined - "'ANF' in NFS_provider" - ANF_account_rg is defined @@ -155,29 +193,37 @@ - name: Collect AFS storage data if NFS is used when: + - has_nfs_mounts | bool - NFS_provider is defined - "'AFS' in NFS_provider" + - afs_storage_accounts is defined + - afs_storage_accounts | length > 0 register: afs_storage_metadata_results delegate_to: localhost ansible.builtin.shell: executable: /bin/bash cmd: | set -o pipefail - for sa in $(az storage account list \ - --query "[?kind=='FileStorage'].{rg:resourceGroup,name:name,id:id}" \ - -o tsv | awk '{print $1":"$2":"$3}'); do rg=$(echo $sa | cut -d: -f1); \ - acc=$(echo $sa | cut -d: -f2); sid=$(echo $sa | cut -d: -f3); \ - dns="$acc.file.core.windows.net"; for sh in $(az storage share-rm list --resource-group $rg --storage-account $acc \ - --query "[?enabledProtocols=='NFS'].[name,accessTier,quotaGiB]" -o tsv); \ - do name=$(echo $sh | awk '{print $1}'); tier=$(echo $sh | awk '{print $2}'); \ - quota=$(echo $sh | awk '{print $3}'); \ - peip=$(az network private-endpoint list \ - --query "[?privateLinkServiceConnections[?privateLinkServiceId=='$sid']].customDnsConfigs[].ipAddresses[]" -o tsv); \ - for ip in $peip; do thr=$((100 + ( (quota*4+99)/100 ) + ( (quota*6+99)/100 ) )); \ - iops=$((quota+3000)); \ - if [ $iops -gt 100000 ]; then iops=100000; fi; \ - echo "{\"Type\":\"AFS\",\"Name\":\"$name\",\"Pool\":\"$acc\",\"ServiceLevel\":\"$tier\",\"ThroughputMibps\":$thr,\"ProtocolTypes\":\"NFS4.1\",\"NFSAddressDNS\":\"$dns:/$acc/$name\",\"NFSAddress\":\"$ip:/$acc/$name\",\"QoSType\":\"Manual\",\"IOPS\":$iops,\"Id\":\"$sid\"}"; \ - done; done; done + for acc in {{ afs_storage_accounts | join(' ') }}; do + sa_info=$(az storage account show --name "$acc" --query "{rg:resourceGroup,name:name,id:id}" -o tsv) + rg=$(echo "$sa_info" | awk '{print $1}') + sid=$(echo "$sa_info" | awk '{print $3}') + dns="$acc.file.core.windows.net" + for sh in $(az storage share-rm list --resource-group "$rg" --storage-account "$acc" \ + --query "[?enabledProtocols=='NFS'].[name,accessTier,quotaGiB]" -o tsv); do + name=$(echo "$sh" | awk '{print $1}') + tier=$(echo "$sh" | awk '{print $2}') + quota=$(echo "$sh" | awk '{print $3}') + peip=$(az network private-endpoint list \ + --query "[?privateLinkServiceConnections[?privateLinkServiceId=='$sid']].customDnsConfigs[].ipAddresses[]" -o tsv) + for ip in $peip; do + thr=$((100 + ( (quota*4+99)/100 ) + ( (quota*6+99)/100 ) )) + iops=$((quota+3000)) + if [ $iops -gt 100000 ]; then iops=100000; fi + echo "{\"Type\":\"AFS\",\"Name\":\"$name\",\"Pool\":\"$acc\",\"ServiceLevel\":\"$tier\",\"ThroughputMibps\":$thr,\"ProtocolTypes\":\"NFS4.1\",\"NFSAddressDNS\":\"$dns:/$acc/$name\",\"NFSAddress\":\"$ip:/$acc/$name\",\"QoSType\":\"Manual\",\"IOPS\":$iops,\"Id\":\"$sid\"}" + done + done + done - name: Debug AFS storage data collected when: afs_storage_metadata_results is defined diff --git a/src/roles/configuration_checks/tasks/files/hana.yml b/src/roles/configuration_checks/tasks/files/hana.yml index 16cecb0a..db8ac2c4 100644 --- a/src/roles/configuration_checks/tasks/files/hana.yml +++ b/src/roles/configuration_checks/tasks/files/hana.yml @@ -162,57 +162,59 @@ checks: valid_list: ["reboot", "stonith-action=reboot"] report: *check - - id: "DB-HANA-0006" - name: "Load Balancer timestamps Non-HA" - description: "Timestamp parameter for Non-HA Load Balancers" + - id: "DB-HANA-0004" + name: "sysctl net.core.rmem_max" + description: "SAP HANA sysctl net.core.rmem_max" category: *os_check severity: *high workload: *sap applicability: os_type: [*suse, *redhat] os_version: *all_versions - hardware_type: *vm - storage_type: *all_storage + hardware_type: *all_hardware + storage_type: *premium_storage role: [*db_role] database_type: [*hana] - high_availability: false - high_availability_agent: *cluster_type collector_type: *command collector_args: - command: "/sbin/sysctl net.ipv4.tcp_timestamps -n" + command: "/sbin/sysctl net.core.rmem_max -n" user: *root validator_type: *string validator_args: - expected_output: "1" + expected_output: "2500000" report: *check + references: + microsoft: "https://docs.microsoft.com/en-us/azure/virtual-machines/workloads/sap/sap-hana-scale-out-standby-netapp-files-suse" + sap: "3024346" - - id: "DB-HANA-0007" - name: "Load Balancer timestamps HA" - description: "Timestamp parameter for HA Load Balancers" + - id: "DB-HANA-0005" + name: "sysctl net.core.rmem_max" + description: "SAP HANA sysctl net.core.rmem_max" category: *os_check severity: *high workload: *sap applicability: os_type: [*suse, *redhat] os_version: *all_versions - hardware_type: *vm - storage_type: *all_storage + hardware_type: *all_hardware + storage_type: *anf role: [*db_role] database_type: [*hana] - high_availability: true - high_availability_agent: *cluster_type collector_type: *command collector_args: - command: "/sbin/sysctl net.ipv4.tcp_timestamps -n" + command: "/sbin/sysctl net.core.rmem_max -n" user: *root validator_type: *string validator_args: - expected_output: "0" + expected_output: "16777216" report: *check + references: + microsoft: "https://docs.microsoft.com/en-us/azure/virtual-machines/workloads/sap/sap-hana-scale-out-standby-netapp-files-suse" + sap: "3024346" - - id: "DB-HANA-0008" - name: "sysctl net.core.rmem_max" - description: "SAP HANA sysctl net.core.rmem_max" + - id: "DB-HANA-0006" + name: "sysctl net.core.wmem_max" + description: "SAP HANA sysctl net.core.wmem_max" category: *os_check severity: *high workload: *sap @@ -220,22 +222,22 @@ checks: os_type: [*suse, *redhat] os_version: *all_versions hardware_type: *all_hardware - storage_type: *all_storage + storage_type: *premium_storage role: [*db_role] database_type: [*hana] collector_type: *command collector_args: - command: "/sbin/sysctl net.core.rmem_max -n" + command: "/sbin/sysctl net.core.wmem_max -n" user: *root validator_type: *string validator_args: - expected_output: "16777216" + expected_output: "212992" report: *check references: microsoft: "https://docs.microsoft.com/en-us/azure/virtual-machines/workloads/sap/sap-hana-scale-out-standby-netapp-files-suse" sap: "3024346" - - id: "DB-HANA-0009" + - id: "DB-HANA-0007" name: "sysctl net.core.wmem_max" description: "SAP HANA sysctl net.core.wmem_max" category: *os_check @@ -245,7 +247,7 @@ checks: os_type: [*suse, *redhat] os_version: *all_versions hardware_type: *all_hardware - storage_type: *all_storage + storage_type: *anf role: [*db_role] database_type: [*hana] collector_type: *command @@ -260,7 +262,7 @@ checks: microsoft: "https://docs.microsoft.com/en-us/azure/virtual-machines/workloads/sap/sap-hana-scale-out-standby-netapp-files-suse" sap: "3024346" - - id: "DB-HANA-0010" + - id: "DB-HANA-0008" name: "sysctl net.ipv4.tcp_rmem" description: "SAP HANA sysctl net.ipv4.tcp_rmem" category: *os_check @@ -270,7 +272,32 @@ checks: os_type: [*suse, *redhat] os_version: *all_versions hardware_type: *all_hardware - storage_type: *all_storage + storage_type: *premium_storage + role: [*db_role] + database_type: [*hana] + collector_type: *command + collector_args: + command: "/sbin/sysctl net.ipv4.tcp_rmem -n" + user: *root + validator_type: *string + validator_args: + expected_output: "4096 131072 6291456" + report: *check + references: + microsoft: "https://docs.microsoft.com/en-us/azure/virtual-machines/workloads/sap/sap-hana-scale-out-standby-netapp-files-suse" + sap: "3024346" + + - id: "DB-HANA-0009" + name: "sysctl net.ipv4.tcp_rmem" + description: "SAP HANA sysctl net.ipv4.tcp_rmem" + category: *os_check + severity: *high + workload: *sap + applicability: + os_type: [*suse, *redhat] + os_version: *all_versions + hardware_type: *all_hardware + storage_type: *anf role: [*db_role] database_type: [*hana] collector_type: *command @@ -285,6 +312,31 @@ checks: microsoft: "https://docs.microsoft.com/en-us/azure/virtual-machines/workloads/sap/sap-hana-scale-out-standby-netapp-files-suse" sap: "3024346" + - id: "DB-HANA-0010" + name: "sysctl net.ipv4.tcp_wmem" + description: "SAP HANA sysctl net.ipv4.tcp_wmem" + category: *os_check + severity: *high + workload: *sap + applicability: + os_type: [*suse, *redhat] + os_version: *all_versions + hardware_type: *all_hardware + storage_type: *premium_storage + role: [*db_role] + database_type: [*hana] + collector_type: *command + collector_args: + command: "/sbin/sysctl net.ipv4.tcp_wmem -n" + user: *root + validator_type: *string + validator_args: + expected_output: "4096 16384 4194304" + report: *check + references: + microsoft: "https://docs.microsoft.com/en-us/azure/virtual-machines/workloads/sap/sap-hana-scale-out-standby-netapp-files-suse" + sap: "3024346" + - id: "DB-HANA-0011" name: "sysctl net.ipv4.tcp_wmem" description: "SAP HANA sysctl net.ipv4.tcp_wmem" @@ -295,7 +347,7 @@ checks: os_type: [*suse, *redhat] os_version: *all_versions hardware_type: *all_hardware - storage_type: *all_storage + storage_type: *anf role: [*db_role] database_type: [*hana] collector_type: *command @@ -320,7 +372,7 @@ checks: os_type: [*suse, *redhat] os_version: *all_versions hardware_type: *all_hardware - storage_type: *all_storage + storage_type: *anf role: [*db_role] database_type: [*hana] collector_type: *command @@ -345,7 +397,7 @@ checks: os_type: [*suse, *redhat] os_version: *all_versions hardware_type: *all_hardware - storage_type: *all_storage + storage_type: *anf role: [*db_role] database_type: [*hana] collector_type: *command @@ -370,7 +422,7 @@ checks: os_type: [*suse, *redhat] os_version: *all_versions hardware_type: *all_hardware - storage_type: *all_storage + storage_type: *anf role: [*db_role] database_type: [*hana] collector_type: *command @@ -420,7 +472,7 @@ checks: os_type: [*suse, *redhat] os_version: *all_versions hardware_type: *all_hardware - storage_type: *all_storage + storage_type: *premium_storage role: [*db_role] database_type: [*hana] collector_type: *command @@ -429,13 +481,38 @@ checks: user: *root validator_type: *string validator_args: - expected_output: "1" + expected_output: "0" report: *check references: microsoft: "https://docs.microsoft.com/en-us/azure/virtual-machines/workloads/sap/sap-hana-scale-out-standby-netapp-files-suse" sap: "3024346" - id: "DB-HANA-0017" + name: "sysctl net.ipv4.tcp_timestamps" + description: "SAP HANA sysctl net.ipv4.tcp_timestamps" + category: *os_check + severity: *high + workload: *sap + applicability: + os_type: [*suse, *redhat] + os_version: *all_versions + hardware_type: *all_hardware + storage_type: *anf + role: [*db_role] + database_type: [*hana] + collector_type: *command + collector_args: + command: "/sbin/sysctl net.ipv4.tcp_timestamps -n" + user: *root + validator_type: *string + validator_args: + expected_output: "1" + report: *check + references: + microsoft: "https://docs.microsoft.com/en-us/azure/virtual-machines/workloads/sap/sap-hana-scale-out-standby-netapp-files-suse" + sap: "3024346" + + - id: "DB-HANA-0018" name: "sysctl net.ipv4.tcp_sack" description: "SAP HANA sysctl net.ipv4.tcp_sack" category: *os_check @@ -445,7 +522,7 @@ checks: os_type: [*suse, *redhat] os_version: *all_versions hardware_type: *all_hardware - storage_type: *all_storage + storage_type: *anf role: [*db_role] database_type: [*hana] collector_type: *command @@ -460,7 +537,7 @@ checks: microsoft: "https://docs.microsoft.com/en-us/azure/virtual-machines/workloads/sap/sap-hana-scale-out-standby-netapp-files-suse" sap: "3024346" - - id: "DB-HANA-0018" + - id: "DB-HANA-0019" name: "sysctl net.ipv6.conf.all.disable_ipv6" description: "SAP HANA sysctl net.ipv6.conf.all.disable_ipv6" category: *os_check @@ -470,7 +547,7 @@ checks: os_type: [*suse, *redhat] os_version: *all_versions hardware_type: *all_hardware - storage_type: *all_storage + storage_type: *anf role: [*db_role] database_type: [*hana] collector_type: *command @@ -485,7 +562,7 @@ checks: microsoft: "https://docs.microsoft.com/en-us/azure/virtual-machines/workloads/sap/sap-hana-scale-out-standby-netapp-files-suse" sap: "3024346" - - id: "DB-HANA-0019" + - id: "DB-HANA-0020" name: "sysctl net.ipv4.tcp_max_syn_backlog" description: "SAP HANA sysctl net.ipv4.tcp_max_syn_backlog" category: *os_check @@ -495,22 +572,22 @@ checks: os_type: [*suse, *redhat] os_version: *all_versions hardware_type: *all_hardware - storage_type: *all_storage + storage_type: *anf role: [*db_role] database_type: [*hana] collector_type: *command collector_args: command: "/sbin/sysctl net.ipv4.tcp_max_syn_backlog -n" user: *root - validator_type: *string + validator_type: *range validator_args: - expected_output: "16348" + min: "8192" report: *check references: microsoft: "https://docs.microsoft.com/en-us/azure/virtual-machines/workloads/sap/sap-hana-scale-out-standby-netapp-files-suse" sap: "3024346" - - id: "DB-HANA-0020" + - id: "DB-HANA-0021" name: "sysctl net.ipv4.ip_local_port_range" description: "SAP HANA sysctl net.ipv4.ip_local_port_range" category: *os_check @@ -529,13 +606,13 @@ checks: user: *root validator_type: *string validator_args: - expected_output: "9000 65300" + expected_output: "9000 65499" report: *check references: microsoft: "https://docs.microsoft.com/en-us/azure/virtual-machines/workloads/sap/sap-hana-scale-out-standby-netapp-files-suse" sap: "3024346" - - id: "DB-HANA-0021" + - id: "DB-HANA-0022" name: "sysctl net.ipv4.conf.all.rp_filter" description: "SAP HANA sysctl net.ipv4.conf.all.rp_filter" category: *os_check @@ -545,7 +622,7 @@ checks: os_type: [*suse, *redhat] os_version: *all_versions hardware_type: *all_hardware - storage_type: *all_storage + storage_type: *anf role: [*db_role] database_type: [*hana] collector_type: *command @@ -560,7 +637,7 @@ checks: microsoft: "https://docs.microsoft.com/en-us/azure/virtual-machines/workloads/sap/sap-hana-scale-out-standby-netapp-files-suse" sap: "3024346" - - id: "DB-HANA-0022" + - id: "DB-HANA-0023" name: "sysctl sunrpc.tcp_slot_table_entries" description: "SAP HANA sysctl sunrpc.tcp_slot_table_entries" category: *os_check @@ -570,7 +647,7 @@ checks: os_type: [*suse, *redhat] os_version: *all_versions hardware_type: *all_hardware - storage_type: *all_storage + storage_type: *anf role: [*db_role] database_type: [*hana] collector_type: *command @@ -585,7 +662,7 @@ checks: microsoft: "https://docs.microsoft.com/en-us/azure/virtual-machines/workloads/sap/sap-hana-scale-out-standby-netapp-files-suse" sap: "3024346" - - id: "DB-HANA-0023" + - id: "DB-HANA-0024" name: "sysctl vm.swappiness" description: "SAP HANA sysctl vm.swappiness" category: *os_check @@ -610,7 +687,7 @@ checks: microsoft: "https://docs.microsoft.com/en-us/azure/virtual-machines/workloads/sap/sap-hana-scale-out-standby-netapp-files-suse" sap: "3024346" - - id: "DB-HANA-0024" + - id: "DB-HANA-0025" name: "Red Hat tuned-adm profile" description: "SAP HANA Red Hat tuned-adm profile" category: *sap_check @@ -634,30 +711,6 @@ checks: references: sap: "2777782" - - id: "DB-HANA-0025" - name: "Kernel version higher than 4.12.14-95.37.1" - description: "SAP HANA Backup fails on Azure - SLES 12.4" - category: *sap_check - severity: *warning - workload: *sap - applicability: - os_type: [*suse] - os_version: [*suse_12_4] - hardware_type: *vm - storage_type: *premium_storage - role: [*db_role] - database_type: [*hana] - collector_type: *command - collector_args: - command: "uname -r" - user: *root - validator_type: *string - validator_args: - expected_output: "4.12.14-95.37.1" - report: *check - references: - sap: "2814271" - - id: "DB-HANA-0026" name: "Mellanox TX timeout - CPU soft lockup" description: "set hv_storvsc.storvsc_ringbuffer_size=131072 and hv_storvsc.storvsc_vcpus_per_sub_channel=1024 in kernel boot line" @@ -905,7 +958,7 @@ checks: - id: "DB-HANA-0036" name: "Stripe size for /hana/log" - description: "The stripe size for /hana/log should be 256k (256.00k or 262144 bytes)" + description: "The stripe size for /hana/log should be 64 (64.00k or 65536 bytes)" category: *sap_check severity: *high workload: *sap @@ -923,7 +976,7 @@ checks: mount_point: "/hana/log" validator_type: *string validator_args: - expected: "256.00k" + expected: "64.00k" report: *check references: sap: "2972496" @@ -1284,4 +1337,29 @@ checks: report: *check references: sap: "2972496" - microsoft: "https://docs.microsoft.com/en-us/azure/virtual-machines/workloads/sap/hana-vm-operations-storage" \ No newline at end of file + microsoft: "https://docs.microsoft.com/en-us/azure/virtual-machines/workloads/sap/hana-vm-operations-storage" + + + - id: "DB-HANA-0052" + name: "Kernel version higher than 4.12.14-95.37.1" + description: "SAP HANA Backup fails on Azure - SLES 12.4" + category: *sap_check + severity: *warning + workload: *sap + applicability: + os_type: [*suse] + os_version: [*suse_12_4] + hardware_type: *vm + storage_type: *premium_storage + role: [*db_role] + database_type: [*hana] + collector_type: *command + collector_args: + command: "uname -r" + user: *root + validator_type: *string + validator_args: + expected_output: "4.12.14-95.37.1" + report: *check + references: + sap: "2814271" diff --git a/src/roles/configuration_checks/tasks/files/network.yml b/src/roles/configuration_checks/tasks/files/network.yml new file mode 100644 index 00000000..07cf25d1 --- /dev/null +++ b/src/roles/configuration_checks/tasks/files/network.yml @@ -0,0 +1,220 @@ +enums: + severity: + - info: &info "INFO" + - high: &high "HIGH" + - low: &low "LOW" + - warning: &warning "WARNING" + - critical: &critical "CRITICAL" + - all_severity: &severity [*info, *high, *low, *warning, *critical] + + os_type: + - suse: &suse "SLES_SAP" + - redhat: &redhat "REDHAT" + - oraclelinux: &oraclelinux "OracleLinux" + - windows: &windows "Windows" + - all_os: &os_type [*suse, *redhat, *oraclelinux, *windows] + + os_version: + - suse_12_3: &suse_12_3 "SUSE 12 SP3" + - suse_12_4: &suse_12_4 "SUSE 12 SP4" + - suse_12_5: &suse_12_5 "SUSE 12 SP5" + - suse_15_0: &suse_15_0 "SUSE 15 SP0" + - suse_15_0: &suse_15_1 "SUSE 15 SP1" + - all_versions: &all_versions "all" + + hardware_type: + - vm: &vm "VM" + - hli: &hli "HLI" + - all_hardware: &all_hardware [*vm, *hli] + + storage_type: + premium_storage: &premium_storage ["Premium_LRS","UltraSSD_LRS","PremiumV2_LRS","AFS"] + anf: &anf ["ANF"] + all_storage: &all_storage ["Premium_LRS","UltraSSD_LRS","StandardSSD_LRS","Standard_LRS","ANF","PremiumV2_LRS","AFS"] + + workload: + - sap: &sap "SAP" + - all_workload: &workload [*sap] + + db: + - hana: &hana "HANA" + - mssql: &mssql "MSSQL" + - oracle: &oracle "Oracle" + - db2: &db2 "Db2" + - ase: &ase "ASE" + - all_db: &db [*hana, *mssql, *oracle, *db2, *ase] + + role: + - db: &db_role "DB" + - ascs: &ascs_role "SCS" + - ers: &ers_role "ERS" + - app: &app_role "APP" + - webdispatcher: &web_dispatch "WEB" + - pas: &pas "PAS" + - all_role: &role [*db_role, *ascs_role, *ers_role, *app_role, *web_dispatch, *pas] + + cluster_type: + - sbd: &sbd "ISCSI" + - fencing_agent: &fencing_agent "AFA" + - all_fencing_agent: &cluster_type [*sbd, *fencing_agent] + + collector_type: + - command: &command "command" + - azure: &azure "azure" + - all_collector_type: &collector_type [*command, *azure] + + category: + - package: &package_check "Package" + - vm: &vm_check "Virtual Machine" + - sap: &sap_check "SAP" + - os: &os_check "Operating System" + - network: &network_check "Networking" + - all_check_types: &category [*package_check, *vm_check, *sap_check, *os_check, *network_check] + + user: + - root: &root "root" + - sidadm: &sidadm "sidadm" + - all_users: &user [*root, *sidadm] + + validator_type: + - string: &string "string" + - range: &range "range" + - list: &list "list" + - all: &validator_type [*string, *range, *list] + + report: + - check: &check "check" + - section: §ion "section" + - table: &table "table" + - report: &report [*check, *section, *table] + +checks: + - id: "NET-0001" + name: "No of network interface" + description: "Checks the number of network interfaces on the VM" + category: *network_check + severity: *info + workload: *workload + applicability: + hardware_type: *vm + collector_type: *azure + collector_args: + command: |- + az vm nic list --resource-group {{ CONTEXT.resource_group_name }} \ + --vm-name {{ CONTEXT.vm_name }} \ + --subscription {{ CONTEXT.subscription_id }} \ + --query "[].{Name:id}" -o tsv | wc -l + report: *check + + - id: "NET-0002" + name: "Network Interface Name" + description: "Retrieves the name of the network interface(s) attached to the VM" + category: *network_check + severity: *info + workload: *workload + applicability: + hardware_type: *vm + collector_type: *azure + collector_args: + command: |- + az vm nic list --resource-group {{ CONTEXT.resource_group_name }} \ + --vm-name {{ CONTEXT.vm_name }} \ + --subscription {{ CONTEXT.subscription_id }} \ + --query "[].id" -o tsv | xargs -I {} basename {} + report: *check + + - id: "NET-0003" + name: "Subnet" + description: "Retrieves the subnet(s) associated with the VM's network interface(s)" + category: *network_check + severity: *info + workload: *workload + applicability: + hardware_type: *vm + collector_type: *azure + collector_args: + command: |- + az vm nic list --resource-group {{ CONTEXT.resource_group_name }} \ + --vm-name {{ CONTEXT.vm_name }} \ + --subscription {{ CONTEXT.subscription_id }} \ + --query "[].id" -o tsv | while read nic_id; do \ + nic=$(basename "$nic_id"); \ + az network nic show --resource-group {{ CONTEXT.resource_group_name }} --name "$nic" \ + --query "ipConfigurations[].subnet.id" -o tsv | xargs -I {} basename {}; \ + done + report: *check + + - id: "NET-0004" + name: "Accelerated Networking" + description: "Checks if Accelerated Networking is enabled on the VM's network interface(s)" + category: *network_check + severity: *high + workload: *workload + applicability: + hardware_type: *vm + collector_type: *azure + collector_args: + command: |- + az vm nic list --resource-group {{ CONTEXT.resource_group_name }} \ + --vm-name {{ CONTEXT.vm_name }} \ + --subscription {{ CONTEXT.subscription_id }} \ + --query "[].id" -o tsv | while read nic_id; do \ + nic=$(basename "$nic_id"); \ + status=$(az network nic show --resource-group {{ CONTEXT.resource_group_name }} --name "$nic" \ + --query "enableAcceleratedNetworking" -o tsv); \ + echo "$status"; \ + done + validator_type: *string + validator_args: + expected_output: "true" + report: *check + + - id: "NET-0005" + name: "No of IP configurations" + description: "Checks the number of IP configurations on each network interface" + category: *network_check + severity: *info + workload: *workload + applicability: + hardware_type: *vm + collector_type: *azure + collector_args: + command: |- + az vm nic list --resource-group {{ CONTEXT.resource_group_name }} \ + --vm-name {{ CONTEXT.vm_name }} \ + --subscription {{ CONTEXT.subscription_id }} \ + --query "[].id" -o tsv | while read nic_id; do \ + nic=$(basename "$nic_id"); \ + count=$(az network nic show --resource-group {{ CONTEXT.resource_group_name }} --name "$nic" \ + --query "ipConfigurations | length(@)" -o tsv); \ + echo "$nic: $count"; \ + done + report: *check + + - id: "NET-0006" + name: "IP Details" + description: "Retrieves all IP addresses configured on the VM's network interface(s)" + category: *network_check + severity: *info + workload: *workload + applicability: + hardware_type: *vm + collector_type: *azure + collector_args: + command: |- + az vm nic list --resource-group {{ CONTEXT.resource_group_name }} \ + --vm-name {{ CONTEXT.vm_name }} \ + --subscription {{ CONTEXT.subscription_id }} \ + --query "[].id" -o tsv | while read nic_id; do \ + nic=$(basename "$nic_id"); \ + az network nic show --resource-group {{ CONTEXT.resource_group_name }} --name "$nic" \ + --query "ipConfigurations[].{IP:privateIPAddress, Primary:primary}" -o tsv | \ + while IFS=$'\t' read -r ip is_primary; do \ + if [ "${is_primary,,}" = "true" ]; then \ + echo "$nic: $ip Primary"; \ + else \ + echo "$nic: $ip Secondary"; \ + fi; \ + done; \ + done + report: *check diff --git a/src/roles/configuration_checks/tasks/files/virtual_machine.yml b/src/roles/configuration_checks/tasks/files/virtual_machine.yml index 671517a3..cbfb01b0 100644 --- a/src/roles/configuration_checks/tasks/files/virtual_machine.yml +++ b/src/roles/configuration_checks/tasks/files/virtual_machine.yml @@ -259,26 +259,23 @@ checks: report: *check - id: "IC-0012" - name: "OS Timezone" - description: "Checks the OS timezone" + name: "Linux Major and Minor Release" + description: "Checks the Linux major and minor release" category: *vm_check severity: *info workload: *workload applicability: - os_type: [*suse, *redhat, *oraclelinux] - os_version: *all_versions + os_type: [*suse] hardware_type: *vm - role: *role - database_type: *db collector_type: *command collector_args: - command: "/bin/date +%Z" + command: "/bin/cat /etc/os-release | grep VARIANT_ID | cut -d '=' -f2 | tr -d '\"'" user: *root report: *check - id: "IC-0013" - name: "OS KDUMP Configuration" - description: "Checks the KDUMP configuration of the system" + name: "OS Timezone" + description: "Checks the OS timezone" category: *vm_check severity: *info workload: *workload @@ -290,7 +287,7 @@ checks: database_type: *db collector_type: *command collector_args: - command: "/bin/systemctl status kdump.service | grep -o 'Active:.*'" + command: "/bin/date +%Z" user: *root report: *check @@ -661,7 +658,7 @@ checks: if [ -z "$ppg_id" ] || [ "$ppg_id" = "null" ]; then echo "No PPG defined"; else - az ppg show --ids "$ppg_id" --query 'virtualMachines[].id' -o tsv 2>/dev/null || echo "Error: Failed to retrieve PPG VMs"; + az ppg show --ids "$ppg_id" --query 'virtualMachines[].id' -o tsv 2>/dev/null | while read vm_id; do basename "$vm_id"; done || echo "Error: Failed to retrieve PPG VMs"; fi else echo "Error: Failed to retrieve VM PPG"; @@ -883,7 +880,6 @@ checks: fi report: *check - - id: "IC-0040" name: "Cluster Configuration" description: "Checks the cluster configuration of the system" @@ -903,3 +899,21 @@ checks: command: "crm config show" user: *root report: *section + + - id: "IC-0041" + name: "OS KDUMP Configuration" + description: "Checks the KDUMP configuration of the system" + category: *vm_check + severity: *info + workload: *workload + applicability: + os_type: [*suse, *redhat, *oraclelinux] + os_version: *all_versions + hardware_type: *vm + role: *role + database_type: *db + collector_type: *command + collector_args: + command: "/bin/systemctl status kdump.service | grep -o 'Active:.*'" + user: *root + report: *check \ No newline at end of file diff --git a/src/roles/configuration_checks/tasks/main.yml b/src/roles/configuration_checks/tasks/main.yml index be9623fb..79c5a7d9 100644 --- a/src/roles/configuration_checks/tasks/main.yml +++ b/src/roles/configuration_checks/tasks/main.yml @@ -55,6 +55,7 @@ check_type: "{{ check_type }}" vm_name: "{{ compute_metadata.json.compute.name }}" resource_group_name: "{{ compute_metadata.json.compute.resourceGroupName }}" + subscription_id: "{{ compute_metadata.json.compute.subscriptionId | default('unknown') }}" supported_configurations: "{{ vm_support }}" hostname: "{{ inventory_hostname }}" os_type: "{{ ansible_distribution | upper }}" diff --git a/src/templates/config_checks_report.html b/src/templates/config_checks_report.html index 62bbe2c7..b9c029c3 100644 --- a/src/templates/config_checks_report.html +++ b/src/templates/config_checks_report.html @@ -7,9 +7,12 @@ {% macro render_table(data, is_nested=false) %} - {% if not data %} -
| {{ check.check.id }} | {{ check.check.name }} | @@ -1303,6 +1309,8 @@