Watch handler not being invoked

[Kenneth Lehner]

I have a python checks watch handler configured thusly:

{

  "bind_addr" : "135.91.205.104",

  "client_addr" : "0.0.0.0",

  "bootstrap_expect" : 3,

  "data_dir" : "/opt/consul/data",

  "datacenter": "",

  "http_api_response_headers": {

      "Access-Control-Allow-Origin" : "*"

  },

  "server": true,

  "watches": [

  {

      "type": "checks",

      "handler": "/usr/bin/watchHandler.py"

  }

  ],

  "ui": true

}

Unfortunately, I see no indication that it is being invoked.  I register a new service that specifies a health check, the health check is invoked (I see the result on the console), but my watch handler outputs no log entries.  Given that Consul provides no API that exposes what watch handlers, I can't determine if Consul isn't invoking the script, if the script is failing, Consul (which is run as root from a blueprint) or the script doesn't have the correct permissions, or anything else.

If I run this script via the CLI ("consul watch -type=checks..."), it appears to run correctly and creates the log files and entries as expected.

Has anyone else gotten this to work?

[Иван Сусанин]

Hi,

Have somewhat similar issue with latest consul (0.8.3)

For node config I have:

{                                                                                                                                                                                                        
"advertise_addr": "x.x.x.x",                                                                                                                                                                        
"bind_addr": "x.x.x.x",                                                                                                                                                                             
"ports":                                                                                                                                                                                                 
    {                                                                                                                                                                                                    
            "http": 8443                                                                                                                                                                                 
    },                                                                                                                                                                                                   
    "watches": [                                                                                                                                                                                         
        {                                                                                                                                                                                                
            "type": "keyprefix",                                                                                                                                                                         
            "prefix": "VNC/conf/private/VNC/sites_map_generator/",                                                                                                                                       
            "handler": "/consul/sites_map_generator-git_based_watch_v2.sh"                                                                                                          
        }                                                                                                                                                                                                
    ]                                                                                                                                                                                                    
}

All works as expected while running from CLI as:

$ consul watch -type=keyprefix -prefix=VNC/conf/private/VNC/sites_map_generator/ -token $CONSUL_HTTP_TOKEN  "/consul/sites_map_generator-git_based_watch_v2.sh"


But, does not works from config definition - the only (and only!) message I get on consul startup:

2017/05/18 19:02:42 [DEBUG] agent: watch handler '/consul/sites_map_generator-git_based_watch_v2.sh' output:

Nothing more...
And, even while in monitor - it does not show this watch fired when anything changed under "VNC/conf/private/VNC/sites_map_generator/"....
Really strange.

Any way to debug this issue?




вторник, 16 мая 2017 г., 22:42:24 UTC+3 пользователь Kenneth Lehner написал:

[James Phillips]

Hi,

For the first issue, starting Consul with debug-level logging might
shed some light on the issue.

For the second one, it seems like it might be an issue related to
ACLs. When you run it from the command line you are supplying a token,
but the built-in watch handler is leaving that empty so it's using the
anonymous token. We'd need some additional code to get the internal
watches to be able to pass an ACL token.

-- James

> --
> This mailing list is governed under the HashiCorp Community Guidelines -
> https://www.hashicorp.com/community-guidelines.html. Behavior in violation
> of those guidelines may result in your removal from this mailing list.
>
> GitHub Issues: https://github.com/hashicorp/consul/issues
> IRC: #consul on Freenode
> ---
> You received this message because you are subscribed to the Google Groups
> "Consul" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to consul-tool...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/consul-tool/055c774d-f547-4e34-a47e-02db554d6cfb%40googlegroups.com.
>
> For more options, visit https://groups.google.com/d/optout.

[Иван Сусанин]

Hi James,

Thank you a lot for reply, that makes sense.

Let me know if I can provide you any additional debug information or any test I can run to help in investigating this issue.

Thank you,

Ivan

> email to consul-tool+unsubscribe@googlegroups.com.

> To view this discussion on the web visit
> https://groups.google.com/d/msgid/consul-tool/055c774d-f547-4e34-a47e-02db554d6cfb%40googlegroups.com.
>
> For more options, visit https://groups.google.com/d/optout.

--
This mailing list is governed under the HashiCorp Community Guidelines - https://www.hashicorp.com/community-guidelines.html. Behavior in violation of those guidelines may result in your removal from this mailing list.

GitHub Issues: https://github.com/hashicorp/consul/issues
IRC: #consul on Freenode
---

You received this message because you are subscribed to a topic in the Google Groups "Consul" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/consul-tool/1ZxQk9qIGpk/unsubscribe.
To unsubscribe from this group and all its topics, send an email to consul-tool+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/consul-tool/CAGoWc07j1jSga7YmpDjBHSR8eEUVfN9GejwJ%2BVOrF0t-hysntw%40mail.gmail.com.

[James Phillips]

Can you temporarily give the anonymous token read access to that path
in the KV? If that works it's definitely an ACL issue. If you'd like
to open a GitHub issue for that we can look into allowing watches to
be configured with ACL tokens.

>> > email to consul-tool...@googlegroups.com.

>> > To view this discussion on the web visit
>> >
>> > https://groups.google.com/d/msgid/consul-tool/055c774d-f547-4e34-a47e-02db554d6cfb%40googlegroups.com.
>> >
>> > For more options, visit https://groups.google.com/d/optout.
>>
>> --
>> This mailing list is governed under the HashiCorp Community Guidelines -
>> https://www.hashicorp.com/community-guidelines.html. Behavior in violation
>> of those guidelines may result in your removal from this mailing list.
>>
>> GitHub Issues: https://github.com/hashicorp/consul/issues
>> IRC: #consul on Freenode
>> ---
>> You received this message because you are subscribed to a topic in the
>> Google Groups "Consul" group.
>> To unsubscribe from this topic, visit
>> https://groups.google.com/d/topic/consul-tool/1ZxQk9qIGpk/unsubscribe.
>> To unsubscribe from this group and all its topics, send an email to

>> consul-tool...@googlegroups.com.

>> To view this discussion on the web visit
>> https://groups.google.com/d/msgid/consul-tool/CAGoWc07j1jSga7YmpDjBHSR8eEUVfN9GejwJ%2BVOrF0t-hysntw%40mail.gmail.com.
>> For more options, visit https://groups.google.com/d/optout.
>
>

> --
> This mailing list is governed under the HashiCorp Community Guidelines -
> https://www.hashicorp.com/community-guidelines.html. Behavior in violation
> of those guidelines may result in your removal from this mailing list.
>
> GitHub Issues: https://github.com/hashicorp/consul/issues
> IRC: #consul on Freenode
> ---
> You received this message because you are subscribed to the Google Groups
> "Consul" group.
> To unsubscribe from this group and stop receiving emails from it, send an

> email to consul-tool...@googlegroups.com.

> To view this discussion on the web visit

> https://groups.google.com/d/msgid/consul-tool/CAOWmgPxFDOD6JVkCWis0mNU_Ahb-CQ5JVuoURmCmh7vXr5FGiw%40mail.gmail.com.

[Иван Сусанин]

Hi James,

You 100% right - once I gave anonymous token read access to that specific path, watch started to work as expected.

I'll try to open issue, but it can take some time - too much stuff have higher priority.

Anyway, thank you again!

Best regards,

Ivan

>> > email to consul-tool+unsubscribe@googlegroups.com.

>> > To view this discussion on the web visit
>> >
>> > https://groups.google.com/d/msgid/consul-tool/055c774d-f547-4e34-a47e-02db554d6cfb%40googlegroups.com.
>> >
>> > For more options, visit https://groups.google.com/d/optout.
>>
>> --
>> This mailing list is governed under the HashiCorp Community Guidelines -
>> https://www.hashicorp.com/community-guidelines.html. Behavior in violation
>> of those guidelines may result in your removal from this mailing list.
>>
>> GitHub Issues: https://github.com/hashicorp/consul/issues
>> IRC: #consul on Freenode
>> ---
>> You received this message because you are subscribed to a topic in the
>> Google Groups "Consul" group.
>> To unsubscribe from this topic, visit
>> https://groups.google.com/d/topic/consul-tool/1ZxQk9qIGpk/unsubscribe.
>> To unsubscribe from this group and all its topics, send an email to

>> consul-tool+unsubscribe@googlegroups.com.

>> To view this discussion on the web visit
>> https://groups.google.com/d/msgid/consul-tool/CAGoWc07j1jSga7YmpDjBHSR8eEUVfN9GejwJ%2BVOrF0t-hysntw%40mail.gmail.com.
>> For more options, visit https://groups.google.com/d/optout.
>
>
> --
> This mailing list is governed under the HashiCorp Community Guidelines -
> https://www.hashicorp.com/community-guidelines.html. Behavior in violation
> of those guidelines may result in your removal from this mailing list.
>
> GitHub Issues: https://github.com/hashicorp/consul/issues
> IRC: #consul on Freenode
> ---
> You received this message because you are subscribed to the Google Groups
> "Consul" group.
> To unsubscribe from this group and stop receiving emails from it, send an

> email to consul-tool+unsubscribe@googlegroups.com.

> To view this discussion on the web visit

> https://groups.google.com/d/msgid/consul-tool/CAOWmgPxFDOD6JVkCWis0mNU_Ahb-CQ5JVuoURmCmh7vXr5FGiw%40mail.gmail.com.

>
> For more options, visit https://groups.google.com/d/optout.

--
This mailing list is governed under the HashiCorp Community Guidelines - https://www.hashicorp.com/community-guidelines.html. Behavior in violation of those guidelines may result in your removal from this mailing list.

GitHub Issues: https://github.com/hashicorp/consul/issues
IRC: #consul on Freenode
---
You received this message because you are subscribed to a topic in the Google Groups "Consul" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/consul-tool/1ZxQk9qIGpk/unsubscribe.

To unsubscribe from this group and all its topics, send an email to consul-tool+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/consul-tool/CAGoWc07fji3LTSkjtyYBc45Au_TTjYHu4muAHGLXW5SQMtq2pQ%40mail.gmail.com.