Description

glite-CREAM

New version of glite-CREAM

Changes made in this version:

• glexec calls replaced with sudo calls (glexec is used just to get the userid to be used in the sudo invocations)
• For Torque/PBS and LSF by default the new BLAH BLparser (which uses the status/history batch system commands) is now considered. The old parser (which parses the batch system log files) is still supported (see http://grid.pd.infn.it/cream/field.php?n=Main.CREAMAndBlparserConfiguration ). If the new blparser is used (default option) it is just necessary to run yaim once (i.e. it is not necessary anymore to first configure the creamCE and then the BLparser).
• Introduced a new operation (queryEvent) to make more efficient the job status changes detection by ICE
• Introduced a limiter to protect CREAM (new job submissions are disabled when the machine is too loaded): see http://grid.pd.infn.it/cream/field.php?n=Main.Self-limitingCREAMBehavior
• Introduced a proxy purger which cleans from the delegationdb and from the file system the expired proxies (see: http://grid.pd.infn.it/cream/field.php?n=Main.HowToConfigureTheProxyPurger ) Please note that old proxies (i.e. referring to previous CREAM releases) under /opt/glite/var/cream are not deleted (you might want to delete them manually after having installed this patch)
• Improved CREAM startup, which is now in general faster, since CREAM asks the blparser only for the interested jobs (no more for a time slot)
• Improved proxy renewal operation, which is now more efficient when there are several jobs with the same delegationid
• User tomcat not added anymore to VO groups (please note that it won't be removed if it was already there because of previous version of yaim-cream-ce). With this change the group directories under /opt/glite/var/cream_sandbox are now created by yaim
• User tomcat not added anymore to glexec group (please note that it won't be removed if it was already there because of previous version of yaim-cream-ce)
• The host certificate is no longer copied to /usr/share/tomcat5 but remains in /etc/grid-security/tomcat-cert.pem with the permissions tomcat:root.
• Customization of the CREAM JobWrapper is now easier (see http://grid.pd.infn.it/cream/field.php?n=Main.HowToCustomizeTheCREAMJobWrapper )
• Provision of a script (to be run by CE admin) to purge jobs in non-terminal status (see: http://grid.pd.infn.it/cream/field.php?n=Main.HowToPurgeJobsFromTheCREAMDB )
• Implemented support for ISB/OSB transfers from/to gridftp servers run using user credentials
• By default cemon is not deployed anymore (not needed anymore because of the new queryevent operation)
• New schema for both cream and delegation databases (this means they will be dropped and recreated when configuring via yaim)
• Several bug fixes, e.g.:
• Several fixes in the new BLAH blparser
• lcmaps glexec conf file fixed: now it is fully synchronized (TM) with the gridftpd one
• Problems triggered by "strange" characters (e.g. ":" or "(") in the subject DN fixed
• Reasons for ISB/OSB transfer failures are now reported
• Job failure reasons now reported in the CREAM log file
• Improved performance of some DB queries
• GLITE_WMS_RB_BROKERINFO env variable now set in the CREAM JobWrapper

Workaround: Some dependencies not always updated

Performing a yum update glite-CREAM, it was detected that sometimes glite-jobid-api-c, glite-jobid-api-cpp, glite-lbjp-common-trio, glite-security-gsoap-plugin and glite-security-gss are not correctly updated. Please, verify that yum is installing the new rpms, and if not, execute the following command:

yum update glite-jobid-api-c glite-jobid-api-cpp glite-lbjp-common-trio glite-security-gsoap-plugin glite-security-gss

If you simply do a "yum update" (i.e. without specifying the metapackage) you shouldn't be affected by this issue.

Patch #3767: [ yaim-core ] yaim-core 4.0.12 SL5/x86_64

New release of yaim core containing a set of bug fixes and new features:

• Can now configure the GSI callout to call the ARGUS PEP client.
• Avoid mistakenly removing all the services from gLiteservices file.
• Fix GLOBUS_TCP_PORT_RANGE setting on the SL5 tarball UI.
• Correct unset for shell functions in clean-grid-env-funcs.sh
• Make config_bdii_only return non zero in case of error
• Fixes for installing the UI tarball on CernVM.
• Allow general use of the 'nickname' field in the VOMSES settings.
• Add yaim core RPM dependency on perl
• Allow use of pool accounts with up to 4 digits
• Fix grid-env.sh manipulation when running a single yaim function
• Fix gridmap dir group on WMS
• Change the CE_INBOUNDIP and CE_OUTBOUNDIP defaults in site-info.def to be valid and imply the correct (upper) case.
• Call setup-openssl for VDT 1.10.

Patch #3739: Updated glite-info-provider-release package

This new version of glite-info-provider-release works with the new version of glite-version that not longer supports the -u and -s options.

Patch #3726: Trustmanager workaround for JDK 1.6 EC SSL handshake mess

Workaround that disables the ECDH ciphers on tomcat so that the JDK 1.6 problems don't happen. Small fix for logging in util-java.

See patch #3313 for the more important changes.

Patch #3869: Util-java update

Fix for hierarchical CA namespace handling, previously only the root CA namespace was taken into account, now CA cert's or user cert's first parent namespace definition is used.

New trustmanager factory class, which is used inside contextwrapper. It only creates one trustmanager if the trust directory (and crlrequired) configuration on consecutive calls is the same. First call creates one trustmanager and subsequent calls use the same instance. This cuts down considerably the file reads, class creation, memory footprint, delays etc.

RFC2253 DNs generated by new methods in DN* classes and new DNImpl RFC2253 class now produce proper reversed FTC2253 DNs like defined in RFC2253, meaning they start with "CN" rdn and end with "C" rdn if present. Old methods are present and work as before, but are deprecated.

Also SecurityContext.getAuthorizedAttributes method is put back for FTS test servlet.

See also patch #2624 for important configuration changes, patch #3313 for updates and patch #3726 for a small fix.

Patch #3977: SL5/x86_64 APEL CPUScalingFactor bug fix

APEL will now read the CPUScalingReferenceSI00 value from the site GIIS. If this value is not available, APEL will read GlueHostbenchmarkSI00.

Note that the new version of APEL will read the CPU power (specint rating) from the GlueCECapability CPUScalingReferenceSI00 attribute if it is published, so please check that the value is correct (the same as the GlueHostBenchmarkSI00 attribute) and that your APEL accounting records look OK after the upgrade.

Patch #3888: BDII release 5.0.8

The version handles the IOError exception that occasionally causes the BDII update process to die.

Patch #3795: L&B 2.0

This patch solves the bug #63285, that was causing L&B packages to make no difference between 32 vs. 64-bit architectures and always install library files in /opt/glite/lib rather than /opt/glite/lib64 in 64-bit versions.

Fixed bugs

Updated rpms

The RPMs can be updated using yum via

• via apt: yum update
• or via a download from:
  
  http://glitesoft.cern.ch/EGEE/gLite/R3.2/glite-GENERIC/sl5/x86_64/RPMS.updates/

Service reconfiguration after update

Service must be reconfigured.

Service restart after update

Service must be restarted.

How to apply the fix

1. Update the RPMs (see above)
2. Update configuration (see above)
3. Restart the service if necessary (see above)