AFS CRLs update

This is a description of how to manage CRL updates on CERN AFS in order to have them up-to-date for the CERN AFS UI, both for production and pre-production.

Update of the CRL themselves

You need to login to lxplus with the service account (gdafsui) and issue a kerberos token as gdafsui (as opposed to your won account kerberos token).

without log file

In the AFS space, with the service account's token one has to run the following acron job:

[lxplus052] ~ > acrontab -l
45 2,8,14,20 * * * lxplus.cern.ch source /afs/cern.ch/project/gd/LCG-share/current/etc/profile.d/grid_env.sh; $INSTALL_ROOT/glite/sbin/fetch-crl --loc $X509_CERT_DIR --out $X509_CERT_DIR --no-check-certificate 

This will send an e-mail to your account. If you wish to have a log file you should redirect the output accordingly. For instance, as described below.

with log file

In AFS, with the service account's token, run the following acronjob

45 2,8,14,20 * * * lxplus.cern.ch source /afs/cern.ch/project/gd/LCG-share/current/etc/profile.d/grid_env.sh; $INSTALL_ROOT/glite/sbin/fetch-crl --loc $X509_CERT_DIR --out $X509_CERT_DIR --no-check-certificate 2>&1 | tee -a /afs/cern.ch/project/gd/LCG-share2/logs/afs-fetch_crl.log | Mail -s "cronjob output: fetch-crl log" XXX.YYY@cern.ch

This will both send an e-mail to the address you specify (in this case XXX.YYY's address at CERN) and create a log file called afs-fetch_crl.log in the directory

/afs/cern.ch/project/gd/LCG-share2/logs

log file rotation

I have created a logrotate configuration file in the logs directory. In this way an acronjob for logrotation can be run from anyone's account, and rotate the logs once daily (so one log is one day worth of logs) and keep the last 14 logs (they are quite small).

An example of the line to put in acrontab is

0 0 * * * lxplus.cern.ch /usr/sbin/logrotate -s /afs/cern.ch/project/gd/LCG-share2/logs/logrotate.state /afs/cern.ch/project/gd/LCG-share2/logs/logrotate.diana.conf

This will rotate the logs every day at midnight, and keep a state file in the same directory.

-- Main.diana - 11 June 2007