{"host": "relforge1008.eqiad.wmnet", "state": "core_diff", "description": "Differences to core resources", "diff": {"full": {"total": 2900, "only_in_self": ["Class[Profile::Opensearch::Cirrus::Test]", "Class[Role::Cirrus::Test]", "Ferm::Service[opensearch_http_9200]", "File[/etc/ferm/conf.d/10_opensearch_http_9200]", "File[/etc/update-motd.d/05-cirrus--test]", "Firewall::Service[opensearch-http-9200]", "Motd::Message[cirrus::test]", "Motd::Script[cirrus::test]"], "only_in_other": ["Alternatives::Java[17]", "Apt::Repository[wikimedia-opensearch-plugins]", "Apt::Repository[wikimedia-opensearch]", "Cfssl::Cert[discovery2026__relforge1008_eqiad_wmnet]", "Cfssl::Csr[/etc/cfssl/csr/discovery2026__relforge1008_eqiad_wmnet.csr]", "Class[Icinga::Elasticsearch::Base_plugin]", "Class[Java::Tools]", "Class[Java]", "Class[Logstash]", "Class[Nginx]", "Class[Opensearch::Log::Hot_threads]", "Class[Opensearch::Packages]", "Class[Opensearch]", "Class[Profile::Java]", "Class[Profile::Logstash::Gelf_relay]", "Class[Profile::Opensearch::Cirrus::Relforge]", "Class[Profile::Opensearch::Cirrus::Server]", "Class[Profile::Opensearch::Monitoring::Base_checks]", "Class[Profile::Opensearch::Server]", "Class[Profile::Rsyslog::Udp_json_logback_compat]", "Class[Profile::Tcp_fast_open]", "Class[Profile::Tlsproxy::Instance]", "Class[Prometheus::Elasticsearch_exporter::Common]", "Class[Prometheus::Wmf_elasticsearch_exporter::Common]", "Class[Role::Cirrus::Relforge]", "Class[Sslcert::Dhparam]", "Concat::Fragment[wikimedia-opensearch-header]", "Concat::Fragment[wikimedia-opensearch-plugins-header]", "Concat::Fragment[wikimedia-opensearch-plugins]", "Concat::Fragment[wikimedia-opensearch]", "Concat[/etc/apt/sources.list.d/wikimedia-opensearch-plugins.sources]", "Concat[/etc/apt/sources.list.d/wikimedia-opensearch.sources]", "Concat_file[/etc/apt/sources.list.d/wikimedia-opensearch-plugins.sources]", "Concat_file[/etc/apt/sources.list.d/wikimedia-opensearch.sources]", "Concat_fragment[wikimedia-opensearch-header]", "Concat_fragment[wikimedia-opensearch-plugins-header]", "Concat_fragment[wikimedia-opensearch-plugins]", "Concat_fragment[wikimedia-opensearch]", "Elasticsearch::Tlsproxy[relforge-eqiad-small-alpha]", "Elasticsearch::Tlsproxy[relforge-eqiad]", "Exec[Generate cert discovery2026__relforge1008_eqiad_wmnet refresh on intermediate ca change]", "Exec[Generate cert discovery2026__relforge1008_eqiad_wmnet refresh]", "Exec[Generate cert discovery2026__relforge1008_eqiad_wmnet]", "Exec[Refresh tmpfile opensearch-relforge-eqiad-small-alpha]", "Exec[Refresh tmpfile opensearch-relforge-eqiad]", "Exec[apt_repository_wikimedia-opensearch-plugins]", "Exec[apt_repository_wikimedia-opensearch]", "Exec[create chained cert /etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chain.pem]", "Exec[java__cacert_wmf:Wikimedia_Internal_Root_CA]", "Exec[java__cacert_wmf:puppetca.pem]", "Exec[mask_default_prometheus_elasticsearch_exporter]", "Exec[mask_nginx.service]", "Exec[nginx-reload]", "Exec[opensearch-create-keystore-relforge-eqiad-small-alpha]", "Exec[opensearch-create-keystore-relforge-eqiad]", "Exec[renew certificate - discovery2026__relforge1008_eqiad_wmnet]", "Exec[s3-credentials-user-relforge-eqiad-small-alpha]", "Exec[s3-credentials-user-relforge-eqiad]", "Exec[stop-default-nginx]", "Exec[symlink /etc/opensearch/relforge-eqiad-small-alpha/sudachi]", "Exec[symlink /etc/opensearch/relforge-eqiad/sudachi]", "Exec[systemd daemon-reload for clean_up_dlq.service (clean_up_dlq.service)]", "Exec[systemd daemon-reload for clean_up_dlq.timer (clean_up_dlq.timer)]", "Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service (nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service)]", "Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer (nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer)]", "Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service (nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service)]", "Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer (nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9200.service (nrpe2nodexp-opensearch_shard_size_check_9200.service)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9200.timer (nrpe2nodexp-opensearch_shard_size_check_9200.timer)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9400.service (nrpe2nodexp-opensearch_shard_size_check_9400.service)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9400.timer (nrpe2nodexp-opensearch_shard_size_check_9400.timer)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9200.service (nrpe2nodexp-opensearch_shards_9200.service)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9200.timer (nrpe2nodexp-opensearch_shards_9200.timer)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9400.service (nrpe2nodexp-opensearch_shards_9400.service)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9400.timer (nrpe2nodexp-opensearch_shards_9400.timer)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9200.service (nrpe2nodexp-opensearch_unassigned_shard_check_9200.service)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer (nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9400.service (nrpe2nodexp-opensearch_unassigned_shard_check_9400.service)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer (nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer)]", "Exec[systemd daemon-reload for opensearch-disable-readahead-relforge-eqiad-small-alpha.service (opensearch-disable-readahead-relforge-eqiad-small-alpha.service)]", "Exec[systemd daemon-reload for opensearch-disable-readahead-relforge-eqiad-small-alpha.timer (opensearch-disable-readahead-relforge-eqiad-small-alpha.timer)]", "Exec[systemd daemon-reload for opensearch-disable-readahead-relforge-eqiad.service (opensearch-disable-readahead-relforge-eqiad.service)]", "Exec[systemd daemon-reload for opensearch-disable-readahead-relforge-eqiad.timer (opensearch-disable-readahead-relforge-eqiad.timer)]", "Exec[systemd daemon-reload for opensearch-disable-readahead.service (opensearch-disable-readahead.service)]", "Exec[systemd daemon-reload for opensearch-disable-readahead.timer (opensearch-disable-readahead.timer)]", "Exec[systemd daemon-reload for opensearch-hot-threads-log.service (opensearch-hot-threads-log.service)]", "Exec[systemd daemon-reload for opensearch-hot-threads-log.timer (opensearch-hot-threads-log.timer)]", "Exec[systemd daemon-reload for opensearch-relforge-eqiad-gc-log-cleanup.service (opensearch-relforge-eqiad-gc-log-cleanup.service)]", "Exec[systemd daemon-reload for opensearch-relforge-eqiad-gc-log-cleanup.timer (opensearch-relforge-eqiad-gc-log-cleanup.timer)]", "Exec[systemd daemon-reload for opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service (opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service)]", "Exec[systemd daemon-reload for opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer (opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer)]", "Exec[systemd daemon-reload for opensearch_1@.service (opensearch_1@.service)]", "Exec[systemd daemon-reload for prometheus-elasticsearch-exporter-9200.service (prometheus-elasticsearch-exporter-9200)]", "Exec[systemd daemon-reload for prometheus-elasticsearch-exporter-9400.service (prometheus-elasticsearch-exporter-9400)]", "Exec[systemd daemon-reload for prometheus-wmf-elasticsearch-exporter-9200.service (prometheus-wmf-elasticsearch-exporter-9200)]", "Exec[systemd daemon-reload for prometheus-wmf-elasticsearch-exporter-9400.service (prometheus-wmf-elasticsearch-exporter-9400)]", "Exec[systemd daemon-reload for push_cross_cluster_settings_9200.service (push_cross_cluster_settings_9200.service)]", "Exec[systemd daemon-reload for push_cross_cluster_settings_9200.timer (push_cross_cluster_settings_9200.timer)]", "Exec[systemd daemon-reload for push_cross_cluster_settings_9400.service (push_cross_cluster_settings_9400.service)]", "Exec[systemd daemon-reload for push_cross_cluster_settings_9400.timer (push_cross_cluster_settings_9400.timer)]", "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service (wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service)]", "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer (wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer)]", "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service (wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service)]", "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer (wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer)]", "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service (wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service)]", "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer (wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer)]", "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service (wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service)]", "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer (wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer)]", "Exec[systemd reload for nginx systemd fragments]", "Exec[tlsproxy localssl default_server on ports [9243]]", "Exec[tlsproxy localssl default_server on ports [9443]]", "Exec[unmask_nginx.service]", "Exec[update_java_alternatives_17]", "Ferm::Service[elastic-main-https-9243]", "Ferm::Service[elastic-small-alpha-https-9443]", "Ferm::Service[opensearch-https-9243]", "Ferm::Service[opensearch-https-9443]", "Ferm::Service[opensearch_inter_node_9500]", "File[/etc/apt/sources.list.d/wikimedia-opensearch-plugins.list]", "File[/etc/apt/sources.list.d/wikimedia-opensearch.list]", "File[/etc/cfssl/csr/discovery2026__relforge1008_eqiad_wmnet.csr]", "File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet-key.pem]", "File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chain.pem]", "File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chained.pem]", "File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.csr]", "File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.pem]", "File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet]", "File[/etc/default/logstash]", "File[/etc/default/opensearch]", "File[/etc/default/prometheus-elasticsearch-exporter]", "File[/etc/elasticsearch]", "File[/etc/ferm/conf.d/10_elastic-main-https-9243]", "File[/etc/ferm/conf.d/10_elastic-small-alpha-https-9443]", "File[/etc/ferm/conf.d/10_opensearch-https-9243]", "File[/etc/ferm/conf.d/10_opensearch-https-9443]", "File[/etc/ferm/conf.d/10_opensearch_inter_node_9500]", "File[/etc/logrotate.d/clean_up_dlq]", "File[/etc/logrotate.d/nginx]", "File[/etc/logrotate.d/opensearch-disable-readahead-relforge-eqiad-small-alpha]", "File[/etc/logrotate.d/opensearch-disable-readahead-relforge-eqiad]", "File[/etc/logrotate.d/opensearch-disable-readahead]", "File[/etc/logrotate.d/opensearch-relforge-eqiad-gc-log-cleanup]", "File[/etc/logrotate.d/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]", "File[/etc/logrotate.d/opensearch]", "File[/etc/logrotate.d/push_cross_cluster_settings_9200]", "File[/etc/logrotate.d/push_cross_cluster_settings_9400]", "File[/etc/logrotate.d/wmf_auto_restart_prometheus-elasticsearch-exporter-9200]", "File[/etc/logrotate.d/wmf_auto_restart_prometheus-elasticsearch-exporter-9400]", "File[/etc/logrotate.d/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]", "File[/etc/logrotate.d/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]", "File[/etc/logstash/conf.d/10-input-gelf-gelf_relay.conf]", "File[/etc/logstash/conf.d/90-output-udp-gelf_relay.conf]", "File[/etc/logstash/conf.d/README]", "File[/etc/logstash/jvm.options]", "File[/etc/logstash/log4j2.properties]", "File[/etc/logstash/logstash.yml]", "File[/etc/nagios/nrpe.d/check_check_push_cross_cluster_settings_9200_status.cfg]", "File[/etc/nagios/nrpe.d/check_check_push_cross_cluster_settings_9400_status.cfg]", "File[/etc/nagios/nrpe.d/check_opensearch_shard_size_check_9200.cfg]", "File[/etc/nagios/nrpe.d/check_opensearch_shard_size_check_9400.cfg]", "File[/etc/nagios/nrpe.d/check_opensearch_shards_9200.cfg]", "File[/etc/nagios/nrpe.d/check_opensearch_shards_9400.cfg]", "File[/etc/nagios/nrpe.d/check_opensearch_unassigned_shard_check_9200.cfg]", "File[/etc/nagios/nrpe.d/check_opensearch_unassigned_shard_check_9400.cfg]", "File[/etc/nginx/conf.d]", "File[/etc/nginx/nginx.conf]", "File[/etc/nginx/sites-available/relforge-eqiad-small-alpha]", "File[/etc/nginx/sites-available/relforge-eqiad]", "File[/etc/nginx/sites-available]", "File[/etc/nginx/sites-enabled/relforge-eqiad-small-alpha]", "File[/etc/nginx/sites-enabled/relforge-eqiad]", "File[/etc/nginx/sites-enabled]", "File[/etc/nginx]", "File[/etc/opensearch/instances]", "File[/etc/opensearch/relforge-eqiad-small-alpha/cirrus_check_settings.json]", "File[/etc/opensearch/relforge-eqiad-small-alpha/java-security.policy]", "File[/etc/opensearch/relforge-eqiad-small-alpha/jvm.options]", "File[/etc/opensearch/relforge-eqiad-small-alpha/log4j2.properties]", "File[/etc/opensearch/relforge-eqiad-small-alpha/logging.yml]", "File[/etc/opensearch/relforge-eqiad-small-alpha/opensearch.keystore]", "File[/etc/opensearch/relforge-eqiad-small-alpha/opensearch.yml]", "File[/etc/opensearch/relforge-eqiad-small-alpha/scripts]", "File[/etc/opensearch/relforge-eqiad-small-alpha]", "File[/etc/opensearch/relforge-eqiad/cirrus_check_settings.json]", "File[/etc/opensearch/relforge-eqiad/java-security.policy]", "File[/etc/opensearch/relforge-eqiad/jvm.options]", "File[/etc/opensearch/relforge-eqiad/log4j2.properties]", "File[/etc/opensearch/relforge-eqiad/logging.yml]", "File[/etc/opensearch/relforge-eqiad/opensearch.keystore]", "File[/etc/opensearch/relforge-eqiad/opensearch.yml]", "File[/etc/opensearch/relforge-eqiad/scripts]", "File[/etc/opensearch/relforge-eqiad]", "File[/etc/opensearch]", "File[/etc/opensearch_hot_threads.d/relforge-eqiad-small-alpha.yml]", "File[/etc/opensearch_hot_threads.d/relforge-eqiad.yml]", "File[/etc/opensearch_hot_threads.d]", "File[/etc/rsyslog.d/25-nrpe2nodexp-check-push-cross-cluster-settings-9200-status.conf]", "File[/etc/rsyslog.d/25-nrpe2nodexp-check-push-cross-cluster-settings-9400-status.conf]", "File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-shard-size-check-9200.conf]", "File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-shard-size-check-9400.conf]", "File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-shards-9200.conf]", "File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-shards-9400.conf]", "File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-unassigned-shard-check-9200.conf]", "File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-unassigned-shard-check-9400.conf]", "File[/etc/rsyslog.d/40-clean-up-dlq.conf]", "File[/etc/rsyslog.d/40-opensearch-disable-readahead-relforge-eqiad-small-alpha.conf]", "File[/etc/rsyslog.d/40-opensearch-disable-readahead-relforge-eqiad.conf]", "File[/etc/rsyslog.d/40-opensearch-disable-readahead.conf]", "File[/etc/rsyslog.d/40-opensearch-relforge-eqiad-gc-log-cleanup.conf]", "File[/etc/rsyslog.d/40-opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.conf]", "File[/etc/rsyslog.d/40-push-cross-cluster-settings-9200.conf]", "File[/etc/rsyslog.d/40-push-cross-cluster-settings-9400.conf]", "File[/etc/rsyslog.d/40-wmf-auto-restart-prometheus-elasticsearch-exporter-9200.conf]", "File[/etc/rsyslog.d/40-wmf-auto-restart-prometheus-elasticsearch-exporter-9400.conf]", "File[/etc/rsyslog.d/40-wmf-auto-restart-prometheus-wmf-elasticsearch-exporter-9200.conf]", "File[/etc/rsyslog.d/40-wmf-auto-restart-prometheus-wmf-elasticsearch-exporter-9400.conf]", "File[/etc/rsyslog.d/50-udp-json-logback-compat.conf]", "File[/etc/ssl/dhparam.pem]", "File[/etc/sudoers.d/nrpe-check_check_push_cross_cluster_settings_9200_status]", "File[/etc/sudoers.d/nrpe-check_check_push_cross_cluster_settings_9400_status]", "File[/etc/sudoers.d/nrpe-check_opensearch_shard_size_check_9200]", "File[/etc/sudoers.d/nrpe-check_opensearch_shard_size_check_9400]", "File[/etc/sudoers.d/nrpe-check_opensearch_shards_9200]", "File[/etc/sudoers.d/nrpe-check_opensearch_shards_9400]", "File[/etc/sudoers.d/nrpe-check_opensearch_unassigned_shard_check_9200]", "File[/etc/sudoers.d/nrpe-check_opensearch_unassigned_shard_check_9400]", "File[/etc/sysctl.d/70-TCP-Fast-Open.conf]", "File[/etc/sysctl.d/opensearch.conf]", "File[/etc/systemd/system/nginx.service.d/numa.conf]", "File[/etc/systemd/system/nginx.service.d/security.conf]", "File[/etc/systemd/system/nginx.service.d]", "File[/etc/tmpfiles.d/opensearch-relforge-eqiad-small-alpha.conf]", "File[/etc/tmpfiles.d/opensearch-relforge-eqiad.conf]", "File[/etc/udev/rules.d/40-opensearch-readahead.rules]", "File[/etc/update-motd.d/05-cirrus--relforge]", "File[/etc/update-motd.d/96-cluster-memberships]", "File[/lib/systemd/system/clean_up_dlq.service]", "File[/lib/systemd/system/clean_up_dlq.timer]", "File[/lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service]", "File[/lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer]", "File[/lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service]", "File[/lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9200.service]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9200.timer]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9400.service]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9400.timer]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_shards_9200.service]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_shards_9200.timer]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_shards_9400.service]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_shards_9400.timer]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9200.service]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9400.service]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer]", "File[/lib/systemd/system/opensearch-disable-readahead-relforge-eqiad-small-alpha.service]", "File[/lib/systemd/system/opensearch-disable-readahead-relforge-eqiad-small-alpha.timer]", "File[/lib/systemd/system/opensearch-disable-readahead-relforge-eqiad.service]", "File[/lib/systemd/system/opensearch-disable-readahead-relforge-eqiad.timer]", "File[/lib/systemd/system/opensearch-disable-readahead.service]", "File[/lib/systemd/system/opensearch-disable-readahead.timer]", "File[/lib/systemd/system/opensearch-hot-threads-log.service]", "File[/lib/systemd/system/opensearch-hot-threads-log.timer]", "File[/lib/systemd/system/opensearch-relforge-eqiad-gc-log-cleanup.service]", "File[/lib/systemd/system/opensearch-relforge-eqiad-gc-log-cleanup.timer]", "File[/lib/systemd/system/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service]", "File[/lib/systemd/system/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer]", "File[/lib/systemd/system/opensearch_1@.service]", "File[/lib/systemd/system/prometheus-elasticsearch-exporter-9200.service]", "File[/lib/systemd/system/prometheus-elasticsearch-exporter-9400.service]", "File[/lib/systemd/system/prometheus-wmf-elasticsearch-exporter-9200.service]", "File[/lib/systemd/system/prometheus-wmf-elasticsearch-exporter-9400.service]", "File[/lib/systemd/system/push_cross_cluster_settings_9200.service]", "File[/lib/systemd/system/push_cross_cluster_settings_9200.timer]", "File[/lib/systemd/system/push_cross_cluster_settings_9400.service]", "File[/lib/systemd/system/push_cross_cluster_settings_9400.timer]", "File[/lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service]", "File[/lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer]", "File[/lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service]", "File[/lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer]", "File[/lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service]", "File[/lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer]", "File[/lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service]", "File[/lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer]", "File[/srv/opensearch/relforge-eqiad-small-alpha]", "File[/srv/opensearch/relforge-eqiad]", "File[/srv/opensearch]", "File[/usr/lib/nagios/plugins/check_elasticsearch.py]", "File[/usr/lib/nagios/plugins/check_elasticsearch]", "File[/usr/lib/nagios/plugins/check_elasticsearch_shard_size.py]", "File[/usr/lib/nagios/plugins/check_elasticsearch_unassigned_shards.py]", "File[/usr/local/bin/cleanup-dlq]", "File[/usr/local/bin/jheapdump]", "File[/usr/local/bin/logstash-config-test]", "File[/usr/local/bin/opensearch-disable-readahead.sh]", "File[/usr/local/bin/opensearch_hot_threads_logger.py]", "File[/usr/local/bin/prometheus-wmf-elasticsearch-exporter]", "File[/usr/local/bin/set-cross-cluster-seeds_9200.sh]", "File[/usr/local/bin/set-cross-cluster-seeds_9400.sh]", "File[/usr/local/lib/nagios/plugins/check_systemd_unit_status]", "File[/usr/share/opensearch/plugins]", "File[/var/lib/nginx]", "File[/var/lib/prometheus/node.d/check_check_push_cross_cluster_settings_9200_status.prom]", "File[/var/lib/prometheus/node.d/check_check_push_cross_cluster_settings_9400_status.prom]", "File[/var/lib/prometheus/node.d/check_opensearch_shard_size_check_9200.prom]", "File[/var/lib/prometheus/node.d/check_opensearch_shard_size_check_9400.prom]", "File[/var/lib/prometheus/node.d/check_opensearch_shards_9200.prom]", "File[/var/lib/prometheus/node.d/check_opensearch_shards_9400.prom]", "File[/var/lib/prometheus/node.d/check_opensearch_unassigned_shard_check_9200.prom]", "File[/var/lib/prometheus/node.d/check_opensearch_unassigned_shard_check_9400.prom]", "File[/var/log/clean_up_dlq]", "File[/var/log/opensearch-disable-readahead-relforge-eqiad-small-alpha]", "File[/var/log/opensearch-disable-readahead-relforge-eqiad]", "File[/var/log/opensearch-disable-readahead]", "File[/var/log/opensearch-relforge-eqiad-gc-log-cleanup]", "File[/var/log/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]", "File[/var/log/opensearch/opensearch.log]", "File[/var/log/opensearch/opensearch_index_indexing_slowlog.log]", "File[/var/log/opensearch/opensearch_index_search_slowlog.log]", "File[/var/log/opensearch]", "File[/var/log/push_cross_cluster_settings_9200]", "File[/var/log/push_cross_cluster_settings_9400]", "File[/var/log/wmf_auto_restart_prometheus-elasticsearch-exporter-9200]", "File[/var/log/wmf_auto_restart_prometheus-elasticsearch-exporter-9400]", "File[/var/log/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]", "File[/var/log/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]", "File_line[auto_restart_file_presence_prometheus-elasticsearch-exporter-9200]", "File_line[auto_restart_file_presence_prometheus-elasticsearch-exporter-9400]", "File_line[auto_restart_file_presence_prometheus-wmf-elasticsearch-exporter-9200]", "File_line[auto_restart_file_presence_prometheus-wmf-elasticsearch-exporter-9400]", "File_line[opensearch_bin_bashrc]", "Firewall::Service[opensearch-inter-node-9500]", "Java::Cacert[wmf:Wikimedia_Internal_Root_CA]", "Java::Cacert[wmf:puppetca.pem]", "Java::Package[openjdk-jdk-17]", "Logrotate::Conf[clean_up_dlq]", "Logrotate::Conf[nginx]", "Logrotate::Conf[opensearch-disable-readahead-relforge-eqiad-small-alpha]", "Logrotate::Conf[opensearch-disable-readahead-relforge-eqiad]", "Logrotate::Conf[opensearch-disable-readahead]", "Logrotate::Conf[opensearch-relforge-eqiad-gc-log-cleanup]", "Logrotate::Conf[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]", "Logrotate::Conf[opensearch]", "Logrotate::Conf[push_cross_cluster_settings_9200]", "Logrotate::Conf[push_cross_cluster_settings_9400]", "Logrotate::Conf[wmf_auto_restart_prometheus-elasticsearch-exporter-9200]", "Logrotate::Conf[wmf_auto_restart_prometheus-elasticsearch-exporter-9400]", "Logrotate::Conf[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]", "Logrotate::Conf[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]", "Logrotate::Rule[opensearch]", "Logstash::Conf[input-gelf-gelf_relay]", "Logstash::Conf[output-udp-gelf_relay]", "Logstash::Input::Gelf[gelf_relay]", "Logstash::Output::Udp[gelf_relay]", "Monitoring::Exported_nagios_service[relforge1008 check_push_cross_cluster_settings_9200_status]", "Monitoring::Exported_nagios_service[relforge1008 check_push_cross_cluster_settings_9400_status]", "Monitoring::Exported_nagios_service[relforge1008 elasticsearch-https-relforge-eqiad-small-alpha]", "Monitoring::Exported_nagios_service[relforge1008 elasticsearch-https-relforge-eqiad]", "Monitoring::Exported_nagios_service[relforge1008 opensearch_shard_size_check_9200]", "Monitoring::Exported_nagios_service[relforge1008 opensearch_shard_size_check_9400]", "Monitoring::Exported_nagios_service[relforge1008 opensearch_shards_9200]", "Monitoring::Exported_nagios_service[relforge1008 opensearch_shards_9400]", "Monitoring::Exported_nagios_service[relforge1008 opensearch_unassigned_shard_check_9200]", "Monitoring::Exported_nagios_service[relforge1008 opensearch_unassigned_shard_check_9400]", "Monitoring::Service[check_push_cross_cluster_settings_9200_status]", "Monitoring::Service[check_push_cross_cluster_settings_9400_status]", "Monitoring::Service[elasticsearch-https-relforge-eqiad-small-alpha]", "Monitoring::Service[elasticsearch-https-relforge-eqiad]", "Monitoring::Service[opensearch_shard_size_check_9200]", "Monitoring::Service[opensearch_shard_size_check_9400]", "Monitoring::Service[opensearch_shards_9200]", "Monitoring::Service[opensearch_shards_9400]", "Monitoring::Service[opensearch_unassigned_shard_check_9200]", "Monitoring::Service[opensearch_unassigned_shard_check_9400]", "Motd::Message[cirrus::relforge]", "Motd::Script[cirrus::relforge]", "Motd::Script[cluster_memberships]", "Mount[/var/lib/nginx]", "Nginx::Site[relforge-eqiad-small-alpha]", "Nginx::Site[relforge-eqiad]", "Nrpe::Check[check_check_push_cross_cluster_settings_9200_status]", "Nrpe::Check[check_check_push_cross_cluster_settings_9400_status]", "Nrpe::Check[check_opensearch_shard_size_check_9200]", "Nrpe::Check[check_opensearch_shard_size_check_9400]", "Nrpe::Check[check_opensearch_shards_9200]", "Nrpe::Check[check_opensearch_shards_9400]", "Nrpe::Check[check_opensearch_unassigned_shard_check_9200]", "Nrpe::Check[check_opensearch_unassigned_shard_check_9400]", "Nrpe::Monitor_service[check_push_cross_cluster_settings_9200_status]", "Nrpe::Monitor_service[check_push_cross_cluster_settings_9400_status]", "Nrpe::Monitor_service[opensearch_shard_size_check_9200]", "Nrpe::Monitor_service[opensearch_shard_size_check_9400]", "Nrpe::Monitor_service[opensearch_shards_9200]", "Nrpe::Monitor_service[opensearch_shards_9400]", "Nrpe::Monitor_service[opensearch_unassigned_shard_check_9200]", "Nrpe::Monitor_service[opensearch_unassigned_shard_check_9400]", "Nrpe::Plugin[check_systemd_unit_status]", "Opensearch::Cross_cluster_settings[relforge-eqiad-small-alpha]", "Opensearch::Cross_cluster_settings[relforge-eqiad]", "Opensearch::Instance[relforge-eqiad-small-alpha]", "Opensearch::Instance[relforge-eqiad]", "Opensearch::Keystore[s3-credentials-user-relforge-eqiad-small-alpha]", "Opensearch::Keystore[s3-credentials-user-relforge-eqiad]", "Opensearch::Log::Hot_threads_cluster[relforge-eqiad-small-alpha]", "Opensearch::Log::Hot_threads_cluster[relforge-eqiad]", "Package[edac-utils]", "Package[logstash-old-name]", "Package[logstash-oss]", "Package[nginx-common]", "Package[nginx-light]", "Package[openjdk-17-jdk]", "Package[opensearch-madvise]", "Package[opensearch]", "Package[prometheus-elasticsearch-exporter]", "Package[python3-requests]", "Package[wmf-opensearch-search-plugins]", "Profile::Auto_restarts::Service[prometheus-elasticsearch-exporter-9200]", "Profile::Auto_restarts::Service[prometheus-elasticsearch-exporter-9400]", "Profile::Auto_restarts::Service[prometheus-wmf-elasticsearch-exporter-9200]", "Profile::Auto_restarts::Service[prometheus-wmf-elasticsearch-exporter-9400]", "Profile::Prometheus::Elasticsearch_exporter[relforge1008:9200]", "Profile::Prometheus::Elasticsearch_exporter[relforge1008:9400]", "Profile::Prometheus::Wmf_elasticsearch_exporter[relforge1008:9200]", "Profile::Prometheus::Wmf_elasticsearch_exporter[relforge1008:9400]", "Prometheus::Alert::Rule[check_check_push_cross_cluster_settings_9200_status_379fbc6cbce5b297397c866a15729f1a]", "Prometheus::Alert::Rule[check_check_push_cross_cluster_settings_9400_status_de4a199c43946c09f819ca4ffea40ac0]", "Prometheus::Alert::Rule[check_opensearch_shard_size_check_9200_c62725841c61e20ac3f6819b4c0ad800]", "Prometheus::Alert::Rule[check_opensearch_shard_size_check_9400_aefe2d8b10db3bc84662052af1e20008]", "Prometheus::Alert::Rule[check_opensearch_shards_9200_fd6eadf747c645a72e11bd74109a8156]", "Prometheus::Alert::Rule[check_opensearch_shards_9400_2a63eb7dcbe368b7f538118765d629d6]", "Prometheus::Alert::Rule[check_opensearch_unassigned_shard_check_9200_54ca99505516d5452912b573aa7d35d3]", "Prometheus::Alert::Rule[check_opensearch_unassigned_shard_check_9400_a0a4892478c289e50484ffd2fb4c3202]", "Prometheus::Elasticsearch_exporter[localhost:9200]", "Prometheus::Elasticsearch_exporter[localhost:9400]", "Prometheus::Wmf_elasticsearch_exporter[relforge1008:9200]", "Prometheus::Wmf_elasticsearch_exporter[relforge1008:9400]", "Rsyslog::Conf[clean_up_dlq]", "Rsyslog::Conf[nrpe2nodexp-check_push_cross_cluster_settings_9200_status]", "Rsyslog::Conf[nrpe2nodexp-check_push_cross_cluster_settings_9400_status]", "Rsyslog::Conf[nrpe2nodexp-opensearch_shard_size_check_9200]", "Rsyslog::Conf[nrpe2nodexp-opensearch_shard_size_check_9400]", "Rsyslog::Conf[nrpe2nodexp-opensearch_shards_9200]", "Rsyslog::Conf[nrpe2nodexp-opensearch_shards_9400]", "Rsyslog::Conf[nrpe2nodexp-opensearch_unassigned_shard_check_9200]", "Rsyslog::Conf[nrpe2nodexp-opensearch_unassigned_shard_check_9400]", "Rsyslog::Conf[opensearch-disable-readahead-relforge-eqiad-small-alpha]", "Rsyslog::Conf[opensearch-disable-readahead-relforge-eqiad]", "Rsyslog::Conf[opensearch-disable-readahead]", "Rsyslog::Conf[opensearch-relforge-eqiad-gc-log-cleanup]", "Rsyslog::Conf[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]", "Rsyslog::Conf[push_cross_cluster_settings_9200]", "Rsyslog::Conf[push_cross_cluster_settings_9400]", "Rsyslog::Conf[udp_json_logback_compat]", "Rsyslog::Conf[wmf_auto_restart_prometheus-elasticsearch-exporter-9200]", "Rsyslog::Conf[wmf_auto_restart_prometheus-elasticsearch-exporter-9400]", "Rsyslog::Conf[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]", "Rsyslog::Conf[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]", "Service[clean_up_dlq.timer]", "Service[logstash]", "Service[nginx]", "Service[nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer]", "Service[nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer]", "Service[nrpe2nodexp-opensearch_shard_size_check_9200.timer]", "Service[nrpe2nodexp-opensearch_shard_size_check_9400.timer]", "Service[nrpe2nodexp-opensearch_shards_9200.timer]", "Service[nrpe2nodexp-opensearch_shards_9400.timer]", "Service[nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer]", "Service[nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer]", "Service[opensearch-disable-readahead-relforge-eqiad-small-alpha.timer]", "Service[opensearch-disable-readahead-relforge-eqiad.timer]", "Service[opensearch-disable-readahead.timer]", "Service[opensearch-hot-threads-log.timer]", "Service[opensearch-relforge-eqiad-gc-log-cleanup.timer]", "Service[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer]", "Service[opensearch]", "Service[opensearch_1@relforge-eqiad-small-alpha]", "Service[opensearch_1@relforge-eqiad]", "Service[prometheus-elasticsearch-exporter-9200]", "Service[prometheus-elasticsearch-exporter-9400]", "Service[prometheus-elasticsearch-exporter]", "Service[prometheus-wmf-elasticsearch-exporter-9200]", "Service[prometheus-wmf-elasticsearch-exporter-9400]", "Service[push_cross_cluster_settings_9200.timer]", "Service[push_cross_cluster_settings_9400.timer]", "Service[wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer]", "Service[wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer]", "Service[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer]", "Service[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer]", "Sudo::User[nrpe-check_check_push_cross_cluster_settings_9200_status]", "Sudo::User[nrpe-check_check_push_cross_cluster_settings_9400_status]", "Sudo::User[nrpe-check_opensearch_shard_size_check_9200]", "Sudo::User[nrpe-check_opensearch_shard_size_check_9400]", "Sudo::User[nrpe-check_opensearch_shards_9200]", "Sudo::User[nrpe-check_opensearch_shards_9400]", "Sudo::User[nrpe-check_opensearch_unassigned_shard_check_9200]", "Sudo::User[nrpe-check_opensearch_unassigned_shard_check_9400]", "Sysctl::Conffile[TCP Fast Open]", "Sysctl::Conffile[opensearch]", "Sysctl::Parameters[TCP Fast Open]", "Sysctl::Parameters[opensearch]", "Systemd::Mask[nginx.service]", "Systemd::Monitor[push_cross_cluster_settings_9200]", "Systemd::Monitor[push_cross_cluster_settings_9400]", "Systemd::Service[clean_up_dlq]", "Systemd::Service[nrpe2nodexp-check_push_cross_cluster_settings_9200_status]", "Systemd::Service[nrpe2nodexp-check_push_cross_cluster_settings_9400_status]", "Systemd::Service[nrpe2nodexp-opensearch_shard_size_check_9200]", "Systemd::Service[nrpe2nodexp-opensearch_shard_size_check_9400]", "Systemd::Service[nrpe2nodexp-opensearch_shards_9200]", "Systemd::Service[nrpe2nodexp-opensearch_shards_9400]", "Systemd::Service[nrpe2nodexp-opensearch_unassigned_shard_check_9200]", "Systemd::Service[nrpe2nodexp-opensearch_unassigned_shard_check_9400]", "Systemd::Service[opensearch-disable-readahead-relforge-eqiad-small-alpha]", "Systemd::Service[opensearch-disable-readahead-relforge-eqiad]", "Systemd::Service[opensearch-disable-readahead]", "Systemd::Service[opensearch-hot-threads-log]", "Systemd::Service[opensearch-relforge-eqiad-gc-log-cleanup]", "Systemd::Service[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]", "Systemd::Service[prometheus-elasticsearch-exporter-9200]", "Systemd::Service[prometheus-elasticsearch-exporter-9400]", "Systemd::Service[prometheus-wmf-elasticsearch-exporter-9200]", "Systemd::Service[prometheus-wmf-elasticsearch-exporter-9400]", "Systemd::Service[push_cross_cluster_settings_9200]", "Systemd::Service[push_cross_cluster_settings_9400]", "Systemd::Service[wmf_auto_restart_prometheus-elasticsearch-exporter-9200]", "Systemd::Service[wmf_auto_restart_prometheus-elasticsearch-exporter-9400]", "Systemd::Service[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]", "Systemd::Service[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]", "Systemd::Syslog[clean_up_dlq]", "Systemd::Syslog[opensearch-disable-readahead-relforge-eqiad-small-alpha]", "Systemd::Syslog[opensearch-disable-readahead-relforge-eqiad]", "Systemd::Syslog[opensearch-disable-readahead]", "Systemd::Syslog[opensearch-relforge-eqiad-gc-log-cleanup]", "Systemd::Syslog[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]", "Systemd::Syslog[push_cross_cluster_settings_9200]", "Systemd::Syslog[push_cross_cluster_settings_9400]", "Systemd::Syslog[wmf_auto_restart_prometheus-elasticsearch-exporter-9200]", "Systemd::Syslog[wmf_auto_restart_prometheus-elasticsearch-exporter-9400]", "Systemd::Syslog[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]", "Systemd::Syslog[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]", "Systemd::Timer::Job[clean_up_dlq]", "Systemd::Timer::Job[nrpe2nodexp-check_push_cross_cluster_settings_9200_status]", "Systemd::Timer::Job[nrpe2nodexp-check_push_cross_cluster_settings_9400_status]", "Systemd::Timer::Job[nrpe2nodexp-opensearch_shard_size_check_9200]", "Systemd::Timer::Job[nrpe2nodexp-opensearch_shard_size_check_9400]", "Systemd::Timer::Job[nrpe2nodexp-opensearch_shards_9200]", "Systemd::Timer::Job[nrpe2nodexp-opensearch_shards_9400]", "Systemd::Timer::Job[nrpe2nodexp-opensearch_unassigned_shard_check_9200]", "Systemd::Timer::Job[nrpe2nodexp-opensearch_unassigned_shard_check_9400]", "Systemd::Timer::Job[opensearch-disable-readahead-relforge-eqiad-small-alpha]", "Systemd::Timer::Job[opensearch-disable-readahead-relforge-eqiad]", "Systemd::Timer::Job[opensearch-disable-readahead]", "Systemd::Timer::Job[opensearch-hot-threads-log]", "Systemd::Timer::Job[opensearch-relforge-eqiad-gc-log-cleanup]", "Systemd::Timer::Job[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]", "Systemd::Timer::Job[push_cross_cluster_settings_9200]", "Systemd::Timer::Job[push_cross_cluster_settings_9400]", "Systemd::Timer::Job[wmf_auto_restart_prometheus-elasticsearch-exporter-9200]", "Systemd::Timer::Job[wmf_auto_restart_prometheus-elasticsearch-exporter-9400]", "Systemd::Timer::Job[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]", "Systemd::Timer::Job[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]", "Systemd::Timer[clean_up_dlq]", "Systemd::Timer[nrpe2nodexp-check_push_cross_cluster_settings_9200_status]", "Systemd::Timer[nrpe2nodexp-check_push_cross_cluster_settings_9400_status]", "Systemd::Timer[nrpe2nodexp-opensearch_shard_size_check_9200]", "Systemd::Timer[nrpe2nodexp-opensearch_shard_size_check_9400]", "Systemd::Timer[nrpe2nodexp-opensearch_shards_9200]", "Systemd::Timer[nrpe2nodexp-opensearch_shards_9400]", "Systemd::Timer[nrpe2nodexp-opensearch_unassigned_shard_check_9200]", "Systemd::Timer[nrpe2nodexp-opensearch_unassigned_shard_check_9400]", "Systemd::Timer[opensearch-disable-readahead-relforge-eqiad-small-alpha]", "Systemd::Timer[opensearch-disable-readahead-relforge-eqiad]", "Systemd::Timer[opensearch-disable-readahead]", "Systemd::Timer[opensearch-hot-threads-log]", "Systemd::Timer[opensearch-relforge-eqiad-gc-log-cleanup]", "Systemd::Timer[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]", "Systemd::Timer[push_cross_cluster_settings_9200]", "Systemd::Timer[push_cross_cluster_settings_9400]", "Systemd::Timer[wmf_auto_restart_prometheus-elasticsearch-exporter-9200]", "Systemd::Timer[wmf_auto_restart_prometheus-elasticsearch-exporter-9400]", "Systemd::Timer[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]", "Systemd::Timer[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]", "Systemd::Tmpfile[opensearch-relforge-eqiad-small-alpha]", "Systemd::Tmpfile[opensearch-relforge-eqiad]", "Systemd::Unit[clean_up_dlq.service]", "Systemd::Unit[clean_up_dlq.timer]", "Systemd::Unit[nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service]", "Systemd::Unit[nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer]", "Systemd::Unit[nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service]", "Systemd::Unit[nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer]", "Systemd::Unit[nrpe2nodexp-opensearch_shard_size_check_9200.service]", "Systemd::Unit[nrpe2nodexp-opensearch_shard_size_check_9200.timer]", "Systemd::Unit[nrpe2nodexp-opensearch_shard_size_check_9400.service]", "Systemd::Unit[nrpe2nodexp-opensearch_shard_size_check_9400.timer]", "Systemd::Unit[nrpe2nodexp-opensearch_shards_9200.service]", "Systemd::Unit[nrpe2nodexp-opensearch_shards_9200.timer]", "Systemd::Unit[nrpe2nodexp-opensearch_shards_9400.service]", "Systemd::Unit[nrpe2nodexp-opensearch_shards_9400.timer]", "Systemd::Unit[nrpe2nodexp-opensearch_unassigned_shard_check_9200.service]", "Systemd::Unit[nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer]", "Systemd::Unit[nrpe2nodexp-opensearch_unassigned_shard_check_9400.service]", "Systemd::Unit[nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer]", "Systemd::Unit[opensearch-disable-readahead-relforge-eqiad-small-alpha.service]", "Systemd::Unit[opensearch-disable-readahead-relforge-eqiad-small-alpha.timer]", "Systemd::Unit[opensearch-disable-readahead-relforge-eqiad.service]", "Systemd::Unit[opensearch-disable-readahead-relforge-eqiad.timer]", "Systemd::Unit[opensearch-disable-readahead.service]", "Systemd::Unit[opensearch-disable-readahead.timer]", "Systemd::Unit[opensearch-hot-threads-log.service]", "Systemd::Unit[opensearch-hot-threads-log.timer]", "Systemd::Unit[opensearch-relforge-eqiad-gc-log-cleanup.service]", "Systemd::Unit[opensearch-relforge-eqiad-gc-log-cleanup.timer]", "Systemd::Unit[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service]", "Systemd::Unit[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer]", "Systemd::Unit[opensearch_1@.service]", "Systemd::Unit[prometheus-elasticsearch-exporter-9200]", "Systemd::Unit[prometheus-elasticsearch-exporter-9400]", "Systemd::Unit[prometheus-wmf-elasticsearch-exporter-9200]", "Systemd::Unit[prometheus-wmf-elasticsearch-exporter-9400]", "Systemd::Unit[push_cross_cluster_settings_9200.service]", "Systemd::Unit[push_cross_cluster_settings_9200.timer]", "Systemd::Unit[push_cross_cluster_settings_9400.service]", "Systemd::Unit[push_cross_cluster_settings_9400.timer]", "Systemd::Unit[wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service]", "Systemd::Unit[wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer]", "Systemd::Unit[wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service]", "Systemd::Unit[wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer]", "Systemd::Unit[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service]", "Systemd::Unit[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer]", "Systemd::Unit[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service]", "Systemd::Unit[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer]", "Systemd::Unmask[nginx.service]", "Tlsproxy::Localssl[relforge-eqiad-small-alpha]", "Tlsproxy::Localssl[relforge-eqiad]", "Udev::Rule[opensearch-readahead]"], "resource_diffs": [{"resource": "Systemd::Syslog[opensearch-relforge-eqiad-gc-log-cleanup]", "parameters": "--- Systemd::Syslog[opensearch-relforge-eqiad-gc-log-cleanup].orig\n+++ Systemd::Syslog[opensearch-relforge-eqiad-gc-log-cleanup]\n\n+    readable_by            => all\n+    force_stop             => True\n+    ensure                 => present\n+    programname_comparison => startswith\n+    log_filename           => syslog.log\n+    owner                  => root\n+    group                  => root\n+    base_dir               => /var/log\n"}, {"resource": "Systemd::Unit[opensearch-hot-threads-log.service]", "parameters": "--- Systemd::Unit[opensearch-hot-threads-log.service].orig\n+++ Systemd::Unit[opensearch-hot-threads-log.service]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => present\n+    override_filename => puppet-override.conf\n+    unit              => opensearch-hot-threads-log.service\n"}, {"resource": "Rsyslog::Conf[nrpe2nodexp-opensearch_unassigned_shard_check_9200]", "parameters": "--- Rsyslog::Conf[nrpe2nodexp-opensearch_unassigned_shard_check_9200].orig\n+++ Rsyslog::Conf[nrpe2nodexp-opensearch_unassigned_shard_check_9200]\n\n+    mode     => 0444\n+    priority => 25\n+    ensure   => absent\n"}, {"resource": "File[/lib/systemd/system/opensearch-disable-readahead-relforge-eqiad-small-alpha.service]", "content": "--- /lib/systemd/system/opensearch-disable-readahead-relforge-eqiad-small-alpha.service.orig\n+++ /lib/systemd/system/opensearch-disable-readahead-relforge-eqiad-small-alpha.service\n@@ -0,0 +1,8 @@\n+[Unit]\n+Description=Disables readahead on all open files every 30 minutes to alleviate Cirrussearch / opensearch IO load spikes\n+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+\n+[Service]\n+Type=oneshot\n+User=root\n+ExecStart=/usr/local/bin/opensearch-disable-readahead.sh relforge-eqiad-small-alpha /srv/opensearch", "parameters": "--- File[/lib/systemd/system/opensearch-disable-readahead-relforge-eqiad-small-alpha.service].orig\n+++ File[/lib/systemd/system/opensearch-disable-readahead-relforge-eqiad-small-alpha.service]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for opensearch-disable-readahead-relforge-eqiad-small-alpha.service (opensearch-disable-readahead-relforge-eqiad-small-alpha.service)]\n"}, {"resource": "Class[Profile::Apt]", "parameters": "--- Class[Profile::Apt].orig\n+++ Class[Profile::Apt]\n\n@@\n-    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[prometheus-ethtool-exporter]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[libicu67]', 'Package[libwsutil12]', 'Package[libwireshark14]', 'Package[libopencsd0]', 'Package[libwiretap11]', 'Package[ruby2.7]', 'Package[python3.9-minimal]', 'Package[python3.9]', 'Package[perl-modules-5.32]', 'Package[libpython3.9]', 'Package[libperl5.32]', 'Package[libpython3.9-minimal]', 'Package[libpython3.9-stdlib]', 'Package[libidn11]', 'Package[libldap-2.4-2]', 'Package[liburing1]', 'Package[libwebp6]', 'Package[libcbor0]', 'Package[libusb-0.1-4]', 'Package[telnet]', 'Package[libruby2.7]', 'Package[libdns-export1110]', 'Package[libisc-export1105]', 'Package[libbpf0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[ulogd2]', 'Package[conntrack]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]']\n+    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[prometheus-ethtool-exporter]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[libicu67]', 'Package[libwsutil12]', 'Package[libwireshark14]', 'Package[libopencsd0]', 'Package[libwiretap11]', 'Package[ruby2.7]', 'Package[python3.9-minimal]', 'Package[python3.9]', 'Package[perl-modules-5.32]', 'Package[libpython3.9]', 'Package[libperl5.32]', 'Package[libpython3.9-minimal]', 'Package[libpython3.9-stdlib]', 'Package[libidn11]', 'Package[libldap-2.4-2]', 'Package[liburing1]', 'Package[libwebp6]', 'Package[libcbor0]', 'Package[libusb-0.1-4]', 'Package[telnet]', 'Package[libruby2.7]', 'Package[libdns-export1110]', 'Package[libisc-export1105]', 'Package[libbpf0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[ulogd2]', 'Package[conntrack]', 'Package[edac-utils]', 'Package[opensearch]', 'Package[python3-requests]', 'Package[wmf-opensearch-search-plugins]', 'Package[opensearch-madvise]', 'Package[logstash-oss]', 'Package[logstash-old-name]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]', 'Package[openjdk-17-jdk]', 'Package[prometheus-elasticsearch-exporter]', 'Package[nginx-light]', 'Package[nginx-common]']\n"}, {"resource": "File[/usr/local/lib/nagios/plugins/check_systemd_unit_status]", "parameters": "--- File[/usr/local/lib/nagios/plugins/check_systemd_unit_status].orig\n+++ File[/usr/local/lib/nagios/plugins/check_systemd_unit_status]\n\n+    owner   => root\n+    source  => puppet:///modules/systemd/check_systemd_unit_status\n+    require => File[/usr/local/lib/nagios/plugins/]\n+    group   => root\n+    tag     => nrpe::plugin\n+    ensure  => file\n+    mode    => 0555\n"}, {"resource": "Nginx::Site[relforge-eqiad-small-alpha]", "parameters": "--- Nginx::Site[relforge-eqiad-small-alpha].orig\n+++ Nginx::Site[relforge-eqiad-small-alpha]\n\n+    require => Exec[tlsproxy localssl default_server on ports [9443]]\n+    ensure  => present\n"}, {"resource": "Sysctl::Parameters[opensearch]", "parameters": "--- Sysctl::Parameters[opensearch].orig\n+++ Sysctl::Parameters[opensearch]\n\n+    ensure             => present\n+    no_priority_prefix => True\n+    priority           => 70\n+    values             => {'vm.max_map_count': 1048576}\n"}, {"resource": "Java::Package[openjdk-jdk-17]", "parameters": "--- Java::Package[openjdk-jdk-17].orig\n+++ Java::Package[openjdk-jdk-17]\n\n+    package_info => {'version': '17', 'variant': 'jdk'}\n+    egd_source   => /dev/random\n+    hardened_tls => False\n"}, {"resource": "Prometheus::Wmf_elasticsearch_exporter[relforge1008:9400]", "parameters": "--- Prometheus::Wmf_elasticsearch_exporter[relforge1008:9400].orig\n+++ Prometheus::Wmf_elasticsearch_exporter[relforge1008:9400]\n\n+    prometheus_port    => 9121\n+    indices_to_monitor => []\n+    elasticsearch_port => 9400\n"}, {"resource": "Service[prometheus-wmf-elasticsearch-exporter-9200]", "parameters": "--- Service[prometheus-wmf-elasticsearch-exporter-9200].orig\n+++ Service[prometheus-wmf-elasticsearch-exporter-9200]\n\n+    ensure => running\n+    enable => True\n"}, {"resource": "Monitoring::Exported_nagios_service[relforge1008 check_push_cross_cluster_settings_9200_status]", "parameters": "--- Monitoring::Exported_nagios_service[relforge1008 check_push_cross_cluster_settings_9200_status].orig\n+++ Monitoring::Exported_nagios_service[relforge1008 check_push_cross_cluster_settings_9200_status]\n\n+    check_command          => nrpe_check!check_check_push_cross_cluster_settings_9200_status!10\n+    retry_interval         => 1\n+    active_checks_enabled  => 1\n+    contact_groups         => admins\n+    host_name              => relforge1008\n+    check_freshness        => 0\n+    notification_period    => 24x7\n+    servicegroups          => relforge_eqiad\n+    notification_interval  => 0\n+    ensure                 => present\n+    notification_options   => c,r,f\n+    check_interval         => 10\n+    notifications_enabled  => 0\n+    max_check_attempts     => 2\n+    is_volatile            => 0\n+    passive_checks_enabled => 1\n+    check_period           => 24x7\n+    service_description    => Check unit status of push_cross_cluster_settings_9200\n+    notes_url              => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n"}, {"resource": "Systemd::Unit[clean_up_dlq.service]", "parameters": "--- Systemd::Unit[clean_up_dlq.service].orig\n+++ Systemd::Unit[clean_up_dlq.service]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => absent\n+    override_filename => puppet-override.conf\n+    unit              => clean_up_dlq.service\n"}, {"resource": "Class[Profile::Base::Production]", "parameters": "--- Class[Profile::Base::Production].orig\n+++ Class[Profile::Base::Production]\n\n@@\n-    role_description => Unpuppetised system for testing\n+    role_description => Elasticsearch relforge\n"}, {"resource": "Systemd::Timer::Job[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]", "parameters": "--- Systemd::Timer::Job[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400].orig\n+++ Systemd::Timer::Job[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]\n\n+    send_mail                 => False\n+    user                      => root\n+    require                   => File[/usr/local/sbin/wmf-auto-restart]\n+    monitoring_enabled        => False\n+    logfile_name              => syslog.log\n+    logging_enabled           => True\n+    command                   => /usr/local/sbin/wmf-auto-restart -s prometheus-wmf-elasticsearch-exporter-9400\n+    private_tmp               => False\n+    description               => Auto restart job: prometheus-wmf-elasticsearch-exporter-9400\n+    syslog_force_stop         => True\n+    ignore_errors             => False\n+    send_mail_only_on_error   => True\n+    fixed_random_delay        => False\n+    logfile_perms             => all\n+    ensure                    => present\n+    logfile_basedir           => /var/log\n+    environment               => {}\n+    logfile_group             => root\n+    send_mail_to              => root@relforge1008.eqiad.wmnet\n+    success_exit_status       => []\n+    interval                  => {'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 11:6:00'}\n+    monitoring_contact_groups => admins\n+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+    syslog_match_startswith   => True\n"}, {"resource": "Service[opensearch-relforge-eqiad-gc-log-cleanup.timer]", "parameters": "--- Service[opensearch-relforge-eqiad-gc-log-cleanup.timer].orig\n+++ Service[opensearch-relforge-eqiad-gc-log-cleanup.timer]\n\n+    ensure   => running\n+    provider => systemd\n+    enable   => True\n"}, {"resource": "File[/etc/ferm/conf.d/10_opensearch-https-9243]", "content": "--- /etc/ferm/conf.d/10_opensearch-https-9243.orig\n+++ /etc/ferm/conf.d/10_opensearch-https-9243\n@@ -0,0 +1,6 @@\n+# Autogenerated by puppet. DO NOT EDIT BY HAND!\n+#\n+# \n+&R_SERVICE(tcp, 9243, (($CUMIN_MASTERS $ANALYTICS_NETWORKS $STAGING_KUBEPODS_NETWORKS)));\n+\n+", "parameters": "--- File[/etc/ferm/conf.d/10_opensearch-https-9243].orig\n+++ File[/etc/ferm/conf.d/10_opensearch-https-9243]\n\n+    owner   => root\n+    group   => root\n+    tag     => ferm\n+    require => File[/etc/ferm/conf.d]\n+    mode    => 0400\n+    ensure  => present\n+    notify  => Service[ferm]\n"}, {"resource": "File[/lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer]", "content": "--- /lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer.orig\n+++ /lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer\n@@ -0,0 +1,12 @@\n+[Unit]\n+Description=Periodic execution of wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service\n+\n+[Timer]\n+Unit=wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service\n+# Accuracy sets the maximum time interval around the execution time we want to allow\n+AccuracySec=15sec\n+OnCalendar=Mon,Tue,Wed,Thu,Fri *-*-* 7:36:00\n+RandomizedDelaySec=0\n+\n+[Install]\n+WantedBy=multi-user.target", "parameters": "--- File[/lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer].orig\n+++ File[/lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer (wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer)]\n"}, {"resource": "Logrotate::Conf[wmf_auto_restart_prometheus-elasticsearch-exporter-9200]", "parameters": "--- Logrotate::Conf[wmf_auto_restart_prometheus-elasticsearch-exporter-9200].orig\n+++ Logrotate::Conf[wmf_auto_restart_prometheus-elasticsearch-exporter-9200]\n\n+    ensure => present\n"}, {"resource": "Service[prometheus-elasticsearch-exporter]", "parameters": "--- Service[prometheus-elasticsearch-exporter].orig\n+++ Service[prometheus-elasticsearch-exporter]\n\n+    ensure  => stopped\n+    require => Package[prometheus-elasticsearch-exporter]\n"}, {"resource": "File[/etc/ferm/conf.d/10_opensearch_inter_node_9500]", "content": "--- /etc/ferm/conf.d/10_opensearch_inter_node_9500.orig\n+++ /etc/ferm/conf.d/10_opensearch_inter_node_9500\n@@ -0,0 +1,8 @@\n+# Autogenerated by puppet. DO NOT EDIT BY HAND!\n+#\n+# \n+&R_SERVICE(tcp, 9500, (10.64.164.14 10.64.32.100 10.64.48.120 2620:0:861:103:10:64:32:100 2620:0:861:107:10:64:48:120 2620:0:861:12c:10:64:164:14));\n+\n+\n+\n+&NO_TRACK(tcp, 9500);", "parameters": "--- File[/etc/ferm/conf.d/10_opensearch_inter_node_9500].orig\n+++ File[/etc/ferm/conf.d/10_opensearch_inter_node_9500]\n\n+    owner   => root\n+    group   => root\n+    tag     => ferm\n+    require => File[/etc/ferm/conf.d]\n+    mode    => 0400\n+    ensure  => present\n+    notify  => Service[ferm]\n"}, {"resource": "File[/var/lib/prometheus/node.d/check_opensearch_unassigned_shard_check_9400.prom]", "parameters": "--- File[/var/lib/prometheus/node.d/check_opensearch_unassigned_shard_check_9400.prom].orig\n+++ File[/var/lib/prometheus/node.d/check_opensearch_unassigned_shard_check_9400.prom]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n"}, {"resource": "File[/usr/local/bin/opensearch_hot_threads_logger.py]", "parameters": "--- File[/usr/local/bin/opensearch_hot_threads_logger.py].orig\n+++ File[/usr/local/bin/opensearch_hot_threads_logger.py]\n\n+    mode   => 0555\n+    source => puppet:///modules/opensearch/opensearch_hot_threads_logger.py\n+    owner  => root\n+    group  => root\n"}, {"resource": "Systemd::Timer::Job[nrpe2nodexp-opensearch_shards_9400]", "parameters": "--- Systemd::Timer::Job[nrpe2nodexp-opensearch_shards_9400].orig\n+++ Systemd::Timer::Job[nrpe2nodexp-opensearch_shards_9400]\n\n+    send_mail                 => False\n+    user                      => nagios\n+    monitoring_enabled        => False\n+    logfile_name              => syslog.log\n+    logging_enabled           => False\n+    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash \"2a63eb7dcbe368b7f538118765d629d6\" --timeout 10 --check-command \"check_opensearch_shards_9400\"\n+    private_tmp               => False\n+    splay                     => 60\n+    description               => execution of nrpe2nodexp for the check_opensearch_shards_9400 command.\n+    syslog_force_stop         => True\n+    ignore_errors             => True\n+    send_mail_only_on_error   => True\n+    fixed_random_delay        => True\n+    logfile_perms             => all\n+    syslog_identifier         => nrpe2nodexp-opensearch_shards_9400\n+    ensure                    => absent\n+    logfile_basedir           => /var/log\n+    environment               => {}\n+    logfile_group             => root\n+    send_mail_to              => root@relforge1008.eqiad.wmnet\n+    group                     => prometheus-node-exporter\n+    success_exit_status       => []\n+    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]\n+    monitoring_contact_groups => admins\n+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+    syslog_match_startswith   => True\n"}, {"resource": "Package[edac-utils]", "parameters": "--- Package[edac-utils].orig\n+++ Package[edac-utils]\n\n+    provider => apt\n+    ensure   => latest\n"}, {"resource": "Systemd::Timer[opensearch-hot-threads-log]", "parameters": "--- Systemd::Timer[opensearch-hot-threads-log].orig\n+++ Systemd::Timer[opensearch-hot-threads-log]\n\n+    unit_name          => opensearch-hot-threads-log.service\n+    fixed_random_delay => False\n+    splay              => 0\n+    ensure             => present\n+    timer_intervals    => [{'start': 'OnCalendar', 'interval': '*-*-* *:00/5:00'}]\n+    accuracy           => 15sec\n"}, {"resource": "Systemd::Unit[wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service]", "parameters": "--- Systemd::Unit[wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service].orig\n+++ Systemd::Unit[wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => present\n+    override_filename => puppet-override.conf\n+    unit              => wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service\n"}, {"resource": "File[/etc/opensearch/instances]", "content": "--- /etc/opensearch/instances.orig\n+++ /etc/opensearch/instances\n@@ -0,0 +1,2 @@\n+opensearch_1@relforge-eqiad\n+opensearch_1@relforge-eqiad-small-alpha", "parameters": "--- File[/etc/opensearch/instances].orig\n+++ File[/etc/opensearch/instances]\n\n+    owner  => root\n+    mode   => 0444\n+    group  => root\n+    ensure => file\n"}, {"resource": "File[/etc/nagios/nrpe.d/check_opensearch_shard_size_check_9400.cfg]", "content": "--- /etc/nagios/nrpe.d/check_opensearch_shard_size_check_9400.cfg.orig\n+++ /etc/nagios/nrpe.d/check_opensearch_shard_size_check_9400.cfg\n@@ -0,0 +1,2 @@\n+# File generated by puppet. DO NOT edit by hand\n+command[check_opensearch_shard_size_check_9400]=/usr/lib/nagios/plugins/check_elasticsearch_shard_size.py --url http://localhost:9400 --shard-size-warning 110 --shard-size-critical 140 --timeout 4", "parameters": "--- File[/etc/nagios/nrpe.d/check_opensearch_shard_size_check_9400.cfg].orig\n+++ File[/etc/nagios/nrpe.d/check_opensearch_shard_size_check_9400.cfg]\n\n+    owner   => root\n+    require => Package[nagios-nrpe-server]\n+    group   => root\n+    tag     => nrpe::check\n+    ensure  => present\n+    mode    => 0444\n+    notify  => Service[nagios-nrpe-server]\n"}, {"resource": "Systemd::Timer::Job[opensearch-relforge-eqiad-gc-log-cleanup]", "parameters": "--- Systemd::Timer::Job[opensearch-relforge-eqiad-gc-log-cleanup].orig\n+++ Systemd::Timer::Job[opensearch-relforge-eqiad-gc-log-cleanup]\n\n+    send_mail                 => False\n+    user                      => root\n+    monitoring_enabled        => False\n+    logfile_name              => syslog.log\n+    logging_enabled           => True\n+    command                   => /usr/bin/find /var/log/opensearch -name 'relforge-eqiad_jvm_gc.*.log*' -mtime +30 -delete\n+    private_tmp               => False\n+    description               => Cleanup GC logs\n+    syslog_force_stop         => True\n+    ignore_errors             => False\n+    send_mail_only_on_error   => True\n+    fixed_random_delay        => False\n+    logfile_perms             => all\n+    ensure                    => present\n+    logfile_basedir           => /var/log\n+    environment               => {}\n+    logfile_group             => root\n+    send_mail_to              => root@relforge1008.eqiad.wmnet\n+    success_exit_status       => []\n+    interval                  => {'start': 'OnCalendar', 'interval': '*-*-* 02:12:00'}\n+    monitoring_contact_groups => admins\n+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+    syslog_match_startswith   => True\n"}, {"resource": "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9200.service (nrpe2nodexp-opensearch_shards_9200.service)]", "parameters": "--- Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9200.service (nrpe2nodexp-opensearch_shards_9200.service)].orig\n+++ Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9200.service (nrpe2nodexp-opensearch_shards_9200.service)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "File[/lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9400.service]", "content": "--- /lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9400.service.orig\n+++ /lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9400.service\n@@ -0,0 +1,11 @@\n+[Unit]\n+Description=execution of nrpe2nodexp for the check_opensearch_unassigned_shard_check_9400 command.\n+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+\n+[Service]\n+Type=oneshot\n+User=nagios\n+\n+Group=prometheus-node-exporter\n+SyslogIdentifier=nrpe2nodexp-opensearch_unassigned_shard_check_9400\n+ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash \"a0a4892478c289e50484ffd2fb4c3202\" --timeout 10 --check-command \"check_opensearch_unassigned_shard_check_9400\"", "parameters": "--- File[/lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9400.service].orig\n+++ File[/lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9400.service]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9400.service (nrpe2nodexp-opensearch_unassigned_shard_check_9400.service)]\n"}, {"resource": "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9200.service (nrpe2nodexp-opensearch_shard_size_check_9200.service)]", "parameters": "--- Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9200.service (nrpe2nodexp-opensearch_shard_size_check_9200.service)].orig\n+++ Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9200.service (nrpe2nodexp-opensearch_shard_size_check_9200.service)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Prometheus::Alert::Rule[check_opensearch_unassigned_shard_check_9200_54ca99505516d5452912b573aa7d35d3]", "parameters": "--- Prometheus::Alert::Rule[check_opensearch_unassigned_shard_check_9200_54ca99505516d5452912b573aa7d35d3].orig\n+++ Prometheus::Alert::Rule[check_opensearch_unassigned_shard_check_9200_54ca99505516d5452912b573aa7d35d3]\n\n+    for                => 720m\n+    team               => observability\n+    ensure             => absent\n+    dashboard          => TODO\n+    instance           => ops\n+    runbook            => https://wikitech.wikimedia.org/wiki/Search#Administration\n+    severity           => info\n+    def_label_whitelst => ['team', 'severity']\n+    alert_name         => nrpe_OpenSearch_unassigned_shard_check___9200\n+    site               => eqiad\n+    group              => nrpechecks\n+    summary            => NRPE CHECK: OpenSearch unassigned shard check - 9200\n+    expr               => (nagios_nrpe_check_result{alert_rule_hash=\"54ca99505516d5452912b573aa7d35d3\",check_name=\"check_opensearch_unassigned_shard_check_9200\", status=~\"(WARNING|CRITICAL)\", severity=~\"(warning|critical)\"} > 0) * on (instance) group_left (team) role_owner\n+    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_opensearch_unassigned_shard_check_9200))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))\n+    description        => NRPE CHECK: OpenSearch unassigned shard check - 9200\n"}, {"resource": "Class[Profile::Rsyslog::Udp_json_logback_compat]", "parameters": "--- Class[Profile::Rsyslog::Udp_json_logback_compat].orig\n+++ Class[Profile::Rsyslog::Udp_json_logback_compat]\n\n+    logging_kafka_brokers => ['kafka-logging1001.eqiad.wmnet:9093', 'kafka-logging1002.eqiad.wmnet:9093', 'kafka-logging1003.eqiad.wmnet:9093', 'kafka-logging1004.eqiad.wmnet:9093', 'kafka-logging1005.eqiad.wmnet:9093']\n+    queue_enabled_sites   => ['ulsfo', 'esams', 'eqsin', 'eqiad', 'codfw', 'drmrs', 'magru']\n+    port                  => 11514\n"}, {"resource": "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer (nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer)]", "parameters": "--- Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer (nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer)].orig\n+++ Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer (nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "File[/usr/lib/nagios/plugins/check_elasticsearch]", "parameters": "--- File[/usr/lib/nagios/plugins/check_elasticsearch].orig\n+++ File[/usr/lib/nagios/plugins/check_elasticsearch]\n\n+    owner  => root\n+    mode   => 0755\n+    group  => root\n+    source => puppet:///modules/icinga/elasticsearch/check_elasticsearch\n"}, {"resource": "File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-shard-size-check-9400.conf]", "content": "--- /etc/rsyslog.d/25-nrpe2nodexp-opensearch-shard-size-check-9400.conf.orig\n+++ /etc/rsyslog.d/25-nrpe2nodexp-opensearch-shard-size-check-9400.conf\n@@ -0,0 +1,10 @@\n+# SPDX-License-Identifier: Apache-2.0\n+if $programname contains \"nrpe2nodexp-opensearch_shard_size_check_9400\" then {\n+    if ($msg contains \"\\\"ecs.version\\\": \\\"1.7.0\\\"\") then {\n+        # Send logs to kafka\n+        set $.log_outputs = \"kafka ecs_170 local\";\n+    } else {\n+        # Filter out non-relevant nrpe2nodexp messages\n+        stop\n+    }\n+}", "parameters": "--- File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-shard-size-check-9400.conf].orig\n+++ File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-shard-size-check-9400.conf]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Service[rsyslog]\n"}, {"resource": "File[/lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer]", "content": "--- /lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer.orig\n+++ /lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer\n@@ -0,0 +1,12 @@\n+[Unit]\n+Description=Periodic execution of wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service\n+\n+[Timer]\n+Unit=wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service\n+# Accuracy sets the maximum time interval around the execution time we want to allow\n+AccuracySec=15sec\n+OnCalendar=Mon,Tue,Wed,Thu,Fri *-*-* 10:55:00\n+RandomizedDelaySec=0\n+\n+[Install]\n+WantedBy=multi-user.target", "parameters": "--- File[/lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer].orig\n+++ File[/lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer (wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer)]\n"}, {"resource": "File[/etc/rsyslog.d/25-nrpe2nodexp-check-push-cross-cluster-settings-9200-status.conf]", "content": "--- /etc/rsyslog.d/25-nrpe2nodexp-check-push-cross-cluster-settings-9200-status.conf.orig\n+++ /etc/rsyslog.d/25-nrpe2nodexp-check-push-cross-cluster-settings-9200-status.conf\n@@ -0,0 +1,10 @@\n+# SPDX-License-Identifier: Apache-2.0\n+if $programname contains \"nrpe2nodexp-check_push_cross_cluster_settings_9200_status\" then {\n+    if ($msg contains \"\\\"ecs.version\\\": \\\"1.7.0\\\"\") then {\n+        # Send logs to kafka\n+        set $.log_outputs = \"kafka ecs_170 local\";\n+    } else {\n+        # Filter out non-relevant nrpe2nodexp messages\n+        stop\n+    }\n+}", "parameters": "--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-push-cross-cluster-settings-9200-status.conf].orig\n+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-push-cross-cluster-settings-9200-status.conf]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Service[rsyslog]\n"}, {"resource": "Ferm::Service[opensearch-https-9243]", "parameters": "--- Ferm::Service[opensearch-https-9243].orig\n+++ Ferm::Service[opensearch-https-9243]\n\n+    unrestricted_access => False\n+    ensure              => present\n+    notrack             => False\n+    srange              => (($CUMIN_MASTERS $ANALYTICS_NETWORKS $STAGING_KUBEPODS_NETWORKS))\n+    prio                => 10\n+    desc                => \n+    port                => 9243\n+    proto               => tcp\n"}, {"resource": "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service (wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service)]", "parameters": "--- Exec[systemd daemon-reload for wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service (wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service)].orig\n+++ Exec[systemd daemon-reload for wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service (wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "File[/etc/opensearch/relforge-eqiad-small-alpha/scripts]", "parameters": "--- File[/etc/opensearch/relforge-eqiad-small-alpha/scripts].orig\n+++ File[/etc/opensearch/relforge-eqiad-small-alpha/scripts]\n\n+    owner  => root\n+    mode   => 0444\n+    group  => root\n+    ensure => directory\n"}, {"resource": "File[/etc/opensearch/relforge-eqiad-small-alpha/java-security.policy]", "parameters": "--- File[/etc/opensearch/relforge-eqiad-small-alpha/java-security.policy].orig\n+++ File[/etc/opensearch/relforge-eqiad-small-alpha/java-security.policy]\n\n+    owner  => opensearch\n+    source => puppet:///modules/profile/opensearch/java-security.policy\n+    group  => opensearch\n+    ensure => file\n+    mode   => 0440\n"}, {"resource": "Exec[Generate cert discovery2026__relforge1008_eqiad_wmnet]", "parameters": "--- Exec[Generate cert discovery2026__relforge1008_eqiad_wmnet].orig\n+++ Exec[Generate cert discovery2026__relforge1008_eqiad_wmnet]\n\n+    environment => ['GODEBUG=x509ignoreCN=0']\n+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/relforge1008.eqiad.wmnet.pem -label discovery2026  /etc/cfssl/csr/discovery2026__relforge1008_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet\n\n+    unless      => /usr/bin/test \"$(/usr/bin/openssl x509 -in /etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.pem -noout -pubkey 2>&1)\" == \"$(/usr/bin/openssl pkey -pubout -in /etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet-key.pem 2>&1)\"\n\n+    require     => Cfssl::Csr[/etc/cfssl/csr/discovery2026__relforge1008_eqiad_wmnet.csr]\n"}, {"resource": "File[/etc/rsyslog.d/40-wmf-auto-restart-prometheus-wmf-elasticsearch-exporter-9200.conf]", "content": "--- /etc/rsyslog.d/40-wmf-auto-restart-prometheus-wmf-elasticsearch-exporter-9200.conf.orig\n+++ /etc/rsyslog.d/40-wmf-auto-restart-prometheus-wmf-elasticsearch-exporter-9200.conf\n@@ -0,0 +1,10 @@\n+# rsyslog.conf(5) configuration file for services.\n+# This file is managed by Puppet.\n+if $programname startswith \"wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200\" then {\n+    action(\n+        type=\"omfile\" file=\"/var/log/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200/syslog.log\"\n+        fileOwner=\"root\" fileGroup=\"root\"\n+        fileCreateMode=\"0644\"\n+    )\n+    & stop\n+}", "parameters": "--- File[/etc/rsyslog.d/40-wmf-auto-restart-prometheus-wmf-elasticsearch-exporter-9200.conf].orig\n+++ File[/etc/rsyslog.d/40-wmf-auto-restart-prometheus-wmf-elasticsearch-exporter-9200.conf]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Service[rsyslog]\n"}, {"resource": "File[/etc/nginx/sites-available/relforge-eqiad-small-alpha]", "content": "--- /etc/nginx/sites-available/relforge-eqiad-small-alpha.orig\n+++ /etc/nginx/sites-available/relforge-eqiad-small-alpha\n@@ -0,0 +1,59 @@\n+# Proxy site configuration file for relforge-eqiad-small-alpha\n+# This file is managed by Puppet!\n+upstream local_fe_relforge-eqiad-small-alpha {\n+    server 10.64.32.100:9400 max_fails=0;\n+}\n+\n+# SSL proxying\n+server {\n+    # Enabling TCP Fast Open is safe for HTTP over TLS. There is no idempotency\n+    # concern replaying TLS Client Hello.\n+    # https://tools.ietf.org/html/rfc7413#section-6.3.2\n+    listen [::]:9443 default_server deferred backlog=16384 reuseport ipv6only=on fastopen=150 ssl ;\n+    listen 9443 default_server deferred backlog=16384 reuseport fastopen=150 ssl ;\n+    server_name relforge1008.eqiad.wmnet relforge.svc.eqiad.wmnet;\n+\n+    error_log   /var/log/nginx/relforge-eqiad-small-alpha.error.log;\n+    access_log   off;\n+\n+    ssl_certificate /etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chained.pem;\n+    ssl_certificate_key /etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet-key.pem;\n+\n+    keepalive_timeout 60;\n+    keepalive_requests 100;\n+\n+    location / {\n+        proxy_pass http://local_fe_relforge-eqiad-small-alpha;\n+        proxy_http_version 1.1;\n+        proxy_set_header Connection close; # should be default\n+\n+        # this should be in sync with Varnish's first_byte_timeout\n+        # and PHP's max_execution_time\n+        proxy_read_timeout 180s;\n+\n+        proxy_set_header Host $host;\n+        proxy_set_header X-Client-IP $remote_addr;\n+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n+        proxy_set_header X-Forwarded-Proto https;\n+        proxy_set_header X-Connection-Properties \"H2=$h2; SSR=$session_reused; SSL=$ssl_protocol; C=$ssl_cipher;\";\n+\n+        # Don't clobber the Server header from the backend.\n+        proxy_pass_header Server;\n+\n+        proxy_redirect off;\n+        proxy_buffering off;\n+        proxy_request_buffering on;\n+\n+        # With proxy buffering off, proxy_buffer_size is still used to\n+        # define the singular chunk of buffer the content passes\n+        # through.  Apparently if nginx can't read all the response\n+        # headers in the first such chunk, it fails with 502.  Upping\n+        # this to 8k (from def 4k) solves the one reported case in\n+        # https://phabricator.wikimedia.org/T161819\n+        # --\n+        # Raising this further from 8K to 32K, at least temporarily, due to T226840\n+        # Note 32KB is also the similar default limit in our varnishes (http_resp_size)\n+        proxy_buffer_size       32k;\n+        proxy_buffers         4 32k;\n+    }\n+}", "parameters": "--- File[/etc/nginx/sites-available/relforge-eqiad-small-alpha].orig\n+++ File[/etc/nginx/sites-available/relforge-eqiad-small-alpha]\n\n+    before => ['Service[nginx]']\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    notify => Exec[nginx-reload]\n"}, {"resource": "Systemd::Timer::Job[wmf_auto_restart_prometheus-elasticsearch-exporter-9400]", "parameters": "--- Systemd::Timer::Job[wmf_auto_restart_prometheus-elasticsearch-exporter-9400].orig\n+++ Systemd::Timer::Job[wmf_auto_restart_prometheus-elasticsearch-exporter-9400]\n\n+    send_mail                 => False\n+    user                      => root\n+    require                   => File[/usr/local/sbin/wmf-auto-restart]\n+    monitoring_enabled        => False\n+    logfile_name              => syslog.log\n+    logging_enabled           => True\n+    command                   => /usr/local/sbin/wmf-auto-restart -s prometheus-elasticsearch-exporter-9400\n+    private_tmp               => False\n+    description               => Auto restart job: prometheus-elasticsearch-exporter-9400\n+    syslog_force_stop         => True\n+    ignore_errors             => False\n+    send_mail_only_on_error   => True\n+    fixed_random_delay        => False\n+    logfile_perms             => all\n+    ensure                    => present\n+    logfile_basedir           => /var/log\n+    environment               => {}\n+    logfile_group             => root\n+    send_mail_to              => root@relforge1008.eqiad.wmnet\n+    success_exit_status       => []\n+    interval                  => {'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 14:27:00'}\n+    monitoring_contact_groups => admins\n+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+    syslog_match_startswith   => True\n"}, {"resource": "Concat::Fragment[main contacts]"}, {"resource": "Systemd::Unit[nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer]", "parameters": "--- Systemd::Unit[nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer].orig\n+++ Systemd::Unit[nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => absent\n+    override_filename => puppet-override.conf\n+    unit              => nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer\n"}, {"resource": "Systemd::Timer::Job[wmf_auto_restart_prometheus-elasticsearch-exporter-9200]", "parameters": "--- Systemd::Timer::Job[wmf_auto_restart_prometheus-elasticsearch-exporter-9200].orig\n+++ Systemd::Timer::Job[wmf_auto_restart_prometheus-elasticsearch-exporter-9200]\n\n+    send_mail                 => False\n+    user                      => root\n+    require                   => File[/usr/local/sbin/wmf-auto-restart]\n+    monitoring_enabled        => False\n+    logfile_name              => syslog.log\n+    logging_enabled           => True\n+    command                   => /usr/local/sbin/wmf-auto-restart -s prometheus-elasticsearch-exporter-9200\n+    private_tmp               => False\n+    description               => Auto restart job: prometheus-elasticsearch-exporter-9200\n+    syslog_force_stop         => True\n+    ignore_errors             => False\n+    send_mail_only_on_error   => True\n+    fixed_random_delay        => False\n+    logfile_perms             => all\n+    ensure                    => present\n+    logfile_basedir           => /var/log\n+    environment               => {}\n+    logfile_group             => root\n+    send_mail_to              => root@relforge1008.eqiad.wmnet\n+    success_exit_status       => []\n+    interval                  => {'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 7:36:00'}\n+    monitoring_contact_groups => admins\n+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+    syslog_match_startswith   => True\n"}, {"resource": "Cfssl::Cert[discovery2026__relforge1008_eqiad_wmnet]", "parameters": "--- Cfssl::Cert[discovery2026__relforge1008_eqiad_wmnet].orig\n+++ Cfssl::Cert[discovery2026__relforge1008_eqiad_wmnet]\n\n+    notify_services => []\n+    ensure          => present\n+    common_name     => relforge1008.eqiad.wmnet\n+    hosts           => ['relforge.svc.eqiad.wmnet']\n+    renew_seconds   => 952200\n+    key             => {'algo': 'ecdsa', 'size': 256}\n+    provide_chain   => True\n+    owner           => root\n+    group           => root\n+    auto_renew      => True\n+    label           => discovery2026\n+    environment     => ['GODEBUG=x509ignoreCN=0']\n+    before_services => []\n+    mode            => 0740\n+    names           => []\n"}, {"resource": "Systemd::Timer::Job[opensearch-hot-threads-log]", "parameters": "--- Systemd::Timer::Job[opensearch-hot-threads-log].orig\n+++ Systemd::Timer::Job[opensearch-hot-threads-log]\n\n+    send_mail                 => False\n+    user                      => opensearch\n+    require                   => ['Package[opensearch]', 'File[/usr/local/bin/opensearch_hot_threads_logger.py]']\n+    monitoring_enabled        => False\n+    logfile_name              => syslog.log\n+    logging_enabled           => False\n+    command                   => /usr/local/bin/opensearch_hot_threads_logger.py\n+    private_tmp               => False\n+    description               => Archive exception logs of hot opensearch threads\n+    syslog_force_stop         => True\n+    ignore_errors             => False\n+    send_mail_only_on_error   => True\n+    fixed_random_delay        => False\n+    logfile_perms             => all\n+    ensure                    => present\n+    logfile_basedir           => /var/log\n+    environment               => {}\n+    logfile_group             => root\n+    send_mail_to              => root@relforge1008.eqiad.wmnet\n+    success_exit_status       => []\n+    interval                  => {'start': 'OnCalendar', 'interval': '*-*-* *:00/5:00'}\n+    monitoring_contact_groups => admins\n+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+    syslog_match_startswith   => True\n"}, {"resource": "File[/etc/nginx]", "parameters": "--- File[/etc/nginx].orig\n+++ File[/etc/nginx]\n\n+    before  => ['Service[nginx]']\n+    owner   => root\n+    group   => root\n+    require => Package[nginx-light]\n+    ensure  => directory\n"}, {"resource": "File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chained.pem]", "parameters": "--- File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chained.pem].orig\n+++ File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chained.pem]\n\n+    owner   => root\n+    group   => root\n+    require => Exec[create chained cert /etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chain.pem]\n+    ensure  => file\n+    notify  => ['Exec[nginx-reload]', 'Exec[nginx-reload]']\n"}, {"resource": "Logrotate::Conf[nginx]", "parameters": "--- Logrotate::Conf[nginx].orig\n+++ Logrotate::Conf[nginx]\n\n+    source => puppet:///modules/profile/tlsproxy/logrotate\n+    tag    => nginx\n+    ensure => present\n"}, {"resource": "Logrotate::Conf[opensearch-disable-readahead-relforge-eqiad]", "parameters": "--- Logrotate::Conf[opensearch-disable-readahead-relforge-eqiad].orig\n+++ Logrotate::Conf[opensearch-disable-readahead-relforge-eqiad]\n\n+    ensure => present\n"}, {"resource": "File[/etc/update-motd.d/05-cirrus--relforge]", "content": "--- /etc/update-motd.d/05-cirrus--relforge.orig\n+++ /etc/update-motd.d/05-cirrus--relforge\n@@ -0,0 +1,2 @@\n+#!/bin/sh\n+printf \"%s\\n\" \"relforge1008 is a Elasticsearch relforge (cirrus::relforge)\"", "parameters": "--- File[/etc/update-motd.d/05-cirrus--relforge].orig\n+++ File[/etc/update-motd.d/05-cirrus--relforge]\n\n+    mode   => 0555\n+    owner  => root\n+    group  => root\n+    ensure => present\n"}, {"resource": "File[/lib/systemd/system/opensearch-relforge-eqiad-gc-log-cleanup.timer]", "content": "--- /lib/systemd/system/opensearch-relforge-eqiad-gc-log-cleanup.timer.orig\n+++ /lib/systemd/system/opensearch-relforge-eqiad-gc-log-cleanup.timer\n@@ -0,0 +1,12 @@\n+[Unit]\n+Description=Periodic execution of opensearch-relforge-eqiad-gc-log-cleanup.service\n+\n+[Timer]\n+Unit=opensearch-relforge-eqiad-gc-log-cleanup.service\n+# Accuracy sets the maximum time interval around the execution time we want to allow\n+AccuracySec=15sec\n+OnCalendar=*-*-* 02:12:00\n+RandomizedDelaySec=0\n+\n+[Install]\n+WantedBy=multi-user.target", "parameters": "--- File[/lib/systemd/system/opensearch-relforge-eqiad-gc-log-cleanup.timer].orig\n+++ File[/lib/systemd/system/opensearch-relforge-eqiad-gc-log-cleanup.timer]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for opensearch-relforge-eqiad-gc-log-cleanup.timer (opensearch-relforge-eqiad-gc-log-cleanup.timer)]\n"}, {"resource": "File[/var/lib/prometheus/node.d/check_opensearch_shards_9400.prom]", "parameters": "--- File[/var/lib/prometheus/node.d/check_opensearch_shards_9400.prom].orig\n+++ File[/var/lib/prometheus/node.d/check_opensearch_shards_9400.prom]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n"}, {"resource": "File[/lib/systemd/system/opensearch-disable-readahead-relforge-eqiad.timer]", "content": "--- /lib/systemd/system/opensearch-disable-readahead-relforge-eqiad.timer.orig\n+++ /lib/systemd/system/opensearch-disable-readahead-relforge-eqiad.timer\n@@ -0,0 +1,13 @@\n+[Unit]\n+Description=Periodic execution of opensearch-disable-readahead-relforge-eqiad.service\n+\n+[Timer]\n+Unit=opensearch-disable-readahead-relforge-eqiad.service\n+# Accuracy sets the maximum time interval around the execution time we want to allow\n+AccuracySec=15sec\n+OnUnitActiveSec=30min\n+OnBootSec=1min\n+RandomizedDelaySec=0\n+\n+[Install]\n+WantedBy=multi-user.target", "parameters": "--- File[/lib/systemd/system/opensearch-disable-readahead-relforge-eqiad.timer].orig\n+++ File[/lib/systemd/system/opensearch-disable-readahead-relforge-eqiad.timer]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for opensearch-disable-readahead-relforge-eqiad.timer (opensearch-disable-readahead-relforge-eqiad.timer)]\n"}, {"resource": "File[/etc/nginx/sites-enabled/relforge-eqiad-small-alpha]", "parameters": "--- File[/etc/nginx/sites-enabled/relforge-eqiad-small-alpha].orig\n+++ File[/etc/nginx/sites-enabled/relforge-eqiad-small-alpha]\n\n+    before => ['Service[nginx]']\n+    owner  => root\n+    target => /etc/nginx/sites-available/relforge-eqiad-small-alpha\n+    group  => root\n+    ensure => link\n"}, {"resource": "File[/etc/nginx/conf.d]", "parameters": "--- File[/etc/nginx/conf.d].orig\n+++ File[/etc/nginx/conf.d]\n\n+    before  => ['Service[nginx]']\n+    owner   => root\n+    group   => root\n+    recurse => True\n+    force   => True\n+    ensure  => directory\n+    purge   => True\n"}, {"resource": "Service[wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer]", "parameters": "--- Service[wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer].orig\n+++ Service[wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer]\n\n+    ensure   => running\n+    provider => systemd\n+    enable   => True\n"}, {"resource": "File[/etc/opensearch_hot_threads.d/relforge-eqiad.yml]", "content": "--- /etc/opensearch_hot_threads.d/relforge-eqiad.yml.orig\n+++ /etc/opensearch_hot_threads.d/relforge-eqiad.yml\n@@ -0,0 +1,3 @@\n+---\n+port: 9200\n+log_file: \"/var/log/opensearch/opensearch_hot_threads-relforge-eqiad.log\"", "parameters": "--- File[/etc/opensearch_hot_threads.d/relforge-eqiad.yml].orig\n+++ File[/etc/opensearch_hot_threads.d/relforge-eqiad.yml]\n\n+    owner  => root\n+    mode   => 0755\n+    group  => root\n+    ensure => file\n"}, {"resource": "File[/lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service]", "content": "--- /lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service.orig\n+++ /lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service\n@@ -0,0 +1,8 @@\n+[Unit]\n+Description=Auto restart job: prometheus-wmf-elasticsearch-exporter-9400\n+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+\n+[Service]\n+Type=oneshot\n+User=root\n+ExecStart=/usr/local/sbin/wmf-auto-restart -s prometheus-wmf-elasticsearch-exporter-9400", "parameters": "--- File[/lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service].orig\n+++ File[/lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service (wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service)]\n"}, {"resource": "File[/etc/nginx/sites-enabled]", "parameters": "--- File[/etc/nginx/sites-enabled].orig\n+++ File[/etc/nginx/sites-enabled]\n\n+    before  => ['Service[nginx]']\n+    owner   => root\n+    group   => root\n+    recurse => True\n+    force   => True\n+    ensure  => directory\n+    purge   => True\n"}, {"resource": "File[/etc/systemd/system/nginx.service.d]", "parameters": "--- File[/etc/systemd/system/nginx.service.d].orig\n+++ File[/etc/systemd/system/nginx.service.d]\n\n+    mode   => 0555\n+    owner  => root\n+    group  => root\n+    ensure => directory\n"}, {"resource": "Profile::Prometheus::Elasticsearch_exporter[relforge1008:9200]", "parameters": "--- Profile::Prometheus::Elasticsearch_exporter[relforge1008:9200].orig\n+++ Profile::Prometheus::Elasticsearch_exporter[relforge1008:9200]\n\n+    extra_config       => \n+    prometheus_port    => 9108\n+    elasticsearch_port => 9200\n"}, {"resource": "File_line[auto_restart_file_presence_prometheus-wmf-elasticsearch-exporter-9400]", "parameters": "--- File_line[auto_restart_file_presence_prometheus-wmf-elasticsearch-exporter-9400].orig\n+++ File_line[auto_restart_file_presence_prometheus-wmf-elasticsearch-exporter-9400]\n\n+    path    => /etc/debdeploy-client/autorestarts.conf\n+    require => File[/etc/debdeploy-client/autorestarts.conf]\n+    line    => prometheus-wmf-elasticsearch-exporter-9400\n+    ensure  => present\n"}, {"resource": "Udev::Rule[opensearch-readahead]", "parameters": "--- Udev::Rule[opensearch-readahead].orig\n+++ Udev::Rule[opensearch-readahead]\n\n+    priority => 40\n+    ensure   => present\n"}, {"resource": "Logrotate::Conf[opensearch-relforge-eqiad-gc-log-cleanup]", "parameters": "--- Logrotate::Conf[opensearch-relforge-eqiad-gc-log-cleanup].orig\n+++ Logrotate::Conf[opensearch-relforge-eqiad-gc-log-cleanup]\n\n+    ensure => present\n"}, {"resource": "Nrpe::Monitor_service[disk_space]", "parameters": "--- Nrpe::Monitor_service[disk_space].orig\n+++ Nrpe::Monitor_service[disk_space]\n\n@@\n-    nrpe_command => /usr/lib/nagios/plugins/check_disk -w 6% -c 3% -W 6% -K 3% -l -e -A -i \"/srv/sd[a-b][1-3]\" -i \"/srv/nvme[0-9]n[0-9]p[0-9]\" --exclude-type=fuse --exclude-type=fuse.fuse_dfs --exclude-type=tracefs\n+    nrpe_command => /usr/lib/nagios/plugins/check_disk -w 15% -c 10% -W 6% -K 3% -l -e -A -i \"/srv/sd[a-b][1-3]\" --exclude-type=tracefs\n"}, {"resource": "Logrotate::Rule[opensearch]", "parameters": "--- Logrotate::Rule[opensearch].orig\n+++ Logrotate::Rule[opensearch]\n\n+    post_rotate    => []\n+    frequency      => daily\n+    ensure         => present\n+    copy_truncate  => True\n+    compress       => True\n+    date_yesterday => False\n+    no_create      => False\n+    date_ext       => False\n+    missing_ok     => True\n+    file_glob      => /var/log/opensearch/*.log\n+    not_if_empty   => True\n+    rotate         => 7\n"}, {"resource": "Class[Profile::Opensearch::Server]", "parameters": "--- Class[Profile::Opensearch::Server].orig\n+++ Class[Profile::Opensearch::Server]\n\n+    common_settings       => {'awareness_attributes': 'row', 'recover_after_nodes': 1, 'recover_after_time': '1m', 'search_shard_count_limit': 1000, 'reindex_remote_whitelist': 'search.svc.eqiad.wmnet:9243,search.svc.codfw.wmnet:9243', 'bulk_thread_pool_executors': 32, 'bulk_thread_pool_capacity': 1000, 'ltr_cache_size': '100mb', 'auto_create_index': True, 'plugins_mandatory': ['analysis-hebrew', 'analysis-icu', 'analysis-smartcn', 'analysis-stempel', 'analysis-ukrainian', 'cirrus-highlighter', 'opensearch-analysis-stconvert', 'opensearch-extra', 'opensearch-extra-analysis-esperanto', 'opensearch-extra-analysis-serbian', 'opensearch-extra-analysis-slovak', 'ltr'], 'filter_cache_size': '20%', 'script_max_compilations_per_minute': 10000, 'send_logs_to_logstash': True, 'disable_security_plugin': True}\n+    enable_curator        => False\n+    exporter_extra_config => \n+    instances             => {'relforge-eqiad': {'cluster_name': 'relforge-eqiad', 'short_cluster_name': 'chi', 'heap_memory': '30G', 'http_port': 9200, 'tls_port': 9243, 'transport_tcp_port': 9300, 'certificate_name': 'relforge.svc.eqiad.wmnet'}, 'relforge-eqiad-small-alpha': {'cluster_name': 'relforge-eqiad-small-alpha', 'short_cluster_name': 'omega', 'heap_memory': '4G', 'http_port': 9400, 'tls_port': 9443, 'transport_tcp_port': 9500, 'certificate_name': 'relforge.svc.eqiad.wmnet'}}\n+    require               => ['Class[Profile::Java]', 'Class[Profile::Netbox::Host]']\n+    native_lib_path       => /usr/share/opensearch/plugins/opensearch-knn/lib\n+    s3_username           => search:platform\n+    base_data_dir         => /srv/opensearch\n+    logstash_logback_port => 11514\n+    version               => 1.3.20\n+    logstash_host         => localhost\n+    java_home             => /usr/lib/jvm/java-11-openjdk-amd64\n+    dc_settings           => {'unicast_hosts': ['relforge1008.eqiad.wmnet', 'relforge1009.eqiad.wmnet', 'relforge1010.eqiad.wmnet'], 'cluster_hosts': ['relforge1008.eqiad.wmnet', 'relforge1009.eqiad.wmnet', 'relforge1010.eqiad.wmnet'], 'expected_nodes': 2}\n"}, {"resource": "Systemd::Syslog[wmf_auto_restart_prometheus-elasticsearch-exporter-9400]", "parameters": "--- Systemd::Syslog[wmf_auto_restart_prometheus-elasticsearch-exporter-9400].orig\n+++ Systemd::Syslog[wmf_auto_restart_prometheus-elasticsearch-exporter-9400]\n\n+    readable_by            => all\n+    force_stop             => True\n+    ensure                 => present\n+    programname_comparison => startswith\n+    log_filename           => syslog.log\n+    owner                  => root\n+    group                  => root\n+    base_dir               => /var/log\n"}, {"resource": "File[/etc/opensearch/relforge-eqiad-small-alpha/log4j2.properties]", "content": "--- /etc/opensearch/relforge-eqiad-small-alpha/log4j2.properties.orig\n+++ /etc/opensearch/relforge-eqiad-small-alpha/log4j2.properties\n@@ -0,0 +1,201 @@\n+status = error\n+\n+# log action execution errors for easier debugging\n+logger.action.name = org.opensearch.action\n+logger.action.level = debug\n+\n+appender.console.type = Console\n+appender.console.name = console\n+appender.console.layout.type = PatternLayout\n+appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n\n+\n+######## Server JSON ############################\n+appender.rolling.type = RollingFile\n+appender.rolling.name = rolling\n+appender.rolling.fileName = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs.cluster_name}_server.json\n+appender.rolling.layout.type = OpenSearchJsonLayout\n+appender.rolling.layout.type_name = server\n+\n+appender.rolling.filePattern = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs.cluster_name}-%d{yyyy-MM-dd}-%i.json.gz\n+appender.rolling.policies.type = Policies\n+appender.rolling.policies.time.type = TimeBasedTriggeringPolicy\n+appender.rolling.policies.time.interval = 1\n+appender.rolling.policies.time.modulate = true\n+appender.rolling.policies.size.type = SizeBasedTriggeringPolicy\n+appender.rolling.policies.size.size = 128MB\n+appender.rolling.strategy.type = DefaultRolloverStrategy\n+appender.rolling.strategy.fileIndex = nomax\n+appender.rolling.strategy.action.type = Delete\n+appender.rolling.strategy.action.basepath = ${sys:opensearch.logs.base_path}\n+appender.rolling.strategy.action.condition.type = IfFileName\n+appender.rolling.strategy.action.condition.glob = ${sys:opensearch.logs.cluster_name}-*\n+appender.rolling.strategy.action.condition.nested_condition.type = IfAccumulatedFileSize\n+appender.rolling.strategy.action.condition.nested_condition.exceeds = 2GB\n+################################################\n+######## Server -  old style pattern ###########\n+appender.rolling_old.type = RollingFile\n+appender.rolling_old.name = rolling_old\n+appender.rolling_old.fileName = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs.cluster_name}.log\n+appender.rolling_old.layout.type = PatternLayout\n+appender.rolling_old.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n\n+\n+appender.rolling_old.filePattern = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs.cluster_name}-%d{yyyy-MM-dd}-%i.log.gz\n+appender.rolling_old.policies.type = Policies\n+appender.rolling_old.policies.time.type = TimeBasedTriggeringPolicy\n+appender.rolling_old.policies.time.interval = 1\n+appender.rolling_old.policies.time.modulate = true\n+appender.rolling_old.policies.size.type = SizeBasedTriggeringPolicy\n+appender.rolling_old.policies.size.size = 128MB\n+appender.rolling_old.strategy.type = DefaultRolloverStrategy\n+appender.rolling_old.strategy.fileIndex = nomax\n+appender.rolling_old.strategy.action.type = Delete\n+appender.rolling_old.strategy.action.basepath = ${sys:opensearch.logs.base_path}\n+appender.rolling_old.strategy.action.condition.type = IfFileName\n+appender.rolling_old.strategy.action.condition.glob = ${sys:opensearch.logs.cluster_name}-*\n+appender.rolling_old.strategy.action.condition.nested_condition.type = IfAccumulatedFileSize\n+appender.rolling_old.strategy.action.condition.nested_condition.exceeds = 2GB\n+################################################\n+\n+rootLogger.level = info\n+rootLogger.appenderRef.console.ref = console\n+rootLogger.appenderRef.rolling.ref = rolling\n+rootLogger.appenderRef.rolling_old.ref = rolling_old\n+\n+######## Deprecation JSON #######################\n+appender.deprecation_rolling.type = RollingFile\n+appender.deprecation_rolling.name = deprecation_rolling\n+appender.deprecation_rolling.fileName = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs.cluster_name}_deprecation.json\n+appender.deprecation_rolling.layout.type = OpenSearchJsonLayout\n+appender.deprecation_rolling.layout.type_name = deprecation\n+appender.deprecation_rolling.layout.opensearchmessagefields=x-opaque-id\n+\n+appender.deprecation_rolling.filePattern = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs.cluster_name}_deprecation-%i.json.gz\n+appender.deprecation_rolling.policies.type = Policies\n+appender.deprecation_rolling.policies.size.type = SizeBasedTriggeringPolicy\n+appender.deprecation_rolling.policies.size.size = 1GB\n+appender.deprecation_rolling.strategy.type = DefaultRolloverStrategy\n+appender.deprecation_rolling.strategy.max = 4\n+#################################################\n+######## Deprecation -  old style pattern #######\n+appender.deprecation_rolling_old.type = RollingFile\n+appender.deprecation_rolling_old.name = deprecation_rolling_old\n+appender.deprecation_rolling_old.fileName = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs.cluster_name}_deprecation.log\n+appender.deprecation_rolling_old.layout.type = PatternLayout\n+appender.deprecation_rolling_old.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n\n+\n+appender.deprecation_rolling_old.filePattern = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs.cluster_name}\\\n+  _deprecation-%i.log.gz\n+appender.deprecation_rolling_old.policies.type = Policies\n+appender.deprecation_rolling_old.policies.size.type = SizeBasedTriggeringPolicy\n+appender.deprecation_rolling_old.policies.size.size = 1GB\n+appender.deprecation_rolling_old.strategy.type = DefaultRolloverStrategy\n+appender.deprecation_rolling_old.strategy.max = 4\n+#################################################\n+logger.deprecation.name = org.opensearch.deprecation\n+logger.deprecation.level = warn\n+logger.deprecation.appenderRef.deprecation_rolling.ref = deprecation_rolling\n+logger.deprecation.appenderRef.deprecation_rolling_old.ref = deprecation_rolling_old\n+logger.deprecation.additivity = false\n+\n+######## Search slowlog JSON ####################\n+appender.index_search_slowlog_rolling.type = RollingFile\n+appender.index_search_slowlog_rolling.name = index_search_slowlog_rolling\n+appender.index_search_slowlog_rolling.fileName = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs\\\n+  .cluster_name}_index_search_slowlog.json\n+appender.index_search_slowlog_rolling.layout.type = OpenSearchJsonLayout\n+appender.index_search_slowlog_rolling.layout.type_name = index_search_slowlog\n+appender.index_search_slowlog_rolling.layout.opensearchmessagefields=message,took,took_millis,total_hits,types,stats,search_type,total_shards,source,id\n+\n+appender.index_search_slowlog_rolling.filePattern = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs\\\n+  .cluster_name}_index_search_slowlog-%i.json.gz\n+appender.index_search_slowlog_rolling.policies.type = Policies\n+appender.index_search_slowlog_rolling.policies.size.type = SizeBasedTriggeringPolicy\n+appender.index_search_slowlog_rolling.policies.size.size = 1GB\n+appender.index_search_slowlog_rolling.strategy.type = DefaultRolloverStrategy\n+appender.index_search_slowlog_rolling.strategy.max = 4\n+#################################################\n+######## Search slowlog -  old style pattern ####\n+appender.index_search_slowlog_rolling_old.type = RollingFile\n+appender.index_search_slowlog_rolling_old.name = index_search_slowlog_rolling_old\n+appender.index_search_slowlog_rolling_old.fileName = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs.cluster_name}\\\n+  _index_search_slowlog.log\n+appender.index_search_slowlog_rolling_old.layout.type = PatternLayout\n+appender.index_search_slowlog_rolling_old.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n\n+\n+appender.index_search_slowlog_rolling_old.filePattern = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs.cluster_name}\\\n+  _index_search_slowlog-%i.log.gz\n+appender.index_search_slowlog_rolling_old.policies.type = Policies\n+appender.index_search_slowlog_rolling_old.policies.size.type = SizeBasedTriggeringPolicy\n+appender.index_search_slowlog_rolling_old.policies.size.size = 1GB\n+appender.index_search_slowlog_rolling_old.strategy.type = DefaultRolloverStrategy\n+appender.index_search_slowlog_rolling_old.strategy.max = 4\n+#################################################\n+logger.index_search_slowlog_rolling.name = index.search.slowlog\n+logger.index_search_slowlog_rolling.level = trace\n+logger.index_search_slowlog_rolling.appenderRef.index_search_slowlog_rolling.ref = index_search_slowlog_rolling\n+logger.index_search_slowlog_rolling.appenderRef.index_search_slowlog_rolling_old.ref = index_search_slowlog_rolling_old\n+logger.index_search_slowlog_rolling.additivity = false\n+\n+######## Indexing slowlog JSON ##################\n+appender.index_indexing_slowlog_rolling.type = RollingFile\n+appender.index_indexing_slowlog_rolling.name = index_indexing_slowlog_rolling\n+appender.index_indexing_slowlog_rolling.fileName = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs.cluster_name}\\\n+  _index_indexing_slowlog.json\n+appender.index_indexing_slowlog_rolling.layout.type = OpenSearchJsonLayout\n+appender.index_indexing_slowlog_rolling.layout.type_name = index_indexing_slowlog\n+appender.index_indexing_slowlog_rolling.layout.opensearchmessagefields=message,took,took_millis,doc_type,id,routing,source\n+\n+appender.index_indexing_slowlog_rolling.filePattern = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs.cluster_name}\\\n+  _index_indexing_slowlog-%i.json.gz\n+appender.index_indexing_slowlog_rolling.policies.type = Policies\n+appender.index_indexing_slowlog_rolling.policies.size.type = SizeBasedTriggeringPolicy\n+appender.index_indexing_slowlog_rolling.policies.size.size = 1GB\n+appender.index_indexing_slowlog_rolling.strategy.type = DefaultRolloverStrategy\n+appender.index_indexing_slowlog_rolling.strategy.max = 4\n+#################################################\n+######## Indexing slowlog -  old style pattern ##\n+appender.index_indexing_slowlog_rolling_old.type = RollingFile\n+appender.index_indexing_slowlog_rolling_old.name = index_indexing_slowlog_rolling_old\n+appender.index_indexing_slowlog_rolling_old.fileName = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs.cluster_name}\\\n+  _index_indexing_slowlog.log\n+appender.index_indexing_slowlog_rolling_old.layout.type = PatternLayout\n+appender.index_indexing_slowlog_rolling_old.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n\n+\n+appender.index_indexing_slowlog_rolling_old.filePattern = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs.cluster_name}\\\n+  _index_indexing_slowlog-%i.log.gz\n+appender.index_indexing_slowlog_rolling_old.policies.type = Policies\n+appender.index_indexing_slowlog_rolling_old.policies.size.type = SizeBasedTriggeringPolicy\n+appender.index_indexing_slowlog_rolling_old.policies.size.size = 1GB\n+appender.index_indexing_slowlog_rolling_old.strategy.type = DefaultRolloverStrategy\n+appender.index_indexing_slowlog_rolling_old.strategy.max = 4\n+#################################################\n+\n+logger.index_indexing_slowlog.name = index.indexing.slowlog.index\n+logger.index_indexing_slowlog.level = trace\n+logger.index_indexing_slowlog.appenderRef.index_indexing_slowlog_rolling.ref = index_indexing_slowlog_rolling\n+logger.index_indexing_slowlog.appenderRef.index_indexing_slowlog_rolling_old.ref = index_indexing_slowlog_rolling_old\n+logger.index_indexing_slowlog.additivity = false\n+\n+\n+### Custom settings\n+monitorInterval=600\n+\n+# Add references to Logstash appender for interesting loggers\n+\n+rootLogger.appenderRef.ship_to_logstash.ref = ship_to_logstash\n+logger.index_indexing_slowlog.appenderRef.ship_to_logstash.ref = ship_to_logstash\n+logger.index_search_slowlog_rolling.appenderRef.ship_to_logstash.ref = ship_to_logstash\n+logger.index_search_slowlog_rolling.appenderRef.ship_to_logstash.ref = ship_to_logstash\n+\n+# Define Logstash appender\n+appender.ship_to_logstash.name=ship_to_logstash\n+appender.ship_to_logstash.type=syslog\n+appender.ship_to_logstash.protocol=udp\n+appender.ship_to_logstash.facility=LOCAL0\n+appender.ship_to_logstash.layout.type=OpenSearchJsonLayout\n+appender.ship_to_logstash.layout.compact=true\n+appender.ship_to_logstash.layout.complete=true\n+appender.ship_to_logstash.host=localhost\n+appender.ship_to_logstash.port=11514\n+appender.ship_to_logstash.layout.type_name=opensearch\n+", "parameters": "--- File[/etc/opensearch/relforge-eqiad-small-alpha/log4j2.properties].orig\n+++ File[/etc/opensearch/relforge-eqiad-small-alpha/log4j2.properties]\n\n+    owner  => root\n+    mode   => 0444\n+    group  => root\n+    ensure => file\n"}, {"resource": "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9400.timer (nrpe2nodexp-opensearch_shard_size_check_9400.timer)]", "parameters": "--- Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9400.timer (nrpe2nodexp-opensearch_shard_size_check_9400.timer)].orig\n+++ Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9400.timer (nrpe2nodexp-opensearch_shard_size_check_9400.timer)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Systemd::Unit[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service]", "parameters": "--- Systemd::Unit[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service].orig\n+++ Systemd::Unit[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => present\n+    override_filename => puppet-override.conf\n+    unit              => opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service\n"}, {"resource": "Profile::Prometheus::Wmf_elasticsearch_exporter[relforge1008:9400]", "parameters": "--- Profile::Prometheus::Wmf_elasticsearch_exporter[relforge1008:9400].orig\n+++ Profile::Prometheus::Wmf_elasticsearch_exporter[relforge1008:9400]\n\n+    prometheus_port    => 9121\n+    indices_to_monitor => []\n+    elasticsearch_port => 9400\n"}, {"resource": "Service[nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer]", "parameters": "--- Service[nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer].orig\n+++ Service[nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer]\n\n+    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer (nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer)]']\n+    provider => systemd\n+    enable   => False\n+    ensure   => stopped\n"}, {"resource": "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer (wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer)]", "parameters": "--- Exec[systemd daemon-reload for wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer (wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer)].orig\n+++ Exec[systemd daemon-reload for wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer (wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer)]\n\n+    before      => ['Service[wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer]']\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Rsyslog::Conf[nrpe2nodexp-check_push_cross_cluster_settings_9200_status]", "parameters": "--- Rsyslog::Conf[nrpe2nodexp-check_push_cross_cluster_settings_9200_status].orig\n+++ Rsyslog::Conf[nrpe2nodexp-check_push_cross_cluster_settings_9200_status]\n\n+    mode     => 0444\n+    priority => 25\n+    ensure   => absent\n"}, {"resource": "Opensearch::Instance[relforge-eqiad-small-alpha]", "parameters": "--- Opensearch::Instance[relforge-eqiad-small-alpha].orig\n+++ Opensearch::Instance[relforge-eqiad-small-alpha]\n\n+    configure_curator                  => False\n+    compatibility_mode                 => False\n+    short_cluster_name                 => omega\n+    base_data_dir                      => /srv/opensearch\n+    use_cms_gc                         => False\n+    recovery_max_bytes_per_sec         => 40mb\n+    certificate_name                   => relforge.svc.eqiad.wmnet\n+    script_max_compilations_per_minute => 10000\n+    publish_host                       => 10.64.32.100\n+    node_name                          => relforge1008-relforge-eqiad-small-alpha\n+    plugins_mandatory                  => ['analysis-hebrew', 'analysis-icu', 'analysis-smartcn', 'analysis-stempel', 'analysis-ukrainian', 'cirrus-highlighter', 'opensearch-analysis-stconvert', 'opensearch-extra', 'opensearch-extra-analysis-esperanto', 'opensearch-extra-analysis-serbian', 'opensearch-extra-analysis-slovak', 'ltr']\n+    security_plugin_certificates       => {}\n+    reindex_remote_whitelist           => search.svc.eqiad.wmnet:9243,search.svc.codfw.wmnet:9243\n+    auto_create_index                  => True\n+    row                                => eqiad-row-c\n+    watermarks                         => {}\n+    recover_after_nodes                => 1\n+    bind_networks                      => ['_local_', '_site_']\n+    unicast_hosts                      => ['relforge1008.eqiad.wmnet', 'relforge1009.eqiad.wmnet', 'relforge1010.eqiad.wmnet']\n+    send_logs_to_logstash              => True\n+    gc_log                             => True\n+    require                            => Package[opensearch]\n+    bulk_thread_pool_executors         => 32\n+    ltr_cache_size                     => 100mb\n+    cluster_hosts                      => ['relforge1008.eqiad.wmnet', 'relforge1009.eqiad.wmnet', 'relforge1010.eqiad.wmnet']\n+    bulk_thread_pool_capacity          => 1000\n+    recover_after_time                 => 1m\n+    holds_data                         => True\n+    logstash_logback_port              => 11514\n+    filter_cache_size                  => 20%\n+    logstash_host                      => localhost\n+    version                            => 1.3.20\n+    search_shard_count_limit           => 1000\n+    disable_security_plugin            => True\n+    expected_nodes                     => 2\n+    http_port                          => 9400\n+    load_fixed_bitset_filters_eagerly  => True\n+    tls_port                           => 9443\n+    transport_tcp_port                 => 9500\n+    heap_memory                        => 4G\n+    cluster_name                       => relforge-eqiad-small-alpha\n+    cms_gc_init_occupancy_fraction     => 75\n+    rack                               => C4\n+    curator_uses_unicast_hosts         => True\n+    awareness_attributes               => row\n"}, {"resource": "Systemd::Timer[wmf_auto_restart_prometheus-elasticsearch-exporter-9200]", "parameters": "--- Systemd::Timer[wmf_auto_restart_prometheus-elasticsearch-exporter-9200].orig\n+++ Systemd::Timer[wmf_auto_restart_prometheus-elasticsearch-exporter-9200]\n\n+    unit_name          => wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service\n+    fixed_random_delay => False\n+    splay              => 0\n+    ensure             => present\n+    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 7:36:00'}]\n+    accuracy           => 15sec\n"}, {"resource": "Profile::Auto_restarts::Service[prometheus-elasticsearch-exporter-9400]", "parameters": "--- Profile::Auto_restarts::Service[prometheus-elasticsearch-exporter-9400].orig\n+++ Profile::Auto_restarts::Service[prometheus-elasticsearch-exporter-9400]\n\n+    ensure => present\n"}, {"resource": "Nrpe::Check[check_opensearch_shards_9400]", "parameters": "--- Nrpe::Check[check_opensearch_shards_9400].orig\n+++ Nrpe::Check[check_opensearch_shards_9400]\n\n+    before  => Monitoring::Service[opensearch_shards_9400]\n+    command => /usr/lib/nagios/plugins/check_elasticsearch.py --ignore-status --url http://localhost:9400 --shards-inactive '>=0.15' --timeout 4\n+    ensure  => present\n"}, {"resource": "Opensearch::Log::Hot_threads_cluster[relforge-eqiad]", "parameters": "--- Opensearch::Log::Hot_threads_cluster[relforge-eqiad].orig\n+++ Opensearch::Log::Hot_threads_cluster[relforge-eqiad]\n\n+    http_port    => 9200\n+    cluster_name => relforge-eqiad\n"}, {"resource": "Exec[tlsproxy localssl default_server on ports [9243]]", "parameters": "--- Exec[tlsproxy localssl default_server on ports [9243]].orig\n+++ Exec[tlsproxy localssl default_server on ports [9243]]\n\n+    command     => /bin/true\n+    onlyif      => /bin/false\n+    refreshonly => True\n"}, {"resource": "File[/lib/systemd/system/opensearch-disable-readahead-relforge-eqiad.service]", "content": "--- /lib/systemd/system/opensearch-disable-readahead-relforge-eqiad.service.orig\n+++ /lib/systemd/system/opensearch-disable-readahead-relforge-eqiad.service\n@@ -0,0 +1,8 @@\n+[Unit]\n+Description=Disables readahead on all open files every 30 minutes to alleviate Cirrussearch / opensearch IO load spikes\n+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+\n+[Service]\n+Type=oneshot\n+User=root\n+ExecStart=/usr/local/bin/opensearch-disable-readahead.sh relforge-eqiad /srv/opensearch", "parameters": "--- File[/lib/systemd/system/opensearch-disable-readahead-relforge-eqiad.service].orig\n+++ File[/lib/systemd/system/opensearch-disable-readahead-relforge-eqiad.service]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for opensearch-disable-readahead-relforge-eqiad.service (opensearch-disable-readahead-relforge-eqiad.service)]\n"}, {"resource": "File[/lib/systemd/system/opensearch_1@.service]", "content": "--- /lib/systemd/system/opensearch_1@.service.orig\n+++ /lib/systemd/system/opensearch_1@.service\n@@ -0,0 +1,73 @@\n+[Unit]\n+Description=OpenSearch (cluster %i)\n+PartOf=opensearch.service\n+Documentation=https://opensearch.org/docs\n+Wants=network-online.target\n+After=network-online.target\n+\n+[Service]\n+Type=notify\n+RuntimeDirectory=opensearch\n+PrivateTmp=true\n+Environment=OPENSEARCH_HOME=/usr/share/opensearch\n+Environment=OPENSEARCH_PATH_CONF=/etc/opensearch/%i\n+Environment=OPENSEARCH_JVM_OPTIONS=/etc/opensearch/%i/jvm.options\n+Environment=PID_DIR=/run/opensearch-%i\n+Environment=OPENSEARCH_SD_NOTIFY=true\n+\n+Environment=LD_LIBRARY_PATH=/usr/share/opensearch/plugins/opensearch-knn/lib\n+Environment=JAVA_HOME=/usr/lib/jvm/java-11-openjdk-amd64\n+\n+WorkingDirectory=/usr/share/opensearch\n+\n+User=opensearch\n+Group=opensearch\n+\n+# Force creation of /run/opensearch (see T276198)\n+ExecStartPre=/bin/systemd-tmpfiles --create /etc/tmpfiles.d/opensearch-%i.conf\n+ExecStart=/usr/share/opensearch/bin/opensearch \\\n+        -p ${PID_DIR}/%i.pid \\\n+        --quiet \\\n+        -Epath.logs=/var/log/opensearch \\\n+        -Epath.data=/srv/opensearch/%i\n+\n+# StandardOutput is configured to redirect to journalctl since\n+# some error messages may be logged in standard output before\n+# opensearch logging system is initialized. OpenSearch\n+# stores its logs in /var/log/opensearch and does not use\n+# journalctl by default. If you also want to enable journalctl\n+# logging, you can simply remove the \"quiet\" option from ExecStart.\n+StandardOutput=journal\n+StandardError=inherit\n+\n+# Specifies the maximum file descriptor number that can be opened by this process\n+LimitNOFILE=65535\n+\n+# Specifies the maximum number of processes\n+LimitNPROC=4096\n+\n+# Specifies the maximum size of virtual memory\n+LimitAS=infinity\n+\n+# Specifies the maximum file size\n+LimitFSIZE=infinity\n+\n+# Disable timeout logic and wait until process is stopped\n+TimeoutStopSec=0\n+\n+# SIGTERM signal is used to stop the Java process\n+KillSignal=SIGTERM\n+\n+# Send the signal only to the JVM rather than its control group\n+KillMode=process\n+\n+# Java process is never killed\n+SendSIGKILL=no\n+\n+# When a JVM receives a SIGTERM signal it exits with code 143\n+SuccessExitStatus=143\n+\n+[Install]\n+WantedBy=multi-user.target\n+\n+# Built for packages-7.4.1 (packages)", "parameters": "--- File[/lib/systemd/system/opensearch_1@.service].orig\n+++ File[/lib/systemd/system/opensearch_1@.service]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for opensearch_1@.service (opensearch_1@.service)]\n"}, {"resource": "Exec[systemd daemon-reload for opensearch-disable-readahead.timer (opensearch-disable-readahead.timer)]", "parameters": "--- Exec[systemd daemon-reload for opensearch-disable-readahead.timer (opensearch-disable-readahead.timer)].orig\n+++ Exec[systemd daemon-reload for opensearch-disable-readahead.timer (opensearch-disable-readahead.timer)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "File[/etc/logrotate.d/wmf_auto_restart_prometheus-elasticsearch-exporter-9200]", "content": "--- /etc/logrotate.d/wmf_auto_restart_prometheus-elasticsearch-exporter-9200.orig\n+++ /etc/logrotate.d/wmf_auto_restart_prometheus-elasticsearch-exporter-9200\n@@ -0,0 +1,12 @@\n+# logrotate(8) config for wmf_auto_restart_prometheus-elasticsearch-exporter-9200\n+\n+/var/log/wmf_auto_restart_prometheus-elasticsearch-exporter-9200/*.log {\n+    daily\n+    copytruncate\n+    missingok\n+    compress\n+    delaycompress\n+    notifempty\n+    rotate 15\n+    size 256M\n+}", "parameters": "--- File[/etc/logrotate.d/wmf_auto_restart_prometheus-elasticsearch-exporter-9200].orig\n+++ File[/etc/logrotate.d/wmf_auto_restart_prometheus-elasticsearch-exporter-9200]\n\n+    owner  => root\n+    mode   => 0444\n+    group  => root\n+    ensure => present\n"}, {"resource": "Service[prometheus-wmf-elasticsearch-exporter-9400]", "parameters": "--- Service[prometheus-wmf-elasticsearch-exporter-9400].orig\n+++ Service[prometheus-wmf-elasticsearch-exporter-9400]\n\n+    ensure => running\n+    enable => True\n"}, {"resource": "File[/etc/sudoers.d/nrpe-check_opensearch_shards_9400]", "parameters": "--- File[/etc/sudoers.d/nrpe-check_opensearch_shards_9400].orig\n+++ File[/etc/sudoers.d/nrpe-check_opensearch_shards_9400]\n\n+    owner   => root\n+    require => Package[nagios-nrpe-server]\n+    group   => root\n+    ensure  => absent\n"}, {"resource": "Systemd::Unit[push_cross_cluster_settings_9400.timer]", "parameters": "--- Systemd::Unit[push_cross_cluster_settings_9400.timer].orig\n+++ Systemd::Unit[push_cross_cluster_settings_9400.timer]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => present\n+    override_filename => puppet-override.conf\n+    unit              => push_cross_cluster_settings_9400.timer\n"}, {"resource": "Logstash::Output::Udp[gelf_relay]", "parameters": "--- Logstash::Output::Udp[gelf_relay].orig\n+++ Logstash::Output::Udp[gelf_relay]\n\n+    priority  => 90\n+    port      => 11514\n+    ensure    => present\n+    codec     => json\n+    host      => localhost\n+    plugin_id => output/udp/gelf_relay\n"}, {"resource": "File[/lib/systemd/system/opensearch-disable-readahead.service]", "content": "--- /lib/systemd/system/opensearch-disable-readahead.service.orig\n+++ /lib/systemd/system/opensearch-disable-readahead.service\n@@ -0,0 +1,8 @@\n+[Unit]\n+Description=Disables readahead on all open files every 30 minutes to alleviate Cirrussearch / opensearch IO load spikes\n+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+\n+[Service]\n+Type=oneshot\n+User=root\n+ExecStart=/usr/local/bin/opensearch-disable-readahead.sh", "parameters": "--- File[/lib/systemd/system/opensearch-disable-readahead.service].orig\n+++ File[/lib/systemd/system/opensearch-disable-readahead.service]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for opensearch-disable-readahead.service (opensearch-disable-readahead.service)]\n"}, {"resource": "File[/etc/systemd/system/nginx.service.d/security.conf]", "parameters": "--- File[/etc/systemd/system/nginx.service.d/security.conf].orig\n+++ File[/etc/systemd/system/nginx.service.d/security.conf]\n\n+    before  => Class[Nginx]\n+    owner   => root\n+    require => File[/etc/systemd/system/nginx.service.d]\n+    source  => puppet:///modules/profile/tlsproxy/nginx-security.conf\n+    group   => root\n+    ensure  => present\n+    mode    => 0444\n"}, {"resource": "File[/var/log/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]", "parameters": "--- File[/var/log/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup].orig\n+++ File[/var/log/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]\n\n+    owner  => root\n+    group  => root\n+    force  => True\n+    ensure => directory\n+    mode   => 0755\n+    backup => False\n"}, {"resource": "File[/etc/systemd/system/nginx.service.d/numa.conf]", "content": "--- /etc/systemd/system/nginx.service.d/numa.conf.orig\n+++ /etc/systemd/system/nginx.service.d/numa.conf\n@@ -0,0 +1,3 @@\n+[Service]\n+ExecStart=\n+ExecStart=/usr/bin/numactl -a -N 0,1 /usr/sbin/nginx -g 'daemon on; master_process on;'", "parameters": "--- File[/etc/systemd/system/nginx.service.d/numa.conf].orig\n+++ File[/etc/systemd/system/nginx.service.d/numa.conf]\n\n+    before  => Class[Nginx]\n+    owner   => root\n+    require => File[/etc/systemd/system/nginx.service.d]\n+    group   => root\n+    ensure  => present\n+    mode    => 0444\n"}, {"resource": "Mount[/var/lib/nginx]", "parameters": "--- Mount[/var/lib/nginx].orig\n+++ Mount[/var/lib/nginx]\n\n+    before  => Service[nginx]\n+    options => defaults,noatime,uid=0,gid=0,mode=755,size=1g\n+    pass    => 0\n+    device  => tmpfs\n+    fstype  => tmpfs\n+    ensure  => mounted\n+    require => File[/var/lib/nginx]\n+    dump    => 0\n"}, {"resource": "File[/var/lib/prometheus/node.d/check_opensearch_shard_size_check_9200.prom]", "parameters": "--- File[/var/lib/prometheus/node.d/check_opensearch_shard_size_check_9200.prom].orig\n+++ File[/var/lib/prometheus/node.d/check_opensearch_shard_size_check_9200.prom]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n"}, {"resource": "File[/usr/local/bin/cleanup-dlq]", "parameters": "--- File[/usr/local/bin/cleanup-dlq].orig\n+++ File[/usr/local/bin/cleanup-dlq]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n"}, {"resource": "File[/usr/local/bin/prometheus-wmf-elasticsearch-exporter]", "parameters": "--- File[/usr/local/bin/prometheus-wmf-elasticsearch-exporter].orig\n+++ File[/usr/local/bin/prometheus-wmf-elasticsearch-exporter]\n\n+    owner  => root\n+    source => puppet:///modules/prometheus/usr/local/bin/prometheus-wmf-elasticsearch-exporter.py\n+    group  => root\n+    ensure => present\n+    mode   => 0555\n"}, {"resource": "File[/etc/logrotate.d/opensearch-disable-readahead-relforge-eqiad]", "content": "--- /etc/logrotate.d/opensearch-disable-readahead-relforge-eqiad.orig\n+++ /etc/logrotate.d/opensearch-disable-readahead-relforge-eqiad\n@@ -0,0 +1,12 @@\n+# logrotate(8) config for opensearch-disable-readahead-relforge-eqiad\n+\n+/var/log/opensearch-disable-readahead-relforge-eqiad/*.log {\n+    daily\n+    copytruncate\n+    missingok\n+    compress\n+    delaycompress\n+    notifempty\n+    rotate 15\n+    size 256M\n+}", "parameters": "--- File[/etc/logrotate.d/opensearch-disable-readahead-relforge-eqiad].orig\n+++ File[/etc/logrotate.d/opensearch-disable-readahead-relforge-eqiad]\n\n+    owner  => root\n+    mode   => 0444\n+    group  => root\n+    ensure => present\n"}, {"resource": "File[/srv/opensearch/relforge-eqiad-small-alpha]", "parameters": "--- File[/srv/opensearch/relforge-eqiad-small-alpha].orig\n+++ File[/srv/opensearch/relforge-eqiad-small-alpha]\n\n+    owner  => opensearch\n+    mode   => 0755\n+    group  => opensearch\n+    ensure => directory\n"}, {"resource": "File[/etc/rsyslog.d/40-wmf-auto-restart-prometheus-elasticsearch-exporter-9200.conf]", "content": "--- /etc/rsyslog.d/40-wmf-auto-restart-prometheus-elasticsearch-exporter-9200.conf.orig\n+++ /etc/rsyslog.d/40-wmf-auto-restart-prometheus-elasticsearch-exporter-9200.conf\n@@ -0,0 +1,10 @@\n+# rsyslog.conf(5) configuration file for services.\n+# This file is managed by Puppet.\n+if $programname startswith \"wmf_auto_restart_prometheus-elasticsearch-exporter-9200\" then {\n+    action(\n+        type=\"omfile\" file=\"/var/log/wmf_auto_restart_prometheus-elasticsearch-exporter-9200/syslog.log\"\n+        fileOwner=\"root\" fileGroup=\"root\"\n+        fileCreateMode=\"0644\"\n+    )\n+    & stop\n+}", "parameters": "--- File[/etc/rsyslog.d/40-wmf-auto-restart-prometheus-elasticsearch-exporter-9200.conf].orig\n+++ File[/etc/rsyslog.d/40-wmf-auto-restart-prometheus-elasticsearch-exporter-9200.conf]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Service[rsyslog]\n"}, {"resource": "Exec[symlink /etc/opensearch/relforge-eqiad-small-alpha/sudachi]", "parameters": "--- Exec[symlink /etc/opensearch/relforge-eqiad-small-alpha/sudachi].orig\n+++ Exec[symlink /etc/opensearch/relforge-eqiad-small-alpha/sudachi]\n\n+    creates => /etc/opensearch/relforge-eqiad-small-alpha/sudachi\n+    command => /usr/bin/ln -s '/usr/share/opensearch/config/sudachi' '/etc/opensearch/relforge-eqiad-small-alpha/sudachi'\n+    onlyif  => /usr/bin/test -d '/usr/share/opensearch/config/sudachi'\n"}, {"resource": "File[/etc/opensearch_hot_threads.d]", "parameters": "--- File[/etc/opensearch_hot_threads.d].orig\n+++ File[/etc/opensearch_hot_threads.d]\n\n+    owner  => root\n+    mode   => 0755\n+    group  => root\n+    ensure => directory\n"}, {"resource": "Exec[systemd daemon-reload for opensearch-disable-readahead-relforge-eqiad-small-alpha.service (opensearch-disable-readahead-relforge-eqiad-small-alpha.service)]", "parameters": "--- Exec[systemd daemon-reload for opensearch-disable-readahead-relforge-eqiad-small-alpha.service (opensearch-disable-readahead-relforge-eqiad-small-alpha.service)].orig\n+++ Exec[systemd daemon-reload for opensearch-disable-readahead-relforge-eqiad-small-alpha.service (opensearch-disable-readahead-relforge-eqiad-small-alpha.service)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Nrpe::Monitor_service[opensearch_shard_size_check_9200]", "parameters": "--- Nrpe::Monitor_service[opensearch_shard_size_check_9200].orig\n+++ Nrpe::Monitor_service[opensearch_shard_size_check_9200]\n\n+    retry_interval              => 180\n+    check_interval              => 1440\n+    ensure                      => present\n+    migration_task              => T371083\n+    contact_group               => admins,team-discovery\n+    nrpe_command                => /usr/lib/nagios/plugins/check_elasticsearch_shard_size.py --url http://localhost:9200 --shard-size-warning 110 --shard-size-critical 140 --timeout 4\n+    enable_nrpe2nodexp          => False\n+    critical                    => False\n+    alertmanager_team           => observability\n+    retries                     => 3\n+    nrpe2nodexp_parse_perf_data => False\n+    enable_icinga_check         => True\n+    timeout                     => 10\n+    description                 => OpenSearch shard size check - 9200\n+    notes_url                   => https://wikitech.wikimedia.org/wiki/Search#If_it_has_been_indexed\n"}, {"resource": "Package[opensearch-madvise]", "parameters": "--- Package[opensearch-madvise].orig\n+++ Package[opensearch-madvise]\n\n+    provider => apt\n+    ensure   => present\n"}, {"resource": "File[/etc/opensearch/relforge-eqiad/java-security.policy]", "parameters": "--- File[/etc/opensearch/relforge-eqiad/java-security.policy].orig\n+++ File[/etc/opensearch/relforge-eqiad/java-security.policy]\n\n+    owner  => opensearch\n+    source => puppet:///modules/profile/opensearch/java-security.policy\n+    group  => opensearch\n+    ensure => file\n+    mode   => 0440\n"}, {"resource": "Monitoring::Exported_nagios_service[relforge1008 opensearch_shards_9400]", "parameters": "--- Monitoring::Exported_nagios_service[relforge1008 opensearch_shards_9400].orig\n+++ Monitoring::Exported_nagios_service[relforge1008 opensearch_shards_9400]\n\n+    check_command          => nrpe_check!check_opensearch_shards_9400!10\n+    retry_interval         => 1\n+    active_checks_enabled  => 1\n+    contact_groups         => admins,team-discovery\n+    host_name              => relforge1008\n+    check_freshness        => 0\n+    notification_period    => 24x7\n+    servicegroups          => relforge_eqiad\n+    notification_interval  => 0\n+    ensure                 => present\n+    notification_options   => c,r,f\n+    check_interval         => 1\n+    notifications_enabled  => 0\n+    max_check_attempts     => 3\n+    is_volatile            => 0\n+    passive_checks_enabled => 1\n+    check_period           => 24x7\n+    service_description    => OpenSearch health check for shards on 9400\n+    notes_url              => https://wikitech.wikimedia.org/wiki/Search#Administration\n"}, {"resource": "File[/var/log/opensearch/opensearch_index_search_slowlog.log]", "parameters": "--- File[/var/log/opensearch/opensearch_index_search_slowlog.log].orig\n+++ File[/var/log/opensearch/opensearch_index_search_slowlog.log]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n"}, {"resource": "Systemd::Unit[nrpe2nodexp-opensearch_shard_size_check_9400.timer]", "parameters": "--- Systemd::Unit[nrpe2nodexp-opensearch_shard_size_check_9400.timer].orig\n+++ Systemd::Unit[nrpe2nodexp-opensearch_shard_size_check_9400.timer]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => absent\n+    override_filename => puppet-override.conf\n+    unit              => nrpe2nodexp-opensearch_shard_size_check_9400.timer\n"}, {"resource": "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer (nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer)]", "parameters": "--- Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer (nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer)].orig\n+++ Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer (nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "File[/lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service]", "content": "--- /lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service.orig\n+++ /lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service\n@@ -0,0 +1,8 @@\n+[Unit]\n+Description=Auto restart job: prometheus-elasticsearch-exporter-9200\n+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+\n+[Service]\n+Type=oneshot\n+User=root\n+ExecStart=/usr/local/sbin/wmf-auto-restart -s prometheus-elasticsearch-exporter-9200", "parameters": "--- File[/lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service].orig\n+++ File[/lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service (wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service)]\n"}, {"resource": "File[/lib/systemd/system/prometheus-wmf-elasticsearch-exporter-9400.service]", "content": "--- /lib/systemd/system/prometheus-wmf-elasticsearch-exporter-9400.service.orig\n+++ /lib/systemd/system/prometheus-wmf-elasticsearch-exporter-9400.service\n@@ -0,0 +1,13 @@\n+[Unit]\n+Description=Prometheus WMF Elasticsearch Exporter\n+\n+[Service]\n+Restart=always\n+User=prometheus\n+ExecStart=/usr/local/bin/prometheus-wmf-elasticsearch-exporter \\\n+    --listen :9121 \\\n+    --port 9400 \\\n+    --indices \n+\n+[Install]\n+WantedBy=multi-user.target", "parameters": "--- File[/lib/systemd/system/prometheus-wmf-elasticsearch-exporter-9400.service].orig\n+++ File[/lib/systemd/system/prometheus-wmf-elasticsearch-exporter-9400.service]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for prometheus-wmf-elasticsearch-exporter-9400.service (prometheus-wmf-elasticsearch-exporter-9400)]\n"}, {"resource": "Nrpe::Check[check_opensearch_unassigned_shard_check_9200]", "parameters": "--- Nrpe::Check[check_opensearch_unassigned_shard_check_9200].orig\n+++ Nrpe::Check[check_opensearch_unassigned_shard_check_9200]\n\n+    before  => Monitoring::Service[opensearch_unassigned_shard_check_9200]\n+    command => /usr/lib/nagios/plugins/check_elasticsearch_unassigned_shards.py --url http://localhost:9200 --timeout 4\n+    ensure  => present\n"}, {"resource": "Logstash::Input::Gelf[gelf_relay]", "parameters": "--- Logstash::Input::Gelf[gelf_relay].orig\n+++ Logstash::Input::Gelf[gelf_relay]\n\n+    priority  => 10\n+    port      => 12201\n+    ensure    => present\n+    host      => localhost\n+    tags      => ['input-gelf-relay']\n+    plugin_id => input/gelf/12201\n"}, {"resource": "File[/lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer]", "content": "--- /lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer.orig\n+++ /lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer\n@@ -0,0 +1,12 @@\n+[Unit]\n+Description=Periodic execution of wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service\n+\n+[Timer]\n+Unit=wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service\n+# Accuracy sets the maximum time interval around the execution time we want to allow\n+AccuracySec=15sec\n+OnCalendar=Mon,Tue,Wed,Thu,Fri *-*-* 11:6:00\n+RandomizedDelaySec=0\n+\n+[Install]\n+WantedBy=multi-user.target", "parameters": "--- File[/lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer].orig\n+++ File[/lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer (wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer)]\n"}, {"resource": "File[/lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer]", "content": "--- /lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer.orig\n+++ /lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer\n@@ -0,0 +1,14 @@\n+[Unit]\n+Description=Periodic execution of nrpe2nodexp-opensearch_unassigned_shard_check_9400.service\n+\n+[Timer]\n+Unit=nrpe2nodexp-opensearch_unassigned_shard_check_9400.service\n+# Accuracy sets the maximum time interval around the execution time we want to allow\n+AccuracySec=15sec\n+OnUnitInactiveSec=720min\n+OnActiveSec=1s\n+RandomizedDelaySec=43200\n+FixedRandomDelay=true\n+\n+[Install]\n+WantedBy=multi-user.target", "parameters": "--- File[/lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer].orig\n+++ File[/lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer (nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer)]\n"}, {"resource": "Service[nrpe2nodexp-opensearch_shard_size_check_9400.timer]", "parameters": "--- Service[nrpe2nodexp-opensearch_shard_size_check_9400.timer].orig\n+++ Service[nrpe2nodexp-opensearch_shard_size_check_9400.timer]\n\n+    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9400.timer (nrpe2nodexp-opensearch_shard_size_check_9400.timer)]']\n+    provider => systemd\n+    enable   => False\n+    ensure   => stopped\n"}, {"resource": "File_line[auto_restart_file_presence_prometheus-wmf-elasticsearch-exporter-9200]", "parameters": "--- File_line[auto_restart_file_presence_prometheus-wmf-elasticsearch-exporter-9200].orig\n+++ File_line[auto_restart_file_presence_prometheus-wmf-elasticsearch-exporter-9200]\n\n+    path    => /etc/debdeploy-client/autorestarts.conf\n+    require => File[/etc/debdeploy-client/autorestarts.conf]\n+    line    => prometheus-wmf-elasticsearch-exporter-9200\n+    ensure  => present\n"}, {"resource": "File[/var/lib/prometheus/node.d/role_owner.prom]", "content": "--- /var/lib/prometheus/node.d/role_owner.prom.orig\n+++ /var/lib/prometheus/node.d/role_owner.prom\n@@ -1,3 +1,3 @@\n # HELP role_owner The team owner of the server role\n # TYPE role_owner gauge\n-role_owner{team=\"search-platform\",role=\"cirrus::test\",cluster=\"relforge\"} 1.0\n+role_owner{team=\"search-platform\",role=\"cirrus::relforge\",cluster=\"relforge\"} 1.0"}, {"resource": "Exec[systemd daemon-reload for opensearch-disable-readahead-relforge-eqiad.service (opensearch-disable-readahead-relforge-eqiad.service)]", "parameters": "--- Exec[systemd daemon-reload for opensearch-disable-readahead-relforge-eqiad.service (opensearch-disable-readahead-relforge-eqiad.service)].orig\n+++ Exec[systemd daemon-reload for opensearch-disable-readahead-relforge-eqiad.service (opensearch-disable-readahead-relforge-eqiad.service)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Systemd::Unit[opensearch-disable-readahead-relforge-eqiad.timer]", "parameters": "--- Systemd::Unit[opensearch-disable-readahead-relforge-eqiad.timer].orig\n+++ Systemd::Unit[opensearch-disable-readahead-relforge-eqiad.timer]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => present\n+    override_filename => puppet-override.conf\n+    unit              => opensearch-disable-readahead-relforge-eqiad.timer\n"}, {"resource": "Exec[systemd daemon-reload for opensearch-disable-readahead.service (opensearch-disable-readahead.service)]", "parameters": "--- Exec[systemd daemon-reload for opensearch-disable-readahead.service (opensearch-disable-readahead.service)].orig\n+++ Exec[systemd daemon-reload for opensearch-disable-readahead.service (opensearch-disable-readahead.service)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "File[/lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer]", "content": "--- /lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer.orig\n+++ /lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer\n@@ -0,0 +1,12 @@\n+[Unit]\n+Description=Periodic execution of wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service\n+\n+[Timer]\n+Unit=wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service\n+# Accuracy sets the maximum time interval around the execution time we want to allow\n+AccuracySec=15sec\n+OnCalendar=Mon,Tue,Wed,Thu,Fri *-*-* 14:27:00\n+RandomizedDelaySec=0\n+\n+[Install]\n+WantedBy=multi-user.target", "parameters": "--- File[/lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer].orig\n+++ File[/lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer (wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer)]\n"}, {"resource": "Exec[systemd daemon-reload for clean_up_dlq.timer (clean_up_dlq.timer)]", "parameters": "--- Exec[systemd daemon-reload for clean_up_dlq.timer (clean_up_dlq.timer)].orig\n+++ Exec[systemd daemon-reload for clean_up_dlq.timer (clean_up_dlq.timer)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Rsyslog::Conf[nrpe2nodexp-opensearch_shard_size_check_9200]", "parameters": "--- Rsyslog::Conf[nrpe2nodexp-opensearch_shard_size_check_9200].orig\n+++ Rsyslog::Conf[nrpe2nodexp-opensearch_shard_size_check_9200]\n\n+    mode     => 0444\n+    priority => 25\n+    ensure   => absent\n"}, {"resource": "File[/lib/systemd/system/push_cross_cluster_settings_9400.timer]", "content": "--- /lib/systemd/system/push_cross_cluster_settings_9400.timer.orig\n+++ /lib/systemd/system/push_cross_cluster_settings_9400.timer\n@@ -0,0 +1,13 @@\n+[Unit]\n+Description=Periodic execution of push_cross_cluster_settings_9400.service\n+\n+[Timer]\n+Unit=push_cross_cluster_settings_9400.service\n+# Accuracy sets the maximum time interval around the execution time we want to allow\n+AccuracySec=15sec\n+OnUnitActiveSec=15min\n+OnActiveSec=1s\n+RandomizedDelaySec=0\n+\n+[Install]\n+WantedBy=multi-user.target", "parameters": "--- File[/lib/systemd/system/push_cross_cluster_settings_9400.timer].orig\n+++ File[/lib/systemd/system/push_cross_cluster_settings_9400.timer]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for push_cross_cluster_settings_9400.timer (push_cross_cluster_settings_9400.timer)]\n"}, {"resource": "Exec[Refresh tmpfile opensearch-relforge-eqiad-small-alpha]", "parameters": "--- Exec[Refresh tmpfile opensearch-relforge-eqiad-small-alpha].orig\n+++ Exec[Refresh tmpfile opensearch-relforge-eqiad-small-alpha]\n\n+    command     => /bin/systemd-tmpfiles --create --remove '/etc/tmpfiles.d/opensearch-relforge-eqiad-small-alpha.conf'\n+    subscribe   => File[/etc/tmpfiles.d/opensearch-relforge-eqiad-small-alpha.conf]\n+    user        => root\n+    refreshonly => True\n"}, {"resource": "Systemd::Monitor[push_cross_cluster_settings_9400]", "parameters": "--- Systemd::Monitor[push_cross_cluster_settings_9400].orig\n+++ Systemd::Monitor[push_cross_cluster_settings_9400]\n\n+    retries        => 2\n+    check_interval => 10\n+    ensure         => present\n+    migration_task => T407130\n+    contact_group  => admins\n+    notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+    critical       => False\n"}, {"resource": "File[/etc/rsyslog.d/40-opensearch-disable-readahead.conf]", "content": "--- /etc/rsyslog.d/40-opensearch-disable-readahead.conf.orig\n+++ /etc/rsyslog.d/40-opensearch-disable-readahead.conf\n@@ -0,0 +1,10 @@\n+# rsyslog.conf(5) configuration file for services.\n+# This file is managed by Puppet.\n+if $programname startswith \"opensearch-disable-readahead\" then {\n+    action(\n+        type=\"omfile\" file=\"/var/log/opensearch-disable-readahead/syslog.log\"\n+        fileOwner=\"root\" fileGroup=\"root\"\n+        fileCreateMode=\"0644\"\n+    )\n+    & stop\n+}", "parameters": "--- File[/etc/rsyslog.d/40-opensearch-disable-readahead.conf].orig\n+++ File[/etc/rsyslog.d/40-opensearch-disable-readahead.conf]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Service[rsyslog]\n"}, {"resource": "Systemd::Timer[nrpe2nodexp-opensearch_shards_9200]", "parameters": "--- Systemd::Timer[nrpe2nodexp-opensearch_shards_9200].orig\n+++ Systemd::Timer[nrpe2nodexp-opensearch_shards_9200]\n\n+    unit_name          => nrpe2nodexp-opensearch_shards_9200.service\n+    fixed_random_delay => True\n+    splay              => 60\n+    ensure             => absent\n+    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]\n+    accuracy           => 15sec\n"}, {"resource": "Exec[nginx-reload]", "parameters": "--- Exec[nginx-reload].orig\n+++ Exec[nginx-reload]\n\n+    command     => /usr/sbin/service nginx reload\n+    refreshonly => True\n"}, {"resource": "File[/lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service]", "content": "--- /lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service.orig\n+++ /lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service\n@@ -0,0 +1,8 @@\n+[Unit]\n+Description=Auto restart job: prometheus-wmf-elasticsearch-exporter-9200\n+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+\n+[Service]\n+Type=oneshot\n+User=root\n+ExecStart=/usr/local/sbin/wmf-auto-restart -s prometheus-wmf-elasticsearch-exporter-9200", "parameters": "--- File[/lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service].orig\n+++ File[/lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service (wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service)]\n"}, {"resource": "File[/lib/systemd/system/nrpe2nodexp-opensearch_shards_9400.timer]", "content": "--- /lib/systemd/system/nrpe2nodexp-opensearch_shards_9400.timer.orig\n+++ /lib/systemd/system/nrpe2nodexp-opensearch_shards_9400.timer\n@@ -0,0 +1,14 @@\n+[Unit]\n+Description=Periodic execution of nrpe2nodexp-opensearch_shards_9400.service\n+\n+[Timer]\n+Unit=nrpe2nodexp-opensearch_shards_9400.service\n+# Accuracy sets the maximum time interval around the execution time we want to allow\n+AccuracySec=15sec\n+OnUnitInactiveSec=1min\n+OnActiveSec=1s\n+RandomizedDelaySec=60\n+FixedRandomDelay=true\n+\n+[Install]\n+WantedBy=multi-user.target", "parameters": "--- File[/lib/systemd/system/nrpe2nodexp-opensearch_shards_9400.timer].orig\n+++ File[/lib/systemd/system/nrpe2nodexp-opensearch_shards_9400.timer]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9400.timer (nrpe2nodexp-opensearch_shards_9400.timer)]\n"}, {"resource": "Systemd::Timer::Job[opensearch-disable-readahead-relforge-eqiad-small-alpha]", "parameters": "--- Systemd::Timer::Job[opensearch-disable-readahead-relforge-eqiad-small-alpha].orig\n+++ Systemd::Timer::Job[opensearch-disable-readahead-relforge-eqiad-small-alpha]\n\n+    send_mail                 => False\n+    user                      => root\n+    monitoring_enabled        => False\n+    logfile_name              => syslog.log\n+    logging_enabled           => True\n+    command                   => /usr/local/bin/opensearch-disable-readahead.sh relforge-eqiad-small-alpha /srv/opensearch\n+    private_tmp               => False\n+    description               => Disables readahead on all open files every 30 minutes to alleviate Cirrussearch / opensearch IO load spikes\n+    syslog_force_stop         => True\n+    ignore_errors             => False\n+    send_mail_only_on_error   => True\n+    fixed_random_delay        => False\n+    logfile_perms             => all\n+    ensure                    => present\n+    logfile_basedir           => /var/log\n+    environment               => {}\n+    logfile_group             => root\n+    send_mail_to              => root@relforge1008.eqiad.wmnet\n+    success_exit_status       => []\n+    interval                  => [{'start': 'OnUnitActiveSec', 'interval': '30min'}, {'start': 'OnBootSec', 'interval': '1min'}]\n+    monitoring_contact_groups => admins\n+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+    syslog_match_startswith   => True\n"}, {"resource": "File[/etc/logstash/log4j2.properties]", "content": "--- /etc/logstash/log4j2.properties.orig\n+++ /etc/logstash/log4j2.properties\n@@ -0,0 +1,51 @@\n+status = error\n+name = LogstashPropertiesConfig\n+\n+appender.rolling.type = RollingFile\n+appender.rolling.name = plain_rolling\n+appender.rolling.fileName = ${sys:ls.logs}/logstash-${sys:ls.log.format}.log\n+appender.rolling.filePattern = ${sys:ls.logs}/logstash-${sys:ls.log.format}-%d{yyyy-MM-dd}-%i.log.gz\n+appender.rolling.policies.type = Policies\n+appender.rolling.policies.time.type = TimeBasedTriggeringPolicy\n+appender.rolling.policies.time.interval = 1\n+appender.rolling.policies.time.modulate = true\n+appender.rolling.layout.type = PatternLayout\n+appender.rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c] %-.10000m%n\n+appender.rolling.policies.size.type = SizeBasedTriggeringPolicy\n+appender.rolling.policies.size.size = 128M\n+appender.rolling.strategy.type = DefaultRolloverStrategy\n+appender.rolling.strategy.max = 4\n+appender.rolling.strategy.action.type = Delete\n+appender.rolling.strategy.action.basepath = ${sys:ls.logs}\n+appender.rolling.strategy.action.condition.type = IfFileName\n+appender.rolling.strategy.action.condition.glob = logstash-${sys:ls.log.format}-*\n+appender.rolling.strategy.action.ifAny.type = IfAny\n+appender.rolling.strategy.action.ifAny.ifLastModified.type = IfLastModified\n+appender.rolling.strategy.action.ifAny.ifLastModified.age = 30D\n+appender.rolling.strategy.action.ifAny.ifAccumulatedFileSize.type = IfAccumulatedFileSize\n+appender.rolling.strategy.action.ifAny.ifAccumulatedFileSize.exceeds = 15GB\n+\n+appender.json_rolling.type = RollingFile\n+appender.json_rolling.name = json_rolling\n+appender.json_rolling.fileName = ${sys:ls.logs}/logstash-${sys:ls.log.format}.log\n+appender.json_rolling.filePattern = ${sys:ls.logs}/logstash-${sys:ls.log.format}-%d{yyyy-MM-dd}.log\n+appender.json_rolling.policies.type = Policies\n+appender.json_rolling.policies.time.type = TimeBasedTriggeringPolicy\n+appender.json_rolling.policies.time.interval = 1\n+appender.json_rolling.policies.time.modulate = true\n+appender.json_rolling.layout.type = JSONLayout\n+appender.json_rolling.layout.compact = true\n+appender.json_rolling.layout.eventEol = true\n+appender.json_rolling.strategy.type = DefaultRolloverStrategy\n+appender.json_rolling.strategy.action.type = Delete\n+appender.json_rolling.strategy.action.basepath = ${sys:ls.logs}\n+appender.json_rolling.strategy.action.condition.type = IfFileName\n+appender.json_rolling.strategy.action.condition.glob = logstash-${sys:ls.log.format}-*\n+appender.json_rolling.strategy.action.ifAny.type = IfAny\n+appender.json_rolling.strategy.action.ifAny.ifLastModified.type = IfLastModified\n+appender.json_rolling.strategy.action.ifAny.ifLastModified.age = 30D\n+appender.json_rolling.strategy.action.ifAny.ifAccumulatedFileSize.type = IfAccumulatedFileSize\n+appender.json_rolling.strategy.action.ifAny.ifAccumulatedFileSize.exceeds = 10GB\n+\n+rootLogger.level = ${sys:ls.log.level}\n+rootLogger.appenderRef.rolling.ref = ${sys:ls.log.format}_rolling", "parameters": "--- File[/etc/logstash/log4j2.properties].orig\n+++ File[/etc/logstash/log4j2.properties]\n\n+    owner   => root\n+    group   => root\n+    require => Package[logstash-oss]\n+    mode    => 0444\n+    ensure  => file\n"}, {"resource": "Systemd::Timer::Job[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]", "parameters": "--- Systemd::Timer::Job[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200].orig\n+++ Systemd::Timer::Job[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]\n\n+    send_mail                 => False\n+    user                      => root\n+    require                   => File[/usr/local/sbin/wmf-auto-restart]\n+    monitoring_enabled        => False\n+    logfile_name              => syslog.log\n+    logging_enabled           => True\n+    command                   => /usr/local/sbin/wmf-auto-restart -s prometheus-wmf-elasticsearch-exporter-9200\n+    private_tmp               => False\n+    description               => Auto restart job: prometheus-wmf-elasticsearch-exporter-9200\n+    syslog_force_stop         => True\n+    ignore_errors             => False\n+    send_mail_only_on_error   => True\n+    fixed_random_delay        => False\n+    logfile_perms             => all\n+    ensure                    => present\n+    logfile_basedir           => /var/log\n+    environment               => {}\n+    logfile_group             => root\n+    send_mail_to              => root@relforge1008.eqiad.wmnet\n+    success_exit_status       => []\n+    interval                  => {'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 10:55:00'}\n+    monitoring_contact_groups => admins\n+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+    syslog_match_startswith   => True\n"}, {"resource": "Exec[systemd daemon-reload for push_cross_cluster_settings_9200.service (push_cross_cluster_settings_9200.service)]", "parameters": "--- Exec[systemd daemon-reload for push_cross_cluster_settings_9200.service (push_cross_cluster_settings_9200.service)].orig\n+++ Exec[systemd daemon-reload for push_cross_cluster_settings_9200.service (push_cross_cluster_settings_9200.service)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Systemd::Timer::Job[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]", "parameters": "--- Systemd::Timer::Job[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup].orig\n+++ Systemd::Timer::Job[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]\n\n+    send_mail                 => False\n+    user                      => root\n+    monitoring_enabled        => False\n+    logfile_name              => syslog.log\n+    logging_enabled           => True\n+    command                   => /usr/bin/find /var/log/opensearch -name 'relforge-eqiad-small-alpha_jvm_gc.*.log*' -mtime +30 -delete\n+    private_tmp               => False\n+    description               => Cleanup GC logs\n+    syslog_force_stop         => True\n+    ignore_errors             => False\n+    send_mail_only_on_error   => True\n+    fixed_random_delay        => False\n+    logfile_perms             => all\n+    ensure                    => present\n+    logfile_basedir           => /var/log\n+    environment               => {}\n+    logfile_group             => root\n+    send_mail_to              => root@relforge1008.eqiad.wmnet\n+    success_exit_status       => []\n+    interval                  => {'start': 'OnCalendar', 'interval': '*-*-* 02:12:00'}\n+    monitoring_contact_groups => admins\n+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+    syslog_match_startswith   => True\n"}, {"resource": "Exec[systemd daemon-reload for push_cross_cluster_settings_9400.service (push_cross_cluster_settings_9400.service)]", "parameters": "--- Exec[systemd daemon-reload for push_cross_cluster_settings_9400.service (push_cross_cluster_settings_9400.service)].orig\n+++ Exec[systemd daemon-reload for push_cross_cluster_settings_9400.service (push_cross_cluster_settings_9400.service)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Exec[Generate cert discovery2026__relforge1008_eqiad_wmnet refresh on intermediate ca change]", "parameters": "--- Exec[Generate cert discovery2026__relforge1008_eqiad_wmnet refresh on intermediate ca change].orig\n+++ Exec[Generate cert discovery2026__relforge1008_eqiad_wmnet refresh on intermediate ca change]\n\n+    environment => ['GODEBUG=x509ignoreCN=0']\n+    subscribe   => File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chain.pem]\n+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/relforge1008.eqiad.wmnet.pem -label discovery2026  /etc/cfssl/csr/discovery2026__relforge1008_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet\n\n+    require     => Cfssl::Csr[/etc/cfssl/csr/discovery2026__relforge1008_eqiad_wmnet.csr]\n+    refreshonly => True\n"}, {"resource": "File[/var/log/opensearch-disable-readahead-relforge-eqiad-small-alpha]", "parameters": "--- File[/var/log/opensearch-disable-readahead-relforge-eqiad-small-alpha].orig\n+++ File[/var/log/opensearch-disable-readahead-relforge-eqiad-small-alpha]\n\n+    owner  => root\n+    group  => root\n+    force  => True\n+    ensure => directory\n+    mode   => 0755\n+    backup => False\n"}, {"resource": "File[/var/log/wmf_auto_restart_prometheus-elasticsearch-exporter-9400]", "parameters": "--- File[/var/log/wmf_auto_restart_prometheus-elasticsearch-exporter-9400].orig\n+++ File[/var/log/wmf_auto_restart_prometheus-elasticsearch-exporter-9400]\n\n+    owner  => root\n+    group  => root\n+    force  => True\n+    ensure => directory\n+    mode   => 0755\n+    backup => False\n"}, {"resource": "Exec[systemd daemon-reload for opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service (opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service)]", "parameters": "--- Exec[systemd daemon-reload for opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service (opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service)].orig\n+++ Exec[systemd daemon-reload for opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service (opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "File[/usr/share/opensearch/plugins]", "parameters": "--- File[/usr/share/opensearch/plugins].orig\n+++ File[/usr/share/opensearch/plugins]\n\n+    owner  => root\n+    group  => root\n+    force  => True\n+    ensure => directory\n+    mode   => 0755\n"}, {"resource": "Systemd::Timer::Job[nrpe2nodexp-check_push_cross_cluster_settings_9400_status]", "parameters": "--- Systemd::Timer::Job[nrpe2nodexp-check_push_cross_cluster_settings_9400_status].orig\n+++ Systemd::Timer::Job[nrpe2nodexp-check_push_cross_cluster_settings_9400_status]\n\n+    send_mail                 => False\n+    user                      => nagios\n+    monitoring_enabled        => False\n+    logfile_name              => syslog.log\n+    logging_enabled           => False\n+    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash \"de4a199c43946c09f819ca4ffea40ac0\" --timeout 10 --check-command \"check_check_push_cross_cluster_settings_9400_status\"\n+    private_tmp               => False\n+    splay                     => 300\n+    description               => execution of nrpe2nodexp for the check_check_push_cross_cluster_settings_9400_status command.\n+    syslog_force_stop         => True\n+    ignore_errors             => True\n+    send_mail_only_on_error   => True\n+    fixed_random_delay        => True\n+    logfile_perms             => all\n+    syslog_identifier         => nrpe2nodexp-check_push_cross_cluster_settings_9400_status\n+    ensure                    => absent\n+    logfile_basedir           => /var/log\n+    environment               => {}\n+    logfile_group             => root\n+    send_mail_to              => root@relforge1008.eqiad.wmnet\n+    group                     => prometheus-node-exporter\n+    success_exit_status       => []\n+    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '5min'}]\n+    monitoring_contact_groups => admins\n+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+    syslog_match_startswith   => True\n"}, {"resource": "Systemd::Unit[prometheus-wmf-elasticsearch-exporter-9200]", "parameters": "--- Systemd::Unit[prometheus-wmf-elasticsearch-exporter-9200].orig\n+++ Systemd::Unit[prometheus-wmf-elasticsearch-exporter-9200]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => True\n+    ensure            => present\n+    override_filename => puppet-override.conf\n+    unit              => prometheus-wmf-elasticsearch-exporter-9200\n"}, {"resource": "Systemd::Tmpfile[opensearch-relforge-eqiad]", "parameters": "--- Systemd::Tmpfile[opensearch-relforge-eqiad].orig\n+++ Systemd::Tmpfile[opensearch-relforge-eqiad]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n"}, {"resource": "File[/etc/logstash/conf.d/90-output-udp-gelf_relay.conf]", "content": "--- /etc/logstash/conf.d/90-output-udp-gelf_relay.conf.orig\n+++ /etc/logstash/conf.d/90-output-udp-gelf_relay.conf\n@@ -0,0 +1,9 @@\n+output {\n+\n+      udp {\n+          host => 'localhost'\n+          port => '11514'\n+          codec =>'json'\n+      }\n+\n+}", "parameters": "--- File[/etc/logstash/conf.d/90-output-udp-gelf_relay.conf].orig\n+++ File[/etc/logstash/conf.d/90-output-udp-gelf_relay.conf]\n\n+    owner        => logstash\n+    group        => logstash\n+    validate_cmd => /usr/local/bin/logstash-config-test %\n+    ensure       => present\n+    mode         => 0440\n+    notify       => Service[logstash]\n"}, {"resource": "File[/lib/systemd/system/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer]", "content": "--- /lib/systemd/system/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer.orig\n+++ /lib/systemd/system/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer\n@@ -0,0 +1,12 @@\n+[Unit]\n+Description=Periodic execution of opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service\n+\n+[Timer]\n+Unit=opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service\n+# Accuracy sets the maximum time interval around the execution time we want to allow\n+AccuracySec=15sec\n+OnCalendar=*-*-* 02:12:00\n+RandomizedDelaySec=0\n+\n+[Install]\n+WantedBy=multi-user.target", "parameters": "--- File[/lib/systemd/system/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer].orig\n+++ File[/lib/systemd/system/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer (opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer)]\n"}, {"resource": "Profile::Auto_restarts::Service[prometheus-wmf-elasticsearch-exporter-9400]", "parameters": "--- Profile::Auto_restarts::Service[prometheus-wmf-elasticsearch-exporter-9400].orig\n+++ Profile::Auto_restarts::Service[prometheus-wmf-elasticsearch-exporter-9400]\n\n+    ensure => present\n"}, {"resource": "Systemd::Service[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]", "parameters": "--- Systemd::Service[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200].orig\n+++ Systemd::Service[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]\n\n+    override                 => False\n+    restart                  => False\n+    require                  => Systemd::Unit[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service]\n+    ensure                   => present\n+    unit_type                => timer\n+    migration_task           => T407130\n+    monitoring_enabled       => False\n+    monitoring_contact_group => admins\n+    service_params           => {}\n+    monitoring_critical      => False\n"}, {"resource": "Systemd::Unit[wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer]", "parameters": "--- Systemd::Unit[wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer].orig\n+++ Systemd::Unit[wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => present\n+    override_filename => puppet-override.conf\n+    unit              => wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer\n"}, {"resource": "Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer (nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer)]", "parameters": "--- Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer (nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer)].orig\n+++ Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer (nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Rsyslog::Conf[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]", "parameters": "--- Rsyslog::Conf[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200].orig\n+++ Rsyslog::Conf[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]\n\n+    mode     => 0444\n+    priority => 40\n+    require  => File[/var/log/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]\n+    ensure   => present\n"}, {"resource": "Service[wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer]", "parameters": "--- Service[wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer].orig\n+++ Service[wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer]\n\n+    ensure   => running\n+    provider => systemd\n+    enable   => True\n"}, {"resource": "Monitoring::Exported_nagios_service[relforge1008 opensearch_shard_size_check_9400]", "parameters": "--- Monitoring::Exported_nagios_service[relforge1008 opensearch_shard_size_check_9400].orig\n+++ Monitoring::Exported_nagios_service[relforge1008 opensearch_shard_size_check_9400]\n\n+    check_command          => nrpe_check!check_opensearch_shard_size_check_9400!10\n+    retry_interval         => 180\n+    active_checks_enabled  => 1\n+    contact_groups         => admins,team-discovery\n+    host_name              => relforge1008\n+    check_freshness        => 0\n+    notification_period    => 24x7\n+    servicegroups          => relforge_eqiad\n+    notification_interval  => 0\n+    ensure                 => present\n+    notification_options   => c,r,f\n+    check_interval         => 1440\n+    notifications_enabled  => 0\n+    max_check_attempts     => 3\n+    is_volatile            => 0\n+    passive_checks_enabled => 1\n+    check_period           => 24x7\n+    service_description    => OpenSearch shard size check - 9400\n+    notes_url              => https://wikitech.wikimedia.org/wiki/Search#If_it_has_been_indexed\n"}, {"resource": "Concat_file[/etc/apt/sources.list.d/wikimedia-opensearch-plugins.sources]", "parameters": "--- Concat_file[/etc/apt/sources.list.d/wikimedia-opensearch-plugins.sources].orig\n+++ Concat_file[/etc/apt/sources.list.d/wikimedia-opensearch-plugins.sources]\n\n+    tag            => _etc_apt_sources.list.d_wikimedia-opensearch-plugins.sources\n+    format         => plain\n+    force          => False\n+    show_diff      => True\n+    ensure_newline => False\n+    order          => alpha\n+    owner          => root\n+    group          => root\n+    mode           => 0444\n+    backup         => puppet\n+    replace        => True\n"}, {"resource": "File[/var/log/push_cross_cluster_settings_9200]", "parameters": "--- File[/var/log/push_cross_cluster_settings_9200].orig\n+++ File[/var/log/push_cross_cluster_settings_9200]\n\n+    owner  => root\n+    group  => root\n+    force  => True\n+    ensure => directory\n+    mode   => 0755\n+    backup => False\n"}, {"resource": "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer (wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer)]", "parameters": "--- Exec[systemd daemon-reload for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer (wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer)].orig\n+++ Exec[systemd daemon-reload for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer (wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer)]\n\n+    before      => ['Service[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer]']\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Exec[systemd daemon-reload for prometheus-wmf-elasticsearch-exporter-9400.service (prometheus-wmf-elasticsearch-exporter-9400)]", "parameters": "--- Exec[systemd daemon-reload for prometheus-wmf-elasticsearch-exporter-9400.service (prometheus-wmf-elasticsearch-exporter-9400)].orig\n+++ Exec[systemd daemon-reload for prometheus-wmf-elasticsearch-exporter-9400.service (prometheus-wmf-elasticsearch-exporter-9400)]\n\n+    command     => /bin/systemctl daemon-reload\n+    notify      => ['Service[prometheus-wmf-elasticsearch-exporter-9400]']\n+    refreshonly => True\n"}, {"resource": "File[/lib/systemd/system/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service]", "content": "--- /lib/systemd/system/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service.orig\n+++ /lib/systemd/system/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service\n@@ -0,0 +1,8 @@\n+[Unit]\n+Description=Cleanup GC logs\n+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+\n+[Service]\n+Type=oneshot\n+User=root\n+ExecStart=/usr/bin/find /var/log/opensearch -name 'relforge-eqiad-small-alpha_jvm_gc.*.log*' -mtime +30 -delete", "parameters": "--- File[/lib/systemd/system/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service].orig\n+++ File[/lib/systemd/system/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service (opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service)]\n"}, {"resource": "Systemd::Timer[push_cross_cluster_settings_9200]", "parameters": "--- Systemd::Timer[push_cross_cluster_settings_9200].orig\n+++ Systemd::Timer[push_cross_cluster_settings_9200]\n\n+    unit_name          => push_cross_cluster_settings_9200.service\n+    fixed_random_delay => False\n+    splay              => 0\n+    ensure             => present\n+    timer_intervals    => [{'start': 'OnUnitActiveSec', 'interval': '15min'}, {'interval': '1s', 'start': 'OnActiveSec'}]\n+    accuracy           => 15sec\n"}, {"resource": "File[/var/log/opensearch]", "parameters": "--- File[/var/log/opensearch].orig\n+++ File[/var/log/opensearch]\n\n+    owner   => opensearch\n+    group   => opensearch\n+    require => Package[opensearch]\n+    mode    => 0755\n+    ensure  => directory\n"}, {"resource": "Systemd::Unit[prometheus-wmf-elasticsearch-exporter-9400]", "parameters": "--- Systemd::Unit[prometheus-wmf-elasticsearch-exporter-9400].orig\n+++ Systemd::Unit[prometheus-wmf-elasticsearch-exporter-9400]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => True\n+    ensure            => present\n+    override_filename => puppet-override.conf\n+    unit              => prometheus-wmf-elasticsearch-exporter-9400\n"}, {"resource": "Java::Cacert[wmf:puppetca.pem]", "parameters": "--- Java::Cacert[wmf:puppetca.pem].orig\n+++ Java::Cacert[wmf:puppetca.pem]\n\n+    owner     => root\n+    require   => Alternatives::Java[17]\n+    group     => root\n+    ensure    => present\n+    path      => /etc/ssl/certs/Puppet_Internal_CA.pem\n+    storepass => changeit\n"}, {"resource": "Systemd::Timer[nrpe2nodexp-check_push_cross_cluster_settings_9400_status]", "parameters": "--- Systemd::Timer[nrpe2nodexp-check_push_cross_cluster_settings_9400_status].orig\n+++ Systemd::Timer[nrpe2nodexp-check_push_cross_cluster_settings_9400_status]\n\n+    unit_name          => nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service\n+    fixed_random_delay => True\n+    splay              => 300\n+    ensure             => absent\n+    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '5min'}, {'interval': '1s', 'start': 'OnActiveSec'}]\n+    accuracy           => 15sec\n"}, {"resource": "File[/etc/opensearch_hot_threads.d/relforge-eqiad-small-alpha.yml]", "content": "--- /etc/opensearch_hot_threads.d/relforge-eqiad-small-alpha.yml.orig\n+++ /etc/opensearch_hot_threads.d/relforge-eqiad-small-alpha.yml\n@@ -0,0 +1,3 @@\n+---\n+port: 9400\n+log_file: \"/var/log/opensearch/opensearch_hot_threads-relforge-eqiad-small-alpha.log\"", "parameters": "--- File[/etc/opensearch_hot_threads.d/relforge-eqiad-small-alpha.yml].orig\n+++ File[/etc/opensearch_hot_threads.d/relforge-eqiad-small-alpha.yml]\n\n+    owner  => root\n+    mode   => 0755\n+    group  => root\n+    ensure => file\n"}, {"resource": "File[/etc/nagios/nrpe.d/check_check_push_cross_cluster_settings_9200_status.cfg]", "content": "--- /etc/nagios/nrpe.d/check_check_push_cross_cluster_settings_9200_status.cfg.orig\n+++ /etc/nagios/nrpe.d/check_check_push_cross_cluster_settings_9200_status.cfg\n@@ -0,0 +1,2 @@\n+# File generated by puppet. DO NOT edit by hand\n+command[check_check_push_cross_cluster_settings_9200_status]=/usr/local/lib/nagios/plugins/check_systemd_unit_status push_cross_cluster_settings_9200", "parameters": "--- File[/etc/nagios/nrpe.d/check_check_push_cross_cluster_settings_9200_status.cfg].orig\n+++ File[/etc/nagios/nrpe.d/check_check_push_cross_cluster_settings_9200_status.cfg]\n\n+    owner   => root\n+    require => Package[nagios-nrpe-server]\n+    group   => root\n+    tag     => nrpe::check\n+    ensure  => present\n+    mode    => 0444\n+    notify  => Service[nagios-nrpe-server]\n"}, {"resource": "File[/lib/systemd/system/prometheus-wmf-elasticsearch-exporter-9200.service]", "content": "--- /lib/systemd/system/prometheus-wmf-elasticsearch-exporter-9200.service.orig\n+++ /lib/systemd/system/prometheus-wmf-elasticsearch-exporter-9200.service\n@@ -0,0 +1,13 @@\n+[Unit]\n+Description=Prometheus WMF Elasticsearch Exporter\n+\n+[Service]\n+Restart=always\n+User=prometheus\n+ExecStart=/usr/local/bin/prometheus-wmf-elasticsearch-exporter \\\n+    --listen :9120 \\\n+    --port 9200 \\\n+    --indices \n+\n+[Install]\n+WantedBy=multi-user.target", "parameters": "--- File[/lib/systemd/system/prometheus-wmf-elasticsearch-exporter-9200.service].orig\n+++ File[/lib/systemd/system/prometheus-wmf-elasticsearch-exporter-9200.service]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for prometheus-wmf-elasticsearch-exporter-9200.service (prometheus-wmf-elasticsearch-exporter-9200)]\n"}, {"resource": "Exec[create chained cert /etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chain.pem]", "parameters": "--- Exec[create chained cert /etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chain.pem].orig\n+++ Exec[create chained cert /etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chain.pem]\n\n+    subscribe => ['Exec[renew certificate - discovery2026__relforge1008_eqiad_wmnet]', 'File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chain.pem]', 'File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.pem]']\n+    command   => /bin/cat /etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.pem /etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chain.pem > /etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chained.pem\n+    require   => Exec[Generate cert discovery2026__relforge1008_eqiad_wmnet refresh on intermediate ca change]\n+    notify    => ['Exec[nginx-reload]', 'Exec[nginx-reload]']\n+    unless    => /usr/bin/test \"$(/bin/cat /etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.pem /etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chain.pem | sha512sum)\" == \"$(/bin/cat /etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chained.pem | sha512sum)\"\n\n"}, {"resource": "File[/etc/nagios/nrpe.d/check_opensearch_shard_size_check_9200.cfg]", "content": "--- /etc/nagios/nrpe.d/check_opensearch_shard_size_check_9200.cfg.orig\n+++ /etc/nagios/nrpe.d/check_opensearch_shard_size_check_9200.cfg\n@@ -0,0 +1,2 @@\n+# File generated by puppet. DO NOT edit by hand\n+command[check_opensearch_shard_size_check_9200]=/usr/lib/nagios/plugins/check_elasticsearch_shard_size.py --url http://localhost:9200 --shard-size-warning 110 --shard-size-critical 140 --timeout 4", "parameters": "--- File[/etc/nagios/nrpe.d/check_opensearch_shard_size_check_9200.cfg].orig\n+++ File[/etc/nagios/nrpe.d/check_opensearch_shard_size_check_9200.cfg]\n\n+    owner   => root\n+    require => Package[nagios-nrpe-server]\n+    group   => root\n+    tag     => nrpe::check\n+    ensure  => present\n+    mode    => 0444\n+    notify  => Service[nagios-nrpe-server]\n"}, {"resource": "Service[prometheus-elasticsearch-exporter-9200]", "parameters": "--- Service[prometheus-elasticsearch-exporter-9200].orig\n+++ Service[prometheus-elasticsearch-exporter-9200]\n\n+    ensure => running\n+    enable => True\n"}, {"resource": "File[/lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9400.timer]", "content": "--- /lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9400.timer.orig\n+++ /lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9400.timer\n@@ -0,0 +1,14 @@\n+[Unit]\n+Description=Periodic execution of nrpe2nodexp-opensearch_shard_size_check_9400.service\n+\n+[Timer]\n+Unit=nrpe2nodexp-opensearch_shard_size_check_9400.service\n+# Accuracy sets the maximum time interval around the execution time we want to allow\n+AccuracySec=15sec\n+OnUnitInactiveSec=600min\n+OnActiveSec=1s\n+RandomizedDelaySec=36000\n+FixedRandomDelay=true\n+\n+[Install]\n+WantedBy=multi-user.target", "parameters": "--- File[/lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9400.timer].orig\n+++ File[/lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9400.timer]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9400.timer (nrpe2nodexp-opensearch_shard_size_check_9400.timer)]\n"}, {"resource": "File[/etc/apt/sources.list.d/wikimedia-opensearch-plugins.list]", "parameters": "--- File[/etc/apt/sources.list.d/wikimedia-opensearch-plugins.list].orig\n+++ File[/etc/apt/sources.list.d/wikimedia-opensearch-plugins.list]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n"}, {"resource": "File[/var/log/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]", "parameters": "--- File[/var/log/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200].orig\n+++ File[/var/log/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]\n\n+    owner  => root\n+    group  => root\n+    force  => True\n+    ensure => directory\n+    mode   => 0755\n+    backup => False\n"}, {"resource": "File[/etc/sudoers.d/nrpe-check_opensearch_shard_size_check_9400]", "parameters": "--- File[/etc/sudoers.d/nrpe-check_opensearch_shard_size_check_9400].orig\n+++ File[/etc/sudoers.d/nrpe-check_opensearch_shard_size_check_9400]\n\n+    owner   => root\n+    require => Package[nagios-nrpe-server]\n+    group   => root\n+    ensure  => absent\n"}, {"resource": "File[/etc/rsyslog.d/40-opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.conf]", "content": "--- /etc/rsyslog.d/40-opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.conf.orig\n+++ /etc/rsyslog.d/40-opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.conf\n@@ -0,0 +1,10 @@\n+# rsyslog.conf(5) configuration file for services.\n+# This file is managed by Puppet.\n+if $programname startswith \"opensearch-relforge-eqiad-small-alpha-gc-log-cleanup\" then {\n+    action(\n+        type=\"omfile\" file=\"/var/log/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup/syslog.log\"\n+        fileOwner=\"root\" fileGroup=\"root\"\n+        fileCreateMode=\"0644\"\n+    )\n+    & stop\n+}", "parameters": "--- File[/etc/rsyslog.d/40-opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.conf].orig\n+++ File[/etc/rsyslog.d/40-opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.conf]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Service[rsyslog]\n"}, {"resource": "Systemd::Unit[nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer]", "parameters": "--- Systemd::Unit[nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer].orig\n+++ Systemd::Unit[nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => absent\n+    override_filename => puppet-override.conf\n+    unit              => nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer\n"}, {"resource": "Monitoring::Exported_nagios_service[relforge1008 elasticsearch-https-relforge-eqiad-small-alpha]", "parameters": "--- Monitoring::Exported_nagios_service[relforge1008 elasticsearch-https-relforge-eqiad-small-alpha].orig\n+++ Monitoring::Exported_nagios_service[relforge1008 elasticsearch-https-relforge-eqiad-small-alpha]\n\n+    check_command          => check_ssl_on_port!relforge1008.eqiad.wmnet!9443\n+    retry_interval         => 1\n+    active_checks_enabled  => 1\n+    contact_groups         => team-data-platform,team-discovery\n+    host_name              => relforge1008\n+    check_freshness        => 0\n+    notification_period    => 24x7\n+    servicegroups          => relforge_eqiad\n+    notification_interval  => 0\n+    ensure                 => present\n+    notification_options   => c,r,f\n+    check_interval         => 1\n+    notifications_enabled  => 0\n+    max_check_attempts     => 3\n+    is_volatile            => 0\n+    passive_checks_enabled => 1\n+    check_period           => 24x7\n+    service_description    => Elasticsearch HTTPS for relforge-eqiad-small-alpha\n+    notes_url              => https://wikitech.wikimedia.org/wiki/Search\n"}, {"resource": "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9400.service (nrpe2nodexp-opensearch_unassigned_shard_check_9400.service)]", "parameters": "--- Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9400.service (nrpe2nodexp-opensearch_unassigned_shard_check_9400.service)].orig\n+++ Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9400.service (nrpe2nodexp-opensearch_unassigned_shard_check_9400.service)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "File[/etc/default/opensearch]", "content": "--- /etc/default/opensearch.orig\n+++ /etc/default/opensearch\n@@ -0,0 +1,6 @@\n+# SPDX-License-Identifier: Apache-2.0\n+# Default env file provided by upstream always reset OPENSEARCH_PATH_CONF\n+# when called from /usr/share/opensearch/bin/opensearch-env\n+# only set it when not defined.\n+# This file is still required to set OPENSEARCH_PATH_CONF by postinst scripts\n+OPENSEARCH_PATH_CONF=${OPENSEARCH_PATH_CONF-/etc/opensearch}", "parameters": "--- File[/etc/default/opensearch].orig\n+++ File[/etc/default/opensearch]\n\n+    owner   => root\n+    group   => root\n+    require => Package[opensearch]\n+    mode    => 0444\n+    ensure  => file\n"}, {"resource": "Profile::Prometheus::Elasticsearch_exporter[relforge1008:9400]", "parameters": "--- Profile::Prometheus::Elasticsearch_exporter[relforge1008:9400].orig\n+++ Profile::Prometheus::Elasticsearch_exporter[relforge1008:9400]\n\n+    extra_config       => \n+    prometheus_port    => 9109\n+    elasticsearch_port => 9400\n"}, {"resource": "Class[Profile::Tlsproxy::Instance]", "parameters": "--- Class[Profile::Tlsproxy::Instance].orig\n+++ Class[Profile::Tlsproxy::Instance]\n\n+    ssl_compatibility_mode     => compat\n+    nginx_client_max_body_size => 100m\n+    bootstrap_protection       => False\n+    require                    => ['Class[Profile::Tcp_fast_open]']\n+    numa_iface                 => lo\n+    nginx_variant              => light\n"}, {"resource": "Service[opensearch-hot-threads-log.timer]", "parameters": "--- Service[opensearch-hot-threads-log.timer].orig\n+++ Service[opensearch-hot-threads-log.timer]\n\n+    ensure   => running\n+    provider => systemd\n+    enable   => True\n"}, {"resource": "Systemd::Tmpfile[opensearch-relforge-eqiad-small-alpha]", "parameters": "--- Systemd::Tmpfile[opensearch-relforge-eqiad-small-alpha].orig\n+++ Systemd::Tmpfile[opensearch-relforge-eqiad-small-alpha]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n"}, {"resource": "Rsyslog::Conf[nrpe2nodexp-opensearch_shard_size_check_9400]", "parameters": "--- Rsyslog::Conf[nrpe2nodexp-opensearch_shard_size_check_9400].orig\n+++ Rsyslog::Conf[nrpe2nodexp-opensearch_shard_size_check_9400]\n\n+    mode     => 0444\n+    priority => 25\n+    ensure   => absent\n"}, {"resource": "Systemd::Timer[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]", "parameters": "--- Systemd::Timer[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup].orig\n+++ Systemd::Timer[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]\n\n+    unit_name          => opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service\n+    fixed_random_delay => False\n+    splay              => 0\n+    ensure             => present\n+    timer_intervals    => [{'start': 'OnCalendar', 'interval': '*-*-* 02:12:00'}]\n+    accuracy           => 15sec\n"}, {"resource": "File[/etc/sysctl.d/opensearch.conf]", "content": "--- /etc/sysctl.d/opensearch.conf.orig\n+++ /etc/sysctl.d/opensearch.conf\n@@ -0,0 +1,2 @@\n+# sysctl parameters managed by Puppet.\n+vm.max_map_count = 1048576", "parameters": "--- File[/etc/sysctl.d/opensearch.conf].orig\n+++ File[/etc/sysctl.d/opensearch.conf]\n\n+    owner  => root\n+    notify => Exec[update_sysctl]\n+    group  => root\n+    ensure => present\n"}, {"resource": "File[/etc/opensearch/relforge-eqiad/log4j2.properties]", "content": "--- /etc/opensearch/relforge-eqiad/log4j2.properties.orig\n+++ /etc/opensearch/relforge-eqiad/log4j2.properties\n@@ -0,0 +1,201 @@\n+status = error\n+\n+# log action execution errors for easier debugging\n+logger.action.name = org.opensearch.action\n+logger.action.level = debug\n+\n+appender.console.type = Console\n+appender.console.name = console\n+appender.console.layout.type = PatternLayout\n+appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n\n+\n+######## Server JSON ############################\n+appender.rolling.type = RollingFile\n+appender.rolling.name = rolling\n+appender.rolling.fileName = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs.cluster_name}_server.json\n+appender.rolling.layout.type = OpenSearchJsonLayout\n+appender.rolling.layout.type_name = server\n+\n+appender.rolling.filePattern = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs.cluster_name}-%d{yyyy-MM-dd}-%i.json.gz\n+appender.rolling.policies.type = Policies\n+appender.rolling.policies.time.type = TimeBasedTriggeringPolicy\n+appender.rolling.policies.time.interval = 1\n+appender.rolling.policies.time.modulate = true\n+appender.rolling.policies.size.type = SizeBasedTriggeringPolicy\n+appender.rolling.policies.size.size = 128MB\n+appender.rolling.strategy.type = DefaultRolloverStrategy\n+appender.rolling.strategy.fileIndex = nomax\n+appender.rolling.strategy.action.type = Delete\n+appender.rolling.strategy.action.basepath = ${sys:opensearch.logs.base_path}\n+appender.rolling.strategy.action.condition.type = IfFileName\n+appender.rolling.strategy.action.condition.glob = ${sys:opensearch.logs.cluster_name}-*\n+appender.rolling.strategy.action.condition.nested_condition.type = IfAccumulatedFileSize\n+appender.rolling.strategy.action.condition.nested_condition.exceeds = 2GB\n+################################################\n+######## Server -  old style pattern ###########\n+appender.rolling_old.type = RollingFile\n+appender.rolling_old.name = rolling_old\n+appender.rolling_old.fileName = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs.cluster_name}.log\n+appender.rolling_old.layout.type = PatternLayout\n+appender.rolling_old.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n\n+\n+appender.rolling_old.filePattern = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs.cluster_name}-%d{yyyy-MM-dd}-%i.log.gz\n+appender.rolling_old.policies.type = Policies\n+appender.rolling_old.policies.time.type = TimeBasedTriggeringPolicy\n+appender.rolling_old.policies.time.interval = 1\n+appender.rolling_old.policies.time.modulate = true\n+appender.rolling_old.policies.size.type = SizeBasedTriggeringPolicy\n+appender.rolling_old.policies.size.size = 128MB\n+appender.rolling_old.strategy.type = DefaultRolloverStrategy\n+appender.rolling_old.strategy.fileIndex = nomax\n+appender.rolling_old.strategy.action.type = Delete\n+appender.rolling_old.strategy.action.basepath = ${sys:opensearch.logs.base_path}\n+appender.rolling_old.strategy.action.condition.type = IfFileName\n+appender.rolling_old.strategy.action.condition.glob = ${sys:opensearch.logs.cluster_name}-*\n+appender.rolling_old.strategy.action.condition.nested_condition.type = IfAccumulatedFileSize\n+appender.rolling_old.strategy.action.condition.nested_condition.exceeds = 2GB\n+################################################\n+\n+rootLogger.level = info\n+rootLogger.appenderRef.console.ref = console\n+rootLogger.appenderRef.rolling.ref = rolling\n+rootLogger.appenderRef.rolling_old.ref = rolling_old\n+\n+######## Deprecation JSON #######################\n+appender.deprecation_rolling.type = RollingFile\n+appender.deprecation_rolling.name = deprecation_rolling\n+appender.deprecation_rolling.fileName = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs.cluster_name}_deprecation.json\n+appender.deprecation_rolling.layout.type = OpenSearchJsonLayout\n+appender.deprecation_rolling.layout.type_name = deprecation\n+appender.deprecation_rolling.layout.opensearchmessagefields=x-opaque-id\n+\n+appender.deprecation_rolling.filePattern = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs.cluster_name}_deprecation-%i.json.gz\n+appender.deprecation_rolling.policies.type = Policies\n+appender.deprecation_rolling.policies.size.type = SizeBasedTriggeringPolicy\n+appender.deprecation_rolling.policies.size.size = 1GB\n+appender.deprecation_rolling.strategy.type = DefaultRolloverStrategy\n+appender.deprecation_rolling.strategy.max = 4\n+#################################################\n+######## Deprecation -  old style pattern #######\n+appender.deprecation_rolling_old.type = RollingFile\n+appender.deprecation_rolling_old.name = deprecation_rolling_old\n+appender.deprecation_rolling_old.fileName = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs.cluster_name}_deprecation.log\n+appender.deprecation_rolling_old.layout.type = PatternLayout\n+appender.deprecation_rolling_old.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n\n+\n+appender.deprecation_rolling_old.filePattern = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs.cluster_name}\\\n+  _deprecation-%i.log.gz\n+appender.deprecation_rolling_old.policies.type = Policies\n+appender.deprecation_rolling_old.policies.size.type = SizeBasedTriggeringPolicy\n+appender.deprecation_rolling_old.policies.size.size = 1GB\n+appender.deprecation_rolling_old.strategy.type = DefaultRolloverStrategy\n+appender.deprecation_rolling_old.strategy.max = 4\n+#################################################\n+logger.deprecation.name = org.opensearch.deprecation\n+logger.deprecation.level = warn\n+logger.deprecation.appenderRef.deprecation_rolling.ref = deprecation_rolling\n+logger.deprecation.appenderRef.deprecation_rolling_old.ref = deprecation_rolling_old\n+logger.deprecation.additivity = false\n+\n+######## Search slowlog JSON ####################\n+appender.index_search_slowlog_rolling.type = RollingFile\n+appender.index_search_slowlog_rolling.name = index_search_slowlog_rolling\n+appender.index_search_slowlog_rolling.fileName = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs\\\n+  .cluster_name}_index_search_slowlog.json\n+appender.index_search_slowlog_rolling.layout.type = OpenSearchJsonLayout\n+appender.index_search_slowlog_rolling.layout.type_name = index_search_slowlog\n+appender.index_search_slowlog_rolling.layout.opensearchmessagefields=message,took,took_millis,total_hits,types,stats,search_type,total_shards,source,id\n+\n+appender.index_search_slowlog_rolling.filePattern = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs\\\n+  .cluster_name}_index_search_slowlog-%i.json.gz\n+appender.index_search_slowlog_rolling.policies.type = Policies\n+appender.index_search_slowlog_rolling.policies.size.type = SizeBasedTriggeringPolicy\n+appender.index_search_slowlog_rolling.policies.size.size = 1GB\n+appender.index_search_slowlog_rolling.strategy.type = DefaultRolloverStrategy\n+appender.index_search_slowlog_rolling.strategy.max = 4\n+#################################################\n+######## Search slowlog -  old style pattern ####\n+appender.index_search_slowlog_rolling_old.type = RollingFile\n+appender.index_search_slowlog_rolling_old.name = index_search_slowlog_rolling_old\n+appender.index_search_slowlog_rolling_old.fileName = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs.cluster_name}\\\n+  _index_search_slowlog.log\n+appender.index_search_slowlog_rolling_old.layout.type = PatternLayout\n+appender.index_search_slowlog_rolling_old.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n\n+\n+appender.index_search_slowlog_rolling_old.filePattern = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs.cluster_name}\\\n+  _index_search_slowlog-%i.log.gz\n+appender.index_search_slowlog_rolling_old.policies.type = Policies\n+appender.index_search_slowlog_rolling_old.policies.size.type = SizeBasedTriggeringPolicy\n+appender.index_search_slowlog_rolling_old.policies.size.size = 1GB\n+appender.index_search_slowlog_rolling_old.strategy.type = DefaultRolloverStrategy\n+appender.index_search_slowlog_rolling_old.strategy.max = 4\n+#################################################\n+logger.index_search_slowlog_rolling.name = index.search.slowlog\n+logger.index_search_slowlog_rolling.level = trace\n+logger.index_search_slowlog_rolling.appenderRef.index_search_slowlog_rolling.ref = index_search_slowlog_rolling\n+logger.index_search_slowlog_rolling.appenderRef.index_search_slowlog_rolling_old.ref = index_search_slowlog_rolling_old\n+logger.index_search_slowlog_rolling.additivity = false\n+\n+######## Indexing slowlog JSON ##################\n+appender.index_indexing_slowlog_rolling.type = RollingFile\n+appender.index_indexing_slowlog_rolling.name = index_indexing_slowlog_rolling\n+appender.index_indexing_slowlog_rolling.fileName = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs.cluster_name}\\\n+  _index_indexing_slowlog.json\n+appender.index_indexing_slowlog_rolling.layout.type = OpenSearchJsonLayout\n+appender.index_indexing_slowlog_rolling.layout.type_name = index_indexing_slowlog\n+appender.index_indexing_slowlog_rolling.layout.opensearchmessagefields=message,took,took_millis,doc_type,id,routing,source\n+\n+appender.index_indexing_slowlog_rolling.filePattern = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs.cluster_name}\\\n+  _index_indexing_slowlog-%i.json.gz\n+appender.index_indexing_slowlog_rolling.policies.type = Policies\n+appender.index_indexing_slowlog_rolling.policies.size.type = SizeBasedTriggeringPolicy\n+appender.index_indexing_slowlog_rolling.policies.size.size = 1GB\n+appender.index_indexing_slowlog_rolling.strategy.type = DefaultRolloverStrategy\n+appender.index_indexing_slowlog_rolling.strategy.max = 4\n+#################################################\n+######## Indexing slowlog -  old style pattern ##\n+appender.index_indexing_slowlog_rolling_old.type = RollingFile\n+appender.index_indexing_slowlog_rolling_old.name = index_indexing_slowlog_rolling_old\n+appender.index_indexing_slowlog_rolling_old.fileName = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs.cluster_name}\\\n+  _index_indexing_slowlog.log\n+appender.index_indexing_slowlog_rolling_old.layout.type = PatternLayout\n+appender.index_indexing_slowlog_rolling_old.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n\n+\n+appender.index_indexing_slowlog_rolling_old.filePattern = ${sys:opensearch.logs.base_path}${sys:file.separator}${sys:opensearch.logs.cluster_name}\\\n+  _index_indexing_slowlog-%i.log.gz\n+appender.index_indexing_slowlog_rolling_old.policies.type = Policies\n+appender.index_indexing_slowlog_rolling_old.policies.size.type = SizeBasedTriggeringPolicy\n+appender.index_indexing_slowlog_rolling_old.policies.size.size = 1GB\n+appender.index_indexing_slowlog_rolling_old.strategy.type = DefaultRolloverStrategy\n+appender.index_indexing_slowlog_rolling_old.strategy.max = 4\n+#################################################\n+\n+logger.index_indexing_slowlog.name = index.indexing.slowlog.index\n+logger.index_indexing_slowlog.level = trace\n+logger.index_indexing_slowlog.appenderRef.index_indexing_slowlog_rolling.ref = index_indexing_slowlog_rolling\n+logger.index_indexing_slowlog.appenderRef.index_indexing_slowlog_rolling_old.ref = index_indexing_slowlog_rolling_old\n+logger.index_indexing_slowlog.additivity = false\n+\n+\n+### Custom settings\n+monitorInterval=600\n+\n+# Add references to Logstash appender for interesting loggers\n+\n+rootLogger.appenderRef.ship_to_logstash.ref = ship_to_logstash\n+logger.index_indexing_slowlog.appenderRef.ship_to_logstash.ref = ship_to_logstash\n+logger.index_search_slowlog_rolling.appenderRef.ship_to_logstash.ref = ship_to_logstash\n+logger.index_search_slowlog_rolling.appenderRef.ship_to_logstash.ref = ship_to_logstash\n+\n+# Define Logstash appender\n+appender.ship_to_logstash.name=ship_to_logstash\n+appender.ship_to_logstash.type=syslog\n+appender.ship_to_logstash.protocol=udp\n+appender.ship_to_logstash.facility=LOCAL0\n+appender.ship_to_logstash.layout.type=OpenSearchJsonLayout\n+appender.ship_to_logstash.layout.compact=true\n+appender.ship_to_logstash.layout.complete=true\n+appender.ship_to_logstash.host=localhost\n+appender.ship_to_logstash.port=11514\n+appender.ship_to_logstash.layout.type_name=opensearch\n+", "parameters": "--- File[/etc/opensearch/relforge-eqiad/log4j2.properties].orig\n+++ File[/etc/opensearch/relforge-eqiad/log4j2.properties]\n\n+    owner  => root\n+    mode   => 0444\n+    group  => root\n+    ensure => file\n"}, {"resource": "File[/etc/logrotate.d/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]", "content": "--- /etc/logrotate.d/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.orig\n+++ /etc/logrotate.d/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup\n@@ -0,0 +1,12 @@\n+# logrotate(8) config for opensearch-relforge-eqiad-small-alpha-gc-log-cleanup\n+\n+/var/log/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup/*.log {\n+    daily\n+    copytruncate\n+    missingok\n+    compress\n+    delaycompress\n+    notifempty\n+    rotate 15\n+    size 256M\n+}", "parameters": "--- File[/etc/logrotate.d/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup].orig\n+++ File[/etc/logrotate.d/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]\n\n+    owner  => root\n+    mode   => 0444\n+    group  => root\n+    ensure => present\n"}, {"resource": "File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet-key.pem]", "parameters": "--- File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet-key.pem].orig\n+++ File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet-key.pem]\n\n+    owner     => root\n+    backup    => False\n+    group     => root\n+    ensure    => file\n+    mode      => 0440\n+    show_diff => False\n+    notify    => ['Exec[nginx-reload]', 'Exec[nginx-reload]']\n"}, {"resource": "Cfssl::Csr[/etc/cfssl/csr/discovery2026__relforge1008_eqiad_wmnet.csr]", "parameters": "--- Cfssl::Csr[/etc/cfssl/csr/discovery2026__relforge1008_eqiad_wmnet.csr].orig\n+++ Cfssl::Csr[/etc/cfssl/csr/discovery2026__relforge1008_eqiad_wmnet.csr]\n\n+    key         => {'algo': 'ecdsa', 'size': 256}\n+    ensure      => present\n+    names       => []\n+    common_name => relforge1008.eqiad.wmnet\n+    hosts       => ['relforge.svc.eqiad.wmnet']\n"}, {"resource": "Service[opensearch]", "parameters": "--- Service[opensearch].orig\n+++ Service[opensearch]\n\n+    ensure  => stopped\n+    require => Package[opensearch]\n+    enable  => False\n"}, {"resource": "File[/lib/systemd/system/nrpe2nodexp-opensearch_shards_9400.service]", "content": "--- /lib/systemd/system/nrpe2nodexp-opensearch_shards_9400.service.orig\n+++ /lib/systemd/system/nrpe2nodexp-opensearch_shards_9400.service\n@@ -0,0 +1,11 @@\n+[Unit]\n+Description=execution of nrpe2nodexp for the check_opensearch_shards_9400 command.\n+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+\n+[Service]\n+Type=oneshot\n+User=nagios\n+\n+Group=prometheus-node-exporter\n+SyslogIdentifier=nrpe2nodexp-opensearch_shards_9400\n+ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash \"2a63eb7dcbe368b7f538118765d629d6\" --timeout 10 --check-command \"check_opensearch_shards_9400\"", "parameters": "--- File[/lib/systemd/system/nrpe2nodexp-opensearch_shards_9400.service].orig\n+++ File[/lib/systemd/system/nrpe2nodexp-opensearch_shards_9400.service]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9400.service (nrpe2nodexp-opensearch_shards_9400.service)]\n"}, {"resource": "Sudo::User[nrpe-check_check_push_cross_cluster_settings_9400_status]", "parameters": "--- Sudo::User[nrpe-check_check_push_cross_cluster_settings_9400_status].orig\n+++ Sudo::User[nrpe-check_check_push_cross_cluster_settings_9400_status]\n\n+    privileges => []\n+    tag        => nrpe::check\n+    user       => nagios\n+    require    => ['Class[Sudo]']\n+    ensure     => absent\n"}, {"resource": "Systemd::Service[wmf_auto_restart_prometheus-elasticsearch-exporter-9400]", "parameters": "--- Systemd::Service[wmf_auto_restart_prometheus-elasticsearch-exporter-9400].orig\n+++ Systemd::Service[wmf_auto_restart_prometheus-elasticsearch-exporter-9400]\n\n+    override                 => False\n+    restart                  => False\n+    require                  => Systemd::Unit[wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service]\n+    ensure                   => present\n+    unit_type                => timer\n+    migration_task           => T407130\n+    monitoring_enabled       => False\n+    monitoring_contact_group => admins\n+    service_params           => {}\n+    monitoring_critical      => False\n"}, {"resource": "Service[nrpe2nodexp-opensearch_shard_size_check_9200.timer]", "parameters": "--- Service[nrpe2nodexp-opensearch_shard_size_check_9200.timer].orig\n+++ Service[nrpe2nodexp-opensearch_shard_size_check_9200.timer]\n\n+    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9200.timer (nrpe2nodexp-opensearch_shard_size_check_9200.timer)]']\n+    provider => systemd\n+    enable   => False\n+    ensure   => stopped\n"}, {"resource": "File[/lib/systemd/system/opensearch-hot-threads-log.service]", "content": "--- /lib/systemd/system/opensearch-hot-threads-log.service.orig\n+++ /lib/systemd/system/opensearch-hot-threads-log.service\n@@ -0,0 +1,8 @@\n+[Unit]\n+Description=Archive exception logs of hot opensearch threads\n+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+\n+[Service]\n+Type=oneshot\n+User=opensearch\n+ExecStart=/usr/local/bin/opensearch_hot_threads_logger.py", "parameters": "--- File[/lib/systemd/system/opensearch-hot-threads-log.service].orig\n+++ File[/lib/systemd/system/opensearch-hot-threads-log.service]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for opensearch-hot-threads-log.service (opensearch-hot-threads-log.service)]\n"}, {"resource": "Systemd::Unit[clean_up_dlq.timer]", "parameters": "--- Systemd::Unit[clean_up_dlq.timer].orig\n+++ Systemd::Unit[clean_up_dlq.timer]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => absent\n+    override_filename => puppet-override.conf\n+    unit              => clean_up_dlq.timer\n"}, {"resource": "Nrpe::Monitor_service[opensearch_shard_size_check_9400]", "parameters": "--- Nrpe::Monitor_service[opensearch_shard_size_check_9400].orig\n+++ Nrpe::Monitor_service[opensearch_shard_size_check_9400]\n\n+    retry_interval              => 180\n+    check_interval              => 1440\n+    ensure                      => present\n+    migration_task              => T371083\n+    contact_group               => admins,team-discovery\n+    nrpe_command                => /usr/lib/nagios/plugins/check_elasticsearch_shard_size.py --url http://localhost:9400 --shard-size-warning 110 --shard-size-critical 140 --timeout 4\n+    enable_nrpe2nodexp          => False\n+    critical                    => False\n+    alertmanager_team           => observability\n+    retries                     => 3\n+    nrpe2nodexp_parse_perf_data => False\n+    enable_icinga_check         => True\n+    timeout                     => 10\n+    description                 => OpenSearch shard size check - 9400\n+    notes_url                   => https://wikitech.wikimedia.org/wiki/Search#If_it_has_been_indexed\n"}, {"resource": "Systemd::Timer[opensearch-disable-readahead-relforge-eqiad-small-alpha]", "parameters": "--- Systemd::Timer[opensearch-disable-readahead-relforge-eqiad-small-alpha].orig\n+++ Systemd::Timer[opensearch-disable-readahead-relforge-eqiad-small-alpha]\n\n+    unit_name          => opensearch-disable-readahead-relforge-eqiad-small-alpha.service\n+    fixed_random_delay => False\n+    splay              => 0\n+    ensure             => present\n+    timer_intervals    => [{'start': 'OnUnitActiveSec', 'interval': '30min'}, {'start': 'OnBootSec', 'interval': '1min'}]\n+    accuracy           => 15sec\n"}, {"resource": "File[/etc/ssl/dhparam.pem]", "parameters": "--- File[/etc/ssl/dhparam.pem].orig\n+++ File[/etc/ssl/dhparam.pem]\n\n+    owner  => root\n+    source => puppet:///modules/sslcert/dhparam.pem\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n"}, {"resource": "Concat::Fragment[wikimedia-opensearch-header]", "parameters": "--- Concat::Fragment[wikimedia-opensearch-header].orig\n+++ Concat::Fragment[wikimedia-opensearch-header]\n\n+    source => puppet:///modules/apt/sources-deb822-header.txt\n+    target => /etc/apt/sources.list.d/wikimedia-opensearch.sources\n+    order  => 01\n"}, {"resource": "Nrpe::Plugin[check_systemd_unit_status]", "parameters": "--- Nrpe::Plugin[check_systemd_unit_status].orig\n+++ Nrpe::Plugin[check_systemd_unit_status]\n\n+    source => puppet:///modules/systemd/check_systemd_unit_status\n+    ensure => present\n"}, {"resource": "Rsyslog::Conf[nrpe2nodexp-opensearch_shards_9200]", "parameters": "--- Rsyslog::Conf[nrpe2nodexp-opensearch_shards_9200].orig\n+++ Rsyslog::Conf[nrpe2nodexp-opensearch_shards_9200]\n\n+    mode     => 0444\n+    priority => 25\n+    ensure   => absent\n"}, {"resource": "Systemd::Unit[opensearch-disable-readahead-relforge-eqiad-small-alpha.timer]", "parameters": "--- Systemd::Unit[opensearch-disable-readahead-relforge-eqiad-small-alpha.timer].orig\n+++ Systemd::Unit[opensearch-disable-readahead-relforge-eqiad-small-alpha.timer]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => present\n+    override_filename => puppet-override.conf\n+    unit              => opensearch-disable-readahead-relforge-eqiad-small-alpha.timer\n"}, {"resource": "File[/lib/systemd/system/opensearch-disable-readahead-relforge-eqiad-small-alpha.timer]", "content": "--- /lib/systemd/system/opensearch-disable-readahead-relforge-eqiad-small-alpha.timer.orig\n+++ /lib/systemd/system/opensearch-disable-readahead-relforge-eqiad-small-alpha.timer\n@@ -0,0 +1,13 @@\n+[Unit]\n+Description=Periodic execution of opensearch-disable-readahead-relforge-eqiad-small-alpha.service\n+\n+[Timer]\n+Unit=opensearch-disable-readahead-relforge-eqiad-small-alpha.service\n+# Accuracy sets the maximum time interval around the execution time we want to allow\n+AccuracySec=15sec\n+OnUnitActiveSec=30min\n+OnBootSec=1min\n+RandomizedDelaySec=0\n+\n+[Install]\n+WantedBy=multi-user.target", "parameters": "--- File[/lib/systemd/system/opensearch-disable-readahead-relforge-eqiad-small-alpha.timer].orig\n+++ File[/lib/systemd/system/opensearch-disable-readahead-relforge-eqiad-small-alpha.timer]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for opensearch-disable-readahead-relforge-eqiad-small-alpha.timer (opensearch-disable-readahead-relforge-eqiad-small-alpha.timer)]\n"}, {"resource": "Systemd::Timer[push_cross_cluster_settings_9400]", "parameters": "--- Systemd::Timer[push_cross_cluster_settings_9400].orig\n+++ Systemd::Timer[push_cross_cluster_settings_9400]\n\n+    unit_name          => push_cross_cluster_settings_9400.service\n+    fixed_random_delay => False\n+    splay              => 0\n+    ensure             => present\n+    timer_intervals    => [{'start': 'OnUnitActiveSec', 'interval': '15min'}, {'interval': '1s', 'start': 'OnActiveSec'}]\n+    accuracy           => 15sec\n"}, {"resource": "Opensearch::Cross_cluster_settings[relforge-eqiad]", "parameters": "--- Opensearch::Cross_cluster_settings[relforge-eqiad].orig\n+++ Opensearch::Cross_cluster_settings[relforge-eqiad]\n\n+    enable_remote_search => False\n+    instance_name        => relforge-eqiad\n+    settings             => {'relforge-eqiad': {'awareness_attributes': 'row', 'recover_after_nodes': 1, 'recover_after_time': '1m', 'search_shard_count_limit': 1000, 'reindex_remote_whitelist': 'search.svc.eqiad.wmnet:9243,search.svc.codfw.wmnet:9243', 'bulk_thread_pool_executors': 32, 'bulk_thread_pool_capacity': 1000, 'ltr_cache_size': '100mb', 'auto_create_index': True, 'plugins_mandatory': ['analysis-hebrew', 'analysis-icu', 'analysis-smartcn', 'analysis-stempel', 'analysis-ukrainian', 'cirrus-highlighter', 'opensearch-analysis-stconvert', 'opensearch-extra', 'opensearch-extra-analysis-esperanto', 'opensearch-extra-analysis-serbian', 'opensearch-extra-analysis-slovak', 'ltr'], 'filter_cache_size': '20%', 'script_max_compilations_per_minute': 10000, 'send_logs_to_logstash': True, 'disable_security_plugin': True, 'unicast_hosts': ['relforge1008.eqiad.wmnet', 'relforge1009.eqiad.wmnet', 'relforge1010.eqiad.wmnet'], 'cluster_hosts': ['relforge1008.eqiad.wmnet', 'relforge1009.eqiad.wmnet', 'relforge1010.eqiad.wmnet'], 'expected_nodes': 2, 'cluster_name': 'relforge-eqiad', 'short_cluster_name': 'chi', 'heap_memory': '30G', 'http_port': 9200, 'tls_port': 9243, 'transport_tcp_port': 9300, 'certificate_name': 'relforge.svc.eqiad.wmnet'}, 'relforge-eqiad-small-alpha': {'awareness_attributes': 'row', 'recover_after_nodes': 1, 'recover_after_time': '1m', 'search_shard_count_limit': 1000, 'reindex_remote_whitelist': 'search.svc.eqiad.wmnet:9243,search.svc.codfw.wmnet:9243', 'bulk_thread_pool_executors': 32, 'bulk_thread_pool_capacity': 1000, 'ltr_cache_size': '100mb', 'auto_create_index': True, 'plugins_mandatory': ['analysis-hebrew', 'analysis-icu', 'analysis-smartcn', 'analysis-stempel', 'analysis-ukrainian', 'cirrus-highlighter', 'opensearch-analysis-stconvert', 'opensearch-extra', 'opensearch-extra-analysis-esperanto', 'opensearch-extra-analysis-serbian', 'opensearch-extra-analysis-slovak', 'ltr'], 'filter_cache_size': '20%', 'script_max_compilations_per_minute': 10000, 'send_logs_to_logstash': True, 'disable_security_plugin': True, 'unicast_hosts': ['relforge1008.eqiad.wmnet', 'relforge1009.eqiad.wmnet', 'relforge1010.eqiad.wmnet'], 'cluster_hosts': ['relforge1008.eqiad.wmnet', 'relforge1009.eqiad.wmnet', 'relforge1010.eqiad.wmnet'], 'expected_nodes': 2, 'cluster_name': 'relforge-eqiad-small-alpha', 'short_cluster_name': 'omega', 'heap_memory': '4G', 'http_port': 9400, 'tls_port': 9443, 'transport_tcp_port': 9500, 'certificate_name': 'relforge.svc.eqiad.wmnet'}}\n"}, {"resource": "Systemd::Service[nrpe2nodexp-opensearch_shards_9400]", "parameters": "--- Systemd::Service[nrpe2nodexp-opensearch_shards_9400].orig\n+++ Systemd::Service[nrpe2nodexp-opensearch_shards_9400]\n\n+    override                 => False\n+    restart                  => False\n+    require                  => Systemd::Unit[nrpe2nodexp-opensearch_shards_9400.service]\n+    ensure                   => absent\n+    unit_type                => timer\n+    migration_task           => T407130\n+    monitoring_enabled       => False\n+    monitoring_contact_group => admins\n+    service_params           => {}\n+    monitoring_critical      => False\n"}, {"resource": "Nrpe::Check[check_disk_space]", "parameters": "--- Nrpe::Check[check_disk_space].orig\n+++ Nrpe::Check[check_disk_space]\n\n@@\n-    command => /usr/lib/nagios/plugins/check_disk -w 6% -c 3% -W 6% -K 3% -l -e -A -i \"/srv/sd[a-b][1-3]\" -i \"/srv/nvme[0-9]n[0-9]p[0-9]\" --exclude-type=fuse --exclude-type=fuse.fuse_dfs --exclude-type=tracefs\n+    command => /usr/lib/nagios/plugins/check_disk -w 15% -c 10% -W 6% -K 3% -l -e -A -i \"/srv/sd[a-b][1-3]\" --exclude-type=tracefs\n"}, {"resource": "Concat::Fragment[wikimedia-opensearch]", "parameters": "--- Concat::Fragment[wikimedia-opensearch].orig\n+++ Concat::Fragment[wikimedia-opensearch]\n\n+    target => /etc/apt/sources.list.d/wikimedia-opensearch.sources\n+    order  => 10\n"}, {"resource": "Nrpe::Monitor_service[opensearch_unassigned_shard_check_9200]", "parameters": "--- Nrpe::Monitor_service[opensearch_unassigned_shard_check_9200].orig\n+++ Nrpe::Monitor_service[opensearch_unassigned_shard_check_9200]\n\n+    retry_interval              => 120\n+    check_interval              => 720\n+    ensure                      => present\n+    migration_task              => T371083\n+    contact_group               => admins,team-discovery\n+    nrpe_command                => /usr/lib/nagios/plugins/check_elasticsearch_unassigned_shards.py --url http://localhost:9200 --timeout 4\n+    enable_nrpe2nodexp          => False\n+    critical                    => False\n+    alertmanager_team           => observability\n+    retries                     => 1\n+    nrpe2nodexp_parse_perf_data => False\n+    enable_icinga_check         => True\n+    timeout                     => 10\n+    description                 => OpenSearch unassigned shard check - 9200\n+    notes_url                   => https://wikitech.wikimedia.org/wiki/Search#Administration\n"}, {"resource": "Rsyslog::Conf[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]", "parameters": "--- Rsyslog::Conf[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup].orig\n+++ Rsyslog::Conf[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]\n\n+    mode     => 0444\n+    priority => 40\n+    require  => File[/var/log/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]\n+    ensure   => present\n"}, {"resource": "Exec[systemd daemon-reload for opensearch-relforge-eqiad-gc-log-cleanup.service (opensearch-relforge-eqiad-gc-log-cleanup.service)]", "parameters": "--- Exec[systemd daemon-reload for opensearch-relforge-eqiad-gc-log-cleanup.service (opensearch-relforge-eqiad-gc-log-cleanup.service)].orig\n+++ Exec[systemd daemon-reload for opensearch-relforge-eqiad-gc-log-cleanup.service (opensearch-relforge-eqiad-gc-log-cleanup.service)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Ferm::Service[elastic-small-alpha-https-9443]", "parameters": "--- Ferm::Service[elastic-small-alpha-https-9443].orig\n+++ Ferm::Service[elastic-small-alpha-https-9443]\n\n+    unrestricted_access => False\n+    ensure              => present\n+    notrack             => False\n+    srange              => (10.64.16.154 2620:0:861:102:10:64:16:154 10.192.32.49 2620:0:860:103:10:192:32:49)\n+    prio                => 10\n+    desc                => \n+    port                => 9443\n+    proto               => tcp\n"}, {"resource": "Systemd::Timer[clean_up_dlq]", "parameters": "--- Systemd::Timer[clean_up_dlq].orig\n+++ Systemd::Timer[clean_up_dlq]\n\n+    unit_name          => clean_up_dlq.service\n+    fixed_random_delay => False\n+    splay              => 0\n+    ensure             => absent\n+    timer_intervals    => [{'start': 'OnCalendar', 'interval': '1h'}]\n+    accuracy           => 15sec\n"}, {"resource": "Concat_fragment[wikimedia-opensearch-plugins]", "content": "--- wikimedia-opensearch-plugins.orig\n+++ wikimedia-opensearch-plugins\n@@ -0,0 +1,5 @@\n+Types: deb deb-src\n+URIs: http://apt.wikimedia.org/wikimedia\n+Suites: bookworm-wikimedia\n+Components: component/opensearch13\n+Signed-By: /etc/apt/keyrings/wikimedia-archive-keyring.gpg", "parameters": "--- Concat_fragment[wikimedia-opensearch-plugins].orig\n+++ Concat_fragment[wikimedia-opensearch-plugins]\n\n+    target => /etc/apt/sources.list.d/wikimedia-opensearch-plugins.sources\n+    tag    => _etc_apt_sources.list.d_wikimedia-opensearch-plugins.sources\n+    order  => 10\n"}, {"resource": "Rsyslog::Conf[opensearch-disable-readahead-relforge-eqiad-small-alpha]", "parameters": "--- Rsyslog::Conf[opensearch-disable-readahead-relforge-eqiad-small-alpha].orig\n+++ Rsyslog::Conf[opensearch-disable-readahead-relforge-eqiad-small-alpha]\n\n+    mode     => 0444\n+    priority => 40\n+    require  => File[/var/log/opensearch-disable-readahead-relforge-eqiad-small-alpha]\n+    ensure   => present\n"}, {"resource": "File[/etc/default/prometheus-elasticsearch-exporter]", "parameters": "--- File[/etc/default/prometheus-elasticsearch-exporter].orig\n+++ File[/etc/default/prometheus-elasticsearch-exporter]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n"}, {"resource": "Sudo::User[nrpe-check_opensearch_shards_9400]", "parameters": "--- Sudo::User[nrpe-check_opensearch_shards_9400].orig\n+++ Sudo::User[nrpe-check_opensearch_shards_9400]\n\n+    privileges => []\n+    tag        => nrpe::check\n+    user       => nagios\n+    require    => ['Class[Sudo]']\n+    ensure     => absent\n"}, {"resource": "Service[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer]", "parameters": "--- Service[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer].orig\n+++ Service[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer]\n\n+    ensure   => running\n+    provider => systemd\n+    enable   => True\n"}, {"resource": "File[/etc/rsyslog.d/25-nrpe2nodexp-check-push-cross-cluster-settings-9400-status.conf]", "content": "--- /etc/rsyslog.d/25-nrpe2nodexp-check-push-cross-cluster-settings-9400-status.conf.orig\n+++ /etc/rsyslog.d/25-nrpe2nodexp-check-push-cross-cluster-settings-9400-status.conf\n@@ -0,0 +1,10 @@\n+# SPDX-License-Identifier: Apache-2.0\n+if $programname contains \"nrpe2nodexp-check_push_cross_cluster_settings_9400_status\" then {\n+    if ($msg contains \"\\\"ecs.version\\\": \\\"1.7.0\\\"\") then {\n+        # Send logs to kafka\n+        set $.log_outputs = \"kafka ecs_170 local\";\n+    } else {\n+        # Filter out non-relevant nrpe2nodexp messages\n+        stop\n+    }\n+}", "parameters": "--- File[/etc/rsyslog.d/25-nrpe2nodexp-check-push-cross-cluster-settings-9400-status.conf].orig\n+++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-push-cross-cluster-settings-9400-status.conf]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Service[rsyslog]\n"}, {"resource": "File[/var/log/opensearch-disable-readahead-relforge-eqiad]", "parameters": "--- File[/var/log/opensearch-disable-readahead-relforge-eqiad].orig\n+++ File[/var/log/opensearch-disable-readahead-relforge-eqiad]\n\n+    owner  => root\n+    group  => root\n+    force  => True\n+    ensure => directory\n+    mode   => 0755\n+    backup => False\n"}, {"resource": "File[/etc/nagios/nrpe.d/check_disk_space.cfg]", "content": "--- /etc/nagios/nrpe.d/check_disk_space.cfg.orig\n+++ /etc/nagios/nrpe.d/check_disk_space.cfg\n@@ -1,2 +1,2 @@\n # File generated by puppet. DO NOT edit by hand\n-command[check_disk_space]=/usr/lib/nagios/plugins/check_disk -w 6% -c 3% -W 6% -K 3% -l -e -A -i \"/srv/sd[a-b][1-3]\" -i \"/srv/nvme[0-9]n[0-9]p[0-9]\" --exclude-type=fuse --exclude-type=fuse.fuse_dfs --exclude-type=tracefs\n+command[check_disk_space]=/usr/lib/nagios/plugins/check_disk -w 15% -c 10% -W 6% -K 3% -l -e -A -i \"/srv/sd[a-b][1-3]\" --exclude-type=tracefs"}, {"resource": "Exec[mask_nginx.service]", "parameters": "--- Exec[mask_nginx.service].orig\n+++ Exec[mask_nginx.service]\n\n+    command => /bin/systemctl mask nginx.service\n+    unless  => /usr/bin/dpkg -s nginx-light | /bin/grep -q '^Status: install ok installed$'\n+    creates => /etc/systemd/system/nginx.service\n"}, {"resource": "File[/usr/lib/nagios/plugins/check_elasticsearch_shard_size.py]", "parameters": "--- File[/usr/lib/nagios/plugins/check_elasticsearch_shard_size.py].orig\n+++ File[/usr/lib/nagios/plugins/check_elasticsearch_shard_size.py]\n\n+    owner  => root\n+    mode   => 0755\n+    group  => root\n+    source => puppet:///modules/icinga/elasticsearch/check_elasticsearch_shard_size.py\n"}, {"resource": "Systemd::Syslog[opensearch-disable-readahead-relforge-eqiad-small-alpha]", "parameters": "--- Systemd::Syslog[opensearch-disable-readahead-relforge-eqiad-small-alpha].orig\n+++ Systemd::Syslog[opensearch-disable-readahead-relforge-eqiad-small-alpha]\n\n+    readable_by            => all\n+    force_stop             => True\n+    ensure                 => present\n+    programname_comparison => startswith\n+    log_filename           => syslog.log\n+    owner                  => root\n+    group                  => root\n+    base_dir               => /var/log\n"}, {"resource": "Monitoring::Service[check_push_cross_cluster_settings_9200_status]", "parameters": "--- Monitoring::Service[check_push_cross_cluster_settings_9200_status].orig\n+++ Monitoring::Service[check_push_cross_cluster_settings_9200_status]\n\n+    check_command  => nrpe_check!check_check_push_cross_cluster_settings_9200_status!10\n+    retry_interval => 1\n+    freshness      => 36000\n+    ensure         => present\n+    check_interval => 10\n+    config_dir     => /etc/nagios\n+    migration_task => T407130\n+    contact_group  => admins\n+    host           => relforge1008\n+    critical       => False\n+    retries        => 2\n+    passive        => False\n+    description    => Check unit status of push_cross_cluster_settings_9200\n+    notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n"}, {"resource": "File[/etc/apt/sources.list.d/wikimedia-opensearch.list]", "parameters": "--- File[/etc/apt/sources.list.d/wikimedia-opensearch.list].orig\n+++ File[/etc/apt/sources.list.d/wikimedia-opensearch.list]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n"}, {"resource": "Ferm::Service[opensearch-https-9443]", "parameters": "--- Ferm::Service[opensearch-https-9443].orig\n+++ Ferm::Service[opensearch-https-9443]\n\n+    unrestricted_access => False\n+    ensure              => present\n+    notrack             => False\n+    srange              => (($CUMIN_MASTERS $ANALYTICS_NETWORKS $STAGING_KUBEPODS_NETWORKS))\n+    prio                => 10\n+    desc                => \n+    port                => 9443\n+    proto               => tcp\n"}, {"resource": "File[/etc/rsyslog.d/40-wmf-auto-restart-prometheus-elasticsearch-exporter-9400.conf]", "content": "--- /etc/rsyslog.d/40-wmf-auto-restart-prometheus-elasticsearch-exporter-9400.conf.orig\n+++ /etc/rsyslog.d/40-wmf-auto-restart-prometheus-elasticsearch-exporter-9400.conf\n@@ -0,0 +1,10 @@\n+# rsyslog.conf(5) configuration file for services.\n+# This file is managed by Puppet.\n+if $programname startswith \"wmf_auto_restart_prometheus-elasticsearch-exporter-9400\" then {\n+    action(\n+        type=\"omfile\" file=\"/var/log/wmf_auto_restart_prometheus-elasticsearch-exporter-9400/syslog.log\"\n+        fileOwner=\"root\" fileGroup=\"root\"\n+        fileCreateMode=\"0644\"\n+    )\n+    & stop\n+}", "parameters": "--- File[/etc/rsyslog.d/40-wmf-auto-restart-prometheus-elasticsearch-exporter-9400.conf].orig\n+++ File[/etc/rsyslog.d/40-wmf-auto-restart-prometheus-elasticsearch-exporter-9400.conf]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Service[rsyslog]\n"}, {"resource": "Systemd::Unit[push_cross_cluster_settings_9200.timer]", "parameters": "--- Systemd::Unit[push_cross_cluster_settings_9200.timer].orig\n+++ Systemd::Unit[push_cross_cluster_settings_9200.timer]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => present\n+    override_filename => puppet-override.conf\n+    unit              => push_cross_cluster_settings_9200.timer\n"}, {"resource": "Exec[mask_default_prometheus_elasticsearch_exporter]", "parameters": "--- Exec[mask_default_prometheus_elasticsearch_exporter].orig\n+++ Exec[mask_default_prometheus_elasticsearch_exporter]\n\n+    command => /bin/systemctl mask prometheus-elasticsearch-exporter.service\n+    creates => /etc/systemd/system/prometheus-elasticsearch-exporter.service\n"}, {"resource": "Systemd::Unit[prometheus-elasticsearch-exporter-9200]", "parameters": "--- Systemd::Unit[prometheus-elasticsearch-exporter-9200].orig\n+++ Systemd::Unit[prometheus-elasticsearch-exporter-9200]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => present\n+    override_filename => puppet-override.conf\n+    unit              => prometheus-elasticsearch-exporter-9200\n"}, {"resource": "Service[opensearch-disable-readahead-relforge-eqiad-small-alpha.timer]", "parameters": "--- Service[opensearch-disable-readahead-relforge-eqiad-small-alpha.timer].orig\n+++ Service[opensearch-disable-readahead-relforge-eqiad-small-alpha.timer]\n\n+    ensure   => running\n+    provider => systemd\n+    enable   => True\n"}, {"resource": "Systemd::Unit[opensearch-relforge-eqiad-gc-log-cleanup.service]", "parameters": "--- Systemd::Unit[opensearch-relforge-eqiad-gc-log-cleanup.service].orig\n+++ Systemd::Unit[opensearch-relforge-eqiad-gc-log-cleanup.service]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => present\n+    override_filename => puppet-override.conf\n+    unit              => opensearch-relforge-eqiad-gc-log-cleanup.service\n"}, {"resource": "Exec[apt_repository_wikimedia-opensearch-plugins]", "parameters": "--- Exec[apt_repository_wikimedia-opensearch-plugins].orig\n+++ Exec[apt_repository_wikimedia-opensearch-plugins]\n\n+    command     => /usr/bin/apt-get update \n+    refreshonly => True\n"}, {"resource": "File[/etc/nginx/sites-available/relforge-eqiad]", "content": "--- /etc/nginx/sites-available/relforge-eqiad.orig\n+++ /etc/nginx/sites-available/relforge-eqiad\n@@ -0,0 +1,59 @@\n+# Proxy site configuration file for relforge-eqiad\n+# This file is managed by Puppet!\n+upstream local_fe_relforge-eqiad {\n+    server 10.64.32.100:9200 max_fails=0;\n+}\n+\n+# SSL proxying\n+server {\n+    # Enabling TCP Fast Open is safe for HTTP over TLS. There is no idempotency\n+    # concern replaying TLS Client Hello.\n+    # https://tools.ietf.org/html/rfc7413#section-6.3.2\n+    listen [::]:9243 default_server deferred backlog=16384 reuseport ipv6only=on fastopen=150 ssl ;\n+    listen 9243 default_server deferred backlog=16384 reuseport fastopen=150 ssl ;\n+    server_name relforge1008.eqiad.wmnet relforge.svc.eqiad.wmnet;\n+\n+    error_log   /var/log/nginx/relforge-eqiad.error.log;\n+    access_log   off;\n+\n+    ssl_certificate /etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chained.pem;\n+    ssl_certificate_key /etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet-key.pem;\n+\n+    keepalive_timeout 60;\n+    keepalive_requests 100;\n+\n+    location / {\n+        proxy_pass http://local_fe_relforge-eqiad;\n+        proxy_http_version 1.1;\n+        proxy_set_header Connection close; # should be default\n+\n+        # this should be in sync with Varnish's first_byte_timeout\n+        # and PHP's max_execution_time\n+        proxy_read_timeout 180s;\n+\n+        proxy_set_header Host $host;\n+        proxy_set_header X-Client-IP $remote_addr;\n+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n+        proxy_set_header X-Forwarded-Proto https;\n+        proxy_set_header X-Connection-Properties \"H2=$h2; SSR=$session_reused; SSL=$ssl_protocol; C=$ssl_cipher;\";\n+\n+        # Don't clobber the Server header from the backend.\n+        proxy_pass_header Server;\n+\n+        proxy_redirect off;\n+        proxy_buffering off;\n+        proxy_request_buffering on;\n+\n+        # With proxy buffering off, proxy_buffer_size is still used to\n+        # define the singular chunk of buffer the content passes\n+        # through.  Apparently if nginx can't read all the response\n+        # headers in the first such chunk, it fails with 502.  Upping\n+        # this to 8k (from def 4k) solves the one reported case in\n+        # https://phabricator.wikimedia.org/T161819\n+        # --\n+        # Raising this further from 8K to 32K, at least temporarily, due to T226840\n+        # Note 32KB is also the similar default limit in our varnishes (http_resp_size)\n+        proxy_buffer_size       32k;\n+        proxy_buffers         4 32k;\n+    }\n+}", "parameters": "--- File[/etc/nginx/sites-available/relforge-eqiad].orig\n+++ File[/etc/nginx/sites-available/relforge-eqiad]\n\n+    before => ['Service[nginx]']\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    notify => Exec[nginx-reload]\n"}, {"resource": "File[/etc/opensearch/relforge-eqiad-small-alpha/cirrus_check_settings.json]", "content": "--- /etc/opensearch/relforge-eqiad-small-alpha/cirrus_check_settings.json.orig\n+++ /etc/opensearch/relforge-eqiad-small-alpha/cirrus_check_settings.json\n@@ -0,0 +1,14 @@\n+{\n+  \"persistent\": {\n+    \"cluster.remote.chi.seeds\": [\n+      \"relforge1008.eqiad.wmnet:9300\",\n+      \"relforge1009.eqiad.wmnet:9300\",\n+      \"relforge1010.eqiad.wmnet:9300\"\n+    ],\n+    \"cluster.remote.omega.seeds\": [\n+      \"relforge1008.eqiad.wmnet:9500\",\n+      \"relforge1009.eqiad.wmnet:9500\",\n+      \"relforge1010.eqiad.wmnet:9500\"\n+    ]\n+  }\n+}", "parameters": "--- File[/etc/opensearch/relforge-eqiad-small-alpha/cirrus_check_settings.json].orig\n+++ File[/etc/opensearch/relforge-eqiad-small-alpha/cirrus_check_settings.json]\n\n+    owner  => root\n+    mode   => 0444\n+    group  => root\n+    ensure => file\n"}, {"resource": "File[/var/lib/prometheus/node.d/check_check_push_cross_cluster_settings_9200_status.prom]", "parameters": "--- File[/var/lib/prometheus/node.d/check_check_push_cross_cluster_settings_9200_status.prom].orig\n+++ File[/var/lib/prometheus/node.d/check_check_push_cross_cluster_settings_9200_status.prom]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n"}, {"resource": "Service[nrpe2nodexp-opensearch_shards_9400.timer]", "parameters": "--- Service[nrpe2nodexp-opensearch_shards_9400.timer].orig\n+++ Service[nrpe2nodexp-opensearch_shards_9400.timer]\n\n+    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9400.timer (nrpe2nodexp-opensearch_shards_9400.timer)]']\n+    provider => systemd\n+    enable   => False\n+    ensure   => stopped\n"}, {"resource": "File[/etc/nagios/nrpe.d/check_opensearch_shards_9400.cfg]", "content": "--- /etc/nagios/nrpe.d/check_opensearch_shards_9400.cfg.orig\n+++ /etc/nagios/nrpe.d/check_opensearch_shards_9400.cfg\n@@ -0,0 +1,2 @@\n+# File generated by puppet. DO NOT edit by hand\n+command[check_opensearch_shards_9400]=/usr/lib/nagios/plugins/check_elasticsearch.py --ignore-status --url http://localhost:9400 --shards-inactive '>=0.15' --timeout 4", "parameters": "--- File[/etc/nagios/nrpe.d/check_opensearch_shards_9400.cfg].orig\n+++ File[/etc/nagios/nrpe.d/check_opensearch_shards_9400.cfg]\n\n+    owner   => root\n+    require => Package[nagios-nrpe-server]\n+    group   => root\n+    tag     => nrpe::check\n+    ensure  => present\n+    mode    => 0444\n+    notify  => Service[nagios-nrpe-server]\n"}, {"resource": "Logrotate::Conf[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]", "parameters": "--- Logrotate::Conf[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200].orig\n+++ Logrotate::Conf[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]\n\n+    ensure => present\n"}, {"resource": "Systemd::Syslog[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]", "parameters": "--- Systemd::Syslog[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400].orig\n+++ Systemd::Syslog[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]\n\n+    readable_by            => all\n+    force_stop             => True\n+    ensure                 => present\n+    programname_comparison => startswith\n+    log_filename           => syslog.log\n+    owner                  => root\n+    group                  => root\n+    base_dir               => /var/log\n"}, {"resource": "File[/etc/logrotate.d/opensearch-disable-readahead-relforge-eqiad-small-alpha]", "content": "--- /etc/logrotate.d/opensearch-disable-readahead-relforge-eqiad-small-alpha.orig\n+++ /etc/logrotate.d/opensearch-disable-readahead-relforge-eqiad-small-alpha\n@@ -0,0 +1,12 @@\n+# logrotate(8) config for opensearch-disable-readahead-relforge-eqiad-small-alpha\n+\n+/var/log/opensearch-disable-readahead-relforge-eqiad-small-alpha/*.log {\n+    daily\n+    copytruncate\n+    missingok\n+    compress\n+    delaycompress\n+    notifempty\n+    rotate 15\n+    size 256M\n+}", "parameters": "--- File[/etc/logrotate.d/opensearch-disable-readahead-relforge-eqiad-small-alpha].orig\n+++ File[/etc/logrotate.d/opensearch-disable-readahead-relforge-eqiad-small-alpha]\n\n+    owner  => root\n+    mode   => 0444\n+    group  => root\n+    ensure => present\n"}, {"resource": "Prometheus::Alert::Rule[check_opensearch_shards_9400_2a63eb7dcbe368b7f538118765d629d6]", "parameters": "--- Prometheus::Alert::Rule[check_opensearch_shards_9400_2a63eb7dcbe368b7f538118765d629d6].orig\n+++ Prometheus::Alert::Rule[check_opensearch_shards_9400_2a63eb7dcbe368b7f538118765d629d6]\n\n+    for                => 3m\n+    team               => observability\n+    ensure             => absent\n+    dashboard          => TODO\n+    instance           => ops\n+    runbook            => https://wikitech.wikimedia.org/wiki/Search#Administration\n+    severity           => info\n+    def_label_whitelst => ['team', 'severity']\n+    alert_name         => nrpe_OpenSearch_health_check_for_shards_on_9400\n+    site               => eqiad\n+    group              => nrpechecks\n+    summary            => NRPE CHECK: OpenSearch health check for shards on 9400\n+    expr               => (nagios_nrpe_check_result{alert_rule_hash=\"2a63eb7dcbe368b7f538118765d629d6\",check_name=\"check_opensearch_shards_9400\", status=~\"(WARNING|CRITICAL)\", severity=~\"(warning|critical)\"} > 0) * on (instance) group_left (team) role_owner\n+    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_opensearch_shards_9400))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))\n+    description        => NRPE CHECK: OpenSearch health check for shards on 9400\n"}, {"resource": "Exec[java__cacert_wmf:Wikimedia_Internal_Root_CA]", "parameters": "--- Exec[java__cacert_wmf:Wikimedia_Internal_Root_CA].orig\n+++ Exec[java__cacert_wmf:Wikimedia_Internal_Root_CA]\n\n+    command => /usr/bin/keytool -import -trustcacerts -noprompt -cacerts     -file /usr/share/ca-certificates/wikimedia/Wikimedia_Internal_Root_CA.crt -storepass changeit -alias wmf:Wikimedia_Internal_Root_CA\n\n+    group   => root\n+    user    => root\n+    unless  => /usr/bin/keytool -list -cacerts -noprompt -storepass changeit -alias wmf:Wikimedia_Internal_Root_CA\n"}, {"resource": "File[/etc/ferm/conf.d/10_opensearch_inter_node_9300]", "content": "--- /etc/ferm/conf.d/10_opensearch_inter_node_9300.orig\n+++ /etc/ferm/conf.d/10_opensearch_inter_node_9300\n@@ -4,3 +4,5 @@\n &R_SERVICE(tcp, 9300, (10.64.164.14 10.64.32.100 10.64.48.120 2620:0:861:103:10:64:32:100 2620:0:861:107:10:64:48:120 2620:0:861:12c:10:64:164:14));\n \n \n+\n+&NO_TRACK(tcp, 9300);"}, {"resource": "File[/usr/local/bin/set-cross-cluster-seeds_9200.sh]", "content": "--- /usr/local/bin/set-cross-cluster-seeds_9200.sh.orig\n+++ /usr/local/bin/set-cross-cluster-seeds_9200.sh\n@@ -0,0 +1,16 @@\n+#!/bin/bash\n+# SPDX-License-Identifier: Apache-2.0\n+# set-cross-cluster-seeds.sh. Given a json file with opensearch remote seeds,\n+# update OpenSearch cluster with correct settings.\n+# Author: Brian King\n+\n+set -eo pipefail\n+\n+data=\"/etc/opensearch/relforge-eqiad/cirrus_check_settings.json\"\n+\n+logger \"updating cross cluster seed settings via ${data}\"\n+\n+curl -XPUT \\\n+  -H 'content-type: application/json' \\\n+  --data \"@${data}\" \\\n+  http://localhost:9200/_cluster/settings", "parameters": "--- File[/usr/local/bin/set-cross-cluster-seeds_9200.sh].orig\n+++ File[/usr/local/bin/set-cross-cluster-seeds_9200.sh]\n\n+    owner  => root\n+    mode   => 0700\n+    group  => root\n+    ensure => file\n"}, {"resource": "Motd::Script[cirrus::relforge]", "parameters": "--- Motd::Script[cirrus::relforge].orig\n+++ Motd::Script[cirrus::relforge]\n\n+    priority => 5\n+    ensure   => present\n"}, {"resource": "Class[Profile::Opensearch::Cirrus::Server]", "parameters": "--- Class[Profile::Opensearch::Cirrus::Server].orig\n+++ Class[Profile::Opensearch::Cirrus::Server]\n\n+    ferm_srange                     => (($CUMIN_MASTERS $ANALYTICS_NETWORKS $STAGING_KUBEPODS_NETWORKS))\n+    certificate_domains             => ['relforge.svc.eqiad.wmnet']\n+    enable_performance_cpu_governor => False\n+    enable_remote_search            => False\n+    base_data_dir                   => /srv/opensearch\n+    ferm_ro_srange                  => \n+    storage_device                  => md1\n+    version                         => 1.3.20\n+    expose_http                     => False\n+    cluster                         => relforge\n+    ssl_provider                    => cfssl\n"}, {"resource": "Package[opensearch]", "parameters": "--- Package[opensearch].orig\n+++ Package[opensearch]\n\n+    provider => apt\n+    ensure   => 1.3.20\n"}, {"resource": "Service[prometheus-elasticsearch-exporter-9400]", "parameters": "--- Service[prometheus-elasticsearch-exporter-9400].orig\n+++ Service[prometheus-elasticsearch-exporter-9400]\n\n+    ensure => running\n+    enable => True\n"}, {"resource": "Systemd::Unit[nrpe2nodexp-opensearch_shard_size_check_9200.timer]", "parameters": "--- Systemd::Unit[nrpe2nodexp-opensearch_shard_size_check_9200.timer].orig\n+++ Systemd::Unit[nrpe2nodexp-opensearch_shard_size_check_9200.timer]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => absent\n+    override_filename => puppet-override.conf\n+    unit              => nrpe2nodexp-opensearch_shard_size_check_9200.timer\n"}, {"resource": "Sysctl::Conffile[opensearch]", "parameters": "--- Sysctl::Conffile[opensearch].orig\n+++ Sysctl::Conffile[opensearch]\n\n+    ensure             => present\n+    priority           => 70\n+    no_priority_prefix => True\n"}, {"resource": "File[/lib/systemd/system/clean_up_dlq.service]", "content": "--- /lib/systemd/system/clean_up_dlq.service.orig\n+++ /lib/systemd/system/clean_up_dlq.service\n@@ -0,0 +1,8 @@\n+[Unit]\n+Description=Clean up dead letter queue and restart logstash\n+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+\n+[Service]\n+Type=oneshot\n+User=root\n+ExecStart=/usr/local/bin/cleanup-dlq", "parameters": "--- File[/lib/systemd/system/clean_up_dlq.service].orig\n+++ File[/lib/systemd/system/clean_up_dlq.service]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for clean_up_dlq.service (clean_up_dlq.service)]\n"}, {"resource": "File[/etc/logrotate.d/push_cross_cluster_settings_9400]", "content": "--- /etc/logrotate.d/push_cross_cluster_settings_9400.orig\n+++ /etc/logrotate.d/push_cross_cluster_settings_9400\n@@ -0,0 +1,12 @@\n+# logrotate(8) config for push_cross_cluster_settings_9400\n+\n+/var/log/push_cross_cluster_settings_9400/*.log {\n+    daily\n+    copytruncate\n+    missingok\n+    compress\n+    delaycompress\n+    notifempty\n+    rotate 15\n+    size 256M\n+}", "parameters": "--- File[/etc/logrotate.d/push_cross_cluster_settings_9400].orig\n+++ File[/etc/logrotate.d/push_cross_cluster_settings_9400]\n\n+    owner  => root\n+    mode   => 0444\n+    group  => root\n+    ensure => present\n"}, {"resource": "Systemd::Monitor[push_cross_cluster_settings_9200]", "parameters": "--- Systemd::Monitor[push_cross_cluster_settings_9200].orig\n+++ Systemd::Monitor[push_cross_cluster_settings_9200]\n\n+    retries        => 2\n+    check_interval => 10\n+    ensure         => present\n+    migration_task => T407130\n+    contact_group  => admins\n+    notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+    critical       => False\n"}, {"resource": "Apt::Repository[wikimedia-opensearch]", "parameters": "--- Apt::Repository[wikimedia-opensearch].orig\n+++ Apt::Repository[wikimedia-opensearch]\n\n+    before                   => Class[Opensearch]\n+    bin                      => True\n+    components               => thirdparty/opensearch1\n+    ensure                   => present\n+    dist                     => bookworm-wikimedia\n+    source                   => True\n+    trust_repo               => False\n+    uri                      => http://apt.wikimedia.org/wikimedia\n+    keyfile                  => puppet:///modules/install_server/autoinstall/keyring/wikimedia-archive-keyring.gpg\n+    allow_releaseinfo_change => False\n"}, {"resource": "Systemd::Service[opensearch-relforge-eqiad-gc-log-cleanup]", "parameters": "--- Systemd::Service[opensearch-relforge-eqiad-gc-log-cleanup].orig\n+++ Systemd::Service[opensearch-relforge-eqiad-gc-log-cleanup]\n\n+    override                 => False\n+    restart                  => False\n+    require                  => Systemd::Unit[opensearch-relforge-eqiad-gc-log-cleanup.service]\n+    ensure                   => present\n+    unit_type                => timer\n+    migration_task           => T407130\n+    monitoring_enabled       => False\n+    monitoring_contact_group => admins\n+    service_params           => {}\n+    monitoring_critical      => False\n"}, {"resource": "Logrotate::Conf[opensearch]", "parameters": "--- Logrotate::Conf[opensearch].orig\n+++ Logrotate::Conf[opensearch]\n\n+    ensure => present\n"}, {"resource": "File[/etc/elasticsearch]", "parameters": "--- File[/etc/elasticsearch].orig\n+++ File[/etc/elasticsearch]\n\n+    owner   => root\n+    target  => /etc/opensearch\n+    group   => root\n+    require => File[/etc/opensearch/instances]\n+    ensure  => link\n"}, {"resource": "File[/var/log/clean_up_dlq]", "parameters": "--- File[/var/log/clean_up_dlq].orig\n+++ File[/var/log/clean_up_dlq]\n\n+    owner  => root\n+    group  => root\n+    force  => True\n+    ensure => absent\n+    mode   => 0755\n+    backup => False\n"}, {"resource": "Systemd::Unit[nrpe2nodexp-opensearch_shards_9400.timer]", "parameters": "--- Systemd::Unit[nrpe2nodexp-opensearch_shards_9400.timer].orig\n+++ Systemd::Unit[nrpe2nodexp-opensearch_shards_9400.timer]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => absent\n+    override_filename => puppet-override.conf\n+    unit              => nrpe2nodexp-opensearch_shards_9400.timer\n"}, {"resource": "File[/var/log/push_cross_cluster_settings_9400]", "parameters": "--- File[/var/log/push_cross_cluster_settings_9400].orig\n+++ File[/var/log/push_cross_cluster_settings_9400]\n\n+    owner  => root\n+    group  => root\n+    force  => True\n+    ensure => directory\n+    mode   => 0755\n+    backup => False\n"}, {"resource": "Apt::Repository[wikimedia-opensearch-plugins]", "parameters": "--- Apt::Repository[wikimedia-opensearch-plugins].orig\n+++ Apt::Repository[wikimedia-opensearch-plugins]\n\n+    bin                      => True\n+    components               => component/opensearch13\n+    ensure                   => present\n+    dist                     => bookworm-wikimedia\n+    source                   => True\n+    trust_repo               => False\n+    uri                      => http://apt.wikimedia.org/wikimedia\n+    keyfile                  => puppet:///modules/install_server/autoinstall/keyring/wikimedia-archive-keyring.gpg\n+    allow_releaseinfo_change => False\n"}, {"resource": "Systemd::Unit[nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service]", "parameters": "--- Systemd::Unit[nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service].orig\n+++ Systemd::Unit[nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => absent\n+    override_filename => puppet-override.conf\n+    unit              => nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service\n"}, {"resource": "File[/etc/sudoers.d/nrpe-check_opensearch_unassigned_shard_check_9200]", "parameters": "--- File[/etc/sudoers.d/nrpe-check_opensearch_unassigned_shard_check_9200].orig\n+++ File[/etc/sudoers.d/nrpe-check_opensearch_unassigned_shard_check_9200]\n\n+    owner   => root\n+    require => Package[nagios-nrpe-server]\n+    group   => root\n+    ensure  => absent\n"}, {"resource": "Exec[systemd daemon-reload for prometheus-wmf-elasticsearch-exporter-9200.service (prometheus-wmf-elasticsearch-exporter-9200)]", "parameters": "--- Exec[systemd daemon-reload for prometheus-wmf-elasticsearch-exporter-9200.service (prometheus-wmf-elasticsearch-exporter-9200)].orig\n+++ Exec[systemd daemon-reload for prometheus-wmf-elasticsearch-exporter-9200.service (prometheus-wmf-elasticsearch-exporter-9200)]\n\n+    command     => /bin/systemctl daemon-reload\n+    notify      => ['Service[prometheus-wmf-elasticsearch-exporter-9200]']\n+    refreshonly => True\n"}, {"resource": "Concat_fragment[wikimedia-opensearch-header]", "parameters": "--- Concat_fragment[wikimedia-opensearch-header].orig\n+++ Concat_fragment[wikimedia-opensearch-header]\n\n+    source => puppet:///modules/apt/sources-deb822-header.txt\n+    target => /etc/apt/sources.list.d/wikimedia-opensearch.sources\n+    tag    => _etc_apt_sources.list.d_wikimedia-opensearch.sources\n+    order  => 01\n"}, {"resource": "Motd::Script[cluster_memberships]", "parameters": "--- Motd::Script[cluster_memberships].orig\n+++ Motd::Script[cluster_memberships]\n\n+    source   => puppet:///modules/opensearch/opensearch.motd\n+    priority => 96\n+    ensure   => present\n"}, {"resource": "Systemd::Service[nrpe2nodexp-opensearch_shards_9200]", "parameters": "--- Systemd::Service[nrpe2nodexp-opensearch_shards_9200].orig\n+++ Systemd::Service[nrpe2nodexp-opensearch_shards_9200]\n\n+    override                 => False\n+    restart                  => False\n+    require                  => Systemd::Unit[nrpe2nodexp-opensearch_shards_9200.service]\n+    ensure                   => absent\n+    unit_type                => timer\n+    migration_task           => T407130\n+    monitoring_enabled       => False\n+    monitoring_contact_group => admins\n+    service_params           => {}\n+    monitoring_critical      => False\n"}, {"resource": "Class[Opensearch]", "parameters": "--- Class[Opensearch].orig\n+++ Class[Opensearch]\n\n+    before                  => ['File[/usr/share/opensearch/plugins]']\n+    enable_curator          => False\n+    default_instance_params => {}\n+    plugins_mandatory       => ['analysis-hebrew', 'analysis-icu', 'analysis-smartcn', 'analysis-stempel', 'analysis-ukrainian', 'cirrus-highlighter', 'opensearch-analysis-stconvert', 'opensearch-extra', 'opensearch-extra-analysis-esperanto', 'opensearch-extra-analysis-serbian', 'opensearch-extra-analysis-slovak', 'ltr']\n+    instances               => {'relforge-eqiad': {'awareness_attributes': 'row', 'recover_after_nodes': 1, 'recover_after_time': '1m', 'search_shard_count_limit': 1000, 'reindex_remote_whitelist': 'search.svc.eqiad.wmnet:9243,search.svc.codfw.wmnet:9243', 'bulk_thread_pool_executors': 32, 'bulk_thread_pool_capacity': 1000, 'ltr_cache_size': '100mb', 'auto_create_index': True, 'plugins_mandatory': ['analysis-hebrew', 'analysis-icu', 'analysis-smartcn', 'analysis-stempel', 'analysis-ukrainian', 'cirrus-highlighter', 'opensearch-analysis-stconvert', 'opensearch-extra', 'opensearch-extra-analysis-esperanto', 'opensearch-extra-analysis-serbian', 'opensearch-extra-analysis-slovak', 'ltr'], 'filter_cache_size': '20%', 'script_max_compilations_per_minute': 10000, 'send_logs_to_logstash': True, 'disable_security_plugin': True, 'unicast_hosts': ['relforge1008.eqiad.wmnet', 'relforge1009.eqiad.wmnet', 'relforge1010.eqiad.wmnet'], 'cluster_hosts': ['relforge1008.eqiad.wmnet', 'relforge1009.eqiad.wmnet', 'relforge1010.eqiad.wmnet'], 'expected_nodes': 2, 'cluster_name': 'relforge-eqiad', 'short_cluster_name': 'chi', 'heap_memory': '30G', 'http_port': 9200, 'tls_port': 9243, 'transport_tcp_port': 9300, 'certificate_name': 'relforge.svc.eqiad.wmnet'}, 'relforge-eqiad-small-alpha': {'awareness_attributes': 'row', 'recover_after_nodes': 1, 'recover_after_time': '1m', 'search_shard_count_limit': 1000, 'reindex_remote_whitelist': 'search.svc.eqiad.wmnet:9243,search.svc.codfw.wmnet:9243', 'bulk_thread_pool_executors': 32, 'bulk_thread_pool_capacity': 1000, 'ltr_cache_size': '100mb', 'auto_create_index': True, 'plugins_mandatory': ['analysis-hebrew', 'analysis-icu', 'analysis-smartcn', 'analysis-stempel', 'analysis-ukrainian', 'cirrus-highlighter', 'opensearch-analysis-stconvert', 'opensearch-extra', 'opensearch-extra-analysis-esperanto', 'opensearch-extra-analysis-serbian', 'opensearch-extra-analysis-slovak', 'ltr'], 'filter_cache_size': '20%', 'script_max_compilations_per_minute': 10000, 'send_logs_to_logstash': True, 'disable_security_plugin': True, 'unicast_hosts': ['relforge1008.eqiad.wmnet', 'relforge1009.eqiad.wmnet', 'relforge1010.eqiad.wmnet'], 'cluster_hosts': ['relforge1008.eqiad.wmnet', 'relforge1009.eqiad.wmnet', 'relforge1010.eqiad.wmnet'], 'expected_nodes': 2, 'cluster_name': 'relforge-eqiad-small-alpha', 'short_cluster_name': 'omega', 'heap_memory': '4G', 'http_port': 9400, 'tls_port': 9443, 'transport_tcp_port': 9500, 'certificate_name': 'relforge.svc.eqiad.wmnet'}}\n+    rack                    => C4\n+    row                     => eqiad-row-c\n+    native_lib_path         => /usr/share/opensearch/plugins/opensearch-knn/lib\n+    logstash_logback_port   => 11514\n+    base_data_dir           => /srv/opensearch\n+    logstash_host           => localhost\n+    version                 => 1.3.20\n+    java_home               => /usr/lib/jvm/java-11-openjdk-amd64\n"}, {"resource": "Monitoring::Exported_nagios_service[relforge1008 check_push_cross_cluster_settings_9400_status]", "parameters": "--- Monitoring::Exported_nagios_service[relforge1008 check_push_cross_cluster_settings_9400_status].orig\n+++ Monitoring::Exported_nagios_service[relforge1008 check_push_cross_cluster_settings_9400_status]\n\n+    check_command          => nrpe_check!check_check_push_cross_cluster_settings_9400_status!10\n+    retry_interval         => 1\n+    active_checks_enabled  => 1\n+    contact_groups         => admins\n+    host_name              => relforge1008\n+    check_freshness        => 0\n+    notification_period    => 24x7\n+    servicegroups          => relforge_eqiad\n+    notification_interval  => 0\n+    ensure                 => present\n+    notification_options   => c,r,f\n+    check_interval         => 10\n+    notifications_enabled  => 0\n+    max_check_attempts     => 2\n+    is_volatile            => 0\n+    passive_checks_enabled => 1\n+    check_period           => 24x7\n+    service_description    => Check unit status of push_cross_cluster_settings_9400\n+    notes_url              => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n"}, {"resource": "Systemd::Unit[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer]", "parameters": "--- Systemd::Unit[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer].orig\n+++ Systemd::Unit[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => present\n+    override_filename => puppet-override.conf\n+    unit              => wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer\n"}, {"resource": "File[/etc/opensearch/relforge-eqiad/opensearch.yml]", "content": "--- /etc/opensearch/relforge-eqiad/opensearch.yml.orig\n+++ /etc/opensearch/relforge-eqiad/opensearch.yml\n@@ -0,0 +1,199 @@\n+# ======================== OpenSearch Configuration =========================\n+#\n+# NOTE: OpenSearch comes with reasonable defaults for most settings.\n+#       Before you set out to tweak and tune the configuration, make sure you\n+#       understand what are you trying to accomplish and the consequences.\n+#\n+# The primary way of configuring a node is via this file. This template lists\n+# the most important settings you may want to configure for a production cluster.\n+#\n+# Please consult the documentation for further information on configuration options:\n+# https://opensearch.org/docs/opensearch/configuration/\n+#\n+# ---------------------------------- Cluster -----------------------------------\n+#\n+# Use a descriptive name for your cluster:\n+#\n+cluster.name: relforge-eqiad\n+#\n+# ------------------------------------ Node ------------------------------------\n+#\n+# Use a descriptive name for the node:\n+#\n+node.name: relforge1008-relforge-eqiad\n+#\n+# Add custom attributes to the node:\n+#\n+#node.attr.rack: r1\n+#\n+# Row/rack awareness attributes\n+#\n+cluster.routing.allocation.awareness.attributes: row\n+node.attr.row: eqiad-row-c\n+node.attr.rack: C4\n+#\n+# Other attributes\n+#\n+node.attr.hostname: relforge1008\n+node.attr.fqdn: relforge1008.eqiad.wmnet\n+#\n+# Allow this node to be eligible as a master node (enabled by default):\n+node.master: true\n+# Allow this node to store data (enabled by default):\n+node.data: true\n+#\n+# ----------------------------------- Paths ------------------------------------\n+#\n+# Path to directory where to store the data (separate multiple locations by comma):\n+#\n+path.data: /srv/opensearch/relforge-eqiad\n+#\n+# Path to log files:\n+#\n+path.logs: /var/log/opensearch\n+#\n+# ----------------------------------- Memory -----------------------------------\n+#\n+# Lock the memory on startup:\n+#\n+bootstrap.memory_lock: false # we don't have swap anyway\n+#\n+# Make sure that the heap size is set to about half the memory available\n+# on the system and that the owner of the process is allowed to use this\n+# limit.\n+#\n+# OpenSearch performs poorly when the system is swapping the memory.\n+#\n+# ---------------------------------- Network -----------------------------------\n+#\n+# Set the bind address to a specific IP (IPv4 or IPv6):\n+#\n+#network.host: 192.168.0.1\n+#\n+# Set a custom port for HTTP:\n+#\n+http.port: 9200\n+#\n+# For more information, consult the network module documentation.\n+#\n+# Set the address other nodes will use to communicate with this node. If not\n+# set, it is automatically derived. It must point to an actual IP address.\n+#\n+network.publish_host: 10.64.32.100\n+\n+# Set both 'bind_host' and 'publish_host':\n+#\n+network.host: [ _local_,_site_ ]\n+\n+# Set a custom port for the node to node communication (9300 by default):\n+#\n+transport.tcp.port: 9300\n+#\n+# --------------------------------- Discovery ----------------------------------\n+#\n+# Pass an initial list of hosts to perform discovery when this node is started:\n+# The default list of hosts is [\"127.0.0.1\", \"[::1]\"]\n+#\n+#discovery.seed_hosts: [\"host1\", \"host2\"]\n+#\n+# Bootstrap the cluster using an initial set of master-eligible nodes:\n+#\n+#cluster.initial_master_nodes: [\"node-1\", \"node-2\"]\n+#\n+discovery.zen.ping.unicast.hosts: [\"relforge1008.eqiad.wmnet\", \"relforge1009.eqiad.wmnet\", \"relforge1010.eqiad.wmnet\"]\n+#\n+# For more information, consult the discovery and cluster formation module documentation.\n+#\n+# ---------------------------------- Gateway -----------------------------------\n+#\n+# Block initial recovery after a full cluster restart until N nodes are started:\n+#\n+gateway.recover_after_nodes: 1\n+#\n+# For more information, consult the gateway module documentation.\n+#\n+#\n+gateway:\n+    recover_after_time: 1m\n+    expected_nodes: 2\n+#\n+# ---------------------------------- Various -----------------------------------\n+#\n+# Require explicit names when deleting indices:\n+#\n+#action.destructive_requires_name: true\n+#\n+# ---------------------------------- Custom settings ---------------------------\n+#\n+# If a plugin listed here is not installed for current node, the node will not start.\n+#\n+plugin.mandatory: analysis-hebrew,analysis-icu,analysis-smartcn,analysis-stempel,analysis-ukrainian,cirrus-highlighter,opensearch-analysis-stconvert,opensearch-extra,opensearch-extra-analysis-esperanto,opensearch-extra-analysis-serbian,opensearch-extra-analysis-slovak,ltr\n+\n+# Specify the pattern of index names allowed to be created automatically\n+action.auto_create_index: true\n+\n+# Protect against accidental close/delete operations on all indices. You can\n+# still close/delete individual indices.\n+action.destructive_requires_name: true\n+\n+# Allow up to 1000 shards to be queried at a time. The default\n+# 1k is too low to allow mwgrep to operate.\n+action.search.shard_count.limit: 1000\n+\n+# Enable the disk space aware shard allocator\n+cluster.routing.allocation.disk.threshold_enabled: true\n+# Stop allocating new shards to nodes when this threshold is reached\n+cluster.routing.allocation.disk.watermark.low: 0.75\n+# Move shards off of nodes when this threshold is reached\n+cluster.routing.allocation.disk.watermark.high: 0.80\n+# Set indexes read-only with allocated shards on affected node when this threshold is reached\n+cluster.routing.allocation.disk.watermark.flood_stage: 0.95\n+# Check disk utilization every 60 seconds\n+cluster.info.update.interval: 60s\n+\n+# Set the number of concurrent recoveries happening on a node:\n+#\n+# 1. During the initial recovery\n+cluster.routing.allocation.node_initial_primaries_recoveries: 3\n+\n+# 2. During adding/removing nodes, rebalancing, etc\n+cluster.routing.allocation.node_concurrent_recoveries: 2\n+\n+# Set to throttle throughput when recovering (eg. 100mb, by default 20mb):\n+indices.recovery.max_bytes_per_sec: 40mb\n+\n+##\n+# OpenSearch cluster balance configuration\n+##\n+# This puts much more weight on distributing the shards per index then the defaults.  This will make sure that,\n+# for example, each live node gets a copy of enwiki.\n+cluster.routing.allocation.balance:\n+    shard: 0.195\n+    index: 0.8\n+\n+##\n+# Filter cache size\n+##\n+indices.queries.cache.size: 20%\n+\n+##\n+# Thread pool settings\n+##\n+thread_pool:\n+    write:\n+        size: 32\n+        queue_size: 1000\n+\n+\n+\n+\n+##\n+# Hosts allowed as data sources for reindexing\n+reindex.remote.whitelist: \"search.svc.eqiad.wmnet:9243,search.svc.codfw.wmnet:9243\"\n+\n+\n+##\n+# Size the LTR cache to prevent churn under normal and AB testing scenarios\n+ltr.caches.max_mem: 100mb\n+\n+", "parameters": "--- File[/etc/opensearch/relforge-eqiad/opensearch.yml].orig\n+++ File[/etc/opensearch/relforge-eqiad/opensearch.yml]\n\n+    owner  => root\n+    mode   => 0444\n+    group  => root\n+    ensure => file\n"}, {"resource": "Profile::Auto_restarts::Service[prometheus-wmf-elasticsearch-exporter-9200]", "parameters": "--- Profile::Auto_restarts::Service[prometheus-wmf-elasticsearch-exporter-9200].orig\n+++ Profile::Auto_restarts::Service[prometheus-wmf-elasticsearch-exporter-9200]\n\n+    ensure => present\n"}, {"resource": "Exec[systemd daemon-reload for opensearch-disable-readahead-relforge-eqiad.timer (opensearch-disable-readahead-relforge-eqiad.timer)]", "parameters": "--- Exec[systemd daemon-reload for opensearch-disable-readahead-relforge-eqiad.timer (opensearch-disable-readahead-relforge-eqiad.timer)].orig\n+++ Exec[systemd daemon-reload for opensearch-disable-readahead-relforge-eqiad.timer (opensearch-disable-readahead-relforge-eqiad.timer)]\n\n+    before      => ['Service[opensearch-disable-readahead-relforge-eqiad.timer]']\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Rsyslog::Conf[nrpe2nodexp-opensearch_unassigned_shard_check_9400]", "parameters": "--- Rsyslog::Conf[nrpe2nodexp-opensearch_unassigned_shard_check_9400].orig\n+++ Rsyslog::Conf[nrpe2nodexp-opensearch_unassigned_shard_check_9400]\n\n+    mode     => 0444\n+    priority => 25\n+    ensure   => absent\n"}, {"resource": "Systemd::Unit[nrpe2nodexp-opensearch_unassigned_shard_check_9400.service]", "parameters": "--- Systemd::Unit[nrpe2nodexp-opensearch_unassigned_shard_check_9400.service].orig\n+++ Systemd::Unit[nrpe2nodexp-opensearch_unassigned_shard_check_9400.service]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => absent\n+    override_filename => puppet-override.conf\n+    unit              => nrpe2nodexp-opensearch_unassigned_shard_check_9400.service\n"}, {"resource": "Class[Opensearch::Packages]", "parameters": "--- Class[Opensearch::Packages].orig\n+++ Class[Opensearch::Packages]\n\n+    send_logs_to_logstash => True\n+    version               => 1.3.20\n"}, {"resource": "Exec[s3-credentials-user-relforge-eqiad]", "parameters": "--- Exec[s3-credentials-user-relforge-eqiad].orig\n+++ Exec[s3-credentials-user-relforge-eqiad]\n\n+    environment => ['OPENSEARCH_PATH_CONF=/etc/opensearch/relforge-eqiad']\n+    command     => echo 'search:platform' | /usr/share/opensearch/bin/opensearch-keystore add s3.client.default.access_key\n+    group       => opensearch\n+    require     => File[/etc/opensearch/relforge-eqiad/opensearch.keystore]\n+    path        => /bin:/usr/bin\n+    unless      => /usr/share/opensearch/bin/opensearch-keystore list | grep s3.client.default.access_key\n"}, {"resource": "Class[Logstash]", "parameters": "--- Class[Logstash].orig\n+++ Class[Logstash]\n\n+    pipeline_batch_delay => 50\n+    dlq_hosts            => []\n+    gc_log               => True\n+    log_format           => json\n+    pipeline_workers     => 2\n+    heap_memory          => 192m\n+    pipeline_batch_size  => 125\n+    enable_dlq           => False\n+    dlq_max_bytes        => 1024mb\n+    java_package         => openjdk-17-jdk\n+    version              => 7.16.3-1\n+    manage_service       => True\n"}, {"resource": "Systemd::Unit[push_cross_cluster_settings_9200.service]", "parameters": "--- Systemd::Unit[push_cross_cluster_settings_9200.service].orig\n+++ Systemd::Unit[push_cross_cluster_settings_9200.service]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => present\n+    override_filename => puppet-override.conf\n+    unit              => push_cross_cluster_settings_9200.service\n"}, {"resource": "Systemd::Syslog[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]", "parameters": "--- Systemd::Syslog[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup].orig\n+++ Systemd::Syslog[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]\n\n+    readable_by            => all\n+    force_stop             => True\n+    ensure                 => present\n+    programname_comparison => startswith\n+    log_filename           => syslog.log\n+    owner                  => root\n+    group                  => root\n+    base_dir               => /var/log\n"}, {"resource": "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service (wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service)]", "parameters": "--- Exec[systemd daemon-reload for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service (wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service)].orig\n+++ Exec[systemd daemon-reload for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service (wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Service[clean_up_dlq.timer]", "parameters": "--- Service[clean_up_dlq.timer].orig\n+++ Service[clean_up_dlq.timer]\n\n+    before   => ['Exec[systemd daemon-reload for clean_up_dlq.timer (clean_up_dlq.timer)]']\n+    provider => systemd\n+    enable   => False\n+    ensure   => stopped\n"}, {"resource": "Service[nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer]", "parameters": "--- Service[nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer].orig\n+++ Service[nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer]\n\n+    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer (nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer)]']\n+    provider => systemd\n+    enable   => False\n+    ensure   => stopped\n"}, {"resource": "File[/etc/rsyslog.d/40-opensearch-disable-readahead-relforge-eqiad-small-alpha.conf]", "content": "--- /etc/rsyslog.d/40-opensearch-disable-readahead-relforge-eqiad-small-alpha.conf.orig\n+++ /etc/rsyslog.d/40-opensearch-disable-readahead-relforge-eqiad-small-alpha.conf\n@@ -0,0 +1,10 @@\n+# rsyslog.conf(5) configuration file for services.\n+# This file is managed by Puppet.\n+if $programname startswith \"opensearch-disable-readahead-relforge-eqiad-small-alpha\" then {\n+    action(\n+        type=\"omfile\" file=\"/var/log/opensearch-disable-readahead-relforge-eqiad-small-alpha/syslog.log\"\n+        fileOwner=\"root\" fileGroup=\"root\"\n+        fileCreateMode=\"0644\"\n+    )\n+    & stop\n+}", "parameters": "--- File[/etc/rsyslog.d/40-opensearch-disable-readahead-relforge-eqiad-small-alpha.conf].orig\n+++ File[/etc/rsyslog.d/40-opensearch-disable-readahead-relforge-eqiad-small-alpha.conf]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Service[rsyslog]\n"}, {"resource": "File[/etc/logrotate.d/opensearch-relforge-eqiad-gc-log-cleanup]", "content": "--- /etc/logrotate.d/opensearch-relforge-eqiad-gc-log-cleanup.orig\n+++ /etc/logrotate.d/opensearch-relforge-eqiad-gc-log-cleanup\n@@ -0,0 +1,12 @@\n+# logrotate(8) config for opensearch-relforge-eqiad-gc-log-cleanup\n+\n+/var/log/opensearch-relforge-eqiad-gc-log-cleanup/*.log {\n+    daily\n+    copytruncate\n+    missingok\n+    compress\n+    delaycompress\n+    notifempty\n+    rotate 15\n+    size 256M\n+}", "parameters": "--- File[/etc/logrotate.d/opensearch-relforge-eqiad-gc-log-cleanup].orig\n+++ File[/etc/logrotate.d/opensearch-relforge-eqiad-gc-log-cleanup]\n\n+    owner  => root\n+    mode   => 0444\n+    group  => root\n+    ensure => present\n"}, {"resource": "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9200.service (nrpe2nodexp-opensearch_unassigned_shard_check_9200.service)]", "parameters": "--- Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9200.service (nrpe2nodexp-opensearch_unassigned_shard_check_9200.service)].orig\n+++ Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9200.service (nrpe2nodexp-opensearch_unassigned_shard_check_9200.service)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Service[opensearch_1@relforge-eqiad]", "parameters": "--- Service[opensearch_1@relforge-eqiad].orig\n+++ Service[opensearch_1@relforge-eqiad]\n\n+    provider => systemd\n+    tag      => opensearch_services\n+    require  => ['Systemd::Unit[opensearch_1@.service]', 'File[/etc/opensearch/relforge-eqiad/opensearch.yml]', 'File[/etc/opensearch/relforge-eqiad/logging.yml]', 'File[/etc/opensearch/relforge-eqiad/log4j2.properties]', 'File[/etc/opensearch/relforge-eqiad/jvm.options]', 'File[/srv/opensearch/relforge-eqiad]', 'Systemd::Tmpfile[opensearch-relforge-eqiad]']\n+    ensure   => running\n+    enable   => True\n"}, {"resource": "Systemd::Unit[opensearch-disable-readahead.timer]", "parameters": "--- Systemd::Unit[opensearch-disable-readahead.timer].orig\n+++ Systemd::Unit[opensearch-disable-readahead.timer]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => absent\n+    override_filename => puppet-override.conf\n+    unit              => opensearch-disable-readahead.timer\n"}, {"resource": "Concat_fragment[wikimedia-opensearch-plugins-header]", "parameters": "--- Concat_fragment[wikimedia-opensearch-plugins-header].orig\n+++ Concat_fragment[wikimedia-opensearch-plugins-header]\n\n+    source => puppet:///modules/apt/sources-deb822-header.txt\n+    target => /etc/apt/sources.list.d/wikimedia-opensearch-plugins.sources\n+    tag    => _etc_apt_sources.list.d_wikimedia-opensearch-plugins.sources\n+    order  => 01\n"}, {"resource": "Prometheus::Elasticsearch_exporter[localhost:9400]", "parameters": "--- Prometheus::Elasticsearch_exporter[localhost:9400].orig\n+++ Prometheus::Elasticsearch_exporter[localhost:9400]\n\n+    extra_config       => \n+    prometheus_port    => 9109\n+    elasticsearch_port => 9400\n"}, {"resource": "File[/var/log/opensearch/opensearch.log]", "parameters": "--- File[/var/log/opensearch/opensearch.log].orig\n+++ File[/var/log/opensearch/opensearch.log]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n"}, {"resource": "Package[logstash-old-name]", "parameters": "--- Package[logstash-old-name].orig\n+++ Package[logstash-old-name]\n\n+    name     => logstash\n+    provider => apt\n+    before   => Package[logstash-oss]\n+    ensure   => absent\n"}, {"resource": "Systemd::Timer::Job[opensearch-disable-readahead-relforge-eqiad]", "parameters": "--- Systemd::Timer::Job[opensearch-disable-readahead-relforge-eqiad].orig\n+++ Systemd::Timer::Job[opensearch-disable-readahead-relforge-eqiad]\n\n+    send_mail                 => False\n+    user                      => root\n+    monitoring_enabled        => False\n+    logfile_name              => syslog.log\n+    logging_enabled           => True\n+    command                   => /usr/local/bin/opensearch-disable-readahead.sh relforge-eqiad /srv/opensearch\n+    private_tmp               => False\n+    description               => Disables readahead on all open files every 30 minutes to alleviate Cirrussearch / opensearch IO load spikes\n+    syslog_force_stop         => True\n+    ignore_errors             => False\n+    send_mail_only_on_error   => True\n+    fixed_random_delay        => False\n+    logfile_perms             => all\n+    ensure                    => present\n+    logfile_basedir           => /var/log\n+    environment               => {}\n+    logfile_group             => root\n+    send_mail_to              => root@relforge1008.eqiad.wmnet\n+    success_exit_status       => []\n+    interval                  => [{'start': 'OnUnitActiveSec', 'interval': '30min'}, {'start': 'OnBootSec', 'interval': '1min'}]\n+    monitoring_contact_groups => admins\n+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+    syslog_match_startswith   => True\n"}, {"resource": "Systemd::Timer[opensearch-relforge-eqiad-gc-log-cleanup]", "parameters": "--- Systemd::Timer[opensearch-relforge-eqiad-gc-log-cleanup].orig\n+++ Systemd::Timer[opensearch-relforge-eqiad-gc-log-cleanup]\n\n+    unit_name          => opensearch-relforge-eqiad-gc-log-cleanup.service\n+    fixed_random_delay => False\n+    splay              => 0\n+    ensure             => present\n+    timer_intervals    => [{'start': 'OnCalendar', 'interval': '*-*-* 02:12:00'}]\n+    accuracy           => 15sec\n"}, {"resource": "File[/etc/nagios/nrpe.d/check_opensearch_shards_9200.cfg]", "content": "--- /etc/nagios/nrpe.d/check_opensearch_shards_9200.cfg.orig\n+++ /etc/nagios/nrpe.d/check_opensearch_shards_9200.cfg\n@@ -0,0 +1,2 @@\n+# File generated by puppet. DO NOT edit by hand\n+command[check_opensearch_shards_9200]=/usr/lib/nagios/plugins/check_elasticsearch.py --ignore-status --url http://localhost:9200 --shards-inactive '>=0.15' --timeout 4", "parameters": "--- File[/etc/nagios/nrpe.d/check_opensearch_shards_9200.cfg].orig\n+++ File[/etc/nagios/nrpe.d/check_opensearch_shards_9200.cfg]\n\n+    owner   => root\n+    require => Package[nagios-nrpe-server]\n+    group   => root\n+    tag     => nrpe::check\n+    ensure  => present\n+    mode    => 0444\n+    notify  => Service[nagios-nrpe-server]\n"}, {"resource": "File[/lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer]", "content": "--- /lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer.orig\n+++ /lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer\n@@ -0,0 +1,14 @@\n+[Unit]\n+Description=Periodic execution of nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service\n+\n+[Timer]\n+Unit=nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service\n+# Accuracy sets the maximum time interval around the execution time we want to allow\n+AccuracySec=15sec\n+OnUnitInactiveSec=5min\n+OnActiveSec=1s\n+RandomizedDelaySec=300\n+FixedRandomDelay=true\n+\n+[Install]\n+WantedBy=multi-user.target", "parameters": "--- File[/lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer].orig\n+++ File[/lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer (nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer)]\n"}, {"resource": "File[/lib/systemd/system/nrpe2nodexp-opensearch_shards_9200.service]", "content": "--- /lib/systemd/system/nrpe2nodexp-opensearch_shards_9200.service.orig\n+++ /lib/systemd/system/nrpe2nodexp-opensearch_shards_9200.service\n@@ -0,0 +1,11 @@\n+[Unit]\n+Description=execution of nrpe2nodexp for the check_opensearch_shards_9200 command.\n+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+\n+[Service]\n+Type=oneshot\n+User=nagios\n+\n+Group=prometheus-node-exporter\n+SyslogIdentifier=nrpe2nodexp-opensearch_shards_9200\n+ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash \"fd6eadf747c645a72e11bd74109a8156\" --timeout 10 --check-command \"check_opensearch_shards_9200\"", "parameters": "--- File[/lib/systemd/system/nrpe2nodexp-opensearch_shards_9200.service].orig\n+++ File[/lib/systemd/system/nrpe2nodexp-opensearch_shards_9200.service]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9200.service (nrpe2nodexp-opensearch_shards_9200.service)]\n"}, {"resource": "Logrotate::Conf[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]", "parameters": "--- Logrotate::Conf[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup].orig\n+++ Logrotate::Conf[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]\n\n+    ensure => present\n"}, {"resource": "File[/lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer]", "content": "--- /lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer.orig\n+++ /lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer\n@@ -0,0 +1,14 @@\n+[Unit]\n+Description=Periodic execution of nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service\n+\n+[Timer]\n+Unit=nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service\n+# Accuracy sets the maximum time interval around the execution time we want to allow\n+AccuracySec=15sec\n+OnUnitInactiveSec=5min\n+OnActiveSec=1s\n+RandomizedDelaySec=300\n+FixedRandomDelay=true\n+\n+[Install]\n+WantedBy=multi-user.target", "parameters": "--- File[/lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer].orig\n+++ File[/lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer (nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer)]\n"}, {"resource": "Exec[systemd reload for nginx systemd fragments]", "parameters": "--- Exec[systemd reload for nginx systemd fragments].orig\n+++ Exec[systemd reload for nginx systemd fragments]\n\n+    command     => /bin/systemctl daemon-reload\n+    subscribe   => ['File[/etc/systemd/system/nginx.service.d/numa.conf]', 'File[/etc/systemd/system/nginx.service.d/security.conf]']\n+    refreshonly => True\n"}, {"resource": "File[/lib/systemd/system/push_cross_cluster_settings_9200.service]", "content": "--- /lib/systemd/system/push_cross_cluster_settings_9200.service.orig\n+++ /lib/systemd/system/push_cross_cluster_settings_9200.service\n@@ -0,0 +1,8 @@\n+[Unit]\n+Description=Auto set remote cluster seeds for relforge-eqiad\n+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+\n+[Service]\n+Type=oneshot\n+User=root\n+ExecStart=/bin/bash /usr/local/bin/set-cross-cluster-seeds_9200.sh", "parameters": "--- File[/lib/systemd/system/push_cross_cluster_settings_9200.service].orig\n+++ File[/lib/systemd/system/push_cross_cluster_settings_9200.service]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for push_cross_cluster_settings_9200.service (push_cross_cluster_settings_9200.service)]\n"}, {"resource": "Systemd::Service[nrpe2nodexp-opensearch_shard_size_check_9400]", "parameters": "--- Systemd::Service[nrpe2nodexp-opensearch_shard_size_check_9400].orig\n+++ Systemd::Service[nrpe2nodexp-opensearch_shard_size_check_9400]\n\n+    override                 => False\n+    restart                  => False\n+    require                  => Systemd::Unit[nrpe2nodexp-opensearch_shard_size_check_9400.service]\n+    ensure                   => absent\n+    unit_type                => timer\n+    migration_task           => T407130\n+    monitoring_enabled       => False\n+    monitoring_contact_group => admins\n+    service_params           => {}\n+    monitoring_critical      => False\n"}, {"resource": "Ferm::Service[elastic-main-https-9243]", "parameters": "--- Ferm::Service[elastic-main-https-9243].orig\n+++ Ferm::Service[elastic-main-https-9243]\n\n+    unrestricted_access => False\n+    ensure              => present\n+    notrack             => False\n+    srange              => (10.64.16.154 2620:0:861:102:10:64:16:154 10.192.32.49 2620:0:860:103:10:192:32:49)\n+    prio                => 10\n+    desc                => \n+    port                => 9243\n+    proto               => tcp\n"}, {"resource": "File[/etc/rsyslog.d/40-wmf-auto-restart-prometheus-wmf-elasticsearch-exporter-9400.conf]", "content": "--- /etc/rsyslog.d/40-wmf-auto-restart-prometheus-wmf-elasticsearch-exporter-9400.conf.orig\n+++ /etc/rsyslog.d/40-wmf-auto-restart-prometheus-wmf-elasticsearch-exporter-9400.conf\n@@ -0,0 +1,10 @@\n+# rsyslog.conf(5) configuration file for services.\n+# This file is managed by Puppet.\n+if $programname startswith \"wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400\" then {\n+    action(\n+        type=\"omfile\" file=\"/var/log/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400/syslog.log\"\n+        fileOwner=\"root\" fileGroup=\"root\"\n+        fileCreateMode=\"0644\"\n+    )\n+    & stop\n+}", "parameters": "--- File[/etc/rsyslog.d/40-wmf-auto-restart-prometheus-wmf-elasticsearch-exporter-9400.conf].orig\n+++ File[/etc/rsyslog.d/40-wmf-auto-restart-prometheus-wmf-elasticsearch-exporter-9400.conf]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Service[rsyslog]\n"}, {"resource": "Systemd::Timer::Job[nrpe2nodexp-opensearch_unassigned_shard_check_9400]", "parameters": "--- Systemd::Timer::Job[nrpe2nodexp-opensearch_unassigned_shard_check_9400].orig\n+++ Systemd::Timer::Job[nrpe2nodexp-opensearch_unassigned_shard_check_9400]\n\n+    send_mail                 => False\n+    user                      => nagios\n+    monitoring_enabled        => False\n+    logfile_name              => syslog.log\n+    logging_enabled           => False\n+    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash \"a0a4892478c289e50484ffd2fb4c3202\" --timeout 10 --check-command \"check_opensearch_unassigned_shard_check_9400\"\n+    private_tmp               => False\n+    splay                     => 43200\n+    description               => execution of nrpe2nodexp for the check_opensearch_unassigned_shard_check_9400 command.\n+    syslog_force_stop         => True\n+    ignore_errors             => True\n+    send_mail_only_on_error   => True\n+    fixed_random_delay        => True\n+    logfile_perms             => all\n+    syslog_identifier         => nrpe2nodexp-opensearch_unassigned_shard_check_9400\n+    ensure                    => absent\n+    logfile_basedir           => /var/log\n+    environment               => {}\n+    logfile_group             => root\n+    send_mail_to              => root@relforge1008.eqiad.wmnet\n+    group                     => prometheus-node-exporter\n+    success_exit_status       => []\n+    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '720min'}]\n+    monitoring_contact_groups => admins\n+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+    syslog_match_startswith   => True\n"}, {"resource": "Rsyslog::Conf[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]", "parameters": "--- Rsyslog::Conf[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400].orig\n+++ Rsyslog::Conf[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]\n\n+    mode     => 0444\n+    priority => 40\n+    require  => File[/var/log/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]\n+    ensure   => present\n"}, {"resource": "Logstash::Conf[output-udp-gelf_relay]", "parameters": "--- Logstash::Conf[output-udp-gelf_relay].orig\n+++ Logstash::Conf[output-udp-gelf_relay]\n\n+    priority => 90\n+    ensure   => present\n"}, {"resource": "Monitoring::Service[check_push_cross_cluster_settings_9400_status]", "parameters": "--- Monitoring::Service[check_push_cross_cluster_settings_9400_status].orig\n+++ Monitoring::Service[check_push_cross_cluster_settings_9400_status]\n\n+    check_command  => nrpe_check!check_check_push_cross_cluster_settings_9400_status!10\n+    retry_interval => 1\n+    freshness      => 36000\n+    ensure         => present\n+    check_interval => 10\n+    config_dir     => /etc/nagios\n+    migration_task => T407130\n+    contact_group  => admins\n+    host           => relforge1008\n+    critical       => False\n+    retries        => 2\n+    passive        => False\n+    description    => Check unit status of push_cross_cluster_settings_9400\n+    notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n"}, {"resource": "Service[nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer]", "parameters": "--- Service[nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer].orig\n+++ Service[nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer]\n\n+    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer (nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer)]']\n+    provider => systemd\n+    enable   => False\n+    ensure   => stopped\n"}, {"resource": "Rsyslog::Conf[opensearch-relforge-eqiad-gc-log-cleanup]", "parameters": "--- Rsyslog::Conf[opensearch-relforge-eqiad-gc-log-cleanup].orig\n+++ Rsyslog::Conf[opensearch-relforge-eqiad-gc-log-cleanup]\n\n+    mode     => 0444\n+    priority => 40\n+    require  => File[/var/log/opensearch-relforge-eqiad-gc-log-cleanup]\n+    ensure   => present\n"}, {"resource": "File[/usr/lib/nagios/plugins/check_elasticsearch.py]", "parameters": "--- File[/usr/lib/nagios/plugins/check_elasticsearch.py].orig\n+++ File[/usr/lib/nagios/plugins/check_elasticsearch.py]\n\n+    owner  => root\n+    mode   => 0755\n+    group  => root\n+    source => puppet:///modules/icinga/elasticsearch/check_elasticsearch.py\n"}, {"resource": "Exec[apt_repository_wikimedia-opensearch]", "parameters": "--- Exec[apt_repository_wikimedia-opensearch].orig\n+++ Exec[apt_repository_wikimedia-opensearch]\n\n+    command     => /usr/bin/apt-get update \n+    refreshonly => True\n"}, {"resource": "Logrotate::Conf[push_cross_cluster_settings_9200]", "parameters": "--- Logrotate::Conf[push_cross_cluster_settings_9200].orig\n+++ Logrotate::Conf[push_cross_cluster_settings_9200]\n\n+    ensure => present\n"}, {"resource": "File[/etc/opensearch/relforge-eqiad-small-alpha/opensearch.yml]", "content": "--- /etc/opensearch/relforge-eqiad-small-alpha/opensearch.yml.orig\n+++ /etc/opensearch/relforge-eqiad-small-alpha/opensearch.yml\n@@ -0,0 +1,199 @@\n+# ======================== OpenSearch Configuration =========================\n+#\n+# NOTE: OpenSearch comes with reasonable defaults for most settings.\n+#       Before you set out to tweak and tune the configuration, make sure you\n+#       understand what are you trying to accomplish and the consequences.\n+#\n+# The primary way of configuring a node is via this file. This template lists\n+# the most important settings you may want to configure for a production cluster.\n+#\n+# Please consult the documentation for further information on configuration options:\n+# https://opensearch.org/docs/opensearch/configuration/\n+#\n+# ---------------------------------- Cluster -----------------------------------\n+#\n+# Use a descriptive name for your cluster:\n+#\n+cluster.name: relforge-eqiad-small-alpha\n+#\n+# ------------------------------------ Node ------------------------------------\n+#\n+# Use a descriptive name for the node:\n+#\n+node.name: relforge1008-relforge-eqiad-small-alpha\n+#\n+# Add custom attributes to the node:\n+#\n+#node.attr.rack: r1\n+#\n+# Row/rack awareness attributes\n+#\n+cluster.routing.allocation.awareness.attributes: row\n+node.attr.row: eqiad-row-c\n+node.attr.rack: C4\n+#\n+# Other attributes\n+#\n+node.attr.hostname: relforge1008\n+node.attr.fqdn: relforge1008.eqiad.wmnet\n+#\n+# Allow this node to be eligible as a master node (enabled by default):\n+node.master: true\n+# Allow this node to store data (enabled by default):\n+node.data: true\n+#\n+# ----------------------------------- Paths ------------------------------------\n+#\n+# Path to directory where to store the data (separate multiple locations by comma):\n+#\n+path.data: /srv/opensearch/relforge-eqiad-small-alpha\n+#\n+# Path to log files:\n+#\n+path.logs: /var/log/opensearch\n+#\n+# ----------------------------------- Memory -----------------------------------\n+#\n+# Lock the memory on startup:\n+#\n+bootstrap.memory_lock: false # we don't have swap anyway\n+#\n+# Make sure that the heap size is set to about half the memory available\n+# on the system and that the owner of the process is allowed to use this\n+# limit.\n+#\n+# OpenSearch performs poorly when the system is swapping the memory.\n+#\n+# ---------------------------------- Network -----------------------------------\n+#\n+# Set the bind address to a specific IP (IPv4 or IPv6):\n+#\n+#network.host: 192.168.0.1\n+#\n+# Set a custom port for HTTP:\n+#\n+http.port: 9400\n+#\n+# For more information, consult the network module documentation.\n+#\n+# Set the address other nodes will use to communicate with this node. If not\n+# set, it is automatically derived. It must point to an actual IP address.\n+#\n+network.publish_host: 10.64.32.100\n+\n+# Set both 'bind_host' and 'publish_host':\n+#\n+network.host: [ _local_,_site_ ]\n+\n+# Set a custom port for the node to node communication (9300 by default):\n+#\n+transport.tcp.port: 9500\n+#\n+# --------------------------------- Discovery ----------------------------------\n+#\n+# Pass an initial list of hosts to perform discovery when this node is started:\n+# The default list of hosts is [\"127.0.0.1\", \"[::1]\"]\n+#\n+#discovery.seed_hosts: [\"host1\", \"host2\"]\n+#\n+# Bootstrap the cluster using an initial set of master-eligible nodes:\n+#\n+#cluster.initial_master_nodes: [\"node-1\", \"node-2\"]\n+#\n+discovery.zen.ping.unicast.hosts: [\"relforge1008.eqiad.wmnet\", \"relforge1009.eqiad.wmnet\", \"relforge1010.eqiad.wmnet\"]\n+#\n+# For more information, consult the discovery and cluster formation module documentation.\n+#\n+# ---------------------------------- Gateway -----------------------------------\n+#\n+# Block initial recovery after a full cluster restart until N nodes are started:\n+#\n+gateway.recover_after_nodes: 1\n+#\n+# For more information, consult the gateway module documentation.\n+#\n+#\n+gateway:\n+    recover_after_time: 1m\n+    expected_nodes: 2\n+#\n+# ---------------------------------- Various -----------------------------------\n+#\n+# Require explicit names when deleting indices:\n+#\n+#action.destructive_requires_name: true\n+#\n+# ---------------------------------- Custom settings ---------------------------\n+#\n+# If a plugin listed here is not installed for current node, the node will not start.\n+#\n+plugin.mandatory: analysis-hebrew,analysis-icu,analysis-smartcn,analysis-stempel,analysis-ukrainian,cirrus-highlighter,opensearch-analysis-stconvert,opensearch-extra,opensearch-extra-analysis-esperanto,opensearch-extra-analysis-serbian,opensearch-extra-analysis-slovak,ltr\n+\n+# Specify the pattern of index names allowed to be created automatically\n+action.auto_create_index: true\n+\n+# Protect against accidental close/delete operations on all indices. You can\n+# still close/delete individual indices.\n+action.destructive_requires_name: true\n+\n+# Allow up to 1000 shards to be queried at a time. The default\n+# 1k is too low to allow mwgrep to operate.\n+action.search.shard_count.limit: 1000\n+\n+# Enable the disk space aware shard allocator\n+cluster.routing.allocation.disk.threshold_enabled: true\n+# Stop allocating new shards to nodes when this threshold is reached\n+cluster.routing.allocation.disk.watermark.low: 0.75\n+# Move shards off of nodes when this threshold is reached\n+cluster.routing.allocation.disk.watermark.high: 0.80\n+# Set indexes read-only with allocated shards on affected node when this threshold is reached\n+cluster.routing.allocation.disk.watermark.flood_stage: 0.95\n+# Check disk utilization every 60 seconds\n+cluster.info.update.interval: 60s\n+\n+# Set the number of concurrent recoveries happening on a node:\n+#\n+# 1. During the initial recovery\n+cluster.routing.allocation.node_initial_primaries_recoveries: 3\n+\n+# 2. During adding/removing nodes, rebalancing, etc\n+cluster.routing.allocation.node_concurrent_recoveries: 2\n+\n+# Set to throttle throughput when recovering (eg. 100mb, by default 20mb):\n+indices.recovery.max_bytes_per_sec: 40mb\n+\n+##\n+# OpenSearch cluster balance configuration\n+##\n+# This puts much more weight on distributing the shards per index then the defaults.  This will make sure that,\n+# for example, each live node gets a copy of enwiki.\n+cluster.routing.allocation.balance:\n+    shard: 0.195\n+    index: 0.8\n+\n+##\n+# Filter cache size\n+##\n+indices.queries.cache.size: 20%\n+\n+##\n+# Thread pool settings\n+##\n+thread_pool:\n+    write:\n+        size: 32\n+        queue_size: 1000\n+\n+\n+\n+\n+##\n+# Hosts allowed as data sources for reindexing\n+reindex.remote.whitelist: \"search.svc.eqiad.wmnet:9243,search.svc.codfw.wmnet:9243\"\n+\n+\n+##\n+# Size the LTR cache to prevent churn under normal and AB testing scenarios\n+ltr.caches.max_mem: 100mb\n+\n+", "parameters": "--- File[/etc/opensearch/relforge-eqiad-small-alpha/opensearch.yml].orig\n+++ File[/etc/opensearch/relforge-eqiad-small-alpha/opensearch.yml]\n\n+    owner  => root\n+    mode   => 0444\n+    group  => root\n+    ensure => file\n"}, {"resource": "File[/etc/rsyslog.d/40-push-cross-cluster-settings-9400.conf]", "content": "--- /etc/rsyslog.d/40-push-cross-cluster-settings-9400.conf.orig\n+++ /etc/rsyslog.d/40-push-cross-cluster-settings-9400.conf\n@@ -0,0 +1,10 @@\n+# rsyslog.conf(5) configuration file for services.\n+# This file is managed by Puppet.\n+if $programname startswith \"push_cross_cluster_settings_9400\" then {\n+    action(\n+        type=\"omfile\" file=\"/var/log/push_cross_cluster_settings_9400/syslog.log\"\n+        fileOwner=\"root\" fileGroup=\"root\"\n+        fileCreateMode=\"0644\"\n+    )\n+    & stop\n+}", "parameters": "--- File[/etc/rsyslog.d/40-push-cross-cluster-settings-9400.conf].orig\n+++ File[/etc/rsyslog.d/40-push-cross-cluster-settings-9400.conf]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Service[rsyslog]\n"}, {"resource": "Systemd::Unit[opensearch-disable-readahead.service]", "parameters": "--- Systemd::Unit[opensearch-disable-readahead.service].orig\n+++ Systemd::Unit[opensearch-disable-readahead.service]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => absent\n+    override_filename => puppet-override.conf\n+    unit              => opensearch-disable-readahead.service\n"}, {"resource": "Service[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer]", "parameters": "--- Service[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer].orig\n+++ Service[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer]\n\n+    ensure   => running\n+    provider => systemd\n+    enable   => True\n"}, {"resource": "Class[Profile::Java]", "parameters": "--- Class[Profile::Java].orig\n+++ Class[Profile::Java]\n\n+    trust_puppet_ca => True\n+    enable_dbg      => False\n+    hardened_tls    => False\n+    extra_args      => {}\n+    egd_source      => /dev/random\n+    java_packages   => []\n"}, {"resource": "Systemd::Unit[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service]", "parameters": "--- Systemd::Unit[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service].orig\n+++ Systemd::Unit[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => present\n+    override_filename => puppet-override.conf\n+    unit              => wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service\n"}, {"resource": "Exec[symlink /etc/opensearch/relforge-eqiad/sudachi]", "parameters": "--- Exec[symlink /etc/opensearch/relforge-eqiad/sudachi].orig\n+++ Exec[symlink /etc/opensearch/relforge-eqiad/sudachi]\n\n+    creates => /etc/opensearch/relforge-eqiad/sudachi\n+    command => /usr/bin/ln -s '/usr/share/opensearch/config/sudachi' '/etc/opensearch/relforge-eqiad/sudachi'\n+    onlyif  => /usr/bin/test -d '/usr/share/opensearch/config/sudachi'\n"}, {"resource": "Systemd::Service[prometheus-wmf-elasticsearch-exporter-9400]", "parameters": "--- Systemd::Service[prometheus-wmf-elasticsearch-exporter-9400].orig\n+++ Systemd::Service[prometheus-wmf-elasticsearch-exporter-9400]\n\n+    subscribe                => File[/usr/local/bin/prometheus-wmf-elasticsearch-exporter]\n+    override                 => False\n+    restart                  => True\n+    require                  => File[/usr/local/bin/prometheus-wmf-elasticsearch-exporter]\n+    ensure                   => present\n+    unit_type                => service\n+    migration_task           => T407130\n+    monitoring_enabled       => False\n+    monitoring_contact_group => admins\n+    service_params           => {}\n+    monitoring_critical      => False\n"}, {"resource": "File[/etc/opensearch]", "parameters": "--- File[/etc/opensearch].orig\n+++ File[/etc/opensearch]\n\n+    owner   => root\n+    group   => root\n+    recurse => True\n+    force   => True\n+    ensure  => directory\n+    mode    => 0755\n+    purge   => True\n"}, {"resource": "File[/etc/opensearch/relforge-eqiad/opensearch.keystore]", "parameters": "--- File[/etc/opensearch/relforge-eqiad/opensearch.keystore].orig\n+++ File[/etc/opensearch/relforge-eqiad/opensearch.keystore]\n\n+    owner => root\n+    mode  => 0640\n+    group => opensearch\n"}, {"resource": "File[/lib/systemd/system/push_cross_cluster_settings_9200.timer]", "content": "--- /lib/systemd/system/push_cross_cluster_settings_9200.timer.orig\n+++ /lib/systemd/system/push_cross_cluster_settings_9200.timer\n@@ -0,0 +1,13 @@\n+[Unit]\n+Description=Periodic execution of push_cross_cluster_settings_9200.service\n+\n+[Timer]\n+Unit=push_cross_cluster_settings_9200.service\n+# Accuracy sets the maximum time interval around the execution time we want to allow\n+AccuracySec=15sec\n+OnUnitActiveSec=15min\n+OnActiveSec=1s\n+RandomizedDelaySec=0\n+\n+[Install]\n+WantedBy=multi-user.target", "parameters": "--- File[/lib/systemd/system/push_cross_cluster_settings_9200.timer].orig\n+++ File[/lib/systemd/system/push_cross_cluster_settings_9200.timer]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for push_cross_cluster_settings_9200.timer (push_cross_cluster_settings_9200.timer)]\n"}, {"resource": "File[/etc/update-motd.d/96-cluster-memberships]", "parameters": "--- File[/etc/update-motd.d/96-cluster-memberships].orig\n+++ File[/etc/update-motd.d/96-cluster-memberships]\n\n+    owner  => root\n+    source => puppet:///modules/opensearch/opensearch.motd\n+    group  => root\n+    ensure => present\n+    mode   => 0555\n"}, {"resource": "Systemd::Syslog[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]", "parameters": "--- Systemd::Syslog[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200].orig\n+++ Systemd::Syslog[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]\n\n+    readable_by            => all\n+    force_stop             => True\n+    ensure                 => present\n+    programname_comparison => startswith\n+    log_filename           => syslog.log\n+    owner                  => root\n+    group                  => root\n+    base_dir               => /var/log\n"}, {"resource": "File[/usr/local/bin/jheapdump]", "parameters": "--- File[/usr/local/bin/jheapdump].orig\n+++ File[/usr/local/bin/jheapdump]\n\n+    owner  => root\n+    source => puppet:///modules/java/jheapdump\n+    group  => root\n+    ensure => file\n+    mode   => 0555\n"}, {"resource": "File[/etc/sysctl.d/70-TCP-Fast-Open.conf]", "content": "--- /etc/sysctl.d/70-TCP-Fast-Open.conf.orig\n+++ /etc/sysctl.d/70-TCP-Fast-Open.conf\n@@ -0,0 +1,2 @@\n+# sysctl parameters managed by Puppet.\n+net.ipv4.tcp_fastopen = 3", "parameters": "--- File[/etc/sysctl.d/70-TCP-Fast-Open.conf].orig\n+++ File[/etc/sysctl.d/70-TCP-Fast-Open.conf]\n\n+    owner  => root\n+    notify => Exec[update_sysctl]\n+    group  => root\n+    ensure => present\n"}, {"resource": "Opensearch::Keystore[s3-credentials-user-relforge-eqiad-small-alpha]", "parameters": "--- Opensearch::Keystore[s3-credentials-user-relforge-eqiad-small-alpha].orig\n+++ Opensearch::Keystore[s3-credentials-user-relforge-eqiad-small-alpha]\n\n+    key          => s3.client.default.access_key\n+    value        => search:platform\n+    cluster_name => relforge-eqiad-small-alpha\n"}, {"resource": "File[/etc/logrotate.d/nginx]", "parameters": "--- File[/etc/logrotate.d/nginx].orig\n+++ File[/etc/logrotate.d/nginx]\n\n+    before => ['Service[nginx]']\n+    owner  => root\n+    source => puppet:///modules/profile/tlsproxy/logrotate\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n"}, {"resource": "Opensearch::Cross_cluster_settings[relforge-eqiad-small-alpha]", "parameters": "--- Opensearch::Cross_cluster_settings[relforge-eqiad-small-alpha].orig\n+++ Opensearch::Cross_cluster_settings[relforge-eqiad-small-alpha]\n\n+    enable_remote_search => False\n+    instance_name        => relforge-eqiad-small-alpha\n+    settings             => {'relforge-eqiad': {'awareness_attributes': 'row', 'recover_after_nodes': 1, 'recover_after_time': '1m', 'search_shard_count_limit': 1000, 'reindex_remote_whitelist': 'search.svc.eqiad.wmnet:9243,search.svc.codfw.wmnet:9243', 'bulk_thread_pool_executors': 32, 'bulk_thread_pool_capacity': 1000, 'ltr_cache_size': '100mb', 'auto_create_index': True, 'plugins_mandatory': ['analysis-hebrew', 'analysis-icu', 'analysis-smartcn', 'analysis-stempel', 'analysis-ukrainian', 'cirrus-highlighter', 'opensearch-analysis-stconvert', 'opensearch-extra', 'opensearch-extra-analysis-esperanto', 'opensearch-extra-analysis-serbian', 'opensearch-extra-analysis-slovak', 'ltr'], 'filter_cache_size': '20%', 'script_max_compilations_per_minute': 10000, 'send_logs_to_logstash': True, 'disable_security_plugin': True, 'unicast_hosts': ['relforge1008.eqiad.wmnet', 'relforge1009.eqiad.wmnet', 'relforge1010.eqiad.wmnet'], 'cluster_hosts': ['relforge1008.eqiad.wmnet', 'relforge1009.eqiad.wmnet', 'relforge1010.eqiad.wmnet'], 'expected_nodes': 2, 'cluster_name': 'relforge-eqiad', 'short_cluster_name': 'chi', 'heap_memory': '30G', 'http_port': 9200, 'tls_port': 9243, 'transport_tcp_port': 9300, 'certificate_name': 'relforge.svc.eqiad.wmnet'}, 'relforge-eqiad-small-alpha': {'awareness_attributes': 'row', 'recover_after_nodes': 1, 'recover_after_time': '1m', 'search_shard_count_limit': 1000, 'reindex_remote_whitelist': 'search.svc.eqiad.wmnet:9243,search.svc.codfw.wmnet:9243', 'bulk_thread_pool_executors': 32, 'bulk_thread_pool_capacity': 1000, 'ltr_cache_size': '100mb', 'auto_create_index': True, 'plugins_mandatory': ['analysis-hebrew', 'analysis-icu', 'analysis-smartcn', 'analysis-stempel', 'analysis-ukrainian', 'cirrus-highlighter', 'opensearch-analysis-stconvert', 'opensearch-extra', 'opensearch-extra-analysis-esperanto', 'opensearch-extra-analysis-serbian', 'opensearch-extra-analysis-slovak', 'ltr'], 'filter_cache_size': '20%', 'script_max_compilations_per_minute': 10000, 'send_logs_to_logstash': True, 'disable_security_plugin': True, 'unicast_hosts': ['relforge1008.eqiad.wmnet', 'relforge1009.eqiad.wmnet', 'relforge1010.eqiad.wmnet'], 'cluster_hosts': ['relforge1008.eqiad.wmnet', 'relforge1009.eqiad.wmnet', 'relforge1010.eqiad.wmnet'], 'expected_nodes': 2, 'cluster_name': 'relforge-eqiad-small-alpha', 'short_cluster_name': 'omega', 'heap_memory': '4G', 'http_port': 9400, 'tls_port': 9443, 'transport_tcp_port': 9500, 'certificate_name': 'relforge.svc.eqiad.wmnet'}}\n"}, {"resource": "File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-shard-size-check-9200.conf]", "content": "--- /etc/rsyslog.d/25-nrpe2nodexp-opensearch-shard-size-check-9200.conf.orig\n+++ /etc/rsyslog.d/25-nrpe2nodexp-opensearch-shard-size-check-9200.conf\n@@ -0,0 +1,10 @@\n+# SPDX-License-Identifier: Apache-2.0\n+if $programname contains \"nrpe2nodexp-opensearch_shard_size_check_9200\" then {\n+    if ($msg contains \"\\\"ecs.version\\\": \\\"1.7.0\\\"\") then {\n+        # Send logs to kafka\n+        set $.log_outputs = \"kafka ecs_170 local\";\n+    } else {\n+        # Filter out non-relevant nrpe2nodexp messages\n+        stop\n+    }\n+}", "parameters": "--- File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-shard-size-check-9200.conf].orig\n+++ File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-shard-size-check-9200.conf]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Service[rsyslog]\n"}, {"resource": "Rsyslog::Conf[clean_up_dlq]", "parameters": "--- Rsyslog::Conf[clean_up_dlq].orig\n+++ Rsyslog::Conf[clean_up_dlq]\n\n+    mode     => 0444\n+    priority => 40\n+    require  => File[/var/log/clean_up_dlq]\n+    ensure   => absent\n"}, {"resource": "File[/usr/local/bin/logstash-config-test]", "parameters": "--- File[/usr/local/bin/logstash-config-test].orig\n+++ File[/usr/local/bin/logstash-config-test]\n\n+    owner   => root\n+    source  => puppet:///modules/logstash/logstash-config-test\n+    group   => root\n+    require => Package[logstash-oss]\n+    mode    => 0555\n"}, {"resource": "Systemd::Timer::Job[opensearch-disable-readahead]", "parameters": "--- Systemd::Timer::Job[opensearch-disable-readahead].orig\n+++ Systemd::Timer::Job[opensearch-disable-readahead]\n\n+    send_mail                 => False\n+    user                      => root\n+    monitoring_enabled        => False\n+    logfile_name              => syslog.log\n+    logging_enabled           => True\n+    command                   => /usr/local/bin/opensearch-disable-readahead.sh\n+    private_tmp               => False\n+    description               => Disables readahead on all open files every 30 minutes to alleviate Cirrussearch / opensearch IO load spikes\n+    syslog_force_stop         => True\n+    ignore_errors             => False\n+    send_mail_only_on_error   => True\n+    fixed_random_delay        => False\n+    logfile_perms             => all\n+    ensure                    => absent\n+    logfile_basedir           => /var/log\n+    environment               => {}\n+    logfile_group             => root\n+    send_mail_to              => root@relforge1008.eqiad.wmnet\n+    success_exit_status       => []\n+    interval                  => [{'start': 'OnUnitActiveSec', 'interval': '30min'}, {'start': 'OnBootSec', 'interval': '1min'}]\n+    monitoring_contact_groups => admins\n+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+    syslog_match_startswith   => True\n"}, {"resource": "Service[logstash]", "parameters": "--- Service[logstash].orig\n+++ Service[logstash]\n\n+    provider   => systemd\n+    hasrestart => True\n+    ensure     => running\n+    hasstatus  => True\n+    enable     => True\n"}, {"resource": "Exec[systemd daemon-reload for opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer (opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer)]", "parameters": "--- Exec[systemd daemon-reload for opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer (opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer)].orig\n+++ Exec[systemd daemon-reload for opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer (opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer)]\n\n+    before      => ['Service[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer]']\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "File[/var/lib/prometheus/node.d/check_opensearch_shards_9200.prom]", "parameters": "--- File[/var/lib/prometheus/node.d/check_opensearch_shards_9200.prom].orig\n+++ File[/var/lib/prometheus/node.d/check_opensearch_shards_9200.prom]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n"}, {"resource": "Exec[systemd daemon-reload for opensearch_1@.service (opensearch_1@.service)]", "parameters": "--- Exec[systemd daemon-reload for opensearch_1@.service (opensearch_1@.service)].orig\n+++ Exec[systemd daemon-reload for opensearch_1@.service (opensearch_1@.service)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Exec[renew certificate - discovery2026__relforge1008_eqiad_wmnet]", "parameters": "--- Exec[renew certificate - discovery2026__relforge1008_eqiad_wmnet].orig\n+++ Exec[renew certificate - discovery2026__relforge1008_eqiad_wmnet]\n\n+    environment => ['GODEBUG=x509ignoreCN=0']\n+    command     => /usr/bin/cfssl sign -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/relforge1008.eqiad.wmnet.pem -label discovery2026  /etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet\n\n+    unless      => /usr/bin/openssl x509 -in /etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.pem -checkend 952200\n+    require     => Exec[Generate cert discovery2026__relforge1008_eqiad_wmnet]\n"}, {"resource": "Monitoring::Service[opensearch_shards_9400]", "parameters": "--- Monitoring::Service[opensearch_shards_9400].orig\n+++ Monitoring::Service[opensearch_shards_9400]\n\n+    check_command  => nrpe_check!check_opensearch_shards_9400!10\n+    retry_interval => 1\n+    freshness      => 36000\n+    ensure         => present\n+    check_interval => 1\n+    config_dir     => /etc/nagios\n+    migration_task => T371083\n+    contact_group  => admins,team-discovery\n+    host           => relforge1008\n+    critical       => False\n+    retries        => 3\n+    passive        => False\n+    description    => OpenSearch health check for shards on 9400\n+    notes_url      => https://wikitech.wikimedia.org/wiki/Search#Administration\n"}, {"resource": "File[/etc/logrotate.d/opensearch]", "content": "--- /etc/logrotate.d/opensearch.orig\n+++ /etc/logrotate.d/opensearch\n@@ -0,0 +1,12 @@\n+# This file is managed by Puppet.\n+# puppet:///logrotate/logrotate.erb\n+\n+/var/log/opensearch/*.log {\n+    notifempty\n+    daily\n+    copytruncate\n+    rotate 7\n+    compress\n+    delaycompress\n+    missingok\n+}", "parameters": "--- File[/etc/logrotate.d/opensearch].orig\n+++ File[/etc/logrotate.d/opensearch]\n\n+    owner  => root\n+    mode   => 0444\n+    group  => root\n+    ensure => present\n"}, {"resource": "Prometheus::Alert::Rule[check_opensearch_shard_size_check_9200_c62725841c61e20ac3f6819b4c0ad800]", "parameters": "--- Prometheus::Alert::Rule[check_opensearch_shard_size_check_9200_c62725841c61e20ac3f6819b4c0ad800].orig\n+++ Prometheus::Alert::Rule[check_opensearch_shard_size_check_9200_c62725841c61e20ac3f6819b4c0ad800]\n\n+    for                => 1800m\n+    team               => observability\n+    ensure             => absent\n+    dashboard          => TODO\n+    instance           => ops\n+    runbook            => https://wikitech.wikimedia.org/wiki/Search#If_it_has_been_indexed\n+    severity           => info\n+    def_label_whitelst => ['team', 'severity']\n+    alert_name         => nrpe_OpenSearch_shard_size_check___9200\n+    site               => eqiad\n+    group              => nrpechecks\n+    summary            => NRPE CHECK: OpenSearch shard size check - 9200\n+    expr               => (nagios_nrpe_check_result{alert_rule_hash=\"c62725841c61e20ac3f6819b4c0ad800\",check_name=\"check_opensearch_shard_size_check_9200\", status=~\"(WARNING|CRITICAL)\", severity=~\"(warning|critical)\"} > 0) * on (instance) group_left (team) role_owner\n+    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_opensearch_shard_size_check_9200))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))\n+    description        => NRPE CHECK: OpenSearch shard size check - 9200\n"}, {"resource": "Systemd::Service[opensearch-disable-readahead-relforge-eqiad]", "parameters": "--- Systemd::Service[opensearch-disable-readahead-relforge-eqiad].orig\n+++ Systemd::Service[opensearch-disable-readahead-relforge-eqiad]\n\n+    override                 => False\n+    restart                  => False\n+    require                  => Systemd::Unit[opensearch-disable-readahead-relforge-eqiad.service]\n+    ensure                   => present\n+    unit_type                => timer\n+    migration_task           => T407130\n+    monitoring_enabled       => False\n+    monitoring_contact_group => admins\n+    service_params           => {}\n+    monitoring_critical      => False\n"}, {"resource": "Logrotate::Conf[opensearch-disable-readahead-relforge-eqiad-small-alpha]", "parameters": "--- Logrotate::Conf[opensearch-disable-readahead-relforge-eqiad-small-alpha].orig\n+++ Logrotate::Conf[opensearch-disable-readahead-relforge-eqiad-small-alpha]\n\n+    ensure => present\n"}, {"resource": "Exec[unmask_nginx.service]", "parameters": "--- Exec[unmask_nginx.service].orig\n+++ Exec[unmask_nginx.service]\n\n+    command     => /bin/systemctl unmask nginx.service\n+    onlyif      => /bin/readlink -f /etc/systemd/system/nginx.service | grep -q /dev/null\n+    refreshonly => True\n"}, {"resource": "Monitoring::Service[opensearch_shards_9200]", "parameters": "--- Monitoring::Service[opensearch_shards_9200].orig\n+++ Monitoring::Service[opensearch_shards_9200]\n\n+    check_command  => nrpe_check!check_opensearch_shards_9200!10\n+    retry_interval => 1\n+    freshness      => 36000\n+    ensure         => present\n+    check_interval => 1\n+    config_dir     => /etc/nagios\n+    migration_task => T371083\n+    contact_group  => admins,team-discovery\n+    host           => relforge1008\n+    critical       => False\n+    retries        => 3\n+    passive        => False\n+    description    => OpenSearch health check for shards on 9200\n+    notes_url      => https://wikitech.wikimedia.org/wiki/Search#Administration\n"}, {"resource": "File[/etc/opensearch/relforge-eqiad/cirrus_check_settings.json]", "content": "--- /etc/opensearch/relforge-eqiad/cirrus_check_settings.json.orig\n+++ /etc/opensearch/relforge-eqiad/cirrus_check_settings.json\n@@ -0,0 +1,14 @@\n+{\n+  \"persistent\": {\n+    \"cluster.remote.chi.seeds\": [\n+      \"relforge1008.eqiad.wmnet:9300\",\n+      \"relforge1009.eqiad.wmnet:9300\",\n+      \"relforge1010.eqiad.wmnet:9300\"\n+    ],\n+    \"cluster.remote.omega.seeds\": [\n+      \"relforge1008.eqiad.wmnet:9500\",\n+      \"relforge1009.eqiad.wmnet:9500\",\n+      \"relforge1010.eqiad.wmnet:9500\"\n+    ]\n+  }\n+}", "parameters": "--- File[/etc/opensearch/relforge-eqiad/cirrus_check_settings.json].orig\n+++ File[/etc/opensearch/relforge-eqiad/cirrus_check_settings.json]\n\n+    owner  => root\n+    mode   => 0444\n+    group  => root\n+    ensure => file\n"}, {"resource": "Systemd::Timer[nrpe2nodexp-check_push_cross_cluster_settings_9200_status]", "parameters": "--- Systemd::Timer[nrpe2nodexp-check_push_cross_cluster_settings_9200_status].orig\n+++ Systemd::Timer[nrpe2nodexp-check_push_cross_cluster_settings_9200_status]\n\n+    unit_name          => nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service\n+    fixed_random_delay => True\n+    splay              => 300\n+    ensure             => absent\n+    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '5min'}, {'interval': '1s', 'start': 'OnActiveSec'}]\n+    accuracy           => 15sec\n"}, {"resource": "File[/usr/local/bin/set-cross-cluster-seeds_9400.sh]", "content": "--- /usr/local/bin/set-cross-cluster-seeds_9400.sh.orig\n+++ /usr/local/bin/set-cross-cluster-seeds_9400.sh\n@@ -0,0 +1,16 @@\n+#!/bin/bash\n+# SPDX-License-Identifier: Apache-2.0\n+# set-cross-cluster-seeds.sh. Given a json file with opensearch remote seeds,\n+# update OpenSearch cluster with correct settings.\n+# Author: Brian King\n+\n+set -eo pipefail\n+\n+data=\"/etc/opensearch/relforge-eqiad-small-alpha/cirrus_check_settings.json\"\n+\n+logger \"updating cross cluster seed settings via ${data}\"\n+\n+curl -XPUT \\\n+  -H 'content-type: application/json' \\\n+  --data \"@${data}\" \\\n+  http://localhost:9400/_cluster/settings", "parameters": "--- File[/usr/local/bin/set-cross-cluster-seeds_9400.sh].orig\n+++ File[/usr/local/bin/set-cross-cluster-seeds_9400.sh]\n\n+    owner  => root\n+    mode   => 0700\n+    group  => root\n+    ensure => file\n"}, {"resource": "Exec[systemd daemon-reload for opensearch-hot-threads-log.service (opensearch-hot-threads-log.service)]", "parameters": "--- Exec[systemd daemon-reload for opensearch-hot-threads-log.service (opensearch-hot-threads-log.service)].orig\n+++ Exec[systemd daemon-reload for opensearch-hot-threads-log.service (opensearch-hot-threads-log.service)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Concat[/etc/apt/sources.list.d/wikimedia-opensearch.sources]", "parameters": "--- Concat[/etc/apt/sources.list.d/wikimedia-opensearch.sources].orig\n+++ Concat[/etc/apt/sources.list.d/wikimedia-opensearch.sources]\n\n+    warn           => False\n+    format         => plain\n+    ensure         => present\n+    force          => False\n+    show_diff      => True\n+    ensure_newline => False\n+    order          => alpha\n+    owner          => root\n+    group          => root\n+    path           => /etc/apt/sources.list.d/wikimedia-opensearch.sources\n+    mode           => 0444\n+    backup         => puppet\n+    notify         => Exec[apt_repository_wikimedia-opensearch]\n+    replace        => True\n"}, {"resource": "Class[Profile::Opensearch::Monitoring::Base_checks]", "parameters": "--- Class[Profile::Opensearch::Monitoring::Base_checks].orig\n+++ Class[Profile::Opensearch::Monitoring::Base_checks]\n\n+    threshold                     => >=0.15\n+    shard_size_warning            => 110\n+    require                       => ['Class[Profile::Opensearch::Server]']\n+    enable_shard_size_check       => True\n+    shard_size_critical           => 140\n+    enable_unassigned_shard_check => True\n+    timeout                       => 4\n+    enable_health_check           => True\n"}, {"resource": "Logrotate::Conf[wmf_auto_restart_prometheus-elasticsearch-exporter-9400]", "parameters": "--- Logrotate::Conf[wmf_auto_restart_prometheus-elasticsearch-exporter-9400].orig\n+++ Logrotate::Conf[wmf_auto_restart_prometheus-elasticsearch-exporter-9400]\n\n+    ensure => present\n"}, {"resource": "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9200.timer (nrpe2nodexp-opensearch_shards_9200.timer)]", "parameters": "--- Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9200.timer (nrpe2nodexp-opensearch_shards_9200.timer)].orig\n+++ Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9200.timer (nrpe2nodexp-opensearch_shards_9200.timer)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Ferm::Service[opensearch_inter_node_9300]", "parameters": "--- Ferm::Service[opensearch_inter_node_9300].orig\n+++ Ferm::Service[opensearch_inter_node_9300]\n\n@@\n-    notrack => False\n+    notrack => True\n@@\n-    port    => [9300]\n+    port    => 9300\n"}, {"resource": "Systemd::Timer[nrpe2nodexp-opensearch_shard_size_check_9200]", "parameters": "--- Systemd::Timer[nrpe2nodexp-opensearch_shard_size_check_9200].orig\n+++ Systemd::Timer[nrpe2nodexp-opensearch_shard_size_check_9200]\n\n+    unit_name          => nrpe2nodexp-opensearch_shard_size_check_9200.service\n+    fixed_random_delay => True\n+    splay              => 36000\n+    ensure             => absent\n+    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '600min'}, {'interval': '1s', 'start': 'OnActiveSec'}]\n+    accuracy           => 15sec\n"}, {"resource": "File_line[auto_restart_file_presence_prometheus-elasticsearch-exporter-9400]", "parameters": "--- File_line[auto_restart_file_presence_prometheus-elasticsearch-exporter-9400].orig\n+++ File_line[auto_restart_file_presence_prometheus-elasticsearch-exporter-9400]\n\n+    path    => /etc/debdeploy-client/autorestarts.conf\n+    require => File[/etc/debdeploy-client/autorestarts.conf]\n+    line    => prometheus-elasticsearch-exporter-9400\n+    ensure  => present\n"}, {"resource": "Firewall::Service[opensearch-inter-node-9300]", "parameters": "--- Firewall::Service[opensearch-inter-node-9300].orig\n+++ Firewall::Service[opensearch-inter-node-9300]\n\n@@\n-    notrack => False\n+    notrack => True\n@@\n-    port    => [9300]\n+    port    => 9300\n"}, {"resource": "File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-unassigned-shard-check-9200.conf]", "content": "--- /etc/rsyslog.d/25-nrpe2nodexp-opensearch-unassigned-shard-check-9200.conf.orig\n+++ /etc/rsyslog.d/25-nrpe2nodexp-opensearch-unassigned-shard-check-9200.conf\n@@ -0,0 +1,10 @@\n+# SPDX-License-Identifier: Apache-2.0\n+if $programname contains \"nrpe2nodexp-opensearch_unassigned_shard_check_9200\" then {\n+    if ($msg contains \"\\\"ecs.version\\\": \\\"1.7.0\\\"\") then {\n+        # Send logs to kafka\n+        set $.log_outputs = \"kafka ecs_170 local\";\n+    } else {\n+        # Filter out non-relevant nrpe2nodexp messages\n+        stop\n+    }\n+}", "parameters": "--- File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-unassigned-shard-check-9200.conf].orig\n+++ File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-unassigned-shard-check-9200.conf]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Service[rsyslog]\n"}, {"resource": "Systemd::Timer[nrpe2nodexp-opensearch_unassigned_shard_check_9400]", "parameters": "--- Systemd::Timer[nrpe2nodexp-opensearch_unassigned_shard_check_9400].orig\n+++ Systemd::Timer[nrpe2nodexp-opensearch_unassigned_shard_check_9400]\n\n+    unit_name          => nrpe2nodexp-opensearch_unassigned_shard_check_9400.service\n+    fixed_random_delay => True\n+    splay              => 43200\n+    ensure             => absent\n+    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '720min'}, {'interval': '1s', 'start': 'OnActiveSec'}]\n+    accuracy           => 15sec\n"}, {"resource": "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service (wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service)]", "parameters": "--- Exec[systemd daemon-reload for wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service (wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service)].orig\n+++ Exec[systemd daemon-reload for wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service (wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Package[nginx-common]", "parameters": "--- Package[nginx-common].orig\n+++ Package[nginx-common]\n\n+    provider => apt\n+    ensure   => installed\n"}, {"resource": "Logrotate::Conf[opensearch-disable-readahead]", "parameters": "--- Logrotate::Conf[opensearch-disable-readahead].orig\n+++ Logrotate::Conf[opensearch-disable-readahead]\n\n+    ensure => absent\n"}, {"resource": "Package[logstash-oss]", "parameters": "--- Package[logstash-oss].orig\n+++ Package[logstash-oss]\n\n+    ensure   => 1:7.16.3-1\n+    provider => apt\n+    require  => Package[openjdk-17-jdk]\n"}, {"resource": "File[/lib/systemd/system/clean_up_dlq.timer]", "content": "--- /lib/systemd/system/clean_up_dlq.timer.orig\n+++ /lib/systemd/system/clean_up_dlq.timer\n@@ -0,0 +1,12 @@\n+[Unit]\n+Description=Periodic execution of clean_up_dlq.service\n+\n+[Timer]\n+Unit=clean_up_dlq.service\n+# Accuracy sets the maximum time interval around the execution time we want to allow\n+AccuracySec=15sec\n+OnCalendar=1h\n+RandomizedDelaySec=0\n+\n+[Install]\n+WantedBy=multi-user.target", "parameters": "--- File[/lib/systemd/system/clean_up_dlq.timer].orig\n+++ File[/lib/systemd/system/clean_up_dlq.timer]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for clean_up_dlq.timer (clean_up_dlq.timer)]\n"}, {"resource": "Class[Profile::Logstash::Gelf_relay]", "parameters": "--- Class[Profile::Logstash::Gelf_relay].orig\n+++ Class[Profile::Logstash::Gelf_relay]\n\n+    version => 7.16.3-1\n"}, {"resource": "Exec[Refresh tmpfile opensearch-relforge-eqiad]", "parameters": "--- Exec[Refresh tmpfile opensearch-relforge-eqiad].orig\n+++ Exec[Refresh tmpfile opensearch-relforge-eqiad]\n\n+    command     => /bin/systemd-tmpfiles --create --remove '/etc/tmpfiles.d/opensearch-relforge-eqiad.conf'\n+    subscribe   => File[/etc/tmpfiles.d/opensearch-relforge-eqiad.conf]\n+    user        => root\n+    refreshonly => True\n"}, {"resource": "File[/srv/opensearch/relforge-eqiad]", "parameters": "--- File[/srv/opensearch/relforge-eqiad].orig\n+++ File[/srv/opensearch/relforge-eqiad]\n\n+    owner  => opensearch\n+    mode   => 0755\n+    group  => opensearch\n+    ensure => directory\n"}, {"resource": "Exec[stop-default-nginx]", "parameters": "--- Exec[stop-default-nginx].orig\n+++ Exec[stop-default-nginx]\n\n+    before      => Service[nginx]\n+    command     => /usr/sbin/service nginx stop\n+    subscribe   => Package[nginx-light]\n+    refreshonly => True\n"}, {"resource": "Ferm::Service[opensearch_http_9200]", "parameters": "--- Ferm::Service[opensearch_http_9200].orig\n+++ Ferm::Service[opensearch_http_9200]\n\n-    unrestricted_access => False\n-    ensure              => present\n-    notrack             => False\n-    prio                => 10\n-    src_sets            => ['ANALYTICS_NETWORKS']\n-    desc                => \n-    port                => [9200]\n-    proto               => tcp\n"}, {"resource": "Systemd::Timer::Job[nrpe2nodexp-opensearch_unassigned_shard_check_9200]", "parameters": "--- Systemd::Timer::Job[nrpe2nodexp-opensearch_unassigned_shard_check_9200].orig\n+++ Systemd::Timer::Job[nrpe2nodexp-opensearch_unassigned_shard_check_9200]\n\n+    send_mail                 => False\n+    user                      => nagios\n+    monitoring_enabled        => False\n+    logfile_name              => syslog.log\n+    logging_enabled           => False\n+    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash \"54ca99505516d5452912b573aa7d35d3\" --timeout 10 --check-command \"check_opensearch_unassigned_shard_check_9200\"\n+    private_tmp               => False\n+    splay                     => 43200\n+    description               => execution of nrpe2nodexp for the check_opensearch_unassigned_shard_check_9200 command.\n+    syslog_force_stop         => True\n+    ignore_errors             => True\n+    send_mail_only_on_error   => True\n+    fixed_random_delay        => True\n+    logfile_perms             => all\n+    syslog_identifier         => nrpe2nodexp-opensearch_unassigned_shard_check_9200\n+    ensure                    => absent\n+    logfile_basedir           => /var/log\n+    environment               => {}\n+    logfile_group             => root\n+    send_mail_to              => root@relforge1008.eqiad.wmnet\n+    group                     => prometheus-node-exporter\n+    success_exit_status       => []\n+    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '720min'}]\n+    monitoring_contact_groups => admins\n+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+    syslog_match_startswith   => True\n"}, {"resource": "Systemd::Timer[nrpe2nodexp-opensearch_shards_9400]", "parameters": "--- Systemd::Timer[nrpe2nodexp-opensearch_shards_9400].orig\n+++ Systemd::Timer[nrpe2nodexp-opensearch_shards_9400]\n\n+    unit_name          => nrpe2nodexp-opensearch_shards_9400.service\n+    fixed_random_delay => True\n+    splay              => 60\n+    ensure             => absent\n+    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}, {'interval': '1s', 'start': 'OnActiveSec'}]\n+    accuracy           => 15sec\n"}, {"resource": "Prometheus::Alert::Rule[check_opensearch_shard_size_check_9400_aefe2d8b10db3bc84662052af1e20008]", "parameters": "--- Prometheus::Alert::Rule[check_opensearch_shard_size_check_9400_aefe2d8b10db3bc84662052af1e20008].orig\n+++ Prometheus::Alert::Rule[check_opensearch_shard_size_check_9400_aefe2d8b10db3bc84662052af1e20008]\n\n+    for                => 1800m\n+    team               => observability\n+    ensure             => absent\n+    dashboard          => TODO\n+    instance           => ops\n+    runbook            => https://wikitech.wikimedia.org/wiki/Search#If_it_has_been_indexed\n+    severity           => info\n+    def_label_whitelst => ['team', 'severity']\n+    alert_name         => nrpe_OpenSearch_shard_size_check___9400\n+    site               => eqiad\n+    group              => nrpechecks\n+    summary            => NRPE CHECK: OpenSearch shard size check - 9400\n+    expr               => (nagios_nrpe_check_result{alert_rule_hash=\"aefe2d8b10db3bc84662052af1e20008\",check_name=\"check_opensearch_shard_size_check_9400\", status=~\"(WARNING|CRITICAL)\", severity=~\"(warning|critical)\"} > 0) * on (instance) group_left (team) role_owner\n+    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_opensearch_shard_size_check_9400))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))\n+    description        => NRPE CHECK: OpenSearch shard size check - 9400\n"}, {"resource": "Systemd::Unit[nrpe2nodexp-opensearch_shards_9200.timer]", "parameters": "--- Systemd::Unit[nrpe2nodexp-opensearch_shards_9200.timer].orig\n+++ Systemd::Unit[nrpe2nodexp-opensearch_shards_9200.timer]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => absent\n+    override_filename => puppet-override.conf\n+    unit              => nrpe2nodexp-opensearch_shards_9200.timer\n"}, {"resource": "Nrpe::Check[check_opensearch_unassigned_shard_check_9400]", "parameters": "--- Nrpe::Check[check_opensearch_unassigned_shard_check_9400].orig\n+++ Nrpe::Check[check_opensearch_unassigned_shard_check_9400]\n\n+    before  => Monitoring::Service[opensearch_unassigned_shard_check_9400]\n+    command => /usr/lib/nagios/plugins/check_elasticsearch_unassigned_shards.py --url http://localhost:9400 --timeout 4\n+    ensure  => present\n"}, {"resource": "Systemd::Timer::Job[nrpe2nodexp-opensearch_shard_size_check_9400]", "parameters": "--- Systemd::Timer::Job[nrpe2nodexp-opensearch_shard_size_check_9400].orig\n+++ Systemd::Timer::Job[nrpe2nodexp-opensearch_shard_size_check_9400]\n\n+    send_mail                 => False\n+    user                      => nagios\n+    monitoring_enabled        => False\n+    logfile_name              => syslog.log\n+    logging_enabled           => False\n+    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash \"aefe2d8b10db3bc84662052af1e20008\" --timeout 10 --check-command \"check_opensearch_shard_size_check_9400\"\n+    private_tmp               => False\n+    splay                     => 36000\n+    description               => execution of nrpe2nodexp for the check_opensearch_shard_size_check_9400 command.\n+    syslog_force_stop         => True\n+    ignore_errors             => True\n+    send_mail_only_on_error   => True\n+    fixed_random_delay        => True\n+    logfile_perms             => all\n+    syslog_identifier         => nrpe2nodexp-opensearch_shard_size_check_9400\n+    ensure                    => absent\n+    logfile_basedir           => /var/log\n+    environment               => {}\n+    logfile_group             => root\n+    send_mail_to              => root@relforge1008.eqiad.wmnet\n+    group                     => prometheus-node-exporter\n+    success_exit_status       => []\n+    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '600min'}]\n+    monitoring_contact_groups => admins\n+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+    syslog_match_startswith   => True\n"}, {"resource": "Tlsproxy::Localssl[relforge-eqiad]", "parameters": "--- Tlsproxy::Localssl[relforge-eqiad].orig\n+++ Tlsproxy::Localssl[relforge-eqiad]\n\n+    keepalive_timeout  => 60\n+    default_server     => True\n+    require            => ['Class[Profile::Tlsproxy::Instance]']\n+    keepalive_requests => 100\n+    cfssl_paths        => {'cert': '/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.pem', 'key': '/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet-key.pem', 'chain': '/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chain.pem', 'chained': '/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chained.pem'}\n+    skip_private       => False\n+    access_log         => False\n+    read_timeout       => 180\n+    only_get_requests  => False\n+    acme_chief         => False\n+    server_name        => relforge1008.eqiad.wmnet\n+    acme_certname      => relforge-eqiad\n+    enable_http2       => False\n+    server_aliases     => ['relforge.svc.eqiad.wmnet']\n+    tls_ports          => [9243]\n+    upstream_ports     => [9200]\n+    upstream_ip        => 10.64.32.100\n"}, {"resource": "Concat[/etc/apt/sources.list.d/wikimedia-opensearch-plugins.sources]", "parameters": "--- Concat[/etc/apt/sources.list.d/wikimedia-opensearch-plugins.sources].orig\n+++ Concat[/etc/apt/sources.list.d/wikimedia-opensearch-plugins.sources]\n\n+    warn           => False\n+    format         => plain\n+    ensure         => present\n+    force          => False\n+    show_diff      => True\n+    ensure_newline => False\n+    order          => alpha\n+    owner          => root\n+    group          => root\n+    path           => /etc/apt/sources.list.d/wikimedia-opensearch-plugins.sources\n+    mode           => 0444\n+    backup         => puppet\n+    notify         => Exec[apt_repository_wikimedia-opensearch-plugins]\n+    replace        => True\n"}, {"resource": "Sudo::User[nrpe-check_opensearch_unassigned_shard_check_9400]", "parameters": "--- Sudo::User[nrpe-check_opensearch_unassigned_shard_check_9400].orig\n+++ Sudo::User[nrpe-check_opensearch_unassigned_shard_check_9400]\n\n+    privileges => []\n+    tag        => nrpe::check\n+    user       => nagios\n+    require    => ['Class[Sudo]']\n+    ensure     => absent\n"}, {"resource": "Firewall::Service[opensearch-http-9200]", "parameters": "--- Firewall::Service[opensearch-http-9200].orig\n+++ Firewall::Service[opensearch-http-9200]\n\n-    unrestricted_access => False\n-    ensure              => present\n-    notrack             => False\n-    prio                => 10\n-    src_sets            => ['ANALYTICS_NETWORKS']\n-    desc                => \n-    port                => [9200]\n-    proto               => tcp\n"}, {"resource": "File[/lib/systemd/system/prometheus-elasticsearch-exporter-9200.service]", "content": "--- /lib/systemd/system/prometheus-elasticsearch-exporter-9200.service.orig\n+++ /lib/systemd/system/prometheus-elasticsearch-exporter-9200.service\n@@ -0,0 +1,11 @@\n+[Unit]\n+Description=Prometheus exporter for Elasticsearch\n+Documentation=https://prometheus.io/docs/introduction/overview/\n+\n+[Service]\n+Restart=always\n+User=prometheus\n+ExecStart=/usr/bin/prometheus-elasticsearch-exporter --es.uri=http://localhost:9200 --web.listen-address=:9108 \n+\n+[Install]\n+WantedBy=multi-user.target", "parameters": "--- File[/lib/systemd/system/prometheus-elasticsearch-exporter-9200.service].orig\n+++ File[/lib/systemd/system/prometheus-elasticsearch-exporter-9200.service]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for prometheus-elasticsearch-exporter-9200.service (prometheus-elasticsearch-exporter-9200)]\n"}, {"resource": "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer (wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer)]", "parameters": "--- Exec[systemd daemon-reload for wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer (wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer)].orig\n+++ Exec[systemd daemon-reload for wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer (wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer)]\n\n+    before      => ['Service[wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer]']\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Alternatives::Java[17]", "parameters": "--- Alternatives::Java[17].orig\n+++ Alternatives::Java[17]\n\n+    require => Java::Package[openjdk-jdk-17]\n"}, {"resource": "Systemd::Service[nrpe2nodexp-opensearch_shard_size_check_9200]", "parameters": "--- Systemd::Service[nrpe2nodexp-opensearch_shard_size_check_9200].orig\n+++ Systemd::Service[nrpe2nodexp-opensearch_shard_size_check_9200]\n\n+    override                 => False\n+    restart                  => False\n+    require                  => Systemd::Unit[nrpe2nodexp-opensearch_shard_size_check_9200.service]\n+    ensure                   => absent\n+    unit_type                => timer\n+    migration_task           => T407130\n+    monitoring_enabled       => False\n+    monitoring_contact_group => admins\n+    service_params           => {}\n+    monitoring_critical      => False\n"}, {"resource": "Opensearch::Instance[relforge-eqiad]", "parameters": "--- Opensearch::Instance[relforge-eqiad].orig\n+++ Opensearch::Instance[relforge-eqiad]\n\n+    configure_curator                  => False\n+    compatibility_mode                 => False\n+    short_cluster_name                 => chi\n+    base_data_dir                      => /srv/opensearch\n+    use_cms_gc                         => False\n+    recovery_max_bytes_per_sec         => 40mb\n+    certificate_name                   => relforge.svc.eqiad.wmnet\n+    script_max_compilations_per_minute => 10000\n+    publish_host                       => 10.64.32.100\n+    node_name                          => relforge1008-relforge-eqiad\n+    plugins_mandatory                  => ['analysis-hebrew', 'analysis-icu', 'analysis-smartcn', 'analysis-stempel', 'analysis-ukrainian', 'cirrus-highlighter', 'opensearch-analysis-stconvert', 'opensearch-extra', 'opensearch-extra-analysis-esperanto', 'opensearch-extra-analysis-serbian', 'opensearch-extra-analysis-slovak', 'ltr']\n+    security_plugin_certificates       => {}\n+    reindex_remote_whitelist           => search.svc.eqiad.wmnet:9243,search.svc.codfw.wmnet:9243\n+    auto_create_index                  => True\n+    row                                => eqiad-row-c\n+    watermarks                         => {}\n+    recover_after_nodes                => 1\n+    bind_networks                      => ['_local_', '_site_']\n+    unicast_hosts                      => ['relforge1008.eqiad.wmnet', 'relforge1009.eqiad.wmnet', 'relforge1010.eqiad.wmnet']\n+    send_logs_to_logstash              => True\n+    gc_log                             => True\n+    require                            => Package[opensearch]\n+    bulk_thread_pool_executors         => 32\n+    ltr_cache_size                     => 100mb\n+    cluster_hosts                      => ['relforge1008.eqiad.wmnet', 'relforge1009.eqiad.wmnet', 'relforge1010.eqiad.wmnet']\n+    bulk_thread_pool_capacity          => 1000\n+    recover_after_time                 => 1m\n+    holds_data                         => True\n+    logstash_logback_port              => 11514\n+    filter_cache_size                  => 20%\n+    logstash_host                      => localhost\n+    version                            => 1.3.20\n+    search_shard_count_limit           => 1000\n+    disable_security_plugin            => True\n+    expected_nodes                     => 2\n+    http_port                          => 9200\n+    load_fixed_bitset_filters_eagerly  => True\n+    tls_port                           => 9243\n+    transport_tcp_port                 => 9300\n+    heap_memory                        => 30G\n+    cluster_name                       => relforge-eqiad\n+    cms_gc_init_occupancy_fraction     => 75\n+    rack                               => C4\n+    curator_uses_unicast_hosts         => True\n+    awareness_attributes               => row\n"}, {"resource": "File[/etc/logrotate.d/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]", "content": "--- /etc/logrotate.d/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.orig\n+++ /etc/logrotate.d/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400\n@@ -0,0 +1,12 @@\n+# logrotate(8) config for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400\n+\n+/var/log/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400/*.log {\n+    daily\n+    copytruncate\n+    missingok\n+    compress\n+    delaycompress\n+    notifempty\n+    rotate 15\n+    size 256M\n+}", "parameters": "--- File[/etc/logrotate.d/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400].orig\n+++ File[/etc/logrotate.d/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]\n\n+    owner  => root\n+    mode   => 0444\n+    group  => root\n+    ensure => present\n"}, {"resource": "Java::Cacert[wmf:Wikimedia_Internal_Root_CA]", "parameters": "--- Java::Cacert[wmf:Wikimedia_Internal_Root_CA].orig\n+++ Java::Cacert[wmf:Wikimedia_Internal_Root_CA]\n\n+    owner     => root\n+    require   => Alternatives::Java[17]\n+    group     => root\n+    ensure    => present\n+    path      => /usr/share/ca-certificates/wikimedia/Wikimedia_Internal_Root_CA.crt\n+    storepass => changeit\n"}, {"resource": "Service[nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer]", "parameters": "--- Service[nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer].orig\n+++ Service[nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer]\n\n+    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer (nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer)]']\n+    provider => systemd\n+    enable   => False\n+    ensure   => stopped\n"}, {"resource": "Systemd::Timer[nrpe2nodexp-opensearch_unassigned_shard_check_9200]", "parameters": "--- Systemd::Timer[nrpe2nodexp-opensearch_unassigned_shard_check_9200].orig\n+++ Systemd::Timer[nrpe2nodexp-opensearch_unassigned_shard_check_9200]\n\n+    unit_name          => nrpe2nodexp-opensearch_unassigned_shard_check_9200.service\n+    fixed_random_delay => True\n+    splay              => 43200\n+    ensure             => absent\n+    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '720min'}, {'interval': '1s', 'start': 'OnActiveSec'}]\n+    accuracy           => 15sec\n"}, {"resource": "Systemd::Unit[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer]", "parameters": "--- Systemd::Unit[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer].orig\n+++ Systemd::Unit[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => present\n+    override_filename => puppet-override.conf\n+    unit              => wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer\n"}, {"resource": "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9400.service (nrpe2nodexp-opensearch_shard_size_check_9400.service)]", "parameters": "--- Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9400.service (nrpe2nodexp-opensearch_shard_size_check_9400.service)].orig\n+++ Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9400.service (nrpe2nodexp-opensearch_shard_size_check_9400.service)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Rsyslog::Conf[opensearch-disable-readahead]", "parameters": "--- Rsyslog::Conf[opensearch-disable-readahead].orig\n+++ Rsyslog::Conf[opensearch-disable-readahead]\n\n+    mode     => 0444\n+    priority => 40\n+    require  => File[/var/log/opensearch-disable-readahead]\n+    ensure   => absent\n"}, {"resource": "Systemd::Timer[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]", "parameters": "--- Systemd::Timer[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200].orig\n+++ Systemd::Timer[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]\n\n+    unit_name          => wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service\n+    fixed_random_delay => False\n+    splay              => 0\n+    ensure             => present\n+    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 10:55:00'}]\n+    accuracy           => 15sec\n"}, {"resource": "Rsyslog::Conf[nrpe2nodexp-opensearch_shards_9400]", "parameters": "--- Rsyslog::Conf[nrpe2nodexp-opensearch_shards_9400].orig\n+++ Rsyslog::Conf[nrpe2nodexp-opensearch_shards_9400]\n\n+    mode     => 0444\n+    priority => 25\n+    ensure   => absent\n"}, {"resource": "Package[prometheus-elasticsearch-exporter]", "parameters": "--- Package[prometheus-elasticsearch-exporter].orig\n+++ Package[prometheus-elasticsearch-exporter]\n\n+    provider => apt\n+    ensure   => installed\n"}, {"resource": "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9400.timer (nrpe2nodexp-opensearch_shards_9400.timer)]", "parameters": "--- Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9400.timer (nrpe2nodexp-opensearch_shards_9400.timer)].orig\n+++ Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9400.timer (nrpe2nodexp-opensearch_shards_9400.timer)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Exec[systemd daemon-reload for prometheus-elasticsearch-exporter-9400.service (prometheus-elasticsearch-exporter-9400)]", "parameters": "--- Exec[systemd daemon-reload for prometheus-elasticsearch-exporter-9400.service (prometheus-elasticsearch-exporter-9400)].orig\n+++ Exec[systemd daemon-reload for prometheus-elasticsearch-exporter-9400.service (prometheus-elasticsearch-exporter-9400)]\n\n+    before      => ['Service[prometheus-elasticsearch-exporter-9400]']\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Systemd::Timer::Job[nrpe2nodexp-check_push_cross_cluster_settings_9200_status]", "parameters": "--- Systemd::Timer::Job[nrpe2nodexp-check_push_cross_cluster_settings_9200_status].orig\n+++ Systemd::Timer::Job[nrpe2nodexp-check_push_cross_cluster_settings_9200_status]\n\n+    send_mail                 => False\n+    user                      => nagios\n+    monitoring_enabled        => False\n+    logfile_name              => syslog.log\n+    logging_enabled           => False\n+    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash \"379fbc6cbce5b297397c866a15729f1a\" --timeout 10 --check-command \"check_check_push_cross_cluster_settings_9200_status\"\n+    private_tmp               => False\n+    splay                     => 300\n+    description               => execution of nrpe2nodexp for the check_check_push_cross_cluster_settings_9200_status command.\n+    syslog_force_stop         => True\n+    ignore_errors             => True\n+    send_mail_only_on_error   => True\n+    fixed_random_delay        => True\n+    logfile_perms             => all\n+    syslog_identifier         => nrpe2nodexp-check_push_cross_cluster_settings_9200_status\n+    ensure                    => absent\n+    logfile_basedir           => /var/log\n+    environment               => {}\n+    logfile_group             => root\n+    send_mail_to              => root@relforge1008.eqiad.wmnet\n+    group                     => prometheus-node-exporter\n+    success_exit_status       => []\n+    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '5min'}]\n+    monitoring_contact_groups => admins\n+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+    syslog_match_startswith   => True\n"}, {"resource": "File[/etc/cfssl/csr/discovery2026__relforge1008_eqiad_wmnet.csr]", "content": "--- /etc/cfssl/csr/discovery2026__relforge1008_eqiad_wmnet.csr.orig\n+++ /etc/cfssl/csr/discovery2026__relforge1008_eqiad_wmnet.csr\n@@ -0,0 +1,14 @@\n+{\n+  \"CN\": \"relforge1008.eqiad.wmnet\",\n+  \"hosts\": [\n+    \"relforge.svc.eqiad.wmnet\",\n+    \"relforge1008.eqiad.wmnet\"\n+  ],\n+  \"key\": {\n+    \"algo\": \"ecdsa\",\n+    \"size\": 256\n+  },\n+  \"names\": [\n+\n+  ]\n+}", "parameters": "--- File[/etc/cfssl/csr/discovery2026__relforge1008_eqiad_wmnet.csr].orig\n+++ File[/etc/cfssl/csr/discovery2026__relforge1008_eqiad_wmnet.csr]\n\n+    owner  => root\n+    mode   => 0400\n+    group  => root\n+    ensure => file\n"}, {"resource": "Exec[opensearch-create-keystore-relforge-eqiad-small-alpha]", "parameters": "--- Exec[opensearch-create-keystore-relforge-eqiad-small-alpha].orig\n+++ Exec[opensearch-create-keystore-relforge-eqiad-small-alpha]\n\n+    environment => ['OPENSEARCH_PATH_CONF=/etc/opensearch/relforge-eqiad-small-alpha']\n+    command     => /usr/share/opensearch/bin/opensearch-keystore create\n+    creates     => /etc/opensearch/relforge-eqiad-small-alpha/opensearch.keystore\n+    before      => File[/etc/opensearch/relforge-eqiad-small-alpha/opensearch.keystore]\n"}, {"resource": "Monitoring::Exported_nagios_service[relforge1008 opensearch_shards_9200]", "parameters": "--- Monitoring::Exported_nagios_service[relforge1008 opensearch_shards_9200].orig\n+++ Monitoring::Exported_nagios_service[relforge1008 opensearch_shards_9200]\n\n+    check_command          => nrpe_check!check_opensearch_shards_9200!10\n+    retry_interval         => 1\n+    active_checks_enabled  => 1\n+    contact_groups         => admins,team-discovery\n+    host_name              => relforge1008\n+    check_freshness        => 0\n+    notification_period    => 24x7\n+    servicegroups          => relforge_eqiad\n+    notification_interval  => 0\n+    ensure                 => present\n+    notification_options   => c,r,f\n+    check_interval         => 1\n+    notifications_enabled  => 0\n+    max_check_attempts     => 3\n+    is_volatile            => 0\n+    passive_checks_enabled => 1\n+    check_period           => 24x7\n+    service_description    => OpenSearch health check for shards on 9200\n+    notes_url              => https://wikitech.wikimedia.org/wiki/Search#Administration\n"}, {"resource": "Sudo::User[nrpe-check_check_push_cross_cluster_settings_9200_status]", "parameters": "--- Sudo::User[nrpe-check_check_push_cross_cluster_settings_9200_status].orig\n+++ Sudo::User[nrpe-check_check_push_cross_cluster_settings_9200_status]\n\n+    privileges => []\n+    tag        => nrpe::check\n+    user       => nagios\n+    require    => ['Class[Sudo]']\n+    ensure     => absent\n"}, {"resource": "Systemd::Unit[nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service]", "parameters": "--- Systemd::Unit[nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service].orig\n+++ Systemd::Unit[nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => absent\n+    override_filename => puppet-override.conf\n+    unit              => nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service\n"}, {"resource": "Service[nginx]", "parameters": "--- Service[nginx].orig\n+++ Service[nginx]\n\n+    hasrestart => True\n+    enable     => True\n+    require    => Package[nginx-light]\n+    ensure     => running\n"}, {"resource": "Class[Profile::Monitoring]", "parameters": "--- Class[Profile::Monitoring].orig\n+++ Class[Profile::Monitoring]\n\n@@\n-    nrpe_check_disk_options => -w 6% -c 3% -W 6% -K 3% -l -e -A -i \"/srv/sd[a-b][1-3]\" -i \"/srv/nvme[0-9]n[0-9]p[0-9]\" --exclude-type=fuse --exclude-type=fuse.fuse_dfs --exclude-type=tracefs\n+    nrpe_check_disk_options => -w 15% -c 10% -W 6% -K 3% -l -e -A -i \"/srv/sd[a-b][1-3]\" --exclude-type=tracefs\n"}, {"resource": "File[/etc/update-motd.d/05-cirrus--test]", "content": "--- /etc/update-motd.d/05-cirrus--test.orig\n+++ /etc/update-motd.d/05-cirrus--test\n@@ -1,2 +0,0 @@\n-#!/bin/sh\n-printf \"%s\\n\" \"relforge1008 is a Unpuppetised system for testing (cirrus::test)\"", "parameters": "--- File[/etc/update-motd.d/05-cirrus--test].orig\n+++ File[/etc/update-motd.d/05-cirrus--test]\n\n-    mode   => 0555\n-    owner  => root\n-    group  => root\n-    ensure => present\n"}, {"resource": "Rsyslog::Conf[wmf_auto_restart_prometheus-elasticsearch-exporter-9200]", "parameters": "--- Rsyslog::Conf[wmf_auto_restart_prometheus-elasticsearch-exporter-9200].orig\n+++ Rsyslog::Conf[wmf_auto_restart_prometheus-elasticsearch-exporter-9200]\n\n+    mode     => 0444\n+    priority => 40\n+    require  => File[/var/log/wmf_auto_restart_prometheus-elasticsearch-exporter-9200]\n+    ensure   => present\n"}, {"resource": "File[/lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9200.timer]", "content": "--- /lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9200.timer.orig\n+++ /lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9200.timer\n@@ -0,0 +1,14 @@\n+[Unit]\n+Description=Periodic execution of nrpe2nodexp-opensearch_shard_size_check_9200.service\n+\n+[Timer]\n+Unit=nrpe2nodexp-opensearch_shard_size_check_9200.service\n+# Accuracy sets the maximum time interval around the execution time we want to allow\n+AccuracySec=15sec\n+OnUnitInactiveSec=600min\n+OnActiveSec=1s\n+RandomizedDelaySec=36000\n+FixedRandomDelay=true\n+\n+[Install]\n+WantedBy=multi-user.target", "parameters": "--- File[/lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9200.timer].orig\n+++ File[/lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9200.timer]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9200.timer (nrpe2nodexp-opensearch_shard_size_check_9200.timer)]\n"}, {"resource": "File[/etc/opensearch/relforge-eqiad/scripts]", "parameters": "--- File[/etc/opensearch/relforge-eqiad/scripts].orig\n+++ File[/etc/opensearch/relforge-eqiad/scripts]\n\n+    owner  => root\n+    mode   => 0444\n+    group  => root\n+    ensure => directory\n"}, {"resource": "Nrpe::Monitor_service[check_push_cross_cluster_settings_9200_status]", "parameters": "--- Nrpe::Monitor_service[check_push_cross_cluster_settings_9200_status].orig\n+++ Nrpe::Monitor_service[check_push_cross_cluster_settings_9200_status]\n\n+    retry_interval              => 1\n+    check_interval              => 10\n+    ensure                      => present\n+    migration_task              => T407130\n+    nrpe_command                => /usr/local/lib/nagios/plugins/check_systemd_unit_status push_cross_cluster_settings_9200\n+    contact_group               => admins\n+    enable_nrpe2nodexp          => False\n+    critical                    => False\n+    alertmanager_team           => observability\n+    retries                     => 2\n+    nrpe2nodexp_parse_perf_data => False\n+    enable_icinga_check         => True\n+    timeout                     => 10\n+    description                 => Check unit status of push_cross_cluster_settings_9200\n+    notes_url                   => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n"}, {"resource": "Elasticsearch::Tlsproxy[relforge-eqiad]", "parameters": "--- Elasticsearch::Tlsproxy[relforge-eqiad].orig\n+++ Elasticsearch::Tlsproxy[relforge-eqiad]\n\n+    tls_port          => 9243\n+    read_only         => False\n+    acme_chief        => False\n+    server_name       => relforge1008.eqiad.wmnet\n+    enable_http2      => False\n+    upstream_port     => 9200\n+    server_aliases    => ['relforge.svc.eqiad.wmnet']\n+    cfssl_paths       => {'cert': '/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.pem', 'key': '/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet-key.pem', 'chain': '/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chain.pem', 'chained': '/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chained.pem'}\n+    certificate_names => []\n"}, {"resource": "Exec[java__cacert_wmf:puppetca.pem]", "parameters": "--- Exec[java__cacert_wmf:puppetca.pem].orig\n+++ Exec[java__cacert_wmf:puppetca.pem]\n\n+    command => /usr/bin/keytool -import -trustcacerts -noprompt -cacerts     -file /etc/ssl/certs/Puppet_Internal_CA.pem -storepass changeit -alias wmf:puppetca.pem\n\n+    group   => root\n+    user    => root\n+    unless  => /usr/bin/keytool -list -cacerts -noprompt -storepass changeit -alias wmf:puppetca.pem\n"}, {"resource": "File[/var/log/wmf_auto_restart_prometheus-elasticsearch-exporter-9200]", "parameters": "--- File[/var/log/wmf_auto_restart_prometheus-elasticsearch-exporter-9200].orig\n+++ File[/var/log/wmf_auto_restart_prometheus-elasticsearch-exporter-9200]\n\n+    owner  => root\n+    group  => root\n+    force  => True\n+    ensure => directory\n+    mode   => 0755\n+    backup => False\n"}, {"resource": "Elasticsearch::Tlsproxy[relforge-eqiad-small-alpha]", "parameters": "--- Elasticsearch::Tlsproxy[relforge-eqiad-small-alpha].orig\n+++ Elasticsearch::Tlsproxy[relforge-eqiad-small-alpha]\n\n+    tls_port          => 9443\n+    read_only         => False\n+    acme_chief        => False\n+    server_name       => relforge1008.eqiad.wmnet\n+    enable_http2      => False\n+    upstream_port     => 9400\n+    server_aliases    => ['relforge.svc.eqiad.wmnet']\n+    cfssl_paths       => {'cert': '/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.pem', 'key': '/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet-key.pem', 'chain': '/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chain.pem', 'chained': '/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chained.pem'}\n+    certificate_names => []\n"}, {"resource": "Nrpe::Monitor_service[opensearch_shards_9200]", "parameters": "--- Nrpe::Monitor_service[opensearch_shards_9200].orig\n+++ Nrpe::Monitor_service[opensearch_shards_9200]\n\n+    retry_interval              => 1\n+    ensure                      => present\n+    check_interval              => 1\n+    migration_task              => T371083\n+    contact_group               => admins,team-discovery\n+    nrpe_command                => /usr/lib/nagios/plugins/check_elasticsearch.py --ignore-status --url http://localhost:9200 --shards-inactive '>=0.15' --timeout 4\n+    enable_nrpe2nodexp          => False\n+    critical                    => False\n+    alertmanager_team           => observability\n+    retries                     => 3\n+    nrpe2nodexp_parse_perf_data => False\n+    enable_icinga_check         => True\n+    timeout                     => 10\n+    description                 => OpenSearch health check for shards on 9200\n+    notes_url                   => https://wikitech.wikimedia.org/wiki/Search#Administration\n"}, {"resource": "File[/etc/logstash/conf.d/10-input-gelf-gelf_relay.conf]", "content": "--- /etc/logstash/conf.d/10-input-gelf-gelf_relay.conf.orig\n+++ /etc/logstash/conf.d/10-input-gelf-gelf_relay.conf\n@@ -0,0 +1,11 @@\n+input {\n+  # Graylog extended logging format\n+  gelf {\n+    type  => \"gelf\"\n+    port  => 12201\n+    remap => false\n+    host  => \"localhost\"\n+    id   => \"input/gelf/12201\"\n+    tags => [\"input-gelf-relay\"]\n+  }\n+}", "parameters": "--- File[/etc/logstash/conf.d/10-input-gelf-gelf_relay.conf].orig\n+++ File[/etc/logstash/conf.d/10-input-gelf-gelf_relay.conf]\n\n+    owner        => logstash\n+    group        => logstash\n+    validate_cmd => /usr/local/bin/logstash-config-test %\n+    ensure       => present\n+    mode         => 0440\n+    notify       => Service[logstash]\n"}, {"resource": "File[/etc/ferm/conf.d/10_elastic-main-https-9243]", "content": "--- /etc/ferm/conf.d/10_elastic-main-https-9243.orig\n+++ /etc/ferm/conf.d/10_elastic-main-https-9243\n@@ -0,0 +1,6 @@\n+# Autogenerated by puppet. DO NOT EDIT BY HAND!\n+#\n+# \n+&R_SERVICE(tcp, 9243, (10.64.16.154 2620:0:861:102:10:64:16:154 10.192.32.49 2620:0:860:103:10:192:32:49));\n+\n+", "parameters": "--- File[/etc/ferm/conf.d/10_elastic-main-https-9243].orig\n+++ File[/etc/ferm/conf.d/10_elastic-main-https-9243]\n\n+    owner   => root\n+    group   => root\n+    tag     => ferm\n+    require => File[/etc/ferm/conf.d]\n+    mode    => 0400\n+    ensure  => present\n+    notify  => Service[ferm]\n"}, {"resource": "Class[Adduser]", "parameters": "--- Class[Adduser].orig\n+++ Class[Adduser]\n\n@@\n-    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[prometheus-ethtool-exporter]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[libicu67]', 'Package[libwsutil12]', 'Package[libwireshark14]', 'Package[libopencsd0]', 'Package[libwiretap11]', 'Package[ruby2.7]', 'Package[python3.9-minimal]', 'Package[python3.9]', 'Package[perl-modules-5.32]', 'Package[libpython3.9]', 'Package[libperl5.32]', 'Package[libpython3.9-minimal]', 'Package[libpython3.9-stdlib]', 'Package[libidn11]', 'Package[libldap-2.4-2]', 'Package[liburing1]', 'Package[libwebp6]', 'Package[libcbor0]', 'Package[libusb-0.1-4]', 'Package[telnet]', 'Package[libruby2.7]', 'Package[libdns-export1110]', 'Package[libisc-export1105]', 'Package[libbpf0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[ulogd2]', 'Package[conntrack]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]']\n+    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[prometheus-ethtool-exporter]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[libicu67]', 'Package[libwsutil12]', 'Package[libwireshark14]', 'Package[libopencsd0]', 'Package[libwiretap11]', 'Package[ruby2.7]', 'Package[python3.9-minimal]', 'Package[python3.9]', 'Package[perl-modules-5.32]', 'Package[libpython3.9]', 'Package[libperl5.32]', 'Package[libpython3.9-minimal]', 'Package[libpython3.9-stdlib]', 'Package[libidn11]', 'Package[libldap-2.4-2]', 'Package[liburing1]', 'Package[libwebp6]', 'Package[libcbor0]', 'Package[libusb-0.1-4]', 'Package[telnet]', 'Package[libruby2.7]', 'Package[libdns-export1110]', 'Package[libisc-export1105]', 'Package[libbpf0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[ulogd2]', 'Package[conntrack]', 'Package[edac-utils]', 'Package[opensearch]', 'Package[python3-requests]', 'Package[wmf-opensearch-search-plugins]', 'Package[opensearch-madvise]', 'Package[logstash-oss]', 'Package[logstash-old-name]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]', 'Package[openjdk-17-jdk]', 'Package[prometheus-elasticsearch-exporter]', 'Package[nginx-light]', 'Package[nginx-common]']\n"}, {"resource": "Concat::Fragment[wikimedia-opensearch-plugins-header]", "parameters": "--- Concat::Fragment[wikimedia-opensearch-plugins-header].orig\n+++ Concat::Fragment[wikimedia-opensearch-plugins-header]\n\n+    source => puppet:///modules/apt/sources-deb822-header.txt\n+    target => /etc/apt/sources.list.d/wikimedia-opensearch-plugins.sources\n+    order  => 01\n"}, {"resource": "File[/etc/logrotate.d/clean_up_dlq]", "content": "--- /etc/logrotate.d/clean_up_dlq.orig\n+++ /etc/logrotate.d/clean_up_dlq\n@@ -0,0 +1,12 @@\n+# logrotate(8) config for clean_up_dlq\n+\n+/var/log/clean_up_dlq/*.log {\n+    daily\n+    copytruncate\n+    missingok\n+    compress\n+    delaycompress\n+    notifempty\n+    rotate 15\n+    size 256M\n+}", "parameters": "--- File[/etc/logrotate.d/clean_up_dlq].orig\n+++ File[/etc/logrotate.d/clean_up_dlq]\n\n+    owner  => root\n+    mode   => 0444\n+    group  => root\n+    ensure => absent\n"}, {"resource": "Systemd::Syslog[opensearch-disable-readahead]", "parameters": "--- Systemd::Syslog[opensearch-disable-readahead].orig\n+++ Systemd::Syslog[opensearch-disable-readahead]\n\n+    readable_by            => all\n+    force_stop             => True\n+    ensure                 => absent\n+    programname_comparison => startswith\n+    log_filename           => syslog.log\n+    owner                  => root\n+    group                  => root\n+    base_dir               => /var/log\n"}, {"resource": "File[/var/lib/prometheus/node.d/check_opensearch_unassigned_shard_check_9200.prom]", "parameters": "--- File[/var/lib/prometheus/node.d/check_opensearch_unassigned_shard_check_9200.prom].orig\n+++ File[/var/lib/prometheus/node.d/check_opensearch_unassigned_shard_check_9200.prom]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n"}, {"resource": "File[/srv/opensearch]", "parameters": "--- File[/srv/opensearch].orig\n+++ File[/srv/opensearch]\n\n+    owner   => opensearch\n+    group   => opensearch\n+    require => Package[opensearch]\n+    mode    => 0755\n+    ensure  => directory\n"}, {"resource": "Systemd::Service[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]", "parameters": "--- Systemd::Service[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup].orig\n+++ Systemd::Service[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]\n\n+    override                 => False\n+    restart                  => False\n+    require                  => Systemd::Unit[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service]\n+    ensure                   => present\n+    unit_type                => timer\n+    migration_task           => T407130\n+    monitoring_enabled       => False\n+    monitoring_contact_group => admins\n+    service_params           => {}\n+    monitoring_critical      => False\n"}, {"resource": "Systemd::Unit[nrpe2nodexp-opensearch_unassigned_shard_check_9200.service]", "parameters": "--- Systemd::Unit[nrpe2nodexp-opensearch_unassigned_shard_check_9200.service].orig\n+++ Systemd::Unit[nrpe2nodexp-opensearch_unassigned_shard_check_9200.service]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => absent\n+    override_filename => puppet-override.conf\n+    unit              => nrpe2nodexp-opensearch_unassigned_shard_check_9200.service\n"}, {"resource": "Systemd::Unit[opensearch-relforge-eqiad-gc-log-cleanup.timer]", "parameters": "--- Systemd::Unit[opensearch-relforge-eqiad-gc-log-cleanup.timer].orig\n+++ Systemd::Unit[opensearch-relforge-eqiad-gc-log-cleanup.timer]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => present\n+    override_filename => puppet-override.conf\n+    unit              => opensearch-relforge-eqiad-gc-log-cleanup.timer\n"}, {"resource": "File[/lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service]", "content": "--- /lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service.orig\n+++ /lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service\n@@ -0,0 +1,11 @@\n+[Unit]\n+Description=execution of nrpe2nodexp for the check_check_push_cross_cluster_settings_9200_status command.\n+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+\n+[Service]\n+Type=oneshot\n+User=nagios\n+\n+Group=prometheus-node-exporter\n+SyslogIdentifier=nrpe2nodexp-check_push_cross_cluster_settings_9200_status\n+ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash \"379fbc6cbce5b297397c866a15729f1a\" --timeout 10 --check-command \"check_check_push_cross_cluster_settings_9200_status\"", "parameters": "--- File[/lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service].orig\n+++ File[/lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service (nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service)]\n"}, {"resource": "Sudo::User[nrpe-check_opensearch_unassigned_shard_check_9200]", "parameters": "--- Sudo::User[nrpe-check_opensearch_unassigned_shard_check_9200].orig\n+++ Sudo::User[nrpe-check_opensearch_unassigned_shard_check_9200]\n\n+    privileges => []\n+    tag        => nrpe::check\n+    user       => nagios\n+    require    => ['Class[Sudo]']\n+    ensure     => absent\n"}, {"resource": "Logrotate::Conf[clean_up_dlq]", "parameters": "--- Logrotate::Conf[clean_up_dlq].orig\n+++ Logrotate::Conf[clean_up_dlq]\n\n+    ensure => absent\n"}, {"resource": "Sysctl::Parameters[TCP Fast Open]", "parameters": "--- Sysctl::Parameters[TCP Fast Open].orig\n+++ Sysctl::Parameters[TCP Fast Open]\n\n+    ensure             => present\n+    no_priority_prefix => False\n+    priority           => 70\n+    values             => {'net.ipv4.tcp_fastopen': 3}\n"}, {"resource": "File[/etc/nagios/nrpe.d/check_check_push_cross_cluster_settings_9400_status.cfg]", "content": "--- /etc/nagios/nrpe.d/check_check_push_cross_cluster_settings_9400_status.cfg.orig\n+++ /etc/nagios/nrpe.d/check_check_push_cross_cluster_settings_9400_status.cfg\n@@ -0,0 +1,2 @@\n+# File generated by puppet. DO NOT edit by hand\n+command[check_check_push_cross_cluster_settings_9400_status]=/usr/local/lib/nagios/plugins/check_systemd_unit_status push_cross_cluster_settings_9400", "parameters": "--- File[/etc/nagios/nrpe.d/check_check_push_cross_cluster_settings_9400_status.cfg].orig\n+++ File[/etc/nagios/nrpe.d/check_check_push_cross_cluster_settings_9400_status.cfg]\n\n+    owner   => root\n+    require => Package[nagios-nrpe-server]\n+    group   => root\n+    tag     => nrpe::check\n+    ensure  => present\n+    mode    => 0444\n+    notify  => Service[nagios-nrpe-server]\n"}, {"resource": "Rsyslog::Conf[nrpe2nodexp-check_push_cross_cluster_settings_9400_status]", "parameters": "--- Rsyslog::Conf[nrpe2nodexp-check_push_cross_cluster_settings_9400_status].orig\n+++ Rsyslog::Conf[nrpe2nodexp-check_push_cross_cluster_settings_9400_status]\n\n+    mode     => 0444\n+    priority => 25\n+    ensure   => absent\n"}, {"resource": "File[/etc/sudoers.d/nrpe-check_opensearch_unassigned_shard_check_9400]", "parameters": "--- File[/etc/sudoers.d/nrpe-check_opensearch_unassigned_shard_check_9400].orig\n+++ File[/etc/sudoers.d/nrpe-check_opensearch_unassigned_shard_check_9400]\n\n+    owner   => root\n+    require => Package[nagios-nrpe-server]\n+    group   => root\n+    ensure  => absent\n"}, {"resource": "Systemd::Service[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]", "parameters": "--- Systemd::Service[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400].orig\n+++ Systemd::Service[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]\n\n+    override                 => False\n+    restart                  => False\n+    require                  => Systemd::Unit[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service]\n+    ensure                   => present\n+    unit_type                => timer\n+    migration_task           => T407130\n+    monitoring_enabled       => False\n+    monitoring_contact_group => admins\n+    service_params           => {}\n+    monitoring_critical      => False\n"}, {"resource": "Systemd::Mask[nginx.service]", "parameters": "--- Systemd::Mask[nginx.service].orig\n+++ Systemd::Mask[nginx.service]\n\n+    before => ['Package[nginx-light]']\n+    unless => /usr/bin/dpkg -s nginx-light | /bin/grep -q '^Status: install ok installed$'\n+    unit   => nginx.service\n"}, {"resource": "Systemd::Service[prometheus-elasticsearch-exporter-9200]", "parameters": "--- Systemd::Service[prometheus-elasticsearch-exporter-9200].orig\n+++ Systemd::Service[prometheus-elasticsearch-exporter-9200]\n\n+    override                 => False\n+    restart                  => False\n+    require                  => Package[prometheus-elasticsearch-exporter]\n+    ensure                   => present\n+    unit_type                => service\n+    migration_task           => T407130\n+    monitoring_enabled       => False\n+    monitoring_contact_group => admins\n+    service_params           => {'ensure': 'running'}\n+    monitoring_critical      => False\n"}, {"resource": "File[/etc/opensearch/relforge-eqiad-small-alpha/jvm.options]", "content": "--- /etc/opensearch/relforge-eqiad-small-alpha/jvm.options.orig\n+++ /etc/opensearch/relforge-eqiad-small-alpha/jvm.options\n@@ -0,0 +1,109 @@\n+## JVM configuration\n+\n+################################################################\n+## IMPORTANT: JVM heap size\n+################################################################\n+##\n+## You should always set the min and max JVM heap\n+## size to the same value. For example, to set\n+## the heap to 4 GB, set:\n+##\n+## -Xms4g\n+## -Xmx4g\n+##\n+## See https://opensearch.org/docs/opensearch/install/important-settings/\n+## for more information\n+##\n+################################################################\n+\n+# Xms represents the initial size of total heap space\n+# Xmx represents the maximum size of total heap space\n+\n+-Xms4G\n+-Xmx4G\n+\n+################################################################\n+## Numa Awareness\n+################################################################\n+-XX:+UseNUMA\n+\n+################################################################\n+## Expert settings\n+################################################################\n+##\n+## All settings below this section are considered\n+## expert settings. Don't tamper with them unless\n+## you understand what you are doing\n+##\n+################################################################\n+\n+\n+## optimizations\n+\n+# disable calls to System#gc\n+-XX:+DisableExplicitGC\n+\n+# pre-touch memory pages used by the JVM during initialization\n+-XX:+AlwaysPreTouch\n+\n+## basic\n+\n+# force the server VM (remove on 32-bit client JVMs)\n+-server\n+\n+# explicitly set the stack size (reduce to 320k on 32-bit client JVMs)\n+-Xss1m\n+\n+# log4j 2\n+-Dlog4j.skipJansi=true\n+-Dlog4j2.formatMsgNoLookups=true\n+\n+# security policy, needed for OpenSearch to access non-default files/sockets/ports T395571\n+\n+-Djava.security.policy=/etc/opensearch/relforge-eqiad-small-alpha/java-security.policy\n+\n+## heap dumps\n+\n+# generate a heap dump when an allocation from the Java heap fails\n+# heap dumps are created in the working directory of the JVM\n+-XX:+HeapDumpOnOutOfMemoryError\n+\n+# specify an alternative path for heap dumps\n+# ensure the directory exists and has sufficient space\n+-XX:HeapDumpPath=/srv/opensearch/relforge-eqiad-small-alpha\n+\n+## GC logging\n+\n+#-XX:+PrintGCDetails\n+#-XX:+PrintGCTimeStamps\n+#-XX:+PrintGCDateStamps\n+#-XX:+PrintClassHistogram\n+#-XX:+PrintTenuringDistribution\n+#-XX:+PrintGCApplicationStoppedTime\n+\n+# log GC status to a file with time stamps\n+# ensure the directory exists\n+#-Xloggc:${loggc}\n+\n+## Custom Wikimedia configuration\n+\n+# Defines a limit of proportion of time spent in GC before\n+# an OutOfMemory error is thrown.  The goal is to bail and\n+# restart the server if throughput is suffering due to\n+# GC stalls.\n+# TODO: Why 70? why not 60 or 80?\n+-XX:GCTimeLimit=70\n+\n+# Defines minimum percentage of free space after a full GC\n+# before an OutOfMemoryError is thrown. Typically a full GC\n+# should leave > 50% of heap free. If we are down to 10%\n+# something is wrong and bailing is a reasonable solution.\n+-XX:GCHeapFreeLimit=10\n+\n+# Exit on OutOfMemoryError, since in most cases the JVM does not recover\n+-XX:+ExitOnOutOfMemoryError\n+\n+# Custom WMF GC flags\n+-Xlog:gc*:file=/var/log/opensearch/relforge-eqiad-small-alpha_jvm_gc.%p.log::filecount=10,filesize=20000\n+-Xlog:gc+age=trace\n+-Xlog:safepoint", "parameters": "--- File[/etc/opensearch/relforge-eqiad-small-alpha/jvm.options].orig\n+++ File[/etc/opensearch/relforge-eqiad-small-alpha/jvm.options]\n\n+    owner  => root\n+    mode   => 0444\n+    group  => root\n+    ensure => file\n"}, {"resource": "Systemd::Unit[nrpe2nodexp-opensearch_shard_size_check_9200.service]", "parameters": "--- Systemd::Unit[nrpe2nodexp-opensearch_shard_size_check_9200.service].orig\n+++ Systemd::Unit[nrpe2nodexp-opensearch_shard_size_check_9200.service]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => absent\n+    override_filename => puppet-override.conf\n+    unit              => nrpe2nodexp-opensearch_shard_size_check_9200.service\n"}, {"resource": "File[/var/log/opensearch/opensearch_index_indexing_slowlog.log]", "parameters": "--- File[/var/log/opensearch/opensearch_index_indexing_slowlog.log].orig\n+++ File[/var/log/opensearch/opensearch_index_indexing_slowlog.log]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n"}, {"resource": "Rsyslog::Conf[wmf_auto_restart_prometheus-elasticsearch-exporter-9400]", "parameters": "--- Rsyslog::Conf[wmf_auto_restart_prometheus-elasticsearch-exporter-9400].orig\n+++ Rsyslog::Conf[wmf_auto_restart_prometheus-elasticsearch-exporter-9400]\n\n+    mode     => 0444\n+    priority => 40\n+    require  => File[/var/log/wmf_auto_restart_prometheus-elasticsearch-exporter-9400]\n+    ensure   => present\n"}, {"resource": "Monitoring::Service[elasticsearch-https-relforge-eqiad]", "parameters": "--- Monitoring::Service[elasticsearch-https-relforge-eqiad].orig\n+++ Monitoring::Service[elasticsearch-https-relforge-eqiad]\n\n+    check_command  => check_ssl_on_port!relforge1008.eqiad.wmnet!9243\n+    retry_interval => 1\n+    freshness      => 36000\n+    ensure         => present\n+    check_interval => 1\n+    config_dir     => /etc/nagios\n+    migration_task => T384998\n+    host           => relforge1008\n+    critical       => False\n+    retries        => 3\n+    passive        => False\n+    description    => Elasticsearch HTTPS for relforge-eqiad\n+    notes_url      => https://wikitech.wikimedia.org/wiki/Search\n"}, {"resource": "Service[nrpe2nodexp-opensearch_shards_9200.timer]", "parameters": "--- Service[nrpe2nodexp-opensearch_shards_9200.timer].orig\n+++ Service[nrpe2nodexp-opensearch_shards_9200.timer]\n\n+    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9200.timer (nrpe2nodexp-opensearch_shards_9200.timer)]']\n+    provider => systemd\n+    enable   => False\n+    ensure   => stopped\n"}, {"resource": "Systemd::Syslog[wmf_auto_restart_prometheus-elasticsearch-exporter-9200]", "parameters": "--- Systemd::Syslog[wmf_auto_restart_prometheus-elasticsearch-exporter-9200].orig\n+++ Systemd::Syslog[wmf_auto_restart_prometheus-elasticsearch-exporter-9200]\n\n+    readable_by            => all\n+    force_stop             => True\n+    ensure                 => present\n+    programname_comparison => startswith\n+    log_filename           => syslog.log\n+    owner                  => root\n+    group                  => root\n+    base_dir               => /var/log\n"}, {"resource": "Systemd::Syslog[opensearch-disable-readahead-relforge-eqiad]", "parameters": "--- Systemd::Syslog[opensearch-disable-readahead-relforge-eqiad].orig\n+++ Systemd::Syslog[opensearch-disable-readahead-relforge-eqiad]\n\n+    readable_by            => all\n+    force_stop             => True\n+    ensure                 => present\n+    programname_comparison => startswith\n+    log_filename           => syslog.log\n+    owner                  => root\n+    group                  => root\n+    base_dir               => /var/log\n"}, {"resource": "File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet]", "parameters": "--- File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet].orig\n+++ File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet]\n\n+    owner   => root\n+    group   => root\n+    recurse => True\n+    ensure  => directory\n+    mode    => 0740\n"}, {"resource": "File[/usr/local/bin/opensearch-disable-readahead.sh]", "parameters": "--- File[/usr/local/bin/opensearch-disable-readahead.sh].orig\n+++ File[/usr/local/bin/opensearch-disable-readahead.sh]\n\n+    owner  => root\n+    source => puppet:///modules/profile/opensearch/cirrus/opensearch-disable-readahead.sh\n+    group  => root\n+    ensure => file\n+    mode   => 0555\n"}, {"resource": "Service[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer]", "parameters": "--- Service[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer].orig\n+++ Service[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer]\n\n+    ensure   => running\n+    provider => systemd\n+    enable   => True\n"}, {"resource": "File[/etc/udev/rules.d/40-opensearch-readahead.rules]", "content": "--- /etc/udev/rules.d/40-opensearch-readahead.rules.orig\n+++ /etc/udev/rules.d/40-opensearch-readahead.rules\n@@ -0,0 +1 @@\n+SUBSYSTEM==\"block\", KERNEL==\"md1\", ACTION==\"add|change\", ATTR{bdi/read_ahead_kb}=\"16\"", "parameters": "--- File[/etc/udev/rules.d/40-opensearch-readahead.rules].orig\n+++ File[/etc/udev/rules.d/40-opensearch-readahead.rules]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Exec[udev_reload]\n"}, {"resource": "File[/var/log/opensearch-relforge-eqiad-gc-log-cleanup]", "parameters": "--- File[/var/log/opensearch-relforge-eqiad-gc-log-cleanup].orig\n+++ File[/var/log/opensearch-relforge-eqiad-gc-log-cleanup]\n\n+    owner  => root\n+    group  => root\n+    force  => True\n+    ensure => directory\n+    mode   => 0755\n+    backup => False\n"}, {"resource": "Systemd::Unit[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer]", "parameters": "--- Systemd::Unit[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer].orig\n+++ Systemd::Unit[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => present\n+    override_filename => puppet-override.conf\n+    unit              => opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer\n"}, {"resource": "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9400.service (nrpe2nodexp-opensearch_shards_9400.service)]", "parameters": "--- Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9400.service (nrpe2nodexp-opensearch_shards_9400.service)].orig\n+++ Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9400.service (nrpe2nodexp-opensearch_shards_9400.service)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Systemd::Unit[wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer]", "parameters": "--- Systemd::Unit[wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer].orig\n+++ Systemd::Unit[wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => present\n+    override_filename => puppet-override.conf\n+    unit              => wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer\n"}, {"resource": "Nrpe::Check[check_opensearch_shards_9200]", "parameters": "--- Nrpe::Check[check_opensearch_shards_9200].orig\n+++ Nrpe::Check[check_opensearch_shards_9200]\n\n+    before  => Monitoring::Service[opensearch_shards_9200]\n+    command => /usr/lib/nagios/plugins/check_elasticsearch.py --ignore-status --url http://localhost:9200 --shards-inactive '>=0.15' --timeout 4\n+    ensure  => present\n"}, {"resource": "Exec[systemd daemon-reload for opensearch-disable-readahead-relforge-eqiad-small-alpha.timer (opensearch-disable-readahead-relforge-eqiad-small-alpha.timer)]", "parameters": "--- Exec[systemd daemon-reload for opensearch-disable-readahead-relforge-eqiad-small-alpha.timer (opensearch-disable-readahead-relforge-eqiad-small-alpha.timer)].orig\n+++ Exec[systemd daemon-reload for opensearch-disable-readahead-relforge-eqiad-small-alpha.timer (opensearch-disable-readahead-relforge-eqiad-small-alpha.timer)]\n\n+    before      => ['Service[opensearch-disable-readahead-relforge-eqiad-small-alpha.timer]']\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Systemd::Service[opensearch-disable-readahead]", "parameters": "--- Systemd::Service[opensearch-disable-readahead].orig\n+++ Systemd::Service[opensearch-disable-readahead]\n\n+    override                 => False\n+    restart                  => False\n+    require                  => Systemd::Unit[opensearch-disable-readahead.service]\n+    ensure                   => absent\n+    unit_type                => timer\n+    migration_task           => T407130\n+    monitoring_enabled       => False\n+    monitoring_contact_group => admins\n+    service_params           => {}\n+    monitoring_critical      => False\n"}, {"resource": "Motd::Script[cirrus::test]", "parameters": "--- Motd::Script[cirrus::test].orig\n+++ Motd::Script[cirrus::test]\n\n-    priority => 5\n-    ensure   => present\n"}, {"resource": "File[/etc/default/logstash]", "parameters": "--- File[/etc/default/logstash].orig\n+++ File[/etc/default/logstash]\n\n+    owner   => root\n+    group   => root\n+    require => Package[logstash-oss]\n+    mode    => 0444\n+    notify  => Service[logstash]\n"}, {"resource": "Nrpe::Check[check_check_push_cross_cluster_settings_9400_status]", "parameters": "--- Nrpe::Check[check_check_push_cross_cluster_settings_9400_status].orig\n+++ Nrpe::Check[check_check_push_cross_cluster_settings_9400_status]\n\n+    before  => Monitoring::Service[check_push_cross_cluster_settings_9400_status]\n+    command => /usr/local/lib/nagios/plugins/check_systemd_unit_status push_cross_cluster_settings_9400\n+    ensure  => present\n"}, {"resource": "Systemd::Unit[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service]", "parameters": "--- Systemd::Unit[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service].orig\n+++ Systemd::Unit[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => present\n+    override_filename => puppet-override.conf\n+    unit              => wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service\n"}, {"resource": "Systemd::Service[opensearch-disable-readahead-relforge-eqiad-small-alpha]", "parameters": "--- Systemd::Service[opensearch-disable-readahead-relforge-eqiad-small-alpha].orig\n+++ Systemd::Service[opensearch-disable-readahead-relforge-eqiad-small-alpha]\n\n+    override                 => False\n+    restart                  => False\n+    require                  => Systemd::Unit[opensearch-disable-readahead-relforge-eqiad-small-alpha.service]\n+    ensure                   => present\n+    unit_type                => timer\n+    migration_task           => T407130\n+    monitoring_enabled       => False\n+    monitoring_contact_group => admins\n+    service_params           => {}\n+    monitoring_critical      => False\n"}, {"resource": "File[/etc/rsyslog.d/40-push-cross-cluster-settings-9200.conf]", "content": "--- /etc/rsyslog.d/40-push-cross-cluster-settings-9200.conf.orig\n+++ /etc/rsyslog.d/40-push-cross-cluster-settings-9200.conf\n@@ -0,0 +1,10 @@\n+# rsyslog.conf(5) configuration file for services.\n+# This file is managed by Puppet.\n+if $programname startswith \"push_cross_cluster_settings_9200\" then {\n+    action(\n+        type=\"omfile\" file=\"/var/log/push_cross_cluster_settings_9200/syslog.log\"\n+        fileOwner=\"root\" fileGroup=\"root\"\n+        fileCreateMode=\"0644\"\n+    )\n+    & stop\n+}", "parameters": "--- File[/etc/rsyslog.d/40-push-cross-cluster-settings-9200.conf].orig\n+++ File[/etc/rsyslog.d/40-push-cross-cluster-settings-9200.conf]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Service[rsyslog]\n"}, {"resource": "File[/etc/nagios/nrpe.d/check_opensearch_unassigned_shard_check_9200.cfg]", "content": "--- /etc/nagios/nrpe.d/check_opensearch_unassigned_shard_check_9200.cfg.orig\n+++ /etc/nagios/nrpe.d/check_opensearch_unassigned_shard_check_9200.cfg\n@@ -0,0 +1,2 @@\n+# File generated by puppet. DO NOT edit by hand\n+command[check_opensearch_unassigned_shard_check_9200]=/usr/lib/nagios/plugins/check_elasticsearch_unassigned_shards.py --url http://localhost:9200 --timeout 4", "parameters": "--- File[/etc/nagios/nrpe.d/check_opensearch_unassigned_shard_check_9200.cfg].orig\n+++ File[/etc/nagios/nrpe.d/check_opensearch_unassigned_shard_check_9200.cfg]\n\n+    owner   => root\n+    require => Package[nagios-nrpe-server]\n+    group   => root\n+    tag     => nrpe::check\n+    ensure  => present\n+    mode    => 0444\n+    notify  => Service[nagios-nrpe-server]\n"}, {"resource": "Systemd::Syslog[push_cross_cluster_settings_9400]", "parameters": "--- Systemd::Syslog[push_cross_cluster_settings_9400].orig\n+++ Systemd::Syslog[push_cross_cluster_settings_9400]\n\n+    readable_by            => all\n+    force_stop             => True\n+    ensure                 => present\n+    programname_comparison => startswith\n+    log_filename           => syslog.log\n+    owner                  => root\n+    group                  => root\n+    base_dir               => /var/log\n"}, {"resource": "Systemd::Timer::Job[push_cross_cluster_settings_9400]", "parameters": "--- Systemd::Timer::Job[push_cross_cluster_settings_9400].orig\n+++ Systemd::Timer::Job[push_cross_cluster_settings_9400]\n\n+    send_mail                 => False\n+    user                      => root\n+    monitoring_enabled        => True\n+    logfile_name              => syslog.log\n+    logging_enabled           => True\n+    command                   => /bin/bash /usr/local/bin/set-cross-cluster-seeds_9400.sh\n+    private_tmp               => False\n+    description               => Auto set remote cluster seeds for relforge-eqiad-small-alpha\n+    syslog_force_stop         => True\n+    ignore_errors             => False\n+    send_mail_only_on_error   => True\n+    fixed_random_delay        => False\n+    logfile_perms             => all\n+    ensure                    => present\n+    logfile_basedir           => /var/log\n+    environment               => {}\n+    logfile_group             => root\n+    send_mail_to              => root@relforge1008.eqiad.wmnet\n+    success_exit_status       => []\n+    interval                  => {'start': 'OnUnitActiveSec', 'interval': '15min'}\n+    monitoring_contact_groups => admins\n+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+    syslog_match_startswith   => True\n"}, {"resource": "File[/lib/systemd/system/push_cross_cluster_settings_9400.service]", "content": "--- /lib/systemd/system/push_cross_cluster_settings_9400.service.orig\n+++ /lib/systemd/system/push_cross_cluster_settings_9400.service\n@@ -0,0 +1,8 @@\n+[Unit]\n+Description=Auto set remote cluster seeds for relforge-eqiad-small-alpha\n+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+\n+[Service]\n+Type=oneshot\n+User=root\n+ExecStart=/bin/bash /usr/local/bin/set-cross-cluster-seeds_9400.sh", "parameters": "--- File[/lib/systemd/system/push_cross_cluster_settings_9400.service].orig\n+++ File[/lib/systemd/system/push_cross_cluster_settings_9400.service]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for push_cross_cluster_settings_9400.service (push_cross_cluster_settings_9400.service)]\n"}, {"resource": "Package[python3-requests]", "parameters": "--- Package[python3-requests].orig\n+++ Package[python3-requests]\n\n+    provider => apt\n+    ensure   => installed\n"}, {"resource": "Exec[systemd daemon-reload for clean_up_dlq.service (clean_up_dlq.service)]", "parameters": "--- Exec[systemd daemon-reload for clean_up_dlq.service (clean_up_dlq.service)].orig\n+++ Exec[systemd daemon-reload for clean_up_dlq.service (clean_up_dlq.service)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Firewall::Service[opensearch-inter-node-9500]", "parameters": "--- Firewall::Service[opensearch-inter-node-9500].orig\n+++ Firewall::Service[opensearch-inter-node-9500]\n\n+    unrestricted_access => False\n+    ensure              => present\n+    notrack             => True\n+    srange              => ['relforge1008.eqiad.wmnet', 'relforge1009.eqiad.wmnet', 'relforge1010.eqiad.wmnet']\n+    prio                => 10\n+    desc                => \n+    port                => 9500\n+    proto               => tcp\n"}, {"resource": "Monitoring::Service[opensearch_shard_size_check_9200]", "parameters": "--- Monitoring::Service[opensearch_shard_size_check_9200].orig\n+++ Monitoring::Service[opensearch_shard_size_check_9200]\n\n+    check_command  => nrpe_check!check_opensearch_shard_size_check_9200!10\n+    retry_interval => 180\n+    freshness      => 36000\n+    ensure         => present\n+    check_interval => 1440\n+    config_dir     => /etc/nagios\n+    migration_task => T371083\n+    contact_group  => admins,team-discovery\n+    host           => relforge1008\n+    critical       => False\n+    retries        => 3\n+    passive        => False\n+    description    => OpenSearch shard size check - 9200\n+    notes_url      => https://wikitech.wikimedia.org/wiki/Search#If_it_has_been_indexed\n"}, {"resource": "Prometheus::Alert::Rule[check_check_push_cross_cluster_settings_9200_status_379fbc6cbce5b297397c866a15729f1a]", "parameters": "--- Prometheus::Alert::Rule[check_check_push_cross_cluster_settings_9200_status_379fbc6cbce5b297397c866a15729f1a].orig\n+++ Prometheus::Alert::Rule[check_check_push_cross_cluster_settings_9200_status_379fbc6cbce5b297397c866a15729f1a]\n\n+    for                => 11m\n+    team               => observability\n+    ensure             => absent\n+    dashboard          => TODO\n+    instance           => ops\n+    runbook            => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+    severity           => info\n+    def_label_whitelst => ['team', 'severity']\n+    alert_name         => nrpe_Check_unit_status_of_push_cross_cluster_settings_9200\n+    site               => eqiad\n+    group              => nrpechecks\n+    summary            => NRPE CHECK: Check unit status of push_cross_cluster_settings_9200\n+    expr               => (nagios_nrpe_check_result{alert_rule_hash=\"379fbc6cbce5b297397c866a15729f1a\",check_name=\"check_check_push_cross_cluster_settings_9200_status\", status=~\"(WARNING|CRITICAL)\", severity=~\"(warning|critical)\"} > 0) * on (instance) group_left (team) role_owner\n+    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_push_cross_cluster_settings_9200_status))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))\n+    description        => NRPE CHECK: Check unit status of push_cross_cluster_settings_9200\n"}, {"resource": "Systemd::Unit[push_cross_cluster_settings_9400.service]", "parameters": "--- Systemd::Unit[push_cross_cluster_settings_9400.service].orig\n+++ Systemd::Unit[push_cross_cluster_settings_9400.service]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => present\n+    override_filename => puppet-override.conf\n+    unit              => push_cross_cluster_settings_9400.service\n"}, {"resource": "Sudo::User[nrpe-check_opensearch_shards_9200]", "parameters": "--- Sudo::User[nrpe-check_opensearch_shards_9200].orig\n+++ Sudo::User[nrpe-check_opensearch_shards_9200]\n\n+    privileges => []\n+    tag        => nrpe::check\n+    user       => nagios\n+    require    => ['Class[Sudo]']\n+    ensure     => absent\n"}, {"resource": "Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service (nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service)]", "parameters": "--- Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service (nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service)].orig\n+++ Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service (nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Rsyslog::Conf[push_cross_cluster_settings_9200]", "parameters": "--- Rsyslog::Conf[push_cross_cluster_settings_9200].orig\n+++ Rsyslog::Conf[push_cross_cluster_settings_9200]\n\n+    mode     => 0444\n+    priority => 40\n+    require  => File[/var/log/push_cross_cluster_settings_9200]\n+    ensure   => present\n"}, {"resource": "Nrpe::Check[check_opensearch_shard_size_check_9400]", "parameters": "--- Nrpe::Check[check_opensearch_shard_size_check_9400].orig\n+++ Nrpe::Check[check_opensearch_shard_size_check_9400]\n\n+    before  => Monitoring::Service[opensearch_shard_size_check_9400]\n+    command => /usr/lib/nagios/plugins/check_elasticsearch_shard_size.py --url http://localhost:9400 --shard-size-warning 110 --shard-size-critical 140 --timeout 4\n+    ensure  => present\n"}, {"resource": "File[/etc/opensearch/relforge-eqiad-small-alpha/logging.yml]", "parameters": "--- File[/etc/opensearch/relforge-eqiad-small-alpha/logging.yml].orig\n+++ File[/etc/opensearch/relforge-eqiad-small-alpha/logging.yml]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n"}, {"resource": "Exec[Generate cert discovery2026__relforge1008_eqiad_wmnet refresh]", "parameters": "--- Exec[Generate cert discovery2026__relforge1008_eqiad_wmnet refresh].orig\n+++ Exec[Generate cert discovery2026__relforge1008_eqiad_wmnet refresh]\n\n+    environment => ['GODEBUG=x509ignoreCN=0']\n+    command     => /usr/bin/cfssl gencert -config /etc/cfssl/client-cfssl.conf -tls-remote-ca /etc/ssl/certs/wmf-ca-certificates.crt -mutual-tls-client-cert /etc/cfssl/mutual_tls_client_cert.pem -mutual-tls-client-key /var/lib/puppet/ssl/private_keys/relforge1008.eqiad.wmnet.pem -label discovery2026  /etc/cfssl/csr/discovery2026__relforge1008_eqiad_wmnet.csr | /usr/bin/cfssljson -bare /etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet\n\n+    subscribe   => File[/etc/cfssl/csr/discovery2026__relforge1008_eqiad_wmnet.csr]\n+    refreshonly => True\n"}, {"resource": "Concat::Fragment[wikimedia-opensearch-plugins]", "parameters": "--- Concat::Fragment[wikimedia-opensearch-plugins].orig\n+++ Concat::Fragment[wikimedia-opensearch-plugins]\n\n+    target => /etc/apt/sources.list.d/wikimedia-opensearch-plugins.sources\n+    order  => 10\n"}, {"resource": "Systemd::Service[push_cross_cluster_settings_9400]", "parameters": "--- Systemd::Service[push_cross_cluster_settings_9400].orig\n+++ Systemd::Service[push_cross_cluster_settings_9400]\n\n+    override                 => False\n+    restart                  => False\n+    require                  => Systemd::Unit[push_cross_cluster_settings_9400.service]\n+    ensure                   => present\n+    unit_type                => timer\n+    migration_task           => T407130\n+    monitoring_enabled       => False\n+    monitoring_contact_group => admins\n+    service_params           => {}\n+    monitoring_critical      => False\n"}, {"resource": "File[/etc/tmpfiles.d/opensearch-relforge-eqiad-small-alpha.conf]", "content": "--- /etc/tmpfiles.d/opensearch-relforge-eqiad-small-alpha.conf.orig\n+++ /etc/tmpfiles.d/opensearch-relforge-eqiad-small-alpha.conf\n@@ -0,0 +1 @@\n+d    /run/opensearch-relforge-eqiad-small-alpha  0755 opensearch opensearch - -", "parameters": "--- File[/etc/tmpfiles.d/opensearch-relforge-eqiad-small-alpha.conf].orig\n+++ File[/etc/tmpfiles.d/opensearch-relforge-eqiad-small-alpha.conf]\n\n+    mode   => 0444\n+    owner  => root\n+    group  => root\n+    ensure => present\n"}, {"resource": "File[/lib/systemd/system/prometheus-elasticsearch-exporter-9400.service]", "content": "--- /lib/systemd/system/prometheus-elasticsearch-exporter-9400.service.orig\n+++ /lib/systemd/system/prometheus-elasticsearch-exporter-9400.service\n@@ -0,0 +1,11 @@\n+[Unit]\n+Description=Prometheus exporter for Elasticsearch\n+Documentation=https://prometheus.io/docs/introduction/overview/\n+\n+[Service]\n+Restart=always\n+User=prometheus\n+ExecStart=/usr/bin/prometheus-elasticsearch-exporter --es.uri=http://localhost:9400 --web.listen-address=:9109 \n+\n+[Install]\n+WantedBy=multi-user.target", "parameters": "--- File[/lib/systemd/system/prometheus-elasticsearch-exporter-9400.service].orig\n+++ File[/lib/systemd/system/prometheus-elasticsearch-exporter-9400.service]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for prometheus-elasticsearch-exporter-9400.service (prometheus-elasticsearch-exporter-9400)]\n"}, {"resource": "Sysctl::Conffile[TCP Fast Open]", "parameters": "--- Sysctl::Conffile[TCP Fast Open].orig\n+++ Sysctl::Conffile[TCP Fast Open]\n\n+    ensure             => present\n+    priority           => 70\n+    no_priority_prefix => False\n"}, {"resource": "File[/etc/ferm/conf.d/10_opensearch-https-9443]", "content": "--- /etc/ferm/conf.d/10_opensearch-https-9443.orig\n+++ /etc/ferm/conf.d/10_opensearch-https-9443\n@@ -0,0 +1,6 @@\n+# Autogenerated by puppet. DO NOT EDIT BY HAND!\n+#\n+# \n+&R_SERVICE(tcp, 9443, (($CUMIN_MASTERS $ANALYTICS_NETWORKS $STAGING_KUBEPODS_NETWORKS)));\n+\n+", "parameters": "--- File[/etc/ferm/conf.d/10_opensearch-https-9443].orig\n+++ File[/etc/ferm/conf.d/10_opensearch-https-9443]\n\n+    owner   => root\n+    group   => root\n+    tag     => ferm\n+    require => File[/etc/ferm/conf.d]\n+    mode    => 0400\n+    ensure  => present\n+    notify  => Service[ferm]\n"}, {"resource": "File[/etc/logrotate.d/push_cross_cluster_settings_9200]", "content": "--- /etc/logrotate.d/push_cross_cluster_settings_9200.orig\n+++ /etc/logrotate.d/push_cross_cluster_settings_9200\n@@ -0,0 +1,12 @@\n+# logrotate(8) config for push_cross_cluster_settings_9200\n+\n+/var/log/push_cross_cluster_settings_9200/*.log {\n+    daily\n+    copytruncate\n+    missingok\n+    compress\n+    delaycompress\n+    notifempty\n+    rotate 15\n+    size 256M\n+}", "parameters": "--- File[/etc/logrotate.d/push_cross_cluster_settings_9200].orig\n+++ File[/etc/logrotate.d/push_cross_cluster_settings_9200]\n\n+    owner  => root\n+    mode   => 0444\n+    group  => root\n+    ensure => present\n"}, {"resource": "Sudo::User[nrpe-check_opensearch_shard_size_check_9200]", "parameters": "--- Sudo::User[nrpe-check_opensearch_shard_size_check_9200].orig\n+++ Sudo::User[nrpe-check_opensearch_shard_size_check_9200]\n\n+    privileges => []\n+    tag        => nrpe::check\n+    user       => nagios\n+    require    => ['Class[Sudo]']\n+    ensure     => absent\n"}, {"resource": "File[/etc/ferm/conf.d/10_elastic-small-alpha-https-9443]", "content": "--- /etc/ferm/conf.d/10_elastic-small-alpha-https-9443.orig\n+++ /etc/ferm/conf.d/10_elastic-small-alpha-https-9443\n@@ -0,0 +1,6 @@\n+# Autogenerated by puppet. DO NOT EDIT BY HAND!\n+#\n+# \n+&R_SERVICE(tcp, 9443, (10.64.16.154 2620:0:861:102:10:64:16:154 10.192.32.49 2620:0:860:103:10:192:32:49));\n+\n+", "parameters": "--- File[/etc/ferm/conf.d/10_elastic-small-alpha-https-9443].orig\n+++ File[/etc/ferm/conf.d/10_elastic-small-alpha-https-9443]\n\n+    owner   => root\n+    group   => root\n+    tag     => ferm\n+    require => File[/etc/ferm/conf.d]\n+    mode    => 0400\n+    ensure  => present\n+    notify  => Service[ferm]\n"}, {"resource": "Systemd::Timer::Job[clean_up_dlq]", "parameters": "--- Systemd::Timer::Job[clean_up_dlq].orig\n+++ Systemd::Timer::Job[clean_up_dlq]\n\n+    send_mail                 => False\n+    user                      => root\n+    monitoring_enabled        => False\n+    logfile_name              => syslog.log\n+    logging_enabled           => True\n+    command                   => /usr/local/bin/cleanup-dlq\n+    private_tmp               => False\n+    description               => Clean up dead letter queue and restart logstash\n+    syslog_force_stop         => True\n+    ignore_errors             => False\n+    send_mail_only_on_error   => True\n+    fixed_random_delay        => False\n+    logfile_perms             => all\n+    ensure                    => absent\n+    logfile_basedir           => /var/log\n+    environment               => {}\n+    logfile_group             => root\n+    send_mail_to              => root@relforge1008.eqiad.wmnet\n+    success_exit_status       => []\n+    interval                  => {'start': 'OnCalendar', 'interval': '1h'}\n+    monitoring_contact_groups => admins\n+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+    syslog_match_startswith   => True\n"}, {"resource": "File[/lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer]", "content": "--- /lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer.orig\n+++ /lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer\n@@ -0,0 +1,14 @@\n+[Unit]\n+Description=Periodic execution of nrpe2nodexp-opensearch_unassigned_shard_check_9200.service\n+\n+[Timer]\n+Unit=nrpe2nodexp-opensearch_unassigned_shard_check_9200.service\n+# Accuracy sets the maximum time interval around the execution time we want to allow\n+AccuracySec=15sec\n+OnUnitInactiveSec=720min\n+OnActiveSec=1s\n+RandomizedDelaySec=43200\n+FixedRandomDelay=true\n+\n+[Install]\n+WantedBy=multi-user.target", "parameters": "--- File[/lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer].orig\n+++ File[/lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer (nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer)]\n"}, {"resource": "Opensearch::Log::Hot_threads_cluster[relforge-eqiad-small-alpha]", "parameters": "--- Opensearch::Log::Hot_threads_cluster[relforge-eqiad-small-alpha].orig\n+++ Opensearch::Log::Hot_threads_cluster[relforge-eqiad-small-alpha]\n\n+    http_port    => 9400\n+    cluster_name => relforge-eqiad-small-alpha\n"}, {"resource": "Monitoring::Service[opensearch_shard_size_check_9400]", "parameters": "--- Monitoring::Service[opensearch_shard_size_check_9400].orig\n+++ Monitoring::Service[opensearch_shard_size_check_9400]\n\n+    check_command  => nrpe_check!check_opensearch_shard_size_check_9400!10\n+    retry_interval => 180\n+    freshness      => 36000\n+    ensure         => present\n+    check_interval => 1440\n+    config_dir     => /etc/nagios\n+    migration_task => T371083\n+    contact_group  => admins,team-discovery\n+    host           => relforge1008\n+    critical       => False\n+    retries        => 3\n+    passive        => False\n+    description    => OpenSearch shard size check - 9400\n+    notes_url      => https://wikitech.wikimedia.org/wiki/Search#If_it_has_been_indexed\n"}, {"resource": "File[/lib/systemd/system/opensearch-disable-readahead.timer]", "content": "--- /lib/systemd/system/opensearch-disable-readahead.timer.orig\n+++ /lib/systemd/system/opensearch-disable-readahead.timer\n@@ -0,0 +1,13 @@\n+[Unit]\n+Description=Periodic execution of opensearch-disable-readahead.service\n+\n+[Timer]\n+Unit=opensearch-disable-readahead.service\n+# Accuracy sets the maximum time interval around the execution time we want to allow\n+AccuracySec=15sec\n+OnUnitActiveSec=30min\n+OnBootSec=1min\n+RandomizedDelaySec=0\n+\n+[Install]\n+WantedBy=multi-user.target", "parameters": "--- File[/lib/systemd/system/opensearch-disable-readahead.timer].orig\n+++ File[/lib/systemd/system/opensearch-disable-readahead.timer]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for opensearch-disable-readahead.timer (opensearch-disable-readahead.timer)]\n"}, {"resource": "Systemd::Timer::Job[nrpe2nodexp-opensearch_shard_size_check_9200]", "parameters": "--- Systemd::Timer::Job[nrpe2nodexp-opensearch_shard_size_check_9200].orig\n+++ Systemd::Timer::Job[nrpe2nodexp-opensearch_shard_size_check_9200]\n\n+    send_mail                 => False\n+    user                      => nagios\n+    monitoring_enabled        => False\n+    logfile_name              => syslog.log\n+    logging_enabled           => False\n+    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash \"c62725841c61e20ac3f6819b4c0ad800\" --timeout 10 --check-command \"check_opensearch_shard_size_check_9200\"\n+    private_tmp               => False\n+    splay                     => 36000\n+    description               => execution of nrpe2nodexp for the check_opensearch_shard_size_check_9200 command.\n+    syslog_force_stop         => True\n+    ignore_errors             => True\n+    send_mail_only_on_error   => True\n+    fixed_random_delay        => True\n+    logfile_perms             => all\n+    syslog_identifier         => nrpe2nodexp-opensearch_shard_size_check_9200\n+    ensure                    => absent\n+    logfile_basedir           => /var/log\n+    environment               => {}\n+    logfile_group             => root\n+    send_mail_to              => root@relforge1008.eqiad.wmnet\n+    group                     => prometheus-node-exporter\n+    success_exit_status       => []\n+    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '600min'}]\n+    monitoring_contact_groups => admins\n+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+    syslog_match_startswith   => True\n"}, {"resource": "File[/etc/rsyslog.d/40-clean-up-dlq.conf]", "content": "--- /etc/rsyslog.d/40-clean-up-dlq.conf.orig\n+++ /etc/rsyslog.d/40-clean-up-dlq.conf\n@@ -0,0 +1,10 @@\n+# rsyslog.conf(5) configuration file for services.\n+# This file is managed by Puppet.\n+if $programname startswith \"clean_up_dlq\" then {\n+    action(\n+        type=\"omfile\" file=\"/var/log/clean_up_dlq/syslog.log\"\n+        fileOwner=\"root\" fileGroup=\"root\"\n+        fileCreateMode=\"0644\"\n+    )\n+    & stop\n+}", "parameters": "--- File[/etc/rsyslog.d/40-clean-up-dlq.conf].orig\n+++ File[/etc/rsyslog.d/40-clean-up-dlq.conf]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Service[rsyslog]\n"}, {"resource": "Rsyslog::Conf[opensearch-disable-readahead-relforge-eqiad]", "parameters": "--- Rsyslog::Conf[opensearch-disable-readahead-relforge-eqiad].orig\n+++ Rsyslog::Conf[opensearch-disable-readahead-relforge-eqiad]\n\n+    mode     => 0444\n+    priority => 40\n+    require  => File[/var/log/opensearch-disable-readahead-relforge-eqiad]\n+    ensure   => present\n"}, {"resource": "File[/etc/nagios/nrpe.d/check_opensearch_unassigned_shard_check_9400.cfg]", "content": "--- /etc/nagios/nrpe.d/check_opensearch_unassigned_shard_check_9400.cfg.orig\n+++ /etc/nagios/nrpe.d/check_opensearch_unassigned_shard_check_9400.cfg\n@@ -0,0 +1,2 @@\n+# File generated by puppet. DO NOT edit by hand\n+command[check_opensearch_unassigned_shard_check_9400]=/usr/lib/nagios/plugins/check_elasticsearch_unassigned_shards.py --url http://localhost:9400 --timeout 4", "parameters": "--- File[/etc/nagios/nrpe.d/check_opensearch_unassigned_shard_check_9400.cfg].orig\n+++ File[/etc/nagios/nrpe.d/check_opensearch_unassigned_shard_check_9400.cfg]\n\n+    owner   => root\n+    require => Package[nagios-nrpe-server]\n+    group   => root\n+    tag     => nrpe::check\n+    ensure  => present\n+    mode    => 0444\n+    notify  => Service[nagios-nrpe-server]\n"}, {"resource": "Rsyslog::Conf[udp_json_logback_compat]", "parameters": "--- Rsyslog::Conf[udp_json_logback_compat].orig\n+++ Rsyslog::Conf[udp_json_logback_compat]\n\n+    mode     => 0444\n+    priority => 50\n+    ensure   => present\n"}, {"resource": "File[/lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service]", "content": "--- /lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service.orig\n+++ /lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service\n@@ -0,0 +1,11 @@\n+[Unit]\n+Description=execution of nrpe2nodexp for the check_check_push_cross_cluster_settings_9400_status command.\n+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+\n+[Service]\n+Type=oneshot\n+User=nagios\n+\n+Group=prometheus-node-exporter\n+SyslogIdentifier=nrpe2nodexp-check_push_cross_cluster_settings_9400_status\n+ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash \"de4a199c43946c09f819ca4ffea40ac0\" --timeout 10 --check-command \"check_check_push_cross_cluster_settings_9400_status\"", "parameters": "--- File[/lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service].orig\n+++ File[/lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service (nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service)]\n"}, {"resource": "Class[Nginx]", "parameters": "--- Class[Nginx].orig\n+++ Class[Nginx]\n\n+    modules      => []\n+    managed      => False\n+    lib_on_tmpfs => True\n+    variant      => light\n+    ensure       => present\n+    tmpfs_size   => 1g\n"}, {"resource": "Logstash::Conf[input-gelf-gelf_relay]", "parameters": "--- Logstash::Conf[input-gelf-gelf_relay].orig\n+++ Logstash::Conf[input-gelf-gelf_relay]\n\n+    priority => 10\n+    ensure   => present\n"}, {"resource": "File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chain.pem]", "parameters": "--- File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chain.pem].orig\n+++ File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chain.pem]\n\n+    owner  => root\n+    source => puppet:///modules/profile/pki/intermediates/discovery2026-cert.pem\n+    group  => root\n+    ensure => file\n+    mode   => 0440\n+    notify => ['Exec[nginx-reload]', 'Exec[nginx-reload]']\n"}, {"resource": "File[/etc/opensearch/relforge-eqiad-small-alpha/opensearch.keystore]", "parameters": "--- File[/etc/opensearch/relforge-eqiad-small-alpha/opensearch.keystore].orig\n+++ File[/etc/opensearch/relforge-eqiad-small-alpha/opensearch.keystore]\n\n+    owner => root\n+    mode  => 0640\n+    group => opensearch\n"}, {"resource": "File[/etc/tmpfiles.d/opensearch-relforge-eqiad.conf]", "content": "--- /etc/tmpfiles.d/opensearch-relforge-eqiad.conf.orig\n+++ /etc/tmpfiles.d/opensearch-relforge-eqiad.conf\n@@ -0,0 +1 @@\n+d    /run/opensearch-relforge-eqiad  0755 opensearch opensearch - -", "parameters": "--- File[/etc/tmpfiles.d/opensearch-relforge-eqiad.conf].orig\n+++ File[/etc/tmpfiles.d/opensearch-relforge-eqiad.conf]\n\n+    mode   => 0444\n+    owner  => root\n+    group  => root\n+    ensure => present\n"}, {"resource": "Exec[opensearch-create-keystore-relforge-eqiad]", "parameters": "--- Exec[opensearch-create-keystore-relforge-eqiad].orig\n+++ Exec[opensearch-create-keystore-relforge-eqiad]\n\n+    environment => ['OPENSEARCH_PATH_CONF=/etc/opensearch/relforge-eqiad']\n+    command     => /usr/share/opensearch/bin/opensearch-keystore create\n+    creates     => /etc/opensearch/relforge-eqiad/opensearch.keystore\n+    before      => File[/etc/opensearch/relforge-eqiad/opensearch.keystore]\n"}, {"resource": "Systemd::Unit[wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service]", "parameters": "--- Systemd::Unit[wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service].orig\n+++ Systemd::Unit[wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => present\n+    override_filename => puppet-override.conf\n+    unit              => wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service\n"}, {"resource": "Systemd::Service[wmf_auto_restart_prometheus-elasticsearch-exporter-9200]", "parameters": "--- Systemd::Service[wmf_auto_restart_prometheus-elasticsearch-exporter-9200].orig\n+++ Systemd::Service[wmf_auto_restart_prometheus-elasticsearch-exporter-9200]\n\n+    override                 => False\n+    restart                  => False\n+    require                  => Systemd::Unit[wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service]\n+    ensure                   => present\n+    unit_type                => timer\n+    migration_task           => T407130\n+    monitoring_enabled       => False\n+    monitoring_contact_group => admins\n+    service_params           => {}\n+    monitoring_critical      => False\n"}, {"resource": "File[/etc/sudoers.d/nrpe-check_check_push_cross_cluster_settings_9400_status]", "parameters": "--- File[/etc/sudoers.d/nrpe-check_check_push_cross_cluster_settings_9400_status].orig\n+++ File[/etc/sudoers.d/nrpe-check_check_push_cross_cluster_settings_9400_status]\n\n+    owner   => root\n+    require => Package[nagios-nrpe-server]\n+    group   => root\n+    ensure  => absent\n"}, {"resource": "File[/etc/opensearch/relforge-eqiad/jvm.options]", "content": "--- /etc/opensearch/relforge-eqiad/jvm.options.orig\n+++ /etc/opensearch/relforge-eqiad/jvm.options\n@@ -0,0 +1,109 @@\n+## JVM configuration\n+\n+################################################################\n+## IMPORTANT: JVM heap size\n+################################################################\n+##\n+## You should always set the min and max JVM heap\n+## size to the same value. For example, to set\n+## the heap to 4 GB, set:\n+##\n+## -Xms4g\n+## -Xmx4g\n+##\n+## See https://opensearch.org/docs/opensearch/install/important-settings/\n+## for more information\n+##\n+################################################################\n+\n+# Xms represents the initial size of total heap space\n+# Xmx represents the maximum size of total heap space\n+\n+-Xms30G\n+-Xmx30G\n+\n+################################################################\n+## Numa Awareness\n+################################################################\n+-XX:+UseNUMA\n+\n+################################################################\n+## Expert settings\n+################################################################\n+##\n+## All settings below this section are considered\n+## expert settings. Don't tamper with them unless\n+## you understand what you are doing\n+##\n+################################################################\n+\n+\n+## optimizations\n+\n+# disable calls to System#gc\n+-XX:+DisableExplicitGC\n+\n+# pre-touch memory pages used by the JVM during initialization\n+-XX:+AlwaysPreTouch\n+\n+## basic\n+\n+# force the server VM (remove on 32-bit client JVMs)\n+-server\n+\n+# explicitly set the stack size (reduce to 320k on 32-bit client JVMs)\n+-Xss1m\n+\n+# log4j 2\n+-Dlog4j.skipJansi=true\n+-Dlog4j2.formatMsgNoLookups=true\n+\n+# security policy, needed for OpenSearch to access non-default files/sockets/ports T395571\n+\n+-Djava.security.policy=/etc/opensearch/relforge-eqiad/java-security.policy\n+\n+## heap dumps\n+\n+# generate a heap dump when an allocation from the Java heap fails\n+# heap dumps are created in the working directory of the JVM\n+-XX:+HeapDumpOnOutOfMemoryError\n+\n+# specify an alternative path for heap dumps\n+# ensure the directory exists and has sufficient space\n+-XX:HeapDumpPath=/srv/opensearch/relforge-eqiad\n+\n+## GC logging\n+\n+#-XX:+PrintGCDetails\n+#-XX:+PrintGCTimeStamps\n+#-XX:+PrintGCDateStamps\n+#-XX:+PrintClassHistogram\n+#-XX:+PrintTenuringDistribution\n+#-XX:+PrintGCApplicationStoppedTime\n+\n+# log GC status to a file with time stamps\n+# ensure the directory exists\n+#-Xloggc:${loggc}\n+\n+## Custom Wikimedia configuration\n+\n+# Defines a limit of proportion of time spent in GC before\n+# an OutOfMemory error is thrown.  The goal is to bail and\n+# restart the server if throughput is suffering due to\n+# GC stalls.\n+# TODO: Why 70? why not 60 or 80?\n+-XX:GCTimeLimit=70\n+\n+# Defines minimum percentage of free space after a full GC\n+# before an OutOfMemoryError is thrown. Typically a full GC\n+# should leave > 50% of heap free. If we are down to 10%\n+# something is wrong and bailing is a reasonable solution.\n+-XX:GCHeapFreeLimit=10\n+\n+# Exit on OutOfMemoryError, since in most cases the JVM does not recover\n+-XX:+ExitOnOutOfMemoryError\n+\n+# Custom WMF GC flags\n+-Xlog:gc*:file=/var/log/opensearch/relforge-eqiad_jvm_gc.%p.log::filecount=10,filesize=20000\n+-Xlog:gc+age=trace\n+-Xlog:safepoint", "parameters": "--- File[/etc/opensearch/relforge-eqiad/jvm.options].orig\n+++ File[/etc/opensearch/relforge-eqiad/jvm.options]\n\n+    owner  => root\n+    mode   => 0444\n+    group  => root\n+    ensure => file\n"}, {"resource": "Systemd::Unit[nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer]", "parameters": "--- Systemd::Unit[nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer].orig\n+++ Systemd::Unit[nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => absent\n+    override_filename => puppet-override.conf\n+    unit              => nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer\n"}, {"resource": "Systemd::Syslog[push_cross_cluster_settings_9200]", "parameters": "--- Systemd::Syslog[push_cross_cluster_settings_9200].orig\n+++ Systemd::Syslog[push_cross_cluster_settings_9200]\n\n+    readable_by            => all\n+    force_stop             => True\n+    ensure                 => present\n+    programname_comparison => startswith\n+    log_filename           => syslog.log\n+    owner                  => root\n+    group                  => root\n+    base_dir               => /var/log\n"}, {"resource": "Motd::Message[cirrus::test]", "parameters": "--- Motd::Message[cirrus::test].orig\n+++ Motd::Message[cirrus::test]\n\n-    priority => 5\n-    message  => relforge1008 is a Unpuppetised system for testing (cirrus::test)\n-    ensure   => present\n"}, {"resource": "Systemd::Timer::Job[nrpe2nodexp-opensearch_shards_9200]", "parameters": "--- Systemd::Timer::Job[nrpe2nodexp-opensearch_shards_9200].orig\n+++ Systemd::Timer::Job[nrpe2nodexp-opensearch_shards_9200]\n\n+    send_mail                 => False\n+    user                      => nagios\n+    monitoring_enabled        => False\n+    logfile_name              => syslog.log\n+    logging_enabled           => False\n+    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash \"fd6eadf747c645a72e11bd74109a8156\" --timeout 10 --check-command \"check_opensearch_shards_9200\"\n+    private_tmp               => False\n+    splay                     => 60\n+    description               => execution of nrpe2nodexp for the check_opensearch_shards_9200 command.\n+    syslog_force_stop         => True\n+    ignore_errors             => True\n+    send_mail_only_on_error   => True\n+    fixed_random_delay        => True\n+    logfile_perms             => all\n+    syslog_identifier         => nrpe2nodexp-opensearch_shards_9200\n+    ensure                    => absent\n+    logfile_basedir           => /var/log\n+    environment               => {}\n+    logfile_group             => root\n+    send_mail_to              => root@relforge1008.eqiad.wmnet\n+    group                     => prometheus-node-exporter\n+    success_exit_status       => []\n+    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '1min'}]\n+    monitoring_contact_groups => admins\n+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+    syslog_match_startswith   => True\n"}, {"resource": "File[/etc/rsyslog.d/50-udp-json-logback-compat.conf]", "content": "--- /etc/rsyslog.d/50-udp-json-logback-compat.conf.orig\n+++ /etc/rsyslog.d/50-udp-json-logback-compat.conf\n@@ -0,0 +1,43 @@\n+# Provide a UDP input to accept JSON payloads on localhost and forward them to logstash via Kakfa.\n+\n+module(load=\"imudp\")\n+module(load=\"mmjsonparse\")\n+module(load=\"omkafka\")\n+\n+template(name=\"template_udp_json_logback_compat\" type=\"list\") {\n+  property(name=\"$!all-json\")\n+}\n+\n+# Use the parsed json \"level\" field value as the kafka topic suffix\n+template(name=\"udp_json_logback_compat_topic\" type=\"string\" string=\"logback-%!level:::lowercase%\")\n+\n+# Use a separate (in memory) queue to limit message processing to this ruleset only.\n+ruleset(name=\"ruleset_udp_json_logback_compat\" queue.type=\"LinkedList\") {\n+\n+  action(type=\"mmjsonparse\" name=\"mmjsonparse_udp_json_logback_compat\" cookie=\"\" useRawMsg=\"on\")\n+\n+  if $parsesuccess == \"OK\" then {\n+    action(type=\"omkafka\"\n+           broker=[\"kafka-logging1001.eqiad.wmnet:9093\",\"kafka-logging1002.eqiad.wmnet:9093\",\"kafka-logging1003.eqiad.wmnet:9093\",\"kafka-logging1004.eqiad.wmnet:9093\",\"kafka-logging1005.eqiad.wmnet:9093\"]\n+           topic=\"udp_json_logback_compat_topic\"\n+           dynatopic=\"on\"\n+           dynatopic.cachesize=\"1000\"\n+           partitions.auto=\"on\"\n+           template=\"template_udp_json_logback_compat\"\n+           queue.type=\"LinkedList\" queue.size=\"10000\" queue.filename=\"udp_json_logback_compat\"\n+           queue.highWatermark=\"7000\" queue.lowWatermark=\"6000\"\n+           queue.checkpointInterval=\"5\"\n+           queue.maxDiskSpace=\"40960000\"\n+           confParam=[ \"security.protocol=ssl\",\n+                       \"ssl.ca.location=/etc/ssl/certs/wmf-ca-certificates.crt\",\n+                       \"compression.codec=snappy\",\n+                       \"socket.timeout.ms=60000\",\n+                       \"socket.keepalive.enable=true\",\n+                       \"queue.buffering.max.ms=50\",\n+                       \"batch.num.messages=1000\" ]\n+    )\n+  }\n+\n+}\n+\n+input(type=\"imudp\" port=\"11514\" address=\"localhost\" ruleset=\"ruleset_udp_json_logback_compat\")", "parameters": "--- File[/etc/rsyslog.d/50-udp-json-logback-compat.conf].orig\n+++ File[/etc/rsyslog.d/50-udp-json-logback-compat.conf]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Service[rsyslog]\n"}, {"resource": "Systemd::Service[nrpe2nodexp-opensearch_unassigned_shard_check_9200]", "parameters": "--- Systemd::Service[nrpe2nodexp-opensearch_unassigned_shard_check_9200].orig\n+++ Systemd::Service[nrpe2nodexp-opensearch_unassigned_shard_check_9200]\n\n+    override                 => False\n+    restart                  => False\n+    require                  => Systemd::Unit[nrpe2nodexp-opensearch_unassigned_shard_check_9200.service]\n+    ensure                   => absent\n+    unit_type                => timer\n+    migration_task           => T407130\n+    monitoring_enabled       => False\n+    monitoring_contact_group => admins\n+    service_params           => {}\n+    monitoring_critical      => False\n"}, {"resource": "Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service (nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service)]", "parameters": "--- Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service (nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service)].orig\n+++ Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service (nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "File[/etc/nginx/nginx.conf]", "content": "--- /etc/nginx/nginx.conf.orig\n+++ /etc/nginx/nginx.conf\n@@ -0,0 +1,67 @@\n+# This file is managed by Puppet!\n+\n+user www-data www-data;\n+worker_processes 48;\n+worker_cpu_affinity 000000000000000000000001000000000000000000000001 000000000000000000000001000000000000000000000001 000000000000000000000010000000000000000000000010 000000000000000000000010000000000000000000000010 000000000000000000000100000000000000000000000100 000000000000000000000100000000000000000000000100 000000000000000000001000000000000000000000001000 000000000000000000001000000000000000000000001000 000000000000000000010000000000000000000000010000 000000000000000000010000000000000000000000010000 000000000000000000100000000000000000000000100000 000000000000000000100000000000000000000000100000 000000000000000001000000000000000000000001000000 000000000000000001000000000000000000000001000000 000000000000000010000000000000000000000010000000 000000000000000010000000000000000000000010000000 000000000000000100000000000000000000000100000000 000000000000000100000000000000000000000100000000 000000000000001000000000000000000000001000000000 000000000000001000000000000000000000001000000000 000000000000010000000000000000000000010000000000 000000000000010000000000000000000000010000000000 000000000000100000000000000000000000100000000000 000000000000100000000000000000000000100000000000 000000000001000000000000000000000001000000000000 000000000001000000000000000000000001000000000000 000000000010000000000000000000000010000000000000 000000000010000000000000000000000010000000000000 000000000100000000000000000000000100000000000000 000000000100000000000000000000000100000000000000 000000001000000000000000000000001000000000000000 000000001000000000000000000000001000000000000000 000000010000000000000000000000010000000000000000 000000010000000000000000000000010000000000000000 000000100000000000000000000000100000000000000000 000000100000000000000000000000100000000000000000 000001000000000000000000000001000000000000000000 000001000000000000000000000001000000000000000000 000010000000000000000000000010000000000000000000 000010000000000000000000000010000000000000000000 000100000000000000000000000100000000000000000000 000100000000000000000000000100000000000000000000 001000000000000000000000001000000000000000000000 001000000000000000000000001000000000000000000000 010000000000000000000000010000000000000000000000 010000000000000000000000010000000000000000000000 100000000000000000000000100000000000000000000000 100000000000000000000000100000000000000000000000;\n+worker_rlimit_nofile 262144;\n+\n+error_log  /var/log/nginx/error.log;\n+pid        /run/nginx.pid;\n+\n+events {\n+    worker_connections 131072;\n+    multi_accept off; # accept 1 conn per epoll hit, basically\n+    accept_mutex off; # better latencies at high connection rates\n+}\n+\n+http {\n+    include       /etc/nginx/mime.types;\n+\n+    access_log\t/var/log/nginx/access.log;\n+\n+    client_max_body_size 100m;\n+    client_body_buffer_size 64k;\n+    http2_max_field_size 8k;\n+\n+    sendfile        on;\n+    #tcp_nopush     on;\n+\n+    #keepalive_timeout  0;\n+    keepalive_timeout  65;\n+    tcp_nodelay        on;\n+\n+    gzip  off;\n+    gzip_disable \"MSIE [1-6]\\.(?!.*SV1)\";\n+\n+    # SSL sessionid caching.  1m is ~4000 sessions.\n+    # Still experimenting!\n+    ssl_session_cache shared:SSL:1024m;\n+    ssl_session_timeout 25h;\n+\n+    # Disable RFC5077 tickets (may revisit later when client support is better)\n+    ssl_session_tickets off;\n+\n+    # nginx's $http2 is either 'h2' or '' (empty string) for http/1\n+    # Map it to $h2 as a boolean string value '1' or '0' for use in headers\n+    map $http2 $h2 {\n+        default '1';\n+        '' '0';\n+    }\n+\n+    # Nginx indicates session reuse with 'r' and '.', which is rather cryptic.\n+    # Map this value to '1' and '0' instead.\n+    map $ssl_session_reused $session_reused {\n+        'r' '1';\n+        '.' '0';\n+    }\n+\n+\n+    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;\n+    ssl_ciphers -ALL:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA;\n+    ssl_ecdh_curve X25519:prime256v1;\n+    ssl_prefer_server_ciphers on;\n+    ssl_dhparam /etc/ssl/dhparam.pem;\n+\n+    include /etc/nginx/conf.d/*.conf;\n+    include /etc/nginx/sites-enabled/*;\n+}", "parameters": "--- File[/etc/nginx/nginx.conf].orig\n+++ File[/etc/nginx/nginx.conf]\n\n+    owner  => root\n+    group  => root\n+    tag    => nginx\n+    before => ['Service[nginx]']\n"}, {"resource": "File[/etc/rsyslog.d/40-opensearch-disable-readahead-relforge-eqiad.conf]", "content": "--- /etc/rsyslog.d/40-opensearch-disable-readahead-relforge-eqiad.conf.orig\n+++ /etc/rsyslog.d/40-opensearch-disable-readahead-relforge-eqiad.conf\n@@ -0,0 +1,10 @@\n+# rsyslog.conf(5) configuration file for services.\n+# This file is managed by Puppet.\n+if $programname startswith \"opensearch-disable-readahead-relforge-eqiad\" then {\n+    action(\n+        type=\"omfile\" file=\"/var/log/opensearch-disable-readahead-relforge-eqiad/syslog.log\"\n+        fileOwner=\"root\" fileGroup=\"root\"\n+        fileCreateMode=\"0644\"\n+    )\n+    & stop\n+}", "parameters": "--- File[/etc/rsyslog.d/40-opensearch-disable-readahead-relforge-eqiad.conf].orig\n+++ File[/etc/rsyslog.d/40-opensearch-disable-readahead-relforge-eqiad.conf]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Service[rsyslog]\n"}, {"resource": "Monitoring::Exported_nagios_service[relforge1008 opensearch_unassigned_shard_check_9400]", "parameters": "--- Monitoring::Exported_nagios_service[relforge1008 opensearch_unassigned_shard_check_9400].orig\n+++ Monitoring::Exported_nagios_service[relforge1008 opensearch_unassigned_shard_check_9400]\n\n+    check_command          => nrpe_check!check_opensearch_unassigned_shard_check_9400!10\n+    retry_interval         => 120\n+    active_checks_enabled  => 1\n+    contact_groups         => admins,team-discovery\n+    host_name              => relforge1008\n+    check_freshness        => 0\n+    notification_period    => 24x7\n+    servicegroups          => relforge_eqiad\n+    notification_interval  => 0\n+    ensure                 => present\n+    notification_options   => c,r,f\n+    check_interval         => 720\n+    notifications_enabled  => 0\n+    max_check_attempts     => 1\n+    is_volatile            => 0\n+    passive_checks_enabled => 1\n+    check_period           => 24x7\n+    service_description    => OpenSearch unassigned shard check - 9400\n+    notes_url              => https://wikitech.wikimedia.org/wiki/Search#Administration\n"}, {"resource": "Exec[systemd daemon-reload for opensearch-hot-threads-log.timer (opensearch-hot-threads-log.timer)]", "parameters": "--- Exec[systemd daemon-reload for opensearch-hot-threads-log.timer (opensearch-hot-threads-log.timer)].orig\n+++ Exec[systemd daemon-reload for opensearch-hot-threads-log.timer (opensearch-hot-threads-log.timer)]\n\n+    before      => ['Service[opensearch-hot-threads-log.timer]']\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Profile::Prometheus::Wmf_elasticsearch_exporter[relforge1008:9200]", "parameters": "--- Profile::Prometheus::Wmf_elasticsearch_exporter[relforge1008:9200].orig\n+++ Profile::Prometheus::Wmf_elasticsearch_exporter[relforge1008:9200]\n\n+    prometheus_port    => 9120\n+    indices_to_monitor => []\n+    elasticsearch_port => 9200\n"}, {"resource": "Service[push_cross_cluster_settings_9200.timer]", "parameters": "--- Service[push_cross_cluster_settings_9200.timer].orig\n+++ Service[push_cross_cluster_settings_9200.timer]\n\n+    ensure   => running\n+    provider => systemd\n+    enable   => True\n"}, {"resource": "Concat_fragment[wikimedia-opensearch]", "content": "--- wikimedia-opensearch.orig\n+++ wikimedia-opensearch\n@@ -0,0 +1,5 @@\n+Types: deb deb-src\n+URIs: http://apt.wikimedia.org/wikimedia\n+Suites: bookworm-wikimedia\n+Components: thirdparty/opensearch1\n+Signed-By: /etc/apt/keyrings/wikimedia-archive-keyring.gpg", "parameters": "--- Concat_fragment[wikimedia-opensearch].orig\n+++ Concat_fragment[wikimedia-opensearch]\n\n+    target => /etc/apt/sources.list.d/wikimedia-opensearch.sources\n+    tag    => _etc_apt_sources.list.d_wikimedia-opensearch.sources\n+    order  => 10\n"}, {"resource": "Ferm::Service[opensearch_inter_node_9500]", "parameters": "--- Ferm::Service[opensearch_inter_node_9500].orig\n+++ Ferm::Service[opensearch_inter_node_9500]\n\n+    unrestricted_access => False\n+    ensure              => present\n+    notrack             => True\n+    srange              => ['relforge1008.eqiad.wmnet', 'relforge1009.eqiad.wmnet', 'relforge1010.eqiad.wmnet']\n+    prio                => 10\n+    desc                => \n+    port                => 9500\n+    proto               => tcp\n"}, {"resource": "Exec[update_java_alternatives_17]", "parameters": "--- Exec[update_java_alternatives_17].orig\n+++ Exec[update_java_alternatives_17]\n\n+    command => /usr/sbin/update-java-alternatives -s /usr/lib/jvm/java-1.17.0-openjdk-amd64\n+    unless  => /usr/bin/update-alternatives --query java | /bin/grep 'Value: /usr/lib/jvm/java-17-openjdk-amd64'\n"}, {"resource": "Systemd::Unmask[nginx.service]", "parameters": "--- Systemd::Unmask[nginx.service].orig\n+++ Systemd::Unmask[nginx.service]\n\n+    unit        => nginx.service\n+    refreshonly => True\n"}, {"resource": "Sudo::User[nrpe-check_opensearch_shard_size_check_9400]", "parameters": "--- Sudo::User[nrpe-check_opensearch_shard_size_check_9400].orig\n+++ Sudo::User[nrpe-check_opensearch_shard_size_check_9400]\n\n+    privileges => []\n+    tag        => nrpe::check\n+    user       => nagios\n+    require    => ['Class[Sudo]']\n+    ensure     => absent\n"}, {"resource": "Systemd::Service[nrpe2nodexp-opensearch_unassigned_shard_check_9400]", "parameters": "--- Systemd::Service[nrpe2nodexp-opensearch_unassigned_shard_check_9400].orig\n+++ Systemd::Service[nrpe2nodexp-opensearch_unassigned_shard_check_9400]\n\n+    override                 => False\n+    restart                  => False\n+    require                  => Systemd::Unit[nrpe2nodexp-opensearch_unassigned_shard_check_9400.service]\n+    ensure                   => absent\n+    unit_type                => timer\n+    migration_task           => T407130\n+    monitoring_enabled       => False\n+    monitoring_contact_group => admins\n+    service_params           => {}\n+    monitoring_critical      => False\n"}, {"resource": "File[/lib/systemd/system/nrpe2nodexp-opensearch_shards_9200.timer]", "content": "--- /lib/systemd/system/nrpe2nodexp-opensearch_shards_9200.timer.orig\n+++ /lib/systemd/system/nrpe2nodexp-opensearch_shards_9200.timer\n@@ -0,0 +1,14 @@\n+[Unit]\n+Description=Periodic execution of nrpe2nodexp-opensearch_shards_9200.service\n+\n+[Timer]\n+Unit=nrpe2nodexp-opensearch_shards_9200.service\n+# Accuracy sets the maximum time interval around the execution time we want to allow\n+AccuracySec=15sec\n+OnUnitInactiveSec=1min\n+OnActiveSec=1s\n+RandomizedDelaySec=60\n+FixedRandomDelay=true\n+\n+[Install]\n+WantedBy=multi-user.target", "parameters": "--- File[/lib/systemd/system/nrpe2nodexp-opensearch_shards_9200.timer].orig\n+++ File[/lib/systemd/system/nrpe2nodexp-opensearch_shards_9200.timer]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9200.timer (nrpe2nodexp-opensearch_shards_9200.timer)]\n"}, {"resource": "File[/lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9400.service]", "content": "--- /lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9400.service.orig\n+++ /lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9400.service\n@@ -0,0 +1,11 @@\n+[Unit]\n+Description=execution of nrpe2nodexp for the check_opensearch_shard_size_check_9400 command.\n+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+\n+[Service]\n+Type=oneshot\n+User=nagios\n+\n+Group=prometheus-node-exporter\n+SyslogIdentifier=nrpe2nodexp-opensearch_shard_size_check_9400\n+ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash \"aefe2d8b10db3bc84662052af1e20008\" --timeout 10 --check-command \"check_opensearch_shard_size_check_9400\"", "parameters": "--- File[/lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9400.service].orig\n+++ File[/lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9400.service]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9400.service (nrpe2nodexp-opensearch_shard_size_check_9400.service)]\n"}, {"resource": "File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-shards-9200.conf]", "content": "--- /etc/rsyslog.d/25-nrpe2nodexp-opensearch-shards-9200.conf.orig\n+++ /etc/rsyslog.d/25-nrpe2nodexp-opensearch-shards-9200.conf\n@@ -0,0 +1,10 @@\n+# SPDX-License-Identifier: Apache-2.0\n+if $programname contains \"nrpe2nodexp-opensearch_shards_9200\" then {\n+    if ($msg contains \"\\\"ecs.version\\\": \\\"1.7.0\\\"\") then {\n+        # Send logs to kafka\n+        set $.log_outputs = \"kafka ecs_170 local\";\n+    } else {\n+        # Filter out non-relevant nrpe2nodexp messages\n+        stop\n+    }\n+}", "parameters": "--- File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-shards-9200.conf].orig\n+++ File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-shards-9200.conf]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Service[rsyslog]\n"}, {"resource": "Systemd::Timer[opensearch-disable-readahead-relforge-eqiad]", "parameters": "--- Systemd::Timer[opensearch-disable-readahead-relforge-eqiad].orig\n+++ Systemd::Timer[opensearch-disable-readahead-relforge-eqiad]\n\n+    unit_name          => opensearch-disable-readahead-relforge-eqiad.service\n+    fixed_random_delay => False\n+    splay              => 0\n+    ensure             => present\n+    timer_intervals    => [{'start': 'OnUnitActiveSec', 'interval': '30min'}, {'start': 'OnBootSec', 'interval': '1min'}]\n+    accuracy           => 15sec\n"}, {"resource": "Service[opensearch-disable-readahead.timer]", "parameters": "--- Service[opensearch-disable-readahead.timer].orig\n+++ Service[opensearch-disable-readahead.timer]\n\n+    before   => ['Exec[systemd daemon-reload for opensearch-disable-readahead.timer (opensearch-disable-readahead.timer)]']\n+    provider => systemd\n+    enable   => False\n+    ensure   => stopped\n"}, {"resource": "Systemd::Unit[nrpe2nodexp-opensearch_shard_size_check_9400.service]", "parameters": "--- Systemd::Unit[nrpe2nodexp-opensearch_shard_size_check_9400.service].orig\n+++ Systemd::Unit[nrpe2nodexp-opensearch_shard_size_check_9400.service]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => absent\n+    override_filename => puppet-override.conf\n+    unit              => nrpe2nodexp-opensearch_shard_size_check_9400.service\n"}, {"resource": "Exec[systemd daemon-reload for push_cross_cluster_settings_9200.timer (push_cross_cluster_settings_9200.timer)]", "parameters": "--- Exec[systemd daemon-reload for push_cross_cluster_settings_9200.timer (push_cross_cluster_settings_9200.timer)].orig\n+++ Exec[systemd daemon-reload for push_cross_cluster_settings_9200.timer (push_cross_cluster_settings_9200.timer)]\n\n+    before      => ['Service[push_cross_cluster_settings_9200.timer]']\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Prometheus::Alert::Rule[check_opensearch_unassigned_shard_check_9400_a0a4892478c289e50484ffd2fb4c3202]", "parameters": "--- Prometheus::Alert::Rule[check_opensearch_unassigned_shard_check_9400_a0a4892478c289e50484ffd2fb4c3202].orig\n+++ Prometheus::Alert::Rule[check_opensearch_unassigned_shard_check_9400_a0a4892478c289e50484ffd2fb4c3202]\n\n+    for                => 720m\n+    team               => observability\n+    ensure             => absent\n+    dashboard          => TODO\n+    instance           => ops\n+    runbook            => https://wikitech.wikimedia.org/wiki/Search#Administration\n+    severity           => info\n+    def_label_whitelst => ['team', 'severity']\n+    alert_name         => nrpe_OpenSearch_unassigned_shard_check___9400\n+    site               => eqiad\n+    group              => nrpechecks\n+    summary            => NRPE CHECK: OpenSearch unassigned shard check - 9400\n+    expr               => (nagios_nrpe_check_result{alert_rule_hash=\"a0a4892478c289e50484ffd2fb4c3202\",check_name=\"check_opensearch_unassigned_shard_check_9400\", status=~\"(WARNING|CRITICAL)\", severity=~\"(warning|critical)\"} > 0) * on (instance) group_left (team) role_owner\n+    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_opensearch_unassigned_shard_check_9400))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))\n+    description        => NRPE CHECK: OpenSearch unassigned shard check - 9400\n"}, {"resource": "Monitoring::Exported_nagios_service[relforge1008 opensearch_unassigned_shard_check_9200]", "parameters": "--- Monitoring::Exported_nagios_service[relforge1008 opensearch_unassigned_shard_check_9200].orig\n+++ Monitoring::Exported_nagios_service[relforge1008 opensearch_unassigned_shard_check_9200]\n\n+    check_command          => nrpe_check!check_opensearch_unassigned_shard_check_9200!10\n+    retry_interval         => 120\n+    active_checks_enabled  => 1\n+    contact_groups         => admins,team-discovery\n+    host_name              => relforge1008\n+    check_freshness        => 0\n+    notification_period    => 24x7\n+    servicegroups          => relforge_eqiad\n+    notification_interval  => 0\n+    ensure                 => present\n+    notification_options   => c,r,f\n+    check_interval         => 720\n+    notifications_enabled  => 0\n+    max_check_attempts     => 1\n+    is_volatile            => 0\n+    passive_checks_enabled => 1\n+    check_period           => 24x7\n+    service_description    => OpenSearch unassigned shard check - 9200\n+    notes_url              => https://wikitech.wikimedia.org/wiki/Search#Administration\n"}, {"resource": "Nrpe::Check[check_check_push_cross_cluster_settings_9200_status]", "parameters": "--- Nrpe::Check[check_check_push_cross_cluster_settings_9200_status].orig\n+++ Nrpe::Check[check_check_push_cross_cluster_settings_9200_status]\n\n+    before  => Monitoring::Service[check_push_cross_cluster_settings_9200_status]\n+    command => /usr/local/lib/nagios/plugins/check_systemd_unit_status push_cross_cluster_settings_9200\n+    ensure  => present\n"}, {"resource": "File[/lib/systemd/system/opensearch-relforge-eqiad-gc-log-cleanup.service]", "content": "--- /lib/systemd/system/opensearch-relforge-eqiad-gc-log-cleanup.service.orig\n+++ /lib/systemd/system/opensearch-relforge-eqiad-gc-log-cleanup.service\n@@ -0,0 +1,8 @@\n+[Unit]\n+Description=Cleanup GC logs\n+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+\n+[Service]\n+Type=oneshot\n+User=root\n+ExecStart=/usr/bin/find /var/log/opensearch -name 'relforge-eqiad_jvm_gc.*.log*' -mtime +30 -delete", "parameters": "--- File[/lib/systemd/system/opensearch-relforge-eqiad-gc-log-cleanup.service].orig\n+++ File[/lib/systemd/system/opensearch-relforge-eqiad-gc-log-cleanup.service]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for opensearch-relforge-eqiad-gc-log-cleanup.service (opensearch-relforge-eqiad-gc-log-cleanup.service)]\n"}, {"resource": "Exec[systemd daemon-reload for push_cross_cluster_settings_9400.timer (push_cross_cluster_settings_9400.timer)]", "parameters": "--- Exec[systemd daemon-reload for push_cross_cluster_settings_9400.timer (push_cross_cluster_settings_9400.timer)].orig\n+++ Exec[systemd daemon-reload for push_cross_cluster_settings_9400.timer (push_cross_cluster_settings_9400.timer)]\n\n+    before      => ['Service[push_cross_cluster_settings_9400.timer]']\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "File[/etc/logstash/conf.d/README]", "parameters": "--- File[/etc/logstash/conf.d/README].orig\n+++ File[/etc/logstash/conf.d/README]\n\n+    owner   => logstash\n+    source  => puppet:///modules/logstash/conf.d/README\n+    group   => logstash\n+    require => Package[logstash-oss]\n+    ensure  => present\n"}, {"resource": "File_line[opensearch_bin_bashrc]", "parameters": "--- File_line[opensearch_bin_bashrc].orig\n+++ File_line[opensearch_bin_bashrc]\n\n+    path   => /root/.bashrc\n+    line   => PATH=${PATH}:/usr/share/opensearch/bin  # Managed by puppet\n+    ensure => present\n"}, {"resource": "Systemd::Service[prometheus-elasticsearch-exporter-9400]", "parameters": "--- Systemd::Service[prometheus-elasticsearch-exporter-9400].orig\n+++ Systemd::Service[prometheus-elasticsearch-exporter-9400]\n\n+    override                 => False\n+    restart                  => False\n+    require                  => Package[prometheus-elasticsearch-exporter]\n+    ensure                   => present\n+    unit_type                => service\n+    migration_task           => T407130\n+    monitoring_enabled       => False\n+    monitoring_contact_group => admins\n+    service_params           => {'ensure': 'running'}\n+    monitoring_critical      => False\n"}, {"resource": "Systemd::Unit[opensearch_1@.service]", "parameters": "--- Systemd::Unit[opensearch_1@.service].orig\n+++ Systemd::Unit[opensearch_1@.service]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => present\n+    override_filename => puppet-override.conf\n+    unit              => opensearch_1@.service\n"}, {"resource": "Monitoring::Exported_nagios_service[relforge1008 elasticsearch-https-relforge-eqiad]", "parameters": "--- Monitoring::Exported_nagios_service[relforge1008 elasticsearch-https-relforge-eqiad].orig\n+++ Monitoring::Exported_nagios_service[relforge1008 elasticsearch-https-relforge-eqiad]\n\n+    check_command          => check_ssl_on_port!relforge1008.eqiad.wmnet!9243\n+    retry_interval         => 1\n+    active_checks_enabled  => 1\n+    contact_groups         => team-data-platform,team-discovery\n+    host_name              => relforge1008\n+    check_freshness        => 0\n+    notification_period    => 24x7\n+    servicegroups          => relforge_eqiad\n+    notification_interval  => 0\n+    ensure                 => present\n+    notification_options   => c,r,f\n+    check_interval         => 1\n+    notifications_enabled  => 0\n+    max_check_attempts     => 3\n+    is_volatile            => 0\n+    passive_checks_enabled => 1\n+    check_period           => 24x7\n+    service_description    => Elasticsearch HTTPS for relforge-eqiad\n+    notes_url              => https://wikitech.wikimedia.org/wiki/Search\n"}, {"resource": "Rsyslog::Conf[push_cross_cluster_settings_9400]", "parameters": "--- Rsyslog::Conf[push_cross_cluster_settings_9400].orig\n+++ Rsyslog::Conf[push_cross_cluster_settings_9400]\n\n+    mode     => 0444\n+    priority => 40\n+    require  => File[/var/log/push_cross_cluster_settings_9400]\n+    ensure   => present\n"}, {"resource": "Exec[tlsproxy localssl default_server on ports [9443]]", "parameters": "--- Exec[tlsproxy localssl default_server on ports [9443]].orig\n+++ Exec[tlsproxy localssl default_server on ports [9443]]\n\n+    command     => /bin/true\n+    onlyif      => /bin/false\n+    refreshonly => True\n"}, {"resource": "File[/etc/rsyslog.d/40-opensearch-relforge-eqiad-gc-log-cleanup.conf]", "content": "--- /etc/rsyslog.d/40-opensearch-relforge-eqiad-gc-log-cleanup.conf.orig\n+++ /etc/rsyslog.d/40-opensearch-relforge-eqiad-gc-log-cleanup.conf\n@@ -0,0 +1,10 @@\n+# rsyslog.conf(5) configuration file for services.\n+# This file is managed by Puppet.\n+if $programname startswith \"opensearch-relforge-eqiad-gc-log-cleanup\" then {\n+    action(\n+        type=\"omfile\" file=\"/var/log/opensearch-relforge-eqiad-gc-log-cleanup/syslog.log\"\n+        fileOwner=\"root\" fileGroup=\"root\"\n+        fileCreateMode=\"0644\"\n+    )\n+    & stop\n+}", "parameters": "--- File[/etc/rsyslog.d/40-opensearch-relforge-eqiad-gc-log-cleanup.conf].orig\n+++ File[/etc/rsyslog.d/40-opensearch-relforge-eqiad-gc-log-cleanup.conf]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Service[rsyslog]\n"}, {"resource": "Systemd::Unit[opensearch-disable-readahead-relforge-eqiad-small-alpha.service]", "parameters": "--- Systemd::Unit[opensearch-disable-readahead-relforge-eqiad-small-alpha.service].orig\n+++ Systemd::Unit[opensearch-disable-readahead-relforge-eqiad-small-alpha.service]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => present\n+    override_filename => puppet-override.conf\n+    unit              => opensearch-disable-readahead-relforge-eqiad-small-alpha.service\n"}, {"resource": "File[/etc/sudoers.d/nrpe-check_opensearch_shards_9200]", "parameters": "--- File[/etc/sudoers.d/nrpe-check_opensearch_shards_9200].orig\n+++ File[/etc/sudoers.d/nrpe-check_opensearch_shards_9200]\n\n+    owner   => root\n+    require => Package[nagios-nrpe-server]\n+    group   => root\n+    ensure  => absent\n"}, {"resource": "Service[opensearch-disable-readahead-relforge-eqiad.timer]", "parameters": "--- Service[opensearch-disable-readahead-relforge-eqiad.timer].orig\n+++ Service[opensearch-disable-readahead-relforge-eqiad.timer]\n\n+    ensure   => running\n+    provider => systemd\n+    enable   => True\n"}, {"resource": "File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.pem]", "parameters": "--- File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.pem].orig\n+++ File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.pem]\n\n+    owner  => root\n+    group  => root\n+    ensure => file\n+    mode   => 0440\n+    notify => ['Exec[nginx-reload]', 'Exec[nginx-reload]']\n"}, {"resource": "Monitoring::Service[opensearch_unassigned_shard_check_9400]", "parameters": "--- Monitoring::Service[opensearch_unassigned_shard_check_9400].orig\n+++ Monitoring::Service[opensearch_unassigned_shard_check_9400]\n\n+    check_command  => nrpe_check!check_opensearch_unassigned_shard_check_9400!10\n+    retry_interval => 120\n+    freshness      => 36000\n+    ensure         => present\n+    check_interval => 720\n+    config_dir     => /etc/nagios\n+    migration_task => T371083\n+    contact_group  => admins,team-discovery\n+    host           => relforge1008\n+    critical       => False\n+    retries        => 1\n+    passive        => False\n+    description    => OpenSearch unassigned shard check - 9400\n+    notes_url      => https://wikitech.wikimedia.org/wiki/Search#Administration\n"}, {"resource": "Logrotate::Conf[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]", "parameters": "--- Logrotate::Conf[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400].orig\n+++ Logrotate::Conf[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]\n\n+    ensure => present\n"}, {"resource": "File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-unassigned-shard-check-9400.conf]", "content": "--- /etc/rsyslog.d/25-nrpe2nodexp-opensearch-unassigned-shard-check-9400.conf.orig\n+++ /etc/rsyslog.d/25-nrpe2nodexp-opensearch-unassigned-shard-check-9400.conf\n@@ -0,0 +1,10 @@\n+# SPDX-License-Identifier: Apache-2.0\n+if $programname contains \"nrpe2nodexp-opensearch_unassigned_shard_check_9400\" then {\n+    if ($msg contains \"\\\"ecs.version\\\": \\\"1.7.0\\\"\") then {\n+        # Send logs to kafka\n+        set $.log_outputs = \"kafka ecs_170 local\";\n+    } else {\n+        # Filter out non-relevant nrpe2nodexp messages\n+        stop\n+    }\n+}", "parameters": "--- File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-unassigned-shard-check-9400.conf].orig\n+++ File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-unassigned-shard-check-9400.conf]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Service[rsyslog]\n"}, {"resource": "Systemd::Syslog[clean_up_dlq]", "parameters": "--- Systemd::Syslog[clean_up_dlq].orig\n+++ Systemd::Syslog[clean_up_dlq]\n\n+    readable_by            => all\n+    force_stop             => True\n+    ensure                 => absent\n+    programname_comparison => startswith\n+    log_filename           => syslog.log\n+    owner                  => root\n+    group                  => root\n+    base_dir               => /var/log\n"}, {"resource": "File[/etc/logstash/logstash.yml]", "content": "--- /etc/logstash/logstash.yml.orig\n+++ /etc/logstash/logstash.yml\n@@ -0,0 +1,11 @@\n+---\n+path.data: \"/var/lib/logstash\"\n+path.config: \"/etc/logstash/conf.d\"\n+path.logs: \"/var/log/logstash\"\n+pipeline.workers: 2\n+pipeline.batch.size: 125\n+pipeline.batch.delay: 50\n+log.format: json\n+dead_letter_queue.enable: false\n+dead_letter_queue.max_bytes: 1024mb\n+http.port: '9675'", "parameters": "--- File[/etc/logstash/logstash.yml].orig\n+++ File[/etc/logstash/logstash.yml]\n\n+    owner   => root\n+    group   => root\n+    require => Package[logstash-oss]\n+    mode    => 0444\n+    notify  => Service[logstash]\n"}, {"resource": "File[/var/lib/prometheus/node.d/check_opensearch_shard_size_check_9400.prom]", "parameters": "--- File[/var/lib/prometheus/node.d/check_opensearch_shard_size_check_9400.prom].orig\n+++ File[/var/lib/prometheus/node.d/check_opensearch_shard_size_check_9400.prom]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n"}, {"resource": "Concat_file[/etc/apt/sources.list.d/wikimedia-opensearch.sources]", "parameters": "--- Concat_file[/etc/apt/sources.list.d/wikimedia-opensearch.sources].orig\n+++ Concat_file[/etc/apt/sources.list.d/wikimedia-opensearch.sources]\n\n+    tag            => _etc_apt_sources.list.d_wikimedia-opensearch.sources\n+    format         => plain\n+    force          => False\n+    show_diff      => True\n+    ensure_newline => False\n+    order          => alpha\n+    owner          => root\n+    group          => root\n+    mode           => 0444\n+    backup         => puppet\n+    replace        => True\n"}, {"resource": "Systemd::Service[nrpe2nodexp-check_push_cross_cluster_settings_9200_status]", "parameters": "--- Systemd::Service[nrpe2nodexp-check_push_cross_cluster_settings_9200_status].orig\n+++ Systemd::Service[nrpe2nodexp-check_push_cross_cluster_settings_9200_status]\n\n+    override                 => False\n+    restart                  => False\n+    require                  => Systemd::Unit[nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service]\n+    ensure                   => absent\n+    unit_type                => timer\n+    migration_task           => T407130\n+    monitoring_enabled       => False\n+    monitoring_contact_group => admins\n+    service_params           => {}\n+    monitoring_critical      => False\n"}, {"resource": "File[/lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9200.service]", "content": "--- /lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9200.service.orig\n+++ /lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9200.service\n@@ -0,0 +1,11 @@\n+[Unit]\n+Description=execution of nrpe2nodexp for the check_opensearch_unassigned_shard_check_9200 command.\n+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+\n+[Service]\n+Type=oneshot\n+User=nagios\n+\n+Group=prometheus-node-exporter\n+SyslogIdentifier=nrpe2nodexp-opensearch_unassigned_shard_check_9200\n+ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash \"54ca99505516d5452912b573aa7d35d3\" --timeout 10 --check-command \"check_opensearch_unassigned_shard_check_9200\"", "parameters": "--- File[/lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9200.service].orig\n+++ File[/lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9200.service]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9200.service (nrpe2nodexp-opensearch_unassigned_shard_check_9200.service)]\n"}, {"resource": "File[/var/log/opensearch-disable-readahead]", "parameters": "--- File[/var/log/opensearch-disable-readahead].orig\n+++ File[/var/log/opensearch-disable-readahead]\n\n+    owner  => root\n+    group  => root\n+    force  => True\n+    ensure => absent\n+    mode   => 0755\n+    backup => False\n"}, {"resource": "Tlsproxy::Localssl[relforge-eqiad-small-alpha]", "parameters": "--- Tlsproxy::Localssl[relforge-eqiad-small-alpha].orig\n+++ Tlsproxy::Localssl[relforge-eqiad-small-alpha]\n\n+    keepalive_timeout  => 60\n+    default_server     => True\n+    require            => ['Class[Profile::Tlsproxy::Instance]']\n+    keepalive_requests => 100\n+    cfssl_paths        => {'cert': '/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.pem', 'key': '/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet-key.pem', 'chain': '/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chain.pem', 'chained': '/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chained.pem'}\n+    skip_private       => False\n+    access_log         => False\n+    read_timeout       => 180\n+    only_get_requests  => False\n+    acme_chief         => False\n+    server_name        => relforge1008.eqiad.wmnet\n+    acme_certname      => relforge-eqiad-small-alpha\n+    enable_http2       => False\n+    server_aliases     => ['relforge.svc.eqiad.wmnet']\n+    tls_ports          => [9443]\n+    upstream_ports     => [9400]\n+    upstream_ip        => 10.64.32.100\n"}, {"resource": "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service (wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service)]", "parameters": "--- Exec[systemd daemon-reload for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service (wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service)].orig\n+++ Exec[systemd daemon-reload for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service (wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Exec[systemd daemon-reload for opensearch-relforge-eqiad-gc-log-cleanup.timer (opensearch-relforge-eqiad-gc-log-cleanup.timer)]", "parameters": "--- Exec[systemd daemon-reload for opensearch-relforge-eqiad-gc-log-cleanup.timer (opensearch-relforge-eqiad-gc-log-cleanup.timer)].orig\n+++ Exec[systemd daemon-reload for opensearch-relforge-eqiad-gc-log-cleanup.timer (opensearch-relforge-eqiad-gc-log-cleanup.timer)]\n\n+    before      => ['Service[opensearch-relforge-eqiad-gc-log-cleanup.timer]']\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Prometheus::Elasticsearch_exporter[localhost:9200]", "parameters": "--- Prometheus::Elasticsearch_exporter[localhost:9200].orig\n+++ Prometheus::Elasticsearch_exporter[localhost:9200]\n\n+    extra_config       => \n+    prometheus_port    => 9108\n+    elasticsearch_port => 9200\n"}, {"resource": "File_line[auto_restart_file_presence_prometheus-elasticsearch-exporter-9200]", "parameters": "--- File_line[auto_restart_file_presence_prometheus-elasticsearch-exporter-9200].orig\n+++ File_line[auto_restart_file_presence_prometheus-elasticsearch-exporter-9200]\n\n+    path    => /etc/debdeploy-client/autorestarts.conf\n+    require => File[/etc/debdeploy-client/autorestarts.conf]\n+    line    => prometheus-elasticsearch-exporter-9200\n+    ensure  => present\n"}, {"resource": "Monitoring::Service[opensearch_unassigned_shard_check_9200]", "parameters": "--- Monitoring::Service[opensearch_unassigned_shard_check_9200].orig\n+++ Monitoring::Service[opensearch_unassigned_shard_check_9200]\n\n+    check_command  => nrpe_check!check_opensearch_unassigned_shard_check_9200!10\n+    retry_interval => 120\n+    freshness      => 36000\n+    ensure         => present\n+    check_interval => 720\n+    config_dir     => /etc/nagios\n+    migration_task => T371083\n+    contact_group  => admins,team-discovery\n+    host           => relforge1008\n+    critical       => False\n+    retries        => 1\n+    passive        => False\n+    description    => OpenSearch unassigned shard check - 9200\n+    notes_url      => https://wikitech.wikimedia.org/wiki/Search#Administration\n"}, {"resource": "Package[openjdk-17-jdk]", "parameters": "--- Package[openjdk-17-jdk].orig\n+++ Package[openjdk-17-jdk]\n\n+    provider => apt\n+    ensure   => installed\n"}, {"resource": "Nrpe::Monitor_service[opensearch_shards_9400]", "parameters": "--- Nrpe::Monitor_service[opensearch_shards_9400].orig\n+++ Nrpe::Monitor_service[opensearch_shards_9400]\n\n+    retry_interval              => 1\n+    ensure                      => present\n+    check_interval              => 1\n+    migration_task              => T371083\n+    contact_group               => admins,team-discovery\n+    nrpe_command                => /usr/lib/nagios/plugins/check_elasticsearch.py --ignore-status --url http://localhost:9400 --shards-inactive '>=0.15' --timeout 4\n+    enable_nrpe2nodexp          => False\n+    critical                    => False\n+    alertmanager_team           => observability\n+    retries                     => 3\n+    nrpe2nodexp_parse_perf_data => False\n+    enable_icinga_check         => True\n+    timeout                     => 10\n+    description                 => OpenSearch health check for shards on 9400\n+    notes_url                   => https://wikitech.wikimedia.org/wiki/Search#Administration\n"}, {"resource": "Monitoring::Service[elasticsearch-https-relforge-eqiad-small-alpha]", "parameters": "--- Monitoring::Service[elasticsearch-https-relforge-eqiad-small-alpha].orig\n+++ Monitoring::Service[elasticsearch-https-relforge-eqiad-small-alpha]\n\n+    check_command  => check_ssl_on_port!relforge1008.eqiad.wmnet!9443\n+    retry_interval => 1\n+    freshness      => 36000\n+    ensure         => present\n+    check_interval => 1\n+    config_dir     => /etc/nagios\n+    migration_task => T384998\n+    host           => relforge1008\n+    critical       => False\n+    retries        => 3\n+    passive        => False\n+    description    => Elasticsearch HTTPS for relforge-eqiad-small-alpha\n+    notes_url      => https://wikitech.wikimedia.org/wiki/Search\n"}, {"resource": "Monitoring::Exported_nagios_service[relforge1008 opensearch_shard_size_check_9200]", "parameters": "--- Monitoring::Exported_nagios_service[relforge1008 opensearch_shard_size_check_9200].orig\n+++ Monitoring::Exported_nagios_service[relforge1008 opensearch_shard_size_check_9200]\n\n+    check_command          => nrpe_check!check_opensearch_shard_size_check_9200!10\n+    retry_interval         => 180\n+    active_checks_enabled  => 1\n+    contact_groups         => admins,team-discovery\n+    host_name              => relforge1008\n+    check_freshness        => 0\n+    notification_period    => 24x7\n+    servicegroups          => relforge_eqiad\n+    notification_interval  => 0\n+    ensure                 => present\n+    notification_options   => c,r,f\n+    check_interval         => 1440\n+    notifications_enabled  => 0\n+    max_check_attempts     => 3\n+    is_volatile            => 0\n+    passive_checks_enabled => 1\n+    check_period           => 24x7\n+    service_description    => OpenSearch shard size check - 9200\n+    notes_url              => https://wikitech.wikimedia.org/wiki/Search#If_it_has_been_indexed\n"}, {"resource": "Systemd::Service[nrpe2nodexp-check_push_cross_cluster_settings_9400_status]", "parameters": "--- Systemd::Service[nrpe2nodexp-check_push_cross_cluster_settings_9400_status].orig\n+++ Systemd::Service[nrpe2nodexp-check_push_cross_cluster_settings_9400_status]\n\n+    override                 => False\n+    restart                  => False\n+    require                  => Systemd::Unit[nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service]\n+    ensure                   => absent\n+    unit_type                => timer\n+    migration_task           => T407130\n+    monitoring_enabled       => False\n+    monitoring_contact_group => admins\n+    service_params           => {}\n+    monitoring_critical      => False\n"}, {"resource": "File[/etc/opensearch/relforge-eqiad-small-alpha]", "parameters": "--- File[/etc/opensearch/relforge-eqiad-small-alpha].orig\n+++ File[/etc/opensearch/relforge-eqiad-small-alpha]\n\n+    owner  => root\n+    mode   => 0755\n+    group  => root\n+    ensure => directory\n"}, {"resource": "Systemd::Timer[wmf_auto_restart_prometheus-elasticsearch-exporter-9400]", "parameters": "--- Systemd::Timer[wmf_auto_restart_prometheus-elasticsearch-exporter-9400].orig\n+++ Systemd::Timer[wmf_auto_restart_prometheus-elasticsearch-exporter-9400]\n\n+    unit_name          => wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service\n+    fixed_random_delay => False\n+    splay              => 0\n+    ensure             => present\n+    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 14:27:00'}]\n+    accuracy           => 15sec\n"}, {"resource": "Prometheus::Wmf_elasticsearch_exporter[relforge1008:9200]", "parameters": "--- Prometheus::Wmf_elasticsearch_exporter[relforge1008:9200].orig\n+++ Prometheus::Wmf_elasticsearch_exporter[relforge1008:9200]\n\n+    prometheus_port    => 9120\n+    indices_to_monitor => []\n+    elasticsearch_port => 9200\n"}, {"resource": "Concat_fragment[main contacts]", "content": "--- main contacts.orig\n+++ main contacts\n@@ -1,3 +1,3 @@\n ---\n-role::cirrus::test:\n+role::cirrus::relforge:\n - Search Platform"}, {"resource": "File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.csr]", "parameters": "--- File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.csr].orig\n+++ File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.csr]\n\n+    owner  => root\n+    mode   => 0440\n+    group  => root\n+    ensure => file\n"}, {"resource": "Systemd::Unit[opensearch-hot-threads-log.timer]", "parameters": "--- Systemd::Unit[opensearch-hot-threads-log.timer].orig\n+++ Systemd::Unit[opensearch-hot-threads-log.timer]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => present\n+    override_filename => puppet-override.conf\n+    unit              => opensearch-hot-threads-log.timer\n"}, {"resource": "File[/lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service]", "content": "--- /lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service.orig\n+++ /lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service\n@@ -0,0 +1,8 @@\n+[Unit]\n+Description=Auto restart job: prometheus-elasticsearch-exporter-9400\n+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+\n+[Service]\n+Type=oneshot\n+User=root\n+ExecStart=/usr/local/sbin/wmf-auto-restart -s prometheus-elasticsearch-exporter-9400", "parameters": "--- File[/lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service].orig\n+++ File[/lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service (wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service)]\n"}, {"resource": "Prometheus::Alert::Rule[check_check_push_cross_cluster_settings_9400_status_de4a199c43946c09f819ca4ffea40ac0]", "parameters": "--- Prometheus::Alert::Rule[check_check_push_cross_cluster_settings_9400_status_de4a199c43946c09f819ca4ffea40ac0].orig\n+++ Prometheus::Alert::Rule[check_check_push_cross_cluster_settings_9400_status_de4a199c43946c09f819ca4ffea40ac0]\n\n+    for                => 11m\n+    team               => observability\n+    ensure             => absent\n+    dashboard          => TODO\n+    instance           => ops\n+    runbook            => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+    severity           => info\n+    def_label_whitelst => ['team', 'severity']\n+    alert_name         => nrpe_Check_unit_status_of_push_cross_cluster_settings_9400\n+    site               => eqiad\n+    group              => nrpechecks\n+    summary            => NRPE CHECK: Check unit status of push_cross_cluster_settings_9400\n+    expr               => (nagios_nrpe_check_result{alert_rule_hash=\"de4a199c43946c09f819ca4ffea40ac0\",check_name=\"check_check_push_cross_cluster_settings_9400_status\", status=~\"(WARNING|CRITICAL)\", severity=~\"(warning|critical)\"} > 0) * on (instance) group_left (team) role_owner\n+    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_push_cross_cluster_settings_9400_status))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))\n+    description        => NRPE CHECK: Check unit status of push_cross_cluster_settings_9400\n"}, {"resource": "File[/etc/sudoers.d/nrpe-check_check_push_cross_cluster_settings_9200_status]", "parameters": "--- File[/etc/sudoers.d/nrpe-check_check_push_cross_cluster_settings_9200_status].orig\n+++ File[/etc/sudoers.d/nrpe-check_check_push_cross_cluster_settings_9200_status]\n\n+    owner   => root\n+    require => Package[nagios-nrpe-server]\n+    group   => root\n+    ensure  => absent\n"}, {"resource": "Service[push_cross_cluster_settings_9400.timer]", "parameters": "--- Service[push_cross_cluster_settings_9400.timer].orig\n+++ Service[push_cross_cluster_settings_9400.timer]\n\n+    ensure   => running\n+    provider => systemd\n+    enable   => True\n"}, {"resource": "Package[nginx-light]", "parameters": "--- Package[nginx-light].orig\n+++ Package[nginx-light]\n\n+    provider => apt\n+    notify   => ['Systemd::Unmask[nginx.service]']\n+    ensure   => installed\n"}, {"resource": "Systemd::Timer[opensearch-disable-readahead]", "parameters": "--- Systemd::Timer[opensearch-disable-readahead].orig\n+++ Systemd::Timer[opensearch-disable-readahead]\n\n+    unit_name          => opensearch-disable-readahead.service\n+    fixed_random_delay => False\n+    splay              => 0\n+    ensure             => absent\n+    timer_intervals    => [{'start': 'OnUnitActiveSec', 'interval': '30min'}, {'start': 'OnBootSec', 'interval': '1min'}]\n+    accuracy           => 15sec\n"}, {"resource": "File[/etc/opensearch/relforge-eqiad/logging.yml]", "parameters": "--- File[/etc/opensearch/relforge-eqiad/logging.yml].orig\n+++ File[/etc/opensearch/relforge-eqiad/logging.yml]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n"}, {"resource": "File[/etc/nginx/sites-available]", "parameters": "--- File[/etc/nginx/sites-available].orig\n+++ File[/etc/nginx/sites-available]\n\n+    before  => ['Service[nginx]']\n+    owner   => root\n+    group   => root\n+    recurse => True\n+    force   => True\n+    ensure  => directory\n+    purge   => True\n"}, {"resource": "File[/usr/lib/nagios/plugins/check_elasticsearch_unassigned_shards.py]", "parameters": "--- File[/usr/lib/nagios/plugins/check_elasticsearch_unassigned_shards.py].orig\n+++ File[/usr/lib/nagios/plugins/check_elasticsearch_unassigned_shards.py]\n\n+    owner  => root\n+    mode   => 0755\n+    group  => root\n+    source => puppet:///modules/icinga/elasticsearch/check_elasticsearch_unassigned_shards.py\n"}, {"resource": "Systemd::Unit[prometheus-elasticsearch-exporter-9400]", "parameters": "--- Systemd::Unit[prometheus-elasticsearch-exporter-9400].orig\n+++ Systemd::Unit[prometheus-elasticsearch-exporter-9400]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => present\n+    override_filename => puppet-override.conf\n+    unit              => prometheus-elasticsearch-exporter-9400\n"}, {"resource": "Logrotate::Conf[push_cross_cluster_settings_9400]", "parameters": "--- Logrotate::Conf[push_cross_cluster_settings_9400].orig\n+++ Logrotate::Conf[push_cross_cluster_settings_9400]\n\n+    ensure => present\n"}, {"resource": "Exec[systemd daemon-reload for prometheus-elasticsearch-exporter-9200.service (prometheus-elasticsearch-exporter-9200)]", "parameters": "--- Exec[systemd daemon-reload for prometheus-elasticsearch-exporter-9200.service (prometheus-elasticsearch-exporter-9200)].orig\n+++ Exec[systemd daemon-reload for prometheus-elasticsearch-exporter-9200.service (prometheus-elasticsearch-exporter-9200)]\n\n+    before      => ['Service[prometheus-elasticsearch-exporter-9200]']\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Prometheus::Alert::Rule[check_opensearch_shards_9200_fd6eadf747c645a72e11bd74109a8156]", "parameters": "--- Prometheus::Alert::Rule[check_opensearch_shards_9200_fd6eadf747c645a72e11bd74109a8156].orig\n+++ Prometheus::Alert::Rule[check_opensearch_shards_9200_fd6eadf747c645a72e11bd74109a8156]\n\n+    for                => 3m\n+    team               => observability\n+    ensure             => absent\n+    dashboard          => TODO\n+    instance           => ops\n+    runbook            => https://wikitech.wikimedia.org/wiki/Search#Administration\n+    severity           => info\n+    def_label_whitelst => ['team', 'severity']\n+    alert_name         => nrpe_OpenSearch_health_check_for_shards_on_9200\n+    site               => eqiad\n+    group              => nrpechecks\n+    summary            => NRPE CHECK: OpenSearch health check for shards on 9200\n+    expr               => (nagios_nrpe_check_result{alert_rule_hash=\"fd6eadf747c645a72e11bd74109a8156\",check_name=\"check_opensearch_shards_9200\", status=~\"(WARNING|CRITICAL)\", severity=~\"(warning|critical)\"} > 0) * on (instance) group_left (team) role_owner\n+    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_opensearch_shards_9200))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))\n+    description        => NRPE CHECK: OpenSearch health check for shards on 9200\n"}, {"resource": "Systemd::Timer[nrpe2nodexp-opensearch_shard_size_check_9400]", "parameters": "--- Systemd::Timer[nrpe2nodexp-opensearch_shard_size_check_9400].orig\n+++ Systemd::Timer[nrpe2nodexp-opensearch_shard_size_check_9400]\n\n+    unit_name          => nrpe2nodexp-opensearch_shard_size_check_9400.service\n+    fixed_random_delay => True\n+    splay              => 36000\n+    ensure             => absent\n+    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '600min'}, {'interval': '1s', 'start': 'OnActiveSec'}]\n+    accuracy           => 15sec\n"}, {"resource": "Systemd::Unit[opensearch-disable-readahead-relforge-eqiad.service]", "parameters": "--- Systemd::Unit[opensearch-disable-readahead-relforge-eqiad.service].orig\n+++ Systemd::Unit[opensearch-disable-readahead-relforge-eqiad.service]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => present\n+    override_filename => puppet-override.conf\n+    unit              => opensearch-disable-readahead-relforge-eqiad.service\n"}, {"resource": "File[/etc/sudoers.d/nrpe-check_opensearch_shard_size_check_9200]", "parameters": "--- File[/etc/sudoers.d/nrpe-check_opensearch_shard_size_check_9200].orig\n+++ File[/etc/sudoers.d/nrpe-check_opensearch_shard_size_check_9200]\n\n+    owner   => root\n+    require => Package[nagios-nrpe-server]\n+    group   => root\n+    ensure  => absent\n"}, {"resource": "Systemd::Unit[nrpe2nodexp-opensearch_shards_9400.service]", "parameters": "--- Systemd::Unit[nrpe2nodexp-opensearch_shards_9400.service].orig\n+++ Systemd::Unit[nrpe2nodexp-opensearch_shards_9400.service]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => absent\n+    override_filename => puppet-override.conf\n+    unit              => nrpe2nodexp-opensearch_shards_9400.service\n"}, {"resource": "Class[Java]", "parameters": "--- Class[Java].orig\n+++ Class[Java]\n\n+    before        => ['Java::Cacert[wmf:puppetca.pem]', 'Java::Cacert[wmf:Wikimedia_Internal_Root_CA]', 'Java::Cacert[wmf:puppetca.pem]', 'Java::Cacert[wmf:Wikimedia_Internal_Root_CA]']\n+    enable_dbg    => False\n+    hardened_tls  => False\n+    require       => Package[wmf-certificates]\n+    egd_source    => /dev/random\n+    java_packages => [{'version': '17', 'variant': 'jdk'}]\n"}, {"resource": "Nrpe::Check[check_opensearch_shard_size_check_9200]", "parameters": "--- Nrpe::Check[check_opensearch_shard_size_check_9200].orig\n+++ Nrpe::Check[check_opensearch_shard_size_check_9200]\n\n+    before  => Monitoring::Service[opensearch_shard_size_check_9200]\n+    command => /usr/lib/nagios/plugins/check_elasticsearch_shard_size.py --url http://localhost:9200 --shard-size-warning 110 --shard-size-critical 140 --timeout 4\n+    ensure  => present\n"}, {"resource": "File[/etc/logstash/jvm.options]", "content": "--- /etc/logstash/jvm.options.orig\n+++ /etc/logstash/jvm.options\n@@ -0,0 +1,91 @@\n+#####################################################################\n+## THSI FILE IS MANAGED BY PUPPET\n+## puppet://modules/logstash/jvm.options.erb\n+#####################################################################\n+\n+## JVM configuration\n+\n+# Xms represents the initial size of total heap space\n+# Xmx represents the maximum size of total heap space\n+\n+-Xms192m\n+-Xmx192m\n+\n+################################################################\n+## Expert settings\n+################################################################\n+##\n+## All settings below this section are considered\n+## expert settings. Don't tamper with them unless\n+## you understand what you are doing\n+##\n+################################################################\n+\n+## GC configuration\n+\n+## optimizations\n+\n+# disable calls to System#gc\n+-XX:+DisableExplicitGC\n+\n+## locale\n+# Set the locale language\n+#-Duser.language=en\n+\n+# Set the locale country\n+#-Duser.country=US\n+\n+# Set the locale variant, if any\n+#-Duser.variant=\n+\n+## basic\n+\n+# set the I/O temp directory\n+#-Djava.io.tmpdir=$HOME\n+\n+# set to headless, just in case\n+-Djava.awt.headless=true\n+\n+# ensure UTF-8 encoding by default (e.g. filenames)\n+-Dfile.encoding=UTF-8\n+\n+# use our provided JNA always versus the system one\n+#-Djna.nosys=true\n+\n+# log4j2\n+-Dlog4j2.formatMsgNoLookups=true\n+\n+## heap dumps\n+\n+# generate a heap dump when an allocation from the Java heap fails\n+# heap dumps are created in the working directory of the JVM\n+-XX:+HeapDumpOnOutOfMemoryError\n+\n+# specify an alternative path for heap dumps\n+# ensure the directory exists and has sufficient space\n+#-XX:HeapDumpPath=${LOGSTASH_HOME}/heapdump.hprof\n+\n+## GC logging\n+#-XX:+PrintGCDetails\n+#-XX:+PrintGCTimeStamps\n+#-XX:+PrintGCDateStamps\n+#-XX:+PrintClassHistogram\n+#-XX:+PrintTenuringDistribution\n+#-XX:+PrintGCApplicationStoppedTime\n+\n+# log GC status to a file with time stamps\n+# ensure the directory exists\n+#-Xloggc:${LS_GC_LOG_FILE}\n+\n+# Entropy source for randomness\n+-Djava.security.egd=file:/dev/urandom\n+\n+# Copy the logging context from parent threads to children\n+-Dlog4j2.isThreadContextMapInheritable=true\n+\n+--add-opens java.base/sun.nio.ch=ALL-UNNAMED\n+--add-opens java.base/java.io=ALL-UNNAMED\n+\n+# Custom flags for GC logging.\n+-Xlog:gc*:file=/var/log/logstash/logstash_jvm_gc.%p.log::filecount=10,filesize=20000\n+-Xlog:gc+age=trace", "parameters": "--- File[/etc/logstash/jvm.options].orig\n+++ File[/etc/logstash/jvm.options]\n\n+    owner   => root\n+    group   => root\n+    require => Package[logstash-oss]\n+    mode    => 0444\n+    notify  => Service[logstash]\n"}, {"resource": "File[/etc/opensearch/relforge-eqiad]", "parameters": "--- File[/etc/opensearch/relforge-eqiad].orig\n+++ File[/etc/opensearch/relforge-eqiad]\n\n+    owner  => root\n+    mode   => 0755\n+    group  => root\n+    ensure => directory\n"}, {"resource": "Systemd::Unit[nrpe2nodexp-opensearch_shards_9200.service]", "parameters": "--- Systemd::Unit[nrpe2nodexp-opensearch_shards_9200.service].orig\n+++ Systemd::Unit[nrpe2nodexp-opensearch_shards_9200.service]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => absent\n+    override_filename => puppet-override.conf\n+    unit              => nrpe2nodexp-opensearch_shards_9200.service\n"}, {"resource": "File[/var/log/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]", "parameters": "--- File[/var/log/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400].orig\n+++ File[/var/log/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]\n\n+    owner  => root\n+    group  => root\n+    force  => True\n+    ensure => directory\n+    mode   => 0755\n+    backup => False\n"}, {"resource": "Nrpe::Monitor_service[check_push_cross_cluster_settings_9400_status]", "parameters": "--- Nrpe::Monitor_service[check_push_cross_cluster_settings_9400_status].orig\n+++ Nrpe::Monitor_service[check_push_cross_cluster_settings_9400_status]\n\n+    retry_interval              => 1\n+    check_interval              => 10\n+    ensure                      => present\n+    migration_task              => T407130\n+    nrpe_command                => /usr/local/lib/nagios/plugins/check_systemd_unit_status push_cross_cluster_settings_9400\n+    contact_group               => admins\n+    enable_nrpe2nodexp          => False\n+    critical                    => False\n+    alertmanager_team           => observability\n+    retries                     => 2\n+    nrpe2nodexp_parse_perf_data => False\n+    enable_icinga_check         => True\n+    timeout                     => 10\n+    description                 => Check unit status of push_cross_cluster_settings_9400\n+    notes_url                   => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n"}, {"resource": "File[/etc/logrotate.d/opensearch-disable-readahead]", "content": "--- /etc/logrotate.d/opensearch-disable-readahead.orig\n+++ /etc/logrotate.d/opensearch-disable-readahead\n@@ -0,0 +1,12 @@\n+# logrotate(8) config for opensearch-disable-readahead\n+\n+/var/log/opensearch-disable-readahead/*.log {\n+    daily\n+    copytruncate\n+    missingok\n+    compress\n+    delaycompress\n+    notifempty\n+    rotate 15\n+    size 256M\n+}", "parameters": "--- File[/etc/logrotate.d/opensearch-disable-readahead].orig\n+++ File[/etc/logrotate.d/opensearch-disable-readahead]\n\n+    owner  => root\n+    mode   => 0444\n+    group  => root\n+    ensure => absent\n"}, {"resource": "Systemd::Service[clean_up_dlq]", "parameters": "--- Systemd::Service[clean_up_dlq].orig\n+++ Systemd::Service[clean_up_dlq]\n\n+    override                 => False\n+    restart                  => False\n+    require                  => Systemd::Unit[clean_up_dlq.service]\n+    ensure                   => absent\n+    unit_type                => timer\n+    migration_task           => T407130\n+    monitoring_enabled       => False\n+    monitoring_contact_group => admins\n+    service_params           => {}\n+    monitoring_critical      => False\n"}, {"resource": "File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-shards-9400.conf]", "content": "--- /etc/rsyslog.d/25-nrpe2nodexp-opensearch-shards-9400.conf.orig\n+++ /etc/rsyslog.d/25-nrpe2nodexp-opensearch-shards-9400.conf\n@@ -0,0 +1,10 @@\n+# SPDX-License-Identifier: Apache-2.0\n+if $programname contains \"nrpe2nodexp-opensearch_shards_9400\" then {\n+    if ($msg contains \"\\\"ecs.version\\\": \\\"1.7.0\\\"\") then {\n+        # Send logs to kafka\n+        set $.log_outputs = \"kafka ecs_170 local\";\n+    } else {\n+        # Filter out non-relevant nrpe2nodexp messages\n+        stop\n+    }\n+}", "parameters": "--- File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-shards-9400.conf].orig\n+++ File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-shards-9400.conf]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Service[rsyslog]\n"}, {"resource": "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9200.timer (nrpe2nodexp-opensearch_shard_size_check_9200.timer)]", "parameters": "--- Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9200.timer (nrpe2nodexp-opensearch_shard_size_check_9200.timer)].orig\n+++ Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9200.timer (nrpe2nodexp-opensearch_shard_size_check_9200.timer)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "File[/etc/logrotate.d/wmf_auto_restart_prometheus-elasticsearch-exporter-9400]", "content": "--- /etc/logrotate.d/wmf_auto_restart_prometheus-elasticsearch-exporter-9400.orig\n+++ /etc/logrotate.d/wmf_auto_restart_prometheus-elasticsearch-exporter-9400\n@@ -0,0 +1,12 @@\n+# logrotate(8) config for wmf_auto_restart_prometheus-elasticsearch-exporter-9400\n+\n+/var/log/wmf_auto_restart_prometheus-elasticsearch-exporter-9400/*.log {\n+    daily\n+    copytruncate\n+    missingok\n+    compress\n+    delaycompress\n+    notifempty\n+    rotate 15\n+    size 256M\n+}", "parameters": "--- File[/etc/logrotate.d/wmf_auto_restart_prometheus-elasticsearch-exporter-9400].orig\n+++ File[/etc/logrotate.d/wmf_auto_restart_prometheus-elasticsearch-exporter-9400]\n\n+    owner  => root\n+    mode   => 0444\n+    group  => root\n+    ensure => present\n"}, {"resource": "Package[wmf-opensearch-search-plugins]", "parameters": "--- Package[wmf-opensearch-search-plugins].orig\n+++ Package[wmf-opensearch-search-plugins]\n\n+    before   => ['Service[opensearch_1@relforge-eqiad]', 'Service[opensearch_1@relforge-eqiad-small-alpha]']\n+    provider => apt\n+    require  => ['Class[Java]', 'Package[opensearch]']\n+    ensure   => present\n"}, {"resource": "Nginx::Site[relforge-eqiad]", "parameters": "--- Nginx::Site[relforge-eqiad].orig\n+++ Nginx::Site[relforge-eqiad]\n\n+    require => Exec[tlsproxy localssl default_server on ports [9243]]\n+    ensure  => present\n"}, {"resource": "File[/etc/logrotate.d/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]", "content": "--- /etc/logrotate.d/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.orig\n+++ /etc/logrotate.d/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200\n@@ -0,0 +1,12 @@\n+# logrotate(8) config for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200\n+\n+/var/log/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200/*.log {\n+    daily\n+    copytruncate\n+    missingok\n+    compress\n+    delaycompress\n+    notifempty\n+    rotate 15\n+    size 256M\n+}", "parameters": "--- File[/etc/logrotate.d/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200].orig\n+++ File[/etc/logrotate.d/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]\n\n+    owner  => root\n+    mode   => 0444\n+    group  => root\n+    ensure => present\n"}, {"resource": "File[/var/lib/nginx]", "parameters": "--- File[/var/lib/nginx].orig\n+++ File[/var/lib/nginx]\n\n+    owner  => root\n+    group  => root\n+    before => ['Service[nginx]']\n+    ensure => directory\n"}, {"resource": "Exec[apt-get update]", "parameters": "--- Exec[apt-get update].orig\n+++ Exec[apt-get update]\n\n+    before => ['Class[Opensearch]']\n"}, {"resource": "Opensearch::Keystore[s3-credentials-user-relforge-eqiad]", "parameters": "--- Opensearch::Keystore[s3-credentials-user-relforge-eqiad].orig\n+++ Opensearch::Keystore[s3-credentials-user-relforge-eqiad]\n\n+    key          => s3.client.default.access_key\n+    value        => search:platform\n+    cluster_name => relforge-eqiad\n"}, {"resource": "Profile::Auto_restarts::Service[prometheus-elasticsearch-exporter-9200]", "parameters": "--- Profile::Auto_restarts::Service[prometheus-elasticsearch-exporter-9200].orig\n+++ Profile::Auto_restarts::Service[prometheus-elasticsearch-exporter-9200]\n\n+    ensure => present\n"}, {"resource": "Exec[s3-credentials-user-relforge-eqiad-small-alpha]", "parameters": "--- Exec[s3-credentials-user-relforge-eqiad-small-alpha].orig\n+++ Exec[s3-credentials-user-relforge-eqiad-small-alpha]\n\n+    environment => ['OPENSEARCH_PATH_CONF=/etc/opensearch/relforge-eqiad-small-alpha']\n+    command     => echo 'search:platform' | /usr/share/opensearch/bin/opensearch-keystore add s3.client.default.access_key\n+    group       => opensearch\n+    require     => File[/etc/opensearch/relforge-eqiad-small-alpha/opensearch.keystore]\n+    path        => /bin:/usr/bin\n+    unless      => /usr/share/opensearch/bin/opensearch-keystore list | grep s3.client.default.access_key\n"}, {"resource": "File[/var/lib/prometheus/node.d/check_check_push_cross_cluster_settings_9400_status.prom]", "parameters": "--- File[/var/lib/prometheus/node.d/check_check_push_cross_cluster_settings_9400_status.prom].orig\n+++ File[/var/lib/prometheus/node.d/check_check_push_cross_cluster_settings_9400_status.prom]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n"}, {"resource": "Motd::Message[cirrus::relforge]", "parameters": "--- Motd::Message[cirrus::relforge].orig\n+++ Motd::Message[cirrus::relforge]\n\n+    priority => 5\n+    message  => relforge1008 is a Elasticsearch relforge (cirrus::relforge)\n+    ensure   => present\n"}, {"resource": "Systemd::Timer::Job[push_cross_cluster_settings_9200]", "parameters": "--- Systemd::Timer::Job[push_cross_cluster_settings_9200].orig\n+++ Systemd::Timer::Job[push_cross_cluster_settings_9200]\n\n+    send_mail                 => False\n+    user                      => root\n+    monitoring_enabled        => True\n+    logfile_name              => syslog.log\n+    logging_enabled           => True\n+    command                   => /bin/bash /usr/local/bin/set-cross-cluster-seeds_9200.sh\n+    private_tmp               => False\n+    description               => Auto set remote cluster seeds for relforge-eqiad\n+    syslog_force_stop         => True\n+    ignore_errors             => False\n+    send_mail_only_on_error   => True\n+    fixed_random_delay        => False\n+    logfile_perms             => all\n+    ensure                    => present\n+    logfile_basedir           => /var/log\n+    environment               => {}\n+    logfile_group             => root\n+    send_mail_to              => root@relforge1008.eqiad.wmnet\n+    success_exit_status       => []\n+    interval                  => {'start': 'OnUnitActiveSec', 'interval': '15min'}\n+    monitoring_contact_groups => admins\n+    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+    syslog_match_startswith   => True\n"}, {"resource": "Systemd::Service[prometheus-wmf-elasticsearch-exporter-9200]", "parameters": "--- Systemd::Service[prometheus-wmf-elasticsearch-exporter-9200].orig\n+++ Systemd::Service[prometheus-wmf-elasticsearch-exporter-9200]\n\n+    subscribe                => File[/usr/local/bin/prometheus-wmf-elasticsearch-exporter]\n+    override                 => False\n+    restart                  => True\n+    require                  => File[/usr/local/bin/prometheus-wmf-elasticsearch-exporter]\n+    ensure                   => present\n+    unit_type                => service\n+    migration_task           => T407130\n+    monitoring_enabled       => False\n+    monitoring_contact_group => admins\n+    service_params           => {}\n+    monitoring_critical      => False\n"}, {"resource": "File[/lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9200.service]", "content": "--- /lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9200.service.orig\n+++ /lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9200.service\n@@ -0,0 +1,11 @@\n+[Unit]\n+Description=execution of nrpe2nodexp for the check_opensearch_shard_size_check_9200 command.\n+Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state\n+\n+[Service]\n+Type=oneshot\n+User=nagios\n+\n+Group=prometheus-node-exporter\n+SyslogIdentifier=nrpe2nodexp-opensearch_shard_size_check_9200\n+ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash \"c62725841c61e20ac3f6819b4c0ad800\" --timeout 10 --check-command \"check_opensearch_shard_size_check_9200\"", "parameters": "--- File[/lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9200.service].orig\n+++ File[/lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9200.service]\n\n+    owner  => root\n+    group  => root\n+    ensure => absent\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9200.service (nrpe2nodexp-opensearch_shard_size_check_9200.service)]\n"}, {"resource": "File[/etc/ferm/conf.d/10_opensearch_http_9200]", "content": "--- /etc/ferm/conf.d/10_opensearch_http_9200.orig\n+++ /etc/ferm/conf.d/10_opensearch_http_9200\n@@ -1,6 +0,0 @@\n-# Autogenerated by puppet. DO NOT EDIT BY HAND!\n-#\n-# \n-&R_SERVICE(tcp, 9200, $ANALYTICS_NETWORKS);\n-\n-", "parameters": "--- File[/etc/ferm/conf.d/10_opensearch_http_9200].orig\n+++ File[/etc/ferm/conf.d/10_opensearch_http_9200]\n\n-    owner   => root\n-    group   => root\n-    tag     => ferm\n-    require => File[/etc/ferm/conf.d]\n-    mode    => 0400\n-    ensure  => present\n-    notify  => Service[ferm]\n"}, {"resource": "File[/etc/nginx/sites-enabled/relforge-eqiad]", "parameters": "--- File[/etc/nginx/sites-enabled/relforge-eqiad].orig\n+++ File[/etc/nginx/sites-enabled/relforge-eqiad]\n\n+    before => ['Service[nginx]']\n+    owner  => root\n+    target => /etc/nginx/sites-available/relforge-eqiad\n+    group  => root\n+    ensure => link\n"}, {"resource": "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer (wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer)]", "parameters": "--- Exec[systemd daemon-reload for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer (wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer)].orig\n+++ Exec[systemd daemon-reload for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer (wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer)]\n\n+    before      => ['Service[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer]']\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "Class[Profile::Opensearch::Cirrus::Relforge]", "parameters": "--- Class[Profile::Opensearch::Cirrus::Relforge].orig\n+++ Class[Profile::Opensearch::Cirrus::Relforge]\n\n+    cumin_masters => ['10.64.16.154', '2620:0:861:102:10:64:16:154', '10.192.32.49', '2620:0:860:103:10:192:32:49']\n"}, {"resource": "Service[opensearch_1@relforge-eqiad-small-alpha]", "parameters": "--- Service[opensearch_1@relforge-eqiad-small-alpha].orig\n+++ Service[opensearch_1@relforge-eqiad-small-alpha]\n\n+    provider => systemd\n+    tag      => opensearch_services\n+    require  => ['Systemd::Unit[opensearch_1@.service]', 'File[/etc/opensearch/relforge-eqiad-small-alpha/opensearch.yml]', 'File[/etc/opensearch/relforge-eqiad-small-alpha/logging.yml]', 'File[/etc/opensearch/relforge-eqiad-small-alpha/log4j2.properties]', 'File[/etc/opensearch/relforge-eqiad-small-alpha/jvm.options]', 'File[/srv/opensearch/relforge-eqiad-small-alpha]', 'Systemd::Tmpfile[opensearch-relforge-eqiad-small-alpha]']\n+    ensure   => running\n+    enable   => True\n"}, {"resource": "Systemd::Unit[nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer]", "parameters": "--- Systemd::Unit[nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer].orig\n+++ Systemd::Unit[nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer]\n\n+    override          => False\n+    require           => ['Class[Systemd]']\n+    restart           => False\n+    ensure            => absent\n+    override_filename => puppet-override.conf\n+    unit              => nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer\n"}, {"resource": "Nrpe::Monitor_service[opensearch_unassigned_shard_check_9400]", "parameters": "--- Nrpe::Monitor_service[opensearch_unassigned_shard_check_9400].orig\n+++ Nrpe::Monitor_service[opensearch_unassigned_shard_check_9400]\n\n+    retry_interval              => 120\n+    check_interval              => 720\n+    ensure                      => present\n+    migration_task              => T371083\n+    contact_group               => admins,team-discovery\n+    nrpe_command                => /usr/lib/nagios/plugins/check_elasticsearch_unassigned_shards.py --url http://localhost:9400 --timeout 4\n+    enable_nrpe2nodexp          => False\n+    critical                    => False\n+    alertmanager_team           => observability\n+    retries                     => 1\n+    nrpe2nodexp_parse_perf_data => False\n+    enable_icinga_check         => True\n+    timeout                     => 10\n+    description                 => OpenSearch unassigned shard check - 9400\n+    notes_url                   => https://wikitech.wikimedia.org/wiki/Search#Administration\n"}, {"resource": "Systemd::Timer[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]", "parameters": "--- Systemd::Timer[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400].orig\n+++ Systemd::Timer[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]\n\n+    unit_name          => wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service\n+    fixed_random_delay => False\n+    splay              => 0\n+    ensure             => present\n+    timer_intervals    => [{'start': 'OnCalendar', 'interval': 'Mon,Tue,Wed,Thu,Fri *-*-* 11:6:00'}]\n+    accuracy           => 15sec\n"}, {"resource": "Systemd::Service[push_cross_cluster_settings_9200]", "parameters": "--- Systemd::Service[push_cross_cluster_settings_9200].orig\n+++ Systemd::Service[push_cross_cluster_settings_9200]\n\n+    override                 => False\n+    restart                  => False\n+    require                  => Systemd::Unit[push_cross_cluster_settings_9200.service]\n+    ensure                   => present\n+    unit_type                => timer\n+    migration_task           => T407130\n+    monitoring_enabled       => False\n+    monitoring_contact_group => admins\n+    service_params           => {}\n+    monitoring_critical      => False\n"}, {"resource": "Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer (nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer)]", "parameters": "--- Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer (nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer)].orig\n+++ Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer (nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer)]\n\n+    command     => /bin/systemctl daemon-reload\n+    refreshonly => True\n"}, {"resource": "File[/lib/systemd/system/opensearch-hot-threads-log.timer]", "content": "--- /lib/systemd/system/opensearch-hot-threads-log.timer.orig\n+++ /lib/systemd/system/opensearch-hot-threads-log.timer\n@@ -0,0 +1,12 @@\n+[Unit]\n+Description=Periodic execution of opensearch-hot-threads-log.service\n+\n+[Timer]\n+Unit=opensearch-hot-threads-log.service\n+# Accuracy sets the maximum time interval around the execution time we want to allow\n+AccuracySec=15sec\n+OnCalendar=*-*-* *:00/5:00\n+RandomizedDelaySec=0\n+\n+[Install]\n+WantedBy=multi-user.target", "parameters": "--- File[/lib/systemd/system/opensearch-hot-threads-log.timer].orig\n+++ File[/lib/systemd/system/opensearch-hot-threads-log.timer]\n\n+    owner  => root\n+    group  => root\n+    ensure => present\n+    mode   => 0444\n+    notify => Exec[systemd daemon-reload for opensearch-hot-threads-log.timer (opensearch-hot-threads-log.timer)]\n"}, {"resource": "Systemd::Service[opensearch-hot-threads-log]", "parameters": "--- Systemd::Service[opensearch-hot-threads-log].orig\n+++ Systemd::Service[opensearch-hot-threads-log]\n\n+    override                 => False\n+    restart                  => False\n+    require                  => Systemd::Unit[opensearch-hot-threads-log.service]\n+    ensure                   => present\n+    unit_type                => timer\n+    migration_task           => T407130\n+    monitoring_enabled       => False\n+    monitoring_contact_group => admins\n+    service_params           => {}\n+    monitoring_critical      => False\n"}], "perc_changed": "44.41%"}, "core": {"total": 2900, "only_in_self": ["File[/etc/ferm/conf.d/10_opensearch_http_9200]", "File[/etc/update-motd.d/05-cirrus--test]"], "only_in_other": ["Concat[/etc/apt/sources.list.d/wikimedia-opensearch-plugins.sources]", "Concat[/etc/apt/sources.list.d/wikimedia-opensearch.sources]", "Concat_file[/etc/apt/sources.list.d/wikimedia-opensearch-plugins.sources]", "Concat_file[/etc/apt/sources.list.d/wikimedia-opensearch.sources]", "Concat_fragment[wikimedia-opensearch-header]", "Concat_fragment[wikimedia-opensearch-plugins-header]", "Concat_fragment[wikimedia-opensearch-plugins]", "Concat_fragment[wikimedia-opensearch]", "Exec[Generate cert discovery2026__relforge1008_eqiad_wmnet refresh on intermediate ca change]", "Exec[Generate cert discovery2026__relforge1008_eqiad_wmnet refresh]", "Exec[Generate cert discovery2026__relforge1008_eqiad_wmnet]", "Exec[Refresh tmpfile opensearch-relforge-eqiad-small-alpha]", "Exec[Refresh tmpfile opensearch-relforge-eqiad]", "Exec[apt_repository_wikimedia-opensearch-plugins]", "Exec[apt_repository_wikimedia-opensearch]", "Exec[create chained cert /etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chain.pem]", "Exec[java__cacert_wmf:Wikimedia_Internal_Root_CA]", "Exec[java__cacert_wmf:puppetca.pem]", "Exec[mask_default_prometheus_elasticsearch_exporter]", "Exec[mask_nginx.service]", "Exec[nginx-reload]", "Exec[opensearch-create-keystore-relforge-eqiad-small-alpha]", "Exec[opensearch-create-keystore-relforge-eqiad]", "Exec[renew certificate - discovery2026__relforge1008_eqiad_wmnet]", "Exec[s3-credentials-user-relforge-eqiad-small-alpha]", "Exec[s3-credentials-user-relforge-eqiad]", "Exec[stop-default-nginx]", "Exec[symlink /etc/opensearch/relforge-eqiad-small-alpha/sudachi]", "Exec[symlink /etc/opensearch/relforge-eqiad/sudachi]", "Exec[systemd daemon-reload for clean_up_dlq.service (clean_up_dlq.service)]", "Exec[systemd daemon-reload for clean_up_dlq.timer (clean_up_dlq.timer)]", "Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service (nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service)]", "Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer (nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer)]", "Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service (nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service)]", "Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer (nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9200.service (nrpe2nodexp-opensearch_shard_size_check_9200.service)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9200.timer (nrpe2nodexp-opensearch_shard_size_check_9200.timer)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9400.service (nrpe2nodexp-opensearch_shard_size_check_9400.service)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9400.timer (nrpe2nodexp-opensearch_shard_size_check_9400.timer)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9200.service (nrpe2nodexp-opensearch_shards_9200.service)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9200.timer (nrpe2nodexp-opensearch_shards_9200.timer)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9400.service (nrpe2nodexp-opensearch_shards_9400.service)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9400.timer (nrpe2nodexp-opensearch_shards_9400.timer)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9200.service (nrpe2nodexp-opensearch_unassigned_shard_check_9200.service)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer (nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9400.service (nrpe2nodexp-opensearch_unassigned_shard_check_9400.service)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer (nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer)]", "Exec[systemd daemon-reload for opensearch-disable-readahead-relforge-eqiad-small-alpha.service (opensearch-disable-readahead-relforge-eqiad-small-alpha.service)]", "Exec[systemd daemon-reload for opensearch-disable-readahead-relforge-eqiad-small-alpha.timer (opensearch-disable-readahead-relforge-eqiad-small-alpha.timer)]", "Exec[systemd daemon-reload for opensearch-disable-readahead-relforge-eqiad.service (opensearch-disable-readahead-relforge-eqiad.service)]", "Exec[systemd daemon-reload for opensearch-disable-readahead-relforge-eqiad.timer (opensearch-disable-readahead-relforge-eqiad.timer)]", "Exec[systemd daemon-reload for opensearch-disable-readahead.service (opensearch-disable-readahead.service)]", "Exec[systemd daemon-reload for opensearch-disable-readahead.timer (opensearch-disable-readahead.timer)]", "Exec[systemd daemon-reload for opensearch-hot-threads-log.service (opensearch-hot-threads-log.service)]", "Exec[systemd daemon-reload for opensearch-hot-threads-log.timer (opensearch-hot-threads-log.timer)]", "Exec[systemd daemon-reload for opensearch-relforge-eqiad-gc-log-cleanup.service (opensearch-relforge-eqiad-gc-log-cleanup.service)]", "Exec[systemd daemon-reload for opensearch-relforge-eqiad-gc-log-cleanup.timer (opensearch-relforge-eqiad-gc-log-cleanup.timer)]", "Exec[systemd daemon-reload for opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service (opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service)]", "Exec[systemd daemon-reload for opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer (opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer)]", "Exec[systemd daemon-reload for opensearch_1@.service (opensearch_1@.service)]", "Exec[systemd daemon-reload for prometheus-elasticsearch-exporter-9200.service (prometheus-elasticsearch-exporter-9200)]", "Exec[systemd daemon-reload for prometheus-elasticsearch-exporter-9400.service (prometheus-elasticsearch-exporter-9400)]", "Exec[systemd daemon-reload for prometheus-wmf-elasticsearch-exporter-9200.service (prometheus-wmf-elasticsearch-exporter-9200)]", "Exec[systemd daemon-reload for prometheus-wmf-elasticsearch-exporter-9400.service (prometheus-wmf-elasticsearch-exporter-9400)]", "Exec[systemd daemon-reload for push_cross_cluster_settings_9200.service (push_cross_cluster_settings_9200.service)]", "Exec[systemd daemon-reload for push_cross_cluster_settings_9200.timer (push_cross_cluster_settings_9200.timer)]", "Exec[systemd daemon-reload for push_cross_cluster_settings_9400.service (push_cross_cluster_settings_9400.service)]", "Exec[systemd daemon-reload for push_cross_cluster_settings_9400.timer (push_cross_cluster_settings_9400.timer)]", "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service (wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service)]", "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer (wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer)]", "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service (wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service)]", "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer (wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer)]", "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service (wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service)]", "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer (wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer)]", "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service (wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service)]", "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer (wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer)]", "Exec[systemd reload for nginx systemd fragments]", "Exec[tlsproxy localssl default_server on ports [9243]]", "Exec[tlsproxy localssl default_server on ports [9443]]", "Exec[unmask_nginx.service]", "Exec[update_java_alternatives_17]", "File[/etc/apt/sources.list.d/wikimedia-opensearch-plugins.list]", "File[/etc/apt/sources.list.d/wikimedia-opensearch.list]", "File[/etc/cfssl/csr/discovery2026__relforge1008_eqiad_wmnet.csr]", "File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet-key.pem]", "File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chain.pem]", "File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chained.pem]", "File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.csr]", "File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.pem]", "File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet]", "File[/etc/default/logstash]", "File[/etc/default/opensearch]", "File[/etc/default/prometheus-elasticsearch-exporter]", "File[/etc/elasticsearch]", "File[/etc/ferm/conf.d/10_elastic-main-https-9243]", "File[/etc/ferm/conf.d/10_elastic-small-alpha-https-9443]", "File[/etc/ferm/conf.d/10_opensearch-https-9243]", "File[/etc/ferm/conf.d/10_opensearch-https-9443]", "File[/etc/ferm/conf.d/10_opensearch_inter_node_9500]", "File[/etc/logrotate.d/clean_up_dlq]", "File[/etc/logrotate.d/nginx]", "File[/etc/logrotate.d/opensearch-disable-readahead-relforge-eqiad-small-alpha]", "File[/etc/logrotate.d/opensearch-disable-readahead-relforge-eqiad]", "File[/etc/logrotate.d/opensearch-disable-readahead]", "File[/etc/logrotate.d/opensearch-relforge-eqiad-gc-log-cleanup]", "File[/etc/logrotate.d/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]", "File[/etc/logrotate.d/opensearch]", "File[/etc/logrotate.d/push_cross_cluster_settings_9200]", "File[/etc/logrotate.d/push_cross_cluster_settings_9400]", "File[/etc/logrotate.d/wmf_auto_restart_prometheus-elasticsearch-exporter-9200]", "File[/etc/logrotate.d/wmf_auto_restart_prometheus-elasticsearch-exporter-9400]", "File[/etc/logrotate.d/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]", "File[/etc/logrotate.d/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]", "File[/etc/logstash/conf.d/10-input-gelf-gelf_relay.conf]", "File[/etc/logstash/conf.d/90-output-udp-gelf_relay.conf]", "File[/etc/logstash/conf.d/README]", "File[/etc/logstash/jvm.options]", "File[/etc/logstash/log4j2.properties]", "File[/etc/logstash/logstash.yml]", "File[/etc/nagios/nrpe.d/check_check_push_cross_cluster_settings_9200_status.cfg]", "File[/etc/nagios/nrpe.d/check_check_push_cross_cluster_settings_9400_status.cfg]", "File[/etc/nagios/nrpe.d/check_opensearch_shard_size_check_9200.cfg]", "File[/etc/nagios/nrpe.d/check_opensearch_shard_size_check_9400.cfg]", "File[/etc/nagios/nrpe.d/check_opensearch_shards_9200.cfg]", "File[/etc/nagios/nrpe.d/check_opensearch_shards_9400.cfg]", "File[/etc/nagios/nrpe.d/check_opensearch_unassigned_shard_check_9200.cfg]", "File[/etc/nagios/nrpe.d/check_opensearch_unassigned_shard_check_9400.cfg]", "File[/etc/nginx/conf.d]", "File[/etc/nginx/nginx.conf]", "File[/etc/nginx/sites-available/relforge-eqiad-small-alpha]", "File[/etc/nginx/sites-available/relforge-eqiad]", "File[/etc/nginx/sites-available]", "File[/etc/nginx/sites-enabled/relforge-eqiad-small-alpha]", "File[/etc/nginx/sites-enabled/relforge-eqiad]", "File[/etc/nginx/sites-enabled]", "File[/etc/nginx]", "File[/etc/opensearch/instances]", "File[/etc/opensearch/relforge-eqiad-small-alpha/cirrus_check_settings.json]", "File[/etc/opensearch/relforge-eqiad-small-alpha/java-security.policy]", "File[/etc/opensearch/relforge-eqiad-small-alpha/jvm.options]", "File[/etc/opensearch/relforge-eqiad-small-alpha/log4j2.properties]", "File[/etc/opensearch/relforge-eqiad-small-alpha/logging.yml]", "File[/etc/opensearch/relforge-eqiad-small-alpha/opensearch.keystore]", "File[/etc/opensearch/relforge-eqiad-small-alpha/opensearch.yml]", "File[/etc/opensearch/relforge-eqiad-small-alpha/scripts]", "File[/etc/opensearch/relforge-eqiad-small-alpha]", "File[/etc/opensearch/relforge-eqiad/cirrus_check_settings.json]", "File[/etc/opensearch/relforge-eqiad/java-security.policy]", "File[/etc/opensearch/relforge-eqiad/jvm.options]", "File[/etc/opensearch/relforge-eqiad/log4j2.properties]", "File[/etc/opensearch/relforge-eqiad/logging.yml]", "File[/etc/opensearch/relforge-eqiad/opensearch.keystore]", "File[/etc/opensearch/relforge-eqiad/opensearch.yml]", "File[/etc/opensearch/relforge-eqiad/scripts]", "File[/etc/opensearch/relforge-eqiad]", "File[/etc/opensearch]", "File[/etc/opensearch_hot_threads.d/relforge-eqiad-small-alpha.yml]", "File[/etc/opensearch_hot_threads.d/relforge-eqiad.yml]", "File[/etc/opensearch_hot_threads.d]", "File[/etc/rsyslog.d/25-nrpe2nodexp-check-push-cross-cluster-settings-9200-status.conf]", "File[/etc/rsyslog.d/25-nrpe2nodexp-check-push-cross-cluster-settings-9400-status.conf]", "File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-shard-size-check-9200.conf]", "File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-shard-size-check-9400.conf]", "File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-shards-9200.conf]", "File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-shards-9400.conf]", "File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-unassigned-shard-check-9200.conf]", "File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-unassigned-shard-check-9400.conf]", "File[/etc/rsyslog.d/40-clean-up-dlq.conf]", "File[/etc/rsyslog.d/40-opensearch-disable-readahead-relforge-eqiad-small-alpha.conf]", "File[/etc/rsyslog.d/40-opensearch-disable-readahead-relforge-eqiad.conf]", "File[/etc/rsyslog.d/40-opensearch-disable-readahead.conf]", "File[/etc/rsyslog.d/40-opensearch-relforge-eqiad-gc-log-cleanup.conf]", "File[/etc/rsyslog.d/40-opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.conf]", "File[/etc/rsyslog.d/40-push-cross-cluster-settings-9200.conf]", "File[/etc/rsyslog.d/40-push-cross-cluster-settings-9400.conf]", "File[/etc/rsyslog.d/40-wmf-auto-restart-prometheus-elasticsearch-exporter-9200.conf]", "File[/etc/rsyslog.d/40-wmf-auto-restart-prometheus-elasticsearch-exporter-9400.conf]", "File[/etc/rsyslog.d/40-wmf-auto-restart-prometheus-wmf-elasticsearch-exporter-9200.conf]", "File[/etc/rsyslog.d/40-wmf-auto-restart-prometheus-wmf-elasticsearch-exporter-9400.conf]", "File[/etc/rsyslog.d/50-udp-json-logback-compat.conf]", "File[/etc/ssl/dhparam.pem]", "File[/etc/sudoers.d/nrpe-check_check_push_cross_cluster_settings_9200_status]", "File[/etc/sudoers.d/nrpe-check_check_push_cross_cluster_settings_9400_status]", "File[/etc/sudoers.d/nrpe-check_opensearch_shard_size_check_9200]", "File[/etc/sudoers.d/nrpe-check_opensearch_shard_size_check_9400]", "File[/etc/sudoers.d/nrpe-check_opensearch_shards_9200]", "File[/etc/sudoers.d/nrpe-check_opensearch_shards_9400]", "File[/etc/sudoers.d/nrpe-check_opensearch_unassigned_shard_check_9200]", "File[/etc/sudoers.d/nrpe-check_opensearch_unassigned_shard_check_9400]", "File[/etc/sysctl.d/70-TCP-Fast-Open.conf]", "File[/etc/sysctl.d/opensearch.conf]", "File[/etc/systemd/system/nginx.service.d/numa.conf]", "File[/etc/systemd/system/nginx.service.d/security.conf]", "File[/etc/systemd/system/nginx.service.d]", "File[/etc/tmpfiles.d/opensearch-relforge-eqiad-small-alpha.conf]", "File[/etc/tmpfiles.d/opensearch-relforge-eqiad.conf]", "File[/etc/udev/rules.d/40-opensearch-readahead.rules]", "File[/etc/update-motd.d/05-cirrus--relforge]", "File[/etc/update-motd.d/96-cluster-memberships]", "File[/lib/systemd/system/clean_up_dlq.service]", "File[/lib/systemd/system/clean_up_dlq.timer]", "File[/lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service]", "File[/lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer]", "File[/lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service]", "File[/lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9200.service]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9200.timer]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9400.service]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9400.timer]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_shards_9200.service]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_shards_9200.timer]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_shards_9400.service]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_shards_9400.timer]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9200.service]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9400.service]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer]", "File[/lib/systemd/system/opensearch-disable-readahead-relforge-eqiad-small-alpha.service]", "File[/lib/systemd/system/opensearch-disable-readahead-relforge-eqiad-small-alpha.timer]", "File[/lib/systemd/system/opensearch-disable-readahead-relforge-eqiad.service]", "File[/lib/systemd/system/opensearch-disable-readahead-relforge-eqiad.timer]", "File[/lib/systemd/system/opensearch-disable-readahead.service]", "File[/lib/systemd/system/opensearch-disable-readahead.timer]", "File[/lib/systemd/system/opensearch-hot-threads-log.service]", "File[/lib/systemd/system/opensearch-hot-threads-log.timer]", "File[/lib/systemd/system/opensearch-relforge-eqiad-gc-log-cleanup.service]", "File[/lib/systemd/system/opensearch-relforge-eqiad-gc-log-cleanup.timer]", "File[/lib/systemd/system/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service]", "File[/lib/systemd/system/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer]", "File[/lib/systemd/system/opensearch_1@.service]", "File[/lib/systemd/system/prometheus-elasticsearch-exporter-9200.service]", "File[/lib/systemd/system/prometheus-elasticsearch-exporter-9400.service]", "File[/lib/systemd/system/prometheus-wmf-elasticsearch-exporter-9200.service]", "File[/lib/systemd/system/prometheus-wmf-elasticsearch-exporter-9400.service]", "File[/lib/systemd/system/push_cross_cluster_settings_9200.service]", "File[/lib/systemd/system/push_cross_cluster_settings_9200.timer]", "File[/lib/systemd/system/push_cross_cluster_settings_9400.service]", "File[/lib/systemd/system/push_cross_cluster_settings_9400.timer]", "File[/lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service]", "File[/lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer]", "File[/lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service]", "File[/lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer]", "File[/lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service]", "File[/lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer]", "File[/lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service]", "File[/lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer]", "File[/srv/opensearch/relforge-eqiad-small-alpha]", "File[/srv/opensearch/relforge-eqiad]", "File[/srv/opensearch]", "File[/usr/lib/nagios/plugins/check_elasticsearch.py]", "File[/usr/lib/nagios/plugins/check_elasticsearch]", "File[/usr/lib/nagios/plugins/check_elasticsearch_shard_size.py]", "File[/usr/lib/nagios/plugins/check_elasticsearch_unassigned_shards.py]", "File[/usr/local/bin/cleanup-dlq]", "File[/usr/local/bin/jheapdump]", "File[/usr/local/bin/logstash-config-test]", "File[/usr/local/bin/opensearch-disable-readahead.sh]", "File[/usr/local/bin/opensearch_hot_threads_logger.py]", "File[/usr/local/bin/prometheus-wmf-elasticsearch-exporter]", "File[/usr/local/bin/set-cross-cluster-seeds_9200.sh]", "File[/usr/local/bin/set-cross-cluster-seeds_9400.sh]", "File[/usr/local/lib/nagios/plugins/check_systemd_unit_status]", "File[/usr/share/opensearch/plugins]", "File[/var/lib/nginx]", "File[/var/lib/prometheus/node.d/check_check_push_cross_cluster_settings_9200_status.prom]", "File[/var/lib/prometheus/node.d/check_check_push_cross_cluster_settings_9400_status.prom]", "File[/var/lib/prometheus/node.d/check_opensearch_shard_size_check_9200.prom]", "File[/var/lib/prometheus/node.d/check_opensearch_shard_size_check_9400.prom]", "File[/var/lib/prometheus/node.d/check_opensearch_shards_9200.prom]", "File[/var/lib/prometheus/node.d/check_opensearch_shards_9400.prom]", "File[/var/lib/prometheus/node.d/check_opensearch_unassigned_shard_check_9200.prom]", "File[/var/lib/prometheus/node.d/check_opensearch_unassigned_shard_check_9400.prom]", "File[/var/log/clean_up_dlq]", "File[/var/log/opensearch-disable-readahead-relforge-eqiad-small-alpha]", "File[/var/log/opensearch-disable-readahead-relforge-eqiad]", "File[/var/log/opensearch-disable-readahead]", "File[/var/log/opensearch-relforge-eqiad-gc-log-cleanup]", "File[/var/log/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]", "File[/var/log/opensearch/opensearch.log]", "File[/var/log/opensearch/opensearch_index_indexing_slowlog.log]", "File[/var/log/opensearch/opensearch_index_search_slowlog.log]", "File[/var/log/opensearch]", "File[/var/log/push_cross_cluster_settings_9200]", "File[/var/log/push_cross_cluster_settings_9400]", "File[/var/log/wmf_auto_restart_prometheus-elasticsearch-exporter-9200]", "File[/var/log/wmf_auto_restart_prometheus-elasticsearch-exporter-9400]", "File[/var/log/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]", "File[/var/log/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]", "File_line[auto_restart_file_presence_prometheus-elasticsearch-exporter-9200]", "File_line[auto_restart_file_presence_prometheus-elasticsearch-exporter-9400]", "File_line[auto_restart_file_presence_prometheus-wmf-elasticsearch-exporter-9200]", "File_line[auto_restart_file_presence_prometheus-wmf-elasticsearch-exporter-9400]", "File_line[opensearch_bin_bashrc]", "Mount[/var/lib/nginx]", "Package[edac-utils]", "Package[logstash-old-name]", "Package[logstash-oss]", "Package[nginx-common]", "Package[nginx-light]", "Package[openjdk-17-jdk]", "Package[opensearch-madvise]", "Package[opensearch]", "Package[prometheus-elasticsearch-exporter]", "Package[python3-requests]", "Package[wmf-opensearch-search-plugins]", "Service[clean_up_dlq.timer]", "Service[logstash]", "Service[nginx]", "Service[nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer]", "Service[nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer]", "Service[nrpe2nodexp-opensearch_shard_size_check_9200.timer]", "Service[nrpe2nodexp-opensearch_shard_size_check_9400.timer]", "Service[nrpe2nodexp-opensearch_shards_9200.timer]", "Service[nrpe2nodexp-opensearch_shards_9400.timer]", "Service[nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer]", "Service[nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer]", "Service[opensearch-disable-readahead-relforge-eqiad-small-alpha.timer]", "Service[opensearch-disable-readahead-relforge-eqiad.timer]", "Service[opensearch-disable-readahead.timer]", "Service[opensearch-hot-threads-log.timer]", "Service[opensearch-relforge-eqiad-gc-log-cleanup.timer]", "Service[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer]", "Service[opensearch]", "Service[opensearch_1@relforge-eqiad-small-alpha]", "Service[opensearch_1@relforge-eqiad]", "Service[prometheus-elasticsearch-exporter-9200]", "Service[prometheus-elasticsearch-exporter-9400]", "Service[prometheus-elasticsearch-exporter]", "Service[prometheus-wmf-elasticsearch-exporter-9200]", "Service[prometheus-wmf-elasticsearch-exporter-9400]", "Service[push_cross_cluster_settings_9200.timer]", "Service[push_cross_cluster_settings_9400.timer]", "Service[wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer]", "Service[wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer]", "Service[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer]", "Service[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer]"], "resource_diffs": [{"resource": "File[/var/lib/prometheus/node.d/role_owner.prom]", "content": "--- /var/lib/prometheus/node.d/role_owner.prom.orig\n+++ /var/lib/prometheus/node.d/role_owner.prom\n@@ -1,3 +1,3 @@\n # HELP role_owner The team owner of the server role\n # TYPE role_owner gauge\n-role_owner{team=\"search-platform\",role=\"cirrus::test\",cluster=\"relforge\"} 1.0\n+role_owner{team=\"search-platform\",role=\"cirrus::relforge\",cluster=\"relforge\"} 1.0"}, {"resource": "File[/etc/nagios/nrpe.d/check_disk_space.cfg]", "content": "--- /etc/nagios/nrpe.d/check_disk_space.cfg.orig\n+++ /etc/nagios/nrpe.d/check_disk_space.cfg\n@@ -1,2 +1,2 @@\n # File generated by puppet. DO NOT edit by hand\n-command[check_disk_space]=/usr/lib/nagios/plugins/check_disk -w 6% -c 3% -W 6% -K 3% -l -e -A -i \"/srv/sd[a-b][1-3]\" -i \"/srv/nvme[0-9]n[0-9]p[0-9]\" --exclude-type=fuse --exclude-type=fuse.fuse_dfs --exclude-type=tracefs\n+command[check_disk_space]=/usr/lib/nagios/plugins/check_disk -w 15% -c 10% -W 6% -K 3% -l -e -A -i \"/srv/sd[a-b][1-3]\" --exclude-type=tracefs"}, {"resource": "File[/etc/ferm/conf.d/10_opensearch_inter_node_9300]", "content": "--- /etc/ferm/conf.d/10_opensearch_inter_node_9300.orig\n+++ /etc/ferm/conf.d/10_opensearch_inter_node_9300\n@@ -4,3 +4,5 @@\n &R_SERVICE(tcp, 9300, (10.64.164.14 10.64.32.100 10.64.48.120 2620:0:861:103:10:64:32:100 2620:0:861:107:10:64:48:120 2620:0:861:12c:10:64:164:14));\n \n \n+\n+&NO_TRACK(tcp, 9300);"}, {"resource": "Concat_fragment[main contacts]", "content": "--- main contacts.orig\n+++ main contacts\n@@ -1,3 +1,3 @@\n ---\n-role::cirrus::test:\n+role::cirrus::relforge:\n - Search Platform"}, {"resource": "Exec[apt-get update]", "parameters": "--- Exec[apt-get update].orig\n+++ Exec[apt-get update]\n\n+    before => ['Class[Opensearch]']\n"}], "perc_changed": "11.83%"}, "main": {"total": 2900, "only_in_self": ["Class[Profile::Opensearch::Cirrus::Test]", "Class[Role::Cirrus::Test]", "Ferm::Service[opensearch_http_9200]", "File[/etc/ferm/conf.d/10_opensearch_http_9200]", "File[/etc/update-motd.d/05-cirrus--test]", "Firewall::Service[opensearch-http-9200]", "Motd::Message[cirrus::test]", "Motd::Script[cirrus::test]"], "only_in_other": ["Alternatives::Java[17]", "Apt::Repository[wikimedia-opensearch-plugins]", "Apt::Repository[wikimedia-opensearch]", "Cfssl::Cert[discovery2026__relforge1008_eqiad_wmnet]", "Cfssl::Csr[/etc/cfssl/csr/discovery2026__relforge1008_eqiad_wmnet.csr]", "Class[Icinga::Elasticsearch::Base_plugin]", "Class[Java::Tools]", "Class[Java]", "Class[Logstash]", "Class[Nginx]", "Class[Opensearch::Log::Hot_threads]", "Class[Opensearch::Packages]", "Class[Opensearch]", "Class[Profile::Java]", "Class[Profile::Logstash::Gelf_relay]", "Class[Profile::Opensearch::Cirrus::Relforge]", "Class[Profile::Opensearch::Cirrus::Server]", "Class[Profile::Opensearch::Monitoring::Base_checks]", "Class[Profile::Opensearch::Server]", "Class[Profile::Rsyslog::Udp_json_logback_compat]", "Class[Profile::Tcp_fast_open]", "Class[Profile::Tlsproxy::Instance]", "Class[Prometheus::Elasticsearch_exporter::Common]", "Class[Prometheus::Wmf_elasticsearch_exporter::Common]", "Class[Role::Cirrus::Relforge]", "Class[Sslcert::Dhparam]", "Concat::Fragment[wikimedia-opensearch-header]", "Concat::Fragment[wikimedia-opensearch-plugins-header]", "Concat::Fragment[wikimedia-opensearch-plugins]", "Concat::Fragment[wikimedia-opensearch]", "Concat[/etc/apt/sources.list.d/wikimedia-opensearch-plugins.sources]", "Concat[/etc/apt/sources.list.d/wikimedia-opensearch.sources]", "Concat_file[/etc/apt/sources.list.d/wikimedia-opensearch-plugins.sources]", "Concat_file[/etc/apt/sources.list.d/wikimedia-opensearch.sources]", "Concat_fragment[wikimedia-opensearch-header]", "Concat_fragment[wikimedia-opensearch-plugins-header]", "Concat_fragment[wikimedia-opensearch-plugins]", "Concat_fragment[wikimedia-opensearch]", "Elasticsearch::Tlsproxy[relforge-eqiad-small-alpha]", "Elasticsearch::Tlsproxy[relforge-eqiad]", "Exec[Generate cert discovery2026__relforge1008_eqiad_wmnet refresh on intermediate ca change]", "Exec[Generate cert discovery2026__relforge1008_eqiad_wmnet refresh]", "Exec[Generate cert discovery2026__relforge1008_eqiad_wmnet]", "Exec[Refresh tmpfile opensearch-relforge-eqiad-small-alpha]", "Exec[Refresh tmpfile opensearch-relforge-eqiad]", "Exec[apt_repository_wikimedia-opensearch-plugins]", "Exec[apt_repository_wikimedia-opensearch]", "Exec[create chained cert /etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chain.pem]", "Exec[java__cacert_wmf:Wikimedia_Internal_Root_CA]", "Exec[java__cacert_wmf:puppetca.pem]", "Exec[mask_default_prometheus_elasticsearch_exporter]", "Exec[mask_nginx.service]", "Exec[nginx-reload]", "Exec[opensearch-create-keystore-relforge-eqiad-small-alpha]", "Exec[opensearch-create-keystore-relforge-eqiad]", "Exec[renew certificate - discovery2026__relforge1008_eqiad_wmnet]", "Exec[s3-credentials-user-relforge-eqiad-small-alpha]", "Exec[s3-credentials-user-relforge-eqiad]", "Exec[stop-default-nginx]", "Exec[symlink /etc/opensearch/relforge-eqiad-small-alpha/sudachi]", "Exec[symlink /etc/opensearch/relforge-eqiad/sudachi]", "Exec[systemd daemon-reload for clean_up_dlq.service (clean_up_dlq.service)]", "Exec[systemd daemon-reload for clean_up_dlq.timer (clean_up_dlq.timer)]", "Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service (nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service)]", "Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer (nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer)]", "Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service (nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service)]", "Exec[systemd daemon-reload for nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer (nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9200.service (nrpe2nodexp-opensearch_shard_size_check_9200.service)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9200.timer (nrpe2nodexp-opensearch_shard_size_check_9200.timer)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9400.service (nrpe2nodexp-opensearch_shard_size_check_9400.service)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shard_size_check_9400.timer (nrpe2nodexp-opensearch_shard_size_check_9400.timer)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9200.service (nrpe2nodexp-opensearch_shards_9200.service)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9200.timer (nrpe2nodexp-opensearch_shards_9200.timer)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9400.service (nrpe2nodexp-opensearch_shards_9400.service)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_shards_9400.timer (nrpe2nodexp-opensearch_shards_9400.timer)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9200.service (nrpe2nodexp-opensearch_unassigned_shard_check_9200.service)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer (nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9400.service (nrpe2nodexp-opensearch_unassigned_shard_check_9400.service)]", "Exec[systemd daemon-reload for nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer (nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer)]", "Exec[systemd daemon-reload for opensearch-disable-readahead-relforge-eqiad-small-alpha.service (opensearch-disable-readahead-relforge-eqiad-small-alpha.service)]", "Exec[systemd daemon-reload for opensearch-disable-readahead-relforge-eqiad-small-alpha.timer (opensearch-disable-readahead-relforge-eqiad-small-alpha.timer)]", "Exec[systemd daemon-reload for opensearch-disable-readahead-relforge-eqiad.service (opensearch-disable-readahead-relforge-eqiad.service)]", "Exec[systemd daemon-reload for opensearch-disable-readahead-relforge-eqiad.timer (opensearch-disable-readahead-relforge-eqiad.timer)]", "Exec[systemd daemon-reload for opensearch-disable-readahead.service (opensearch-disable-readahead.service)]", "Exec[systemd daemon-reload for opensearch-disable-readahead.timer (opensearch-disable-readahead.timer)]", "Exec[systemd daemon-reload for opensearch-hot-threads-log.service (opensearch-hot-threads-log.service)]", "Exec[systemd daemon-reload for opensearch-hot-threads-log.timer (opensearch-hot-threads-log.timer)]", "Exec[systemd daemon-reload for opensearch-relforge-eqiad-gc-log-cleanup.service (opensearch-relforge-eqiad-gc-log-cleanup.service)]", "Exec[systemd daemon-reload for opensearch-relforge-eqiad-gc-log-cleanup.timer (opensearch-relforge-eqiad-gc-log-cleanup.timer)]", "Exec[systemd daemon-reload for opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service (opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service)]", "Exec[systemd daemon-reload for opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer (opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer)]", "Exec[systemd daemon-reload for opensearch_1@.service (opensearch_1@.service)]", "Exec[systemd daemon-reload for prometheus-elasticsearch-exporter-9200.service (prometheus-elasticsearch-exporter-9200)]", "Exec[systemd daemon-reload for prometheus-elasticsearch-exporter-9400.service (prometheus-elasticsearch-exporter-9400)]", "Exec[systemd daemon-reload for prometheus-wmf-elasticsearch-exporter-9200.service (prometheus-wmf-elasticsearch-exporter-9200)]", "Exec[systemd daemon-reload for prometheus-wmf-elasticsearch-exporter-9400.service (prometheus-wmf-elasticsearch-exporter-9400)]", "Exec[systemd daemon-reload for push_cross_cluster_settings_9200.service (push_cross_cluster_settings_9200.service)]", "Exec[systemd daemon-reload for push_cross_cluster_settings_9200.timer (push_cross_cluster_settings_9200.timer)]", "Exec[systemd daemon-reload for push_cross_cluster_settings_9400.service (push_cross_cluster_settings_9400.service)]", "Exec[systemd daemon-reload for push_cross_cluster_settings_9400.timer (push_cross_cluster_settings_9400.timer)]", "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service (wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service)]", "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer (wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer)]", "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service (wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service)]", "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer (wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer)]", "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service (wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service)]", "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer (wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer)]", "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service (wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service)]", "Exec[systemd daemon-reload for wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer (wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer)]", "Exec[systemd reload for nginx systemd fragments]", "Exec[tlsproxy localssl default_server on ports [9243]]", "Exec[tlsproxy localssl default_server on ports [9443]]", "Exec[unmask_nginx.service]", "Exec[update_java_alternatives_17]", "Ferm::Service[elastic-main-https-9243]", "Ferm::Service[elastic-small-alpha-https-9443]", "Ferm::Service[opensearch-https-9243]", "Ferm::Service[opensearch-https-9443]", "Ferm::Service[opensearch_inter_node_9500]", "File[/etc/apt/sources.list.d/wikimedia-opensearch-plugins.list]", "File[/etc/apt/sources.list.d/wikimedia-opensearch.list]", "File[/etc/cfssl/csr/discovery2026__relforge1008_eqiad_wmnet.csr]", "File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet-key.pem]", "File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chain.pem]", "File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.chained.pem]", "File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.csr]", "File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet/discovery2026__relforge1008_eqiad_wmnet.pem]", "File[/etc/cfssl/ssl/discovery2026__relforge1008_eqiad_wmnet]", "File[/etc/default/logstash]", "File[/etc/default/opensearch]", "File[/etc/default/prometheus-elasticsearch-exporter]", "File[/etc/elasticsearch]", "File[/etc/ferm/conf.d/10_elastic-main-https-9243]", "File[/etc/ferm/conf.d/10_elastic-small-alpha-https-9443]", "File[/etc/ferm/conf.d/10_opensearch-https-9243]", "File[/etc/ferm/conf.d/10_opensearch-https-9443]", "File[/etc/ferm/conf.d/10_opensearch_inter_node_9500]", "File[/etc/logrotate.d/clean_up_dlq]", "File[/etc/logrotate.d/nginx]", "File[/etc/logrotate.d/opensearch-disable-readahead-relforge-eqiad-small-alpha]", "File[/etc/logrotate.d/opensearch-disable-readahead-relforge-eqiad]", "File[/etc/logrotate.d/opensearch-disable-readahead]", "File[/etc/logrotate.d/opensearch-relforge-eqiad-gc-log-cleanup]", "File[/etc/logrotate.d/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]", "File[/etc/logrotate.d/opensearch]", "File[/etc/logrotate.d/push_cross_cluster_settings_9200]", "File[/etc/logrotate.d/push_cross_cluster_settings_9400]", "File[/etc/logrotate.d/wmf_auto_restart_prometheus-elasticsearch-exporter-9200]", "File[/etc/logrotate.d/wmf_auto_restart_prometheus-elasticsearch-exporter-9400]", "File[/etc/logrotate.d/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]", "File[/etc/logrotate.d/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]", "File[/etc/logstash/conf.d/10-input-gelf-gelf_relay.conf]", "File[/etc/logstash/conf.d/90-output-udp-gelf_relay.conf]", "File[/etc/logstash/conf.d/README]", "File[/etc/logstash/jvm.options]", "File[/etc/logstash/log4j2.properties]", "File[/etc/logstash/logstash.yml]", "File[/etc/nagios/nrpe.d/check_check_push_cross_cluster_settings_9200_status.cfg]", "File[/etc/nagios/nrpe.d/check_check_push_cross_cluster_settings_9400_status.cfg]", "File[/etc/nagios/nrpe.d/check_opensearch_shard_size_check_9200.cfg]", "File[/etc/nagios/nrpe.d/check_opensearch_shard_size_check_9400.cfg]", "File[/etc/nagios/nrpe.d/check_opensearch_shards_9200.cfg]", "File[/etc/nagios/nrpe.d/check_opensearch_shards_9400.cfg]", "File[/etc/nagios/nrpe.d/check_opensearch_unassigned_shard_check_9200.cfg]", "File[/etc/nagios/nrpe.d/check_opensearch_unassigned_shard_check_9400.cfg]", "File[/etc/nginx/conf.d]", "File[/etc/nginx/nginx.conf]", "File[/etc/nginx/sites-available/relforge-eqiad-small-alpha]", "File[/etc/nginx/sites-available/relforge-eqiad]", "File[/etc/nginx/sites-available]", "File[/etc/nginx/sites-enabled/relforge-eqiad-small-alpha]", "File[/etc/nginx/sites-enabled/relforge-eqiad]", "File[/etc/nginx/sites-enabled]", "File[/etc/nginx]", "File[/etc/opensearch/instances]", "File[/etc/opensearch/relforge-eqiad-small-alpha/cirrus_check_settings.json]", "File[/etc/opensearch/relforge-eqiad-small-alpha/java-security.policy]", "File[/etc/opensearch/relforge-eqiad-small-alpha/jvm.options]", "File[/etc/opensearch/relforge-eqiad-small-alpha/log4j2.properties]", "File[/etc/opensearch/relforge-eqiad-small-alpha/logging.yml]", "File[/etc/opensearch/relforge-eqiad-small-alpha/opensearch.keystore]", "File[/etc/opensearch/relforge-eqiad-small-alpha/opensearch.yml]", "File[/etc/opensearch/relforge-eqiad-small-alpha/scripts]", "File[/etc/opensearch/relforge-eqiad-small-alpha]", "File[/etc/opensearch/relforge-eqiad/cirrus_check_settings.json]", "File[/etc/opensearch/relforge-eqiad/java-security.policy]", "File[/etc/opensearch/relforge-eqiad/jvm.options]", "File[/etc/opensearch/relforge-eqiad/log4j2.properties]", "File[/etc/opensearch/relforge-eqiad/logging.yml]", "File[/etc/opensearch/relforge-eqiad/opensearch.keystore]", "File[/etc/opensearch/relforge-eqiad/opensearch.yml]", "File[/etc/opensearch/relforge-eqiad/scripts]", "File[/etc/opensearch/relforge-eqiad]", "File[/etc/opensearch]", "File[/etc/opensearch_hot_threads.d/relforge-eqiad-small-alpha.yml]", "File[/etc/opensearch_hot_threads.d/relforge-eqiad.yml]", "File[/etc/opensearch_hot_threads.d]", "File[/etc/rsyslog.d/25-nrpe2nodexp-check-push-cross-cluster-settings-9200-status.conf]", "File[/etc/rsyslog.d/25-nrpe2nodexp-check-push-cross-cluster-settings-9400-status.conf]", "File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-shard-size-check-9200.conf]", "File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-shard-size-check-9400.conf]", "File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-shards-9200.conf]", "File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-shards-9400.conf]", "File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-unassigned-shard-check-9200.conf]", "File[/etc/rsyslog.d/25-nrpe2nodexp-opensearch-unassigned-shard-check-9400.conf]", "File[/etc/rsyslog.d/40-clean-up-dlq.conf]", "File[/etc/rsyslog.d/40-opensearch-disable-readahead-relforge-eqiad-small-alpha.conf]", "File[/etc/rsyslog.d/40-opensearch-disable-readahead-relforge-eqiad.conf]", "File[/etc/rsyslog.d/40-opensearch-disable-readahead.conf]", "File[/etc/rsyslog.d/40-opensearch-relforge-eqiad-gc-log-cleanup.conf]", "File[/etc/rsyslog.d/40-opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.conf]", "File[/etc/rsyslog.d/40-push-cross-cluster-settings-9200.conf]", "File[/etc/rsyslog.d/40-push-cross-cluster-settings-9400.conf]", "File[/etc/rsyslog.d/40-wmf-auto-restart-prometheus-elasticsearch-exporter-9200.conf]", "File[/etc/rsyslog.d/40-wmf-auto-restart-prometheus-elasticsearch-exporter-9400.conf]", "File[/etc/rsyslog.d/40-wmf-auto-restart-prometheus-wmf-elasticsearch-exporter-9200.conf]", "File[/etc/rsyslog.d/40-wmf-auto-restart-prometheus-wmf-elasticsearch-exporter-9400.conf]", "File[/etc/rsyslog.d/50-udp-json-logback-compat.conf]", "File[/etc/ssl/dhparam.pem]", "File[/etc/sudoers.d/nrpe-check_check_push_cross_cluster_settings_9200_status]", "File[/etc/sudoers.d/nrpe-check_check_push_cross_cluster_settings_9400_status]", "File[/etc/sudoers.d/nrpe-check_opensearch_shard_size_check_9200]", "File[/etc/sudoers.d/nrpe-check_opensearch_shard_size_check_9400]", "File[/etc/sudoers.d/nrpe-check_opensearch_shards_9200]", "File[/etc/sudoers.d/nrpe-check_opensearch_shards_9400]", "File[/etc/sudoers.d/nrpe-check_opensearch_unassigned_shard_check_9200]", "File[/etc/sudoers.d/nrpe-check_opensearch_unassigned_shard_check_9400]", "File[/etc/sysctl.d/70-TCP-Fast-Open.conf]", "File[/etc/sysctl.d/opensearch.conf]", "File[/etc/systemd/system/nginx.service.d/numa.conf]", "File[/etc/systemd/system/nginx.service.d/security.conf]", "File[/etc/systemd/system/nginx.service.d]", "File[/etc/tmpfiles.d/opensearch-relforge-eqiad-small-alpha.conf]", "File[/etc/tmpfiles.d/opensearch-relforge-eqiad.conf]", "File[/etc/udev/rules.d/40-opensearch-readahead.rules]", "File[/etc/update-motd.d/05-cirrus--relforge]", "File[/etc/update-motd.d/96-cluster-memberships]", "File[/lib/systemd/system/clean_up_dlq.service]", "File[/lib/systemd/system/clean_up_dlq.timer]", "File[/lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service]", "File[/lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer]", "File[/lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service]", "File[/lib/systemd/system/nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9200.service]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9200.timer]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9400.service]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_shard_size_check_9400.timer]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_shards_9200.service]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_shards_9200.timer]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_shards_9400.service]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_shards_9400.timer]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9200.service]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9400.service]", "File[/lib/systemd/system/nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer]", "File[/lib/systemd/system/opensearch-disable-readahead-relforge-eqiad-small-alpha.service]", "File[/lib/systemd/system/opensearch-disable-readahead-relforge-eqiad-small-alpha.timer]", "File[/lib/systemd/system/opensearch-disable-readahead-relforge-eqiad.service]", "File[/lib/systemd/system/opensearch-disable-readahead-relforge-eqiad.timer]", "File[/lib/systemd/system/opensearch-disable-readahead.service]", "File[/lib/systemd/system/opensearch-disable-readahead.timer]", "File[/lib/systemd/system/opensearch-hot-threads-log.service]", "File[/lib/systemd/system/opensearch-hot-threads-log.timer]", "File[/lib/systemd/system/opensearch-relforge-eqiad-gc-log-cleanup.service]", "File[/lib/systemd/system/opensearch-relforge-eqiad-gc-log-cleanup.timer]", "File[/lib/systemd/system/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service]", "File[/lib/systemd/system/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer]", "File[/lib/systemd/system/opensearch_1@.service]", "File[/lib/systemd/system/prometheus-elasticsearch-exporter-9200.service]", "File[/lib/systemd/system/prometheus-elasticsearch-exporter-9400.service]", "File[/lib/systemd/system/prometheus-wmf-elasticsearch-exporter-9200.service]", "File[/lib/systemd/system/prometheus-wmf-elasticsearch-exporter-9400.service]", "File[/lib/systemd/system/push_cross_cluster_settings_9200.service]", "File[/lib/systemd/system/push_cross_cluster_settings_9200.timer]", "File[/lib/systemd/system/push_cross_cluster_settings_9400.service]", "File[/lib/systemd/system/push_cross_cluster_settings_9400.timer]", "File[/lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service]", "File[/lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer]", "File[/lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service]", "File[/lib/systemd/system/wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer]", "File[/lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service]", "File[/lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer]", "File[/lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service]", "File[/lib/systemd/system/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer]", "File[/srv/opensearch/relforge-eqiad-small-alpha]", "File[/srv/opensearch/relforge-eqiad]", "File[/srv/opensearch]", "File[/usr/lib/nagios/plugins/check_elasticsearch.py]", "File[/usr/lib/nagios/plugins/check_elasticsearch]", "File[/usr/lib/nagios/plugins/check_elasticsearch_shard_size.py]", "File[/usr/lib/nagios/plugins/check_elasticsearch_unassigned_shards.py]", "File[/usr/local/bin/cleanup-dlq]", "File[/usr/local/bin/jheapdump]", "File[/usr/local/bin/logstash-config-test]", "File[/usr/local/bin/opensearch-disable-readahead.sh]", "File[/usr/local/bin/opensearch_hot_threads_logger.py]", "File[/usr/local/bin/prometheus-wmf-elasticsearch-exporter]", "File[/usr/local/bin/set-cross-cluster-seeds_9200.sh]", "File[/usr/local/bin/set-cross-cluster-seeds_9400.sh]", "File[/usr/local/lib/nagios/plugins/check_systemd_unit_status]", "File[/usr/share/opensearch/plugins]", "File[/var/lib/nginx]", "File[/var/lib/prometheus/node.d/check_check_push_cross_cluster_settings_9200_status.prom]", "File[/var/lib/prometheus/node.d/check_check_push_cross_cluster_settings_9400_status.prom]", "File[/var/lib/prometheus/node.d/check_opensearch_shard_size_check_9200.prom]", "File[/var/lib/prometheus/node.d/check_opensearch_shard_size_check_9400.prom]", "File[/var/lib/prometheus/node.d/check_opensearch_shards_9200.prom]", "File[/var/lib/prometheus/node.d/check_opensearch_shards_9400.prom]", "File[/var/lib/prometheus/node.d/check_opensearch_unassigned_shard_check_9200.prom]", "File[/var/lib/prometheus/node.d/check_opensearch_unassigned_shard_check_9400.prom]", "File[/var/log/clean_up_dlq]", "File[/var/log/opensearch-disable-readahead-relforge-eqiad-small-alpha]", "File[/var/log/opensearch-disable-readahead-relforge-eqiad]", "File[/var/log/opensearch-disable-readahead]", "File[/var/log/opensearch-relforge-eqiad-gc-log-cleanup]", "File[/var/log/opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]", "File[/var/log/opensearch/opensearch.log]", "File[/var/log/opensearch/opensearch_index_indexing_slowlog.log]", "File[/var/log/opensearch/opensearch_index_search_slowlog.log]", "File[/var/log/opensearch]", "File[/var/log/push_cross_cluster_settings_9200]", "File[/var/log/push_cross_cluster_settings_9400]", "File[/var/log/wmf_auto_restart_prometheus-elasticsearch-exporter-9200]", "File[/var/log/wmf_auto_restart_prometheus-elasticsearch-exporter-9400]", "File[/var/log/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]", "File[/var/log/wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]", "File_line[auto_restart_file_presence_prometheus-elasticsearch-exporter-9200]", "File_line[auto_restart_file_presence_prometheus-elasticsearch-exporter-9400]", "File_line[auto_restart_file_presence_prometheus-wmf-elasticsearch-exporter-9200]", "File_line[auto_restart_file_presence_prometheus-wmf-elasticsearch-exporter-9400]", "File_line[opensearch_bin_bashrc]", "Firewall::Service[opensearch-inter-node-9500]", "Java::Cacert[wmf:Wikimedia_Internal_Root_CA]", "Java::Cacert[wmf:puppetca.pem]", "Java::Package[openjdk-jdk-17]", "Logrotate::Conf[clean_up_dlq]", "Logrotate::Conf[nginx]", "Logrotate::Conf[opensearch-disable-readahead-relforge-eqiad-small-alpha]", "Logrotate::Conf[opensearch-disable-readahead-relforge-eqiad]", "Logrotate::Conf[opensearch-disable-readahead]", "Logrotate::Conf[opensearch-relforge-eqiad-gc-log-cleanup]", "Logrotate::Conf[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]", "Logrotate::Conf[opensearch]", "Logrotate::Conf[push_cross_cluster_settings_9200]", "Logrotate::Conf[push_cross_cluster_settings_9400]", "Logrotate::Conf[wmf_auto_restart_prometheus-elasticsearch-exporter-9200]", "Logrotate::Conf[wmf_auto_restart_prometheus-elasticsearch-exporter-9400]", "Logrotate::Conf[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]", "Logrotate::Conf[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]", "Logrotate::Rule[opensearch]", "Logstash::Conf[input-gelf-gelf_relay]", "Logstash::Conf[output-udp-gelf_relay]", "Logstash::Input::Gelf[gelf_relay]", "Logstash::Output::Udp[gelf_relay]", "Monitoring::Exported_nagios_service[relforge1008 check_push_cross_cluster_settings_9200_status]", "Monitoring::Exported_nagios_service[relforge1008 check_push_cross_cluster_settings_9400_status]", "Monitoring::Exported_nagios_service[relforge1008 elasticsearch-https-relforge-eqiad-small-alpha]", "Monitoring::Exported_nagios_service[relforge1008 elasticsearch-https-relforge-eqiad]", "Monitoring::Exported_nagios_service[relforge1008 opensearch_shard_size_check_9200]", "Monitoring::Exported_nagios_service[relforge1008 opensearch_shard_size_check_9400]", "Monitoring::Exported_nagios_service[relforge1008 opensearch_shards_9200]", "Monitoring::Exported_nagios_service[relforge1008 opensearch_shards_9400]", "Monitoring::Exported_nagios_service[relforge1008 opensearch_unassigned_shard_check_9200]", "Monitoring::Exported_nagios_service[relforge1008 opensearch_unassigned_shard_check_9400]", "Monitoring::Service[check_push_cross_cluster_settings_9200_status]", "Monitoring::Service[check_push_cross_cluster_settings_9400_status]", "Monitoring::Service[elasticsearch-https-relforge-eqiad-small-alpha]", "Monitoring::Service[elasticsearch-https-relforge-eqiad]", "Monitoring::Service[opensearch_shard_size_check_9200]", "Monitoring::Service[opensearch_shard_size_check_9400]", "Monitoring::Service[opensearch_shards_9200]", "Monitoring::Service[opensearch_shards_9400]", "Monitoring::Service[opensearch_unassigned_shard_check_9200]", "Monitoring::Service[opensearch_unassigned_shard_check_9400]", "Motd::Message[cirrus::relforge]", "Motd::Script[cirrus::relforge]", "Motd::Script[cluster_memberships]", "Mount[/var/lib/nginx]", "Nginx::Site[relforge-eqiad-small-alpha]", "Nginx::Site[relforge-eqiad]", "Nrpe::Check[check_check_push_cross_cluster_settings_9200_status]", "Nrpe::Check[check_check_push_cross_cluster_settings_9400_status]", "Nrpe::Check[check_opensearch_shard_size_check_9200]", "Nrpe::Check[check_opensearch_shard_size_check_9400]", "Nrpe::Check[check_opensearch_shards_9200]", "Nrpe::Check[check_opensearch_shards_9400]", "Nrpe::Check[check_opensearch_unassigned_shard_check_9200]", "Nrpe::Check[check_opensearch_unassigned_shard_check_9400]", "Nrpe::Monitor_service[check_push_cross_cluster_settings_9200_status]", "Nrpe::Monitor_service[check_push_cross_cluster_settings_9400_status]", "Nrpe::Monitor_service[opensearch_shard_size_check_9200]", "Nrpe::Monitor_service[opensearch_shard_size_check_9400]", "Nrpe::Monitor_service[opensearch_shards_9200]", "Nrpe::Monitor_service[opensearch_shards_9400]", "Nrpe::Monitor_service[opensearch_unassigned_shard_check_9200]", "Nrpe::Monitor_service[opensearch_unassigned_shard_check_9400]", "Nrpe::Plugin[check_systemd_unit_status]", "Opensearch::Cross_cluster_settings[relforge-eqiad-small-alpha]", "Opensearch::Cross_cluster_settings[relforge-eqiad]", "Opensearch::Instance[relforge-eqiad-small-alpha]", "Opensearch::Instance[relforge-eqiad]", "Opensearch::Keystore[s3-credentials-user-relforge-eqiad-small-alpha]", "Opensearch::Keystore[s3-credentials-user-relforge-eqiad]", "Opensearch::Log::Hot_threads_cluster[relforge-eqiad-small-alpha]", "Opensearch::Log::Hot_threads_cluster[relforge-eqiad]", "Package[edac-utils]", "Package[logstash-old-name]", "Package[logstash-oss]", "Package[nginx-common]", "Package[nginx-light]", "Package[openjdk-17-jdk]", "Package[opensearch-madvise]", "Package[opensearch]", "Package[prometheus-elasticsearch-exporter]", "Package[python3-requests]", "Package[wmf-opensearch-search-plugins]", "Profile::Auto_restarts::Service[prometheus-elasticsearch-exporter-9200]", "Profile::Auto_restarts::Service[prometheus-elasticsearch-exporter-9400]", "Profile::Auto_restarts::Service[prometheus-wmf-elasticsearch-exporter-9200]", "Profile::Auto_restarts::Service[prometheus-wmf-elasticsearch-exporter-9400]", "Profile::Prometheus::Elasticsearch_exporter[relforge1008:9200]", "Profile::Prometheus::Elasticsearch_exporter[relforge1008:9400]", "Profile::Prometheus::Wmf_elasticsearch_exporter[relforge1008:9200]", "Profile::Prometheus::Wmf_elasticsearch_exporter[relforge1008:9400]", "Prometheus::Alert::Rule[check_check_push_cross_cluster_settings_9200_status_379fbc6cbce5b297397c866a15729f1a]", "Prometheus::Alert::Rule[check_check_push_cross_cluster_settings_9400_status_de4a199c43946c09f819ca4ffea40ac0]", "Prometheus::Alert::Rule[check_opensearch_shard_size_check_9200_c62725841c61e20ac3f6819b4c0ad800]", "Prometheus::Alert::Rule[check_opensearch_shard_size_check_9400_aefe2d8b10db3bc84662052af1e20008]", "Prometheus::Alert::Rule[check_opensearch_shards_9200_fd6eadf747c645a72e11bd74109a8156]", "Prometheus::Alert::Rule[check_opensearch_shards_9400_2a63eb7dcbe368b7f538118765d629d6]", "Prometheus::Alert::Rule[check_opensearch_unassigned_shard_check_9200_54ca99505516d5452912b573aa7d35d3]", "Prometheus::Alert::Rule[check_opensearch_unassigned_shard_check_9400_a0a4892478c289e50484ffd2fb4c3202]", "Prometheus::Elasticsearch_exporter[localhost:9200]", "Prometheus::Elasticsearch_exporter[localhost:9400]", "Prometheus::Wmf_elasticsearch_exporter[relforge1008:9200]", "Prometheus::Wmf_elasticsearch_exporter[relforge1008:9400]", "Rsyslog::Conf[clean_up_dlq]", "Rsyslog::Conf[nrpe2nodexp-check_push_cross_cluster_settings_9200_status]", "Rsyslog::Conf[nrpe2nodexp-check_push_cross_cluster_settings_9400_status]", "Rsyslog::Conf[nrpe2nodexp-opensearch_shard_size_check_9200]", "Rsyslog::Conf[nrpe2nodexp-opensearch_shard_size_check_9400]", "Rsyslog::Conf[nrpe2nodexp-opensearch_shards_9200]", "Rsyslog::Conf[nrpe2nodexp-opensearch_shards_9400]", "Rsyslog::Conf[nrpe2nodexp-opensearch_unassigned_shard_check_9200]", "Rsyslog::Conf[nrpe2nodexp-opensearch_unassigned_shard_check_9400]", "Rsyslog::Conf[opensearch-disable-readahead-relforge-eqiad-small-alpha]", "Rsyslog::Conf[opensearch-disable-readahead-relforge-eqiad]", "Rsyslog::Conf[opensearch-disable-readahead]", "Rsyslog::Conf[opensearch-relforge-eqiad-gc-log-cleanup]", "Rsyslog::Conf[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]", "Rsyslog::Conf[push_cross_cluster_settings_9200]", "Rsyslog::Conf[push_cross_cluster_settings_9400]", "Rsyslog::Conf[udp_json_logback_compat]", "Rsyslog::Conf[wmf_auto_restart_prometheus-elasticsearch-exporter-9200]", "Rsyslog::Conf[wmf_auto_restart_prometheus-elasticsearch-exporter-9400]", "Rsyslog::Conf[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]", "Rsyslog::Conf[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]", "Service[clean_up_dlq.timer]", "Service[logstash]", "Service[nginx]", "Service[nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer]", "Service[nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer]", "Service[nrpe2nodexp-opensearch_shard_size_check_9200.timer]", "Service[nrpe2nodexp-opensearch_shard_size_check_9400.timer]", "Service[nrpe2nodexp-opensearch_shards_9200.timer]", "Service[nrpe2nodexp-opensearch_shards_9400.timer]", "Service[nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer]", "Service[nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer]", "Service[opensearch-disable-readahead-relforge-eqiad-small-alpha.timer]", "Service[opensearch-disable-readahead-relforge-eqiad.timer]", "Service[opensearch-disable-readahead.timer]", "Service[opensearch-hot-threads-log.timer]", "Service[opensearch-relforge-eqiad-gc-log-cleanup.timer]", "Service[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer]", "Service[opensearch]", "Service[opensearch_1@relforge-eqiad-small-alpha]", "Service[opensearch_1@relforge-eqiad]", "Service[prometheus-elasticsearch-exporter-9200]", "Service[prometheus-elasticsearch-exporter-9400]", "Service[prometheus-elasticsearch-exporter]", "Service[prometheus-wmf-elasticsearch-exporter-9200]", "Service[prometheus-wmf-elasticsearch-exporter-9400]", "Service[push_cross_cluster_settings_9200.timer]", "Service[push_cross_cluster_settings_9400.timer]", "Service[wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer]", "Service[wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer]", "Service[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer]", "Service[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer]", "Sudo::User[nrpe-check_check_push_cross_cluster_settings_9200_status]", "Sudo::User[nrpe-check_check_push_cross_cluster_settings_9400_status]", "Sudo::User[nrpe-check_opensearch_shard_size_check_9200]", "Sudo::User[nrpe-check_opensearch_shard_size_check_9400]", "Sudo::User[nrpe-check_opensearch_shards_9200]", "Sudo::User[nrpe-check_opensearch_shards_9400]", "Sudo::User[nrpe-check_opensearch_unassigned_shard_check_9200]", "Sudo::User[nrpe-check_opensearch_unassigned_shard_check_9400]", "Sysctl::Conffile[TCP Fast Open]", "Sysctl::Conffile[opensearch]", "Sysctl::Parameters[TCP Fast Open]", "Sysctl::Parameters[opensearch]", "Systemd::Mask[nginx.service]", "Systemd::Monitor[push_cross_cluster_settings_9200]", "Systemd::Monitor[push_cross_cluster_settings_9400]", "Systemd::Service[clean_up_dlq]", "Systemd::Service[nrpe2nodexp-check_push_cross_cluster_settings_9200_status]", "Systemd::Service[nrpe2nodexp-check_push_cross_cluster_settings_9400_status]", "Systemd::Service[nrpe2nodexp-opensearch_shard_size_check_9200]", "Systemd::Service[nrpe2nodexp-opensearch_shard_size_check_9400]", "Systemd::Service[nrpe2nodexp-opensearch_shards_9200]", "Systemd::Service[nrpe2nodexp-opensearch_shards_9400]", "Systemd::Service[nrpe2nodexp-opensearch_unassigned_shard_check_9200]", "Systemd::Service[nrpe2nodexp-opensearch_unassigned_shard_check_9400]", "Systemd::Service[opensearch-disable-readahead-relforge-eqiad-small-alpha]", "Systemd::Service[opensearch-disable-readahead-relforge-eqiad]", "Systemd::Service[opensearch-disable-readahead]", "Systemd::Service[opensearch-hot-threads-log]", "Systemd::Service[opensearch-relforge-eqiad-gc-log-cleanup]", "Systemd::Service[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]", "Systemd::Service[prometheus-elasticsearch-exporter-9200]", "Systemd::Service[prometheus-elasticsearch-exporter-9400]", "Systemd::Service[prometheus-wmf-elasticsearch-exporter-9200]", "Systemd::Service[prometheus-wmf-elasticsearch-exporter-9400]", "Systemd::Service[push_cross_cluster_settings_9200]", "Systemd::Service[push_cross_cluster_settings_9400]", "Systemd::Service[wmf_auto_restart_prometheus-elasticsearch-exporter-9200]", "Systemd::Service[wmf_auto_restart_prometheus-elasticsearch-exporter-9400]", "Systemd::Service[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]", "Systemd::Service[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]", "Systemd::Syslog[clean_up_dlq]", "Systemd::Syslog[opensearch-disable-readahead-relforge-eqiad-small-alpha]", "Systemd::Syslog[opensearch-disable-readahead-relforge-eqiad]", "Systemd::Syslog[opensearch-disable-readahead]", "Systemd::Syslog[opensearch-relforge-eqiad-gc-log-cleanup]", "Systemd::Syslog[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]", "Systemd::Syslog[push_cross_cluster_settings_9200]", "Systemd::Syslog[push_cross_cluster_settings_9400]", "Systemd::Syslog[wmf_auto_restart_prometheus-elasticsearch-exporter-9200]", "Systemd::Syslog[wmf_auto_restart_prometheus-elasticsearch-exporter-9400]", "Systemd::Syslog[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]", "Systemd::Syslog[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]", "Systemd::Timer::Job[clean_up_dlq]", "Systemd::Timer::Job[nrpe2nodexp-check_push_cross_cluster_settings_9200_status]", "Systemd::Timer::Job[nrpe2nodexp-check_push_cross_cluster_settings_9400_status]", "Systemd::Timer::Job[nrpe2nodexp-opensearch_shard_size_check_9200]", "Systemd::Timer::Job[nrpe2nodexp-opensearch_shard_size_check_9400]", "Systemd::Timer::Job[nrpe2nodexp-opensearch_shards_9200]", "Systemd::Timer::Job[nrpe2nodexp-opensearch_shards_9400]", "Systemd::Timer::Job[nrpe2nodexp-opensearch_unassigned_shard_check_9200]", "Systemd::Timer::Job[nrpe2nodexp-opensearch_unassigned_shard_check_9400]", "Systemd::Timer::Job[opensearch-disable-readahead-relforge-eqiad-small-alpha]", "Systemd::Timer::Job[opensearch-disable-readahead-relforge-eqiad]", "Systemd::Timer::Job[opensearch-disable-readahead]", "Systemd::Timer::Job[opensearch-hot-threads-log]", "Systemd::Timer::Job[opensearch-relforge-eqiad-gc-log-cleanup]", "Systemd::Timer::Job[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]", "Systemd::Timer::Job[push_cross_cluster_settings_9200]", "Systemd::Timer::Job[push_cross_cluster_settings_9400]", "Systemd::Timer::Job[wmf_auto_restart_prometheus-elasticsearch-exporter-9200]", "Systemd::Timer::Job[wmf_auto_restart_prometheus-elasticsearch-exporter-9400]", "Systemd::Timer::Job[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]", "Systemd::Timer::Job[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]", "Systemd::Timer[clean_up_dlq]", "Systemd::Timer[nrpe2nodexp-check_push_cross_cluster_settings_9200_status]", "Systemd::Timer[nrpe2nodexp-check_push_cross_cluster_settings_9400_status]", "Systemd::Timer[nrpe2nodexp-opensearch_shard_size_check_9200]", "Systemd::Timer[nrpe2nodexp-opensearch_shard_size_check_9400]", "Systemd::Timer[nrpe2nodexp-opensearch_shards_9200]", "Systemd::Timer[nrpe2nodexp-opensearch_shards_9400]", "Systemd::Timer[nrpe2nodexp-opensearch_unassigned_shard_check_9200]", "Systemd::Timer[nrpe2nodexp-opensearch_unassigned_shard_check_9400]", "Systemd::Timer[opensearch-disable-readahead-relforge-eqiad-small-alpha]", "Systemd::Timer[opensearch-disable-readahead-relforge-eqiad]", "Systemd::Timer[opensearch-disable-readahead]", "Systemd::Timer[opensearch-hot-threads-log]", "Systemd::Timer[opensearch-relforge-eqiad-gc-log-cleanup]", "Systemd::Timer[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup]", "Systemd::Timer[push_cross_cluster_settings_9200]", "Systemd::Timer[push_cross_cluster_settings_9400]", "Systemd::Timer[wmf_auto_restart_prometheus-elasticsearch-exporter-9200]", "Systemd::Timer[wmf_auto_restart_prometheus-elasticsearch-exporter-9400]", "Systemd::Timer[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200]", "Systemd::Timer[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400]", "Systemd::Tmpfile[opensearch-relforge-eqiad-small-alpha]", "Systemd::Tmpfile[opensearch-relforge-eqiad]", "Systemd::Unit[clean_up_dlq.service]", "Systemd::Unit[clean_up_dlq.timer]", "Systemd::Unit[nrpe2nodexp-check_push_cross_cluster_settings_9200_status.service]", "Systemd::Unit[nrpe2nodexp-check_push_cross_cluster_settings_9200_status.timer]", "Systemd::Unit[nrpe2nodexp-check_push_cross_cluster_settings_9400_status.service]", "Systemd::Unit[nrpe2nodexp-check_push_cross_cluster_settings_9400_status.timer]", "Systemd::Unit[nrpe2nodexp-opensearch_shard_size_check_9200.service]", "Systemd::Unit[nrpe2nodexp-opensearch_shard_size_check_9200.timer]", "Systemd::Unit[nrpe2nodexp-opensearch_shard_size_check_9400.service]", "Systemd::Unit[nrpe2nodexp-opensearch_shard_size_check_9400.timer]", "Systemd::Unit[nrpe2nodexp-opensearch_shards_9200.service]", "Systemd::Unit[nrpe2nodexp-opensearch_shards_9200.timer]", "Systemd::Unit[nrpe2nodexp-opensearch_shards_9400.service]", "Systemd::Unit[nrpe2nodexp-opensearch_shards_9400.timer]", "Systemd::Unit[nrpe2nodexp-opensearch_unassigned_shard_check_9200.service]", "Systemd::Unit[nrpe2nodexp-opensearch_unassigned_shard_check_9200.timer]", "Systemd::Unit[nrpe2nodexp-opensearch_unassigned_shard_check_9400.service]", "Systemd::Unit[nrpe2nodexp-opensearch_unassigned_shard_check_9400.timer]", "Systemd::Unit[opensearch-disable-readahead-relforge-eqiad-small-alpha.service]", "Systemd::Unit[opensearch-disable-readahead-relforge-eqiad-small-alpha.timer]", "Systemd::Unit[opensearch-disable-readahead-relforge-eqiad.service]", "Systemd::Unit[opensearch-disable-readahead-relforge-eqiad.timer]", "Systemd::Unit[opensearch-disable-readahead.service]", "Systemd::Unit[opensearch-disable-readahead.timer]", "Systemd::Unit[opensearch-hot-threads-log.service]", "Systemd::Unit[opensearch-hot-threads-log.timer]", "Systemd::Unit[opensearch-relforge-eqiad-gc-log-cleanup.service]", "Systemd::Unit[opensearch-relforge-eqiad-gc-log-cleanup.timer]", "Systemd::Unit[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.service]", "Systemd::Unit[opensearch-relforge-eqiad-small-alpha-gc-log-cleanup.timer]", "Systemd::Unit[opensearch_1@.service]", "Systemd::Unit[prometheus-elasticsearch-exporter-9200]", "Systemd::Unit[prometheus-elasticsearch-exporter-9400]", "Systemd::Unit[prometheus-wmf-elasticsearch-exporter-9200]", "Systemd::Unit[prometheus-wmf-elasticsearch-exporter-9400]", "Systemd::Unit[push_cross_cluster_settings_9200.service]", "Systemd::Unit[push_cross_cluster_settings_9200.timer]", "Systemd::Unit[push_cross_cluster_settings_9400.service]", "Systemd::Unit[push_cross_cluster_settings_9400.timer]", "Systemd::Unit[wmf_auto_restart_prometheus-elasticsearch-exporter-9200.service]", "Systemd::Unit[wmf_auto_restart_prometheus-elasticsearch-exporter-9200.timer]", "Systemd::Unit[wmf_auto_restart_prometheus-elasticsearch-exporter-9400.service]", "Systemd::Unit[wmf_auto_restart_prometheus-elasticsearch-exporter-9400.timer]", "Systemd::Unit[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.service]", "Systemd::Unit[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9200.timer]", "Systemd::Unit[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.service]", "Systemd::Unit[wmf_auto_restart_prometheus-wmf-elasticsearch-exporter-9400.timer]", "Systemd::Unmask[nginx.service]", "Tlsproxy::Localssl[relforge-eqiad-small-alpha]", "Tlsproxy::Localssl[relforge-eqiad]", "Udev::Rule[opensearch-readahead]"], "resource_diffs": [{"resource": "Class[Profile::Apt]", "parameters": "--- Class[Profile::Apt].orig\n+++ Class[Profile::Apt]\n\n@@\n-    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[prometheus-ethtool-exporter]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[libicu67]', 'Package[libwsutil12]', 'Package[libwireshark14]', 'Package[libopencsd0]', 'Package[libwiretap11]', 'Package[ruby2.7]', 'Package[python3.9-minimal]', 'Package[python3.9]', 'Package[perl-modules-5.32]', 'Package[libpython3.9]', 'Package[libperl5.32]', 'Package[libpython3.9-minimal]', 'Package[libpython3.9-stdlib]', 'Package[libidn11]', 'Package[libldap-2.4-2]', 'Package[liburing1]', 'Package[libwebp6]', 'Package[libcbor0]', 'Package[libusb-0.1-4]', 'Package[telnet]', 'Package[libruby2.7]', 'Package[libdns-export1110]', 'Package[libisc-export1105]', 'Package[libbpf0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[ulogd2]', 'Package[conntrack]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]']\n+    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[prometheus-ethtool-exporter]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[libicu67]', 'Package[libwsutil12]', 'Package[libwireshark14]', 'Package[libopencsd0]', 'Package[libwiretap11]', 'Package[ruby2.7]', 'Package[python3.9-minimal]', 'Package[python3.9]', 'Package[perl-modules-5.32]', 'Package[libpython3.9]', 'Package[libperl5.32]', 'Package[libpython3.9-minimal]', 'Package[libpython3.9-stdlib]', 'Package[libidn11]', 'Package[libldap-2.4-2]', 'Package[liburing1]', 'Package[libwebp6]', 'Package[libcbor0]', 'Package[libusb-0.1-4]', 'Package[telnet]', 'Package[libruby2.7]', 'Package[libdns-export1110]', 'Package[libisc-export1105]', 'Package[libbpf0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[ulogd2]', 'Package[conntrack]', 'Package[edac-utils]', 'Package[opensearch]', 'Package[python3-requests]', 'Package[wmf-opensearch-search-plugins]', 'Package[opensearch-madvise]', 'Package[logstash-oss]', 'Package[logstash-old-name]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]', 'Package[openjdk-17-jdk]', 'Package[prometheus-elasticsearch-exporter]', 'Package[nginx-light]', 'Package[nginx-common]']\n"}, {"resource": "Class[Profile::Base::Production]", "parameters": "--- Class[Profile::Base::Production].orig\n+++ Class[Profile::Base::Production]\n\n@@\n-    role_description => Unpuppetised system for testing\n+    role_description => Elasticsearch relforge\n"}, {"resource": "Ferm::Service[opensearch_inter_node_9300]", "parameters": "--- Ferm::Service[opensearch_inter_node_9300].orig\n+++ Ferm::Service[opensearch_inter_node_9300]\n\n@@\n-    notrack => False\n+    notrack => True\n@@\n-    port    => [9300]\n+    port    => 9300\n"}, {"resource": "Firewall::Service[opensearch-inter-node-9300]", "parameters": "--- Firewall::Service[opensearch-inter-node-9300].orig\n+++ Firewall::Service[opensearch-inter-node-9300]\n\n@@\n-    notrack => False\n+    notrack => True\n@@\n-    port    => [9300]\n+    port    => 9300\n"}, {"resource": "Concat::Fragment[main contacts]"}, {"resource": "Nrpe::Monitor_service[disk_space]", "parameters": "--- Nrpe::Monitor_service[disk_space].orig\n+++ Nrpe::Monitor_service[disk_space]\n\n@@\n-    nrpe_command => /usr/lib/nagios/plugins/check_disk -w 6% -c 3% -W 6% -K 3% -l -e -A -i \"/srv/sd[a-b][1-3]\" -i \"/srv/nvme[0-9]n[0-9]p[0-9]\" --exclude-type=fuse --exclude-type=fuse.fuse_dfs --exclude-type=tracefs\n+    nrpe_command => /usr/lib/nagios/plugins/check_disk -w 15% -c 10% -W 6% -K 3% -l -e -A -i \"/srv/sd[a-b][1-3]\" --exclude-type=tracefs\n"}, {"resource": "Class[Profile::Monitoring]", "parameters": "--- Class[Profile::Monitoring].orig\n+++ Class[Profile::Monitoring]\n\n@@\n-    nrpe_check_disk_options => -w 6% -c 3% -W 6% -K 3% -l -e -A -i \"/srv/sd[a-b][1-3]\" -i \"/srv/nvme[0-9]n[0-9]p[0-9]\" --exclude-type=fuse --exclude-type=fuse.fuse_dfs --exclude-type=tracefs\n+    nrpe_check_disk_options => -w 15% -c 10% -W 6% -K 3% -l -e -A -i \"/srv/sd[a-b][1-3]\" --exclude-type=tracefs\n"}, {"resource": "Class[Adduser]", "parameters": "--- Class[Adduser].orig\n+++ Class[Adduser]\n\n@@\n-    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[prometheus-ethtool-exporter]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[libicu67]', 'Package[libwsutil12]', 'Package[libwireshark14]', 'Package[libopencsd0]', 'Package[libwiretap11]', 'Package[ruby2.7]', 'Package[python3.9-minimal]', 'Package[python3.9]', 'Package[perl-modules-5.32]', 'Package[libpython3.9]', 'Package[libperl5.32]', 'Package[libpython3.9-minimal]', 'Package[libpython3.9-stdlib]', 'Package[libidn11]', 'Package[libldap-2.4-2]', 'Package[liburing1]', 'Package[libwebp6]', 'Package[libcbor0]', 'Package[libusb-0.1-4]', 'Package[telnet]', 'Package[libruby2.7]', 'Package[libdns-export1110]', 'Package[libisc-export1105]', 'Package[libbpf0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[ulogd2]', 'Package[conntrack]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]']\n+    before => ['Package[puppet]', 'Package[facter]', 'Package[augeas-tools]', 'Package[virt-what]', 'Package[puppet-module-puppetlabs-augeas-core]', 'Package[python3-prometheus-client]', 'Package[python3-yaml]', 'Package[ruby-net-ssh]', 'Package[openssl]', 'Package[ssl-cert]', 'Package[ca-certificates]', 'Package[wmf-certificates]', 'Package[ntp]', 'Package[systemd-timesyncd]', 'Package[exim4-config]', 'Package[exim4-daemon-light]', 'Package[logrotate]', 'Package[prometheus-node-exporter]', 'Package[bsdutils]', 'Package[smartmontools]', 'Package[rsyslog]', 'Package[rsyslog-openssl]', 'Package[cadvisor]', 'Package[prometheus-ethtool-exporter]', 'Package[acct]', 'Package[byobu]', 'Package[colordiff]', 'Package[curl]', 'Package[debian-goodies]', 'Package[ethtool]', 'Package[gdb]', 'Package[gdisk]', 'Package[git]', 'Package[htop]', 'Package[httpry]', 'Package[iotop]', 'Package[iperf]', 'Package[jq]', 'Package[libtemplate-perl]', 'Package[lldpd]', 'Package[lshw]', 'Package[molly-guard]', 'Package[moreutils]', 'Package[net-tools]', 'Package[numactl]', 'Package[ncdu]', 'Package[ngrep]', 'Package[pigz]', 'Package[psmisc]', 'Package[pv]', 'Package[python3]', 'Package[screen]', 'Package[strace]', 'Package[sysstat]', 'Package[tcpdump]', 'Package[tmux]', 'Package[tree]', 'Package[vim]', 'Package[vim-addon-manager]', 'Package[vim-scripts]', 'Package[wipe]', 'Package[xfsprogs]', 'Package[zsh]', 'Package[icdiff]', 'Package[linux-perf]', 'Package[bsd-mailx]', 'Package[ack]', 'Package[netcat-openbsd]', 'Package[tshark]', 'Package[fzf]', 'Package[ripgrep]', 'Package[fd-find]', 'Package[kitty-terminfo]', 'Package[mtr-tiny]', 'Package[bat]', 'Package[efibootmgr]', 'Package[bind9-dnsutils]', 'Package[tzdata]', 'Package[python3-wmflib]', 'Package[ruby-sorted-set]', 'Package[btop]', 'Package[dstat]', 'Package[apport]', 'Package[command-not-found]', 'Package[command-not-found-data]', 'Package[ecryptfs-utils]', 'Package[mlocate]', 'Package[os-prober]', 'Package[python3-apport]', 'Package[wpasupplicant]', 'Package[apt-listchanges]', 'Package[isc-dhcp-client]', 'Package[rasdaemon]', 'Package[libicu67]', 'Package[libwsutil12]', 'Package[libwireshark14]', 'Package[libopencsd0]', 'Package[libwiretap11]', 'Package[ruby2.7]', 'Package[python3.9-minimal]', 'Package[python3.9]', 'Package[perl-modules-5.32]', 'Package[libpython3.9]', 'Package[libperl5.32]', 'Package[libpython3.9-minimal]', 'Package[libpython3.9-stdlib]', 'Package[libidn11]', 'Package[libldap-2.4-2]', 'Package[liburing1]', 'Package[libwebp6]', 'Package[libcbor0]', 'Package[libusb-0.1-4]', 'Package[telnet]', 'Package[libruby2.7]', 'Package[libdns-export1110]', 'Package[libisc-export1105]', 'Package[libbpf0]', 'Package[openssh-client]', 'Package[openssh-server]', 'Package[debdeploy-client]', 'Package[python3-dateutil]', 'Package[sudo]', 'Package[golang-cfssl]', 'Package[debmonitor-client]', 'Package[nagios-nrpe-server]', 'Package[monitoring-plugins]', 'Package[monitoring-plugins-basic]', 'Package[monitoring-plugins-standard]', 'Package[liburiparser1]', 'Package[python3-attr]', 'Package[iucode-tool]', 'Package[freeipmi-tools]', 'Package[freeipmi-ipmiseld]', 'Package[rsyslog-kafka]', 'Package[emacs-nox]', 'Package[prometheus-ipmi-exporter]', 'Package[libnet-dns-perl]', 'Package[iptables]', 'Package[ferm]', 'Package[ulogd2]', 'Package[conntrack]', 'Package[edac-utils]', 'Package[opensearch]', 'Package[python3-requests]', 'Package[wmf-opensearch-search-plugins]', 'Package[opensearch-madvise]', 'Package[logstash-oss]', 'Package[logstash-old-name]', 'Package[prometheus-rsyslog-exporter]', 'Package[initramfs-tools]', 'Package[python3-click]', 'Package[python3-box]', 'Package[confd]', 'Package[python3-toml]', 'Package[openjdk-17-jdk]', 'Package[prometheus-elasticsearch-exporter]', 'Package[nginx-light]', 'Package[nginx-common]']\n"}, {"resource": "File[/var/lib/prometheus/node.d/role_owner.prom]", "content": "--- /var/lib/prometheus/node.d/role_owner.prom.orig\n+++ /var/lib/prometheus/node.d/role_owner.prom\n@@ -1,3 +1,3 @@\n # HELP role_owner The team owner of the server role\n # TYPE role_owner gauge\n-role_owner{team=\"search-platform\",role=\"cirrus::test\",cluster=\"relforge\"} 1.0\n+role_owner{team=\"search-platform\",role=\"cirrus::relforge\",cluster=\"relforge\"} 1.0"}, {"resource": "Nrpe::Check[check_disk_space]", "parameters": "--- Nrpe::Check[check_disk_space].orig\n+++ Nrpe::Check[check_disk_space]\n\n@@\n-    command => /usr/lib/nagios/plugins/check_disk -w 6% -c 3% -W 6% -K 3% -l -e -A -i \"/srv/sd[a-b][1-3]\" -i \"/srv/nvme[0-9]n[0-9]p[0-9]\" --exclude-type=fuse --exclude-type=fuse.fuse_dfs --exclude-type=tracefs\n+    command => /usr/lib/nagios/plugins/check_disk -w 15% -c 10% -W 6% -K 3% -l -e -A -i \"/srv/sd[a-b][1-3]\" --exclude-type=tracefs\n"}, {"resource": "File[/etc/nagios/nrpe.d/check_disk_space.cfg]", "content": "--- /etc/nagios/nrpe.d/check_disk_space.cfg.orig\n+++ /etc/nagios/nrpe.d/check_disk_space.cfg\n@@ -1,2 +1,2 @@\n # File generated by puppet. DO NOT edit by hand\n-command[check_disk_space]=/usr/lib/nagios/plugins/check_disk -w 6% -c 3% -W 6% -K 3% -l -e -A -i \"/srv/sd[a-b][1-3]\" -i \"/srv/nvme[0-9]n[0-9]p[0-9]\" --exclude-type=fuse --exclude-type=fuse.fuse_dfs --exclude-type=tracefs\n+command[check_disk_space]=/usr/lib/nagios/plugins/check_disk -w 15% -c 10% -W 6% -K 3% -l -e -A -i \"/srv/sd[a-b][1-3]\" --exclude-type=tracefs"}, {"resource": "File[/etc/ferm/conf.d/10_opensearch_inter_node_9300]", "content": "--- /etc/ferm/conf.d/10_opensearch_inter_node_9300.orig\n+++ /etc/ferm/conf.d/10_opensearch_inter_node_9300\n@@ -4,3 +4,5 @@\n &R_SERVICE(tcp, 9300, (10.64.164.14 10.64.32.100 10.64.48.120 2620:0:861:103:10:64:32:100 2620:0:861:107:10:64:48:120 2620:0:861:12c:10:64:164:14));\n \n \n+\n+&NO_TRACK(tcp, 9300);"}, {"resource": "Concat_fragment[main contacts]", "content": "--- main contacts.orig\n+++ main contacts\n@@ -1,3 +1,3 @@\n ---\n-role::cirrus::test:\n+role::cirrus::relforge:\n - Search Platform"}, {"resource": "Exec[apt-get update]", "parameters": "--- Exec[apt-get update].orig\n+++ Exec[apt-get update]\n\n+    before => ['Class[Opensearch]']\n"}], "perc_changed": "22.62%"}}}