Compilation results for cloudcontrol1011.eqiad.wmnet: System changes detected

Catalog differences

Summary

Resources only in the new catalog

• File[/etc/nagios/nrpe.d/check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.cfg]
• Systemd::Unit[security_group_ssh-from-restricted-bastion_to_project_superset.timer]
• Systemd::Service[security_group_ssh-from-restricted-bastion_to_project_superset]
• Nrpe::Check[check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]
• Systemd::Unit[security_group_ssh-from-restricted-bastion_to_project_superset.service]
• File[/lib/systemd/system/security_group_ssh-from-restricted-bastion_to_project_superset.service]
• File[/lib/systemd/system/nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.timer]
• Exec[systemd daemon-reload for nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.service (nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.service)]
• Prometheus::Alert::Rule[check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status_bddd44659547ec7e7cbe557e2f1c1f2a]
• Systemd::Timer[security_group_ssh-from-restricted-bastion_to_project_superset]
• Exec[systemd daemon-reload for nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.timer (nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.timer)]
• Exec[systemd daemon-reload for security_group_ssh-from-restricted-bastion_to_project_quarry.timer (security_group_ssh-from-restricted-bastion_to_project_quarry.timer)]
• File[/etc/rsyslog.d/25-nrpe2nodexp-check-security-group-ssh-from-restricted-bastion-to-project-superset-status.conf]
• Exec[systemd daemon-reload for nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.service (nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.service)]
• Systemd::Unit[security_group_ssh-from-restricted-bastion_to_project_quarry.service]
• File[/var/lib/prometheus/node.d/check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.prom]
• Service[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.timer]
• File[/etc/logrotate.d/security_group_ssh-from-restricted-bastion_to_project_quarry]
• File[/etc/sudoers.d/nrpe-check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status]
• File[/lib/systemd/system/nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.timer]
• Systemd::Syslog[security_group_ssh-from-restricted-bastion_to_project_superset]
• Systemd::Service[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status]
• Exec[systemd daemon-reload for security_group_ssh-from-restricted-bastion_to_project_quarry.service (security_group_ssh-from-restricted-bastion_to_project_quarry.service)]
• Monitoring::Exported_nagios_service[cloudcontrol1011 check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]
• Systemd::Monitor[security_group_ssh-from-restricted-bastion_to_project_superset]
• File[/var/lib/prometheus/node.d/check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status.prom]
• Monitoring::Service[check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]
• Systemd::Timer::Job[security_group_ssh-from-restricted-bastion_to_project_superset]
• Nrpe::Monitor_service[check_security_group_ssh-from-restricted-bastion_to_project_superset_status]
• File[/lib/systemd/system/nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.service]
• File[/var/log/security_group_ssh-from-restricted-bastion_to_project_superset]
• File[/etc/logrotate.d/security_group_ssh-from-restricted-bastion_to_project_superset]
• Logrotate::Conf[security_group_ssh-from-restricted-bastion_to_project_quarry]
• Systemd::Service[security_group_ssh-from-restricted-bastion_to_project_quarry]
• Systemd::Timer[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status]
• Nrpe::Check[check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status]
• Monitoring::Exported_nagios_service[cloudcontrol1011 check_security_group_ssh-from-restricted-bastion_to_project_superset_status]
• File[/etc/rsyslog.d/25-nrpe2nodexp-check-security-group-ssh-from-restricted-bastion-to-project-quarry-status.conf]
• Rsyslog::Conf[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]
• Systemd::Unit[security_group_ssh-from-restricted-bastion_to_project_quarry.timer]
• File[/etc/nagios/nrpe.d/check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status.cfg]
• Systemd::Timer::Job[security_group_ssh-from-restricted-bastion_to_project_quarry]
• Exec[systemd daemon-reload for security_group_ssh-from-restricted-bastion_to_project_superset.timer (security_group_ssh-from-restricted-bastion_to_project_superset.timer)]
• Systemd::Syslog[security_group_ssh-from-restricted-bastion_to_project_quarry]
• File[/lib/systemd/system/security_group_ssh-from-restricted-bastion_to_project_quarry.timer]
• Rsyslog::Conf[security_group_ssh-from-restricted-bastion_to_project_superset]
• File[/lib/systemd/system/security_group_ssh-from-restricted-bastion_to_project_superset.timer]
• Systemd::Timer::Job[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status]
• Systemd::Timer[security_group_ssh-from-restricted-bastion_to_project_quarry]
• Service[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.timer]
• Systemd::Unit[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.service]
• Sudo::User[nrpe-check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]
• Nrpe::Monitor_service[check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]
• Systemd::Timer[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]
• File[/lib/systemd/system/security_group_ssh-from-restricted-bastion_to_project_quarry.service]
• Systemd::Unit[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.timer]
• Service[security_group_ssh-from-restricted-bastion_to_project_superset.timer]
• Exec[systemd daemon-reload for security_group_ssh-from-restricted-bastion_to_project_superset.service (security_group_ssh-from-restricted-bastion_to_project_superset.service)]
• File[/etc/rsyslog.d/40-security-group-ssh-from-restricted-bastion-to-project-quarry.conf]
• File[/var/log/security_group_ssh-from-restricted-bastion_to_project_quarry]
• Service[security_group_ssh-from-restricted-bastion_to_project_quarry.timer]
• Systemd::Unit[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.service]
• Systemd::Service[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]
• Systemd::Unit[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.timer]
• File[/lib/systemd/system/nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.service]
• Monitoring::Service[check_security_group_ssh-from-restricted-bastion_to_project_superset_status]
• Rsyslog::Conf[security_group_ssh-from-restricted-bastion_to_project_quarry]
• Logrotate::Conf[security_group_ssh-from-restricted-bastion_to_project_superset]
• File[/etc/rsyslog.d/40-security-group-ssh-from-restricted-bastion-to-project-superset.conf]
• File[/etc/sudoers.d/nrpe-check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]
• Systemd::Timer::Job[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]
• Prometheus::Alert::Rule[check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status_06b7b86463e586f13fe462de48021ff5]
• Exec[systemd daemon-reload for nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.timer (nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.timer)]
• Systemd::Monitor[security_group_ssh-from-restricted-bastion_to_project_quarry]
• Sudo::User[nrpe-check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status]
• Rsyslog::Conf[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status]

Resources modified

• Systemd::Monitor[security_group_ssh-from-restricted-bastion_to_project_quarry]

  Parameters differences:

  --- Systemd::Monitor[security_group_ssh-from-restricted-bastion_to_project_quarry].orig
  +++ Systemd::Monitor[security_group_ssh-from-restricted-bastion_to_project_quarry]
  
  +    migration_task => T407130
  +    retries        => 2
  +    check_interval => 10
  +    ensure         => absent
  +    contact_group  => admins
  +    notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  +    critical       => False
  

• Service[security_group_ssh-from-restricted-bastion_to_project_superset.timer]

  Parameters differences:

  --- Service[security_group_ssh-from-restricted-bastion_to_project_superset.timer].orig
  +++ Service[security_group_ssh-from-restricted-bastion_to_project_superset.timer]
  
  +    ensure   => stopped
  +    before   => ['Exec[systemd daemon-reload for security_group_ssh-from-restricted-bastion_to_project_superset.timer (security_group_ssh-from-restricted-bastion_to_project_superset.timer)]']
  +    provider => systemd
  +    enable   => False
  

• Systemd::Service[security_group_ssh-from-restricted-bastion_to_project_superset]

  Parameters differences:

  --- Systemd::Service[security_group_ssh-from-restricted-bastion_to_project_superset].orig
  +++ Systemd::Service[security_group_ssh-from-restricted-bastion_to_project_superset]
  
  +    restart                  => False
  +    migration_task           => T407130
  +    monitoring_critical      => False
  +    ensure                   => absent
  +    require                  => Systemd::Unit[security_group_ssh-from-restricted-bastion_to_project_superset.service]
  +    service_params           => {}
  +    monitoring_enabled       => False
  +    unit_type                => timer
  +    override                 => False
  +    monitoring_contact_group => admins
  

• File[/etc/logrotate.d/security_group_ssh-from-restricted-bastion_to_project_quarry]

  Parameters differences:

  --- File[/etc/logrotate.d/security_group_ssh-from-restricted-bastion_to_project_quarry].orig
  +++ File[/etc/logrotate.d/security_group_ssh-from-restricted-bastion_to_project_quarry]
  
  +    mode   => 0444
  +    owner  => root
  +    ensure => absent
  +    group  => root
  

  Content differences:

  --- /etc/logrotate.d/security_group_ssh-from-restricted-bastion_to_project_quarry.orig
  +++ /etc/logrotate.d/security_group_ssh-from-restricted-bastion_to_project_quarry
  @@ -0,0 +1,12 @@
  +# logrotate(8) config for security_group_ssh-from-restricted-bastion_to_project_quarry
  +
  +/var/log/security_group_ssh-from-restricted-bastion_to_project_quarry/*.log {
  +    daily
  +    copytruncate
  +    missingok
  +    compress
  +    delaycompress
  +    notifempty
  +    rotate 15
  +    size 256M
  +}

• File[/var/log/security_group_ssh-from-restricted-bastion_to_project_quarry]

  Parameters differences:

  --- File[/var/log/security_group_ssh-from-restricted-bastion_to_project_quarry].orig
  +++ File[/var/log/security_group_ssh-from-restricted-bastion_to_project_quarry]
  
  +    ensure => absent
  +    force  => True
  +    mode   => 0755
  +    owner  => root
  +    group  => root
  +    backup => False
  

• Nrpe::Check[check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]

  Parameters differences:

  --- Nrpe::Check[check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status].orig
  +++ Nrpe::Check[check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]
  
  +    command => /usr/local/lib/nagios/plugins/check_systemd_unit_status security_group_ssh-from-restricted-bastion_to_project_quarry
  +    ensure  => absent
  +    before  => Monitoring::Service[check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]
  

• Systemd::Timer[security_group_ssh-from-restricted-bastion_to_project_quarry]

  Parameters differences:

  --- Systemd::Timer[security_group_ssh-from-restricted-bastion_to_project_quarry].orig
  +++ Systemd::Timer[security_group_ssh-from-restricted-bastion_to_project_quarry]
  
  +    accuracy           => 15sec
  +    ensure             => absent
  +    timer_intervals    => [{'start': 'OnCalendar', 'interval': '*-*-* *:00/30:00'}]
  +    unit_name          => security_group_ssh-from-restricted-bastion_to_project_quarry.service
  +    fixed_random_delay => False
  +    splay              => 0
  

• Systemd::Syslog[security_group_ssh-from-restricted-bastion_to_project_superset]

  Parameters differences:

  --- Systemd::Syslog[security_group_ssh-from-restricted-bastion_to_project_superset].orig
  +++ Systemd::Syslog[security_group_ssh-from-restricted-bastion_to_project_superset]
  
  +    ensure                 => absent
  +    base_dir               => /var/log
  +    programname_comparison => startswith
  +    force_stop             => True
  +    log_filename           => syslog.log
  +    owner                  => root
  +    readable_by            => all
  +    group                  => root
  

• Systemd::Unit[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.service]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.service].orig
  +++ Systemd::Unit[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.service]
  
  +    restart           => False
  +    override          => False
  +    ensure            => absent
  +    unit              => nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.service
  +    override_filename => puppet-override.conf
  +    require           => ['Class[Systemd]']
  

• Systemd::Service[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]

  Parameters differences:

  --- Systemd::Service[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status].orig
  +++ Systemd::Service[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]
  
  +    restart                  => False
  +    migration_task           => T407130
  +    monitoring_critical      => False
  +    ensure                   => absent
  +    require                  => Systemd::Unit[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.service]
  +    service_params           => {}
  +    monitoring_enabled       => False
  +    unit_type                => timer
  +    override                 => False
  +    monitoring_contact_group => admins
  

• File[/etc/nagios/nrpe.d/check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status.cfg]

  Parameters differences:

  --- File[/etc/nagios/nrpe.d/check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status.cfg].orig
  +++ File[/etc/nagios/nrpe.d/check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status.cfg]
  
  +    ensure  => absent
  +    notify  => Service[nagios-nrpe-server]
  +    require => Package[nagios-nrpe-server]
  +    mode    => 0444
  +    owner   => root
  +    tag     => nrpe::check
  +    group   => root
  

  Content differences:

  --- /etc/nagios/nrpe.d/check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status.cfg.orig
  +++ /etc/nagios/nrpe.d/check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status.cfg
  @@ -0,0 +1,2 @@
  +# File generated by puppet. DO NOT edit by hand
  +command[check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status]=/usr/local/lib/nagios/plugins/check_systemd_unit_status security_group_ssh-from-restricted-bastion_to_project_superset

• Systemd::Unit[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.timer]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.timer].orig
  +++ Systemd::Unit[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.timer]
  
  +    restart           => False
  +    override          => False
  +    ensure            => absent
  +    unit              => nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.timer
  +    override_filename => puppet-override.conf
  +    require           => ['Class[Systemd]']
  

• Systemd::Timer[security_group_ssh-from-restricted-bastion_to_project_superset]

  Parameters differences:

  --- Systemd::Timer[security_group_ssh-from-restricted-bastion_to_project_superset].orig
  +++ Systemd::Timer[security_group_ssh-from-restricted-bastion_to_project_superset]
  
  +    accuracy           => 15sec
  +    ensure             => absent
  +    timer_intervals    => [{'start': 'OnCalendar', 'interval': '*-*-* *:00/30:00'}]
  +    unit_name          => security_group_ssh-from-restricted-bastion_to_project_superset.service
  +    fixed_random_delay => False
  +    splay              => 0
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.timer (nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.timer (nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.timer)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.timer (nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.timer)]
  
  +    command     => /bin/systemctl daemon-reload
  +    refreshonly => True
  

• Systemd::Timer::Job[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]

  Parameters differences:

  --- Systemd::Timer::Job[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status].orig
  +++ Systemd::Timer::Job[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]
  
  +    logfile_group             => root
  +    environment               => {}
  +    ensure                    => absent
  +    ignore_errors             => True
  +    monitoring_contact_groups => admins
  +    syslog_match_startswith   => True
  +    success_exit_status       => []
  +    group                     => prometheus-node-exporter
  +    send_mail                 => False
  +    logging_enabled           => False
  +    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  +    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '5min'}]
  +    send_mail_to              => root@cloudcontrol1011.eqiad.wmnet
  +    send_mail_only_on_error   => True
  +    private_tmp               => False
  +    logfile_basedir           => /var/log
  +    monitoring_enabled        => False
  +    logfile_name              => syslog.log
  +    splay                     => 300
  +    syslog_identifier         => nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status
  +    user                      => nagios
  +    fixed_random_delay        => True
  +    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "06b7b86463e586f13fe462de48021ff5" --timeout 10 --check-command "check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status"
  +    syslog_force_stop         => True
  +    logfile_perms             => all
  +    description               => execution of nrpe2nodexp for the check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status command.
  

• Monitoring::Exported_nagios_service[cloudcontrol1011 check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[cloudcontrol1011 check_security_group_ssh-from-restricted-bastion_to_project_quarry_status].orig
  +++ Monitoring::Exported_nagios_service[cloudcontrol1011 check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]
  
  +    service_description    => Check unit status of security_group_ssh-from-restricted-bastion_to_project_quarry
  +    is_volatile            => 0
  +    ensure                 => absent
  +    check_interval         => 10
  +    notification_options   => c,r,f
  +    retry_interval         => 1
  +    notifications_enabled  => 1
  +    notes_url              => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  +    notification_interval  => 0
  +    check_period           => 24x7
  +    passive_checks_enabled => 1
  +    max_check_attempts     => 2
  +    contact_groups         => admins
  +    active_checks_enabled  => 1
  +    notification_period    => 24x7
  +    check_command          => nrpe_check!check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status!10
  +    host_name              => cloudcontrol1011
  +    check_freshness        => 0
  +    servicegroups          => wmcs_eqiad
  

• Systemd::Service[security_group_ssh-from-restricted-bastion_to_project_quarry]

  Parameters differences:

  --- Systemd::Service[security_group_ssh-from-restricted-bastion_to_project_quarry].orig
  +++ Systemd::Service[security_group_ssh-from-restricted-bastion_to_project_quarry]
  
  +    restart                  => False
  +    migration_task           => T407130
  +    monitoring_critical      => False
  +    ensure                   => absent
  +    require                  => Systemd::Unit[security_group_ssh-from-restricted-bastion_to_project_quarry.service]
  +    service_params           => {}
  +    monitoring_enabled       => False
  +    unit_type                => timer
  +    override                 => False
  +    monitoring_contact_group => admins
  

• Rsyslog::Conf[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status]

  Parameters differences:

  --- Rsyslog::Conf[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status].orig
  +++ Rsyslog::Conf[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status]
  
  +    mode     => 0444
  +    ensure   => absent
  +    priority => 25
  

• File[/etc/nagios/nrpe.d/check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.cfg]

  Parameters differences:

  --- File[/etc/nagios/nrpe.d/check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.cfg].orig
  +++ File[/etc/nagios/nrpe.d/check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.cfg]
  
  +    ensure  => absent
  +    notify  => Service[nagios-nrpe-server]
  +    require => Package[nagios-nrpe-server]
  +    mode    => 0444
  +    owner   => root
  +    tag     => nrpe::check
  +    group   => root
  

  Content differences:

  --- /etc/nagios/nrpe.d/check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.cfg.orig
  +++ /etc/nagios/nrpe.d/check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.cfg
  @@ -0,0 +1,2 @@
  +# File generated by puppet. DO NOT edit by hand
  +command[check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]=/usr/local/lib/nagios/plugins/check_systemd_unit_status security_group_ssh-from-restricted-bastion_to_project_quarry

• Nrpe::Monitor_service[check_security_group_ssh-from-restricted-bastion_to_project_superset_status]

  Parameters differences:

  --- Nrpe::Monitor_service[check_security_group_ssh-from-restricted-bastion_to_project_superset_status].orig
  +++ Nrpe::Monitor_service[check_security_group_ssh-from-restricted-bastion_to_project_superset_status]
  
  +    nrpe_command                   => /usr/local/lib/nagios/plugins/check_systemd_unit_status security_group_ssh-from-restricted-bastion_to_project_superset
  +    check_interval                 => 10
  +    ensure                         => absent
  +    timeout                        => 10
  +    retry_interval                 => 1
  +    notes_url                      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  +    retries                        => 2
  +    migration_task                 => T407130
  +    nrpe2nodexp_parse_perf_data    => False
  +    enable_nrpe2nodexp             => False
  +    enable_icinga_check            => True
  +    alertmanager_team              => observability
  +    critical                       => False
  +    alertmanager_severity_override => info
  +    contact_group                  => admins
  +    description                    => Check unit status of security_group_ssh-from-restricted-bastion_to_project_superset
  

• File[/lib/systemd/system/nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.timer]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.timer].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.timer]
  
  +    ensure => absent
  +    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.timer (nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.timer)]
  +    mode   => 0444
  +    owner  => root
  +    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.timer.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.timer
  @@ -0,0 +1,14 @@
  +[Unit]
  +Description=Periodic execution of nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.service
  +
  +[Timer]
  +Unit=nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.service
  +# Accuracy sets the maximum time interval around the execution time we want to allow
  +AccuracySec=15sec
  +OnUnitInactiveSec=5min
  +OnActiveSec=1s
  +RandomizedDelaySec=300
  +FixedRandomDelay=true
  +
  +[Install]
  +WantedBy=multi-user.target

• File[/etc/rsyslog.d/40-security-group-ssh-from-restricted-bastion-to-project-quarry.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-security-group-ssh-from-restricted-bastion-to-project-quarry.conf].orig
  +++ File[/etc/rsyslog.d/40-security-group-ssh-from-restricted-bastion-to-project-quarry.conf]
  
  +    ensure => absent
  +    notify => Service[rsyslog]
  +    mode   => 0444
  +    owner  => root
  +    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-security-group-ssh-from-restricted-bastion-to-project-quarry.conf.orig
  +++ /etc/rsyslog.d/40-security-group-ssh-from-restricted-bastion-to-project-quarry.conf
  @@ -0,0 +1,10 @@
  +# rsyslog.conf(5) configuration file for services.
  +# This file is managed by Puppet.
  +if $programname startswith "security_group_ssh-from-restricted-bastion_to_project_quarry" then {
  +    action(
  +        type="omfile" file="/var/log/security_group_ssh-from-restricted-bastion_to_project_quarry/syslog.log"
  +        fileOwner="root" fileGroup="root"
  +        fileCreateMode="0644"
  +    )
  +    & stop
  +}

• Rsyslog::Conf[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]

  Parameters differences:

  --- Rsyslog::Conf[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status].orig
  +++ Rsyslog::Conf[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]
  
  +    mode     => 0444
  +    ensure   => absent
  +    priority => 25
  

• Rsyslog::Conf[security_group_ssh-from-restricted-bastion_to_project_superset]

  Parameters differences:

  --- Rsyslog::Conf[security_group_ssh-from-restricted-bastion_to_project_superset].orig
  +++ Rsyslog::Conf[security_group_ssh-from-restricted-bastion_to_project_superset]
  
  +    mode     => 0444
  +    ensure   => absent
  +    priority => 40
  +    require  => File[/var/log/security_group_ssh-from-restricted-bastion_to_project_superset]
  

• File[/lib/systemd/system/security_group_ssh-from-restricted-bastion_to_project_quarry.service]

  Parameters differences:

  --- File[/lib/systemd/system/security_group_ssh-from-restricted-bastion_to_project_quarry.service].orig
  +++ File[/lib/systemd/system/security_group_ssh-from-restricted-bastion_to_project_quarry.service]
  
  +    ensure => absent
  +    notify => Exec[systemd daemon-reload for security_group_ssh-from-restricted-bastion_to_project_quarry.service (security_group_ssh-from-restricted-bastion_to_project_quarry.service)]
  +    mode   => 0444
  +    owner  => root
  +    group  => root
  

  Content differences:

  --- /lib/systemd/system/security_group_ssh-from-restricted-bastion_to_project_quarry.service.orig
  +++ /lib/systemd/system/security_group_ssh-from-restricted-bastion_to_project_quarry.service
  @@ -0,0 +1,9 @@
  +[Unit]
  +Description=Apply security group ssh-from-restricted-bastion to project quarry
  +Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  +
  +[Service]
  +Type=oneshot
  +User=root
  +ExecStart=/usr/local/sbin/add-security-group-to-project --os-cloud novaadmin  --security-group-name ssh-from-restricted-bastion --project-id quarry
  +TimeoutStartSec=890

• Exec[systemd daemon-reload for nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.timer (nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.timer (nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.timer)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.timer (nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.timer)]
  
  +    command     => /bin/systemctl daemon-reload
  +    refreshonly => True
  

• Systemd::Unit[security_group_ssh-from-restricted-bastion_to_project_superset.timer]

  Parameters differences:

  --- Systemd::Unit[security_group_ssh-from-restricted-bastion_to_project_superset.timer].orig
  +++ Systemd::Unit[security_group_ssh-from-restricted-bastion_to_project_superset.timer]
  
  +    restart           => False
  +    override          => False
  +    ensure            => absent
  +    unit              => security_group_ssh-from-restricted-bastion_to_project_superset.timer
  +    override_filename => puppet-override.conf
  +    require           => ['Class[Systemd]']
  

• Systemd::Unit[security_group_ssh-from-restricted-bastion_to_project_quarry.timer]

  Parameters differences:

  --- Systemd::Unit[security_group_ssh-from-restricted-bastion_to_project_quarry.timer].orig
  +++ Systemd::Unit[security_group_ssh-from-restricted-bastion_to_project_quarry.timer]
  
  +    restart           => False
  +    override          => False
  +    ensure            => absent
  +    unit              => security_group_ssh-from-restricted-bastion_to_project_quarry.timer
  +    override_filename => puppet-override.conf
  +    require           => ['Class[Systemd]']
  

• Systemd::Unit[security_group_ssh-from-restricted-bastion_to_project_superset.service]

  Parameters differences:

  --- Systemd::Unit[security_group_ssh-from-restricted-bastion_to_project_superset.service].orig
  +++ Systemd::Unit[security_group_ssh-from-restricted-bastion_to_project_superset.service]
  
  +    restart           => False
  +    override          => False
  +    ensure            => absent
  +    unit              => security_group_ssh-from-restricted-bastion_to_project_superset.service
  +    override_filename => puppet-override.conf
  +    require           => ['Class[Systemd]']
  

• File[/var/lib/prometheus/node.d/check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status.prom]

  Parameters differences:

  --- File[/var/lib/prometheus/node.d/check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status.prom].orig
  +++ File[/var/lib/prometheus/node.d/check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status.prom]
  
  +    owner  => root
  +    ensure => absent
  +    group  => root
  

• Class[Profile::Openstack::Eqiad1::Cumin_access]

  Parameters differences:

  --- Class[Profile::Openstack::Eqiad1::Cumin_access].orig
  +++ Class[Profile::Openstack::Eqiad1::Cumin_access]
  
  @@
  -    project_and_security_group_for_cumin_access => {'trove': 'ssh-from-restricted-bastion', 'paws': 'ssh-from-restricted-bastion', 'c26d9d326bdf464fa1025939ded7e5a2': 'ssh-from-restricted-bastion', 'bd825ee46c214f9e88126a2b290d88f8': 'ssh-from-restricted-bastion'}
  +    project_and_security_group_for_cumin_access => {'trove': 'ssh-from-restricted-bastion', 'paws': 'ssh-from-restricted-bastion', 'quarry': 'ssh-from-restricted-bastion', 'superset': 'ssh-from-restricted-bastion', 'c26d9d326bdf464fa1025939ded7e5a2': 'ssh-from-restricted-bastion', 'bd825ee46c214f9e88126a2b290d88f8': 'ssh-from-restricted-bastion'}
  

• Prometheus::Alert::Rule[check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status_bddd44659547ec7e7cbe557e2f1c1f2a]

  Parameters differences:

  --- Prometheus::Alert::Rule[check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status_bddd44659547ec7e7cbe557e2f1c1f2a].orig
  +++ Prometheus::Alert::Rule[check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status_bddd44659547ec7e7cbe557e2f1c1f2a]
  
  +    dashboard          => TODO
  +    ensure             => absent
  +    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
  +    team               => observability
  +    alert_name         => nrpe_Check_unit_status_of_security_group_ssh_from_restricted_bastion_to_project_superset
  +    site               => eqiad
  +    for                => 11m
  +    runbook            => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  +    instance           => ops
  +    expr               => (nagios_nrpe_check_result{alert_rule_hash="bddd44659547ec7e7cbe557e2f1c1f2a",check_name="check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
  +    group              => nrpechecks
  +    summary            => NRPE CHECK: Check unit status of security_group_ssh-from-restricted-bastion_to_project_superset
  +    def_label_whitelst => ['team', 'severity']
  +    severity           => info
  +    description        => NRPE CHECK: Check unit status of security_group_ssh-from-restricted-bastion_to_project_superset
  

• File[/etc/logrotate.d/security_group_ssh-from-restricted-bastion_to_project_superset]

  Parameters differences:

  --- File[/etc/logrotate.d/security_group_ssh-from-restricted-bastion_to_project_superset].orig
  +++ File[/etc/logrotate.d/security_group_ssh-from-restricted-bastion_to_project_superset]
  
  +    mode   => 0444
  +    owner  => root
  +    ensure => absent
  +    group  => root
  

  Content differences:

  --- /etc/logrotate.d/security_group_ssh-from-restricted-bastion_to_project_superset.orig
  +++ /etc/logrotate.d/security_group_ssh-from-restricted-bastion_to_project_superset
  @@ -0,0 +1,12 @@
  +# logrotate(8) config for security_group_ssh-from-restricted-bastion_to_project_superset
  +
  +/var/log/security_group_ssh-from-restricted-bastion_to_project_superset/*.log {
  +    daily
  +    copytruncate
  +    missingok
  +    compress
  +    delaycompress
  +    notifempty
  +    rotate 15
  +    size 256M
  +}

• Systemd::Timer::Job[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status]

  Parameters differences:

  --- Systemd::Timer::Job[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status].orig
  +++ Systemd::Timer::Job[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status]
  
  +    logfile_group             => root
  +    environment               => {}
  +    ensure                    => absent
  +    ignore_errors             => True
  +    monitoring_contact_groups => admins
  +    syslog_match_startswith   => True
  +    success_exit_status       => []
  +    group                     => prometheus-node-exporter
  +    send_mail                 => False
  +    logging_enabled           => False
  +    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  +    interval                  => [{'start': 'OnUnitInactiveSec', 'interval': '5min'}]
  +    send_mail_to              => root@cloudcontrol1011.eqiad.wmnet
  +    send_mail_only_on_error   => True
  +    private_tmp               => False
  +    logfile_basedir           => /var/log
  +    monitoring_enabled        => False
  +    logfile_name              => syslog.log
  +    splay                     => 300
  +    syslog_identifier         => nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status
  +    user                      => nagios
  +    fixed_random_delay        => True
  +    command                   => /usr/local/bin/nrpe2nodexp --alert-rule-hash "bddd44659547ec7e7cbe557e2f1c1f2a" --timeout 10 --check-command "check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status"
  +    syslog_force_stop         => True
  +    logfile_perms             => all
  +    description               => execution of nrpe2nodexp for the check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status command.
  

• Monitoring::Service[check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]

  Parameters differences:

  --- Monitoring::Service[check_security_group_ssh-from-restricted-bastion_to_project_quarry_status].orig
  +++ Monitoring::Service[check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]
  
  +    migration_task => T407130
  +    passive        => False
  +    ensure         => absent
  +    check_interval => 10
  +    config_dir     => /etc/nagios
  +    retry_interval => 1
  +    notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  +    freshness      => 36000
  +    critical       => False
  +    retries        => 2
  +    contact_group  => admins
  +    host           => cloudcontrol1011
  +    check_command  => nrpe_check!check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status!10
  +    description    => Check unit status of security_group_ssh-from-restricted-bastion_to_project_quarry
  

• Logrotate::Conf[security_group_ssh-from-restricted-bastion_to_project_superset]

  Parameters differences:

  --- Logrotate::Conf[security_group_ssh-from-restricted-bastion_to_project_superset].orig
  +++ Logrotate::Conf[security_group_ssh-from-restricted-bastion_to_project_superset]
  
  +    ensure => absent
  

• Systemd::Timer[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status]

  Parameters differences:

  --- Systemd::Timer[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status].orig
  +++ Systemd::Timer[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status]
  
  +    accuracy           => 15sec
  +    ensure             => absent
  +    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '5min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  +    unit_name          => nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.service
  +    fixed_random_delay => True
  +    splay              => 300
  

• File[/var/log/security_group_ssh-from-restricted-bastion_to_project_superset]

  Parameters differences:

  --- File[/var/log/security_group_ssh-from-restricted-bastion_to_project_superset].orig
  +++ File[/var/log/security_group_ssh-from-restricted-bastion_to_project_superset]
  
  +    ensure => absent
  +    force  => True
  +    mode   => 0755
  +    owner  => root
  +    group  => root
  +    backup => False
  

• Systemd::Timer::Job[security_group_ssh-from-restricted-bastion_to_project_quarry]

  Parameters differences:

  --- Systemd::Timer::Job[security_group_ssh-from-restricted-bastion_to_project_quarry].orig
  +++ Systemd::Timer::Job[security_group_ssh-from-restricted-bastion_to_project_quarry]
  
  +    logfile_group             => root
  +    environment               => {}
  +    ensure                    => absent
  +    ignore_errors             => False
  +    monitoring_contact_groups => admins
  +    syslog_match_startswith   => True
  +    success_exit_status       => []
  +    send_mail                 => False
  +    logging_enabled           => True
  +    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  +    interval                  => {'start': 'OnCalendar', 'interval': '*-*-* *:00/30:00'}
  +    send_mail_to              => root@cloudcontrol1011.eqiad.wmnet
  +    send_mail_only_on_error   => True
  +    private_tmp               => False
  +    logfile_basedir           => /var/log
  +    require                   => ['File[/usr/local/sbin/add-security-group-to-project]']
  +    max_runtime_seconds       => 890
  +    monitoring_enabled        => True
  +    logfile_name              => syslog.log
  +    user                      => root
  +    fixed_random_delay        => False
  +    command                   => /usr/local/sbin/add-security-group-to-project --os-cloud novaadmin  --security-group-name ssh-from-restricted-bastion --project-id quarry
  +    syslog_force_stop         => True
  +    logfile_perms             => all
  +    description               => Apply security group ssh-from-restricted-bastion to project quarry
  

• File[/lib/systemd/system/security_group_ssh-from-restricted-bastion_to_project_superset.service]

  Parameters differences:

  --- File[/lib/systemd/system/security_group_ssh-from-restricted-bastion_to_project_superset.service].orig
  +++ File[/lib/systemd/system/security_group_ssh-from-restricted-bastion_to_project_superset.service]
  
  +    ensure => absent
  +    notify => Exec[systemd daemon-reload for security_group_ssh-from-restricted-bastion_to_project_superset.service (security_group_ssh-from-restricted-bastion_to_project_superset.service)]
  +    mode   => 0444
  +    owner  => root
  +    group  => root
  

  Content differences:

  --- /lib/systemd/system/security_group_ssh-from-restricted-bastion_to_project_superset.service.orig
  +++ /lib/systemd/system/security_group_ssh-from-restricted-bastion_to_project_superset.service
  @@ -0,0 +1,9 @@
  +[Unit]
  +Description=Apply security group ssh-from-restricted-bastion to project superset
  +Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  +
  +[Service]
  +Type=oneshot
  +User=root
  +ExecStart=/usr/local/sbin/add-security-group-to-project --os-cloud novaadmin  --security-group-name ssh-from-restricted-bastion --project-id superset
  +TimeoutStartSec=890

• File[/etc/sudoers.d/nrpe-check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe-check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status].orig
  +++ File[/etc/sudoers.d/nrpe-check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status]
  
  +    owner   => root
  +    ensure  => absent
  +    group   => root
  +    require => Package[nagios-nrpe-server]
  

• Systemd::Timer::Job[security_group_ssh-from-restricted-bastion_to_project_superset]

  Parameters differences:

  --- Systemd::Timer::Job[security_group_ssh-from-restricted-bastion_to_project_superset].orig
  +++ Systemd::Timer::Job[security_group_ssh-from-restricted-bastion_to_project_superset]
  
  +    logfile_group             => root
  +    environment               => {}
  +    ensure                    => absent
  +    ignore_errors             => False
  +    monitoring_contact_groups => admins
  +    syslog_match_startswith   => True
  +    success_exit_status       => []
  +    send_mail                 => False
  +    logging_enabled           => True
  +    monitoring_notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  +    interval                  => {'start': 'OnCalendar', 'interval': '*-*-* *:00/30:00'}
  +    send_mail_to              => root@cloudcontrol1011.eqiad.wmnet
  +    send_mail_only_on_error   => True
  +    private_tmp               => False
  +    logfile_basedir           => /var/log
  +    require                   => ['File[/usr/local/sbin/add-security-group-to-project]']
  +    max_runtime_seconds       => 890
  +    monitoring_enabled        => True
  +    logfile_name              => syslog.log
  +    user                      => root
  +    fixed_random_delay        => False
  +    command                   => /usr/local/sbin/add-security-group-to-project --os-cloud novaadmin  --security-group-name ssh-from-restricted-bastion --project-id superset
  +    syslog_force_stop         => True
  +    logfile_perms             => all
  +    description               => Apply security group ssh-from-restricted-bastion to project superset
  

• Service[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.timer]

  Parameters differences:

  --- Service[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.timer].orig
  +++ Service[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.timer]
  
  +    ensure   => stopped
  +    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.timer (nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.timer)]']
  +    provider => systemd
  +    enable   => False
  

• Class[Profile::Openstack::Base::Cumin_access]

  Parameters differences:

  --- Class[Profile::Openstack::Base::Cumin_access].orig
  +++ Class[Profile::Openstack::Base::Cumin_access]
  
  @@
  -    project_and_security_group_for_cumin_access => {'trove': 'ssh-from-restricted-bastion', 'paws': 'ssh-from-restricted-bastion', 'c26d9d326bdf464fa1025939ded7e5a2': 'ssh-from-restricted-bastion', 'bd825ee46c214f9e88126a2b290d88f8': 'ssh-from-restricted-bastion'}
  +    project_and_security_group_for_cumin_access => {'trove': 'ssh-from-restricted-bastion', 'paws': 'ssh-from-restricted-bastion', 'quarry': 'ssh-from-restricted-bastion', 'superset': 'ssh-from-restricted-bastion', 'c26d9d326bdf464fa1025939ded7e5a2': 'ssh-from-restricted-bastion', 'bd825ee46c214f9e88126a2b290d88f8': 'ssh-from-restricted-bastion'}
  

• Prometheus::Alert::Rule[check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status_06b7b86463e586f13fe462de48021ff5]

  Parameters differences:

  --- Prometheus::Alert::Rule[check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status_06b7b86463e586f13fe462de48021ff5].orig
  +++ Prometheus::Alert::Rule[check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status_06b7b86463e586f13fe462de48021ff5]
  
  +    dashboard          => TODO
  +    ensure             => absent
  +    logs               => https://logstash.wikimedia.org/app/dashboards#/view/2d343ac0-6df8-11f0-8e08-7fab0da52b33?_g=(filters:!((query:(match_phrase:(event.module:check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status))),(query:(match_phrase:(host.name:{{$labels.instance|stripPort}})))))
  +    team               => observability
  +    alert_name         => nrpe_Check_unit_status_of_security_group_ssh_from_restricted_bastion_to_project_quarry
  +    site               => eqiad
  +    for                => 11m
  +    runbook            => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  +    instance           => ops
  +    expr               => (nagios_nrpe_check_result{alert_rule_hash="06b7b86463e586f13fe462de48021ff5",check_name="check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status", status=~"(WARNING|CRITICAL)", severity=~"(warning|critical)"} > 0) * on (instance) group_left (team) role_owner
  +    group              => nrpechecks
  +    summary            => NRPE CHECK: Check unit status of security_group_ssh-from-restricted-bastion_to_project_quarry
  +    def_label_whitelst => ['team', 'severity']
  +    severity           => info
  +    description        => NRPE CHECK: Check unit status of security_group_ssh-from-restricted-bastion_to_project_quarry
  

• Sudo::User[nrpe-check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]

  Parameters differences:

  --- Sudo::User[nrpe-check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status].orig
  +++ Sudo::User[nrpe-check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]
  
  +    ensure     => absent
  +    user       => nagios
  +    require    => ['Class[Sudo]']
  +    tag        => nrpe::check
  +    privileges => []
  

• File[/etc/rsyslog.d/25-nrpe2nodexp-check-security-group-ssh-from-restricted-bastion-to-project-quarry-status.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/25-nrpe2nodexp-check-security-group-ssh-from-restricted-bastion-to-project-quarry-status.conf].orig
  +++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-security-group-ssh-from-restricted-bastion-to-project-quarry-status.conf]
  
  +    ensure => absent
  +    notify => Service[rsyslog]
  +    mode   => 0444
  +    owner  => root
  +    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/25-nrpe2nodexp-check-security-group-ssh-from-restricted-bastion-to-project-quarry-status.conf.orig
  +++ /etc/rsyslog.d/25-nrpe2nodexp-check-security-group-ssh-from-restricted-bastion-to-project-quarry-status.conf
  @@ -0,0 +1,10 @@
  +# SPDX-License-Identifier: Apache-2.0
  +if $programname contains "nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status" then {
  +    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
  +        # Send logs to kafka
  +        set $.log_outputs = "kafka ecs_170 local";
  +    } else {
  +        # Filter out non-relevant nrpe2nodexp messages
  +        stop
  +    }
  +}

• Sudo::User[nrpe-check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status]

  Parameters differences:

  --- Sudo::User[nrpe-check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status].orig
  +++ Sudo::User[nrpe-check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status]
  
  +    ensure     => absent
  +    user       => nagios
  +    require    => ['Class[Sudo]']
  +    tag        => nrpe::check
  +    privileges => []
  

• File[/lib/systemd/system/security_group_ssh-from-restricted-bastion_to_project_quarry.timer]

  Parameters differences:

  --- File[/lib/systemd/system/security_group_ssh-from-restricted-bastion_to_project_quarry.timer].orig
  +++ File[/lib/systemd/system/security_group_ssh-from-restricted-bastion_to_project_quarry.timer]
  
  +    ensure => absent
  +    notify => Exec[systemd daemon-reload for security_group_ssh-from-restricted-bastion_to_project_quarry.timer (security_group_ssh-from-restricted-bastion_to_project_quarry.timer)]
  +    mode   => 0444
  +    owner  => root
  +    group  => root
  

  Content differences:

  --- /lib/systemd/system/security_group_ssh-from-restricted-bastion_to_project_quarry.timer.orig
  +++ /lib/systemd/system/security_group_ssh-from-restricted-bastion_to_project_quarry.timer
  @@ -0,0 +1,12 @@
  +[Unit]
  +Description=Periodic execution of security_group_ssh-from-restricted-bastion_to_project_quarry.service
  +
  +[Timer]
  +Unit=security_group_ssh-from-restricted-bastion_to_project_quarry.service
  +# Accuracy sets the maximum time interval around the execution time we want to allow
  +AccuracySec=15sec
  +OnCalendar=*-*-* *:00/30:00
  +RandomizedDelaySec=0
  +
  +[Install]
  +WantedBy=multi-user.target

• Nrpe::Check[check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status]

  Parameters differences:

  --- Nrpe::Check[check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status].orig
  +++ Nrpe::Check[check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status]
  
  +    command => /usr/local/lib/nagios/plugins/check_systemd_unit_status security_group_ssh-from-restricted-bastion_to_project_superset
  +    ensure  => absent
  +    before  => Monitoring::Service[check_security_group_ssh-from-restricted-bastion_to_project_superset_status]
  

• Systemd::Unit[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.timer]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.timer].orig
  +++ Systemd::Unit[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.timer]
  
  +    restart           => False
  +    override          => False
  +    ensure            => absent
  +    unit              => nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.timer
  +    override_filename => puppet-override.conf
  +    require           => ['Class[Systemd]']
  

• Systemd::Service[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status]

  Parameters differences:

  --- Systemd::Service[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status].orig
  +++ Systemd::Service[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status]
  
  +    restart                  => False
  +    migration_task           => T407130
  +    monitoring_critical      => False
  +    ensure                   => absent
  +    require                  => Systemd::Unit[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.service]
  +    service_params           => {}
  +    monitoring_enabled       => False
  +    unit_type                => timer
  +    override                 => False
  +    monitoring_contact_group => admins
  

• Service[security_group_ssh-from-restricted-bastion_to_project_quarry.timer]

  Parameters differences:

  --- Service[security_group_ssh-from-restricted-bastion_to_project_quarry.timer].orig
  +++ Service[security_group_ssh-from-restricted-bastion_to_project_quarry.timer]
  
  +    ensure   => stopped
  +    before   => ['Exec[systemd daemon-reload for security_group_ssh-from-restricted-bastion_to_project_quarry.timer (security_group_ssh-from-restricted-bastion_to_project_quarry.timer)]']
  +    provider => systemd
  +    enable   => False
  

• Exec[systemd daemon-reload for security_group_ssh-from-restricted-bastion_to_project_quarry.timer (security_group_ssh-from-restricted-bastion_to_project_quarry.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for security_group_ssh-from-restricted-bastion_to_project_quarry.timer (security_group_ssh-from-restricted-bastion_to_project_quarry.timer)].orig
  +++ Exec[systemd daemon-reload for security_group_ssh-from-restricted-bastion_to_project_quarry.timer (security_group_ssh-from-restricted-bastion_to_project_quarry.timer)]
  
  +    command     => /bin/systemctl daemon-reload
  +    refreshonly => True
  

• File[/lib/systemd/system/nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.service]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.service].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.service]
  
  +    ensure => absent
  +    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.service (nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.service)]
  +    mode   => 0444
  +    owner  => root
  +    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.service.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.service
  @@ -0,0 +1,11 @@
  +[Unit]
  +Description=execution of nrpe2nodexp for the check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status command.
  +Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  +
  +[Service]
  +Type=oneshot
  +User=nagios
  +
  +Group=prometheus-node-exporter
  +SyslogIdentifier=nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status
  +ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "06b7b86463e586f13fe462de48021ff5" --timeout 10 --check-command "check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status"

• File[/var/lib/prometheus/node.d/check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.prom]

  Parameters differences:

  --- File[/var/lib/prometheus/node.d/check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.prom].orig
  +++ File[/var/lib/prometheus/node.d/check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.prom]
  
  +    owner  => root
  +    ensure => absent
  +    group  => root
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.service (nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.service (nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.service)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.service (nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.service)]
  
  +    command     => /bin/systemctl daemon-reload
  +    refreshonly => True
  

• Systemd::Monitor[security_group_ssh-from-restricted-bastion_to_project_superset]

  Parameters differences:

  --- Systemd::Monitor[security_group_ssh-from-restricted-bastion_to_project_superset].orig
  +++ Systemd::Monitor[security_group_ssh-from-restricted-bastion_to_project_superset]
  
  +    migration_task => T407130
  +    retries        => 2
  +    check_interval => 10
  +    ensure         => absent
  +    contact_group  => admins
  +    notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  +    critical       => False
  

• Rsyslog::Conf[security_group_ssh-from-restricted-bastion_to_project_quarry]

  Parameters differences:

  --- Rsyslog::Conf[security_group_ssh-from-restricted-bastion_to_project_quarry].orig
  +++ Rsyslog::Conf[security_group_ssh-from-restricted-bastion_to_project_quarry]
  
  +    mode     => 0444
  +    ensure   => absent
  +    priority => 40
  +    require  => File[/var/log/security_group_ssh-from-restricted-bastion_to_project_quarry]
  

• Systemd::Syslog[security_group_ssh-from-restricted-bastion_to_project_quarry]

  Parameters differences:

  --- Systemd::Syslog[security_group_ssh-from-restricted-bastion_to_project_quarry].orig
  +++ Systemd::Syslog[security_group_ssh-from-restricted-bastion_to_project_quarry]
  
  +    ensure                 => absent
  +    base_dir               => /var/log
  +    programname_comparison => startswith
  +    force_stop             => True
  +    log_filename           => syslog.log
  +    owner                  => root
  +    readable_by            => all
  +    group                  => root
  

• File[/lib/systemd/system/security_group_ssh-from-restricted-bastion_to_project_superset.timer]

  Parameters differences:

  --- File[/lib/systemd/system/security_group_ssh-from-restricted-bastion_to_project_superset.timer].orig
  +++ File[/lib/systemd/system/security_group_ssh-from-restricted-bastion_to_project_superset.timer]
  
  +    ensure => absent
  +    notify => Exec[systemd daemon-reload for security_group_ssh-from-restricted-bastion_to_project_superset.timer (security_group_ssh-from-restricted-bastion_to_project_superset.timer)]
  +    mode   => 0444
  +    owner  => root
  +    group  => root
  

  Content differences:

  --- /lib/systemd/system/security_group_ssh-from-restricted-bastion_to_project_superset.timer.orig
  +++ /lib/systemd/system/security_group_ssh-from-restricted-bastion_to_project_superset.timer
  @@ -0,0 +1,12 @@
  +[Unit]
  +Description=Periodic execution of security_group_ssh-from-restricted-bastion_to_project_superset.service
  +
  +[Timer]
  +Unit=security_group_ssh-from-restricted-bastion_to_project_superset.service
  +# Accuracy sets the maximum time interval around the execution time we want to allow
  +AccuracySec=15sec
  +OnCalendar=*-*-* *:00/30:00
  +RandomizedDelaySec=0
  +
  +[Install]
  +WantedBy=multi-user.target

• Class[Openstack::Apply_security_groups]

  Parameters differences:

  --- Class[Openstack::Apply_security_groups].orig
  +++ Class[Openstack::Apply_security_groups]
  
  @@
  -    project_and_security_group => {'trove': 'ssh-from-restricted-bastion', 'paws': 'ssh-from-restricted-bastion', 'c26d9d326bdf464fa1025939ded7e5a2': 'ssh-from-restricted-bastion', 'bd825ee46c214f9e88126a2b290d88f8': 'ssh-from-restricted-bastion'}
  +    project_and_security_group => {'trove': 'ssh-from-restricted-bastion', 'paws': 'ssh-from-restricted-bastion', 'quarry': 'ssh-from-restricted-bastion', 'superset': 'ssh-from-restricted-bastion', 'c26d9d326bdf464fa1025939ded7e5a2': 'ssh-from-restricted-bastion', 'bd825ee46c214f9e88126a2b290d88f8': 'ssh-from-restricted-bastion'}
  

• Nrpe::Monitor_service[check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]

  Parameters differences:

  --- Nrpe::Monitor_service[check_security_group_ssh-from-restricted-bastion_to_project_quarry_status].orig
  +++ Nrpe::Monitor_service[check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]
  
  +    nrpe_command                   => /usr/local/lib/nagios/plugins/check_systemd_unit_status security_group_ssh-from-restricted-bastion_to_project_quarry
  +    check_interval                 => 10
  +    ensure                         => absent
  +    timeout                        => 10
  +    retry_interval                 => 1
  +    notes_url                      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  +    retries                        => 2
  +    migration_task                 => T407130
  +    nrpe2nodexp_parse_perf_data    => False
  +    enable_nrpe2nodexp             => False
  +    enable_icinga_check            => True
  +    alertmanager_team              => observability
  +    critical                       => False
  +    alertmanager_severity_override => info
  +    contact_group                  => admins
  +    description                    => Check unit status of security_group_ssh-from-restricted-bastion_to_project_quarry
  

• Exec[systemd daemon-reload for security_group_ssh-from-restricted-bastion_to_project_superset.timer (security_group_ssh-from-restricted-bastion_to_project_superset.timer)]

  Parameters differences:

  --- Exec[systemd daemon-reload for security_group_ssh-from-restricted-bastion_to_project_superset.timer (security_group_ssh-from-restricted-bastion_to_project_superset.timer)].orig
  +++ Exec[systemd daemon-reload for security_group_ssh-from-restricted-bastion_to_project_superset.timer (security_group_ssh-from-restricted-bastion_to_project_superset.timer)]
  
  +    command     => /bin/systemctl daemon-reload
  +    refreshonly => True
  

• Service[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.timer]

  Parameters differences:

  --- Service[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.timer].orig
  +++ Service[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.timer]
  
  +    ensure   => stopped
  +    before   => ['Exec[systemd daemon-reload for nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.timer (nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.timer)]']
  +    provider => systemd
  +    enable   => False
  

• Systemd::Unit[security_group_ssh-from-restricted-bastion_to_project_quarry.service]

  Parameters differences:

  --- Systemd::Unit[security_group_ssh-from-restricted-bastion_to_project_quarry.service].orig
  +++ Systemd::Unit[security_group_ssh-from-restricted-bastion_to_project_quarry.service]
  
  +    restart           => False
  +    override          => False
  +    ensure            => absent
  +    unit              => security_group_ssh-from-restricted-bastion_to_project_quarry.service
  +    override_filename => puppet-override.conf
  +    require           => ['Class[Systemd]']
  

• Exec[systemd daemon-reload for security_group_ssh-from-restricted-bastion_to_project_superset.service (security_group_ssh-from-restricted-bastion_to_project_superset.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for security_group_ssh-from-restricted-bastion_to_project_superset.service (security_group_ssh-from-restricted-bastion_to_project_superset.service)].orig
  +++ Exec[systemd daemon-reload for security_group_ssh-from-restricted-bastion_to_project_superset.service (security_group_ssh-from-restricted-bastion_to_project_superset.service)]
  
  +    command     => /bin/systemctl daemon-reload
  +    refreshonly => True
  

• File[/lib/systemd/system/nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.service]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.service].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.service]
  
  +    ensure => absent
  +    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.service (nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.service)]
  +    mode   => 0444
  +    owner  => root
  +    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.service.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.service
  @@ -0,0 +1,11 @@
  +[Unit]
  +Description=execution of nrpe2nodexp for the check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status command.
  +Documentation=https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  +
  +[Service]
  +Type=oneshot
  +User=nagios
  +
  +Group=prometheus-node-exporter
  +SyslogIdentifier=nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status
  +ExecStart=-/usr/local/bin/nrpe2nodexp --alert-rule-hash "bddd44659547ec7e7cbe557e2f1c1f2a" --timeout 10 --check-command "check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status"

• Monitoring::Service[check_security_group_ssh-from-restricted-bastion_to_project_superset_status]

  Parameters differences:

  --- Monitoring::Service[check_security_group_ssh-from-restricted-bastion_to_project_superset_status].orig
  +++ Monitoring::Service[check_security_group_ssh-from-restricted-bastion_to_project_superset_status]
  
  +    migration_task => T407130
  +    passive        => False
  +    ensure         => absent
  +    check_interval => 10
  +    config_dir     => /etc/nagios
  +    retry_interval => 1
  +    notes_url      => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  +    freshness      => 36000
  +    critical       => False
  +    retries        => 2
  +    contact_group  => admins
  +    host           => cloudcontrol1011
  +    check_command  => nrpe_check!check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status!10
  +    description    => Check unit status of security_group_ssh-from-restricted-bastion_to_project_superset
  

• File[/lib/systemd/system/nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.timer]

  Parameters differences:

  --- File[/lib/systemd/system/nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.timer].orig
  +++ File[/lib/systemd/system/nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.timer]
  
  +    ensure => absent
  +    notify => Exec[systemd daemon-reload for nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.timer (nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.timer)]
  +    mode   => 0444
  +    owner  => root
  +    group  => root
  

  Content differences:

  --- /lib/systemd/system/nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.timer.orig
  +++ /lib/systemd/system/nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.timer
  @@ -0,0 +1,14 @@
  +[Unit]
  +Description=Periodic execution of nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.service
  +
  +[Timer]
  +Unit=nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.service
  +# Accuracy sets the maximum time interval around the execution time we want to allow
  +AccuracySec=15sec
  +OnUnitInactiveSec=5min
  +OnActiveSec=1s
  +RandomizedDelaySec=300
  +FixedRandomDelay=true
  +
  +[Install]
  +WantedBy=multi-user.target

• Exec[systemd daemon-reload for security_group_ssh-from-restricted-bastion_to_project_quarry.service (security_group_ssh-from-restricted-bastion_to_project_quarry.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for security_group_ssh-from-restricted-bastion_to_project_quarry.service (security_group_ssh-from-restricted-bastion_to_project_quarry.service)].orig
  +++ Exec[systemd daemon-reload for security_group_ssh-from-restricted-bastion_to_project_quarry.service (security_group_ssh-from-restricted-bastion_to_project_quarry.service)]
  
  +    command     => /bin/systemctl daemon-reload
  +    refreshonly => True
  

• Logrotate::Conf[security_group_ssh-from-restricted-bastion_to_project_quarry]

  Parameters differences:

  --- Logrotate::Conf[security_group_ssh-from-restricted-bastion_to_project_quarry].orig
  +++ Logrotate::Conf[security_group_ssh-from-restricted-bastion_to_project_quarry]
  
  +    ensure => absent
  

• File[/etc/sudoers.d/nrpe-check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]

  Parameters differences:

  --- File[/etc/sudoers.d/nrpe-check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status].orig
  +++ File[/etc/sudoers.d/nrpe-check_check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]
  
  +    owner   => root
  +    ensure  => absent
  +    group   => root
  +    require => Package[nagios-nrpe-server]
  

• Systemd::Timer[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]

  Parameters differences:

  --- Systemd::Timer[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status].orig
  +++ Systemd::Timer[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status]
  
  +    accuracy           => 15sec
  +    ensure             => absent
  +    timer_intervals    => [{'start': 'OnUnitInactiveSec', 'interval': '5min'}, {'interval': '1s', 'start': 'OnActiveSec'}]
  +    unit_name          => nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.service
  +    fixed_random_delay => True
  +    splay              => 300
  

• Exec[systemd daemon-reload for nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.service (nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.service)]

  Parameters differences:

  --- Exec[systemd daemon-reload for nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.service (nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.service)].orig
  +++ Exec[systemd daemon-reload for nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.service (nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_quarry_status.service)]
  
  +    command     => /bin/systemctl daemon-reload
  +    refreshonly => True
  

• Systemd::Unit[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.service]

  Parameters differences:

  --- Systemd::Unit[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.service].orig
  +++ Systemd::Unit[nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.service]
  
  +    restart           => False
  +    override          => False
  +    ensure            => absent
  +    unit              => nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status.service
  +    override_filename => puppet-override.conf
  +    require           => ['Class[Systemd]']
  

• Monitoring::Exported_nagios_service[cloudcontrol1011 check_security_group_ssh-from-restricted-bastion_to_project_superset_status]

  Parameters differences:

  --- Monitoring::Exported_nagios_service[cloudcontrol1011 check_security_group_ssh-from-restricted-bastion_to_project_superset_status].orig
  +++ Monitoring::Exported_nagios_service[cloudcontrol1011 check_security_group_ssh-from-restricted-bastion_to_project_superset_status]
  
  +    service_description    => Check unit status of security_group_ssh-from-restricted-bastion_to_project_superset
  +    is_volatile            => 0
  +    ensure                 => absent
  +    check_interval         => 10
  +    notification_options   => c,r,f
  +    retry_interval         => 1
  +    notifications_enabled  => 1
  +    notes_url              => https://wikitech.wikimedia.org/wiki/Monitoring/systemd_unit_state
  +    notification_interval  => 0
  +    check_period           => 24x7
  +    passive_checks_enabled => 1
  +    max_check_attempts     => 2
  +    contact_groups         => admins
  +    active_checks_enabled  => 1
  +    notification_period    => 24x7
  +    check_command          => nrpe_check!check_check_security_group_ssh-from-restricted-bastion_to_project_superset_status!10
  +    host_name              => cloudcontrol1011
  +    check_freshness        => 0
  +    servicegroups          => wmcs_eqiad
  

• File[/etc/rsyslog.d/40-security-group-ssh-from-restricted-bastion-to-project-superset.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/40-security-group-ssh-from-restricted-bastion-to-project-superset.conf].orig
  +++ File[/etc/rsyslog.d/40-security-group-ssh-from-restricted-bastion-to-project-superset.conf]
  
  +    ensure => absent
  +    notify => Service[rsyslog]
  +    mode   => 0444
  +    owner  => root
  +    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/40-security-group-ssh-from-restricted-bastion-to-project-superset.conf.orig
  +++ /etc/rsyslog.d/40-security-group-ssh-from-restricted-bastion-to-project-superset.conf
  @@ -0,0 +1,10 @@
  +# rsyslog.conf(5) configuration file for services.
  +# This file is managed by Puppet.
  +if $programname startswith "security_group_ssh-from-restricted-bastion_to_project_superset" then {
  +    action(
  +        type="omfile" file="/var/log/security_group_ssh-from-restricted-bastion_to_project_superset/syslog.log"
  +        fileOwner="root" fileGroup="root"
  +        fileCreateMode="0644"
  +    )
  +    & stop
  +}

• File[/etc/rsyslog.d/25-nrpe2nodexp-check-security-group-ssh-from-restricted-bastion-to-project-superset-status.conf]

  Parameters differences:

  --- File[/etc/rsyslog.d/25-nrpe2nodexp-check-security-group-ssh-from-restricted-bastion-to-project-superset-status.conf].orig
  +++ File[/etc/rsyslog.d/25-nrpe2nodexp-check-security-group-ssh-from-restricted-bastion-to-project-superset-status.conf]
  
  +    ensure => absent
  +    notify => Service[rsyslog]
  +    mode   => 0444
  +    owner  => root
  +    group  => root
  

  Content differences:

  --- /etc/rsyslog.d/25-nrpe2nodexp-check-security-group-ssh-from-restricted-bastion-to-project-superset-status.conf.orig
  +++ /etc/rsyslog.d/25-nrpe2nodexp-check-security-group-ssh-from-restricted-bastion-to-project-superset-status.conf
  @@ -0,0 +1,10 @@
  +# SPDX-License-Identifier: Apache-2.0
  +if $programname contains "nrpe2nodexp-check_security_group_ssh-from-restricted-bastion_to_project_superset_status" then {
  +    if ($msg contains "\"ecs.version\": \"1.7.0\"") then {
  +        # Send logs to kafka
  +        set $.log_outputs = "kafka ecs_170 local";
  +    } else {
  +        # Filter out non-relevant nrpe2nodexp messages
  +        stop
  +    }
  +}

Relevant files

• Production catalog
• Change catalog
• Production errors/warnings
• Change errors/warnings
• Core Diff
• Standard Diff