On Thu, Dec 05, 2013 at 15:37:42 +0200, Ohad Levy wrote: [...]
A) uReports are collected by ABRT server deployed by the administrator. Upon receiving a report, the ABRT server notifies Foreman (or Foreman can periodically ask the ABRT server for new reports). Foreman communicates with ABRT server using some kind of REST API.
- machine authentication has to be handled by ABRT server
- ABRT server has to provide suitable API
- not necessary to duplicate ABRT server code in Foreman
Does it make sense to have multiple abrt servers? does it make sense to tie these into foreman proxies (e.g. when having disconnected networks?)
I don't think it does. One of the main features of the server is grouping the reports that were probably caused by the same bug. I'd say it's best to have just one server.
B) uReports are collected by Foreman, or some kind of proxy written for this purpose. The reports can be browsed in Foreman and can be forwarded to ABRT server instance, either automatically or after the administrator manually accepts the report. The report can be forwarded to ABRT server run by the administrator, or it can be forwarded to the instance managed by Fedora/Red Hat/etc.
- Foreman handles machine authentication
- administrator can benefit from this without deploying their own ABRT server
- subset of the ABRT server functionality would have to be implemented by the Foreman plugin/proxy
Which level of complexity are we talking about here? does it make sense to rewrite the abrt server? (or is it only a subset of the functionality?)
The server is quite complex as it does e.g. the report clustering or resolving function names in stacktraces. I don't think rewriting it entirely is reasonable. However, I can imagine that implementing a tiny subset that would allow the administrator to see that a crash happened in program X (from package Y) Z times in some timeframe would still be useful.
- Machine authentication
uReports were originally designed to allow anonymous reporting, mainly for Fedora users. They only contain data that are not considered sensitive and we currently have no way to find out where did an uReport come from.
While we could just add an item containing e.g. FQDN to the uReport, such information can be easily spoofed. Can we take advantage of the fact that there already exists authentication between the managed machines and Foreman (or Puppet?)?
I would assume in this case, you would want your systems to be known, we could utilize the system facts, or uuid to identify it.
I think that without this assumption there wouldn't be many reasons to integrate abrt server with foreman, as opposed to just running the standalone abrt server somewhere on the network.
Thanks for the response, Martin