As I alluded to in a previous blog entry, we’ve recently been expanding and are going to open a dedicated Customer Service Centre in extra office space that we have taken over in our building.  It’s quite a graphic heavy post, so the pictures are thumbnails – click on any of the pictures to get a larger version.  Sorry for the fact that the quality isn’t amazing, I didn’t have my SLR to hand, so I had to take them on my Android phone.

The new centre is almost finished, here are some picture of how it’s all coming together.

Un-boxing of new equipment well underway.  The upstairs windows have a great view of the River Wey and its narrow boats.

The new racks installed with patch panels and ready to be loaded with switches and servers.

General view of the centre; desks in place, displays getting ready to be mounted.

Unboxing the displays. The displays will help us to monitor customer servers and helpdesk tickets.

Wall mounting brackets for the displays.

The displays up and running and installed with Debian.

Configuring the networking on the displays.

We’re almost ready to unveil our Customer Service Centre, after a couple of frantic weeks getting the cabling installed, assembling the racks, desks and chairs, buying plants and all that, we’re almost there!

We will be delighted to give any current and prospective new customers a tour of the new space and keep posted for the full unveiling when it’s all complete!

I came to a startling realisation yesterday.  Somehow, 2010 has been charging along at the pace of an express train without me even noticing.  Yesterday seemed to be Christmas, but now we’re at the start of March.  That means that it’s now nearly a month since FOSDEM (Free and Open Source Developer’s European Meeting) was held at the Université Libre de Bruxelles.

We have recently been expanding into additional office space upstairs which has been turned into our new Customer Service Centre, this possibly explains where some of the lost time has gone.  More on that, with pictures, in another blog post.

Mark Taylor and I recently travelled to Brussels to attend FOSDEM.  The journey was smooth, with even the M25 being kind to us.  The French and Belgian Autoroutes had hardly any traffic on them until we approached the outskirts of Brussels.  It’s the first time that I’ve been on the Eurotunnel for many years, having favoured the ferry more recently, but it’s wonderful to be able to drive to Brussels, from London, in about the same time that it takes to get to Liverpool or Manchester.  On the Autoroute in France I was interested to see a Lithuanian car transporter filled with N-reg (about 15 year old)  British-registered vehicles – heading away from Britain.

Having arrived in Brussels at about 7pm we spent some time trying to understand the street parking restrictions, before heading off for a quiet drink and Belgian waffle to prepare for the rest of the evening. The Beer (unfortunately not Free) Event was at the Delirium Café near the Grand’Place in Brussels. Festivities were in full swing by this time with a great atmosphere.  If you’ve ever wanted to be in a bar filled only with several thousand other geeks, the Beer event at FOSDEM is definitely the right place to be.  The Delirium Café is in an old and unspoilt part of Brussels which is exceedingly beautiful and very metropolitan with outside restaurants, despite it being in the depths of winter. Despite not being a particularly big beer fan, some of the Belgian beers are very good, particularly the fruit beers from the likes of Lindemans, which are very refreshing

The party went on until the early hours of the morning, and then continued into the not-so-early hours of the morning.  This might explain our slightly late arrival at the site of the Université Libre de Bruxelles on Saturday morningafternoon, where the main FOSDEM conference was held.

Parts of the Université also had some great architecture, but its size meant that keen navigation skills were useful.

Due to the huge number of tracks on such a large number of topics, it was hard to decide exactly which talks to go to, so we decided to go for the tried and tested and went to our good friend Paul Adams’ talk on KDE PIM.

It was great to see stands from so many organisations, from Firefox (bonus points for the cute fox logo)…

…to KDE and Amarok.

I like trying Continental foods, so I was keen to try a restaurant serving local styles of food.  I’ve eaten snails before many years ago in France, but decided that it would be good to try them again.  Which was  followed by something a lot more familiar – Moules (Mussels) for main course. The snails were moderately pleasant. Glad that I tried them but probably won’t do so again for a while.  I did give the frogs legs a miss though.

On the Sunday, for me, the highlight of the day was a talk by Andrew Tanenbaum on MINIX. Tanenbaum is famously known for his debate with Linux Torvalds in 1992 about kernel design. MINIX is a still teaching and research operating system, and the talk was entitled “MINIX 3: a Modular, Self-Healing POSIX-compatible Operating System”.

Despite the fact that it was about a highly technical subject, the talk was very accessible, and made even better by the fact that Tanenbaum is an excellent lecturer who did a great job of keeping the audience entertained and interested.

Overall, FOSDEM was a great opportunity for like-minded people from all over Europe (and perhaps further) to talk about their common interests, even though they were from different projects.

At Sirius we have recently started using and deploying Roundcube in favour of the tried and tested (but very old) Squirrelmail. Impressed by it’s beautiful front-end, ease of use and obvious extensibility, Tom Callway spoke to Till Klampaeckel and Thomas Bruederli, two of Roundcube’s core developers, to find out more about this exciting project.

1) What is Roundcube?

Roundcube is a free open source webmail client with an application-like user interface. Roundcube provides all the functionality one expects from an e-mail program and connects to any mail server backend that supports IMAP.

2) To the best of your knowledge where is the biggest deployment to date?

Below are a couple use-cases, which we’ll probably put on the website as well some time soon. All people of those people are active in one way or another on our mailing list lists.roundcube.net/, users@ and dev@ and agreed to share more experiences and help users in case they have questions.

Most of these installations also have another alternative to RoundCube (e.g. Squirrelmail or Horde/IMP)

University of Michigan
users: 70,013 (there are more users, but the others haven’t used Roundcube yet)

XS4ALL, Netherlands
users: 50,000

Datenpark.ch
users: 3,500

San Pablo CEU University (Spain)
users: 15,000+

Introweb
users: 5000 active users

3) How does Roundcube differ from other open source webmail solutions?

For starters, Roundcube looks awesome!

Mail view of Roundcube

Thanks to its ajax-based architecture it’s fast and responsive and it’s used just like a “real” (desktop) application.

Another big advantage is the separation of the frontend from the functionality which makes Roundcube fully customizable using the skins. We learned that a lot of people want more options when it comes to customizing the visual appearance than just choosing from different set of colors.

4) How extensible is Roundcube using its plugin API?

Plugins are very easy to develop due to their object-oriented architecture. Roundcube is shipped with a couple simple plugins which can be used as template to get started.

Roundcube’s core currently offers over 40 plugin hooks and we try to please everyone by implementing requests for new plugin hooks right away.

Roundcube’s API provides hooks for both the server and the client side. Add the JQuery library (for client side scripting) to the mix and it’s even easier to extend the client functionality because so many developers are already familiar with it.

5) Roundcube is built on IlohaMail’s IMAP library. Why did you choose this as the underlying engine?

At the time when we started Roundcube, the IMAP library was not a default part of PHP and we wanted to provide a software that runs on any standard Apache+PHP box without lots of dependencies. The Ilohamail IMAP wrapper seemed to be simple and also faster.

6) Do you have ambitions to extend Roundcube to offer a groupware functionality like calendaring in the core application?

No, we personally don’t have such ambitions but the plugin API should make it possible to extend a Roundcube installation with such features.

There are already other sophisticated open source solutions for groupware and we don’t want to compete with them. We’d rather see a couple integrations.

7) Why was it so important to release Roundcube as a free, open source project? What advantages does it bring as opposed to using an ‘opencore’ business model?

Open source software is a very important part of Roundcube itself and we wanted to contribute something back to the community. The main advantage for us is that the software is provided “as is” and we don’t have to provide support or responsibility to our “customers”. This may sound a bit rude but all of the core members of the Roundcube team are volunteers working on the project in their spare time. We all have our jobs beside Roundcube and therefore we cannot provide real-time support or immediate fixes if a problem occurs. This is something people would expect when the pay for a product.

8 ) Can users try Roundcube without doing a full installation, to just to get a feeling for the capabilities?

No, we currently don’t have an online demo ourselves. But on the Roundcube forums, there are always a couple users who run demo sites.

9) Are you seeing more interest in Roundcube within enterprises with the economic downturn?

When looking at the download counts we don’t see an increased interest in Roundcube. Maybe enterprises still hesitate to use open source software. Maybe that’s because the IT industry really hasn’t seen the crisis (yet).

Also, one of the reasons people always hesitate to use Roundcube are the conservative versioning we keep. Despite what people think – we are currently “only” at zero dot three dot one.

We are pretty sure that this relatively low version number make it look like we are not finished yet.

10) How is your project organised and how might somebody interested in contributing to the codebase get involved?

The core team of Roundcube consists of about 5 people who keep up the infrastructure and control the development process. The most important tools are the Trac platform with the bug tracker and the developers mailing list. This is the place where the ongoing development is discussed and where everybody can contribute. See trac.roundcube.net/wiki/Dev_Contribution

11) You’ve just released version 0.3.1? What features are you most excited about?

The plugin API. It’s very exciting to see what people do with it and how they extend Roundcube to become an integral part of their platform.

12) To your mind what does the open source movement need to get even more traction? Better evangelists? Better marketing?

From our perspective the biggest factor are people. It always requires more people who actively contribute to open source projects.

Contribution is not just about writing code. It also includes writing documentation, writing bug reports, answering questions, translating and of course evangelism. Whenever a company decides to integrate open source software for their customers and then encourages their employees to contribute their work to the project, that’s a great situation for any open source project to be in. And those are of course the kind of projects any active open source contributor likes to have.

In Roundcube’s case some of our contributors are paid by their employer (or a client) to work on Roundcube, but this is currently just a minority.

Goals

The goals of this blog are to illustrate how to:

• authenticate Mac OSX Leopard workstations from an existing redundant OpenLDAP infrastructure
• configure Mac OSX Leopard workstations from an existing redundant OpenLDAP infrastructure
• store and manage configuration settings on an existing redundant OpenLDAP infrastructure using Workgroup Manager

Please note that this article applies only to Mac OSX Leopard. Previous and later versions are untested.

Download Whitepaper

Introduction

OS X Server contains an directory service, which provides authentication and other network services. It is called Open Directory, and is based on OpenLDAP. As you would expect from an Apple product, it’s shiny and can be configured mostly by pointing and clicking. That’s fine if you have an entirely Apple network, but it leaves you a little stuck if you have a pre-existing network which already has a directory service. How do you avoid duplication?

On top of Open Directory, Workgroup Manager is Apple’s tool for controlling networks of OS X workstations. You can configure preferences on a user, group, computer, or computer group basis. The last option, “computer group” is powerful because you can specify machines by geographical location (or any other metric that you care to choose), and apply settings. For instance, you might want USB sticks to work in the computer labs so that students can save work, but not in the library.

Thankfully however, the answer to the duplication question is that it is quite possible to integrate OS X with an existing directory service such as that provided by Linux and OpenLDAP. The Workgroup Manager white paper promises “Leverage existing network resources by integrating with any LDAP server”, but unfortunately documentation on how to achieve it is hard to come by. (Active Directory should also be possible and is documented elsewhere, but that is left as an exercise for the reader – the principles described in this article apply to any directory service).

There are actually two ways of integrating Mac OS X into an existing infrastructure. One is the Dual Directory setup, which is called the “magic” or “golden” triangle.

This has a number of drawbacks. As the Mac workstations are now using two directory infrastructures, this means running two redundant infrastructures – if either side stops working, things will break horribly. This typically means running multiple OS X Servers, to supplement the pre-existing redundant OpenLDAP infrastructure.

There is a better alternative. Our preferred option is to set up the Mac OS X Server to store the configuration settings for clients and workstations directly in the the Linux-based OpenLDAP directory.

This means that on a daily basis, the Mac (and other workstations) will only speak to the existing OpenLDAP infrastructure. It does not matter greatly if the OS X Server disappears. The OS X Server is only used to change the configuration, which is not generally done very often. Mac workstations will continue to log in and perform correctly even if the OS X Server isn’t there.

Example LDAP directory

See Example LDAP hierarchy. Note that user settings are stored in the user’s record (by also making them an apple-user object class). Other settings will be stored under a new part of the LDAP tree, ou=macosx.

Settings can be applied in different ways in Workgroup Manager.

• Never – the setting is not applied
• Once – the setting is applied as a default setting, but the user is free to change if they wish
• Always – the setting is applied, and the user cannot change the setting (the setting is greyed out)

As the same settings can be applied to both computers and groups, it is important to understand that there is an order of precedence in the way that settings are applied and override each other. Settings applied to the individual user have the highest level of precedence, which allows a high level of granularity to be achieved.

We’ve talked above about an existing redundant OpenLDAP infrastructure. By redundant, we mean that you have OpenLDAP configured in a Master-Slave relationship, with the Master replicating changes out to the slaves.

Although it is possible to run OpenLDAP in other replicated setups such as N-way Multi-Master, this is not necessary. Take a look at the OpenLDAP documentation and make a decision as to the best setup for you requirements. Alternatively contact Sirius and we’ll be happy to provide professional advice.

Implementation

Step 1 – Modify the schema

The first step is to make the OpenLDAP server aware of the schema that OS X requires. The OS X schema can be acquired from an OS X.5 Leopard workstation or servers, from

/private/etc/openldap/schema/samba.schema and /private/etc/openldap/schema/apple.schema

Copy these to your OpenLDAP server and put them in the /etc/openldap/schema

Now, a few changes need to be made to apple.schema:

Uncomment the container object class

Uncomment the authAuthority object class, and move it above the definition of apple-user (it must be moved because it is used by apple-user, and it must be defined before it can be used).

After this, modify your /etc/ldap/slapd.conf file to include the new schemas. As we use GOsa which requires some schemas of its own, a complete schema definition for us looks like:

After this, you should be able to run the slaptest command. This checks the slapd.conf file and associated schemas for validity. Hopefully, this will return:

Step 2 – import the tree structure from an OS X Server

Although the user settings are stored in the user’s records, the settings for computers are not. We’ll therefore create another organization unit in the LDAP directory. Workgroup Manager will read and write settings here, and workstations will read settings from here.

We’ll assume that your directory is under dc=example,dc=com,

Once you have the LDIF file, use ldapadd to add the structure to the LDAP server.

Step 3 – Configure the LDAP mappings on the server

The next step, which is absolutely critical to get right (otherwise you will get obtuse and thoroughly unhelpful and useless errors from Workgroup Manager) is to ensure that Directory Utility is configured correctly with the LDAP server and the correct mapping between OSX and the LDAP directory.

To start configuring the server, start Directory Utility. Switch to Advanced mode and click on the Services tab. Now add an LDAPv3 service. The LDAP Mappings should be configured to be RFC 2307 as a base, but we need to make some modifications.

To existing Users record:

add MCXFlags mapped to apple-mcxflags
add MCXSettings mapped to apple-mcxsettings

To existing Groups record:

add MCXFlags attribute mapped to apple-mcxflags
add MCXSettings attribute mapped to apple-mcxsettings

Add Computer record, with object type apple-computer and search base of cn=computers,ou=macosx,dc=example,dc=com, then:

add RealName attribute mapped to apple-realname
add Category attribute mapped to apple-category
add Comment attribute mapped to description
add IPAddress attribute mapped to ipHostNumber
add IP6Address attribute mapped to ipHostNumber
add EnetAddress attribute mapped to macAddress
add Keywords attribute mapped to apple-keyword
add MCXFlags attribute mapped to apple-mcxflags
add MCXSettings attribute mapped to apple-mcxsettings
add NetworkView attribute mapped to apple-networkview
add Group attribute mapped to apple-computerlist-groups
add UniqueID mapped to uidNumber
add GeneratedUID mapped to appled-generateduid
add AuthenticationAuthority mapped to authAuthority
add PrimaryGroupID mapped to gidNumber

Add ComputerGroups record, with object type posixGroup, apple-group, extensibleObject (note, you must choose “Map to all items in list”) and search base of cn=computer_groups,ou=macosx,dc=example,dc=com, then:

add GroupMembers mapped to apple-group-memberguid
add GroupMembership mapped to memberUid
add Member mapped to memberUid
add PrimaryGroupID mapped to gidNumber
add HomeDirectory mapped to apple-group-homeurl
add HomeLocOwner mapped to apple-group-homeowner
add MCXFlags mapped to apple-mcxflags
add MCXSettings mapped to apple-mcxsettings
add NestedGroups mapped to apple-group-nestedgroup
add RealName mapped to apple-group-realname
add Comment mapped to description
add EMailAddress mapped to mail
add Picture mapped to apple-user-picture
add JPEGPhoto mapped to jpegPhoto
add Keywords mapped to apple-keyword
add GeneratedUID mapped to apple-generateduid
add SMBRID mapped to rid
add SMBGroupRID mapped to primaryGroupID
add SMBSID mapped to sambaSID
add TimeToLive mapped to ttl
add OwnerGUID mapped to appled-ownerguid
add URL mapped to labeledURI
add ContactGUID mapped to apple-contactguid
add GroupServices mapped to apple-group-services
add ServicesLocator mapped to apple-serviceslocator
add XMLPlist mapped to apple-xmlplist
add PrimaryComputerGUID mapped to apple-primarycomputerguid
add MapCoordinates mapped to apple-maccordinates

Add ComputerLists record, with object type apple-computer-list and search base of cn=computer_lists,ou=macosx,dc=example,dc=com, then:

add MCXFlags mapped to apple-mcxflags
add MCXSettings mapped to apple-mcxsettings
add Computers mapped to apple-computers
add Group mapped to apple-computer-list-group
add GeneratdUID mapped to apple-generateduid
add Keywords mapped to apple-keyword

Having configured the LDAP mappings you can actually store the LDAP mappings themselves in LDAP. Use the “Write Settings to Server” button. Specify a DN with write access to that part of the tree and specify a search base under which ou=macosxodconfig exists – for our example tree this is cn=config,ou=macosx,dc=example,dc=com. The mapping will be written to the description attribute as base 64 encoded XML.

Step 4 – Configure LDAP settings on client

To start configuring the server, start Directory Utility. Switch to Advanced mode and click on the Services tab. Now add an LDAPv3 service. The LDAP Mappings should be configured to be from server. Set the search base to be dc=example,dc=com with the configuration search base as cn=config,ou=macosx,dc=example,dc=com.

Step 5 – Automount

As the automount stuff can also be used by Linux workstations also, it won’t be stored under ou=macosx,dc=example,dc=com, but directly under dc=example,dc=com.

The following LDIF imports the correct structure.

The LDIF can be added using ldapadd, as usual.

Step 6 – Success

At this point, your server and client are hopefully fully set up. You should now be able to view your existing users and groups in Workgroup Manager. When you log into OS X workstations, you should be able to see your NFS home directory, and have any settings from Workgroup Manager applied.

Step 7– Troubleshooting

There are various techniques you can use for debugging.

LDAP server:

Make sure that your OpenLDAP server is logging verbosely enough. A reasonable log level is:

If you’ve changed the loglevel, restart the LDAP server then monitor the logs in /var/log using tail -f

Directory Service

Directory Service is a daemon used on OS X to handle all kinds of Directory Lookups, including LDAP. It will log verbosely if it is sent the USR1 signal:

Logs will now be written to /Library/Logs/DirectoryService/DirectoryService.debug.log

See what’s stored in the database.

Use a tool such as JXPlorer to examine what is being stored in the LDAP dirctory. Check that the records contain the base64 encoded XML that you expect them to.

Workgroup Manager

To enable additional debugging in Workgroup Manager, go to Preferences and choose “Show ‘All Records’ tab and inspector. This will allow you to see the LDAP records directly.

The requirement for a new brochure last week got me tackling one of those periodic (and in my case instantly forgettable) gotchas – how to do I import EPS images into Inkscape?

I’ve been using Ubuntu Linux for years but there is one application that I just can’t give up – Adobe’s InDesign. I use it on a Mac. Yes, it’s expensive and proprietary but when it comes to desktop publishing there really is no substitute. Currently it’s hard to find a commercial printer that doesn’t balk at the idea of non Adobe-generated Postscript. That’s a shame because tools like Scribus are excellent.

At Sirius we make extensive use of image libraries like istockphoto.com. Very few designers who operate from such royalty-free libraries produce their vector scalable graphics in anything other than EPS. That’s okay if the graphic doesn’t need manual editing, you just import it straight into Adobe InDesign. But if you want to do a little tweaking you need a drawing program. On Linux, that means Inkscape.

And yet, here’s the thing – Inkscape doesn’t support the EPS format yet. It currently builds its vector images using SVG, an open standard. Unsurprisingly Adobe InDesign doesn’t support SVG. So what’s one to do? Buy Adobe Illustrator? I don’t see the point particularly when Inkscape is so capable.

Searching Google produced lots of desperate pleas from users who have experienced the same problem and lots of sub-optimal solutions. Some suggest importing your EPS into Scribus and exporting it as a SVG. Others suggest doing something similar with OpenOffice Draw. In my experience neither work satisfactorily. The former strips out large swaths of the original image and the latter ‘flattens’ the graphic so it becomes uneditable.

So to the command line.

During my investigations the leading contender was initially ‘pstoedit’. In theory this script should have processed the original EPS into a SVG file using the Ghostscript libraries:

pstodit -f plot-svg illustration.eps illustration.svg

The idea was then to edit the SVG and export it as an InDesign-friendly PDF. In practice, however, the resulting SVG was seriously degraded and unusable.

What about ‘epstopdf’, a little script that lives in the package ‘texlive-extra-utils’:

epstopdf illustration.eps

In theory this simple command should have produced what I was after. And yet attempting this on Ubuntu Jaunty threw the error:

sh: epstopdf: not found
Error: Problems running epstopdf. Check your TeX installation

This slightly odd-looking error is a known problem in Jaunty which can be caused by an inconsistent set of TeX packages and versions.

Short of spending hours in TeX related forums I discovered there is a quicker solution – upgrade to Ubuntu’s latest release, Karmic Koala.

Much to my relief ‘epstopdf’ now processes the original EPS file perfectly and delivers a PDF that Inkscape has no problem editing.

In the build up to the release of a series of benchmarking tests for network monitoring / management applications based on Open Source technologies, Tom Callway speaks to Tarus Balog, the CEO of the OpenNMS Group and current maintainer of the OpenNMS open source network management project.

1. What is OpenNMS?

“OpenNMS is the world’s first enterprise-grade network management application platform developed under the open source model.”

What the heck does that mean?

It was registered on Sourceforge in March of 2000, although it was started in 1999, so it has been around for awhile – long enough to qualify as “world’s first” when you add that …

It was designed from the beginning to be “enterprise-grade” which means it can manage tens of thousands if not hundreds of thousands of network elements. We have commercial support clients who are using one instance of OpenNMS to collect on over 50,000 discreet devices, another collecting data from over 120,000 interfaces (this results in 1.2 million data points every five minutes) and still another with 200 devices, each with 32,000 interfaces per device.

OpenNMS was also built to be a network management application platform. Users can use OpenNMS as a framework on which to build a unique management solution. While OpenNMS does a lot out of the box, it really shines when it is customised for a given network.

2. Why was it so important to release OpenNMS as a free, open source project? What advantages does it bring as opposed to using an opencore business model?

Many people involved with OpenNMS have been doing some form of network management for decades. Those of us with a lot of experience are actually a pretty small group, and we were all frustrated with the fact that commercial solutions weren’t powerful or flexible enough for us to easily deploy them for clients (not to mention the licensing costs). We thought that if we had some common platform on which to build our solutions, we could more easily meet our clients’ needs, and thus OpenNMS was born. The only way to make it grow quickly and be fair to all involved was to make it a pure open source project.

As for “open core” – that combination of open and commercial software – it goes directly against what we were trying to achieve. Open core vendors immediately put a line in the sand, saying “these features are ‘enterprise’ and you shall not have them’, thus the community is forced either to reinvent the wheel or to fork the project, or both. We hope that they’ll just use OpenNMS.

3. How is the project organised and how might somebody interested in contributing to the project get involved?

The two main places for OpenNMS involvement are the Wiki and the discussion lists.

While the project is backed by a commercial entity called The OpenNMS Group, the project is maintained by a group of about 20 people called The Order of the Green Polo. Membership is solely based on merit, and new members are voted in by existing members.

4. There are lots of competitive open source and proprietary network monitoring tools out there – what makes OpenNMS different?

The scalability and flexibility of OpenNMS make it attractive for carriers and large enterprises. If an organisation has a dedicated IT department and at least one person who focuses on management, they are probably a good candidate for using OpenNMS. In many of these companies we have replaced OpenView and Tivoli because those products simply could not handle the load.

In the open source marketplace, it seems that most vendors are focusing on the smaller organisation. Their products are great for users with a modest number of devices to monitor, but they break at scale. Some of the open core options in this space would like to say they compete with the large management vendors, but in fact they are more often competing with products like Solarwinds’ Orion. Think about it: some open core vendors charge US$100+ per device per year to license their software. A modest OpenNMS client has 2000 devices. At those prices they would have to pay US$200,000 per year for the open core option, which over, say, a 5 year lifetime makes it more expensive then HP or IBM, thus they can’t really play in our space.

5. Can you tell us more about OpenNMS’ provisioning capabilities?

It’s one thing to be able to manage a large number of devices, but if one has to spend hours and hours configuring the software to perform the management, then it isn’t enterprise-grade.

OpenNMS has always had a a powerful automatic discovery feature. New devices can be easily added to the system and management “just works”. However, we had one client, Swisscom Hospitality Services, with over 50,000 devices and a very dynamic network. There was no way automated discovery could have worked well with all of the adds, moves and changes they were doing. Since they have an internal database of their IT infrastructure, we had them export that into a specially formatted XML file, which OpenNMS could then import nightly. There was a key to relate the equipment in the Swisscom database to the device in the OpenNMS database and thus very complex changes (nodelabel, IP addresses, etc) could be easily handled.

The only downside was that it was all or nothing. One either used the automatic discovery or the model importer. In version 1.8 we will release a totally new provisioning system that combines the best of both worlds.

6. Can you expand more on the integration of RANCID and OpenNMS and why this is important?

A good portion of The OpenNMS Group revenue comes from custom development (100% of which is rolled back into the project). We had a client in Italy approach us to help them get rid of both OpenView and CiscoWorks. RANCID provides much of the functionality of CiscoWorks and being open source it allowed us to easily integrate it with OpenNMS. These efforts is expected to save the client over €1M per year.

7. Has the user experience improved with OpenJDK?

Not really. OpenJDK is nice in many ways, not the least of which is that those of us who are in open source and develop in Java are not seen as black sheep anymore (well, at least not as much). The problem is that OpenJDK is not a perfect port of the Sun JDK and since OpenNMS utilizes the Java VM to the hilt we have uncovered some bugs in OpenJDK. We reported them and they have been addressed, but I think it will be a year or two before the users will actually start to see the benefit of an improved user experience.

8. Can you elucidate the auto-discovery and other features that can make a user’s life easier?

In many products one has to manually add the device and services to be monitored, i.e. 10.1.1.1 is a Cisco Router, 10.1.1.10 is a Windows server, etc.

With OpenNMS, any new device must be put into the configuration files, but then every instance of that device is automatically detected. For example, I am working with a client who uses 29West software. The 29West application has a really nice SNMP MIB, so I analyzed it and set up OpenNMS to collect on important metrics regarding the performance of the software. Now, anytime the 29West software is discovered on a device, that data collection automatically occurs.

The best part is that since OpenNMS is open source, the community contributes quite a few configurations and thus with each release it can manage more and more devices.

9. How does OpenNMS fare performance-wise?

As I mentioned above, at Swisscom we are monitoring 50,000+ devices. At New Edge Networks they have over 14,000 devices but a whopping total of 120,000+ interfaces. We are doing data collection on about 10 data points per interface every five minutes which is something that few products can do. At a telecom company in Italy we managing devices with 32,000 interfaces per device (many virtual, of course), which breaks OpenView.

Now this doesn’t necessarily run on a Pentium III laptop with 512MB of RAM – each of these systems has hardware finely tuned to support OpenNMS – but hardware is cheap compared to the cost of comparable enterprise management software. Part of the services offered by the OpenNMS Group is advice on sizing the OpenNMS server.

10. Can you tell us about Device / Service and Device / Device dependencies?

The basic data model is that a physical device should correspond to a “node” within OpenNMS. This isn’t always the case, as virtual machines can show up like they were “real” machines, but that is the basic idea. The node supports at least one IP interface, and on that interface will be services.

The service monitoring piece of OpenNMS can range from a simple ping or port check up through complex website navigation and mail transport round trip performance. For a telecom company in Honduras we are testing voice quality and SMS performance using distributed cell phones. If a service availability test fails to meet the configured criteria for proper operation, events are generated and outage records are created.

OpenNMS is smart enough to be able to correlate all services down on an interface to an interface outage, and all interfaces down on a node to a device outage. Using the Path Outage feature of OpenNMS, the topology of devices can be taken into account (so that a router going down does not result in 200 node down notices being sent).

In addition, OpenNMS has an alarm subsystem similar to IBM Tivoli’s Netcool product. It allows for ad hoc correlations to be configured so that, say, “up” alarms are matched with “down” alarms and then cleared.

11. What’s coming up in version 1.8? What are you most excited about?

There are lots of things in 1.8 that I’m excited about, but the two main features are the new provisioner and access control changes.

The provisioning system combines the best of the current automated discovery and the model importer. It gives the user the ability to finely control discovery, from what gets discovered, down to which non-IP interfaces are scheduled for data collection. It can be very permissive (discovering lots of services automatically) to very restricted (only monitoring particular, explicit services on these devices) or some combination of the two. In addition, provisioning changes can cause actions to be taken on external systems, such as changing the node label on a device can cause the DNS entry for that device to be dynamically updated. This compliments the OpenNMS Trouble Ticketing API as another area where two way interaction between the platform and other applications is being implemented.

There is also the addition of access control. Currently, any privileged user of OpenNMS can see all the devices on a particular instance. This doesn’t work well in service provider environments where the client wants to give access to multiple clients but only to their particular resources. For our larger clients this has always been easy since there is a separate customer portal that just mines data from OpenNMS, but for others this will make their lives easier, especially in multi-tenancy environments.

My favorite feature in 1.8 is WMI data collection. Not because I like Windows (I had to go and buy a Windows license just to test the feature) but the fact that it was contributed by a community member, Matt Raykowski, who became a member of the Order of the Green Polo because of it. Contribution to OpenNMS ranges from simple typo correction all the way up to powerful features like WMI collection, and I’d bet few projects can claim as much on the higher end as we do. That’s why I like it so much.

Many people give lip services to open source, but OpenNMS proves that a) open source can compete at the highest levels in the enterprise and b) that it can be done without resorting to commercial software business models.

An enterprise thrives or fails according to how well it does what it does. That much is, or should be, obvious. Inevitably, as they grow processes are put in place which seek to improve efficiency. In recent years with essentially all employees having access to computers, software has been built to recreate those processes electronically.

Enterprise Resource and Planning (ERP) software comes as a suite of utilities to do just that and divides business processes broadly into the following conceptual areas in order to make the structure of very complex software manageable:

• manufacturing
• supply chain
• financial
• project management
• human resource management
• customer/supplier management

In other words there’s something for everyone who is involved with the management of companies. ERP software can be extremely complex, as it must be to meet the needs of some of the largest and most sophisticated companies in the world.

This article is about OpenERP – a fully featured, free and open source ERP software suite. But before describing the features of OpenERP there are some background points to make about the use of ERPs by enteprises and the scope of the post needs to be clarified.

Many organisations, in the late nineties commissioned bespoke software to match their business  processes. They worked from these processes and ‘computerised’ them. Often as not the result amounted to a collection of Visual Basic forms which were (and often still are) very popular.  However the following systemic problems emerged:

• Process Freeze: being ‘fleet of foot’ is intrinsic to successful trading so having business processes effectively frozen in time by bespoke software (which cannot easily be modified) is a very bad thing indeed;
• Over Elaboration: operatives in the field have much less interest in ERP than do the managers in the office! So any excuse not to complete a form or navigate a menu will do just fine. Things like ‘more than you need’ or over complex menus and mandatory fields which no longer exist on the new product just stop folk from using the software;
• Use Anywhere: even SMEs operate in multiple countries on different computing platforms and increasingly require access away from the office.

Technical Overview

OpenERP is free and open source software written in the popular Python programming language. It uses GTK to create an attractive user front end and enterprise-class database PostgreSQL at back end. It has three main packages: OpenERP server, OpenERP desktop client and OpenERP Web Client.

This means…

• that an ERP server (and fail over/backup server) must be setup and supported.
• OpenERP can be installed on Linux or Windows operating systems.
• there are no software costs or licences are incurred
• the web server/client model allows access anywhere from any Internet-enabled device with a browser installed

A vanilla OpenERP installation is relatively easy to setup. It took our engineers less than an hour to have the system up and running with sample data for a ’services’ company installed. OpenERP provides a good range of alternative sample data packs for differnet companies. The desktop client works on Mac, Linux and Windows. The web-based client worked on every browser we tested.

The first thing to appreciate is that OpenERP is modular. It has 300 modules to chose from out-of-the-box and, of course, you are free to write your own. It follows that you can assemble what is effectively a bespoke package to meet your company’s processes.

This is in contrast to the traditional way of doing things where the software is built as a ‘one time compilation’ against your specification. This approach depends on how well you specify your  business processes, the modular approach allows for enormous flexibility.

• modules provide a powerful way to model your company’s processes but those contemplating migration need to take a  look at what they do now;
• it would be a mistake to see OpenERP’s wealth of modules as an easy way to produce a modern, web-based ’shoe-in’ for your existing bespoke system;
• migrating to OpenERP successfully will require a full analysis of your existing business processes.

These bridges must be crossed early in the project management process if expectations are not to be unrealistic.

Using OpenERP

For a newcomer to any software package being able to make sense of what is going on early is vital. This is particularly true for one that will be exposed to technophobic accountants or sales people. OpenERP claims to be the most intuitive of all the ERPs available. One is always suspicious of such a claim and we find things get a lot more ‘intuitive’ once you have learned what to do! However, the project provides excellent documentation on its web site and a comprehensive book to go with it.

Far from being tedious and baffling we found our introduction to OpenERP relatively painless. Motivation came from coming across features that were immediately appreciated for their intrinsic utility rather than gimmickry. In ERP features are not ‘cool’, they must be useful and usable. To give a few examples:

• a Dashboard whose appearance and functionality is tailored to the needs of each user;
• rule-based templates for setting pricing policies across the board including customer specific discounts, percentage markups and so on;
• automatic propagation of accounts data into all areas of the ERP;
• double-entry stock management;
• fully integrated email/sms and company wiki.

Login using a web browser and you are greeted by the Dashboard screen complete with pretty graphs, ToDos, shared calendars, inspiring public messages from the boss, what ever you wish. In fact it’s a standard pane-element format which you can shuffle around and customise. Think iGoogle. At the top of the screen there are just two tabs as standard (Main Menu and Shortcuts) but using shortcuts you can add tabs for the ERP features that you will want. Editing panes and navigating sub-menus is easy. This simplicity and flexibility to customise increases greatly the work force’s ‘buy-in’ to actually use the system.

The blend of web-style navigation and right click menus/help combines well with a sense of coherence that good data-propagation gives. For example, if an accountant back in Zurich downgrades a Partner’s (another key concept of the package which is more ‘customer’) credit rating through his accounts modules then the Sales operative in the field in Bulgaria has his Sales Management module suitably updated on his netbook or smartphone. Meanwhile at Head Office in London they can see the lot.

Analytical tools are vital to any substantial company to keep track of what is going on and to plan for the future. These abound in OpenERP including account analysis packages which allow more than simple reporting required by law; a double entry stock management module which keeps track if stock from where it came via the warehouse to where it went; and a fully-featured project management modules with a decent Gannt utility.

In other words OpenERP gives you the kind of features you would expect as standard with a costly SAP system running on Oracle, only here we have a free and open source product running on PostgreSQL.

Summary

OpenERP is perhaps the paradigmatic exemplar for the power of Open Source development methodology and the module approach to customisation. This well funded, tightly co-ordinated project has produced an astonishingly intuitive and powerful business tool. As with all such projects its future will depend on real-world utility and quality control. So far these two boxes are thoroughly ticked. SAP watch out!

At Sirius we’ve just completed the migration of our corporate website from Joomla! to Drupal. There are many discussions of the relative merits of Drupal and Joomla!, but we thought it would be interesting to discuss what we’ve learned.

Joomla! and Drupal superficially claim to do the same sort of job. Both allow you to get a well structured website supporting multiple contributors up and running quickly and easily. If anything, Joomla! is probably the more straightforward of the two to set-up. It’s very easy to get near-instant gratification from a Joomla! deployment while you’re still knee-deep in Drupal’s ‘blocks’, ‘views’ and ‘taxonomies’.

Our Joomla! based site served us well for three years but as our need for new features grew, so did the arguments for switching to Drupal. While both Drupal and Joomla! offer a thriving market for third-party extensions, we felt that Drupal’s architecture was better suited to us.

In any system there is a trade-off between simplicity and flexibility. As noted above, Joomla! is probably the quicker of the two systems to set-up, but the flip-side is that it makes more assumptions about the nature of your site whereas Drupal encourages you to make those decisions for yourself.

ACLs

Although the plans for Joomla 1.6 are reputed to include ACL features, Joomla 1.5 simply divides users into Public, Register and Special.

For many sites this is sufficient, but for our needs it’s too coarse. A free extension called noixACL is available which adds multiple group membership and fine-grained, generic ACL facility but the lack of support for this concept in Joomla!’s core makes it a difficult solution to administer.

For example, controlling access to menu administration effectively comes down to blocking or allowing various values of the “task” CGI variable. Unfortunately “task” is part of the internals of a module, not its public API. It can contain useful values such as “edit” or “view” but also less elegant ones such as “orderup”, “orderdown”, “accesspublic” or “accessspecial”. You don’t want to grant separate permissions for moving a menu item up and moving it back down! Also, because the values of these tasks are also conceptually private data for a module there is no obligation for them to remain constant – from one release to the next “trash” might change to “delete”. NoixACL’s “adapter” for these actions needs to track these changes and this is a major maintenance headache.

Drupal, by contrast, has core-level support for ACLs which is very elegant. It requires extensions to register the actions they allow users to perform and has a centralised tool for associating these actions with “roles” and and assigning different (and multiple) roles to different users. The names of these actions are explicitly part of a module’s public API and so they tend to be meaningfully named and don’t change between releases.

Content Types

In Joomla! you effectively have a predefined set of content types which behave in fixed ways. Extra content types can be added by installing extension modules but these modules are have no generic way of being aware of and interacting with each other. For example, it is often the case that the category structures have to be defined separately for each content type, especially where something more complex than Joomla!’s two-level Section-Category hierarchy, is insufficient. In effect individual modules act as miniature applications in themselves with their own structures, permissioning and management interfaces.

With Drupal, you use something called CCK (Content Construction Kit) to define new content types at a much finer level with their own metadata, workflows, permissioning and processing. The site administrator is then responsible for using these content types to build ‘views’ – ordering the processing filter pipelines explicitly and pumping them out as dynamic ‘pages’ or ‘blocks’. It’s more work to implement but the result is that content types can be treated by extensions as homogeneous, opaque objects.

The Bottom Line

Essentially, the Joomla! vs Drupal decision comes down to a question of requirements. While your needs are met by Joomla!’s basic features and a few chosen extensions, it remains an easy to administer system.

But as you start to deviate from the structure that Joomla! provides out-of-the-box, and particularly when you start to have more complex content and user types, Drupal pays off the extra effort.

One common misconception is that Drupal is difficult to theme. The simple answer to that is ‘not necessarily’. As with Joomla!, templates can be purchased online but we found that with a little CSS fu, existing free templates could be massaged to get excellent results.

Finally the increasing number of ‘commercial’ Joomla! extensions was becoming a real bugbear for us. It really grates to have to pay for plugins that more often as not you can’t QA the sourcecode because they’re encrypted. By contrast every single Drupal module we’ve used is free and open source. Together these reasons make Drupal far more attractive to professional web developers. You get far more control and somebody else isn’t eating into your profit margin.

At Sirius we’re fans of Request Tracker, which is excellent free software for running a help desk. One reasonably common question on the Request Tracker user’s mailing list is “how do I make setting a subject mandatory when creating a ticket?”. Another useful modification that we use at Sirius is to force setting a non-zero priority on tickets.

RT is designed to be easily customised, and one way of achieving both of these features is to hook into Request Tracker’s BeforeCreate callback. This callback gets called every time the “Create” button is pressed when creating a new ticket. If you haven’t provided a callback the ticket is created as normal. If you have provided a callback, the chunk of code is executed, and the ticket creation can be postponed in the event of unacceptable input such as no subject.

Therefore we can force setting a mandatory subject using the following chunk of perl.

<%init>
my $ARGSRef = $ARGS{'ARGSRef'};

if ($$ARGSRef{'id'} eq 'new')
{
    if ($$ARGSRef{'Subject'} !~ /^[a-zA-z0-9]+/)
    {
        my $msg = loc("You must set a subject, and the subject must start with a letter or number");
        $RT::Logger->debug($msg);
        push @$results, $msg;
        $$skip_create = 1;
    }

    if ($$ARGSRef{'InitialPriority'} !~ /^([1-4]{1}|99)$/)
    {
        my $msg = loc("Initial priority must be 1, 2, 3 or 4");
        $RT::Logger->debug($msg);
        push @$results, $msg;
        $$skip_create = 1;
    }
}
</%init>
<%args>
$skip_create => undef;
$checks_failure => undef;
$results => undef;
</%args>

To install this into your RT installation, create a file containing the callback under:

html/Callbacks/Sirius_Callbacks/Ticket/Create.html/BeforeCreate

On Debian with Debian’s RT packages, the full path is

/usr/share/request-tracker3.8/html/Callbacks/Sirius_Callbacks/Ticket/Create.html/BeforeCreate

(Naturally you don’t have to use the directory “Sirius_Callbacks”, it’s an arbitrary name and doesn’t need any configuration anywhere.)

It’s advised to then clear out the Mason cache, and restart Apache. You will need to clear out the Mason cache if you modify the callback, for the changes to take effect.

Some things to note about the above code.

my $ARGSRef = $ARGS{'ARGSRef'};

gives us reference to several perl variables that will provide useful information in the callback, such as the provided subject and priority.

The variable $results is an array containing messages that should be displayed to the user to help them correct their invalid input.

The variable $skip_create is set to 1 (i.e. true) if invalid input is received, and thus RT knows not to not actually go ahead and create the ticket and display the contents of $results, instead.

A useful improvement would be to allow the regular expressions used to validate the subject and priority to be configured in the RT configuration file, if anybody has a solution, we will be glad to publish the results.

The end result, if you haven’t provided the required information.

And if you have, the ticket will be created as normal.

In the build up to PGDay.EU 2009, an event which we’re sponsoring, Tom Callway caught up with friend and colleague Dave Page to talk about the PostgreSQL project and how this somewhat unsung Open Source project is taking on the enterprise database market.

Dave Page, PostgreSQL core team. Photo by Michael Glaesman

1) What do you do for the PostgreSQL project?
I’m a member of the project’s core team of 7 contributors. We are  basically the steering committee that makes decisions on release  schedules and other project management issues – the things that cannot  be effectively done by the community at large without running into  security, privacy or ‘bikeshedding’ issues. Generally, we try to do  everything possible within the community.

My ‘real’ work within the community spans multiple areas. I started  out, and remain as lead developer of pgAdmin, our management GUI and also look after the ‘one-click’ PostgreSQL multi-platform installers,  and related technologies such as StackBuilder which allows you to piece together a complete application stack with PostgreSQL at the  core. I also work as one of the project’s webmasters and sysadmins looking after our infrastructure.

2) What’s unique about PostgreSQL and where do you see its position relative to other enterprise-class databases?
There is no doubt that PostgreSQL can hold it’s own in the enterprise  DBMS space. We have a feature set in the core server which is  comparable to many of the commercial offerings on the market, and when you consider the vast array of add-ons that are available, such as  PostGIS for GIS applications, or Bucardo, Londiste or Slony for  replication it’s clear that the user has a vast array of choice. That’s one of the beauties of PostgreSQL – it was designed to be  extensible which allows users to add or create pretty much any functionality they need.

It’s true that in years gone by, PostgreSQL has been criticised for  it’s performance. The project has always chosen correctness over  performance – to us, data integrity must always come first. Despite  this, over the last few years we made huge performance improvements – I regularly hear from users that have ported their applications from  other leading DBMSs and are extremely happy that PostgreSQL’s performance has matched or surpassed their previous system.

These are the things that make the project unique – it’s Open Source, and it can stand up against the leading commercial competitors on both performance and features.

3) What are its key strengths and weaknesses?
The key strength in my mind is our community. We have a vast array of  contributors providing user support, code, documentation, advocacy and  other contributions to the project coming from a wide variety of  backgrounds. We have people from global technology companies as well as  countless individuals working together on a daily basis to build on and improve PostgreSQL – as far as I know, no other DBMS has anything  remotely approaching that amount of diversity and experience in it’s team. That helps us continue to make significant improvements with every release.

I think our main weakness is that as a volunteer project, it’s very  hard to manage our direction. We have no direct control over our contributors so we cannot say “we’re going to implement feature X for this release” unless someone actually volunteers to do it, and follows through on that offer. We’re lucky that a lot of time the features people want to write are things that we want in the server. Unfortunately though, we also have people writing things we don’t want, and other work that needs manpower, but few people are interested in working on. Driver maintenance is an example of this – writing a ODBC driver for example just isn’t very appealing to most developers, so we struggle in such areas relying on just one or two key developers.

We also struggle a little on the marketing side of the project. We have some great people working hard on PostgreSQL advocacy, but real marketing requires real money. We’re going directly up against companies who spend millions annually on marketing their products, which is hard to compete with.

4) In your opinion, what have been the biggest technical advancements in PostgreSQL over the past year?
PostgreSQL 8.4 was recently released after a little over a year of  development. The focus of the release was improvements to the administration and management of the server. Key to this were new  features such as:

• Parallel restore: this allows restores from backup to use multiple processes which can in turn utilise multiple CPU cores on your machine, allowing for significantly faster restore time.
• Free Space Map rewrite: the new free space map is dynamically sized, removing the need for manual tuning, or performance degradation in the event that it is inadvertently under-sized. This project also provided the infrastructure for the new visibility map which greatly reduces vacuum overhead for slowly-changing tables, and for index-only scans (in which key values can be retrieved directly from the index, rather than having to look them up in the heap) and is being worked on for 8.5.
• pg_migrator: this is an external utility which allows many users of PostgreSQL 8.3 to quickly migrate their databases to 8.4 without having to dump and reload their data – a task which on large databases could mean hours or even days of downtime.

In addition we also added support for advanced SQL features such as windowing functions and recursive queries, both of which are important to many users of other enterprise DBMSs.

5) What do you think are the biggest challenges that PostgreSQL needs to overcome in order to increase its adoption?
I think our biggest problem in the commercial space is being taken seriously as a competitor to the proprietary DBMSs. We know the software is up to the task, but companies are often wary of relying on Open Source projects for their infrastructure or products and want the sort of services such companies provide to give them the reassurance that that choosing PostgreSQL is a low cost and low risk option.

In the Open Source space as well as at the grass-roots level in IT departments and the hobbyist space, our main challenge is getting PostgreSQL to be used as the default database in the application stack. Part of the work we’re doing to address this is the StackBuilder project, which allows the one-click installer users to get up and running with popular applications such as Drupal or Mediawiki in just a few mouse clicks. We also try to proactively help other projects wherever possible. If a project has a desire to support PostgreSQL or needs to bring the quality of their support up to the same level as they offer for other DBMSs, then we try to offer any help or assistance they need.

6) Can you tell us a little more about PGDay.eu 2009 and what its objectives are?
PGDay.eu 2009 is the third big PostgreSQL conference to be held in Europe. It’s a chance for existing users and developers to meet and learn more about each other, both person to person and through the great lineup of talks we’re planning which will offer something for everyone. It’s also an excellent opportunity for those considering deploying PostgreSQL to come and hear the success stories, meet the developers and see the wide range of companies involved in PostgreSQL who can provide support and services should they need them. Of course – not only will there be the conference itself in the day time, but there will also be time for socialising in the evenings. The aim is simple – to get people together, learn about and discuss PostgreSQL, and to have a good time doing it.

See you in Paris!