Service Changes

Change of IT Service Status Board (IT-SSB) - Updated on 13 Sept

Nicole Cremel — Tue, 23 Jul 2013 10:49:53 +0000

The technology behind the IT and GS Service Status Board (IT SSB and GS SSB, both available via the service portal) will change in order to provide better integration with the CERN Service Portal and the CERN Catalogue for all services and functions.

The main changes are:

There is a slight change in visual presentation due to the change of technology (from Drupal to the Service Now tool). In addition, the new SSB being fully integrated in the Service Portal, the layout is similar to all other pages in the portal.You can already look at the new layout here: https://cerntraining.service-now.com/service-portal/ssb.do
Notes:
1. It is possible to disable the top banner via a flag. E.g. to see the new IT SSB without the top banner, look at: https://cerntraining.service-now.com/service-portal/ssb.do?area=IT&&banner=false
2. On Windows PC with IE browser the "Compatibility View" option must be off (as usual for the service portal).
The web pages “Home”, “Incidents” (or “Outages” for GS), “Planned Interventions” (or “Interventions” for GS) and “Service Changes” will be provided via several tabs with the labels:
“Summary” (instead of “Home”), “Service Incidents”, “Interventions” and “Service changes”.
A filtering capability (additional tab with label "+") can be used to refine the information displayed

Once the change becomes effective, users will be automatically re-directed to the new site.
Important: those using RSS feeds will need to update their settings, please read the following KB article https://cern.service-now.com/service-portal/article.do?n=KB0002181 for more details.

Information for supporters (providing contributions to the SSB):

Since July, supporters can make tests on the "certraining" instance of Service-now (-> select the module "Create OTG record"). Supporters who want to know more about this project can look at the documents stored into:
https://indico.cern.ch/conferenceDisplay.py?confId=262818
with:

The slides presented on 16 July 2013 in the IT amphitheatre
A more complete “project description” (Word/PDF document).

2 DEMO sessions to explain how to post submissions into this new SSB will take place in the IT amphitheatre (Bldg. 31, 3rd floor) :

Wednesday 2 October, at 10h30
Thursday 10 October, at 14h30.

All SSB SSB contributors (all people providing articles in the SSB), both in IT and GS departments, are recommended to attend one of these 2 sessions, before the new SSB is put into production.

User Documentation (for supporters) is provided in the page: https://cern.service-now.com/service-portal/topic.do?topic=SNOW SSB, reports, alerts (OTG records)

Date of production:

The change will be effective on Monday 14 October 2013.

At this date the URLs currently used to access the IT SSB (https://cern.ch/itssb ) and the GS SSB (https://cern.ch/gssb) will be re-directed to access the new “Service Status Board for Computing” (SSB-Computing) and “Service Status Board for CERN” (SSB-CERN or SSB), both available in the CERN Service Portal, in the menu “Service Information”.

In addition, the NEWS page of the portal will also be replaced by a better structured web page. The current “New” item will be removed from the top banner of the Service Portal and moved into the menu “Service Information”, which will contain:

- Service Status Board for CERN
- Service Status Board for Computing
- News

Please note: all the documentation related to the new SNow SSB can be accessed in the page:
https://cern.service-now.com/service-portal/topic.do?topic=SNow SSB (OTG records)

Effective from:

Monday, October 14, 2013 - 10:00

Service Element Affected:

Service Management Service

Specific Service detail:

Service Status Board tool and web sites (IT SSB and GS SSB) available from the Service Portal

Reason for this change:

Full integration of the SSB with the CERN Service Catalogue (i.e. all the Service Elements / SE, and Functional Element / FE, that are defined in the catalogue) and therefore a complete integration inside the CERN Service portal, with a coherent approach and display.

Posted by:

IT-DI

Unit responsible for resolution:

IT Department

Change for News page in the CERN Service Portal

Nicole Cremel — Fri, 13 Sep 2013 13:02:21 +0000

At the same time of the change for the Service Status Board (SSB) the NEWS page of the portal will also be replaced by a better structured web page. The current “News” item available in the service portal (see https://cern.service-now.com/service-portal) will be removed from the top banner and moved into the menu “Service Information”, which will contain:

- Service Status Board for CERN
- Service Status Board for Computing
- News

This change will be put into production on Monday 14 October 2013 (see also the SSB change announcement, at https://test-static-03.web.cern.ch/service-change/change-it-service-status-board-it-ssb-updated-13-sept/14-10-2013).

You can already look at the new layout for the News page here: https://cerntraining.service-now.com/service-portal/news.do

Effective from:

Monday, October 14, 2013 - 10:00

Service Element Affected:

Service Management Service

Specific Service detail:

CERN Service Portal

Posted by:

IT-DI

Unit responsible for resolution:

IT Department

Retiral of old Agile Infrastructure "gitgw.cern.ch"

Gavin Mccance — Mon, 09 Sep 2013 11:26:59 +0000

We'll be shutting down the old Agile Infrastructure "gitgw.cern.ch" service in favour of the CERN central git service at the end of September.

For any repositories that have not already been migrated to the central service already, please:

1. request a new repository in the git service with the same name

2. get an up-to date local copy

3. add a new remote in git pointing to the new service

4. push the branches you care about into the new service

After the shutdown, we'll maintain the read-only AFS repository, so anyone who misses the deadline can still find their work and push it to the central service.

Effective from:

Monday, September 30, 2013 - 13:00

Service Element Affected:

IT Operations Support Service

Posted by:

IT-PES

Unit responsible for resolution:

IT Department

iptables will be set to "true" by default on Puppet-managed infrastructure

Gavin Mccance — Mon, 09 Sep 2013 14:07:42 +0000

We will change the default configuration for the iptables module from "false" to "true". For any hosts that don't otherwise declare it, iptables will then switch on and become managed by Puppet using the default configuration.

We'll make this change on Monday 23rd September.

If you wish to disable the Puppet management of iptables for your hostgroup, please edit the hostgroup parameters in Foreman and set:

writefirewall = false

Use Foreman -> Host -> YAML to check the value for an example host in your hostgroup to tell you if it is already managed. For convenience:

https://judy.cern.ch/hosts/aiadm024.cern.ch/externalNodes?name=aiadm024....

substituting your hostname in both places.

Effective from:

Monday, September 23, 2013 - 09:00

Service Element Affected:

IT Operations Support Service

Posted by:

IT-PES

Unit responsible for resolution:

IT Department

End-of-Life for the Ibex pre-production Cloud Infrastructure service

Jan Van Eldik — Thu, 19 Sep 2013 09:18:41 +0000

As announced in late July, we have deployed a production Cloud Infrastructure service: openstack.cern.ch .

Many Ibex users have already started to use it, and a campaign is underway to migrate the Ibex resources to the production infrastructure.

** We aim to liberate all Ibex resources, and to decommission the
** Ibex service by the end of September.

Therefore, please review your Ibex resources, and delete the
Virtual Machines you no longer need.

To sign up for the Cloud Infrastructure service, please follow
the steps from the 'Join the CERN Private Cloud service' section on
https://information-technology.web.cern.ch/book/cern-private-cloud-user-guide/getting-started/you-start

If you need a shared project on the openstack.cern.ch service,
please note:

shared projects can be requested via the service desk. Please provide the details described at https://information-technology.web.cern.ch/book/cern-cloud-infrastructure-user-guide/administering-projects/creating-project
the set of available flavors ("virtual hardware types") has been restricted. Additional flavors (see list below) can be added to your project upon request.

Your questions and comments are welcome at https://cern.service-now.com/service-portal/function.do?name=cloud-infrastructure&s=cloud%20infrastructure

Effective from:

Thursday, September 19, 2013 - 11:13

Service Element Affected:

Server Provisioning Service

Posted by:

IT-OIS

Unit responsible for resolution:

IT Department

CERN Private Cloud Infrastructure Service

Tim Bell — Thu, 18 Jul 2013 08:11:54 +0000

As presented at the IT User meeting (https://indico.cern.ch/conferenceDisplay.py?confId=246424), an Infrastructure-as-a-Service compute cloud for users will be provided in July.

Features include

Ask for a server through a web page
Get the server in 2 to 15 minutes
Use support operating systems such as Windows or Linux or user-defined images
Various #cores, disk space options
Amazon-like Infrastructure as a Service programmable through REST APIs.

The user guide is already available at http://information-technology.web.cern.ch/book/cern-private-cloud-user-guide.

For questions regarding the new service, please use the service portal at https://cern.service-now.com/service-portal/search.do?q=cloud+infrastructure

Effective from:

Thursday, July 25, 2013 - 10:00

Service Element Affected:

Specific Service detail:

Cloud Infrastructure

Posted by:

IT-OIS

Unit responsible for resolution:

IT Department

Restricted access to add-on products of Issue Tracking Service

Nils Hoimyr — Tue, 02 Jul 2013 07:11:06 +0000

The add on tool of the Issue Tracking Service "Fisheye" and the pilot instance of "Bamboo" are until further not visible from outside CERN.

Affected users: People using Fisheye (code review with the Central JIRA instance), and Grid developers who are pilot users of the Bamboo CI server will not be able to access these products from outside CERN.

Suggested workaround: Access via an SSH tunnel to lxplus or via a Windows Terminal Server.

Effective from:

Tuesday, July 2, 2013 - 08:50

Service Element Affected:

JIRA Service

Reason for this change:

Potential security vulnerability not yet addressed by the supplier.

Posted by:

IT-PES

Unit responsible for resolution:

IT Department

IGTF CAs updated to 1.54

Gavin Mccance — Mon, 01 Jul 2013 11:16:14 +0000

The new IGTF CA Trust Anchors have been updated for the site, to version 1.54.

Effective from:

Monday, July 1, 2013 - 13:15

Service Element Affected:

Multiple Services

Posted by:

IT-PES

Unit responsible for resolution:

IT Department

Closure of the Central IT CVS Service

David Asbury — Wed, 09 Jan 2013 13:48:46 +0000

The CVS Service was announced as being in maintenance mode at the IT Technical Users Meeting in February 2011 as it has been replaced by the SVN service. This message has been repeated several times since.

Users have been expected over this period to move their repositories completely out of CVS to SVN or some other version control system.

By special agreement, only CMS should be still using CVS in 2013 and they also will be moving out by June, taking advantage of the LHC long shutdown.

To implement the closure of CVS we will be restricting access to only leave the CMS repositories available and any other existing users should immediately move their data out of CVS otherwise they may lose access to the files.

Effective from:

Sunday, June 30, 2013 - 23:59

Service Element Affected:

CVS Service

Reason for this change:

The Central SVN service has been available in production for some years, and replaces CVS. Furthermore, the CVS system is obsolete, and there are no security patches or updates to the CVS software.

Posted by:

IT-PES

Unit responsible for resolution:

IT Department

'Services' layout changing on IT website

Catharine Noble — Fri, 21 Jun 2013 07:43:32 +0000

We are planning to change the layout of the 'Services' page of the IT website and welcome your feedback before we make the change.

http://information-technology.web.cern.ch/services

The new layout can be seen here: http://it-dev.web.cern.ch/services

The planned implementation is for the 1st July.

Please contact cath.noble@cern.ch with your comments.

Effective from:

Friday, June 21, 2013 - 09:24

Service Element Affected:

Drupal Service

Specific Service detail:

IT website 'Services' page layout only.

Reason for this change:

The change is for two reasons:

The current 'CERN theme' (visual styling) is no longer supported and we are required to change to the new CERN theme (eg http://design-guidelines.web.cern.ch/ , http://tedxcern.web.cern.ch/ ). Our current layout is not compatible with the new theme, so a layout modification is necessary.
The new 'vertical' layout will provide a more attractive layout and simpler browsing on mobile devices.

Posted by:

IT-DI

Unit responsible for resolution:

IT Department

Change of default CERN Intranet Website

Manuel Malo De Molina Martinez — Mon, 06 May 2013 15:45:17 +0000

The default CERN Intranet Website http://cern.ch/user will be archived on 7 May 2013 at 12:00. From that day onwards, you will see the new CERN website [http://home.web.cern.ch] whenever you access http://cern.ch or http://www.cern.ch, both from inside or outside CERN.

The ‘user’ website will remain available as an archive - although it will no longer be maintained or updated - at http://cern.ch/user-archive.

Effective from:

Tuesday, May 7, 2013 - 12:00

Service Element Affected:

IIS Web Hosting Service

Posted by:

IT-OIS

Unit responsible for resolution:

IT Department

LXPLUS alias migration to SLC6

Juan Manuel Guijarro — Wed, 20 Mar 2013 03:39:56 +0000

The alias LXPLUS.CERN.CH will be switched to point to SLC6 based interactive login nodes on

the 6th of May 2013.

Please note that, since several months, an alias LXPLUS6.CERN.CH which already points to SLC6 based interactive login nodes is available to CERN user community.

Already now, and well beyond the 6th of May 2013, an alias LXPLUS5.CERN.CH will be available for those users needing to login on SLC5 based interactive nodes.

The amount of SLC6 resources within the central batch service will be increased to be able to cope with this LXPLUS.CERN.CH alias switch.

UPDATE Tue MAY 7th: A number of small issues have been detected following the LXPLUS alias switch tat happened yesterday. These issues are been addressed as they are reported. No major issue, like impediment to login into LXPLUS, should be affecting end users at the moment. Users are encouraged to submit a SNOW ticket for any new problem they might encounter.

UPDATE Wed MAY 8th: Known problems on lxplus6.cern.ch.

Some nodes in lxplus.cern.ch are incorrectly installed on the LCG network rather than the GPN network. These machines will be retired and replaced.
The AFS cache configuration is sub optimal (massivley too small) all lxplus nodes6 will be replaced over the next few days.
Reports are that some users are unable to login with password still persist. This is not understood and affected users should continue to report their own situation.
Update 16:00 - We believe this is now understood and fix can deployed tomorrow.
Minimum UID has been lowered from 160 to 101 to allow users in that UID range to login to lxplus.
Mounting fuse filesystems e,g eos or sshfs is currently not possible - this will be addressed.

UPDATE Fri MAY 9th:

Resolved Problems:

Problems with logins for users with UID < 500 is now resolved both for kerberos and password login. Please report any instances where you are still unable to login.
Fuse can now be used for mounting e.g sshfs or EOS file systems.

Outstanding Problems:

The AFS cache configuration is sub optimal (massively too small) all lxplus nodes6 will be replaced over the next few days.

UPDATE Thu MAY 16th:

Resolved Problems:

AFS cache configuration is now fixed
CVMFS cache configuration is now fixed

Effective from:

Monday, May 6, 2013 - 10:00

Service Element Affected:

LXPLUS Service

Reason for this change:

More details and reasons for this service change are explained at:

https://twiki.cern.ch/twiki/bin/viewauth/PESgroup/LxplusMigrationToSLC6

https://information-technology.web.cern.ch/book/lxplus-service/lxplus-5-and-6-differences

Posted by:

IT-PES

Unit responsible for resolution:

IT Department

Java: Important change for all Java Applets and Web Start Applications

Matthias Schroeder — Thu, 18 Apr 2013 12:23:36 +0000

Starting with Java SE 7 Update 21 in April 2013 all Java Applets and Web Start Applications are encouraged to be signed with a trusted certificate.

This change is relevant for all Operating systems, more details can be found on http://linux.web.cern.ch/linux/news.shtml#javasigning

Effective from:

Thursday, April 18, 2013 - 14:16

Service Element Affected:

Multiple Services

Posted by:

IT-OIS

Unit responsible for resolution:

IT Department

Electronic delivery of Microsoft software for Work at Home

Michal Kwiatek — Thu, 11 Apr 2013 11:56:35 +0000

The new Microsoft software shop for CERN is now available through the new supplier as documented at:
https://espace.cern.ch/winservices-help/NICEEnvironment/NICEInstallation/Pages/MicrosoftSoftwareForHome.aspx

Effective from:

Thursday, April 11, 2013 - 13:52

Service Element Affected:

Windows Desktop Service

Posted by:

IT-OIS

Unit responsible for resolution:

IT Department

Closure of file updates feature on CASTOR

Xavier Espinal Curull — Thu, 28 Mar 2013 10:43:06 +0000

The "file update" feature in all CASTOR instances will be suppressed as of 8th of April (already done in the PUBLIC instance on the 25th March). The files will therefore be immutable.
An update of a file will generate a new file in the system.

Effective from:

Monday, April 8, 2013 - 11:00

Service Element Affected:

Storage Service for Projects & Experiments

Reason for this change:

File update feature is barely used, statistics show one in a million cases. Dropping this possibility simplifies the storage behavior and improve consistency inside CASTOR.
The closure of updates starts in CASTORPUBLIC and will be extended across all CASTOR instances.

Also taking profit of the intervention slot for providing full load balanced aliases in CASTOR - change should be transparent as well.

Posted by:

IT-DSS

Unit responsible for resolution:

IT Department

Preservation of archives of deleted e-groups on cds.cern.ch

Pawel Grzywaczewski — Thu, 04 Apr 2013 08:34:15 +0000

On Monday 08.04 a new mechanism will be introduced in e-groups that will save e-groups archives to cds.cern.ch as .eml files when an e-group is deleted.

At present when an e-group is deleted then archives are orphaned – correlation between owner/admins and the site is lost.

The mechanism was discussed with experiments and announced on ITUM on 18.02.2013 https://indico.cern.ch/conferenceDisplay.py?confId=223661

In next weeks there will be a clean-up campaign to move/reactivate “orphaned” archives on Sharepoint.

Effective from:

Monday, April 8, 2013 - 10:30

Service Element Affected:

Not specified

Posted by:

IT-OIS

Unit responsible for resolution:

IT Department

Closure of file updates feature on CASTORPUBLIC

Xavier Espinal Curull — Mon, 18 Mar 2013 13:06:44 +0000

The "file update" feature on CASTORPUBLIC will be suppressed as of March 25th.

The files will therefore be immutable. An update of a file will generate a new file in the system.

Effective from:

Monday, March 25, 2013 - 11:00

Service Element Affected:

Storage Service for Projects & Experiments

Reason for this change:

File update feature is barely used, statistics show one in a million cases. Dropping this possibility simplifies the storage behavior and improve consistency inside CASTOR. The closure of updates starts in CASTORPUBLIC and will be extended across all CASTOR instances.

Posted by:

IT-DSS

Unit responsible for resolution:

IT Department

SLC5/6: Kerberos configuration related changes on 21.03.2013

Jarek Polok — Mon, 18 Mar 2013 08:05:38 +0000

Dear Scientific Linux CERN 5 and 6 users.

System update on Thursday, 21st of March 2013 will include following
Kerberos related changes:

- cern-config-keytab will be obsoleted and replaced by cern-get-keytab

- kerberos configuration (/etc/krb5.conf) will be adjusted to point to
kerberos key distribution center (KDC) for the given network:

   atlasvdc.cern.ch for ATLAS network
   cmsvdc.cern.ch for CMS network
   tndc.cern.ch for TECHNICAL NETWORK

for GENERAL PURPOSE NETWORK (or systems on a network not belonging
to any of above three):

cerndc.cern.ch (this is the current setup)

If you would like to test the change on your system, please run
as root following commands:

# yum --enablerepo=slc*-testing clean all
# yum --enablerepo=slc*-testing install lcm-profile arc cern-get-keytab cern-config-keytab

Jaroslaw Polok for Linux.Support@cern.ch

Effective from:

Thursday, March 21, 2013 - 00:00

Service Element Affected:

Linux Desktop Service

Posted by:

IT-OIS

Unit responsible for resolution:

IT Department

Java 6 and 7 plug-in disabled by default in Internet Explorer

Michal Kwiatek — Wed, 13 Mar 2013 16:40:55 +0000

Java plug-in for Internet Explorer will by default be disabled on all centrally-managed PCs for both Java 6 and 7. The plug-in was previously disabled by default only for Java 7.

User who require to run Java applets in Internet Explorer can re-enable the plug-in by installing the following package from CMF: "Oracle Java Enable plug-in for IE".

Effective from:

Monday, March 18, 2013 - 12:30

Service Element Affected:

Windows Desktop Service

Reason for this change:

Frequent security problems in Java Runtime Environment, which can be remotely exploited when the user visits a rouge web page.

End of public updates for Oracle Java SE 6.

Posted by:

IT-OIS

Unit responsible for resolution:

IT Department

Device driver update on SLC5.9 and SLC6.4 VOBox Virtual Machines

Alexandre Lossent — Mon, 11 Mar 2013 11:25:50 +0000

On 12-Mar-2013, the Quattor configuration templates for VOBoxes hosted on the Service Consolidation infrastructure (virtual machines hosted by HyperV hypervisors) will be updated to take advantage of the integrated paravirtualization drivers for HyperV hypervisors available in SLC5.9 and SLC6.4.

The next run of SPMA on SLC5.9 Virtual Machines (i.e. SLC5 machines with OSDATE >= 20130125) and SLC6.4 Virtual Machines (i.e. SLC6 machines with OSDATE >= 20130308) will then replace the Microsoft paravirtualization drivers, which were used until now, with the integrated drivers; the integrated drivers will then be loaded at the next reboot.

This change is not expected to affect the proper functioning of any existing Virtual Machine.

The following changes are noticeable however, on SLC5 only:

disks will be seen as "sda", "sdb" instead of "hda", "hdb" with previous driver versions. This however does not affect normal partition mounts and the change will not affect existing machines -- unless users have unexpectedly performed advanced configuration explicitly referencing "hda" or "hdb" disks, but this seems unlikely. LVM partitions are not affected, even if created manually. Existing partition definitions in CDB do not need to be updated because installation still relies on SLC5.8 PXE images, which keeps referencing disks as "hda"/"hdb" like before.
due to race conditions in the set of RPM operations performed by SPMA, in some cases a SLC5.9 Virtual Machine may attempt to load both integrated and Microsoft drivers at boot. In this case, the integrated drivers will be used and the Microsoft drivers will be not be loaded; however users may notice a message displayed on the console in the early stages of the boot process regarding the inability to initialize the Microsoft drivers ("vmbus" initialization failure). This does not affect in any way the proper functioning of the integrated drivers, and the message can be safely ignored. The situation will be fixed the next time the boot ramdisk is rebuilt (typically by a subsequent kernel upgrade, though one may also explicitly rebuild the ramdisk by running mkinitrd).

Effective from:

Tuesday, March 12, 2013 - 11:00

Service Element Affected:

VoBOX Service for Projects & Experiments

Specific Service detail:

Affects SLC5.9 VOBox virtual machines hosted in Service Consolidation (HyperV hypervisors)

Reason for this change:

The new drivers are meant to improve performance and stability of virtual machines.

Posted by:

IT-PES

Unit responsible for resolution:

IT Department