gLite > gLite 3.2 > glite-CREAM > Update to glite-CREAM 3.2.5-0.sl5  



gLite 3.2

glite-CREAM - Update to version 3.2.5-0.sl5

Date 03.05.2010
Priority Normal



New version of glite-CREAM

Changes made in this version:

  • glexec calls replaced with sudo calls (glexec is used just to get the userid to be used in the sudo invocations)
  • For Torque/PBS and LSF by default the new BLAH BLparser (which uses the status/history batch system commands) is now considered. The old parser (which parses the batch system log files) is still supported (see ). If the new blparser is used (default option) it is just necessary to run yaim once (i.e. it is not necessary anymore to first configure the creamCE and then the BLparser).
  • Introduced a new operation (queryEvent) to make more efficient the job status changes detection by ICE
  • Introduced a limiter to protect CREAM (new job submissions are disabled when the machine is too loaded): see
  • Introduced a proxy purger which cleans from the delegationdb and from the file system the expired proxies (see: ) Please note that old proxies (i.e. referring to previous CREAM releases) under /opt/glite/var/cream are not deleted (you might want to delete them manually after having installed this patch)
  • Improved CREAM startup, which is now in general faster, since CREAM asks the blparser only for the interested jobs (no more for a time slot)
  • Improved proxy renewal operation, which is now more efficient when there are several jobs with the same delegationid
  • User tomcat not added anymore to VO groups (please note that it won't be removed if it was already there because of previous version of yaim-cream-ce). With this change the group directories under /opt/glite/var/cream_sandbox are now created by yaim
  • User tomcat not added anymore to glexec group (please note that it won't be removed if it was already there because of previous version of yaim-cream-ce)
  • The host certificate is no longer copied to /usr/share/tomcat5 but remains in /etc/grid-security/tomcat-cert.pem with the permissions tomcat:root.
  • Customization of the CREAM JobWrapper is now easier (see )
  • Provision of a script (to be run by CE admin) to purge jobs in non-terminal status (see: )
  • Implemented support for ISB/OSB transfers from/to gridftp servers run using user credentials
  • By default cemon is not deployed anymore (not needed anymore because of the new queryevent operation)
  • New schema for both cream and delegation databases (this means they will be dropped and recreated when configuring via yaim)
  • Several bug fixes, e.g.:
    • Several fixes in the new BLAH blparser
    • lcmaps glexec conf file fixed: now it is fully synchronized (TM) with the gridftpd one
    • Problems triggered by "strange" characters (e.g. ":" or "(") in the subject DN fixed
    • Reasons for ISB/OSB transfer failures are now reported
    • Job failure reasons now reported in the CREAM log file
    • Improved performance of some DB queries
    • GLITE_WMS_RB_BROKERINFO env variable now set in the CREAM JobWrapper

Workaround: Some dependencies not always updated

Performing a yum update glite-CREAM, it was detected that sometimes glite-jobid-api-c, glite-jobid-api-cpp, glite-lbjp-common-trio, glite-security-gsoap-plugin and glite-security-gss are not correctly updated. Please, verify that yum is installing the new rpms, and if not, execute the following command:

yum update glite-jobid-api-c glite-jobid-api-cpp glite-lbjp-common-trio glite-security-gsoap-plugin glite-security-gss

If you simply do a "yum update" (i.e. without specifying the metapackage) you shouldn't be affected by this issue.

Patch #3767: [ yaim-core ] yaim-core 4.0.12 SL5/x86_64

New release of yaim core containing a set of bug fixes and new features:

  • Can now configure the GSI callout to call the ARGUS PEP client.
  • Avoid mistakenly removing all the services from gLiteservices file.
  • Fix GLOBUS_TCP_PORT_RANGE setting on the SL5 tarball UI.
  • Correct unset for shell functions in
  • Make config_bdii_only return non zero in case of error
  • Fixes for installing the UI tarball on CernVM.
  • Allow general use of the 'nickname' field in the VOMSES settings.
  • Add yaim core RPM dependency on perl
  • Allow use of pool accounts with up to 4 digits
  • Fix manipulation when running a single yaim function
  • Fix gridmap dir group on WMS
  • Change the CE_INBOUNDIP and CE_OUTBOUNDIP defaults in site-info.def to be valid and imply the correct (upper) case.
  • Call setup-openssl for VDT 1.10.

Patch #3739: Updated glite-info-provider-release package

This new version of glite-info-provider-release works with the new version of glite-version that not longer supports the -u and -s options.

Patch #3726: Trustmanager workaround for JDK 1.6 EC SSL handshake mess

Workaround that disables the ECDH ciphers on tomcat so that the JDK 1.6 problems don't happen. Small fix for logging in util-java.

See patch #3313 for the more important changes.

Patch #3869: Util-java update

Fix for hierarchical CA namespace handling, previously only the root CA namespace was taken into account, now CA cert's or user cert's first parent namespace definition is used.

New trustmanager factory class, which is used inside contextwrapper. It only creates one trustmanager if the trust directory (and crlrequired) configuration on consecutive calls is the same. First call creates one trustmanager and subsequent calls use the same instance. This cuts down considerably the file reads, class creation, memory footprint, delays etc.

RFC2253 DNs generated by new methods in DN* classes and new DNImpl RFC2253 class now produce proper reversed FTC2253 DNs like defined in RFC2253, meaning they start with "CN" rdn and end with "C" rdn if present. Old methods are present and work as before, but are deprecated.

Also SecurityContext.getAuthorizedAttributes method is put back for FTS test servlet.

See also patch #2624 for important configuration changes, patch #3313 for updates and patch #3726 for a small fix.

Patch #3977: SL5/x86_64 APEL CPUScalingFactor bug fix

APEL will now read the CPUScalingReferenceSI00 value from the site GIIS. If this value is not available, APEL will read GlueHostbenchmarkSI00.

Note that the new version of APEL will read the CPU power (specint rating) from the GlueCECapability CPUScalingReferenceSI00 attribute if it is published, so please check that the value is correct (the same as the GlueHostBenchmarkSI00 attribute) and that your APEL accounting records look OK after the upgrade.

Patch #3888: BDII release 5.0.8

The version handles the IOError exception that occasionally causes the BDII update process to die.

Patch #3795: L&B 2.0

This patch solves the bug #63285, that was causing L&B packages to make no difference between 32 vs. 64-bit architectures and always install library files in /opt/glite/lib rather than /opt/glite/lib64 in 64-bit versions.

This update fixes various bugs. For the full list of bugs, please see list below.

Fixed bugs

Number Description
 #24708 a empty directory left on WN for every job
 #3726 Trustmanager workaround for JDK 1.6 EC SSL handshake mess
 #3739 Updated glite-info-provider-release package
 #37430 BLParser should properly filter it's log output
 #3767 [ yaim-core ] yaim-core 4.0.12 SL5/x86_64
 #3795 L&B 2.0
 #3869 Util-java update
 #3888 BDII release 5.0.8
 #3977 SL5/x86_64 APEL CPUScalingFactor bug fix
 #45364 BLAH_JOB_CANCEL should report failure reason
 #46419 CREAM sandbox area should be scratched when the CREAM DB is scratched
 #47070 [ yaim-cream ] yaim cream module should support remote mysql setup
 #47254 Possible problems if the proxy used to talk with CREAM is shorter than 10 minutes
 #47804 Possible problems configuring blah in CREAM-CE for LSF
 #48786 Load should be one of the parameter of DISABLE_SUBMISSION_POLICY in CREAM
 #49497 user proxies on CREAM do not get cleaned up
 #50226 yaim-cream-ce should use config_secure_tomcat
 #50723 CREAM: check for the jobtype is not case insensitive
 #50875 CREAM: reason for cancelled jobs should be reported
 #50876 CREAM reports that the proxy expired even when the problem is in detecting the lifetime of the proxy
 #51046 CREAM: DelegProxyInfo info sometimes is wrong
 #51118 config_cream_glexec doesn't set glexec permissions right
 #51124 catalina.out is clogged with grid-proxy-init warnings
 #51128 lcas-suexec.db on CREAM CE should be named lcas-glexec.db for consistency
 #51249 [ yaim-cream-ce ] refactor config_cream_db
 #51310 Wrong event timestamp
 #51311 Wrong event timestamp generated by the CREAM Job Sensor
 #51313 CEMon must not notify the expired events.
 #51705 should be removed from CREAM RPM
 #51706 yaim-cream-ce: remove "lcg" prefix from JOB_MANAGER
 #51892 Exception when using java.text.DateFormat.parse
 #51928 BLAH crashes if the cerequirements classad attribute is malformed
 #51978 CREAM can be slow to start
 #51993 Proxy renewal not very efficient for multiple jobs having the same delegationid
 #52020 [ yaim-cream-ce ] Support use of file (besides syslog) for glexec logging
 #52050 misleading error message "The problem seems to be related to glexec"
 #52051 CEMon must remove all expired subscriptions on start-up
 #52052 Sometimes the getInfo() operation does not report the right list of topics.
 #52268 BLAH leaves files in /tmp when CErequirements is set
 #52651 CREAM file descriptor overuse
 #52719 Blah doesn't set the 'executable' flag if a local jobwrapper is found
 #52942 Missing description for ISB/OSB error in jobwrapper
 #53459 [CREAM] Provide method to improve the detection of job status changes by ICE
 #53499 CREAM job wrapper template should be put outside the jar
 #54812 job requirement
 #54900 [ glite-yaim-cream-ce ] config_cream_tomcat_user should not add tomcat to VO groups
 #54949 Some job can remain in running state when BLParser is restarted for both lsf and pbs
 #55078 Possible final state not considered in BLParserPBS and BUpdaterPBS
 #55420 Allow admin to purge CREAM jobs in a non terminal status
 #55438 BUpdater problems in updating job state with AssignFinalState for all batch systems
 #55531 BUpdaterPBS should consider lines like "unable to run job"
 #55565 BLAH configuration attribute blah_disable_wn_proxy_renewal fails to disable proxy renewal.
 #56075 Job failure reasons missing in the CREAM log file
 #56339 [blah] "service glite-ce-blparser restart" does not always work
 #56367 CREAM RPM depends on C libs
 #56518 BLAH blparser doesn't start after boot of the machine
 #56697 CREAM logging must be improved when CREAM register operation fails
 #57210 BLAH condor_submit script doesn't recognize certain options.
 #57307 does not support the handling of "local" attributes
 #57820 [yaim-cream-ce] CREAM-CE publishes GlueServiceDataValue incomplete
 #58103 Cream database Query performance.
 #58109 Wrong value for the "service version" property
 #58119 CREAM CE: publish Production instead of Special as default value for GlueCEStateStatus
 #58423 RFE: support for ISB/OSB transfers from/to gridftp servers running using user credentials
 #58659 NullPointerException from getStatus
 #58792 JobRegister fails, because cream_sandbox directory doesn't exist.
 #58941 [yaim-cream-ce] lcmaps confs for glexec and gridftp are not fully synchronized (TM)
 #59005 Possible problem with hold/resumed jobs in BUpdaterLSF
 #59329 Proxy symlinks left in the registry area until purged
 #59686 Possible crash of BUpdarePBS due to wrong malloc
 #59862 [ yaim-cream-ce ] broken -v functionality
 #59962 Sometimes the CREAM initialization fails with "UserId = ADMINISTRATOR is not enable for that operation!" error
 #60831 Error log message: "CREAM_JOB_SENSOR_HOST parameter not specified!"
 #61322 CREAM jw doesn't set GLITE_WMS_RB_BROKERINFO
 #61401 [yaim-cream-ce] config_cream_blah and config_cream_clean don't take into account GLITE_LOCATION_LOG
 #61402 [yaim-cream-ce] does not use GLITE_LOCATION_VAR/LOG is some cases.
 #61407 Set CE_ID in the cream jw
 #61493 [ yaim-cream-ce ] glexec_get_account policy order is wrong
 #61604 yaim-cream-ce should not install config_gip_software_plugin
 #61730 CREAM jw: GLITE_WMS_LOG_DESTINATION should always be set with the FQDN
 #61761 CEMon must guarantee the notification rate
 #61790 Problems in CREAM CE when there are "strange" characters in the subject certificate
 #62070 Possible problem with notification time in BNotifier
 #62207 [ yaim-cream ] Enable Glue 2.0 publishing
 #62436 Possible problem with updater if job remain queued too long
 #62565 yaim-cream-ce requires BLPARSER_HOST even if the new blparser has to be configured
 #62776 Yaim config for CREAM CE erroneously requires tomcat in glexec group
 #62893 Possible proxy renewal problem in the CREAM jw
 #63398 CREAM jw: removal of token should be retried in case of failure
 #63731 BLparsers cannot handle job lists longer than 10 items in the STARTNOTIFYJOBLIST command
 #63874 CREAM sandbox dir creation program should not attempt creation of parent directories.
 #64593 RFE: CREAM jw should set the env variables CREAM_JOBID and GRID_JOBID
 #64695 BLAH error after qsub failure
 #65022 CEMon can shut down very slowly

Updated rpms

Name Version Full RPM name Description
bdii 5.0.8-1 bdii-5.0.8-1.noarch.rpm bdii
glite-apel-core 2.0.11-0 glite-apel-core-2.0.11-0.noarch.rpm Core components of the Apel accounting application
glite-ce-blahp 1.14.2-1.sl5 glite-ce-blahp-1.14.2-1.sl5.x86_64.rpm The BLAHP daemon is a light component accepting commands to manage jobs on different Local Resources Management Systems
glite-ce-ce-plugin 1.12.1-14 glite-ce-ce-plugin-1.12.1-14.noarch.rpm The CE plugin is a sensor for the CE monitor service that keeps track of the changes of the CE resource
glite-ce-cream 1.12.1-14 glite-ce-cream-1.12.1-14.noarch.rpm The Computing Resource Execution And Management service is a web application taking care of the any job related operation
glite-ce-cream-utils 1.0.0-13.sl5 glite-ce-cream-utils-1.0.0-13.sl5.x86_64.rpm This package contains a set of executables called by the CREAM service
glite-ce-job-plugin 1.12.1-14 glite-ce-job-plugin-1.12.1-14.noarch.rpm The CREAM job plugin is a sensor for the CE monitor service that keeps track of the job status changes interacting with the CREAM web application
glite-ce-monitor 1.12.1-14 glite-ce-monitor-1.12.1-14.noarch.rpm The CE monitor service is a web application that publishes information about the Computing Element
glite-CREAM 3.2.5-0.sl5 glite-CREAM-3.2.5-0.sl5.x86_64.rpm glite-CREAM for version 3.2.5
glite-jobid-api-c 1.0.0-5.sl5 glite-jobid-api-c-1.0.0-5.sl5.x86_64.rpm org.glite.jobid.api-c
glite-jobid-api-cpp 1.0.0-4.sl5 glite-jobid-api-cpp-1.0.0-4.sl5.x86_64.rpm org.glite.jobid.api-cpp
glite-lb-common 7.0.3-2.sl5 glite-lb-common-7.0.3-2.sl5.x86_64.rpm
glite-lbjp-common-trio 1.0.0-6.sl5 glite-lbjp-common-trio-1.0.0-6.sl5.x86_64.rpm org.glite.lbjp-common.trio
glite-lb-logger 2.0.4-2.sl5 glite-lb-logger-2.0.4-2.sl5.x86_64.rpm
glite-security-gsoap-plugin 2.0.1-3.sl5 glite-security-gsoap-plugin-2.0.1-3.sl5.x86_64.rpm
glite-security-gss 2.0.0-6.sl5 glite-security-gss-2.0.0-6.sl5.x86_64.rpm
glite-security-trustmanager 2.5.5-1 glite-security-trustmanager-2.5.5-1.noarch.rpm v. 2.5.5-1
glite-security-util-java 2.7.1-1 glite-security-util-java-2.7.1-1.noarch.rpm Security utilities
glite-version 3.2.2-1 glite-version-3.2.2-1.noarch.rpm Shows version information for the installed gLite node types
glite-yaim-core 4.0.12-1 glite-yaim-core-4.0.12-1.noarch.rpm YAIM core package
glite-yaim-cream-ce 4.1.0-8 glite-yaim-cream-ce-4.1.0-8.noarch.rpm YAIM module for the installation of the CREAM CE node

The RPMs can be updated using yum via

Service reconfiguration after update

Service must be reconfigured.

Service restart after update

Service must be restarted.

How to apply the fix

  1. Update the RPMs (see above)
  2. Update configuration (see above)
  3. Restart the service if necessary (see above)