Mender server deviceauth propagate issue

General Discussions
21

Hi @t-mon @peter,

I’ve got a very similar issue that I could partially fix. I will try to explain it as well as I can, but please let me know if it isn’t clear.

I’m using a Mender Open-Source server, currently on 3.1.0 (I’m pretty sure it appeared when we moved from 3.0.0 to 3.1.0), and use the preautorization workflow since the beginning. At some point (and can’t explain why), some devices I created weren’t able to connect on first try anymore, so it was necessary to decomission them, and manually accept the new pending requests. The problem is, I still have the inventory of the preautorized devices and can’t delete them, even with the Delete Device Inventory API request. It does return a code 204, but I still can get the device inventory.

It’s already an issue, but the real problem is that they share the same serial number I’m using as ID data, and I just realized yesterday that this could prevent some devices to be included in deployment. After I accepted the new devices requests, I do see them as accepted in my GUI, but with the GET List Devices Inventories request, I saw that they missed the “status” attribute.

Using the commands @t-mon provided at the top, I was able to fix the issue for the current devices (thanks a lot btw!), but I’m concerned that this issue might remain for following devices.

I also tried the last commands @peter provided, but it seems that the deletion of my device doesn’t work:

root@mender:~/mender-server.3.1.0/production# echo -ne "use deviceconnect\ndb.devices.deleteMany({\"_id\":\"${device_id}\"})\n" | docker exec -i `docker ps | grep mongo | head -1 | awk '{print($1);}'` mongo
MongoDB shell version v4.4.20
connecting to: mongodb://127.0.0.1:27017/?compressors=disabled&gssapiServiceName=mongodb
Implicit session: session { "id" : UUID("6656bac5-628a-4fd1-bcab-7c1e420073e2") }
MongoDB server version: 4.4.20
switched to db deviceconnect
{ "acknowledged" : true, "deletedCount" : 0 }
bye

Any help on that will be very appreciated.

Yoann

22

hey @Piocky

thanks for using Mender. perhaps we should start a new topic, since your issue is a bit different.
what I would suggest is: backup the inventory devices collection, then clean it:

use inventory...
db.devices.deleteMany({})

after that, I would suggest to run the deviceauth commands to propagate the data to inventory:

docker exec -i `docker ps | grep device-auth | head -1 | awk '{print($1);}'` deviceauth propagate-inventory-statuses
docker exec -i `docker ps | grep device-auth | head -1 | awk '{print($1);}'` deviceauth propagate-inventory-id-data

it is a bit late on Friday night, so just double check that those commands exist in 3.1. on that note using the Mender Server 3.1 does not really make much sense, you should upgrade to 3.6 as soon as you can.
one more thing: the serial number as such is not necessarily a problem, as long as the whole identity is unique (I hope you have something more there than just the serial).

best regards,
peter

23

Hi @peter,

Thanks for your quick answer. I do have a script to backup my database, but I’m not sure how I should use the following commands:

use inventory...
db.devices.deleteMany({})

as well as where to check if the commands you provided exist on 3.1

We will upgrade from 3.1 to 3.6 when we will migrate the Server, but currently we can’t because of the current certificate we are using on this server (not compatible with 3.2 and more).
Unfortunately, we use only Serial Number + RSA public key for identity data, and I feel like the last one is in auth_sets, not in inventory, so maybe that’s why having twice the same serial number is a problem in our case.

Yoann

24

I started a new thread: Cleaning inventry and deviceauth sync commands