Contents

  1. Landscape accounts and logins
    1. I get a mostly blank screen when logging in
    2. What browsers does Landscape support?
    3. I get "You are not a member of an account", help!
    4. Invitations ask me to create a new account
    5. How do I invite another administrator?
    6. I lost my invitation
    7. The invitation doesn't exist, or is no longer available
  2. Landscape pages
    1. Hardware
      1. Can the hardware information be exported?
      2. Can I query the hardware database?
      3. How is the hardware info obtained?
    2. Monitoring
      1. You have too few graphs
      2. Why is the temperature graph always empty?
      3. Can I graph XYZ?
      4. Can I plugin Nagios/Cacti/Munin/XYZ graphs?
      5. How should a Custom Graph script behave?
      6. How frequently do the Custom Graph scripts run?
      7. How long does it take for the Custom Graphs to show data?
      8. How do I deliver a Custom Graph to a machine?
      9. Monitoring is not enough, I need to be alerted if something happens!
    3. Scripts
      1. How do I enable script execution?
      2. How do I disable script execution?
      3. Can I run interactive scripts?
    4. Processes
      1. The %CPU column is empty!
      2. %CPU doesn't match what top says
      3. I have processes that started in 1970?
      4. User/group of some processes is numeric
    5. Packages
      1. No packages
      2. Why do I need to approve package changes?
      3. Why are some package installations approved automatically?
      4. Landscape says some packages are "unknown"
      5. The (package) activity is "Undelivered", do I have to do something?
      6. What does "Package data has changed. Please retry the operation." mean?
    6. Users/groups
      1. Can I add groups?
      2. Can I use LDAP/NIS/winbind?
      3. Why don't you use LDAP for users/groups?
    7. Support Cases
      1. I get a "salesforce" page when clicking on support cases!
      2. Support Cases log me out
  3. Landscape connectivity
    1. What ports does the Landscape client use for communication with the server?
    2. How does the Landscape client connect to the Landscape server?
  4. Misc
    1. Does landscape-client work with Debian?
    2. Can Landscape warn me that a machine needs to be rebooted?
    3. Is there an on-site version of Landscape?
    4. I got an alert to reboot computers, but don't know which ones!
    5. I have hundreds of resynchronization requests, what is going on?
    6. How do I remove a computer from Landscape?

Landscape accounts and logins

I get a mostly blank screen when logging in

You are probably using Internet Explorer or some other non-supported browser. Please see the next topic for information on supported browsers.

What browsers does Landscape support?

Officially, the Landscape team only supports Mozilla Firefox. We know, however, that Google Chrome works, with minor issues. Other browsers may or may not work and are not supported.

Internet Explorer is not supported at the moment. We will start supporting recent versions of Internet Explorer in the future, likely Internet Explorer 8 or newer.

I get "You are not a member of an account", help!

Landscape has the concept of "accounts" and "logins". Anybody can create a login with Landscape, but only Canonical can create accounts and associate logins with accounts.

To be able to use Landscape, you need to be a member of an account. Typically the account represents a company and the login represents the administrator. So, for example, company "XYZ Co" would have an account called "xyz", and an administrator would have a login "joe@xyz.com" or even "joe123@gmail.com".

If you see this error when logging in, it means your login was not yet associated with an account. Some reasons include:

  • the invitation was not yet created by Canonical. This should not happen, so please get in touch with support
  • you didn't get the invitation yet. It is sent out via email, so it may take a while.
  • it was flagged as spam. Please check any spam folder you may have.

If there is still no invitation in your inbox, please get in touch with support.

Invitations ask me to create a new account

In order to use an invitation, you have to be logged in on Landscape. If you are not yet logged in, and click on an invitation link, you will be presented with a form that asks you to either login, or create a new login.

If you already have a login with Landscape, please do not create another one just because this form was presented to you. First login, and then when clicking on the invitation you will be taken to a page where you can choose to accept or reject it.

If you created a new login even when you already had one, please get in touch with support via email or use the Feedback option, as you might not be able to use the "Support Cases" link from within Landscape.

How do I invite another administrator?

Each account has a maximum number of administrators that are allowed to be in it. By default, this number is two, but it can be raised by Canonical support.

If you don't see an option to invite more administrators, then this limit has been reached. If you need the limit to be raised, please get in touch with Canonical support or use the Feedback option.

I lost my invitation

If you no longer have the URL for the invitation, please a fellow Landscape admin to resend the invitation or cancel it and create a new one.

If you are the first admin of your account, then please get in touch with Canonical support or use the Feedback option inside Landscape.

The invitation doesn't exist, or is no longer available

There are some possibilities for this error:

  • the invitation was cancelled
  • the invitation was already used
  • there is a typo in the URL and the provided invitation code never existed

Unless it was a typo, you will have to get in touch with a fellow Landscape admin to resolve the issue. If you are the first admin of your account, then get in touch with Canonical support or use the Feedback option inside Landscape.

Landscape pages

Hardware

Can the hardware information be exported?

Not yet. If you have concrete suggestions or examples about a format you need, please get in touch via the Feedback menu in Landscape.

Can I query the hardware database?

Not yet. For the moment, we only store the information and make it visible to the admin, but specific searches cannot be made.

How is the hardware info obtained?

Most, if not all, of the hardware information that Landscape collects is obtained via HAL on the client.

Monitoring

You have too few graphs

We realize it's not possible to graph everything everybody wants. We tried to provide a basic set of graphs and our intention was to later expand on this set. However, there is a much better way to handle this, and it is via Custom Graphs.

Why is the temperature graph always empty?

Landscape uses the ACPI system to gather temperature data on the client. Basically, it's similar to what the "acpi -t" command shows. If it doesn't show anything temperature related on your machine, then Landscape will not be able to plot temperature information for it. The solution in this case is to use Custom Graphs.

Can I graph XYZ?

You can use the Custom Graphs feature to graph anything for which you can get a number.

Can I plugin Nagios/Cacti/Munin/XYZ graphs?

No. You will have to use the standard graphs that come with Landscape or create your own script and use Custom Graphs. Note that your script can just call some other tool, as long as it outputs the number you want graphed.

How should a Custom Graph script behave?

Please check the requirements.

Note that support for Script Execution needs to be enabled on the client for Custom Graphs to work with it.

How frequently do the Custom Graph scripts run?

The Custom Graph scripts are run by the client every five minutes. This interval is not configurable.

How long does it take for the Custom Graphs to show data?

It can take up to 30min for the Custom Graphs to start showing some data.

How do I deliver a Custom Graph to a machine?

Custom Graphs work with tags. The moment you assign one or more tags to a Custom Graph, the script will be delivered to all machines which have those tags. Alternatively you can select "All computers" in the Custom Graph page to have the script sent to all existing computers in your account, even new ones that are added at a later time.

Monitoring is not enough, I need to be alerted if something happens!

Landscape already has the "Alerts" feature. At some future version, we will have alerts tied to graphs.

Scripts

How do I enable script execution?

Please see Enabling Script Execution.

How do I disable script execution?

To disable script execution on a client, please follow these steps:

  • open a terminal
  • run sudo vi /etc/landscape/client.conf (or use your favorite text editor)

  • remove the ScriptExecution text from the include_manager_plugins line. If it's the only plugin that is included, you may as well delete the whole line

  • after making the changes, save the file and exit the editor
  • now restart the client: run sudo /etc/init.d/landscape-client restart

/!\ Be careful: if you run the wizard again (landscape-config), you can also disable script execution, but do not register the client again!

Can I run interactive scripts?

There is no support inside Landscape to run interactive scripts. You will have to wrap them with some sort of pre-seed solution. If the script is your own, just choose good defaults. If you need to run external commands that may require additional input, try one of these:

  • try supplying the needed information to the command via some option it may have
  • the command may have some sort of non-interactive option, like --batch. Check its manpage.

  • as a last resort, try using expect.

Processes

The %CPU column is empty!

Your landscape-client package is old. Please upgrade.

%CPU doesn't match what top says

Landscape computes CPU usage in the same way that ps(1) does. top does a more instantaneous calculation by observing the process behaviour in the last 2s. ps, however, does consider the whole lifetime of the process, and this is the method Landscape uses.

I have processes that started in 1970?

This is a known bug in older landscape-client versions. Please upgrade.

User/group of some processes is numeric

Landscape ignores network users and groups, i.e., it only considers the ones listed in /etc/passwd and /etc/group. If a running process is owned by a network user or group, Landscape will not be able to translate that uid/gid pair to their respective names, which results in a numeric value being shown in the process list instead.

Packages

No packages

There can be several situations where the server will report no installed or available packages for a Landscape client:

  • bug: please make sure you are running the latest version of the landscape-client package. Run a apt-get update && apt-get install landscape-client session.

  • the client machine was recently added to Landscape: it can take up to 1h30min for a new Landscape client machine to start uploading package information
  • the client machine has no access to Ubuntu package repositories
  • for some reason, cron is disabled on the client machine. Please make sure it's working properly

If you still have problems with packages not showing up in the web interface, please use the Feedback option to report it to us.

Why do I need to approve package changes?

There are some scenarios where the server will automatically "approve" a package change. The basic condition that has to be fulfilled is that the server needs to know exactly what is going to happen, and whatever actually happens needs to meet this expectation.

For example, let's say you request an upgrade for the iproute package. The server, based on the knowledge it has about the package and its dependencies, estimates that this will be a simple upgrade and nothing else is going to be pulled in or removed. So, when the request arrives at your machine and is performed, it is automatically approved if nothing unexpected happens.

If, however, when doing the upgrade, the dependency resolver on the client machine needs to install another package, or remove one because of a new conflict, then this is different from what was expected and the request will have to be explicitly approved by an administrator in the Landscape interface.

The "request upgrades" button will always require an approval. When it is clicked, it basically runs "apt-get upgrade" on the selected machine and that output is sent back to the server to request an approval. In this case, the server doesn't know before hand what the upgrade will do, so it will always have to be approved.

If, however, you click directly on the number representing known upgrades in the packages screen, "Upgrades" column, there will be no need for an approval if the planned upgrade happens exactly as the server predicted.

Why are some package installations approved automatically?

We recently introduced a feature where Landscape will automatically approve some package installations on its own. This happens if, and only if:

  • the requested activity is a package installation, not a package upgrade
  • that package installation requires other packages to be installed
  • there are no package removals at all

If all the above are met, the activity will be approved automatically.

For example, let's say the administrator requested the installation of the package libfoo-dev, and that this package requires libfoo. Landscape will automatically approve the installation of libfoo.

But if installing libfoo-dev requires libbar-dev to be removed, than the activity won't be approved automatically and the intervention of an administrator will be required.

Landscape says some packages are "unknown"

This is a serious situation that affects client versions before 1.3.2.x. It can happen if a client that was running against one Landscape server is pointed to another Landscape server (for example, the Dedicated Server Edition). Package IDs will get mixed up.

If you encounter this situation, you have to:

  • remove the computer from the new Landscape server where it was registered last
  • stop the client: sudo /etc/init.d/landscape-client stop

  • clear the client state: sudo rm -rf /var/lib/landscape/*

  • request a new registration for this client: sudo landscape-config --silent

  • accept the registration at the Landscape UI

The (package) activity is "Undelivered", do I have to do something?

When an activity is in the "Undelivered" state, it means the server is waiting for the client to connect and pick it up. As soon as the client does this connection, the activity will become "Delivered". This tipically happens in one minute or two.

So no, there is nothing to do but wait and refresh the page occasionally to see if the status changed to "Delivered". Future Landscape versions will have some sort of automatic refresh so you don't have to do anything.

If, however, the activity stays in the "Undelivered" state for a long time (say, 10min or more), then it may indicate a problem with the client's connection to the server.

What does "Package data has changed. Please retry the operation." mean?

If you request the installation or upgrading of packages, sometimes it may fail with this message, this indicates that the package data on the client has changed between when you requested the operation and when it was actioned on the client.

e.g. You request an upgrade from package_x-1.0-ubuntu0 to package_x-1.1-ubuntu0 but by the time it's actioned, package_x-1.0-ubuntu1 has been released and is now current.

This may happen if you request changes on a machine that isn't connecting regularly to Landscape, and the package data is out of date on the server side, it will be quickly rectified, or if you're tracking a pre-release of Ubuntu where the package data can change quickly.

Users/groups

Can I add groups?

Not directly via the User interface. For now you will have to use script execution for that.

Can I use LDAP/NIS/winbind?

Landscape ignores the so called network users and groups. Since we cannot edit, add or delete these users, we opted to ignore them. So, yes, you can use network users and groups, but they will be ignored and there is no direct capability to manage them.

Why don't you use LDAP for users/groups?

LDAP is a very powerful method to manage users and groups, and every site that deploys it has its own particularities, specially regarding schemas. We are evaluating how to best incorporate different authentication mechanisms in Landscape (LDAP, AD, etc) and will have more information on this the end of CY2009.

Support Cases

I get a "salesforce" page when clicking on support cases!

Please make sure you have enabled third-party cookies in your browser. In Firefox, that's under Edit->Preferences->Privacy. Alternatively you can whitelist the salesforce.com domain.

This is needed because the Support Cases application comes from Salesforce.

Support Cases log me out

Please enable third-party cookies or whitelist the salesforce.com domain. See the previous question.

Landscape connectivity

What ports does the Landscape client use for communication with the server?

The client communicates with the server over ports 80 and 443 (via http and https). No communication is initiated from the server to the client.

How does the Landscape client connect to the Landscape server?

At no time does the Landscape server initiate a connection to the Landscape client: all communication is started by the client.

There are basically three types of traffic that can be started by a Landscape client. The image below shows a typical network, with machines managed by Landscape:

[[attachment:landscape-layout.png]]

The picture shows different machines with different traffics just for clarity. Any Landscape client has these three types of traffic:

  • ping: this is a very small HTTP (port 80) request which the client sends to the server every 30s just to know if there are pending messages for it. For example, when an administrator requests a package upgrade, a message will be queued waiting for the client to fetch it. The ping will tell the client that the message is waiting and trigger a message exchange (see next item)

  • message exchange: this is where commands and responses are sent and received via HTTPS (port 443). Traffic is higher than in the ping case, specially during initial client setup. A message exchange can happen periodically or on demand, caused by an administrator's action.

  • package download: this includes package download itself, and also repository data download. Every hour, each Landscape client will run the eqivalent of apt-get update to update the repository information. Other than that, packages will be downloaded and installed whenever triggered by an administrator.

A setup as the one pictured above can big benefits if a proxy/cache such as Squid or apt-cache is installed and configured to cache the packages that are being downloaded by the clients. Without it, a general package upgrade sent to all machines with the same distro installed on them will undoubtedly download the same package several times.

Misc

Does landscape-client work with Debian?

We don't test landscape-client on Debian, but we don't really try to make it difficult for Debian users. Bottom line: if it works for you, great, but we can't support it at the moment.

Can Landscape warn me that a machine needs to be rebooted?

Yes, but with the following constraints:

  • this is only supported by landscape-client 1.3 (and any subversions of that) or later
  • the computer needs to have the package update-notifier-common installed

Is there an on-site version of Landscape?

Yes, the Landscape Dedicated Server is installed on-site on your hardware and provides all the same management and monitoring features of Landscape. All system information is transmitted over your network so no access to the public Internet is required. Details on the Dedicated Server can be found here: http://www.canonical.com/enterprise-services/ubuntu-advantage/landscape/dedicated-edition

I got an alert to reboot computers, but don't know which ones!

When answering to such an alert, you are taken to the Info page with the affected computers selected. In order to see which computers will be rebooted, click on the lower left small computer icon, which has a number next to it indicating how many computers are affected. When clicked, a small sliding pane will show the computer names.

I have hundreds of resynchronization requests, what is going on?

Landscape issues a resynchronization request whenever it detects an inconsistency between what the computer is reporting and what Landscape knows about that computer. These requests should be rare. If there are many going on, one after the other, it's a problem.

First, please make sure you are running the latest landscape-client version. One such situation was fixed in version 1.4.0.

Second, another possible cause for these requests is a duplicate ID. Each machine managed by Landscape gets a unique ID which is stored locally on the client inside the /var/lib/landscape directory.

If a machine is bootstrapped based on another machine which was already registered with Landscape (by, for example, using a VM image), this new machine will get the same ID as the original one. The result is that we will have two different machines talking to the Landscape server as if they were one and the same. Since the machines are not the same, Landscape will pretty soon start detecting inconsistencies and issue resynchronization requests, which will never fix the problem.

To detect if you are in this situation, please run the command below on each of your machines, via ssh (NOT via Landscape!). This command (one line only) will output the Landscape ID of the computer, and it has to be unique across them all:

sudo python -c "d=open('/var/lib/landscape/client/broker.bpickle').read();import landscape.lib.bpickle as b;print b.loads(d)['registration']['secure-id']"

If you get two or more machines with the same ID, you have this problem. Please register one of them again and it should be fixed.

How do I remove a computer from Landscape?

  • Remove the landscape-client package from the registered machine
  • In Landscape, select the machine(s) you want to remove and click on "Info", so that you get to the info page
  • There, just below the comment box, is a link called "Remove this computer...". Click on it and confirm the action

FAQ (last edited 2014-05-01 15:49:25 by bryanquigley)