cmdbsyncer 4.3.4__tar.gz → 4.3.5__tar.gz

{cmdbsyncer-4.3.4/cmdbsyncer.egg-info → cmdbsyncer-4.3.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cmdbsyncer
-Version: 4.3.4
+Version: 4.3.5
 Summary: Rule-based modular synchronizer for Checkmk, Netbox, Ansible, I-DOIT, Jira CMDB and 15+ other CMDB/monitoring systems
 Author-email: Kuhn & Ruess GmbH <info@kuhn-ruess.de>
 Maintainer-email: Bastian Kuhn <mail@bastian-kuhn.de>

cmdbsyncer-4.3.5/application/buildinfo.txt

@@ -0,0 +1 @@
+BUILD_DATE=2026-10-07T14:27:29Z

{cmdbsyncer-4.3.4 → cmdbsyncer-4.3.5}/application/changelog/v4.3.md

@@ -1,5 +1,14 @@
 # Version 4.3
 
+## Version 4.3.5
+- FIX: Inventorize applied `rewrite_hostname` twice for CSV, JSON, REST, YML, MySQL, ODBC, JDisc and LDAP accounts, so a template that appends something to the name, a domain for example, missed the host the import had created
+- FIX: When Checkmk applies a bulk host update or create only in part ("Some actions failed"), the log now names each skipped host with the reason Checkmk gives, in one entry, instead of only the host names. A host is also no longer edited several times per export, so the Checkmk audit log no longer fills up with "Nothing was changed" entries, and a host whose attribute was removed is no longer reported as faulty although the removal worked. A bulk update request carries as many hosts as CMK_BULK_UPDATE_OPERATIONS allows, so this needs no more requests than before
+- FIX: A Move to Folder rule whose folder option has no value for a host (it renders to False, True or None, for example a city the host does not have) no longer writes that into the Checkmk folder: Checkmk 2.5 then failed to list any folder and every export stopped with "Mismatch between endpoint and internal data format". The option is left out with a warning naming folder and attribute, a value like this already in a folder is removed, and when Checkmk can no longer list its folders the export continues and repairs the folders its rules manage
+- FIX: A playbook run with an SSH password no longer fails on every host with "Invalid/incorrect password" when the application runs as the web server user — ssh was trying to write its known_hosts into that user's home directory, which is not writable; each run now keeps its known_hosts with its other temporary files, and a run that still hits this says so in the log instead of blaming the password
+- FIX: A Checkmk rule that Checkmk refuses to update is left in place instead of being deleted — a value the target rejects (for example a password store reference written in a format a newer Checkmk no longer accepts) made the export delete the rule and then fail to recreate it, so the rule was gone after every run
+- FEAT: The Checkmk rule export can be tried out before it runs: `export_rules --dry-run` reads the site and prints every rule it would create, update and delete, with the value it would write and the reason behind every deletion, and sends nothing to Checkmk
+- FIX: `--debug` on the Checkmk rule export now shows the full error of a failed run, the same as the other export commands do, instead of only the difference behind each deletion
+
 ## Version 4.3.4
 - FIX: A user the directory created can now log in — a successful directory bind ended in a server error for anybody who has no local password, which is every user created on first login
 - FIX: A directory login that fails records what went wrong, so an unreachable server, a service account with the wrong password and a group mapping naming a role that does not exist can be told apart in Settings → Log

{cmdbsyncer-4.3.4 → cmdbsyncer-4.3.5}/application/plugins/ansible/runner.py

@@ -263,6 +263,66 @@ def _write_run_inventory_spec(directory: str, provider: str, mode: str,
     return spec_path
 
 
+def _apply_ssh_env(env: dict, run_tmp: str) -> None:
+    """
+    Point OpenSSH at a writable known_hosts file inside the run's temp dir.
+
+    Setting $HOME (see `_execute`) covers Ansible's own scratch files but
+    does not reach ssh: OpenSSH expands the `~` of `~/.ssh` and
+    `known_hosts` through the passwd database, not $HOME. Under mod_wsgi /
+    gunicorn the process runs as the web user, whose home (e.g.
+    `/usr/share/httpd`) is not writable, so every host fails with
+
+        Could not create directory '/usr/share/httpd/.ssh'.
+        Failed to add the host to the list of known hosts
+
+    and with a password sshpass exits 5, which Ansible reports as
+    "Invalid/incorrect password" — hiding the real cause entirely.
+
+    Host key checking is turned off because an unknown host key makes ssh
+    ask a question nobody can answer in a background run (the run would
+    hang or fail instead of reporting anything useful). Operator settings
+    win: ANSIBLE_HOST_KEY_CHECKING is only defaulted, and our ssh options
+    are appended *after* any configured ANSIBLE_SSH_EXTRA_ARGS — ssh keeps
+    the first value it is given for an option, so an own
+    `-o UserKnownHostsFile=...` (a persistent known_hosts) takes precedence.
+    """
+    env.setdefault('ANSIBLE_HOST_KEY_CHECKING', 'False')
+    known_hosts = os.path.join(run_tmp, 'known_hosts')
+    configured = (env.get('ANSIBLE_SSH_EXTRA_ARGS') or '').strip()
+    ours = f'-o UserKnownHostsFile={known_hosts} -o StrictHostKeyChecking=no'
+    env['ANSIBLE_SSH_EXTRA_ARGS'] = f'{configured} {ours}'.strip()
+
+
+def _connection_hint(log: str) -> str:
+    """
+    Explain an "Invalid/incorrect password" that is not one.
+
+    sshpass reports every failure it cannot classify as a wrong password,
+    and Ansible prints ssh's stderr behind that message. When that stderr
+    says ssh could not write into the home directory of the user the
+    application runs as, the password is a red herring — so say that in
+    the log instead of sending the next reader hunting for credentials.
+    Returns an empty string when the log shows no such combination.
+    """
+    if 'Invalid/incorrect password' not in log:
+        return ''
+    if not any(marker in log for marker in (
+            "Could not create directory",
+            "Failed to add the host to the list of known hosts",
+    )):
+        return ''
+    return (
+        "\n--- CMDBsyncer ---\n"
+        "This is most likely NOT a wrong password. The ssh output above shows "
+        "that ssh could not write into the home directory of the user this "
+        "application runs as (no writable ~/.ssh), and sshpass reports that as "
+        "'Invalid/incorrect password'. Give the process a writable home "
+        "directory, or set ANSIBLE_SSH_EXTRA_ARGS with "
+        "-o UserKnownHostsFile=<writable file> in its environment.\n"
+    )
+
+
 def cancel_run(stats) -> bool:
     """
     Stop a still-running playbook by signalling its process group.
@@ -361,6 +421,7 @@ def _execute(stats_id, run_params: dict, cwd: Path, provider: str):
         # local-delegated tasks work; real SSH hosts just create this path
         # under their own /tmp.
         env['ANSIBLE_REMOTE_TEMP'] = run_tmp
+        _apply_ssh_env(env, run_tmp)
         inventory_path = _write_run_inventory_spec(
             run_tmp, provider, env['CMDBSYNCER_INVENTORY_MODE'],
             cmdbsyncer_bin=_cmdbsyncer_bin(),
@@ -387,7 +448,8 @@ def _execute(stats_id, run_params: dict, cwd: Path, provider: str):
             )
             stats.pid = proc.pid
             stats.save()
-            stats.log = _stream_output(proc, stats)
+            captured = _stream_output(proc, stats)
+            stats.log = captured + _connection_hint(captured)
             stats.exit_code = proc.returncode
             # A negative return code means the process was killed by a signal
             # — that is how cancel_run() stops a run, so report it as

cmdbsyncer-4.3.5/application/plugins/ansible/tests/__init__.py

@@ -0,0 +1 @@
+"""Test package for the Ansible plugin."""

cmdbsyncer-4.3.5/application/plugins/ansible/tests/test_runner_ssh_env.py

@@ -0,0 +1,86 @@
+"""
+The playbook runner has to work under a web user without a writable home.
+"""
+# pylint: disable=missing-function-docstring,missing-class-docstring,protected-access
+import os
+import sys
+import unittest
+from types import ModuleType
+from unittest.mock import MagicMock
+
+from tests import _load_real_module
+
+
+def _load_runner():
+    """Load the runner with its model import stubbed."""
+    name = 'application.plugins.ansible.runner'
+    if name in sys.modules:
+        return sys.modules[name]
+    models = sys.modules.setdefault(
+        'application.plugins.ansible.models',
+        ModuleType('application.plugins.ansible.models'))
+    if not hasattr(models, 'AnsibleRunStats'):
+        models.AnsibleRunStats = MagicMock()
+    return _load_real_module(name, os.path.join(
+        'plugins', 'ansible', 'runner.py'))
+
+
+class SshEnvTest(unittest.TestCase):
+    """
+    $HOME does not reach OpenSSH — it expands `~/.ssh` via the passwd
+    database — so the run has to name a writable known_hosts itself.
+    """
+
+    @classmethod
+    def setUpClass(cls):
+        cls.runner = _load_runner()
+
+    def test_known_hosts_points_into_the_run_dir(self):
+        env = {}
+        self.runner._apply_ssh_env(env, '/tmp/run-1')
+        self.assertIn('-o UserKnownHostsFile=/tmp/run-1/known_hosts',
+                      env['ANSIBLE_SSH_EXTRA_ARGS'])
+        self.assertEqual(env['ANSIBLE_HOST_KEY_CHECKING'], 'False')
+
+    def test_operator_settings_keep_precedence(self):
+        env = {
+            'ANSIBLE_HOST_KEY_CHECKING': 'True',
+            'ANSIBLE_SSH_EXTRA_ARGS': '-o UserKnownHostsFile=/etc/ansible/known_hosts',
+        }
+        self.runner._apply_ssh_env(env, '/tmp/run-2')
+        self.assertEqual(env['ANSIBLE_HOST_KEY_CHECKING'], 'True')
+        # ssh keeps the first value given for an option, so the configured
+        # file has to come before ours.
+        args = env['ANSIBLE_SSH_EXTRA_ARGS']
+        self.assertLess(args.index('/etc/ansible/known_hosts'),
+                        args.index('/tmp/run-2/known_hosts'))
+
+
+class ConnectionHintTest(unittest.TestCase):
+    """
+    sshpass calls a non-writable home a wrong password. The log must not
+    leave it at that.
+    """
+
+    @classmethod
+    def setUpClass(cls):
+        cls.runner = _load_runner()
+
+    def test_hint_added_for_unwritable_home(self):
+        log = ('fatal: [host]: UNREACHABLE! => {"msg": "Invalid/incorrect '
+               'password: Could not create directory \'/usr/share/httpd/.ssh\'."}')
+        hint = self.runner._connection_hint(log)
+        self.assertIn('NOT a wrong password', hint)
+
+    def test_no_hint_for_a_real_password_failure(self):
+        log = ('fatal: [host]: UNREACHABLE! => {"msg": "Invalid/incorrect '
+               'password: Permission denied, please try again."}')
+        self.assertEqual(self.runner._connection_hint(log), '')
+
+    def test_no_hint_without_the_password_message(self):
+        log = "Could not create directory '/usr/share/httpd/.ssh'."
+        self.assertEqual(self.runner._connection_hint(log), '')
+
+
+if __name__ == '__main__':
+    unittest.main()

{cmdbsyncer-4.3.4 → cmdbsyncer-4.3.5}/application/plugins/checkmk/__init__.py

@@ -459,19 +459,22 @@ def cli_missing_hosts(account):
 
 @cli_cmk.command('export_rules')
 @click.argument("account")
+@click.option("--dry-run", default=False, is_flag=True)
 @click.option("--debug", is_flag=True)
-def cli_export_rules(account, debug):
+def cli_export_rules(account, dry_run, debug):
     """
     Export all configured Rules to given Checkmk Installations
 
     ### Example
     _./cmdbsyncer checkmk export_rules SITEACCOUNT_
+    _./cmdbsyncer checkmk export_rules SITEACCOUNT --dry-run_
 
 
     Args:
         account (string): Name Checkmk Account Config
+        dry_run (bool): Only print what would change ( default is False )
     """
-    export_rules(account, debug)
+    export_rules(account, dry_run=dry_run, debug=debug)
 
 #.
 #   .-- Command: Analyse Rule Optimization

{cmdbsyncer-4.3.4 → cmdbsyncer-4.3.5}/application/plugins/checkmk/cmk2.py

@@ -18,7 +18,17 @@ FALLBACK_CMK_VERSION = '2.4.0'
 
 
 class CmkException(Exception):
-    """Cmk Errors"""
+    """
+    Cmk Errors
+
+    ``failed_hosts`` holds the per host reasons Checkmk sends with a
+    partly failed bulk request ("Some actions failed"), as
+    ``{hostname: reason}``. It is empty for every other error.
+    """
+
+    def __init__(self, *args, failed_hosts=None):
+        super().__init__(*args)
+        self.failed_hosts = failed_hosts or {}
 
 class CMK2(Plugin):  # pylint: disable=too-many-instance-attributes
     """
@@ -248,7 +258,11 @@ class CMK2(Plugin):  # pylint: disable=too-many-instance-attributes
                     message = " ".join(str(x) for x in (title, detail) if x is not None)
                     if fields is not None:
                         message += str(fields)
-                    raise CmkException(message)
+                    # A bulk request that failed for single hosts names
+                    # them in `detail`, but only `ext.failed_hosts` says why.
+                    ext = response_json.get('ext')
+                    failed_hosts = ext.get('failed_hosts') if isinstance(ext, dict) else None
+                    raise CmkException(message, failed_hosts=failed_hosts)
                 return {}, {'status_code': response.status_code}
             resp_header['status_code'] = response.status_code
 

{cmdbsyncer-4.3.4 → cmdbsyncer-4.3.5}/application/plugins/checkmk/cmk_rules.py

@@ -952,6 +952,10 @@ class CheckmkRuleSync(CMK2):  # pylint: disable=too-many-instance-attributes
         # rule_type -> set of content signatures already collected into
         # rulsets_by_type, so the duplicate check does not rescan the list.
         self._rule_signatures = {}
+        # Changes a dry run decided on but did not send, as
+        # (action, target, detail lines). Filled by _plan, printed by
+        # _report_dry_run at the end of the run.
+        self.dry_run_plan = []
 
     @property
     def rule_marker(self):
@@ -1467,7 +1471,15 @@ class CheckmkRuleSync(CMK2):  # pylint: disable=too-many-instance-attributes
     def export_cmk_rules(self):
         """
         Export config rules to checkmk
+
+        With ``dry_run`` set, every step still runs and still reads
+        Checkmk, but no create, update, delete or move is sent: the
+        decisions are collected and printed instead, so the run can be
+        read before it is made for real.
         """
+        if self.dry_run:
+            print(f"{CC.WARNING} !! {CC.ENDC}Dry run: nothing will be sent "
+                  "to Checkmk")
         self.calculate_rules()
         self.calculate_static_rules()
         self.optimize_rules()
@@ -1476,6 +1488,45 @@ class CheckmkRuleSync(CMK2):  # pylint: disable=too-many-instance-attributes
         self.clean_orphaned_rules()
         self.create_rules()
         self.sort_rules()
+        if self.dry_run:
+            self._report_dry_run()
+
+    def _plan(self, action, target, *lines):
+        """
+        Record a change a dry run does not send.
+
+        ``target`` names the ruleset and, for a rule Checkmk already
+        has, its rule id. ``lines`` carry what an operator has to see
+        before the run happens for real — the value above everything
+        else.
+        """
+        detail = [str(line) for line in lines]
+        self.dry_run_plan.append((action, target, detail))
+        self.log_details.append(
+            ("INFO", f"[dry-run] would {action} {target}: {'; '.join(detail)}"))
+
+    def _report_dry_run(self):
+        """
+        Print what the run would have changed, values included.
+
+        A dry run is only worth something if the value is in the output:
+        the point of it is to read the rule Checkmk would receive before
+        Checkmk receives it.
+        """
+        print(f"\n{CC.HEADER}Dry run — nothing was sent to Checkmk{CC.ENDC}")
+        if not self.dry_run_plan:
+            print(f"{CC.OKGREEN}  ** {CC.ENDC}Checkmk already matches the "
+                  "generated rules — nothing would change")
+            return
+        for action, target, detail in self.dry_run_plan:
+            print(f"{CC.OKBLUE} *{CC.ENDC} would {action} {target}")
+            for line in detail:
+                print(f"{CC.OKCYAN}   {line}{CC.ENDC}")
+        counts = Counter(entry[0] for entry in self.dry_run_plan)
+        summary = ", ".join(f"{count}x {action}" for action, count
+                            in sorted(counts.items()))
+        print(f"{CC.WARNING}  ** {CC.ENDC}{len(self.dry_run_plan)} "
+              f"change(s) pending: {summary}")
 
     def _export_hosts(self):
         """
@@ -2220,6 +2271,13 @@ class CheckmkRuleSync(CMK2):  # pylint: disable=too-many-instance-attributes
         a pending change, and on a large ruleset that is the slowest
         part of the export by far.
         """
+        if self.dry_run:
+            # Every move is a POST, and the move chain is built from the
+            # ids Checkmk hands back for the rules created in this run —
+            # which a dry run never creates. There is nothing truthful to
+            # plan here.
+            print(f"{CC.OKGREEN} -- {CC.ENDC} Reorder skipped (dry run)")
+            return
         if self.config.get('skip_rule_reorder'):
             print(f"{CC.OKGREEN} -- {CC.ENDC} Reorder skipped "
                   "(skip_rule_reorder is set on the account)")
@@ -2392,6 +2450,12 @@ class CheckmkRuleSync(CMK2):  # pylint: disable=too-many-instance-attributes
                         # place update). No POST needed; the captured
                         # ``_cmk_id`` is what ``sort_rules`` will move.
                         continue
+                    if self.dry_run:
+                        self._plan('CREATE', f"a rule in {ruleset_name}",
+                                   f"folder: {rule['folder']}",
+                                   f"condition: {rule['condition']}",
+                                   f"value: {rule['value']}")
+                        continue
                     print(f"{CC.OKBLUE} *{CC.ENDC} Create Rule in {ruleset_name} " \
                           f"({rule['condition']})")
                     url = "domain-types/rule/collections/all"
@@ -2469,7 +2533,8 @@ class CheckmkRuleSync(CMK2):  # pylint: disable=too-many-instance-attributes
         """
         wanted = rule.get('description') or self.rule_marker
         properties = dict(cmk_rule['extensions']['properties'])
-        if properties.get('description', '') == wanted:
+        current = properties.get('description', '')
+        if current == wanted:
             return
         properties['description'] = wanted
         rule_id = cmk_rule['id']
@@ -2478,6 +2543,10 @@ class CheckmkRuleSync(CMK2):  # pylint: disable=too-many-instance-attributes
             "conditions": cmk_rule['extensions']['conditions'],
             "value_raw": cmk_rule['extensions']['value_raw'],
         }
+        if self.dry_run:
+            self._plan('UPDATE', f"{ruleset_name} {rule_id}",
+                       f"description: {current!r} -> {wanted!r}")
+            return
         try:
             self.update_rule(rule_id, payload)
             print(f"{CC.OKBLUE} *{CC.ENDC} UPDATE description of Rule in "
@@ -2559,6 +2628,25 @@ class CheckmkRuleSync(CMK2):  # pylint: disable=too-many-instance-attributes
         reason = ' and '.join(part.split(':', 1)[0] for part in mismatches)
         return (f'{reason} changed', '; '.join(mismatches))
 
+    @staticmethod
+    def _keep_after_failed_update(our_rule, rule_id):
+        """
+        Pair a rule Checkmk refused to update with the existing Checkmk rule
+        instead of deleting it.
+
+        A rejected update means Checkmk does not accept the value we send —
+        a create of the very same value fails for the same reason. Deleting
+        the rule and letting the create fail afterwards leaves the target
+        without any rule at all, and every following run repeats it. Keeping
+        both sides untouched loses nothing: the error is reported, the
+        existing rule keeps working, and the next run retries the update.
+
+        Returns True so the caller treats the rule as found.
+        """
+        our_rule['_cmk_id'] = rule_id
+        our_rule['_skip_create'] = True
+        return True
+
     # pylint: disable=too-many-locals,too-many-branches,too-many-statements
     def clean_rules(self):
         """
@@ -2709,6 +2797,19 @@ class CheckmkRuleSync(CMK2):  # pylint: disable=too-many-instance-attributes
                             "conditions": our_rule['condition'],
                             "value_raw": our_rule['value'],
                         }
+                        if self.dry_run:
+                            self._plan(
+                                'UPDATE', f"{ruleset_name} {rule_id}",
+                                f"value: {our_rule['value']}",
+                                "changed: " + analyze_value_differences(
+                                    condition_matches[0]['expected_value'],
+                                    condition_matches[0]['actual_value']))
+                            # Pair it with the Checkmk rule the same way a
+                            # real update does, so the create step does not
+                            # plan a second rule for the same outcome.
+                            our_rule['_cmk_id'] = rule_id
+                            our_rule['_skip_create'] = True
+                            continue
                         try:
                             self.update_rule(rule_id, update_payload)
                             print(f"{CC.OKBLUE} *{CC.ENDC} UPDATE Rule in "
@@ -2725,6 +2826,8 @@ class CheckmkRuleSync(CMK2):  # pylint: disable=too-many-instance-attributes
                             self.log_error(
                                 f"Could not update Rule {rule_id} in "
                                 f"{ruleset_name}: {error}")
+                            rule_found = self._keep_after_failed_update(
+                                our_rule, rule_id)
 
                     # A host entering or leaving a coalesced rule changed
                     # its condition, which used to read as "this rule is
@@ -2750,6 +2853,15 @@ class CheckmkRuleSync(CMK2):  # pylint: disable=too-many-instance-attributes
                             "conditions": our_rule['condition'],
                             "value_raw": our_rule['value'],
                         }
+                        if self.dry_run:
+                            self._plan(
+                                'UPDATE', f"{ruleset_name} {rule_id}",
+                                f"host list: {len(cmk_hosts)} -> "
+                                f"{len(our_hosts)} hosts",
+                                f"value: {our_rule['value']}")
+                            our_rule['_cmk_id'] = rule_id
+                            our_rule['_skip_create'] = True
+                            continue
                         try:
                             self.update_rule(rule_id, update_payload)
                             print(f"{CC.OKBLUE} *{CC.ENDC} UPDATE host list of "
@@ -2768,6 +2880,8 @@ class CheckmkRuleSync(CMK2):  # pylint: disable=too-many-instance-attributes
                             self.log_error(
                                 f"Could not update host list of Rule {rule_id} "
                                 f"in {ruleset_name}: {error}")
+                            rule_found = self._keep_after_failed_update(
+                                our_rule, rule_id)
 
                     # Only warn about flapping when there really are multiple
                     # conflicting matches — a single value drift is handled
@@ -2810,6 +2924,15 @@ class CheckmkRuleSync(CMK2):  # pylint: disable=too-many-instance-attributes
                             rules, cmk_facts)
                         delete_reasons[reason] = \
                             delete_reasons.get(reason, 0) + 1
+                        if self.dry_run:
+                            detail = [f"reason: {reason}",
+                                      f"detail: {reason_detail}",
+                                      f"value: {value}"]
+                            if deletion_details:
+                                detail.append(deletion_details)
+                            self._plan('DELETE', f"{ruleset_name} {rule_id}",
+                                       *detail)
+                            continue
                         print(f"{CC.OKBLUE} *{CC.ENDC} DELETE Rule in "
                               f"{ruleset_name} {rule_id} ({reason})")
                         if self.debug:
@@ -2852,9 +2975,12 @@ class CheckmkRuleSync(CMK2):  # pylint: disable=too-many-instance-attributes
         summary = ", ".join(
             f"{count}x {reason}" for reason, count
             in sorted(delete_reasons.items(), key=lambda x: -x[1]))
-        message = f"Removing {total} rule(s) — reasons: {summary}"
+        verb = "Would remove" if self.dry_run else "Removing"
+        message = f"{verb} {total} rule(s) — reasons: {summary}"
         print(f"{CC.WARNING}  ** {CC.ENDC}{message}")
-        if not self.debug:
+        if not self.debug and not self.dry_run:
+            # A dry run already prints the difference behind every
+            # planned deletion in its report.
             print(f"{CC.OKCYAN}  ** {CC.ENDC}Run with --debug to see the "
                   f"difference behind each deletion")
         self.log_details.append(("INFO", message))
@@ -2897,6 +3023,11 @@ class CheckmkRuleSync(CMK2):  # pylint: disable=too-many-instance-attributes
                 if not self._owns_rule(cmk_rule):
                     continue
                 rule_id = cmk_rule['id']
+                if self.dry_run:
+                    self._plan('DELETE', f"{ruleset_name} {rule_id}",
+                               "reason: orphaned, this ruleset is not "
+                               "generated any more")
+                    continue
                 print(f"{CC.OKBLUE} *{CC.ENDC} DELETE orphaned Rule in "
                       f"{ruleset_name} {rule_id}")
                 try:

{cmdbsyncer-4.3.4 → cmdbsyncer-4.3.5}/application/plugins/checkmk/inits.py

@@ -420,7 +420,7 @@ def projects_for_account(account):
     ]
 
 
-def export_rules(account, debug=False):
+def export_rules(account, dry_run=False, debug=False):
     """
     Create Rules in Checkmk
     """
@@ -429,6 +429,7 @@ def export_rules(account, debug=False):
         rules = _load_rules()
         syncer = CheckmkRuleSync(account)
         syncer.debug = debug
+        syncer.dry_run = dry_run
         syncer.filter = rules['filter']
         syncer.rewrite = rules['rewrite']
 
@@ -462,7 +463,12 @@ def export_rules(account, debug=False):
         syncer.source = "cmk_rule_sync"
         syncer.export_cmk_rules()
     except CmkException as error_obj:
-        print(f'C{ColorCodes.FAIL}MK Connection Error: {error_obj} {ColorCodes.ENDC}')
+        # Same contract as the other export commands: --debug gives the
+        # traceback instead of the one-line message, so a failing export
+        # can be debugged without editing code.
+        if debug:
+            raise
+        print(f'{ColorCodes.FAIL}CMK Connection Error: {error_obj} {ColorCodes.ENDC}')
         if syncer is not None:
             syncer.record_exception(error_obj)
         else: