Health report

geiger is the health report of UraniumOS. It checks services, the network address, disk use, the firewall, frames, the package index and the kernel, and prints one line for each check. It takes no arguments and changes nothing. It is part of the uranium-tools package. After an update, scram verify runs it to decide if the update stays; see scram. It must run as root.

Output

Each line starts with a tag that tells you the result of the check, followed by a short message:

`ok`	The check passed.
`warn`	Something needs attention.
`FAIL`	The system is not healthy.

The exit status is 1 if at least one line is FAIL. The checks run in the same order every time: services, network, root, boot partition, firewall, frames, package index, kernel. A run looks like this:

# geiger
ok    4 services running
ok    network has an address
ok    root 12% used
ok    boot partition 3% used
ok    blastdoor loaded
ok    1 frames, newest 0h old
ok    package index 2 days old
ok    kernel 7.3.0-uranium
# echo $?
0

The count in the first line is the number of service directories without a down file.

Checks

services: geiger asks sv status about every directory in /etc/service that has no file named down, and the service has to be running. Services with a down file are skipped. If all services are running, the check passes. If not, geiger fails and lists the services that are not running. If /etc/service cannot be read, it warns.
network: If no entry of /sys/class/net has a device link, the machine has no network device and the check passes. If there is a device, ip -4 addr has to show an address on an interface other than lo, or the check fails. Only IPv4 counts.
root: geiger looks at how full / is, using df -P. It passes below 85%, warns from 85% and fails from 95%. If df gives nothing usable, it warns that it cannot read the filesystem.
boot partition: Checked only if /boot exists. It warns from 80% and fails from 92%, with boot partition in place of root. The limits are lower because a full boot partition makes scram boot fail, and the frame entries in the boot menu with it. If /boot is not mounted the line describes the root filesystem.
firewall: geiger runs nft list ruleset and looks for a drop policy. If it finds one, the check passes. If it finds none, or if nft fails (for example, without root), geiger warns that the firewall is not loaded. Any table with a drop policy counts, not only the one from /etc/nftables.conf. See blastdoor.
frames: geiger reads the frame directory /run/scram/top/.scram and counts the directories whose names start with a digit. It reports the number of frames and the age of the newest, and warns if the newest frame is older than 72 hours. It warns if there are no frames, and it warns if the directory cannot be read, for example without root. Two more warnings apply when an update is on trial or when an update is waiting to be committed.
package index: geiger reads the date line in /rod/nixpkgs/.pin. It reports the age of the index in days, and warns above 60 days. If there is no readable date, it warns that there is no package index.
kernel: geiger compares /proc/sys/kernel/osrelease with the version in the first line of /rod/profile/boot/config. If they are equal, or equal apart from a suffix such as -uranium, or if there is no config, the check passes. If they differ, geiger warns that you are running an older kernel than the one installed, and that you should reboot. This check never fails.

geiger does not check the clock, disk errors, memory, temperatures or mail. A service only counts as healthy if runit has it up.

Use

In scram verify the first run happens after SCRAM_TRIAL_WAIT seconds (300), then up to three runs 30 seconds apart. The first pass confirms the update. If all three fail the system reboots and the update is reverted. Only FAIL lines count, so a warning never reverts an update. The trial service starts scram verify at every boot and it does nothing when no update is on trial. From cron:

geiger || echo "geiger failed" | mail root

This sends mail only for failures. mail is not in the base package set, so install a mail program first.

Environment

GEIGER_SERVICES: The service directory. Default /etc/service.
GEIGER_BOOT: The boot partition mount point. Default /boot.
ROD_ROOT: Replaces /rod for the package index pin and the profile kernel config. Default /rod.
SCRAM_TOP, SCRAM_FLASH: SCRAM_TOP is the mount point of the btrfs top level, default /run/scram/top. SCRAM_FLASH is the frame directory, default $SCRAM_TOP/.scram.