Skip to content

Even though the PG drop counter cache is per user, Root privilege mandated for sonic-clear priority-group drop counters #4144

@AnantKishorSharma

Description

@AnantKishorSharma

PG drop counters are stored in cache per user/uid by design. but we are restricting admin user to use Root privilege to clear the counters that clears it in the root cache not admin cache.

Because of this check, admin user will never be able to see the o/p relative to cleared counters when it runs show priority-group drop counters

If we use pg-drop -c show/clear by any user it works.

admin@ny-q5241-04:~$ show priority-group drop counters >>>> Root privilege not mandated for show
Ingress PG dropped packets:
      Port    PG0    PG1    PG2    PG3    PG4    PG5    PG6    PG7
-----------  -----  -----  -----  -----  -----  -----  -----  -----
 Ethernet0      0      0      0      0      0      0      0      0
 Ethernet8     71      0      0      0      0      0      0      0

admin@ny-q5241-04:~$ sonic-clear priority-group drop counters 
Root privileges are required for this operation
admin@ny-q5241-04:~$ 
  1. Is pg-drop -c show/clear <namespace> is the recommended cmd to use here and cmds mentioned above are not to be used?
  2. Should we remove the check for Root privilege in sonic-clear priority-group drop counters just like dropcounters?
admin@ny-q5241-04:~$ sonic-clear dropcounters 
Cleared drop counters

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions