From: Stephan Kosinski <stephan@logan.tv>
Subject: [OsX 10.5.5] After Effect CS3 render issue. 
   Date: Fri, 26 Sep 2008 22:13:14 -0400

Hello Greg, Hello all

    Here is the full log:

##########################################################################################################################
###
### loganm014.3: 0002
###
--------------- Rush 102.42a9 --------------
--      Host: loganm005
--       Pid: 2296
--     Title: test_AFX2
--     Jobid: loganm014.3
--     Frame: 0002
--     Tries: 7
--     Owner: dak (1113/20)
-- RunningAs: dak (1113/20)
--  Priority: 1
--      Nice: 10
--    Tmpdir: /var/tmp/.RUSH_TMP.32

--   Started: Fri Sep 26 18:51:47 2008
--------------------------------------------

COMP: test_ShaveAndHairCut
OUTPUTDIR: -
AEVERSION: -
RENDERFLAGS:
BATCHFRAMES: 1 (2-2)
RETRIES: 3 (Fail after 3 retries)

PROGRESS: Launching After Effects...
PROGRESS: ...After Effects successfully launched

--- AERENDER SUCCEEDS
##########################################################################################################################

    ...............But actually it did not, succeed.

    Anyone got this kind of trouble already?


Thank you very much for your help.

Stephan.

Stephan Kosinski wrote:
> While I have to problem in rendering some maya scenes I have an 
> issue with AfterEffect I don't know how to workaround. (well, I'm pretty 
> lame on OsX...)
> 
>      When I submit a job to one of the Mac station, here is what I get 
>      this error:
> 
> _RegisterApplication(), FAILED TO establish the default connection to the WindowServer, _CGSDefaultConnection() is NULL.

	Pretty sure that's a variation of this problem:
	http://www.seriss.com/rush-current/issues-afterfx-6.5/index.html#OSX

	AE is odd in that it needs access to the window manager
	during rendering, on both Windows and OSX, so it's basically
	a permission issue with AE not able to access the window manager.

	The fix is most likely just a matter of:

cd '/Applications/Adobe After Effects 6.5/'
chown 0:0 aerender
chmod 4755 aerender

	..just change the "Adobe After Effects 6.5" path to the
	appropriate CS3 pathname.

-- 
Greg Ercolano, erco@(email surpressed)
Seriss Corporation
Rush Render Queue, http://seriss.com/rush/
Tel: (Tel# suppressed)
Fax: (Tel# suppressed)
Cel: (Tel# suppressed)

Hello Greg, hello rush folks!

	On the two rendering machines I still get the message:

	.... But it renders the current image properly.

	As mentionned in the link you sent the rendered images belong to root.

	On the one of the rendering machine (loganM014)I get this message:

PROGRESS: Launching After Effects...
aerender ERROR -600: GetProcessForPID failed at line 847
	
	.... and the image does not render.

PROGRESS: Launching After Effects...

PROGRESS: ...After Effects successfully launched
PROGRESS:  9/29/08 11:31:00 AM: Starting composition test_ShaveAndHairCut.


PROGRESS:  Render Settings: Best Settings
PROGRESS:  Quality: Best
PROGRESS:  Resolution: Full
PROGRESS:  Size: 640 x 480
PROGRESS:  Proxy Use: Use No Proxies
PROGRESS:  Effects: Current Settings
PROGRESS:  Disk Cache: Read Only
PROGRESS:  Color Depth: Current Settings
PROGRESS:  Frame Blending: On For Checked Layers
PROGRESS:  Field Render: Off
PROGRESS:  Pulldown: Off
PROGRESS:  Motion Blur: On For Checked Layers
PROGRESS:  Use OpenGL: Off
PROGRESS:  Solos: Current Settings
PROGRESS:  Time Span: Custom
PROGRESS:  Start: 00003
PROGRESS:  End: 00003
PROGRESS:  Duration: 00001
PROGRESS:  Frame Rate: 30.00 (comp)
PROGRESS:  Guide Layers: All Off
PROGRESS:  Storage Overflow: On
PROGRESS:  Skip Existing Files: Off
PROGRESS:
PROGRESS:  Output Module: Lossless

PROGRESS:  Format: Targa Sequence
PROGRESS:  Output Info: -
PROGRESS:  Start Frame: 3
PROGRESS:  Output Audio: -
PROGRESS:  Channels: RGB + Alpha
PROGRESS:  Depth: Millions of Colors+
PROGRESS:  Color: Straight
PROGRESS:  Stretch: -
PROGRESS:  Crop: -
PROGRESS:  Final Size: 640 x 480
PROGRESS:  Profile:  -
PROGRESS:  Embed Profile:
PROGRESS:
PROGRESS:  Post-Render Action: None
PROGRESS:
PROGRESS:
PROGRESS:
PROGRESS:
PROGRESS:  00003 (1): 0 Seconds
PROGRESS:  9/29/08 11:31:01 AM: Finished composition test_ShaveAndHairCut.



PROGRESS:  Total Time Elapsed: 1 Seconds



	So here are my two questions:

	- What could I have omitted when I did install rush on this machine?

Thank you for your help.

Stephan.

Greg Ercolano wrote:

Stephan Kosinski wrote:

While I have to problem in rendering some maya scenes I have an issue with AfterEffect I don't know how to workaround. (well, I'm pretty lame on OsX...)

When I submit a job to one of the Mac station, here is what I get this error:

_RegisterApplication(), FAILED TO establish the default connection to the WindowServer, _CGSDefaultConnection() is NULL.

	Pretty sure that's a variation of this problem:
	http://www.seriss.com/rush-current/issues-afterfx-6.5/index.html#OSX

	AE is odd in that it needs access to the window manager
	during rendering, on both Windows and OSX, so it's basically
	a permission issue with AE not able to access the window manager.

	The fix is most likely just a matter of:

cd '/Applications/Adobe After Effects 6.5/'
chown 0:0 aerender
chmod 4755 aerender

	..just change the "Adobe After Effects 6.5" path to the
	appropriate CS3 pathname.

Stephan Kosinski wrote:
> Hello Greg, hello rush folks!
> 
> 	Thank you for the tip. Actaully it now renders the images
> properly 2 of the 3 machines I'm testing AErender on.
> 
> 	On the two rendering machines I still get the message:
> 
> Mon Sep 29 10:52:51 loganM005 aerender[5254] <Warning>: 3891612: (connectAndCheck) Untrusted apps are not allowed to connect to or launch Window Server before login.
> _RegisterApplication(), FAILED TO establish the default connection to the WindowServer, _CGSDefaultConnection() is NULL.
> 
> 	.... But it renders the current image properly.

    Sounds like no one is logged into the window manager on that machine.
    I'd ignore it as just a warning.

    Definitely lobby for Adobe to fix aerender so that it does not need
    to interact with the window manager. They really need to fix that
    so that aerender can be a true command-line-only app. All this
    is because the app is really still interacting with the window manager.

> 	As mentionned in the link you sent the rendered images belong to root.
> 	On the one of the rendering machine (loganM014)I get this message:
> 
> Executing: aerender -project 
> "/Volumes/PROJECTS/dakperso/dakperso_BASE/2d/AFTER_EFFECTS/dak/TRACKING_TEST/project_files/rush_test.aep" 
> -comp "test_ShaveAndHairCut"  -s 3 -e 3
> _RegisterApplication(), FAILED TO establish the default connection to the WindowServer, _CGSDefaultConnection() is NULL.
> PROGRESS: Launching After Effects...
> aerender ERROR -600: GetProcessForPID failed at line 847
> 	
> 	.... and the image does not render.

	Hmm, I haven't seen that one, but it looks like there are
	many hits on google for that error message. Apparently it comes
	up in different contexts.

	My guess is it has to do with someone being logged in over
	the window manager or remote desktop.

	I think you'll have to ask Adobe what that means, as it says it
	failed "at line 847", but doesn't say which file.

> 	What is strange is that when I launch the line in a ssh session the 
> images renders well:
> 
> [loganM014:/Applications/Adobe After Effects CS3] dak% ./aerender 
> -project 
> "/Volumes/PROJECTS/dakperso/dakperso_BASE/2d/AFTER_EFFECTS/dak/TRACKING_TEST/project_files/rush_test.aep" 
> -comp "test_ShaveAndHairCut" -s 3 -e 3
> PROGRESS: Launching After Effects...
> Mon Sep 29 11:30:55 loganM014 aerender[2265] <Warning>: 3891612: 
> (connectAndCheck) Untrusted apps are not allowed to connect to or launch 
> Window Server before login.
> _RegisterApplication(), FAILED TO establish the default connection to 
> the WindowServer, _CGSDefaultConnection() is NULL.
> PROGRESS: ...After Effects successfully launched
> PROGRESS:  9/29/08 11:31:00 AM: Starting composition test_ShaveAndHairCut.

	That is strange, I'd say try logging into the window manager
	on that machine, and see if that changes things.

> 	- What will be the best way to add "chown" and a "chmod" command at the 
> current image completion in order to make to rendered image belongs to 
> the user who launched the job? 

	It sounds like you're asking if you can chown the rendered image
	so that it isn't owned by root, due to the aerender setuid hack.
	(you should not need "chmod", the umask can control that)

	From the perl script, I'd say 'I don't recommend you try',
	as there are too many things to make this hard:

		1) You'd have to parse the image pathname from the log
		   which is in OS9 format, eg:
dakperso:dakperso_BASE:IMAGES:USERS:dak:TRACKING_TEST:work:test_AFX_rush.[#####].tga
		   ..so you'd have to translate that into unix format,
		   and convert the [#####] to the frame number.

		2) You have to be sure the pathname you parse is valid;
		   you don't want to be chowning random files from the log
		   that might 'look like' a pathname. It would be more reliable
		   if AE printed some unique leader on the pathname line, like:

Writing output image: dakperso:dakperso_BASE:IMAGES:USERS:dak:TRACKING_TEST:work:test_AFX_rush.[#####].tga
^^^^^^^^^^^^^^^^^^^^^

		3) If the perl script is running as a normal user, trying to use
		   chown on a root-owned file will likely fail unless the chown
		   command is run as root itself (or sudo)

	All the above together is fairly complicated, and a little too scary
	if you ask me.

	However, if you know how to hack AfterEffect's javascript, then you
	might be able to hack the chown() command in there, since aerender
	will be running as root, and within AE, the pathname will likely
	be more easy to access. But I have no information on this. Possibly
	Adobe support, or one of their newsgroups can advise on how to do this.

-- 
Greg Ercolano, erco@(email surpressed)
Seriss Corporation
Rush Render Queue, http://seriss.com/rush/
Tel: (Tel# suppressed)
Fax: (Tel# suppressed)
Cel: (Tel# suppressed)

Greg Ercolano wrote:
>> _RegisterApplication(), FAILED TO establish the default connection to the WindowServer, _CGSDefaultConnection() is NULL.

    BTW, citing some specifics, using Apple's own docs as a source:
    http://developer.apple.com/technotes/tn2005/tn2083.html#SECPERMISSIONTOCONNECT

    Since links at Microsoft and Apple have a way of going stale constantly,
    I'm quoting the relevant passage from that text here:

*** Technical Note TN2083 ***

[..]

Permission To Connect

[..]

A process can only use the global window server service if its EUID is 0
(it's running as root) or matches the UID of the console user. All other
users are barred from using it.

For a demonstration of this, you can SSH to your own machine and try to
run Activity Monitor from your shell. Listing 6 shows an example of doing
this from Terminal. The first attempt to run Activity Monitor command works
because it's running as the same user as Terminal. The second attempt fails
because the test user (mrgumby) does not match the console user, and thus
cannot access the global window server service.

Listing 6: Accessing the window server from console and non-console users
---------------------------------------------------------------------------
$ ssh ${USER}@localhost
Password:********
Last login: Wed Jun 20 11:49:23 2007
$ id
uid=502(quinn) gid=20(staff) groups=20(staff),81(_appserveradm), 104(com.apple.sharepoint.group.1),79(_appserverusr),80(admin), 101(com.apple.access_remote_ae),103(com.apple.access_ssh-disabled)
$ ls -l /dev/console
crw-------  1 quinn  staff    0,   0 Jun 20 11:50 /dev/console
$ # Launch Activity Monitor and then quit it.
$ /Applications/Utilities/Activity\ Monitor.app/Contents/MacOS/Activity\ Monitor
$ logout
Connection to localhost closed.

$ ssh mrgumby@localhost
[..]
$ id
uid=503(mrgumby) gid=20(staff) groups=20(staff),105(com.apple.sharepoint.group.2), 104(com.apple.sharepoint.group.1)
$ ls -l /dev/console
crw-------   1 quinn  quinn    0,   0 Oct  3 21:31 /dev/console
$ # Activity Monitor fails to launch at all.
$ /Applications/Utilities/ctivity\ Monitor.app/Contents/MacOS/Act_RegisterApplication(), FAILED TO establish the default connection to the WindowServer, _CGSDefaultConnection() is NULL.
2007-06-20 11:54:31.798 Activity Monitor[863:10b] An uncaught exception was raised
[...]

This limitation makes it very hard to reliably use the global window service because:

    * Standard security practice is that daemons should not run as root;
      rather, they should be run by a dedicated user (that is, the wombatd
      daemon is run by a dedicated _wombat user).

      Also, standard security practice dictates that programs running as root
      should try to reduce their attack surface by limiting the list of
      frameworks that they use. Thus, in general, programs running as root
      should not use high-level frameworks that rely on the window server,
      like AppKit and HIToolbox.

      So, solving the problem by running as root is a security no-no.

    * There is no easy way to solve the problem by running your daemon
      as the console user because, with fast user switching, the console
      user can change at any time.

-- 
Greg Ercolano, erco@(email surpressed)
Seriss Corporation
Rush Render Queue, http://seriss.com/rush/
Tel: (Tel# suppressed)
Fax: (Tel# suppressed)
Cel: (Tel# suppressed)

Thank you Greg,

Have a nice day.

Stephan.

Greg Ercolano wrote:

Stephan Kosinski wrote:

Hello Greg, hello rush folks!

	Thank you for the tip. Actaully it now renders the images
properly 2 of the 3 machines I'm testing AErender on.

	On the two rendering machines I still get the message:

Mon Sep 29 10:52:51 loganM005 aerender[5254] <Warning>: 3891612: (connectAndCheck) Untrusted apps are not allowed to connect to or launch Window Server before login.
_RegisterApplication(), FAILED TO establish the default connection to the WindowServer, _CGSDefaultConnection() is NULL.

	.... But it renders the current image properly.

    Sounds like no one is logged into the window manager on that machine.
    I'd ignore it as just a warning.

    Definitely lobby for Adobe to fix aerender so that it does not need
    to interact with the window manager. They really need to fix that
    so that aerender can be a true command-line-only app. All this
    is because the app is really still interacting with the window manager.

	As mentionned in the link you sent the rendered images belong to root.
	On the one of the rendering machine (loganM014)I get this message:

Executing: aerender -project "/Volumes/PROJECTS/dakperso/dakperso_BASE/2d/AFTER_EFFECTS/dak/TRACKING_TEST/project_files/rush_test.aep" -comp "test_ShaveAndHairCut" -s 3 -e 3

_RegisterApplication(), FAILED TO establish the default connection to the WindowServer, _CGSDefaultConnection() is NULL.
PROGRESS: Launching After Effects...
aerender ERROR -600: GetProcessForPID failed at line 847
	
	.... and the image does not render.

	Hmm, I haven't seen that one, but it looks like there are
	many hits on google for that error message. Apparently it comes
	up in different contexts.

	My guess is it has to do with someone being logged in over
	the window manager or remote desktop.

	I think you'll have to ask Adobe what that means, as it says it
	failed "at line 847", but doesn't say which file.

What is strange is that when I launch the line in a ssh session the images renders well:

[loganM014:/Applications/Adobe After Effects CS3] dak% ./aerender -project "/Volumes/PROJECTS/dakperso/dakperso_BASE/2d/AFTER_EFFECTS/dak/TRACKING_TEST/project_files/rush_test.aep" -comp "test_ShaveAndHairCut" -s 3 -e 3

PROGRESS: Launching After Effects...

Mon Sep 29 11:30:55 loganM014 aerender[2265] <Warning>: 3891612: (connectAndCheck) Untrusted apps are not allowed to connect to or launch Window Server before login. _RegisterApplication(), FAILED TO establish the default connection to the WindowServer, _CGSDefaultConnection() is NULL.

PROGRESS: ...After Effects successfully launched
PROGRESS:  9/29/08 11:31:00 AM: Starting composition test_ShaveAndHairCut.

	That is strange, I'd say try logging into the window manager
	on that machine, and see if that changes things.

- What will be the best way to add "chown" and a "chmod" command at the current image completion in order to make to rendered image belongs to the user who launched the job?

	It sounds like you're asking if you can chown the rendered image
	so that it isn't owned by root, due to the aerender setuid hack.
	(you should not need "chmod", the umask can control that)

	From the perl script, I'd say 'I don't recommend you try',
	as there are too many things to make this hard:

		1) You'd have to parse the image pathname from the log
		   which is in OS9 format, eg:
dakperso:dakperso_BASE:IMAGES:USERS:dak:TRACKING_TEST:work:test_AFX_rush.[#####].tga
		   ..so you'd have to translate that into unix format,
		   and convert the [#####] to the frame number.

		2) You have to be sure the pathname you parse is valid;
		   you don't want to be chowning random files from the log
		   that might 'look like' a pathname. It would be more reliable
		   if AE printed some unique leader on the pathname line, like:

Writing output image: dakperso:dakperso_BASE:IMAGES:USERS:dak:TRACKING_TEST:work:test_AFX_rush.[#####].tga
^^^^^^^^^^^^^^^^^^^^^

		3) If the perl script is running as a normal user, trying to use
		   chown on a root-owned file will likely fail unless the chown
		   command is run as root itself (or sudo)

	All the above together is fairly complicated, and a little too scary
	if you ask me.

	However, if you know how to hack AfterEffect's javascript, then you
	might be able to hack the chown() command in there, since aerender
	will be running as root, and within AE, the pathname will likely
	be more easy to access. But I have no information on this. Possibly
	Adobe support, or one of their newsgroups can advise on how to do this.