All Questions(server)

I'm trying to configure MD RAID1 (using mdadm) with the --write-mostly option so that a network (EBS) volume and a local drive are mirrors of one another (the idea being that the local drive is ephemeral to my instance, but has better performance).

To vet this idea, I get a baseline performance estimate of my drive using the following two scripts.

fio -name=RandWrite -group_reporting -allow_file_create=0 \
  -direct=1 -iodepth=128 -rw=randwrite -ioengine=io_uring -bs=32k \
  -time_based=1 -ramp_time=10 -runtime 10 -numjobs=8 \
  -randrepeat=0 -norandommap=1 -filename=$BENCHMARK_TARGET

# Read performance
fio -name=RandRead -group_reporting -allow_file_create=0 \
  -direct=1 -iodepth=128 -rw=randread -ioengine=io_uring -bs=32k \
  -time_based=1 -ramp_time=10 -runtime 10 -numjobs=8 \
  -randrepeat=0 -norandommap=1 -filename=$BENCHMARK_TARGET

Results:

• Network drive: 117 MiB/s write, 117 MiB/s read
• Local drive: 862 MiB/s write, 665 MiB/s read

The problem comes when I introduce mdadm. Even when using a trivial no-mirror "RAID1", the write performance is severely worse when using the network drive.

mdadm --build /dev/md0 --verbose --level=1 --force --raid-devices=1 "$TARGET"
# mdadm --detail /dev/md0
/dev/md0:
           Version :
     Creation Time : Mon Sep 30 14:22:41 2024
        Raid Level : raid1
        Array Size : 10485760 (10.00 GiB 10.74 GB)
     Used Dev Size : 10485760 (10.00 GiB 10.74 GB)
      Raid Devices : 1
     Total Devices : 1

             State : clean
    Active Devices : 1
   Working Devices : 1
    Failed Devices : 0
     Spare Devices : 0

Consistency Policy : resync

    Number   Major   Minor   RaidDevice State
       0       8       16        0      active sync   /dev/sdb

• 0-mirror RAID1 array backed by network drive: 69.9 MiB/s write, 118 MiB/s read
• 0-mirror RAID1 array backed by local drive: 868 MiB/s write, 665 MiB/s read

As we can see here, the write performance didn't change much for local drive (MD-raid vs. raw access), but it's severely impaired when using the network drive via MD-raid. Why does this happen?

In ansible, I'd like to replace this:

pgsql:
  useCluster: false
  addr: 127.0.0.1:5432
  password: ""
email:
  to: [email protected]
  port: 465
  password: ""

replace to this:

pgsql:
  useCluster: false
  addr: 127.0.0.1:5432
  password: "2024xxx"
email:
  to: [email protected]
  port: 465
  password: ""

Because there are two identical variables that cannot be replaced,I use this method.But it cannot be achieved. How should everyone handle it?

replace:
      path: "config.yaml"
      regexp: '(redis:[^<]*)password: ""'
      replace: '\1password: "2024xxx"'

I am creating an Active Directory lab, with a Windows Server 2022 as the Domain Controller.
I would like to remove complexity requirements for passwords on the domain with powershell.

I did try to use the following commands:

$passwordPolicy = Get-ADDefaultDomainPasswordPolicy
$passwordPolicy.ComplexityEnabled = $false
Set-ADDefaultDomainPasswordPolicy $passwordPolicy

There was no error messages. But the complexity requirements are still present, as indicated by ComplexityEnabled:

> Get-ADDefaultDomainPasswordPolicy


ComplexityEnabled           : True
DistinguishedName           : DC=poudlard,DC=wizard
LockoutDuration             : 00:30:00
LockoutObservationWindow    : 00:30:00
LockoutThreshold            : 0
MaxPasswordAge              : 42.00:00:00
MinPasswordAge              : 00:00:00
MinPasswordLength           : 0
objectClass                 : {domainDNS}
objectGuid                  : 6f5b0803-0227-4454-899f-28df34343bfa
PasswordHistoryCount        : 0
ReversibleEncryptionEnabled : False

And my user is part of the Domain admins:

PS C:\Users\vagrant> whoami /groups

GROUP INFORMATION
-----------------

Group Name                                      Type             SID                                          Attributes
=============================================== ================ ============================================ ===============================================================
Everyone                                        Well-known group S-1-1-0                                      Mandatory group, Enabled by default, Enabled group
BUILTIN\Administrators                          Alias            S-1-5-32-544                                 Mandatory group, Enabled by default, Enabled group, Group owner
BUILTIN\Users                                   Alias            S-1-5-32-545                                 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access      Alias            S-1-5-32-554                                 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK                            Well-known group S-1-5-2                                      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users                Well-known group S-1-5-11                                     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization                  Well-known group S-1-5-15                                     Mandatory group, Enabled by default, Enabled group
poudlard\Domain Admins                          Group            S-1-5-21-1683605283-797255120-3757226006-512 Mandatory group, Enabled by default, Enabled group
Authentication authority asserted identity      Well-known group S-1-18-1                                     Mandatory group, Enabled by default, Enabled group
poudlard\Denied RODC Password Replication Group Alias            S-1-5-21-1683605283-797255120-3757226006-572 Mandatory group, Enabled by default, Enabled group, Local Group
Mandatory Label\High Mandatory Level            Label            S-1-16-12288

What could be the issue ?

I have a small business. With little previous knowledge/experience of NAS solutions. The budget was a bit of a problem, I have been capped to 40,000 CZK =~ 1800 USD. First, it may be best to tell you what solution I picked up:

Synology DS923+ with these plugged into:

• Let me start with a UPS, which I already had for 3 months, signalling via USB to the NAS, (this was not part of the budget obviously);
• The included amount of RAM was a joke, so I fitted it with 2x 16 GB ECC module (not from Synology);
• I need just about 22 TB to tripple the previous poor solution, so I went for 4x 8TB HDD (not from Synology);
• Finally, I fitted 2x 1 TB M.2 NVMe (not from Synology).
• 1 Gigabit/s speed is ok for us, so I did not have to buy the 10 Gigabit extension;
• (For completeness, I have a symmetric connection from my ISP with 100 Mbit/s down/and also up and both the router and main switch is not from Synology).

As for set-up, stating only the most important settings:

• SSH access from my main Linux machine with public authentication;
• Reliable and stable connection to the mentioned Linux machine via NFSv4.1;
• Previous solution had only 2 bays 4TB each in RAID0, this time I struggled with my thinking, but in the end had set up RAID5;
• I am well aware I should be going for RAID6 likely, but I would not reach the required capacity, it is a bit better than RAID0, right..;
• As for the file system, I chose BTRFS just to try it out finally, it has nice features..;
• Those two fast M.2 NVMe drives I have set-up as a cache for the volume, in RAID1 as read+write cache.

I was previously decided to use the M.2's in RAID0 as a very fast storage, and here we go:

• I know how to unofficially do that, yet I resisted, and tried the cache first;
• It appears to actually be more helpful, than I thought;
• The use-case for this NAS is very wide, ranging from simple document sharing mostly inside local network with other people to saturating my upload link with high (legal) torrent usage;

Conclusion: Thanks to the heavy torrent use, if I am not mistaken, I believe utilizing those 1 TB NVMe's is a logical choice, but I tend to verify what I am inexperienced with.

So as for the formulation of my question:

Does it make more sense to use NVMe drives for that Synology NAS of ours to act as a cache than as a storage (which is unofficial with non-Synology drives, I know)? Thank you for reading the whole story! I hope to see some fact-based answers. Thanks in any case for your time.

Cache hits normally around 95%, image for the words:

I have a server with two IP addresses attached to a single interface:

2: enp27s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 30:9c:23:83:64:f6 brd ff:ff:ff:ff:ff:ff
    inet [IP_1]/32 scope global noprefixroute enp27s0
       valid_lft forever preferred_lft forever
    inet [IP_2]/32 scope global enp27s0
       valid_lft forever preferred_lft forever
    inet6 [IP6_1]/64 scope link
       valid_lft forever preferred_lft forever

And I have a few virtual machines running on it and whenever they communicate with the outside world, their packets get IP_1 as the source IP. I also have a specific VM which I'd like to "route" through IP_2 instead. I don't want to attach it entirely to that IP address, I'd still prefer for it to stay inside the virtual network, but I want all of the packets coming out of it have IP_2 as their source IP.

I tried to apply a SNAT translation to achieve that, but it didn't really work:

iptables -t nat -A POSTROUTING -s [VM_IP] -o enp27s0 -j SNAT --to-source [IP_2]

I assume that's because by the time packets finish routing they already have IP_1 as source IP and the -s [VM_IP] part of rule doesn't match. Changing that to -s [IP_1] or just setting IP_2 as the primary IP could work probably, but I kinda need other VMs to have their outgoing traffic be routed through IP_1.

Are there any ways to achieve that? I'm pretty sure a question like that has been asked here before, but unfortunately my inexperience prevents me from coming up with keywords to put in the search bar to find it :(

Update: here's my POSTROUTING table rules (excluding that one SNAT rule):

# iptables -t nat -S POSTROUTING
-P POSTROUTING ACCEPT
-A POSTROUTING -j LIBVIRT_PRT

# iptables -t nat -S LIBVIRT_PRT
-N LIBVIRT_PRT
-A LIBVIRT_PRT -s 192.168.122.0/24 -d 224.0.0.0/24 -j RETURN
-A LIBVIRT_PRT -s 192.168.122.0/24 -d 255.255.255.255/32 -j RETURN
-A LIBVIRT_PRT -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
-A LIBVIRT_PRT -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
-A LIBVIRT_PRT -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE