My colleagues want a new host group to have more visibility and want the Critical status to be different color. This is defined in nagios3/stylesheets/status.css as statusBGCRITICAL but as I can't seem to modify status.cgi I don't know where to put that logic.
Is there another/any way to have different status colors for different host groups?
Without making any changes to nagios3 config or OS (debian) filesystem changes when I add some extra devices (to the 12000+ on it already) suddenly
[1508925621] Warning: Return code of 127 for check of service 'PING' on host 'SOME-HOST.CISCO' was out of bounds. Make sure the plugin you're trying to run actually exists.
[1508925621] SERVICE ALERT: SOME-HOST.CISCO;PING;CRITICAL;HARD;3;(Return code of 127 is out of bounds - plugin may be missing)
All the binaries are readable/executable none of that has changed since setup.
It happens for ALL hosts of that type, bear in mind this is a setup that's worked for years non-stop the only thing I can think of is some kind of OS limit is hit when running the checks as that's the only thing that changes, more hosts.
I've had max_concurrent_checks=1500 for a long time. (Its a 16 core 24GB RAM physical server)
Apart from the concurrent checks I run
check_result_reaper_frequency=25
max_check_result_reaper_time=20
The large group of hosts are configured as such:
define host{
use generic-cisco
host_name SOME_HOST.CISCO
alias SOME_HOST.CISCO
address xxx.xxx.xxx.xxx
check_command check-host-alive
hostgroups cisco_devices
}
define service{
use generic-service
host_name SOME_HOST.CISCO
service_description PING
check_command check_ping!200.0,20%!600.0,60%
normal_check_interval 10
retry_check_interval 5
}
The only thing to make return it to a working state is to take off some of the more recent hosts I've added and stop and start and hope it runs fine. Any suggestions?
On Sendmail (debian) In my mail.log I get the usual
xdelay=00:00:00, mailer=relay, pri=120324, relay=foo.bar. [10.100.229.64], dsn=2.0.0, stat=Sent [..] [InternalId=43838731190661, Hostname=foo.bar] Queued mail for delivery)
however my colleagues that admin the Exchange server which I've configured as a relay
define(`SMART_HOST',`foo.bar')
assure me that they are Not getting them on their server.
I also tried telnetting on foo.bar and send an email with the usual SMTP commands and that did work
How come sendmail is also reporting 2.0.0 was sent back from the server and yet email is not sent?
The only thing they say they've done is changed the internal DNS to have a redirect for anything .bar to their domain controllers, I dont know what that means but foo.bar resolves correctly on my server and as stated earlier SMTP commands over a telnet session on it worked.
I am asked to modify a default clean nfsen-1.3.6p1 install to to collect and poll every 30 seconds.
I "patched" libexec/NfSenRC.pm's nfdump command arguments that it uses to -w -D -t 30 -p $port -u $uid -g $gid $buffer_opts $subdirlayout -P $pidfile $ziparg $extensions (-t 30) and the capture data is updated every 30 seconds but I don't know how and where to change the RRD resolution (yes I appreciate that the rrds will need recreating) and the way they're used.
Also changed other 300 second hardcoded values and if statements in the other modules in libexec/
And also how to change the web interface to allow display of all these changes, currently it still locks to at least 5 minutes ago when checking the most recent values in a graph
I have this dusty syslog-ng 3.1.3 that writes to a database and all is working well however it seems to keep only 30 days of logs (last table is logs20150826)
How can I increase that? I see nothing immediately clear in the documentation.
There are some references in logrotate dirs but nothing that seems to be controlling the mysql destination and nothing in /etc/syslog-ng/syslog-ng.conf so this 30 day retention must be some kind of default.
What I have: freeradius 2.1.10 on debian, configured to use a database.
How it works now:
There are many devices on the network and users, the users log on devices to configure them and so on. The users can log on to anything. For example some devices (ciscos) the user account on radius comes along with privileges (cisco-avpair attribute) that restrict what that individual can and cannot do on cisco devices.
What I want freeradius to do in addition, for a specific special case: There's a special device that only select users should be able to authenticate into. Everyone else should be just denied access. (so, more strict than the cisco example above).
What I think I should be doing is first define my own attribute for example company-special-privilege so that I can set that for some users in the database with a value of 0 or 1. Then define some policy in policy.conf.
What I'm asking:
Never done policies and I don't understand where they're applied in the rest of the freeradius config (where should I put my special_access policy).
Also unsure how to formulate it but the following pseudocode should represent what I want:
special_access {
if (request to log in $special_device_ip) {
if ($username company-special-privilege) {
reject #
}
}
}
From the above I don't know how to get the device IP or the attribute that the user is set with. I'm not doing a == 1 on the attribute in the second condition in case the user doesn't have the attribute as I don't know what that would imply but any user that doesn't have 1 must be rejected.
How can I find out whether the boost update process is running presently on Cacti? I want to check in a script before I start the regular system backup, delay my backup if it's boost is still running so that I don't overload the system and avoid the gaps I have around the time of my backup..
We all know about open resolvers, this question is kind of for the inverse situation. I have a DNS server that is locked down to certain CIDRs acl trusted {[..]
options {
[..]
allow-query {
// Accept queries from our "trusted" ACL. We will
// allow anyone to query our master zones below.
// This prevents us from becoming a free DNS server
// to the masses.
trusted;
};
This works.
However it doesn't stop infected hosts within the allowed ranges to send spoofed (most commonly type ANY) requests. Those are resolved and the response still sent to the spoofed IP that "requested" it (which is usually the target of the attackers).
How to prevent the DNS server from resolving domains requested outside the trusted ranges? Is that even something bind should be doing?
In my cacti 088a and Thold plugin (version 0.5) when using Baseline Deviation I can choose only
6 minutes average
24 minutes average
4.8 hours average
for Time reference in the past.
Is there a way to specify my own reference in the past?
I need to detect gradual but persistent decline in certain readings, say steady signal degradation within a whole month rather than just detecting rapid changes with those default time windows I listed above..
Got a Cacti instance (CactiEZ with cacti 088a) where I successfully graph with number of bespoke data template and corresponding graph template.
Theres one specific however case where the RRAs are simply not written out. The OID is correct. with Realtime It graphs correctly but when looking at the graph anywhere else on Cacti (tree/graph management/editing a host/debug mode on the graph) RRDTool "says" ERROR: opening [..] No such file or directory
/usr/bin/rrdtool graph - \
--imgformat=PNG \
--start=-86400 \
--end=-60 \
--title='HOSTDESCRIPT - Volts' \
--base=1000 \
--height=120 \
--width=500 \
--alt-autoscale-max \
--lower-limit='0' \
--vertical-label='Volts' \
--slope-mode \
--font TITLE:10: \
--font AXIS:8: \
--font LEGEND:8: \
--font UNIT:8: \
DEF:a="/var/www/html/rra/correctfilename.rrd":'lib_100_v':LAST \
--watermark "bla" \
LINE1:a#4444FFFF:"" \
GPRINT:a:LAST:"Last\:%8.2lf%s" \
GPRINT:a:AVERAGE:"Average\:%8.2lf%s" \
GPRINT:a:MIN:"Min\:%8.2lf%s" \
GPRINT:a:MAX:"Max\:%8.2lf%s\n"
So: Why fail on only one template (which works btw on an older 087c cacti but I've checked and eyeballed the template for 3 days!). Why would Realtime plugin graph it perfectly?
More importantly - whats the difference between the way normal graphing and polling use of templates and how Realtime uses templates? As I think the difference would point to the cause of the issue.
How can I list the graphs for a host, or at the very least the number of graphs?
I'm thinking of a condition where I'd add more graphs depending on such output but all I see is to list available queries and such, I need the actual number/names of the graphs you see when you go to edit a host and click "*Graph List"
# ps ax | grep nfs
1108 ? S< 0:00 [nfsd4]
1109 ? S< 0:00 [nfsd4_callbacks]
1110 ? S 0:00 [nfsd]
1111 ? S 0:00 [nfsd]
1112 ? S 0:00 [nfsd]
1113 ? S 0:00 [nfsd]
1114 ? S 0:00 [nfsd]
1115 ? S 0:00 [nfsd]
1116 ? S 0:00 [nfsd]
1117 ? S 0:00 [nfsd]
4437 ? S< 0:00 [nfsiod]
16799 ? S 0:00 [nfsv4.0-svc]
18091 pts/1 S+ 0:00 grep nfs
But
# service nfs status
nfs: unrecognized service
That'll be on Ubuntu 11.04 am I missing a sym link or something? How can I fix this quickly?
I've Inherited a Mysql master master system, I've noticed the second master (lets call it slave from now on as it's running on a 'slave' machine) stopped getting its db's updated. I saw that
Master:
Slave_IO_Running: Yes
Slave_SQL_Running: Yes
Slave: (with an error I truncated)
Slave_IO_Running: Yes
Slave_SQL_Running: No
Last_Errno: 1062
Last_Error: Error 'Duplicate entry '3' for key 'PRIMARY'' on [...]
I don't know what caused it to process considering we cant get duplicate there. What's important is to resume normal operations;
Right now I've stop slave; on the Master and stop slave; on the Slave because I saw that if I change records on the Slave the changes Do Get Propagated to Master which is in active use.
How do I: Force sync EVERYTHING from master to slave without affecting data on master? Then hopefully have slave pickup replication as usual?
UPDATE
OK I Tried deleting all tables on slave then it complained in that error section that the 'table' doesnt exist. So i made a no data dump of Master, and made sure I have only empty tables in Secondary (slave).
I start slave; on slave BUT now it's complaining about bloody alter table statements for instance:
Last_Errno: 1060
Last_Error: Error 'Duplicate column name [...] Query: 'ALTER TABLE [...]
How to skip the fracking alter statements I just want to replicate the bloody data and be done with it, my tables have the lates changes already FFS and now its complaining about changes made after the replication seized weeks ago
How do I reset the log or something?
OUTSTANDING Why would this start happening? The "Secondary" is propagating to "Primary". "Primary" is not propagating to "Secondary". But any fixes I tried to do left it in the same state Yes-Yes Yes-No with same Last_Error. I think around that time the server was taken off the network, could that confuse MySQL in some way?