Rooster's questions

So I'm super confused.

I have a test build that started breaking because a mysql socket was attempting to be created in such a deeply nested folder that its file path name exceeded the 108 character limit. So my thought was to put the socket in the test running users home directory in a similiarly named folder. Ie:

/home/nightlybuild/projects/......./myTestProject/output/db/connect.sock becomes /home/nightlybuild/myTestProject/output/db/connect.sock

then I created a symlink in the nested dir:

ln -s /home/nightlybuild/myTestProject/output/db/connect.sock /home/nightlybuild/projects/......./myTestProject/output/db/connect.sock

Now heres what I'm confused about. If I try to run mysql through that socket by passing ANY relative path to the socket in, I can connect and everything works as expected. However, if I pass a full absolute path to the socket in, I get a can't connect error.

Works: (from home dir):

mysql --socket=projects/......./myTestProject/output/db/connect.sock

(doesnt work):

mysql --socket=/home/nightlybuild/projects/......./myTestProject/output/db/connect.sock

I dont understand how the full path could be breaking it at all. Anyone have any ideas what I might be doing wrong or even tips about a log or something I could look at to try and get more info about the problem?

Cheers!

So as of redhat/centos 7, system resource management got a big overhaul. Before redhat/centos 7, cgroups were run using libcgroup packages and daemons like cgred.

Before, if I wanted to move a process into a cgroup, I could do something like:

cgclassify -g cpu:some_cgroup <pid>

In researching systemd's take on resource management however, I found articles stating that libcgroup packages were deprecated and mostly won't work on redhat/centos 7.

If cgclassify should still work, I'm confused as to how I would use it to move processes because there really arent named cgroups anymore, but rather slices/scopes/services.

Assuming I have a logged in user with uid 1111, that I created some rules for limiting resources for in systemd, the following command doesnt work to move a process to their user slice:

cgclassify -g cpu:user-1111.slice <pid>

Is there a convention I'm missing here?

I've also seen that there is a systemd-run command that almost does what I want, but theres no way to blanketly pass every current environment variable to it, which isnt even something you need to worry about with cgclassify. You can pass environment variables, but to actually pass all variables, you'd literally have to have an entry for each variable passed via the command that lets you pass environment variables.

Anyone have anythought on getting cgclassify to work, or even just an approach change I can take?

I may be taking the wrong approach here, but the new centos 7 implementation of cgroups lets you put limits on user's access to system resources by attaching said limits to their slices.

Ie.

systemctl set-property user-1005.slice CPUShares=100

However, that slice won't exist until the user has initially logged in. Since I'll be creating the user, I would kind of like to just trigger that initial log in at creation time, and then attach some default cgroup values then. I tried just using su but that didn't work. The only other thing I can think of is to actually set a password on the user and ssh in locally, which seems like a headache. Is there a simple tool for initiating a log in that might create a user's slice? Or even a better approach to this problem?

Cheers!

Is there a way to see processed that finished running or were killed a given amount of time ago?

For instance, ps -ef will show all running processes, but if a process finishes, it is no longer returned by this command. So for instance if I wanted to see what processes (with their commands) were running an hour ago, is there any command to do that? Or a log of processes no longer in use?

Trying to investigate a blip an hour ago and would like as much information as possible!

Cheers

In linux, considering this use case:

1.  User initiates http request for webpage to remote server
2.  Remote server answers request and sends packets

Is there any reference to the user who started the process that made the request to the remote server on the incoming packets the remote server sends?

I'm trying to figure out a way to filter ingress traffic so I can rate limit on a per user basis rather than just rate limiting the entire system.

I'm trying to troubleshoot an issue I'm having related to IFB Mirroring which I'm attempting to deploy based on this question: Tc: ingress policing and ifb mirroring

My theory is that since the ingress traffic is being redirected to/via ifb to be controlled by egress rules, I should be able to limit the ingress bandwidth via a combination tc and of Linux Control Groups net_cls controller, which can tag packets with a classid.

However its not working. I'm theorizing that since the packets start off from ingress, they aren't being tagged even though they end up being treated as egress. However, the only way I can think to test this is by actually looking at the packet and seeing if the class is there.

Not sure how to do this. I'm thinking possibly tcpdump can but don't know the relevant flags.

If anyone has any ideas about my larger problem I'd appreciate those as well!

Cheers!

I'm setting up some htb packet queues like so:

tc qdisc add dev eth0 root handle 10: htb
tc qdisc add dev eth1 root handle 10: htb

tc class add dev eth0 parent 10: classid 10:1012 htb rate 750kbps ceil 750kbps
tc filter add dev eth0 parent 10: protocol ip prio 10 handle 1: cgroup
tc class add dev eth1 parent 10: classid 10:1012 htb rate 750kbps ceil 750kbps
tc filter add dev eth1 parent 10: protocol ip prio 10 handle 1: cgroup

And am testing it by downloading a 10MB file using wget. I have verified that the packets have the correct classid on them.

When I do the download without these tc rules, I get an average download speed of ~ 9MB/s

When I apply the limit, my speed drops, but it drops to the wrong number. It tops off consistently at 3.7MB/s.

I have no idea why my limit is going over by so much especially considering I have a ceil set. I did notice that the download appears to start limited at 750kbps, but then starts incrementily gaining speed.

Any one have any ideas what I'm doing wrong?

Cheers!

I'm having some trouble limiting network bandwidth using the net_cls control group in conjunction with the linux traffic controller (tc). I think I might just be confused about how I'm writing the filter rules. I figured the easiest way to manage users network bandwidth would be to use their uid as part of their net_cls control groups classid. So I set the following rule in my cgconfig file (and keep rebooting the machine). I also have the proper setup in my cgrules.conf as any limits I impose on other controllers(like memory) are reflected properly.

So say I have a uid of 5004,

group cgroup_demo_cg {

    net_cls {
        net_cls.classid=0x00105004;
#or should it be the hex equivalent of 5004 ?
        #net_cls.classid=0x0010138c;
    }
}

So either way, the next step should be to add some tc stuff. THe handle is 10 either way so, first create the qdisk:

tc qdisc add dev eth0 root handle 10: htb

then set the class rule:

tc class add dev eth0 parent 10: classid 10:5004 htb rate 4kbit
#or if I had to use the hex value
tc class add dev eth0 parent 10: classid 10:138c htb rate 4kbit

then lastly apply a filter which I think should be the same whether I use the hex value or uid value(5004):

tc filter add dev eth0 parent 10: protocol ip prio 10 handle 1: cgroup

So after I set that up, I expect any network traffic from the user in that cgroup to have its network bandwidth limited by the tc accordingly, however it doesn't appear to be.

If I log in as the user, and set up an ssh session to another one of my machines, and then do a top command(which should send/receive a steady stream of some data), then run the command:

tc -s qdisc ls

I see:

qdisc htb 10: dev eth0 root refcnt 2 r2q 10 default 0 direct_packets_stat 0
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
 backlog 0b 0p requeues 0
qdisc pfifo_fast 0: dev eth1 root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
 Sent 1364212 bytes 6045 pkt (dropped 0, overlimits 0 requeues 0)
 backlog 0b 0p requeues 0

Which shows me that nothing was ever added to my qdisk? :(

Any one have any ideas what I'm doing wrong here?

Cheers!

I'm scripting some ldap automation and have reached a slight hangup. Basically, I want to check if an attribute being added to an entry actually exists within a given objectClass before I try to add it.

So far the best idea I have for this is just running a regex on the schema definition file for the attribute, but that wouldn't account for the schema file being edited after the config is initialized.

A second thought would be to just catch the error thrown if the attribute can't be added, but that seems less efficient since my next step would then be to add the attribute to the schema and rebuild the config.

Seems like there should be a simple ldapsearch command to do this but I can't figure out the syntax.

so far I've tried:

ldapsearch -x -b 'dc=MY_DOMAIN,dc=com' '(objectclass=mySCHEMA)'

but that just lists any ldap entries that have the mySCHEMA objectclass on them.

Thanks for the help, Cheers!

I'm using ldap for remote user authentication and I basically need to either figure out how to:

a. chroot a user on machine b from machine a via nfs,(which doesn't seem possible without mounting more directories than I'm comfortable with)

or -------

b. After adding a user to the ldap db on machine a, force a script to be executed on machine b during the users login that will auto chroot the user before they are allowed to do anything upon their first login.

I'm thinking my second option is probably the best bet, and was thinking along the lines of using pam_exec.so to call the script. However, I have a few concerns about this approach. First, I'm not sure if the script that will be run will have root permissions which it will need to perform the chroot. Second, I'm not sure if pam_exec happens early enough in the login process to be an effective option. Lastly, I need to make sure that the code works in both pam.d/ssh and pam.d/su to consider it a valid solution.

Are my concerns valid or does it seem like this would be a good solution? Or is there a better approach to this problem.

So I'm in the process of setting up CGroups on a few servers, and I'm using the documentation pretty heavily to do this.

I came across this in section 2.8.1 of the Fedora Resource Management Guide (also weirdly in This redhat guide:

The entry now specifies that when the user named maria uses the ftp command, the process is automatically moved to the /usergroup/staff/ftp cgroup in the hierarchy that contains the devices subsystem. Note, however, that the daemon moves the process to the cgroup only after the appropriate condition is fulfilled. Therefore, the ftp process might run for a short time in the wrong group. Furthermore, if the process quickly spawns children while in the wrong group, these children might not be moved.

This is listed as somewhat of a sidenote, but it seems like a pretty major issue that kind of undermines the whole point of cGroups. So before I go any further in setting these up, is there a work around or fix for this? Or am I not approaching this right in my thought process?

Its suggested to use cgexec like this to launch a process in a cgroup:

cgexec -g cpu:group1 lynx http://www.redhat.com

but that seems like it would be kind of hard to implement system wide so that every process was launched like so.

Am I missing something here or is there really no alternative? It also seems like this could be a documentation bug as the fedora guide is using a redhat.com link as the example which makes me think the doc is outdated.

Cheers!

I suck at life and accidentally overwrote my fstab before making a backup by trying to

chmod 777 /etc/fstab

so I could edit and resave it via a text editor.

So my question is, since most of these settings are used at boot to set up various things like swap and such, is there a way to determine what was in my previous fstab as long as I haven't restarted my server?

I've thrown a backup of a default in there, but I need this as apparently there were some customized things in the lost fstab file.

Cheers.

so I have a user running sudo and they are in both wheel and other_group. other_group shouldn't need a password but wheel does. My question is : does wheel requiring a password for sudo negate the fact that other_group doesn't need a password?

heres a snippet from running sudo visudo:

## Allows people in group wheel to run all commands
%wheel  ALL=(ALL)       ALL

## Same thing without a password
# %wheel        ALL=(ALL)       NOPASSWD: ALL

## Allows members of the users group to mount and unmount the
## cdrom as root
# %users  ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom

## Allows members of the users group to shutdown this system
# %users  localhost=/sbin/shutdown -h now

%other_group        ALL=(ALL)       NOPASSWD: ALL

I'm having a little trouble getting the standard mod_rewrite that wordpress generates in my directorys .htaccess file to work correctly. The server I'm using has a virtual host set up on it by default, and I'm a little inexperienced configuring them. Ive reached a point where my head hurts from banging it against the wall so any help is appreciated.

so hypothetically, we can say my domain is:

http://domain.com

and I have my wordpress in

http://domain.com/wordpress

so for my pretty links, the .htaccess file that is in domain.com/wordpress reads:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /wordpress/
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
</IfModule>

and my virtual host config file located at etc/apache2/sites-available/domain.com.conf:

<VirtualHost *:80>
  ServerName app01
  ServerAlias domain.com www.domain.com 
  DocumentRoot /var/www/vhosts/application/

  <Directory /var/www/vhosts/application>
    Options FollowSymLinks
    AllowOverride All
    Order allow,deny
    Allow from all
  </Directory> 

  <Directory />
    Options FollowSymLinks
    AllowOverride All
    Order allow,deny
    Allow from all
  </Directory>

  <Location /server-status>
    SetHandler server-status

    Order Deny,Allow
    Deny from all
    Allow from 127.0.0.1
  </Location>

  LogLevel info
  ErrorLog /var/log/apache2/domain.com-error.log
  CustomLog /var/log/apache2/domain.com-access.log combined

  RewriteEngine On
  RewriteLog /var/log/apache2/domain.com-rewrite.log
  RewriteLogLevel 0
</VirtualHost>

So when this is working,

a page save as testpage would be reachable at :

http://domain.com/wordpress/testpage

Ive been struggling with this for a while so any help is appreciated!

Cheers!

I'm running CVS in a bash shell.

I'm just trying to see which modules are available for checkout.

I've been researching for a while and the only thing I've come up with is:

cvs checkout -c

which executes but shows nothing. Now I know its possible that there may just be no modules to checkout, but thats more of a guess to me at this point, and settling for guesses rarely works out well.

UPDATE:

Im running version 1.11.23

apparently this version doesn't support cvs ls Cheers.

I have a site with a live scoring page that updates via ajax while games are going on. It was working fine when the site was running on http.

We installed an ssl an its either self signed or misconfigured, but now the live scoring page ajax requests are running super slow and freezing users screens.

I actually had to switch my curl requests on my crons to curl -k after the ssl was installed so I'm wondering if the ssl itself could be causing the ajax requests to run sooo slow. I realize https is slower than http but should it really be this noticeable?

I recently installed an ssl cert on my rackspace cloud server. Prior to installing it, my cron jobs were running fine.

When I ssh to my server and do a crontab -l,

I can see the jobs are still there:

*/5 * * * * /usr/bin/curl https://mydomain.com/crons/do_things.php

if I directly visit the file in my broswer it still works.

So I'm wondering if there is anything special I need to set up or change to have my cron job running again?

This has happened from time to time in the past with the emails showing up eventually hours to days later, however I sent some emails last week with a true result to Gmail and they still haven't arrived.

I've checked both the inbox and the spam folder to no avail.

If the php email function is returning true there must be an issue on their server correct?