Frederik's questions

I am having a funny issue with my vCenter..

When I try to deploy a new Windows Server 2012R2 from my template VM it almost always fails with this error:

Cannot migrate <vm> from <host the template is on> to <a host in standby mode??> and resource pool Resources in <datacenter>: The operation is not allowed in the current state of the host.

As you can see from the error above, vCenter tries to create the new VM on a server that is in standby mode.

Is this a bug in vSphere or a configuration error on my part?

vSphere HA, DRS and Power Management is enabled on the cluster

I am working on making our puppet infrastructure more dynamic where I can add any number of nodes and these will automatically be applied in another nodes configuration.

An example: I have X number of hosts running a Java application, which are defined by our javaapp module with the following define in it (simplified):

define javaapp::site (
  $site_name,
  $site_port ) {
  # Doing some stuff regarding deployment, service management etc here
}

These are defined in the site.pp file like this:

javaapp::site { 'app01':
  play_site_name    => 'app01',
  play_site_port    => 9100,
}

We have a nginx reverse proxy in front of these application servers where I need to forward requests to a range of servers. Currently my nginx template looks like this:

upstream app-hosts {
  server <%= @host_app_01 %>:9100;
  server <%= @host_app_02 %>:9100;
}

Where @host_app_01 and @host_app_02 have been defined globally in the site.pp file

What I would like to do is to collect an array of the nodes with a specific javaapp site name and use it in the nginx template. Something like this pseudo-code:

upstream app-hosts {
  <% @host_app.each do |host| %>
    server <%= @host.ip %>:<%= @host.appPort %>;
  <% end %>
}

I have read a little about exported resources, but I can't figure out whether it is the right thing for this situation?

Is it even possible to do with puppet?

We are running puppet version 3.7.5.

I want to add a file with puppet that should only exist while puppet runs.

The file should be there to prevent apt from starting any services (which fails) during my puppet run.

This is the class I have so far that doesn't work since there is a duplicate declaration of the same file:

# Opensips package install
class opensips::package {
  case $::osfamily {
    'Debian' : {
      file { 'opensips-enable-apt-policy':
        ensure  => 'present',
        path    => '/usr/sbin/policy-rc.d',
        mode    => '0755',
        content => "#!/bin/sh
echo \"All runlevel operations denied by puppet module ${module_name}\" >&2
exit 101
",
      } ->
      package { $opensips::opensips_debs: ensure => $opensips::package_ensure, } ->
      file { 'opensips-disable-apt-policy':
        ensure => 'absent',
        path   => '/usr/sbin/policy-rc.d',
      }

    }
    default  : {
      fail("Unsupported OS: ${::osfamily}")
    }
  }
}

This should give an idea of the desired end-state, but to sum it up:

• Create the file /usr/sbin/policy-rc.d with the content above
• Run the package install
• Remove the file

How would I do this the best/easiest way?

The agent is Debian Jessie and runs puppet version 3.8.1

I have tried to put the alias metaparameter on the file declaration success.

We are having some problems with printers automatically being added on a 2012R2 RDS host, and suspect the following dialog (where we pressed Yes) to be the issue..

How can this setting be reverted?

It is a virtual server in a domain network (and is joined to the domain)

One of our many 2008R2 servers constantly loses connection to the domain, meaning that users cannot login to shares etc on the server, and it basically becomes useless.

The event sometimes generated by the server when this happens is 3210 with the error code 0xC0000022.

This does however not always happen.

Running NETDOM RESETPWD /Server:AD01 /UserD:domainadmin /PasswordD:domainadminpassword makes it work again until it dies again. Sometimes minutes after, sometimes days after.

We have also tried the usual unjoin/rejoin domain on the server, without success.

This is happening 4-6 times a day at the moment, so it is quite a big issue.

The only services run by the server are file sharing and printing services.

Basically, I want to have this URL:

http://domain.tld/auth.php?state=somestate&token=somelongtoken

rewritten/redirected into this:

http://domain.tld/auth/validate/somestate/somelongtoken

I have been looking over the net for quite some time now, but I cannot figure out how to do this thing..

Also - would a redirect or a rewrite be the best here?

I am not going to use the URL for anything other than validating a user from a API, so it is just redirecting the user after visiting that page.

I want to deploy an installation of VMware VSA in my network, and for that I got 2xquad nics in each server (2x Dell PE 1950)

Everything seems fine so far, but then the installer complains about some NFS address conflicts, which I don't get, since it is a completely closed network.

A quick sketch of the network:

So, as you can see, I connect the servers VSA network directly between them.

But is this actually supported, or do I have to use a switch and a routable IP?

My vCenter server is connected via a Site-To-Site VPN on a different subnet.

ESXi servers are in the 192.168.99.X/24 subnet, and the vCenter server is in a 10.100.100.X/24 subnet.

I am configuring VSA for 192.168.253.X/24 as frontend network, and 192.168.254.X/24 as backend network.

I am configuring the portgroups myself, since the installer complains it is not a greenfield install.

VSA install configuration:
VSA Management Network Settings:
VSA Cluster IP Address: 192.168.253.10
VSA Cluster Service IP Address: 192.168.253.20

Subnet Mask:    255.255.255.0
Gateway:    192.168.99.1

Host Network Settings:   192.168.99.236
Management IP Address:  192.168.253.210
Datastore IP Address:   192.168.253.220
vSphere Feature IP Address: 192.168.253.254
Subnet Mask:    255.255.255.0
Gateway:    192.168.99.1
Back-end IP Address:    192.168.254.2
Back-end Subnet Mask:   255.255.255.0

Host Network Settings:   192.168.99.235
Management IP Address:  192.168.253.110
Datastore IP Address:   192.168.253.120
vSphere Feature IP Address: 192.168.253.253
Subnet Mask:    255.255.255.0
Gateway:    192.168.99.1
Back-end IP Address:    192.168.254.1
Back-end Subnet Mask:   255.255.255.0

VLAN ID Settings:
Management VLAN ID: 1381
Datastore VLAN ID:  1381
vSphere Feature VLAN ID:    1381
Back-end VLAN ID:   1382

Disk Formatting Option:
Format disks immediately

Storage Capacity Selection:
911.72 GB

Here is the warning I get upon starting the install:

This is the error I get when I try to begin the actual install:

This is the overview of the vswitch config:

This is the config of the frontend network on one of the servers. The rest is configured similary, where the active adapters for the frontend is configured as standby for vmotion and vice versa.

I have a Dell Poweredge 1950 3'rd generation server that hangs on boot.

More specifically, it hangs on this image:

The server has worked fine until recently.

The status display reports no errors at all.

Is this possibly a faulty DRAC?

As you can see, the DRAC itself is working fine, as I can both do a remote console of the server, and power control it.

Sometimes, when I press ie. F2 for setup, it moves on a little bit, and adds the line: Remote Access Controller detected but then just hangs there.

The server is out of support from Dell 2 years ago, so not much help to get there I think.

I have some serious problems with my newly setup network with a Layer 2 VPN tunnel.

I draw a little diagram to show the simple version of the setup:

The green lines are through the VPN, the blue are not.

Each gateway has a bridge interface, which bridges the VPN interface to a local interface.

Running TCPdump on that interface shows a lot of traffic, and I can see the pings on either side of the tunnel.

However, something seems wrong with ARP table, as it either won't get filled up, and the hosts dont get any ARP replies.

So.. There are loads of arp who-has packets on the bridge interfaces, but no arp reply from those hosts.

However, running TCPdump on a host shows that it does actually reply to those ARP packets. These just never reaches the bridge interface.

I am seriously running out of ideas here..

I am running Sophos UTM on both gateways, and that software is built on SuSE linux.

Update:

I played around with ARPing to debug a bit more, and when ARPing'ing SITE2 Gateway from a host at the SITE1 side of the network, I get one unicast response - but normal pings still fails. When ARPing'ing from a host at SITE1 to a host at SITE2, i get no replies at all. I can however see the who-has packets: 12:05:47.910181 arp who-has 10.127.0.14 (Broadcast) tell 10.127.0.11 - but no replies at all.
The reply packet is however being sent from the server, so that is not the problem.

This is driving me crazy..

I got this old boy of a switch, which has been set up with some vlans.

Everything works great when using tagged VLAN id's, and when using VLAN1 (default).

However, I cannot set the PVID of a port to a specific VLAN (10), and then use that VLAN untagged.

It works perfectly if I plug in my laptop with a VLAN tag set on the NIC. However, I can't do this on my windows server.

Any clues?

I want to make a backup script, that makes a .tar.gz of a folder I define, say fx /root/tekkit/world

This .tar.gz file should then be uploaded to a FTP server, named by the time it was uploaded, for example: 07-10-2012-13-00.tar.gz

How should such backup script be written?

I already figured out the .tar.gz part - just need the naming and the uploading to FTP.

I know that FTP is not the most secure way to do it, but as it is non-sensitive data, and FTP is the only option I have, it will do.

Edit:

I ended up with this script:

#!/bin/bash

# have some path predefined for backup unless one is provided as first argument
BACKUP_DIR="/root/tekkit/world/"
TMP_DIR="/tmp/tekkitbackup/"
FINISH_DIR="/tmp/tekkitfinished/"
# construct name for our archive
TIME=$(date +%d-%m-%Y-%H-%M)

if [ $1 ]; then
    BACKUP_DIR="$1"
fi

echo "Backing up dir ... $BACKUP_DIR"
mkdir $TMP_DIR
cp -R $BACKUP_DIR $TMP_DIR
cd $FINISH_DIR
tar czvfp tekkit-$TIME.tar.gz -C $TMP_DIR .

# create upload script for lftp
cat <<EOF> lftp.upload.script
open server
user user password
lcd $FINISH_DIR
mput tekkit-$TIME.tar.gz
exit
EOF

# start backup using lftp and script we created; if all went well print simple message and clean up 
lftp -f lftp.upload.script && ( echo Upload successfull ; rm lftp.upload.script )

I am having issues with my phpmyadmin on my nginx install.

When I enter <ServerIP>/phpmyadmin and logs in, I get redirected to <ServerIP>/index.php?<tokenstuff> instead of <ServerIP>/phpmyadmin/index.php?<tokenstuff>

Nginx config file:

user  nginx;
worker_processes  5;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  2;

    #gzip  on;

    include /etc/nginx/conf.d/*.conf;
}

Default.conf:

server {
    listen       80;
    server_name  _;

    #charset koi8-r;
    #access_log  /var/log/nginx/log/host.access.log  main;

    location / {
        root   /usr/share/nginx/html;
        index  index.php index.html index.htm;
    }

    #error_page  404              /404.html;

    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }

    # proxy the PHP scripts to Apache listening on 127.0.0.1:80
    #
    #location ~ \.php$ {
    #    proxy_pass   http://127.0.0.1;
    #}

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    location ~ \.php$ {
        root           /usr/share/nginx/html;
        try_files $uri =404;
        fastcgi_pass   unix:/tmp/php5-fpm.sock;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        include        fastcgi_params;
    }
    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    location ~ /\.ht {
        deny  all;
    }
    location /phpmyadmin {
    root /usr/share/;
    index index.php index.html index.htm;
    location ~ ^/phpmyadmin/(.+\.php)$ {
        try_files $uri =404;
        root /usr/share/;
        fastcgi_pass unix:/tmp/php5-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $request_filename;
        include fastcgi_params;
        fastcgi_param PATH_INFO $fastcgi_script_name;
    }

    location ~* ^/phpmyadmin/(.+\.(jpg|jpeg|gif|css|png|js|ico|html|xml|txt))$ {
        root /usr/share/;
    }
}
}

(Any general tips on tidying op those config files are accepted too)

I am having a problem with my nginx server.

I am fairly new to nginx, so the config files aren't my strongest (yet)

I have this default.conf in /etc/nginx/conf.d/:

server {
    listen       80;
    server_name  _;
    #charset koi8-r;
    #access_log  logs/host.access.log  main;
    location / {
        root   /usr/share/nginx/html;
        index  index.php index.html index.htm;
    }
    error_page  404              /404.html;
    location = /404.html {
        root   /usr/share/nginx/html;
    }
    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }
    # proxy the PHP scripts to Apache listening on 127.0.0.1:80
    #
    #location ~ \.php$ {
    #    proxy_pass   http://127.0.0.1;
    #}
    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    location ~ \.php$ {
        root           /usr/share/nginx/html;
        try_files $uri =404;
        fastcgi_pass   unix:/tmp/php5-fpm.sock;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        include        fastcgi_params;
    }
    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    location ~ /\.ht {
        deny  all;
    }
    location /phpMyAdmin {
    root /usr/share;
    index index.html index.htm index.php;
    }
    location ~ \.php$ {
        root        /usr/share;
        try_files $uri =404;
        fastcgi_pass unix:/tmp/php5-fpm.sock;
        fastcgi_index       index.php;
        fastcgi_param       SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include     fastcgi_params;
    }
}

but when I access <ServerIP>/phpMyAdmin it just gives me a 404.

Log files are like this:

2012/09/18 19:12:53 [error] 3184#0: *1 open() "/usr/share/phpMyAdmin/nginx-logo.png" failed (2: No such file or directory), client: 1.2.3.4, server: _, request: "GET /phpMyAdmin/nginx-logo.png HTTP/1.1", host: "4.3.2.1", referrer: "http://4.3.2.1/phpMyAdmin/index.php"

What do I do wrong?

I administrate an Exchange server for a customer, and now the (transaction?) logs are taking up massive amounts of space.

Are they safe to delete?

The logs are taking ~70GB of space, while the database itself is only ~8GB.

I got a server with 2 NIC's.

One is the external interface, that has a public IP.

When only that interface is up, I can ping it fine from our internal network.

When I enable the second interface with the internal IP address on, I cannot ping the external IP anymore from the internal network. I can however ping it from a server on another internet connection.

I have been dealing with this for quite some time, and I really cant figure out why it won't work..

I have rebooted the server numerous times, without effect.

Interface configurations are as follows:

ifcfg-eth0 (External)

DEVICE="eth0"
BOOTPROTO="static"
HWADDR="00:24:81:82:D2:26"
NM_CONTROLLED="yes"
ONBOOT="yes"
TYPE="Ethernet"
UUID="d8c860fb-eab3-410c-a137-b100fa77ca51"
NETMASK="255.255.255.240"
IPADDR="7x.6x.1xx.1xx"

ifcfg-eth2 (Internal)

DEVICE="eth2"
BOOTPROTO="static"
HWADDR="00:23:7D:9C:CA:A7"
NM_CONTROLLED="yes"
ONBOOT="yes"
TYPE="Ethernet"
UUID="d544ec14-80fa-4765-bec4-e616b0b86bb8"
NETMASK="255.255.255.0"
IPADDR="192.168.11.15"

/etc/sysconfig/network

NETWORKING=yes
HOSTNAME=HOSTNAME
GATEWAY=7x.6x.1xx.1xx

Routing table

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
7x.6x.1xx.1xx   *               255.255.255.240 U     0      0        0 eth0
192.168.11.0    *               255.255.255.0   U     0      0        0 eth2
link-local      *               255.255.0.0     U     1002   0        0 eth0
link-local      *               255.255.0.0     U     1004   0        0 eth2
default         ip07x06x1xx1xx. 0.0.0.0         UG    0      0        0 eth0

I am pinging from a computer in the 192.168.11.0 network. There is a hardware firewall between them, but the logs show nothing of interest.

They are connected to the same switch on the 192.168.11.0 network.

I have a problem with my newly setup Exchange environment for our hosted customers.

First off, when configuring the outlook client, it gives a certificate warning although the certificate has been bought and setup.

I am using a setup like this:
autodiscover.CUSTOMERDOMAIN.TLD CNAME autodiscover.exchange.COMPANYDOMAIN.TLD
(Companydomain is our company that hosts the exchange servers, customerdomain being the customers domain)

Shouldn't that work? I know that Microsoft does something like that for Office365, but I really don't think they buy a certificate for every customer..

So I guess some redirection should be setup somehow - any guidance?

Next thing: When we accept that error, and move on to actually starting Outlook, it states that the certificate is not valid for the RPC proxy server exchange.COMPANYDOMAIN.TLD - this domain is not right, as that domain is not included in the certificate. I would instead like this domain to be mail.exchange.COMPANYDOMAIN.TLD

I tried to run this script setting both internal and external URL's to be the same, with no luck.

Any guidance on this one?

I am running Exchange 2010 SP2, with CAS, HT and MBX split up on 3 different servers.

Update: I have now fixed the issue with the RPC proxy server.

The commands used was: To see what it is currently set to:

get-outlookanywhere |fl externalhostname

To set it to something else:

set-outlookanywhere -identity "exchcas01\rpc (Default Web Site)" -externalhostname "NEWHOSTNAME"

However, I am still having issues with the first problem.

Update 2:

I have gotten further with the first problem. I have setup a small nginx server, that basically only redirects all requests sent to the server to https://autodiscover.exchange.COMPANYDOMAIN.TLD/Autodiscover/autodiscover.xml and this works.. Not so well.. as Outlook tries to create a unsecure connection. How can I redirect from the requested URL, to the SSL URL, without Outlook making a mess?

Some background: We are about to move a customer's server to our facilities, but as that server is a DC, I see some issues with that.

The two sites will be connected with a VPN tunnel. The server will get an IP in the 10.0.0.0/30 (or something similar) subnet, while the clients are in a 192.168.100.X/24 subnet (will be changed from 192.168.1.X/24)

Anything I should think about? Is this some huge operation to do, or is it quite simple?

I think, that as long as the DC remains the primary DNS for the clients, it doesn't really matter what IP it got?

We are about to setup a new and more powerful vCenter server for our VMware environment.

It is going to run vCenter 5.0 along with a couple of other things.

However, I want to make the migration as smooth as possible - and how do I do that with our current vCenter?

Should I set it up so they work together in some way, and then just remove the old one?

Any ideas? What is best practice?

I am having trouble with the management agents on my ESXi hosts, as they keep crashing/not responding..

I am suspecting my iSCSI storage, as it works a bit like the wind is blowing - and we have more or less migrated away from it.

So I am looking for a way to disable Software iSCSI from the CLI (I have SSH access to the hosts) to see if that helps.

I get this error when restarting the services:
Not all VMFS volumes were updated; the error encountered was 'Timeout'.
The VMs are still running, so the VMFS volumes it's talking about is the iSCSI ones - which are not in use right now.

I have a setup with two ESXi5 servers.

We are(were) running with a ISCSi box to server disk for the VM's - however we are in the progress of migrating away from it, because the storage os disk is bad.

Now, one of the ESXi hosts has been running for ~20hrs, and it seems like the management services just crashed on that host..

The vms are still running - so it's not really serious. However, I want to fix it.

Should I be worried? Will the VM's keep running?

The hosts does respond on pings.

I am running a vcenter to administrate the hosts.

Thanks in advance.

UPDATE:

I have now managed to get the services running:

~ # /etc/init.d/vpxa status
vpxa is running
~ # /etc/init.d/hostd status
hostd is running.

But the server is still not responding on either VMware vSphere Client nor the webinterface.

I can however use paping on both port 80 and 443 to the server, which works brilliant.

I would like some help to move on in this case.