We have a super chatty (ajax) html 5 app (gmail-like in its construction, tons of js).
The reading of QUIC sounds interesting. https://en.wikipedia.org/wiki/QUIC
Can IIS (or any .NET hosting engine) support QUIC?
If IIS/Win can't do it, can I do it in an haproxy instance (on CentOS) in front of IIS?
I use Azure blob storage for downloadable files.
It works great, but I am forced to use a commercial tool to upload files.
Below shows how azure cloud explorer chokes, where the commercial azure manager works great. (I wanted to get into the storage account properties to review, but when I start the tool, the whole UI is hung and all I can do is close the app.)
How to get azure cloud explorer working?
From reading the DFS documentation, AD appears required.
This is a problem for us because our servers are either stand alone (not in AD), or part of our hosting service AD, and AD is out of our hands.
The question is: How to do DFS, or something like DFS, when the servers are:
Machines are Win2012-R2 and/or Server 2016
Looking to automagically mirror tlog backups and sql backups across machines, on a close-to-the-minute basis.
(Edited to match the understanding of the answer-writers -- New, fresh, clean question posted here: Active Directory + Google Authenticator - Native support in Windows Server?)
Research Done So Far
There is a technet article on how to use google authenticator with Active Directory Federated Services (AD FS): https://blogs.technet.microsoft.com/cloudpfe/2014/10/26/using-time-based-one-time-passwords-for-multi-factor-authentication-in-ad-fs-3-0/
Oddly, it appears to be a dev project, requiring some code and its own SQL DB.
We are not speaking here of AD FS specifically. We are looking, when you get to it, for 2FA, pref supporting Google Authenticator RFCs, built in to AD.
Using nginx in front of IIS 8.5.
IIS 8.5 has compression configured and working great.
But when we hit it through nginx (config below), gzip is lost (from the perspective of the web browser).
Part 1: Solution attempt #1 was to enable gzip on nginx, which brought back gzip from browser perspective, but now (we fear) has either (a) imposed double-gzip overhead (gzip in iis, unzip on nginx, re-gzip on nginx); or, (b) gzip is now on nginx, which is not ideal (because we have better control on iis, and iis can make better decisions of what is static and what is dynamic, and therefore cache better, etc.). The config for solution #1 can be seen here: nginx: gzip on server is lost during proxy
Addendum 1: Per nginx docs (https://www.nginx.com/resources/admin-guide/compression-and-decompression/): " NGINX ... does not “double compress” responses that are already compressed"
This is good, in that double-zipping will not occur.
Part 2: So what we really want is for the accept-encoding header to pass through, from browser through nginx to iis, let iis do all the zipping, and pass the gzipped responses through nginx without any gzip overhead happening on nginx. Our running config is below.
The question: How do we achieve part 2 in nginx 1.7.9?
Running reverse proxy config, which strips all gzip (e.g. it seems to strip the accept-encoding header):
http {
upstream sandbox_site {
least_conn;
# we pipe to back end on port 80 only, so that nginx handles all ssl
server 192.168.2.16:80 max_fails=1 fail_timeout=60s; # sbox3-site is .2.16
}
server {
# This is sandbox.myapp.com block **************************************
listen 192.168.2.27:80;
server_name sandbox.myapp.com;
location / {
proxy_pass http://sandbox_site;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
server {
# This is SSL version of sandbox.myapp.com block **************************************
listen 192.168.2.27:443 ssl;
server_name sandbox.myapp.com;
ssl_certificate new-sandbox-myapp-com.cer;
ssl_certificate_key new-sandbox-myapp-com.key;
ssl_protocols SSLv3 TLSv1;
ssl_ciphers HIGH:!aNULL:!MD5;
location / {
proxy_pass http://sandbox_site;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
Using nginx as a reverse proxy/load balancer in front of iis/.NET application servers.
Our servers are configured to gzip response payloads. Works fine.
When we stick gzip in front, responses are no longer gzipped.
Question 1: We need to reconfigure gzip in nginx?
Question 2: Is it appropriate to be doing the gzip work twice?
What is the right thing to do here?
(I feel like gzip should happen only at one layer, though there is a benefit of reducing load on the wire, even behind nginx.)
Here is my current config params for gzip (in http section, before first upstream block)
# ****************************** begin gzip section ********************
# Compression
gzip on; # Enable Gzip compressed.
# Enable compression both for HTTP/1.0 and HTTP/1.1.
gzip_http_version 1.1;
# Compression level (1-9).
# 5 is a perfect compromise between size and cpu usage, offering about
# 75% reduction for most ascii files (almost identical to level 9).
gzip_comp_level 5;
# Don't compress anything that's already small and unlikely to shrink much
# if at all (the default is 20 bytes, which is bad as that usually leads to
# larger files after gzipping).
gzip_min_length 1000;
# Compress data even for clients that are connecting to us via proxies,
# identified by the "Via" header (required for CloudFront).
gzip_proxied any;
# Tell proxies to cache both the gzipped and regular version of a resource
# whenever the client's Accept-Encoding capabilities header varies;
# Avoids the issue where a non-gzip capable client (which is extremely rare
# today) would display gibberish if their proxy gave them the gzipped version.
gzip_vary on;
# Compress all output labeled with one of the following MIME-types.
# text/html is always compressed by HttpGzipModule
gzip_types
text/css
text/*
text/javascript
message/*
application/x-javascript
application/json
application/xml
application/atom+xml
application/xaml+xml;
# ****************************** end gzip section ********************
On Win2012-R2
The Web Platform Installer offers an option (that I need...): "Web Deploy 3.6 for Hosting Servers"
I would like to get this into my dsc script, but cannot find the discrete msi(s) on download.microsoft.com or elsewhere on microsoft.com.
How to automate the installation of this puppy?
Looking for the path to package an asp.net app in IIS in a docker container.
The docs/examples we have seen so far show how to package a windows application (and by extension, windows service) in a docker container:
From that, we can see how to package an apache server along with our app in a docker container.
But what we do not see are docs / vision to embed IIS instance (with our app installed in it) in a docker container.
Where to find such docs/examples?
(We have an asp.net app on IIS 8.5 / .NET 4.51)
The articles all discuss staging, packaging and a bunch of infrastructure aspects.
Is it possible to just run the scripts, either locally, or (preferable!) against a remote server?
E.g. infrastructure-free, like I can run ssh commands now?
We do mostly (but not exclusively) win servers.
Preferably, we can start the OS and do little or nothing to it to make it ready to receive commands (we know we may need to create a base image with an agent or ssh server on it).
Need to be able to install mongodb, java based apps, iis config, etc.
Which tool has strongest windows support/community, and (if poss) lightest init footprint?
Operational Answer: Powershell DSC.
This is not the full story (it doesn't do all that chef/puppet/etc do), but it meets a lot of needs, works great, and is out of the box in win 8.1/2012-R2/10. We are very happy with it.
We have a need to deploy a server app that has its own SSL certificate built in. This will get rolled to an unknown number of servers, that will go up and down.
We can generate this certificate using any CA, but in the end, we will just have the 509 certificate pfx file (issued by godaddy or whatever CA). We can have in hand the intermediate certs, but this web server is simple, and only lets us specify the pfx file.
We won't be able to distribute or install intermediate certificates.
The app is a C# app that runs on Win2008 and higher.
What methods are there to solve this?
-- Is there a certificate that is reliable enough for browsers to trust it without intermediate certificates?
-- or ?
We have an application server that sometimes hangs. We suspect it is due to a bad request from a client.
Can nginx log the complete request/response (like fiddler captures) to files, so we can see the requests that were sent before the hang?
(We probably need to avoid pcap and that approach and do it all in nginx)
If nginx is not the right tool for this, what (other than a network analyzer) might be?
The normal solution to this is to tweak the app servers themselves to send their identity back in a custom http header.
We are in a special situation, in that the app server is a hard coded application, and we appear to not be able to get a new build of it with to do this. (On apache or iis it would be easy to solve, we would just add the header to the web server.)
So the question is, does nginx itself have the functionality to add a header to the response that informs the client which server serviced the request?
Note: This is not a normal "browser to web server" situation. This is a custom piece of client code (that we have source to and can modify) hitting a REST API on a monolithic , compiled, server (that we do not have source to and cannot modify). The client needs to know which server it hit, but does NOT need (or want) to go to the same server over and over (e.g. cookies are not the answer.... there are no cookies). The client just needs to be able to see in the response an indication of which server served that request.
Our nginx config is below. We are running the current GA build. We currently run nginx just as a load balancer, and on windows.
upstream appserver {
least_conn;
server 192.168.104.53:1124; // these are the IPs and ports of actual app servers
server 192.168.104.51:1124;
server 192.168.104.59:1124;
}
server {
listen 80; // this is where nginx listens
server_name localhost;
#charset koi8-r;
#access_log logs/host.access.log main;
location / {
proxy_pass http://appserver;
}
We have a Win2003 file server that is the heart of the org. Lots of UNC paths point to it. Drive letter mappings need to stay stable.
How can we abstract the UNC path, in such a way that we can move to a Win2012 server and preserve the UNC paths?
(Ideally, printer UNC references would also be preserved, but we could live with this changing/breaking)
Every doc I can find discusses editing applicationHost.config in notepad to enable this.
The real need:
a) Via appcmd.exe or cmd line tool, enable dynamic compression to be configured in web.config (e.g. to set applicationHost.config -> "httpCompression" -> overrideModeDefault= to "Allow"
b) If 'a' cannot be done, then how, via appcmd.exe or cmd line tool, to enable site wide gzip dynamic content compression for mime type application/x-javascript
I just spent half an hour exploring appcmd.exe, and searching the net, and have seen no examples of using appcmd.exe to flip the overrideModeDefault values
The 1950 exists in Gen 1, Gen 2 and Gen 3 variants. This is important because the Gen 2 and 3 variants can take 64GB RAM while Gen 1 only 32 GB.
I have looked high and low, and cannot find out how to tell one gen from another, except that for Gen 3, the "original configuration" page on the Dell site is supposed to indicate that it is Gen 3.
I have a pair of these, from Nov 2006. They do not show up as Gen 3 in any way I can tell.
There are 8 RAM slots... so either they take max 4GB modules or 8GB modules. There is no way to tell, that I know of, since the Gen1 and 2 systems look and smell the same.
How do I tell if they are Gen 1 or 2?
OK, this has to be msec, but in some docs it is sometimes mentioned as seconds.
Thoughts?
(UOM is units of measure, e.g. "seconds" or "milliseconds" or whatever)
Where is a useful reference for the sdset command?
I can read and read, and I have yet to find a straightforward list of steps to say:
Service: App
User: Joe
Grant Joe start/stop/restart to App
(Why can't it be that easy? )
Note: Getting sdset wrong can cause a service to disappear from Service Manager, and only be visible to root/system (invisible to administrators!). Getting this right is important.
At the moment, I have task that is configured to run as user "automatictask"
But the task will not run, "unable to start" is shown.
When I add this user to the Administrators group, then the task runs fine.
But in real life.... I want this user to be SUPER restricted.... ONLY able to run this task, no login rights, no file system rights other than to the one batch file....
I have searched high and low for a document that says "here is the most stripped down, basic user that can run a task" ....
There seems to be no such document!
Suggestions?
Thanks!
Possible Duplicate:
Alternatives to Splunk?
This has been discussed, but it has been several months, so it may be time to revisit it:
Earlier discussion RE Splunk alternatives
For the record, Splunk rocks. But the pricing is simply beyond what we can consider (When I spoke with Splunk today, the cost for a system to index 5gb/day of data is over $30,000.)
That is more than we spend on SQL Server (by a large multiple), more than we spend on a rack of servers (by a multiple), etc. etc.
The splunk sales team is correct (that for $30K we get more value and functionality than if we spend the same building our own system), but it doesn't matter. The splunk cost is simply too high (by a multiple).
Soooooo, we are looking around!
Is anyone out there building a splunk like system?
Our basic need:
We currently need to index 3-5gb/day, but need to be able to scale to 10gb/day or more. We do not need a lot of history (30 days is fine).
We use Windows 2008 and 2003 servers.
Thanks for your thoughts!
UPDATE: We spent two weeks researching commercial and open source options. Our conclusion: Write our own (we are a software company... we know how to write things). We built a great system built on mongodb and .NET that gives us the functions we needed from MongoDB in about one engineering week. We have now completed our implementation. We use two Mongodb servers (master and slave), and are able to log and index any amount of log data (5gb/day, 15gb/day, etc), limited only by disk space.
UPDATE TO THE UPDATE (December, 2012): We continue to use our mongodb solution, and it works great! If we were building it today, we would strongly consider building it on top of elasticsearch.
OBSERVATIONS: This space needs a solid solution that is $1000-3000 flat rate. The licensing models used by the commercial firms are based on a "milk the data center ops guys" models. That is their right (of course!), but it leaves a HUGE space open for someone to come in underneath them. My guess is that in another year or two there will be a good open source solution that will be really usable.
Thank you all for your input (even if it was self promotion).