Nick's questions

This is essentially the same as these questions:

https://stackoverflow.com/questions/8677493/php-fpm-doesnt-write-to-error-log

Nginx not logging PHP errors

BUT the answers there don't seem to be working on Ubuntu 16.04 with PHP 7.

/etc/php/7.0/fpm/pool.d/www.conf:

catch_workers_output = yes
php_flag[display_errors] = on
php_admin_value[error_log] = /var/log/fpm-php.www.log
php_admin_flag[log_errors] = on

/var/log/fpm-php.www.log exists and is owned by www-data.

/etc/php/7.0/fpm/php.ini:

log_errors = On

Nginx Virtual Host's Server block

access_log /var/log/myapp/access.log;
error_log /var/log/myapp/error.log error;

/var/log/myapp/access.log exists and is owned by www-data.

But when an error occurs, I don't get an error in any of the specified log files, and can't find it in any other place either.

I went through all of the suggestions on the other question but didn't find any answer that worked. I'm assuming something has changed since those answer were posted. Any suggestions?

Starting php5-fpm appears to work, but checking the status immediately shows that it is not running:

[root@server ~]# service php5-fpm start
php5-fpm start/running, process 4516

[root@server ~]# service php5-fpm status
php5-fpm stop/waiting

Even though I am able to load PHP pages (meaning that PHP-FPM must be running), the status sometimes reports as stop/waiting.

It appears that there are processes running, but are these only the worker processes?

ps -aux |grep php
www-data  3552  0.0  0.7 338108 14960 ?        S    05:43   0:00 php-fpm: pool www                                                       
www-data  3553  0.0  1.3 338168 27156 ?        S    05:43   0:00 php-fpm: pool www                                                       
www-data  3554  0.0  1.1 337948 23020 ?        S    05:43   0:00 php-fpm: pool www                                                       
www-data  3555  0.0  1.0 334108 20644 ?        S    05:43   0:00 php-fpm: pool www                                                       
www-data  3556  0.0  1.1 337952 23032 ?        S    05:43   0:00 php-fpm: pool www 

I'm concerned that the master process is not working correctly. There is nothing being reported in the PHP-FPM log though.

[root@server ~]# tail /var/log/php5-fpm.log
[03-May-2014 06:19:32] NOTICE: configuration file /etc/php5/fpm/php-fpm.conf test is successful

Is service php-fpm status misreporting? Or is the master process actually stopped?

UPDATE: Rebooting the server causes PHP-FPM to start on boot and show as running, but issuing the reload or restart command causes it to go into the state described above. In it's current condition, I have to reboot the server every time I change php.ini. The server is Ubuntu 14.04

How do I make my rule match an exact value of a cookie? I've tried:

RewriteCond %{HTTP_COOKIE} ^its=me$ [NC]

RewriteCond %{HTTP_COOKIE} its=^me$ [NC]

RewriteCond %{HTTP_COOKIE} its="me" [NC]

RewriteCond %{HTTP_COOKIE} its=me [NC] 

The last almost works, but matches when extra text is at the end of the value, like "me2". The condition should be true only if the its cookie has an exact value of me, with nothing more before or after.

These values should not match:

• you
• me2
• [empty string]
• [cookie is not set at all]

When calling a gmp math function like gmp_mod, I get:

Fatal error: Call to undefined function gmp_mod()

I have installed the php5-gmp package and restarted the web-server, and the function is still undefined. The server is running Ubuntu 10.04 and PHP is running as an Apache module. All software was installed from official packages.

How do I enable the GMP math functions in PHP? I'm looking for a solution that uses official packages, not compiling from source.

I have a server running CentOS 6.2 minimal, but it doesn't appear to have crontab installed by default?

crontab -e
-bash: crontab: command not found

In searching google, I found references to a "vixie-cron" and "anacronda" but no complete answer on what the official/supported way of getting cron to work on CentOS 6 is.

Maybe someone can shed some light on this?

update:

rpm -qf `which crontab`
/usr/bin/which: no crontab in (/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin)
rpm: no arguments given for query

We have a postfix server that requires authentication to SMTP relay through it. We use virtual mailboxes in MySQL database.

A message was relayed through our system, and we need to determine which one of our user accounts was used to send it.

The message headers contains:

Received: from User (c-76-109-241-139.hsd1.fl.comcast.net [xx.109.xxx.139]) 
    by ourserver.com (Postfix) with ESMTPA id 7BA184B4AD4; 
    Tue,  3 Jul 2012 05:42:59 -0400 (EDT)

We don't have a user called "User", and the IP address is not one that we would be sending mail from. I'd like to find out which of our user accounts the sender authenticated as when sending the message.

Is there a way to track this?

How do I make CentOS run SATA drives at 3Gb/s at boot?

Background:

I'm having an issue with a motherboard that claims to support 6Gb/s SATA transfer speeds, but when using 4 drives on it, in a software RAID 10 with heavy disk IO, some of the SATA links start throwing kernel errors, ie. ata1.00: failed command: WRITE FPDMA QUEUED. But it's a different drive each time, not always ata1, and running extended test on each disk individually produces no errors.

When the errors occur, the Kernel/OS (CentOS 6.2) eventually resets the link several times, and when it continues to fail, then it changes the link speed to 3Gb/s. Once that happens, the errors stop for that drive for the remainder of the session.

What I'd like to do is tell the OS to set the SATA links to 3Gb/s to start with on boot, since I don't think the motherboard's SATA bus can handle all 4 drives at 6Gb/s. I couldn't find an option in the Motherboard's BIOS to change the link speed.

Questions:

1. How would I go about doing that? ie. a config file?

2. Can it be done while the system is running with the RAID array assembled and root partition mounted, or do I need to boot from a rescue CD?

3. Will this result in any data loss? I have backups of course, but reinstalling/restoring is several hours of work that I'd like to avoid if possible.

This afternoon, someone at our office decided to pull the plug out of our server because it was storming outside. They didn't shut it down, they just pulled the plug out while it was running.

The server has 4 SATA drives in a software RAID 10 configuration, and LVM running on top of the RAID. The Server is running CentOS 6.2 Minimal and is a virtual machine host using KVM. At the time that it was unplugged, there were many guest machines running on the computer. Each guest has one or more LVM partitions that it uses directly as hard drives. The guest partitions are EXT3, EXT4 and NTFS. The Host OS is on an EXT4 partition.

Later, when the power came back, that person plugged it back in, and it started up. Since they plugged it in without attaching a monitor first, there is no way to see what came up on the screen. I tried attaching a monitor now, but it won't work unless the monitor is connected at boot. I've left it on, exactly as is, until I can get some advice since I don't want to screw anything up (further).

I can get into the host via SSH. I have not rebooted it yet in case there is something in a log somewhere that might be useful.

What I need to do is check all the disks and partitions for data integrity, if that's even possible. I think RAID 10 uses some kind of memory based cache and I'm worried about the drives being inconsistent, or files being corrupt if there were things in the cue to write to the drive that hadn't been written yet.

[root@othello ~]# cat /proc/mdstat
Personalities : [raid10] [raid1] 
md2 : active raid1 sdc1[2] sda1[0] sdd1[3] sdb1[1]
      102388 blocks super 1.0 [4/4] [UUUU]

md0 : active raid10 sda3[0] sdc3[2] sdd3[3] sdb3[1]
      1952289792 blocks super 1.1 512K chunks 2 near-copies [4/4] [UUUU]
      bitmap: 0/15 pages [0KB], 65536KB chunk

md1 : active raid10 sdc2[2] sda2[0] sdd2[3] sdb2[1]
      1022976 blocks super 1.1 512K chunks 2 near-copies [4/4] [UUUU]

unused devices: <none>

It also bothers me that it's calling my arrays, "near-copies". Is that normal?

What kind of disk checks should I run to make sure everything is OK with the drives and data? Are there any other things I should check?

UPDATE

Output of mdadm --detail

[root@othello ~]# mdadm --detail /dev/md0
/dev/md0:
        Version : 1.1
  Creation Time : Sat Feb 25 09:26:20 2012
     Raid Level : raid10
     Array Size : 1952289792 (1861.85 GiB 1999.14 GB)
  Used Dev Size : 976144896 (930.92 GiB 999.57 GB)
   Raid Devices : 4
  Total Devices : 4
    Persistence : Superblock is persistent

  Intent Bitmap : Internal

    Update Time : Sun Mar 11 12:59:30 2012
          State : active 
 Active Devices : 4
Working Devices : 4
 Failed Devices : 0
  Spare Devices : 0

         Layout : near=2
     Chunk Size : 512K

           Name : othello.myserver.com:0  (local to host othello.myserver.com)
           UUID : 58ba40ab:12516733:e3779362:68200fdd
         Events : 2208

    Number   Major   Minor   RaidDevice State
       0       8        3        0      active sync   /dev/sda3
       1       8       19        1      active sync   /dev/sdb3
       2       8       35        2      active sync   /dev/sdc3
       3       8       51        3      active sync   /dev/sdd3

When I send a test message from my mail server to my @bellsouth.net email, The postfix log shows it was sent OK, but the message never arrives in my bellsouth inbox. Shouldn't I get a failure notice or a bounce if At&T is blocking the messages?

I'm trying to troubleshoot why some customers aren't getting emails, but if there's nothing in mail.log to say the message is rejected, how do I know which messages were delivered successfully?

The log shows:

Feb 27 09:02:36 MyHOSTNAME postfix/pickup[26175]: D53A72713E5: uid=0 from=<root>
Feb 27 09:02:36 MyHOSTNAME postfix/cleanup[26487]: D53A72713E5: message-id=<[email protected]>
Feb 27 09:02:36 MyHOSTNAME postfix/qmgr[5595]: D53A72713E5: from=<[email protected]>, size=878, nrcpt=1 (queue active)
Feb 27 09:02:37 MyHOSTNAME postfix/smtp[26490]: D53A72713E5: to=<[email protected]>, relay=gateway-f1.isp.att.net[204.127.217.16]:25, delay=0.57, delays=0.11/0.03/0.23/0.19, dsn=2.0.0, status=sent (250 ok ; id=20120227140036M0700qer4ne)
Feb 27 09:02:37 MyHOSTNAME postfix/qmgr[5595]: D53A72713E5: removed

The AT&T server accepted the message, right?

I happen to have an At&T/Bellsouth email, but I don't have an account with every ISP we send to. I need some way of knowing if a message is getting to its destination or not. Is there any setting in my main.cf file that would affect whether or not we get reject/bounce notices?

I'm trying to install Pipe Viewer on a CentOS 6.2 minimal system.

When I run:

yum install pv

I get:

* base: mirror.thelinuxfix.com
* extras: mirror.atlanticmetro.net
* updates: ftp.usf.edu

No package pv available.
Error: Nothing to do

Do I need to add another repo? If so, which one and how do I add it?

I have a KVM host machine with several VMs on it. Each VM uses a Logical Volume on the host. I need to copy the LVs to another host machine.

Normally, I would use something like:

dd if=/the/logical-volume of=/some/path/machine.dd

To turn the LV into an image file and use SCP to move it. Then use DD to copy the file back to a new LV on the new host.

The problem with this method is you need twice as much disk space as the VM takes on both machines. ie. a 5GB LV uses 5GB of space for the LV and the dd copy also uses an additional 5GB of space for the image. This is fine for small LVs, but what if (as is my case) you have a 500GB LV for a big VM? The new host machine has a 1TB hard drive, so it can't hold a 500GB dd image file and have a 500GB logical volume to copy to and have room for the host OS and room for other smaller guests.

What I would like to do is something like:

dd if=/dev/mygroup-mylv of=192.168.1.103/dev/newvgroup-newlv

In other words, copy the data directly from one logical volume to the other over the network and skip the intermediate image file.

Is this possible?

I'm trying to follow this tutorial to setup a basic LDAD server (OpenLDAP) for cleint authentication, but I am stuck on the step where I add the back-end configuration.

I've created my backend.ldif file as specified, and I'm attempting to add it with:

sudo ldapadd -Y EXTERNAL -H ldapi:/// -f backend.ldif

But I get:

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=module,cn=config"
ldap_add: Other (e.g., implementation specific) error (80)
    additional info: <olcModuleLoad> handler exited with 1

The full LDIF is:

#Load dynamic backend modules
dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModulepath: /usr/lib/ldap
olcModuleload: back_hdb

# Database settings
dn: olcDatabase=hdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: {1}hdb
olcSuffix: dc=mydomain,dc=us
olcDbDirectory: /var/lib/ldap
olcRootDN: cn=admin,dc=mydomain,dc=us
olcRootPW: dmx512
olcDbConfig: set_cachesize 0 2097152 0
olcDbConfig: set_lk_max_objects 1500
olcDbConfig: set_lk_max_locks 1500
olcDbConfig: set_lk_max_lockers 1500
olcDbIndex: objectClass eq
olcLastMod: TRUE
olcDbCheckpoint: 512 30
olcAccess: to attrs=userPassword by dn="cn=admin,dc=mydomain,dc=us" write by anonymous auth by self write by * none
olcAccess: to attrs=shadowLastChange by self write by * read
olcAccess: to dn.base="" by * read
olcAccess: to * by dn="cn=admin,dc=mydomain,dc=us" write by * read

Any suggestions on how to troubleshoot? I know nothing about LDAP servers this is my first.

UPDATE:

I have started over with a brand new install of 11.04 Server.

I have done the following:

hostname ldap.mycompany.com
nano /etc/hosts (set to ldap.mycompany.com)
nano /etc/hostname (set to ldap.mycompany.com)
sudo apt-get install slapd ldap-utils

I try to load the first schema:

sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/cosine.ldif

I get:

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=cosine,cn=schema,cn=config"
ldap_add: Other (e.g., implementation specific) error (80)
    additional info: olcAttributeTypes: Duplicate attributeType: "0.9.2342.19200300.100.1.2"

I tried the command that was suggested below:

root@ldap:~# cat /etc/ldap/slapd.d/cn\=config/cn\=module\{0\}.ldif
dn: cn=module{0}
objectClass: olcModuleList
cn: module{0}
olcModulePath: /usr/lib/ldap
olcModuleLoad: {0}back_hdb
structuralObjectClass: olcModuleList
entryUUID: 3bedbe64-e4b2-1030-832a-17900c7b3644
creatorsName: cn=config
createTimestamp: 20120206020131Z
entryCSN: 20120206020131.785958Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20120206020131Z

But its not complining about a module this time, its complaining about a "Duplicate attributeType".

So I need a command that says "show loaded attribute types" to see if "cosine" is in the list already?

OK, I'm going o assume that:

sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/cosine.ldif
sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/nis.ldif
sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/inetorgperson.ldif

are unnecessary since they all products the same error.

So I moved on to adding ~/backend.ldif. I removed the load modeule lines from the top, since the module seems to be loaded already.

Now when I try to add:

sudo ldapadd -Y EXTERNAL -H ldapi:/// -f backend.ldif

I get:

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "olcDatabase=hdb,cn=config"
ldap_add: Other (e.g., implementation specific) error (80)
    additional info: <olcSuffix> namingContext "dc=mycompany,dc=us" already served by a preceding hdb database

Which makes no sense since this is the only database on the computer, and this is the first entry I'm adding to it.

How do I Increase the log level of Fetchmail?

This seems stupidly easy but I can't find the directive and file I need anywhere on-line.

Apparently, /dev/random is based on hardware interrupts or similar unpredictable aspects of physical hardware. Since virtual machines don't have physical hardware, running cat /dev/random within a virtual machine produces nothing. I'm using Ubuntu Server 11.04 as the host and guest, with libvirt/KVM.

I need to set-up Kerberos inside a VM, but krb5_newrealm just hangs forever "Loading random data", since the system isn't producing any.

Does anyone know how to work around this? Is is possible to pass the host's /dev/random (which is very chatty) into the vm so the vm can use it's random data?

I've read that there are some software alternatives, but they aren't good for cryptology since they aren't random enough.

EDIT: It appears that cat /dev/random on the vm does produce output, just very, very slowly. I got my realm set-up by waiting about two hours while it was "Loading random data". Eventually it got enough to continue. I'm still interested in a way to accelerate this though.

I recently upgraded our server from 8.04 to 10.04, and all the software along with it.

From what I've found online, it seems that the new version of CURL doesn't include a CA bundle, and, as a result, fails to verify that the certificate of the server you're connecting to is signed by a valid authority.

The actual error is:

CURL error: SSL certificate problem, verify that the CA cert is OK.
Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:
certificate verify failed 

Some palces I've found suggest manually specifying a CA file or disabling the check altogether by setting an option when you call CURL, but I'd much rather fix the issue globally, rather than having to modify each application's CURL calls.

Is there a way to fix CURL's CA problem server-wide so that all of the existing application code works as is without needing to be modified?

The documentation claims that I can add aliases in a file (like /etc/postfix/virtusertable) and then use the "virtual_maps" directive to point to it. This does not appear to be working, however.

My mail is bouncing with:

Recipient address rejected: User unknown in local recipient table;

If I mail the user from the server using the mail command, it works.

mail myuser

The message goes through postfix and inserts itself in the Cyrus inbox correctly.

When I use fetchmail to get the user's messages off a pop3 server, postfix fails. The user's email is "[email protected]", but it doesn't seem to be mapping correctly to "myuser", the cyrus mailbox name.

/etc/postfix/main.cf

myhostname = localhost
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = localhost
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
mailbox_transport = lmtp:unix:/var/run/cyrus/socket/lmtp
#lmtp:unix:/var/run/lmtp
virtual_alias_domains = mydomain.com
virtual_maps = hash:/etc/postfix/virtusertable

/etc/fetchmailrc

et syslog;
set daemon 20;

poll "mail.pop3server.com"
with protocol pop3
user "[email protected]" password "12345" is "myuser"
fetchall keep

/etc/postfix/virtusertable

[email protected]     myuser

postconf -n

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
config_directory = /etc/postfix
inet_interfaces = all
mailbox_size_limit = 0
mailbox_transport = lmtp:unix:/var/run/cyrus/socket/lmtp
mydestination = localhost 
myhostname = localhost
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
myorigin = /etc/mailname
readme_directory = no
recipient_delimiter = +
relayhost = 
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
virtual_alias_domains = mydomain.com

Why is it ignoring my alias?

I'm having an intermittent issue where asterisk will play our greeting to the caller, and then drop the call instead of making our phones ring.

I'm unable to reproduce the problem with any phones I have here, and many callers get through just fine. Some callers though, run into the problem, and I can't find any pattern to it.

The bit of information I could find said it was caused by an error in evaluating a dialplan expression. I'm thinking it's this line:

exten => START,n,GotoIf($[${FORCE_CLOSED}=TRUE]?CLOSED,1)

But I'm not sure what's wrong with it.

I see the following error on the console:

[Apr  4 16:29:49] WARNING[27038]: ast_expr2.fl:459 ast_yyerror: ast_yyerror():  syntax error: syntax error, unexpected '=', expecting $end; Input:=TRUE^

Surrounding Console output:

-- Executing [START@AGInbound:1] Answer("IAX2/AtlantaTeliax-10086", "") in new stack
-- Executing [START@AGInbound:2] BackGround("IAX2/AtlantaTeliax-10086", 0000_AG_THANK_YOU_FOR_CALLING_AG") in new stack
--  Playing '0000_AG_THANK_YOU_FOR_CALLING_AG.slin' (language 'en')
[Apr  4 16:29:49] WARNING[27038]: ast_expr2.fl:459 ast_yyerror: ast_yyerror():  syntax error: syntax error, unexpected '=', expecting $end; Input:
=TRUE
^
[Apr  4 16:29:49] WARNING[27038]: ast_expr2.fl:463 ast_yyerror: If you have questions, please refer to doc/tex/channelvariables.tex in the asterisk source.
    -- Executing [START@AGInbound:3] GotoIf("IAX2/AtlantaTeliax-10086", "?CLOSED,1") in new stack
    -- Executing [START@AGInbound:4] GotoIfTime("IAX2/AtlantaTeliax-10086", "9:30-17:0|mon-fri|*|*?OPEN,1") in new stack
    -- Executing [START@AGInbound:5] GotoIfTime("IAX2/AtlantaTeliax-10086", "10:0-18:30|sat|*|*?OPEN,1") in new stack
    -- Executing [START@AGInbound:6] GotoIfTime("IAX2/AtlantaTeliax-10086", "12:0-17:0|sun|*|*?OPEN,1") in new stack

Relevant lines from the dial plan:

exten => START,1,Answer()
exten => START,n,Background(0000_AG_THANK_YOU_FOR_CALLING_AG)

; See if we're open
; Force Closed if no one's going to be answering
exten => START,n,GotoIf($[${FORCE_CLOSED}=TRUE]?CLOSED,1)

exten => START,n,GotoIfTime(${AG_WEEKDAY_OPEN_HOUR}:${AG_WEEKDAY_OPEN_MIN}-${AG$
exten => START,n,GotoIfTime(${AG_SATURDAY_OPEN_HOUR}:${AG_SATURDAY_OPEN_MIN}-${$
exten => START,n,GotoIfTime(${AG_SUNDAY_OPEN_HOUR}:${AG_SUNDAY_OPEN_MIN}-${AG_S$
; ...and we're not. But maybe the time of day has been overridden?
exten => START,n,GotoIf($[${OVERRIDE_TIME_OF_DAY}=TRUE]?OPEN,1)
; No override... We're definatly closed.
exten => START,n,Goto(CLOSED,1)

Any idea what's wrong with the expression? We recently upgraded from 1.4 to 1.6.

I realise this may be a stupid question for some, but it's something I've always wondered about.

Let's say we have two gigabit switches and all of the devices on the network are also gigabit.

If 10 computers connected to switch A need to transfer large amounts of data to a server on Switch B (at the same time), is the maximum transfer speed of each connection limited by the bandwidth of the connection between the two switches?

In other words, would each computer only be able to transfer at a speed of one gigabit divided by the 10 machines trying to use the "bridge" between switches?

If so, are there any workarounds so that every device can use it's maximum speed from point to point?

I've recently been having problems with thrashing as a result of running out of memory. (My VPS has 256M total)

I'm trying to tune MySQL using mysqltuner.pl, and get the following results:

-------- General Statistics --------------------------------------------------
[--] Skipped version check for MySQLTuner script
[OK] Currently running supported MySQL version 5.0.51a-3ubuntu5.4-log
[OK] Operating on 64-bit architecture

-------- Storage Engine Statistics -------------------------------------------
[--] Status: +Archive -BDB -Federated -InnoDB -ISAM -NDBCluster 
[--] Data in MyISAM tables: 114M (Tables: 454)
[!!] Total fragmented tables: 34

-------- Performance Metrics -------------------------------------------------
[--] Up for: 40s (570 q [14.250 qps], 23 conn, TX: 154K, RX: 23K)
[--] Reads / Writes: 100% / 0%
[--] Total buffers: 338.0M global + 2.7M per thread (20 max threads)
[!!] Maximum possible memory usage: 392.9M (153% of installed RAM)
[OK] Slow queries: 0% (5/570)
[OK] Highest usage of available connections: 15% (3/20)
[!!] Key buffer size / total MyISAM indexes: 8.0M/9.4M
[!!] Key buffer hit rate: 57.1% (7 cached / 3 reads)
[OK] Query cache efficiency: 21.9% (7 cached / 32 selects)
[OK] Query cache prunes per day: 0
[OK] Sorts requiring temporary tables: 0% (0 temp sorts / 1 sorts)
[OK] Temporary tables created on disk: 0% (0 on disk / 32 total)
[OK] Thread cache hit rate: 86% (3 created / 23 connections)
[OK] Table cache hit rate: 26% (128 open / 484 opened)
[OK] Open file limit used: 25% (259/1K)
[OK] Table locks acquired immediately: 100% (492 immediate / 492 locks)

-------- Recommendations -----------------------------------------------------
General recommendations:
    Run OPTIMIZE TABLE to defragment tables for better performance
    MySQL started within last 24 hours - recommendations may be inaccurate
    Reduce your overall MySQL memory footprint for system stability
Variables to adjust:
  *** MySQL's maximum memory usage is dangerously high ***
  *** Add RAM before increasing MySQL buffer variables ***
    key_buffer_size (> 9.4M)

But I'm a bit confused on how to get the maximum memory usage down? It seems to be based on key_buffer and max_connections, but there must be something else involved too?

my.cnf:

key_buffer              = 8M
max_allowed_packet      = 12M
thread_stack            = 128K
thread_cache_size       = 8
max_connections         = 20
table_cache             = 128
tmp_table_size          = 256M
max_heap_table_size     = 256M
join_buffer_size        = 256K
query_cache_limit       = 8M
query_cache_size        = 64M

I've been trying to read through MySQL tuning articles, but they seem geared toward people who already know what they're doing! Any help would be appreciated. Thanks!

When you want to have public key based ssh logins for multiple machines, do you use one private key, and put the same public key on all of the machines? Or do you have one private/public key pair for each connection?