vobelic's questions

I'm trying to setup rsyslog to use the template RSYSLOG_TraditionalFileFormat as the default action template, but for some specific messages i need to use another template. In both cases i need dynaFile.

I'm trying to achieve that with:

#$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$template dynatemplate, "/var/log/%HOSTNAME%/%PROGRAMNAME%.log"
$template dynatemplate2, "/var/log/%HOSTNAME%/%hostname%_%fromhost-ip%_%syslogtag%.log"

:msg, contains, "sometext" ?dynatemplate2;RSYSLOG_SyslogProtocol23Format
& ~

*.* ?dynatemplate

Would the above be considered the correct way?

Also since I'm using rsyslog 8.24 how could it be done using the expression syntax?

Is it possible to block AAAA answers being sent back to clients from a local dns server, but only for certain forward dns domains? I know I can do the filtering based on ipv6 subnet (working sample below), but i would like to filter out based on domain.

I.e. google services (1e100.net domain) are much faster over ipv4 transport, yet i'd still like to have ipv6 for everything else.

;this RPZ entry successfully blocks AAAA answers that match 2001:db8:aa::/48
48.zz.aa.db8.2001.rpz-ip       IN      CNAME   .

My local DNS server in question is running bind 9.9.5

I have an AD domain with two domain controllers and integrated DNS. Since we're moving to Infoblox as the master DNS, the idea is to migrate the existing zone to the Infoblox and make it possible for the controllers to perform dynamic DNS updates for the AD zone. What is the best course of action to do it safely?

I'm having issues with a fresh SLES12 install and swap not mounting. It's a DL360 G6 server with P410 and 2x 146GB drives in RAID1. The single /dev/sda has MBR with sda1 for swap and sda2 for ext4 root partition.

systemd 210-95.1

Basically i'm not getting swap mounted on startup and only a manual swapon helps.

# journalctl
systemd[1]: Dependency failed for /dev/disk/by-uuid/307a84ab-a6cc-40f0-a84e-559aa99f364d.
systemd[1]: Job dev-disk-by\x2duuid-307a84ab\x2da6cc\x2d40f0\x2da84e\x2d559aa99f364d.device/start timed out.
systemd[1]: Timed out waiting for device dev-disk-by\x2duuid-307a84ab\x2da6cc\x2d40f0\x2da84e\x2d559aa99f364d.device.
# systemctl restart dev-disk-by\\x2duuid-307a84ab\\x2da6cc\\x2d40f0\\x2da84e\\x2d559aa99f364d.swap
A dependency job for dev-disk-by\x2duuid-307a84ab\x2da6cc\x2d40f0\x2da84e\x2d559aa99f364d.swap failed. See 'journalctl -xn' for details.


# cat /etc/fstab
UUID=7b830caa-bca2-4617-b8cd-3145726c288a                       /                    ext4       acl,user_xattr        1 1
#/dev/sda1 swap                 swap       defaults              0 0
UUID=307a84ab-a6cc-40f0-a84e-559aa99f364d                      swap                 swap       defaults              0 0

I know there were issues with swap not working in systemd when GPT is used, but i'm clueless here...

I have HP 11842 racks (H6J69A) for networking equipment.

Does anyone use those in their datacenters? Some advice for cable management inside the rack would be highly useful. Photos from existing installations welcome!

Currently I'm investigating what are the best practices for cable management. The idea is to mount networking equipment with ports to the front of the rack and to use patch panels with the same orientation in order to keep the airflow front-to-back. My concern is that there's no vertical cable management on the front side of the rack. At least i don't see HP offering a kit beside D-rings.

Also, if the ports are located on the front, is there a need to move the vertical bars to the back from their standard/delivery position in order to accomodate the cables?

I'm trying to setup proxypass to map http://status.site.com/cacti to http://othersite.com:8080/cacti, but without mapping the whole /.

Here the conf:

<VirtualHost *:80>
    ServerName status.site.com
   ProxyRequests Off                                                                                                 


    ProxyPass             /cacti/       http://othersite.com:8080/cacti/                                            
    ProxyPassReverse      /cacti/       http://othersite.com:8080/cacti/                                            
    ProxyPreserveHost On                                                                        

</VirtualHost>

Now this works for the most part except for http://status.site.com/cacti/graph_view.php The tree like menu on the left hand side gets broken, the whole menu is expanded and there's no collapse/expand possibility. Also the menuitems are unclickable (yet correct links are shown when hovered over with the pointer).

With ProxyPass / http://othersite.com:8080/ this doesn't happen and everything works. How are those two approaches handled differently? I've tried various combinations with ProxyHTMLURLMap but no success.

I'm trialling SLES 12 w/ HAE to run a Fileserver cluster consisting of two nodes. Idea was to use SCSI persistant reservation as a fencing method using the fence_scsi script from stonith fence agents. Two nodes (a, b) are connected via FC to the same LUN which is then exported via NFS from the active node only.

The issue is with fence_scsi as crm fails/complains that nodename/key isn't supplied.

    primitive storage-fence stonith:fence_scsi \
            params action=off devices="/dev/mapper/mpath_test"  \
            op monitor interval=60s timeout=0s

I end up with:

storage-fence_start_0 on fs009a 'unknown error' (1): call=18, status=Error, last-rc-change='Wed Jun 17 00:51:40 2015', queued=0ms, exec=1093ms
storage-fence_start_0 on fs009b 'unknown error' (1): call=18, status=Error, last-rc-change='Wed Jun 17 00:56:42 2015', queued=0ms, exec=1101ms

and

    2015-06-17T01:34:29.156751+02:00 fs009a stonithd[25547]:  warning: log_operation: storage-fence:25670 [ ERROR:root:Failed: nodename or key is required ]
    2015-06-17T01:34:29.156988+02:00 fs009a stonithd[25547]:  warning: log_operation: storage-fence:25670 [  ]
    2015-06-17T01:34:29.157234+02:00 fs009a stonithd[25547]:  warning: log_operation: storage-fence:25670 [ ERROR:root:Please use '-h' for usage ]
    2015-06-17T01:34:29.157460+02:00 fs009a stonithd[25547]:  warning: log_operation: storage-fence:25670 [  ]

Now If nodename is supplied then it doesn't complain. But then I don't understand the fencing configuration. Should I setup two stonith:fence_scsi resources each "stickied" to each of the two nodes?

This is an example from RHEL that takes care of the whole thing, no additional constraints (and it works!)

   pcs stonith create my-scsi-shooter fence_scsi devices=/dev/sda meta provides=unfencing

Reference from RHEL documentation

Note that SLES12 still uses crm while RHEL uses pcs. Also in SLES the meta attribute provides doesn't exist. Is there a way to translate the RHEL pcs command to SLES?

Here the complete config:

# crm configure show
node 739719956: fs009a \
        attributes maintenance=off standby=off
node 739719957: fs009b \
        attributes maintenance=off standby=off
primitive clusterIP IPaddr2 \
        params ip=172.23.59.22 cidr_netmask=25 \
        op monitor interval=10s timeout=20s \
        op stop interval=0s timeout=20s \
        op start interval=0 timeout=20s
primitive fs_storage_test Filesystem \
        params device="/dev/mapper/mpath_test_part1" directory="/TEST" fstype=ext4 \
        op monitor timeout=40 interval=20 \
        op start timeout=60 interval=0 \
        op stop timeout=60 interval=0 \
        meta target-role=Started
primitive nfs-server systemd:nfsserver \
        op monitor interval=60 timeout=15 \
        op start interval=0 timeout=15 \
        op stop interval=0 timeout=15
primitive storage-fence stonith:fence_scsi \
        params action=off devices="/dev/mapper/mpath_test" verbose=false \
        op monitor interval=60s timeout=0s \
        meta target-role=Started
group nas-service clusterIP fs_storage_test nfs-server \
        meta target-role=Started
location constraint-location-a nas-service 100: fs009a
property cib-bootstrap-options: \
        dc-version=1.1.12-ad083a8 \
        cluster-infrastructure=corosync \
        cluster-name=fs009 \
        stonith-enabled=true \
        no-quorum-policy=stop \
        last-lrm-refresh=1434493344
rsc_defaults rsc-options: \
        resource-stickiness=100

corosync.conf http://pastebin.com/M5sr7htC

corosync 2.3.3

pacemaker 1.1.12

This question is in a direct relation to this one: ssh fails to execute remote command when run from cron bash script - works from CLI

I'm not able to comment on the accepted answer as I don't have enough rep so please bear with me.

I'm running a script on a linux PC machine and the host i'm trying to get the output from is a router with its OS so it's nothing I can influence in terms of configuring the console. Basically executing this under cron: OUT=$(ssh -tt -vv [email protected] "remote command") gets me an empty variable.

debug1: Sending command: remote command
debug2: channel 0: request exec confirm 1
debug2: callback done
debug2: channel 0: open confirm rwindow 2621440 rmax 262144
debug2: channel 0: read<=0 rfd 4 len 0
debug2: channel 0: read failed

If I'm executing this outside cron, i.e. in the CLI i'm getting output as expected. As you can see the -tt option to force pseudo-tty allocation doesn't help.

Any solutions for this to help cron overcome the buggy remote console?

I have a working setup with apache 2.2 server acting as a remote proxy.

I'm using proxytunnel with two chained proxies: proxytunnel -q -X -p localproxy:8080 -r remoteproxy:443 -d destination:22 I had to apply a patch for SSL to work though: https://issues.apache.org/bugzilla/show_bug.cgi?id=29744

I'm now trying to do the same using the apache 2.4 server (SSL issue is resolved in 2.4 apparently). The connection establishes immediately but after cca 20 seconds apache (remoteproxy) resets the connection to the local proxy, thus killing my SSH session. Keepalives didn't help.

I tried raising the log level LogLevel debug in the general apache config, but i'm not seeing any useful info. Is there a way to debug the mod_proxy itself in a more detailed manner?

I'm experiencing an issue while trying to pass double tagged through a vSwitch.

A physical interface on the VMWare host machine is receiving double tagged traffic - the outer tag differentiates multiple switches (mirroring remote tag) and the inner tags are from the switches' own internal traffic. The internal traffic can be both tagged and untagged depending if the mirrored port was an access port or a trunk.

A vSwitch is configured with multiple networks (each for a different outer tag from a different switch) and a guest machine should see only (single) tagged traffic.

The problem is that the guest machine isn't receiving any of the traffic that was received (on the phy) as double tagged. If the original internal traffic wasn't tagged (phy on host machine receives only 1-tag) the guest sees that traffic correctly.

I also did a test and configured a network on the vSwitch with tag 4095 where any tagged traffic should be passed (VGT). Again the guest machine receives only the single tagged traffic as received from phy, only difference is that the guest sees it as tagged. This proves the guest OS correctly sees tagged traffic and leads me to conclude the problem is in the vSwitch.

So is there a way to force the vSwitch to ignore the inner tags and pass traffic to guest regardless of the inner tag?

vSphere/vcenter/ESXi version 5.1.0 in question.

I need to get the rate at which certain packets (i.e. LDAP) arrive on a interface in a linux environment.

I was thinking of using tcpdump to filter the wanted packets and subsequently monitor the rate at which rx packets are seen. Perhaps by monitoring the rate of writes/s to tcpdump output file?

Or perhaps even better iptables where i would match packets by certain rule and then somehow get the packet rate for packets matching this rule.

Any idea how this could be done?

Thanks!

I'm trying to supply the dns search list to my windows clients to make the internal DNS naming scheme usable. Windows AD is not used so no GPO available.

The ideal way would be to supply the dns search list via DHCP option 119. Windows DHCP clients tragically don't seem to support that.

Is there an alternative way of achieving this beside GPO?

Related:

Which DHCP Client OS Support DHCP Option 119 Domain Suffix Search?