Mat's questions

On a Windows 2019 Server the drive D: is 100% full (500 Gb used):

I'm trying to understand why the disk is full but I can't because both File Explorer and Total Commander reports no more than 33 Gb used:

It's also strange that WinDirStat reports 100% (500 Gb) used in the start summary, but only 33 Gb used after the analysis:

Please note that:

• I'm logged in as Administrator
• I started WinDirStat with Administrator privileges
• I tried with both local Administrator and Active Directory Domain Admin
• I enabled hidden and system files in File Explorer and Total Commander
• I ran chkdsk on the D: drive without finding any issue

I found 33 Gb of data. Where are other 467 Gb?

I have a 4 disk storage server with two ZFS raidz1 pools, and suddenly last night it started running at 100% CPU with an high load average:

root@stg1:~# w
 07:05:48 up 296 days, 17:19,  1 user,  load average: 27.06, 25.49, 24.74
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT

I have many arc_prune processes which are eating a lot of CPU:

My zfs_arc_max size is default (which should be 50% of the system RAM) and in effect it is not using more than 16 Gb:

------------------------------------------------------------------------
ZFS Subsystem Report                Thu Aug 27 07:09:34 2020
ARC Summary: (HEALTHY)
    Memory Throttle Count:          0

ARC Misc:
    Deleted:                567.62m
    Mutex Misses:               10.46m
    Evict Skips:                10.46m

ARC Size:               102.63% 15.99   GiB
    Target Size: (Adaptive)     100.00% 15.58   GiB
    Min Size (Hard Limit):      6.25%   996.88  MiB
    Max Size (High Water):      16:1    15.58   GiB

ARC Size Breakdown:
    Recently Used Cache Size:   56.67%  9.06    GiB
    Frequently Used Cache Size: 43.33%  6.93    GiB

ARC Hash Breakdown:
    Elements Max:               1.48m
    Elements Current:       21.99%  325.26k
    Collisions:             62.96m
    Chain Max:              6
    Chains:                 12.66k

ARC Total accesses:                 36.36b
    Cache Hit Ratio:        81.78%  29.74b
    Cache Miss Ratio:       18.22%  6.62b
    Actual Hit Ratio:       81.55%  29.65b

    Data Demand Efficiency:     89.52%  598.92m
    Data Prefetch Efficiency:   22.19%  7.58m

    CACHE HITS BY CACHE LIST:
      Anonymously Used:     0.18%   53.22m
      Most Recently Used:       2.05%   608.89m
      Most Frequently Used:     97.66%  29.04b
      Most Recently Used Ghost: 0.05%   14.79m
      Most Frequently Used Ghost:   0.06%   17.72m

    CACHE HITS BY DATA TYPE:
      Demand Data:          1.80%   536.16m
      Prefetch Data:        0.01%   1.68m
      Demand Metadata:      97.83%  29.09b
      Prefetch Metadata:        0.36%   107.49m

    CACHE MISSES BY DATA TYPE:
      Demand Data:          0.95%   62.77m
      Prefetch Data:        0.09%   5.89m
      Demand Metadata:      97.10%  6.43b
      Prefetch Metadata:        1.87%   123.70m


DMU Prefetch Efficiency:                    12.04b
    Hit Ratio:          1.04%   124.91m
    Miss Ratio:         98.96%  11.92b



ZFS Tunable:
    zfs_arc_p_min_shift                               0
    zfs_checksums_per_second                          20
    zvol_request_sync                                 0
    zfs_object_mutex_size                             64
    spa_slop_shift                                    5
    zfs_sync_taskq_batch_pct                          75
    zfs_vdev_async_write_max_active                   10
    zfs_multilist_num_sublists                        0
    zfs_no_scrub_prefetch                             0
    zfs_vdev_sync_read_min_active                     10
    zfs_dmu_offset_next_sync                          0
    metaslab_debug_load                               0
    zfs_vdev_mirror_rotating_seek_inc                 5
    zfs_vdev_mirror_non_rotating_inc                  0
    zfs_read_history                                  0
    zfs_multihost_history                             0
    zfs_metaslab_switch_threshold                     2
    metaslab_fragmentation_factor_enabled             1
    zfs_admin_snapshot                                1
    zfs_delete_blocks                                 20480
    zfs_arc_meta_prune                                10000
    zfs_free_min_time_ms                              1000
    zfs_dedup_prefetch                                0
    zfs_txg_history                                   0
    zfs_vdev_max_active                               1000
    zfs_vdev_sync_write_min_active                    10
    spa_load_verify_data                              1
    zfs_dirty_data_max_max                            4294967296
    zfs_send_corrupt_data                             0
    zfs_scan_min_time_ms                              1000
    dbuf_cache_lowater_pct                            10
    zfs_send_queue_length                             16777216
    dmu_object_alloc_chunk_shift                      7
    zfs_arc_shrink_shift                              0
    zfs_resilver_min_time_ms                          3000
    zfs_free_bpobj_enabled                            1
    zfs_vdev_mirror_non_rotating_seek_inc             1
    zfs_vdev_cache_max                                16384
    ignore_hole_birth                                 1
    zfs_multihost_fail_intervals                      5
    zfs_arc_sys_free                                  0
    zfs_sync_pass_dont_compress                       5
    zio_taskq_batch_pct                               75
    zfs_arc_meta_limit_percent                        75
    zfs_arc_p_dampener_disable                        1
    spa_load_verify_metadata                          1
    dbuf_cache_hiwater_pct                            10
    zfs_read_chunk_size                               1048576
    zfs_arc_grow_retry                                0
    metaslab_aliquot                                  524288
    zfs_vdev_async_read_min_active                    1
    zfs_vdev_cache_bshift                             16
    metaslab_preload_enabled                          1
    l2arc_feed_min_ms                                 200
    zfs_scrub_delay                                   4
    zfs_read_history_hits                             0
    zfetch_max_distance                               8388608
    send_holes_without_birth_time                     1
    zfs_max_recordsize                                1048576
    zfs_dbuf_state_index                              0
    dbuf_cache_max_bytes                              104857600
    zfs_zevent_cols                                   80
    zfs_no_scrub_io                                   0
    zil_slog_bulk                                     786432
    spa_asize_inflation                               24
    l2arc_write_boost                                 8388608
    zfs_arc_meta_limit                                0
    zfs_deadman_enabled                               1
    zfs_abd_scatter_enabled                           1
    zfs_vdev_async_write_active_min_dirty_percent     30
    zfs_free_leak_on_eio                              0
    zfs_vdev_cache_size                               0
    zfs_vdev_write_gap_limit                          4096
    l2arc_headroom                                    2
    zfs_per_txg_dirty_frees_percent                   30
    zfs_compressed_arc_enabled                        1
    zfs_scan_ignore_errors                            0
    zfs_resilver_delay                                2
    zfs_metaslab_segment_weight_enabled               1
    zfs_dirty_data_max_max_percent                    25
    zio_dva_throttle_enabled                          1
    zfs_vdev_scrub_min_active                         1
    zfs_arc_average_blocksize                         8192
    zfs_vdev_queue_depth_pct                          1000
    zfs_multihost_interval                            1000
    zio_requeue_io_start_cut_in_line                  1
    spa_load_verify_maxinflight                       10000
    zfetch_max_streams                                8
    zfs_multihost_import_intervals                    10
    zfs_mdcomp_disable                                0
    zfs_zevent_console                                0
    zfs_sync_pass_deferred_free                       2
    zfs_nocacheflush                                  0
    zfs_arc_dnode_limit                               0
    zfs_delays_per_second                             20
    zfs_dbgmsg_enable                                 0
    zfs_scan_idle                                     50
    zfs_vdev_raidz_impl                               [fastest] original scalar
    zio_delay_max                                     30000
    zvol_threads                                      32
    zfs_vdev_async_write_min_active                   2
    zfs_vdev_sync_read_max_active                     10
    l2arc_headroom_boost                              200
    zfs_sync_pass_rewrite                             2
    spa_config_path                                   /etc/zfs/zpool.cache
    zfs_pd_bytes_max                                  52428800
    zfs_dirty_data_sync                               67108864
    zfs_flags                                         0
    zfs_deadman_checktime_ms                          5000
    zfs_dirty_data_max_percent                        10
    zfetch_min_sec_reap                               2
    zfs_mg_noalloc_threshold                          0
    zfs_arc_meta_min                                  0
    zvol_prefetch_bytes                               131072
    zfs_deadman_synctime_ms                           1000000
    zfs_autoimport_disable                            1
    zfs_arc_min                                       0
    l2arc_noprefetch                                  1
    zfs_nopwrite_enabled                              1
    l2arc_feed_again                                  1
    zfs_vdev_sync_write_max_active                    10
    zfs_prefetch_disable                              0
    zfetch_array_rd_sz                                1048576
    zfs_metaslab_fragmentation_threshold              70
    l2arc_write_max                                   8388608
    zfs_dbgmsg_maxsize                                4194304
    zfs_vdev_read_gap_limit                           32768
    zfs_delay_min_dirty_percent                       60
    zfs_recv_queue_length                             16777216
    zfs_vdev_async_write_active_max_dirty_percent     60
    metaslabs_per_vdev                                200
    zfs_arc_lotsfree_percent                          10
    zfs_immediate_write_sz                            32768
    zil_replay_disable                                0
    zfs_vdev_mirror_rotating_inc                      0
    zvol_volmode                                      1
    zfs_arc_meta_strategy                             1
    dbuf_cache_max_shift                              5
    metaslab_bias_enabled                             1
    zfs_vdev_async_read_max_active                    3
    l2arc_feed_secs                                   1
    zfs_arc_max                                       0
    zfs_zevent_len_max                                256
    zfs_free_max_blocks                               100000
    zfs_top_maxinflight                               32
    zfs_arc_meta_adjust_restarts                      4096
    l2arc_norw                                        0
    zfs_recover                                       0
    zvol_inhibit_dev                                  0
    zfs_vdev_aggregation_limit                        131072
    zvol_major                                        230
    metaslab_debug_unload                             0
    metaslab_lba_weighting_enabled                    1
    zfs_txg_timeout                                   5
    zfs_arc_min_prefetch_lifespan                     0
    zfs_vdev_scrub_max_active                         2
    zfs_vdev_mirror_rotating_seek_offset              1048576
    zfs_arc_pc_percent                                0
    zfs_vdev_scheduler                                noop
    zvol_max_discard_blocks                           16384
    zfs_arc_dnode_reduce_percent                      10
    zfs_dirty_data_max                                3344961536
    zfs_abd_scatter_max_order                         10
    zfs_expire_snapshot                               300
    zfs_arc_dnode_limit_percent                       10
    zfs_delay_scale                                   500000
    zfs_mg_fragmentation_threshold                    85

These are my ZFS pools:

root@stg1:~# zpool status
  pool: bpool
 state: ONLINE
status: Some supported features are not enabled on the pool. The pool can
    still be used, but some features are unavailable.
action: Enable all features using 'zpool upgrade'. Once this is done,
    the pool may no longer be accessible by software that does not support
    the features. See zpool-features(5) for details.
  scan: scrub repaired 0B in 0h0m with 0 errors on Sun Aug  9 00:24:06 2020
config:

    NAME                                         STATE     READ WRITE CKSUM
    bpool                                        ONLINE       0     0     0
      raidz1-0                                   ONLINE       0     0     0
        ata-HGST_HUH721010ALE600_JEJRYJ7N-part3  ONLINE       0     0     0
        ata-HGST_HUH721010ALE600_JEKELZTZ-part3  ONLINE       0     0     0
        ata-HGST_HUH721010ALE600_JEKEW7PZ-part3  ONLINE       0     0     0
        ata-HGST_HUH721010ALE600_JEKG492Z-part3  ONLINE       0     0     0

errors: No known data errors

  pool: rpool
 state: ONLINE
  scan: scrub repaired 0B in 7h34m with 0 errors on Sun Aug  9 07:58:40 2020
config:

    NAME                                         STATE     READ WRITE CKSUM
    rpool                                        ONLINE       0     0     0
      raidz1-0                                   ONLINE       0     0     0
        ata-HGST_HUH721010ALE600_JEJRYJ7N-part4  ONLINE       0     0     0
        ata-HGST_HUH721010ALE600_JEKELZTZ-part4  ONLINE       0     0     0
        ata-HGST_HUH721010ALE600_JEKEW7PZ-part4  ONLINE       0     0     0
        ata-HGST_HUH721010ALE600_JEKG492Z-part4  ONLINE       0     0     0

errors: No known data errors

Drives are SATA, and unfortunately I cannot add any caching SSD device.

Is there anything I can do to release some CPU?

I need to deploy a MinIO infrastructure on three nodes, where each nodes has a single local directory where they can save files in.

I read the MinIO Erasure Code Quickstart Guide, but I don't need MinIO to manage data replication on different local drives because all three nodes are on separated virtual machines on separated hardware and the local storage is already protected by ZFS.

For this reason I only MinIO replicates data between nodes creating three replicas of each files, but when I try to start it with a single data directory it fails:

minio@storage3:/usr/local/bin$ export MINIO_ACCESS_KEY=foo
minio@storage3:/usr/local/bin$ export MINIO_SECRET_KEY=bar
minio@storage3:/usr/local/bin$ ./minio server http://storage{1...3}/minio1
ERROR Invalid command line arguments: Invalid total number of endpoints for erasure mode.
      > Please provide correct combination of local/remote paths.
      HELP:
        For more information, please refer to https://docs.min.io/docs/minio-erasure-code-quickstart-guide

Could you help me please?

I created a simple Ansible playbook:

---
- hosts: all

  tasks:
    - name: Install Icinga2 on Windows
      include_role:
        name: my.icinga2.role
        apply:
          tags:
            - install-icinga2

The role contains this tasks file:

---
- include_tasks: vars.yml
  tags: ['always']

- include_tasks: install.yml
  tags: ['install-icinga2-stack', 'install-icinga2']

- include_tasks: ido-install.yml
  when: icinga2_ido_enable == true
  tags: ['install-icinga2-stack', 'install-icinga2-ido']  

- include_tasks: configure.yml
  tags: ['install-icinga2-stack']

[...]

This is the result when I execute the playbook:

me@ansible:~/ansible$ ansible-playbook plays/icinga2-client-win.yml -i staging.ini --limit windows


PLAY [all] ***************************************************************************************************

TASK [Gathering Facts] ***********************************************************************************************************
ok: [my.windows.client]

TASK [Include variables for Icinga 2] ********************************************************************************************
ok: [my.windows.client]

TASK [set_fact] ******************************************************************************************************************
skipping: [my.windows.client]

TASK [set_fact] ******************************************************************************************************************
ok: [my.windows.client]

TASK [Install Icinga2 Client and connect it to the master server] ****************************************************************

TASK [my.icinga2.role : include_tasks] ***************************************************************************************
included: /home/me/ansible/roles/internal/my.icinga2.role/tasks/vars.yml for my.windows.client

TASK [my.icinga2.role : Set default fact for mysql command] ******************************************************************
ok: [my.windows.client]

TASK [my.icinga2.role : Set fact for mysql command if auth params are given] *************************************************
skipping: [my.windows.client]

TASK [my.icinga2.role : Set Monitoring Plugins for old Debian Versions] ******************************************************
skipping: [my.windows.client]

TASK [my.icinga2.role : include_tasks] ***************************************************************************************
included: /home/me/ansible/roles/internal/my.icinga2.role/tasks/install.yml for my.windows.client

TASK [my.icinga2.role : include_tasks] ***************************************************************************************
skipping: [my.windows.client]

TASK [my.icinga2.role : include_tasks] ***************************************************************************************
skipping: [my.windows.client]

TASK [my.icinga2.role : include_tasks] ***************************************************************************************
included: /home/me/ansible/roles/internal/my.icinga2.role/tasks/install-Windows.yml for my.windows.client

TASK [my.icinga2.role : set_fact] ********************************************************************************************
ok: [my.windows.client]

TASK [my.icinga2.role : set_fact] ********************************************************************************************
skipping: [my.windows.client]

TASK [my.icinga2.role : Install Icinga 2] ************************************************************************************
changed: [my.windows.client]

TASK [my.icinga2.role : include_tasks] ***************************************************************************************
skipping: [my.windows.client]

TASK [my.icinga2.role : include_tasks] ***************************************************************************************
included: /home/me/ansible/roles/internal/my.icinga2.role/tasks/configure.yml for my.windows.client

TASK [my.icinga2.role : Check if Icinga 2 API are already activated] *********************************************************
[ This should not be included! ]

RUNNING HANDLER [my.icinga2.role : Restart Icinga2 on Windows] ***************************************************************
    to retry, use: --limit @/home/me/ansible/plays/icinga2-client-win.retry

PLAY RECAP ***********************************************************************************************************************
my.windows.client   : ok=10   changed=1    unreachable=0    failed=1 

Why the configure.yml role task file is included as it should be included only if I apply the install-icinga2-stack tag and I'm applying the install-icinga2 one?

Further I realise that the ido-install.yml role task file is not included just because the icinga2_ido_enable variable is not true in this playbook (and its default is false), not because one of its tags is not applied (which should be what I want).

Where I'm wrong?

I'm trying to use Ansible on my first Windows node, using winrm on HTTP (I will use https as a second step) and ntlm authentication.

I configured group_vars and the basic connection to the Windows host works:

me@ansible:~/ansible$ ansible -i staging.ini windows -m setup
windows-server.my.domain.name | SUCCESS => {
    "ansible_facts": {
        "ansible_architecture": "64-bit", 
        "ansible_bios_date": "04/01/2014", 
        "ansible_bios_version": "rel-1.11.1-0-g0551a4be2c-prebuilt.qemu-project.org", 
        "ansible_date_time": {
            [...]
        }, 
        "ansible_distribution": "Microsoft Windows Server 2016 Standard", 
        "ansible_distribution_major_version": "10", 
        "ansible_distribution_version": "10.0.14393.0", 
        "ansible_domain": "my.domain.name", 
        [...]
        "ansible_windows_domain": "my.domain.name, 
        "ansible_windows_domain_member": true, 
        "ansible_windows_domain_role": "Member server", 
        "gather_subset": [
            "all"
        ], 
        "module_setup": true
    }, 
    "changed": false
}

Now I'm trying to instal a MSI package (Icinga 2) with a basic playbook:

---
- hosts: all

  tasks:
    - name: Install Icinga 2
      win_package:
        path: "https://packages.icinga.com/windows/Icinga2-v2.10.5-x86_64.msi"
        product_id: "712727BA-156F-466A-9C25-7A6246602664"
        arguments: /install /passive /norestart

But when I run it it remains endlessly hanged with no output:

me@ansible:~/ansible$ ansible-playbook plays/win-test.yml -i staging.ini --limit windows


PLAY [all] *****************************************************************************************************************

TASK [Gathering Facts] *************************************************************************************************************************
ok: [windows-server.my.domain.name]

TASK [Install Icinga 2] ************************************************************************************************************************

(no output after 10 minutes)

I've already tried to debug using -vvvv but it does not output any useful info:

me@ansible:~/ansible$ ansible-playbook plays/win-test.yml -i staging.ini --limit windows -vvvv

TASK [Install Icinga 2] *******************************************************************************************************************
task path: /home/me/ansible/plays/win-test.yml:5
Using module file /home/me/.local/lib/python2.7/site-packages/ansible/modules/windows/win_package.ps1
<windows-server.my.domain.name> ESTABLISH WINRM CONNECTION FOR USER: DOMAIN\me on PORT 5985 TO windows-server.my.domain.name
checking if winrm_host windows-server.my.domain.name is an IPv6 address
EXEC (via pipeline wrapper)

(no output after 10 minutes)

How I can debug it?

In one Ansible playbook I include a variables file which contains one variable like this:

dictionaries:
  - host1:
    - key1:
      - name: "Foo"
        params:
        - bar: "Baz"
  - host2:
    - key1:
      - name: "Foo2"
        params:
        - bar: "Baz2"
  - host3:
    - key1:
      - name: "Foo3"
        params:
        - bar: "Baz3"

I want to take only the element of the list which key name is the Ansible {{ inventory_hostname }} of the host Ansible is executing the playbook on.

So for example, if I execute the playbook on host2 I want to get the dictionary:

- key1:
  - name: "Foo2"
    params:
    - bar: "Baz2"

I'm trying to use the lookup plugin but I'm not sure how I can use it in this situation.

I am writing an Ansible role to build some Icinga 2 configurations, and the more important is the configuration of a client host in a distributed Icinga installation.

I want to declare Icinga 2 host variables in an Ansible variable which can be passed to an Ansible template to build a new Icinga 2 configuration file, for example:

object Host "client" {
  import "generic-host"
  address = "123.123.123.123"

  [...]

  vars.disks["Disks"] = {
    disk_all = true
  }

  vars.tcp["Description"] = {
    tcp_address = "foo.bar"
  }

  [...]    

}

I am declaring Icinga 2 host variables (for example vars.tcp["Description"] in the above example) in an Ansible variable (YAML) like this:

icinga2_clients:
  - client:
    - vars:
      - tcp:
        - name: "Description"
          params:
          - tcp_address: "foo.bar"

Do you any better idea on how to write a better Ansible variable file?

I have a Windows Server 2016 running some RemoteApps, and I configured it to automatically end sessions if they are disconnected for 5 minutes or if they are idle for 15 minutes, like this:

The problem is that even normal Remote Desktop connections are ended in this way, and I don't want this behaviour for a list of users.

• how I can configure this only for RemoteApp and not for Remote Desktop connections?
• how I can exclude a list of users from this behaviour?

I have one Postfix SMTP server with hundreds of users, which are using it to send e-mails as authenticated users.

Sometimes one account is hacked and thousand e-mails become to go out from the SMTP server, starting a spam flooding to hundreds of e-mail addresses.

This obviously make my server to be inserted into many blacklist and when I realise I need to:

• fix the hacked account (and educate users to use good password and to change them frequently)
• stop the flooding removing spam messages from the outgoing queue
• check the IP address into blacklists and remove them if needed
• monitor outgoing e-mails to check if they are marked as spam

Now I want to understand how I can efficiently prevent the flooding before it happens, because we cannot risk to be inserted into any blacklist. I think this could be reached with:

• force users to use a good password: this can be easily reached if you are using an authentication backend like Active Directory, but what about Postfix users and virtual domains saved into the database?
• activating fail2ban on SMTP services (but this does not work if hackers already know passwords and use them at the first try)
• implementing some flooding detection like outgoing rate detection for the same users which could stop relay for a specific user if it's spamming: what technology can be used on top of Postfix to achieve this?
• monitoring: some Nagios/Icinga checks for the elements in the Postfix outgoing queue (but could be too late)
• monitoring: a lot of services which can check if the IP address is into some blacklist (but too late)

Any other idea?

I installed a new Openmediavault 4 server which I joined to my Active Directory managed by two Samba 4 Domain Controllers.

Specifications:

• Active Directory domain MY.AD.DOMAIN managed by two Samba 4 domain controllers (server-z1.my.ad.domain (192.168.70.201) and server-z2.my.ad.domain (192.168.70.202)
• One file server with Samba Version 4.5.12-Debian running on Openmediavault 4.1.0-1 (Debian 9 based)
• The IP address of the file server is 192.168.70.171
• The FQDN of the file server is server-f1.my.ad.domain
• The file server has an alias server-f10.my.ad.domain configured in the DNS
• I want to access to the file server from clients using the IP address (\192.168.70.171), the FQDN (\server-f1.my.ad.domain) and the DNS alias (\server-f10.my.ad.domain).

I joined Openmediavault using SSSD following the guide at https://forum.openmediavault.org/index.php/Thread/18886-Guide-how-to-join-OpenMediaVault-3-x-in-an-Active-Directory-domain/, and I can list domain users using getent passwd even after reboot.

The problem I have is that I can access to Samba shares on Openmediavault connecting to it using the FQDN (\server-f1 or \server-f1.my.ad.domain), but not using the IP address (\192.168.70.171) or the DNS alias (\server-f10 or \server-f10.my.ad.domain).

When I access using the IP address or the DNS alias I get this errors on the Openmediavault system:

Mar 15 20:14:54 server-f1 smbd[21103]: [2018/03/15 20:14:54.956409,  2] ../source3/librpc/crypto/gse_krb5.c:229(fill_mem_keytab_from_secrets)
Mar 15 20:14:54 server-f1 smbd[21103]:   ../source3/librpc/crypto/gse_krb5.c:229: failed to fetch machine password
Mar 15 20:14:54 server-f1 smbd[21103]: [2018/03/15 20:14:54.957928,  2] ../source3/librpc/crypto/gse_krb5.c:229(fill_mem_keytab_from_secrets)
Mar 15 20:14:54 server-f1 smbd[21103]:   ../source3/librpc/crypto/gse_krb5.c:229: failed to fetch machine password
Mar 15 20:14:54 server-f1 smbd[21103]: [2018/03/15 20:14:54.961733,  1] ../lib/param/loadparm.c:1729(lpcfg_do_global_parameter)
Mar 15 20:14:54 server-f1 smbd[21103]:   WARNING: The "syslog" option is deprecated
Mar 15 20:14:54 server-f1 smbd[21103]: [2018/03/15 20:14:54.961772,  1] ../lib/param/loadparm.c:1729(lpcfg_do_global_parameter)
Mar 15 20:14:54 server-f1 smbd[21103]:   WARNING: The "syslog only" option is deprecated
Mar 15 20:14:54 server-f1 smbd[21103]: [2018/03/15 20:14:54.961984,  2] ../source3/param/loadparm.c:2685(lp_do_section)
Mar 15 20:14:54 server-f1 smbd[21103]:   Processing section "[homes]"
Mar 15 20:14:57 server-f1 smbd[21103]: [2018/03/15 20:14:57.049955,  1] ../auth/credentials/credentials_secrets.c:410(cli_credentials_set_machine_account_db_ctx)
Mar 15 20:14:57 server-f1 smbd[21103]:   Could not find machine account in secrets database: Failed to fetch machine account password for DOMAIN from both secrets.ldb (Could not find entry to match filter: '(&(flatname=DOMAIN)(objectclass=primaryDomain))' base: 'cn=Primary Domains': No such object: dsdb_search at ../source4/dsdb/common/util.c:4575) and from /var/lib/samba/private/secrets.tdb: NT_STATUS_CANT_ACCESS_DOMAIN_INFO
Mar 15 20:14:57 server-f1 smbd[21103]: [2018/03/15 20:14:57.050031,  0] ../source3/auth/auth_domain.c:121(connect_to_domain_password_server)
Mar 15 20:14:57 server-f1 smbd[21103]:   connect_to_domain_password_server: unable to open the domain client session to machine SERVER-Z1.MY.AD.DOMAIN. Error was : NT_STATUS_CANT_ACCESS_DOMAIN_INFO.
Mar 15 20:14:57 server-f1 smbd[21103]: [2018/03/15 20:14:57.081918,  1] ../auth/credentials/credentials_secrets.c:410(cli_credentials_set_machine_account_db_ctx)
Mar 15 20:14:57 server-f1 smbd[21103]:   Could not find machine account in secrets database: Failed to fetch machine account password for DOMAIN from both secrets.ldb (Could not find entry to match filter: '(&(flatname=DOMAIN)(objectclass=primaryDomain))' base: 'cn=Primary Domains': No such object: dsdb_search at ../source4/dsdb/common/util.c:4575) and from /var/lib/samba/private/secrets.tdb: NT_STATUS_CANT_ACCESS_DOMAIN_INFO
Mar 15 20:14:57 server-f1 smbd[21103]: [2018/03/15 20:14:57.081968,  0] ../source3/auth/auth_domain.c:121(connect_to_domain_password_server)
Mar 15 20:14:57 server-f1 smbd[21103]:   connect_to_domain_password_server: unable to open the domain client session to machine SERVER-Z1.MY.AD.DOMAIN. Error was : NT_STATUS_CANT_ACCESS_DOMAIN_INFO.
Mar 15 20:14:57 server-f1 smbd[21103]: [2018/03/15 20:14:57.110632,  1] ../auth/credentials/credentials_secrets.c:410(cli_credentials_set_machine_account_db_ctx)
Mar 15 20:14:57 server-f1 smbd[21103]:   Could not find machine account in secrets database: Failed to fetch machine account password for DOMAIN from both secrets.ldb (Could not find entry to match filter: '(&(flatname=DOMAIN)(objectclass=primaryDomain))' base: 'cn=Primary Domains': No such object: dsdb_search at ../source4/dsdb/common/util.c:4575) and from /var/lib/samba/private/secrets.tdb: NT_STATUS_CANT_ACCESS_DOMAIN_INFO
Mar 15 20:14:57 server-f1 smbd[21103]: [2018/03/15 20:14:57.110683,  0] ../source3/auth/auth_domain.c:121(connect_to_domain_password_server)
Mar 15 20:14:57 server-f1 smbd[21103]:   connect_to_domain_password_server: unable to open the domain client session to machine SERVER-Z1.MY.AD.DOMAIN. Error was : NT_STATUS_CANT_ACCESS_DOMAIN_INFO.
Mar 15 20:14:57 server-f1 smbd[21103]: [2018/03/15 20:14:57.112016,  0] ../source3/auth/auth_domain.c:184(domain_client_validate)
Mar 15 20:14:57 server-f1 smbd[21103]:   domain_client_validate: Domain password server not available.
Mar 15 20:14:57 server-f1 smbd[21103]: [2018/03/15 20:14:57.112060,  2] ../source3/auth/auth.c:315(auth_check_ntlm_password)
Mar 15 20:14:57 server-f1 smbd[21103]:   check_ntlm_password:  Authentication for user [my.user] -> [my.user] FAILED with error NT_STATUS_NO_LOGON_SERVERS
Mar 15 20:14:57 server-f1 smbd[21103]: [2018/03/15 20:14:57.112088,  2] ../auth/gensec/spnego.c:720(gensec_spnego_server_negTokenTarg)
Mar 15 20:14:57 server-f1 smbd[21103]:   SPNEGO login failed: NT_STATUS_NO_LOGON_SERVERS
Mar 15 20:14:57 server-f1 smbd[21104]: [2018/03/15 20:14:57.121674,  2] ../source3/librpc/crypto/gse_krb5.c:229(fill_mem_keytab_from_secrets)
Mar 15 20:14:57 server-f1 smbd[21104]:   ../source3/librpc/crypto/gse_krb5.c:229: failed to fetch machine password
Mar 15 20:14:57 server-f1 smbd[21104]: [2018/03/15 20:14:57.125426,  1] ../lib/param/loadparm.c:1729(lpcfg_do_global_parameter)
Mar 15 20:14:57 server-f1 smbd[21104]:   WARNING: The "syslog" option is deprecated
Mar 15 20:14:57 server-f1 smbd[21104]: [2018/03/15 20:14:57.125460,  1] ../lib/param/loadparm.c:1729(lpcfg_do_global_parameter)
Mar 15 20:14:57 server-f1 smbd[21104]:   WARNING: The "syslog only" option is deprecated
Mar 15 20:14:57 server-f1 smbd[21104]: [2018/03/15 20:14:57.125698,  2] ../source3/param/loadparm.c:2685(lp_do_section)
Mar 15 20:14:57 server-f1 smbd[21104]:   Processing section "[homes]"
Mar 15 20:14:57 server-f1 smbd[21104]: [2018/03/15 20:14:57.197432,  1] ../auth/credentials/credentials_secrets.c:410(cli_credentials_set_machine_account_db_ctx)
Mar 15 20:14:57 server-f1 smbd[21104]:   Could not find machine account in secrets database: Failed to fetch machine account password for DOMAIN from both secrets.ldb (Could not find entry to match filter: '(&(flatname=DOMAIN)(objectclass=primaryDomain))' base: 'cn=Primary Domains': No such object: dsdb_search at ../source4/dsdb/common/util.c:4575) and from /var/lib/samba/private/secrets.tdb: NT_STATUS_CANT_ACCESS_DOMAIN_INFO
Mar 15 20:14:57 server-f1 smbd[21104]: [2018/03/15 20:14:57.197476,  0] ../source3/auth/auth_domain.c:121(connect_to_domain_password_server)
Mar 15 20:14:57 server-f1 smbd[21104]:   connect_to_domain_password_server: unable to open the domain client session to machine SERVER-Z1.MY.AD.DOMAIN. Error was : NT_STATUS_CANT_ACCESS_DOMAIN_INFO.
Mar 15 20:14:57 server-f1 smbd[21104]: [2018/03/15 20:14:57.227212,  1] ../auth/credentials/credentials_secrets.c:410(cli_credentials_set_machine_account_db_ctx)
Mar 15 20:14:57 server-f1 smbd[21104]:   Could not find machine account in secrets database: Failed to fetch machine account password for DOMAIN from both secrets.ldb (Could not find entry to match filter: '(&(flatname=DOMAIN)(objectclass=primaryDomain))' base: 'cn=Primary Domains': No such object: dsdb_search at ../source4/dsdb/common/util.c:4575) and from /var/lib/samba/private/secrets.tdb: NT_STATUS_CANT_ACCESS_DOMAIN_INFO
Mar 15 20:14:57 server-f1 smbd[21104]: [2018/03/15 20:14:57.227250,  0] ../source3/auth/auth_domain.c:121(connect_to_domain_password_server)
Mar 15 20:14:57 server-f1 smbd[21104]:   connect_to_domain_password_server: unable to open the domain client session to machine SERVER-Z1.MY.AD.DOMAIN. Error was : NT_STATUS_CANT_ACCESS_DOMAIN_INFO.
Mar 15 20:14:57 server-f1 smbd[21104]: [2018/03/15 20:14:57.257018,  1] ../auth/credentials/credentials_secrets.c:410(cli_credentials_set_machine_account_db_ctx)
Mar 15 20:14:57 server-f1 smbd[21104]:   Could not find machine account in secrets database: Failed to fetch machine account password for DOMAIN from both secrets.ldb (Could not find entry to match filter: '(&(flatname=DOMAIN)(objectclass=primaryDomain))' base: 'cn=Primary Domains': No such object: dsdb_search at ../source4/dsdb/common/util.c:4575) and from /var/lib/samba/private/secrets.tdb: NT_STATUS_CANT_ACCESS_DOMAIN_INFO
Mar 15 20:14:57 server-f1 smbd[21104]: [2018/03/15 20:14:57.257051,  0] ../source3/auth/auth_domain.c:121(connect_to_domain_password_server)
Mar 15 20:14:57 server-f1 smbd[21104]:   connect_to_domain_password_server: unable to open the domain client session to machine SERVER-Z1.MY.AD.DOMAIN. Error was : NT_STATUS_CANT_ACCESS_DOMAIN_INFO.
Mar 15 20:14:57 server-f1 smbd[21104]: [2018/03/15 20:14:57.466888,  0] ../source3/auth/auth_domain.c:184(domain_client_validate)
Mar 15 20:14:57 server-f1 smbd[21104]:   domain_client_validate: Domain password server not available.
Mar 15 20:14:57 server-f1 smbd[21104]: [2018/03/15 20:14:57.466920,  2] ../source3/auth/auth.c:315(auth_check_ntlm_password)
Mar 15 20:14:57 server-f1 smbd[21104]:   check_ntlm_password:  Authentication for user [my.user] -> [my.user] FAILED with error NT_STATUS_NO_LOGON_SERVERS
Mar 15 20:14:57 server-f1 smbd[21104]: [2018/03/15 20:14:57.466943,  2] ../auth/gensec/spnego.c:720(gensec_spnego_server_negTokenTarg)
Mar 15 20:14:57 server-f1 smbd[21104]:   SPNEGO login failed: NT_STATUS_NO_LOGON_SERVERS
Mar 15 20:15:01 server-f1 CRON[21106]: (root) CMD (/usr/sbin/omv-mkrrdgraph >/dev/null 2>&1)

This is my Samba global configuration:

[global]
workgroup = DOMAIN
server string = %h server
dns proxy = no
log level = 3
syslog = 3
log file = /var/log/samba/log.%m
max log size = 1000
syslog only = yes
panic action = /usr/share/samba/panic-action %d
encrypt passwords = true
passdb backend = tdbsam
obey pam restrictions = no
unix password sync = no
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
pam password change = yes
socket options = TCP_NODELAY IPTOS_LOWDELAY
guest account = nobody
load printers = no
disable spoolss = yes
printing = bsd
printcap name = /dev/null
unix extensions = yes
wide links = no
create mask = 0777
directory mask = 0777
use sendfile = yes
aio read size = 16384
aio write size = 16384
local master = yes
time server = no
wins support = no
client signing = yes
client use spnego = yes
kerberos method = secrets and keytab
dedicated keytab file = FILE:/etc/krb5.keytab
password server = server-z1.my.ad.domain, server-z2.my.ad.domain
realm = MY.AD.DOMAIN
security = ads
template homedir = /home/my.ad.domain/users/%U
netbios name = server-f1
netbios aliases = server-f10

Could you help me please?

Thanks!

In my infrastructure I have a SQL Server 2014 Standard standalone server.

As databases and applications which are using SQL Server are growing up, I want to upgrade to SQL Server 2016 Standard and install two nodes to get an highly available SQL Server infrastructure.

I know I could make a SQL Server Failover Cluster, but I need some shared storages for this, which could not be a problem because I have a production NAS/SAN available but it's very slow as it is for data purposes and not for application purposes.

As my virtualization nodes have some fast SSD local storage, I wish to use them to host SQL Server data, so I am wondering if there is a way to build a SQL Server HA cluster without a shared storage, but making a master-slave replication between two nodes on their own local storage, something like what I am already doing for MariaDB with MariaDB Galera Cluster.

I also have an HAProxy available.

Thanks!!

on a server running Debian Stretch I configured a bond0 with the 802.3ad mode as following:

auto bond0
iface bond0 inet manual
        slaves eth0 eth2
        bond_miimon 100
        bond_mode 802.3ad

The bond0 interface is up and and running but it's working with the load balancing (round robin) mode:

root@servir01:~# cat /proc/net/bonding/bond0
Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)

Bonding Mode: load balancing (round-robin)
MII Status: up
MII Polling Interval (ms): 100
Up Delay (ms): 0
Down Delay (ms): 0

Slave Interface: eth0
MII Status: up
Speed: 1000 Mbps
Duplex: full
Link Failure Count: 2
Permanent HW addr: e4:1f:13:65:f0:c4
Slave queue ID: 0

Slave Interface: eth2
MII Status: up
Speed: 1000 Mbps
Duplex: full
Link Failure Count: 2
Permanent HW addr: e4:1f:13:36:a3:ac
Slave queue ID: 0

On the switch the LAG is correctly created with the LACP enabled and it has both ports up and running:

[

The same machine has another bond interface (bond1 on eth1 and eth3 interfaces) configured in the very same way, connected on the same switches, and the LACP is working good:

Bonding Mode: IEEE 802.3ad Dynamic link aggregation
Transmit Hash Policy: layer2 (0)
MII Status: up
MII Polling Interval (ms): 100
Up Delay (ms): 0
Down Delay (ms): 0

802.3ad info
LACP rate: slow
Min links: 0
Aggregator selection policy (ad_select): stable
System priority: 65535
System MAC address: e4:1f:13:65:f0:c6
Active Aggregator Info:
    Aggregator ID: 1
    Number of ports: 2
    Actor Key: 9
    Partner Key: 1010

Why the bond0 interface doesn't want to enable the LACP? Where I am wrong?

I configured a LAG into a stack composed by 2 x SG550X-48 (Units 1/2) and 2 x SG550X-24 (Units 3/4).

The LAG1 is configured with LACP on GE3/4 and GE4/4 ports.

The problem is that the GE4/4 port is recognised as a standby member:

even if the link is UP:

and the operating system (Debian Linux Stretch) recognises it as up and running with both interfaces:

For this reason I have about 50% of packet loss to and from this server and this is a serious problem.

If I try to disable the LACP I don't have the problem:

The strange thing is that I've already used the same configuration in another environment and that works good.

I have a MariaDB Galera cluster with 3 nodes and I configured the SST transfer as

wsrep_sst_method = rsync

When I have to stop and restart a single node, the synchronization is very slow even if the node remained stopped only for 1 hour: it takes about 2 hours to sync.

Is there a way to speed up the synchronization time?

Thanks!

I configured an HAProxy service for my Redis Cluster installation (3 nodes with Redis Sentinel managing the master delegation) and it works good: clients are redirected only to the master node and whenever a slave node becomes master, HAProxy suddenly change the active member into the backend.

Just wanting to be meticulous, the slave nodes are shown as "DOWN" (red colour) into the HAProxy Statistics Report (Layer7 timeout: at step 5 of tcp-check (expect string 'role:master')). Is there a way to have them shown as "backup UP" (blue colour), which is the correct definition?

This because red nodes seems to be a problem, but this is not true as slave members are UP but they are just slave so they are not active. I think this is the correct definition of the "backup UP" state into HAProxy.

This is the configuration of HAProxy:

frontend Redis
    bind            192.168.70.90:6379 name 192.168.70.90:6379   
    mode            tcp
    log         global
    timeout client      30000
    default_backend     Redis_tcp_ipvANY

backend Redis_tcp_ipvANY
    mode            tcp
    timeout connect     30000
    timeout server      30000
    retries         3
    option tcp-check
    tcp-check connect
    tcp-check send PING\r\n
    tcp-check expect string +PONG
    tcp-check send info\ replication\r\n
    tcp-check expect string role:master
    tcp-check send QUIT\r\n
    tcp-check expect string +OK
    server          redis1 192.168.70.91:6379 check inter 1000  maxconn 1024 
    server          redis2 192.168.70.92:6379 check inter 1000  maxconn 1024 
    server          redis3 192.168.70.93:6379 check inter 1000  maxconn 1024 

Do you have any idea about how it's possible to do what I want?

Thanks!

I am using Squid 3.3.13 with no cache enabled and all my clients in LAN are using it to access to HTTP and HTTPS websites. I am not using it as transparent proxy but clients have it configured in OS preferences.

It works, but I'm getting some random (104) Connection rest by peer errors on some websites, for example www.tim.it and www.impresasemplice.it, like what you see on this screenshot:

The strane things are:

• I am not getting this error from every clients but I have it randomly only on some of them
• I am not getting this error for every websites but only on a list of them
• When I get this error it goes away if I retry to reload the page on the same website 3/4 times
• In the same time I am getting the error on the client I can access the same website from the proxy itself with no problems (using a browser like elinks from the command line of the proxy server (CentOS centos-release-6-8.el6.centos.12.3.x86_64)

Looking in the Squid's access.log file I see a 502 error when I get the error from the client. 502 error is "bad gateway", but if I have bad gateway why I can access the same website from elinks on the same time?

[Thu Jan 19 18:05:26 2017].837     56 10.1.3.223 TCP_MISS/502 4489 GET http://www.tim.it/ - HIER_DIRECT/156.54.69.9 text/html
[Thu Jan 19 18:06:47 2017].655     54 10.1.3.223 TCP_MISS/502 4525 GET http://www.tim.it/ - HIER_DIRECT/156.54.69.9 text/html
[Thu Jan 19 18:06:48 2017].099     60 10.1.3.223 TCP_MISS/301 591 GET http://www.tim.it/favicon.ico - HIER_DIRECT/156.54.69.9 text/html
[Thu Jan 19 18:06:48 2017].136     29 10.1.3.223 TCP_MISS/200 0 CONNECT www.tim.it:443 - HIER_DIRECT/156.54.69.9 -
[Thu Jan 19 18:07:04 2017].305  16165 10.1.3.223 TCP_MISS/200 19410 CONNECT www.tim.it:443 - HIER_DIRECT/156.54.69.9 -
[Thu Jan 19 18:07:13 2017].540     90 10.1.3.223 TCP_MISS/301 569 GET http://www.tim.it/ - HIER_DIRECT/156.54.69.9 text/html
[Thu Jan 19 18:07:27 2017].532  13988 10.1.3.223 TCP_MISS/200 3396 CONNECT www.tim.it:443 - HIER_DIRECT/156.54.69.9 -
[Thu Jan 19 18:07:27 2017].540  13996 10.1.3.223 TCP_MISS/200 131005 CONNECT www.tim.it:443 - HIER_DIRECT/156.54.69.9 -
[Thu Jan 19 18:07:44 2017].743  17196 10.1.3.223 TCP_MISS/200 143879 CONNECT www.tim.it:443 - HIER_DIRECT/156.54.69.9 -

Could you help me to find out where I am wrong, please?

I'm evaluating the cluster capabilities of Redis 3 (I'm using Redis 2 standalone at the moment), so I am reading the info at http://redis.io/topics/cluster-tutorial.

In this document I read a very important info:

Note that the minimal cluster that works as expected requires to contain at least three master nodes. For your first tests it is strongly suggested to start a six nodes cluster with three masters and three slaves.

Is it really true? In my mind this is correct if I would use sharding capabilities (data are shared between nodes), but what if I don't need it and I would be happy of having data on only one node?

I basically need one master and two slaves (so the cluster would be live if one node fails), can I have this configuration in a production environment? If yes, what are the contraindications?

Thank you very much for your help!

I have some Nginx servers which shares their configuration together because they are in a load balancer pool.

So I have a unique configuration for all servers and all servers are listening on *:80 and *:443 addresses.

But this is causing me some problems with the SSL certificates on clients which does not support SNI (like Windows XP).

To solve this I should specify a different IP address for each SSL website, but this is different from every server in the pool of course.

Do you have some advises?

Could I specify multiple IPs in the same server without causing an error in case Nginx cannot bind on one of them?

Thank you very much!

On the mongoDB documentation for a production cluster architecture I read that the minimum amount of servers for a running production mongoDB cluster is 7:

Is it possible to share the routers, config servers and shards on the same servers (having 3 total servers each with a router, config and shard service)?

I'm using Redis for some time and now we want to move to a redundant cluster which would be fault tolerant, highly available and load balanced.

I principally use Redis for some PHP web application which stores some process status information (I'm using PHPRedis for this) and I would like to use it also for PHP session store in a load balanced cluster.

I already have a Load Balancing that I use for Nginx and MySQL (based on pfSense).

I saw that Redis Cluster exists for Redis 3, but I also read some comments about the fact that it is not ready for production, others that tells that Redis cannot do a complete master/master cluster configuration.

What is your advise?

• Try Redis Cluster
• Move to another key=value engine (CouchDB? Memcached? Others?)
• Don't mind about load balancing and use only one node of the cluster per time, and having a manual failover, as I don't use persistence
• Other ideas?

Thank you very much for your help!