Aaron C. de Bruyn's questions

Is it possible to scale Elasticsearch from multiple nodes down to one node?

I have a 3-node cluster that is way overkill for the amount of data being logged. To scale it down, I set "cluster.routing.allocation.exclude._ip" to the IP nodes 2 and 3 to get all the data on to one node.

I stopped Elasticsearch on node 3, and the cluster remained healthy.

In preparation to turn off the second node, I adjusted the cluster settings to require a quorum of 1 and make sure it was persistent instead of transient. Then I stopped Elasticsearch on node 2.

Finally I went on to node 1 and set discovery.type to single-node and restarted Elasticsearch.

Elasticsearch is throwing an error:

cannot start with [discovery.type] set to [single-node] when local node {node1.customer.local}{r5tnzHEYRN6TNPNur9jpqA}{PjBDleWmTeSvkRUuUNWVWw}{10.132.135.55}{10.132.135.55:9300}{dilm}{ml.machine_memory=33730138112, xpack.installed=true, ml.max_open_jobs=20} does not have quorum in voting configuration VotingConfiguration{tlbB7vMgQXOzvO36iboqOQ,r5tnzHEYRN6TNPNur9jpqA,s1fLGX7RS│fL
GX│tGpFh2xPZkkIw}

How can I scale down to one node?

How can you tell if two ZFS snapshots are identical or simply named the same?

Say I have two computers named host-a and host-b. Also assume that host-a has a ZFS dataset named /tank/mydataset.

On host-a, I could: zfs snapshot tank/mydataset@mysnapshot' and then I could 'zfs send tank/mydataset@mysnapshot | ssh host-b zfs receive tank/mydataset

This would mean @mysnapshot would be identical on both host-a and host-b.

On the other hand, on host-a I could: zfs snapshot tank/mydataset@mysnapshot followed by ssh host-b zfs snapshot tank/mydataset@mysnapshot.

In this second case, the two snapshots are identically named, but the dataset may be wildly different.

Looking at the properties of tank/mydataset@mysnapshot doesn't list any apparent way of identifying if the snapshots are identical--i.e. a GUID or hash.

Other than trying to take another snapshot of host-a tank/mydataset@mysnapshot2 and trying to send to host-b via zfs send -i @mysnapshot tank/mydataset@mysnapshot2 | ssh host-b zfs receive tank/mydataset is there a way of determining that the snapshots are identical not only in name, but blocks?

I created a 'homes' share in Samba, tested, and then moved all our user profiles over to it.

[homes]
    comment = User Profiles
    path = /tank/users/%U
    valid users = %U
    browseable = no
    writable = yes
    hide dot files = yes

During testing I had no problems with my test profiles. I would sign in to Windows as 'aaron', and it would find my folder under /tank/users/aaron.

Then I moved it in to production and moved everyone over to the new server.

I immediately got calls from users that their desktops were gone. After some digging, I found that some users were signing in as 'JSmith' which Samba translated into looking for /tank/users/JSmith instead of /tank/users/jsmith. As a stop-gap, I simply renamed their folders to the case they were using to sign in.

But I still get sporadic calls from users who suddenly to decide to sign in as 'Jsmith' one day, 'JSmith' another day, 'jsmith' the following day, and even 'JSMITH' because they left their capslock on.

Digging through the samba docs, I don't see a way to force that path to be all lower-case regardless of what the user enters on the login screen.

Am I missing something? Seems like this would be a frequent problem for people hosting files on Samba.

In Active Directory, you can map IP addresses to Client Sites.

...and then you can map Group Policy objects to sites.

Which is great and all, but I have a client that is growing rapidly, and they expect to have hundreds of sites in the next year or two.

Our naming standard is loosely based on LOCODE, so every site is 7 characters--for example 'USHQZOF'. That prefix is used to name every machine.

I'm getting sick of creating the same basic policy everywhere.

It literally follows the format:

• Map drive O to \\USHQZOFSRV01\officeshare
• Map primary printer to \\USHQZOFSRV01\copier

I'd really love it if I could create a policy where I can say:

• Map drive O to \\(site-name-from-ad)SRV01\officeshare
• Map primary printer to \\(site-name-from-ad)SRV01\copier

...and be done with it for good.

It appears you can use a ton of environment variables in your Group Policy Preferences (https://technet.microsoft.com/en-us/library/Cc753915.aspx), but I don't see anything for the Client Site Name.

Am I out of luck, or do I need to go 'old school' and call a cscript/vbscript file during login that looks it up and maps the appropriate items?

(edit: I know it can be done with a VBS file--I've done it before. It just seems...unclean...)

Is there a way to allow users to change their passwords from a web page in Windows?

We have a client that has hundreds of 'kiosk' workstations because all the users use web services that have their own logins. All the machines are domain-joined and they sign in to one account automatically.

One of the 'web apps' users sign in to relies on each individual having an account in active directory. When a user forgets their AD password, we would like to reset it to a default password that everyone in the company knows, and we tell the user to go reset it.

On a 'normal' windows network, they would hit CTRL+ALT+DEL, put in their username and the default password, and then be prompted to change it.

...but on a kiosk network, they are already signed in to the generic account, and the web app has no way of forcing the password change. So they still can't sign in. We also can't enforce policies of expiring passwords every $x months.

I know Outlook Web Access has a form built-in for allowing users to change passwords. Unfortunately, this client doesn't use Outlook Web Access.

Is there a 3rd party utility or a better way of allowing users to change their passwords? Even a desktop app we can tell them to run to enter a username, default password, new password, and a confirmation would be useful.

Try as I might, I can't figure out why this server randomly timestamps syslog entries with bad time.

Here's a 5-minute stretch of syslog from a few minutes ago. You'll notice there are two places where the time is logged wrong. Once where it logs it as January 10th (off by ~4 days) and another where it logs it as November 16th (either ~2 months behind or ~10 months ahead--can't tell since syslog doesn't log the year):

Jan 14 18:25:01 tetrad CRON[15482]: (root) CMD (zfs-auto-snapshot -q -g --label=frequent --keep=12  //)
Jan 14 18:25:01 tetrad CRON[15483]: (root) CMD (if [ -x /etc/munin/plugins/apt_all ]; then munin-run apt_all update 7200 12 >/dev/null; elif [ -x /etc/munin/plugins/apt ]; then munin-run apt update 7200 12 >/dev/null; fi)
Jan 14 18:25:03 tetrad zfs-auto-snap: @zfs-auto-snap_frequent-2015-01-15-0225, 1 created, 1 destroyed, 0 warnings.
Jan 14 18:26:54 tetrad puppet-master[31196]: message repeated 2 times: [ Could not find default node or by name with 'kvm4.virt.pne.local, kvm4.virt.pne, kvm4.virt, kvm4' on node kvm4.virt.pne.local]
>> Jan 10 00:00:01 tetrad CRON[18094]: (root) CMD (if [ -x /etc/munin/plugins/apt_all ]; then munin-run apt_all update 7200 12 >/dev/null; elif [ -x /etc/munin/plugins/apt ]; then munin-run apt update 7200 12 >/dev/null; fi)
Jan 14 18:27:01 tetrad CRON[18094]: (root) CMD (/usr/local/bin/lockrun --lockfile=/root/updatecw.lock -- /root/sqlworkbench/updatecw.sh > /dev/null)
Jan 14 18:28:02 tetrad fetchmail[7149]: message repeated 51 times: [ Warning: the connection is insecure, continuing anyways. (Better use --sslcertck!)]
>> Nov 16 23:45:01 tetrad CRON[20554]: (root) CMD (if [ -x /etc/munin/plugins/apt_all ]; then munin-run apt_all update 7200 12 >/dev/null; elif [ -x /etc/munin/plugins/apt ]; then munin-run apt update 7200 12 >/dev/null; fi)
Jan 14 18:29:04 tetrad fetchmail[7149]: Warning: the connection is insecure, continuing anyways. (Better use --sslcertck!)
Jan 14 18:29:58 tetrad kernel: [7713426.484590] ip_set: protocol 6

I have verified the timezone settings are correct on the box, and I've completely stopped rsyslogd and started it again. I can even leave a loop running on the box for hours without an error:

while true; do date; sleep 1; done

...so it doesn't appear to be an issue with the clock. Reviewing 10,000+ lines of 'date' output in the console sucks! ;)

I should point out that I've only ever seen it when logging a CRON action. The cron jobs are not long running, and I've even tested by commenting out all the jobs in cron for a day. No false time entries.

Any thoughts?

I have a FreeBSD appliance (meaning I can't open the case or I will void the warranty) that was working well until I accidentally clicked 'Enable Serial Console' and rebooted...

I went to plug in my serial cable and found the device has no serial port. Consequently the device starts to boot and hangs.

Is there any way to disable the serial console from the FreeBSD bootloader prompt?

I am testing the possibility of migrating from an old Avaya phone system to AsteriskNow. The migration would cover several hundred phones--but spread out over several years. (Management wants to move buildings to the new phone system one by one as cables get cut or time permits.)

Two other directive is that extensions must not change and they want a GUI that other admins (non-Linux geeks) can manage.

They currently use 9XXX for all extensions.

We linked the Avaya and Asterisk box via PRI card and they both are communicating. From the Avaya side, if we move (for example) extension 9001 to Asterisk, we forward the call over the PRI to the AsteriskNow box and the SIP phone rings.

In AsteriskNow we have an outgoing rule '_9XXX' that routes all 4-digit extensions starting with 9 back to Avaya.

Here's the trouble. Dialing 9001 (the extension moved over to AsteriskNow) causes the call to be routed out the PRI to the Avaya box, then the Avaya box routes the call back to Asterisk, and Asterisk routes it to the SIP phone.

As we get more and more users switched over, it will use up more and more channels over the PRI card.

Is there a way I can ask Asterisk to check it's local extensions first--then forward off to the Avaya system if it starts with '_9XXX'? (I know how I can do it when editing the raw config files, I'm just looking for a way to do it in the GUI so other admins can manage it if necessary.)

As a last-ditch plan, I know I can specifically add '_9001' as an outgoing call rule and sent it directly to extension 9001--but I'd really hate to do that for several hundred phones

I have a failed hardware RAID card. This card had two drives in a RAID-1 mirror. Plugging one of the drives into the motherboard shows no partition table. Using a program like testdisk, I can see the partition table starts 32 blocks into the drive. Apparently the hardware RAID card uses the first 32 blocks for storing its config.

I can display the starting offset of a drive like so:

root@nas1:~# hdparm -g /dev/sdc
/dev/sdc:
 geometry      = 974/255/63, sectors = 15649200, start = 0

...but I can't seem to find a way to tell it to start at 63 blocks instead of 0. If the OS starts reading at 63, it will see the partition table.

Is that even possible under Linux?

I'm baffled as to why this isn't working.

I've tried redirecting STDOUT and STDERR using "&>" and also "2>&1" and neither seems to work. I still get e-mailed by this cron job (every minute!) with smbclient complaining that there are no files in the share.

* * * * * smbclient //scanner/scan-import secretpass -U administrator -c "prompt; mget *; del *" &> /dev/null

For the curious: A client has an old and expensive scanner that scans multiple documents at high speed--but the software has no way to configure the save location. They don't want the documents saved directly on the old XP workstation, so I've shared out the save location and use this cron job to automatically pull the documents over to their linux server.

I know I can generate an OpenVPN static key by 'openvpn --genkey --secret myfile.key'. In python, I am currently using a shell call to generate a key, open the 'myfile.key' and read it back in. It would be much cleaner if I could do it without the shell call.

Does anyone know what type of key is generated with the --genkey command, or a way to generate the key directly in Python?

I have an ancient celeron-based Windows 2003 SBS server on an old Dell machine. It has a very basic IDE non-RAID setup. The server is so old, it takes about 30 minutes to boot up and log in.

A new Dell (ugh!) server was purchased with the intent of doing a ghost from one server to the other. The new server has a PERC6/i RAID controller in in w/ SATA drives.

Copying the data works fine (using linux 'dd'), but the server refuses to boot with 'STOP 0x0000007B (0xF789EA98, 0xC0000034, 0x00000000 0x00000000)'

In my experience, this has been due to Windows not having the drivers for the RAID controller.

To fix this, I would boot the old server, download the drivers for the new server, extract them, right-click on the .inf file and hit 'Install'. Then shutdown and start the copy process.

It's totally not working for me with this new Dell server. I am certain I have the correct drivers--I used the driver from the CD that came with the server, and I also went online and downloaded the correct driver. But the new server refuses to boot.

Does anyone with more experience with this have any pointers?

After last months batch of Windows updates, no one can RDP into their machines.

Doing a bunch of testing turns up that you can't connect to ANY of the ports on the machine. Stopping the 'Base Filtering Engine' immediately makes the box perform like a 'normal' Windows workstation.

It also doesn't appear to be any of the services dependent on BFE either--I tried stopping those one-by-one and it didn't fix the issue.

I tried stopping the Windows Firewall Service, and that didn't fix it. I stopped their eTrust antivirus too.

Whenever the BFE service is running, you can't connect to anything on the machine. Any pointers? Google returns a ton of problems with BFE failing to start, but nothing that I can find about it denying all inbound traffic. This happens on both Windows 7 and Windows Vista boxes.

Is there a way to monitor the exchange logs in realtime like using 'tail -f /var/log/mail.log' in linux? The GUI tools for exchange under SBS 2008 suck for looking at what's going on in realtime.

I have two Panasonic Toughbook CF-30 machines setup from the same installer CD. Both machines were joined to the domain and moved into the same OU. Both machines have no errors in the event logs on startup. One machine gets the 'AutoLogon' group policy which contains the registry entries to get Vista to autologon, the other machines does NO registry processing from any policy that has registry settings.

The working machine logs Event ID 4016 from GroupPolicy which says 'Starting Group Policy Registry Extension Processing. List of applicable policy objects: (No changes detected.) AutoLogon Policy'

The other machine does not have any events which mention registry processing.

Any pointers on where to dig / what to try next?

I client of mine requested that rename one of their lists from 'All Associate Doctors' to just 'Associate Doctors'. I made the appropriate changes in Active Directory and am running into a problem with several of the Outlook 2003 clients on their network.

When most users click in the 'to' field of a new message and type 'a', a drop-down appears with all email addresses starting with 'a', including the old 'All Associate Doctors' list. It does not include the 'Associate Doctors' list. If they pick 'All Associate Doctors' from that drop-down and send the email, it bounces because the list doesn't exist anymore.

This stupid drop-down doesn't appear to be tied to the Outlook Contacts folder, or the Global Address List. It appears to be a list of everything ever typed into the 'to' box.

I tested this by addressing a message to 'joe1' and hitting send. It obviously bounced. Then I created a new message and put 'j' in the to box. Sure enough, joe1 is listed--and it shows up before the actual address 'joea'.

Apparently you can delete items from the list by typing in 'a' and then hitting the delete key for every item on the list.

Does anyone have a better way to clear this list of invalid addresses? Even better, can I set it to actually query the Global Address List or the local Contacts folder? I would even be happy disabling it rather than have people constantly mis-addressing messages.

We have an environment that requires laptops to login as a local user even through the machine is joined to the domain.

With XP, we could push out registry keys: DefaultUserName = 'ALocalUser' DefaultPassword = 'ThePassword' DefaultDomainName = '' AutoAdminLogon = 1 ForceAutoLogon = 1

Leaving the default domain name empty would cause Windows XP to default back to logging in to the local machine instead of the domain.

In Vista leaving it blank causes an error 'The user name or password is incorrect.' along with the username being displayed as '.\ALocalUser'

I have tried deleting the DefaultDomainName key I have tried setting it to a blank string I have tried setting it to '.'

Nothing seems to let it login short of explicitly putting in the name of the local machine. This is a major pain in the rear when I am trying to deploy those registry settings to 8 machines spread across 100 miles.

Does anyone know of a work-around or see something I'm doing wrong?