Home / user-195875

Anthony Fornito's questions

Martin Hope
Anthony Fornito
Asked: 2018-01-13 15:27:07 +0800 CST
  • 14

I have been looking into MTTF, MTBF, MTBR and MTBF for out HP Gen9 servers running in our production environment.

Root of my question, should be worried or not.

I cannot seem to get any good data as each server has a mix of hardware.

At my last company we ran about 2000 dell server r210 r410 r710 I would say on average we had about 5 servers a day that had some sort of failure. So about 0.25% of the server went hard down and needed to have a part replaced before being able to be used again.

My last company everything was setup in an HA pair, N+2 infrastructure so there was not impact to production. We were able to replace the servers and keep going

At my current office, we run 9 servers, (HP Gen9, 56 VM's Hyper-V) we do not keep a lot of replacement parts on hand also out datacenter is not managed so if something dies we have to drive about 45 minutes to replace anything.

My CTO nor IT manager seem to be worried, they have had about 2.5 days of downtime last year, I have been auguring we need to cluster the servers but they do not see a need.

Is there a wrong or right here? Not sure what to do.

I know its not my responsibility if something happens its on the CTO. This is a very small company only the CTO, IT Manager, myself (dev ops)and 1 help desk guy.

Over all experience in running a production environment, is very limited, the way a lot of things are setup I would call very junior level, neither my CTO nor IT Manager knew alot about clustering before I got there. They were in the middle of a project to setup DR without HA, which I augured against but lost.

hyper-v
Martin Hope
Anthony Fornito
Asked: 2018-01-11 09:54:08 +0800 CST
  • 16

I am getting ready to move my production environment from server 2012 R2 to server 2016

I want to do a clean install and in doing some inventory really only have two server I can use for staging, I want to be able to do a clean install.

I have read a couple articles about what is best practice for installing active directory and hyper-v same server.

My application is very light weight ant this will be a staggered migration, so my plan is to use two server (2016 datacenter), cluster them, add the 2012 guests one by one (rolling upgrade), and then when clean add them to the server 2016 I have in production.

What i would like to do is add AD DS to my two servers create a sub-domain replicate AD, and add also add the hyper-v role, along with DNS Server, Failover Clustering, File and Storage Services, Multipath I/O

Would there be any conflicts.

hyper-v
Martin Hope
Anthony Fornito
Asked: 2017-11-14 09:06:26 +0800 CST
  • 12

Environment,

Web server - Server 2012 R2, IIS 8, ASP.NET application

Firewall Cisco 5515

Un-Managed HP switches, No vlaning

Client has been using Curl from the outside to hit our application.

No one else should be using the server.

Using wireshark i can see, If I have TLS 1.2 enabled, every time they hit the server at the end there is a RST

If i disable TLS 1.2 there is no packet RST and everything looks fine.

What could be causing this?

Please let me know if you need anymore info.

windows-server-2012-r2
Martin Hope
Anthony Fornito
Asked: 2017-09-28 12:46:14 +0800 CST
  • 12

We have two IIS 8.5 web servers, Server 2012 R2

Server1

Server2

I am trying to find a powershell command that will sync only changes made on Server1 to Server2

I tried shared configurations however that will sync the bindings as well and I do not want that as they are load balanced. Also I am trying to avoiding adding unneeded bindings to servers to make it work.

I found a couple webdeploy powershell commands however that looks like it wants to sync files as well, we use DFS to sync the files.

All I want to be able to do is sync changes from the Server1 applicationhost.config or web.config to Server2

powershell
Martin Hope
Anthony Fornito
Asked: 2017-09-08 09:05:07 +0800 CST
  • 12

I have 2 hosts both with Server 2016 Datacenter

On each host I have 2 VM's currently Dev using shared storage

I can do all the cluster things ie., Live migrate, move storage,

I have been looking all over google for a script to be able to save all the vm's in the cluster at the same time.

If i run this:

$clusterNodes = Get-ClusterNode;
$Name = ForEach($item in $clusterNodes){Get-VM -ComputerName $item.Name; }
{save-VM -ComputerName $item.Name; }

It will save the vm's however It will prompt me twice for the names of the VM's once for each host.

My over all goal is to be able to reconfigure all the VM's in the cluster from one PC, also the vm's move around a lot so they are not always on the same host.

Example:

Save all the vm's

Move the off os the shared storage:

Set-VM pv02 -SnapshotFileLocation C:\ClusterStorage\Volume1\pv02
Set-VM pv02 -SmartPagingFilePath C:\ClusterStorage\Volume1\pv02
Set-VMHardDiskDrive -VMName  pv02 -ControllerType SCSI -Path C:\ClusterStorage\Volume1\pv02\pv02.vhdx

Start the VM's

If i log into each host individually the command will run fine, however in my production I have 7 hosts with about 100 VM's.

powershell
Martin Hope
Anthony Fornito
Asked: 2017-09-06 13:36:28 +0800 CST
  • 13

How can i reconfigure Hyper-V VM's

I want to be able to change the VM configuration file, check points, and virtual hard drive locations with Powershell.

My Google-FU is only pointing me at moving, I have about ~100 VM's to Change, I can move the files, I do not mind a little downtime, When walking throught the wizard for each VM it takes about 5 to 15 minutes per VM and those are the smaller ones, I need to be able to do all 100 in 2 hours.

If i need to clarify please let me know.

==Where I am getting stuck==

Yes i have seen that link and looked at most of the commands however none do what I am looking for.

The files all together are about 14 TB

The ~100 VM's are clustered between 7 Hosts. The shared storage is EMC spinning disk and I want to move them to 3Par ssd.

Now, what I have been able to do successfully was shut the VM's down, move the files, delete all the VM's and recreate them VIA powershell, which when I told my CTO that may be the only way he about shit kittens.

What i want to be able to is not MOVE the VM's just RECONFIGURE them,

In other works be able to change:

enter image description here

TO:

enter image description here

I want to be able to do this using powershell, Also i need to be able to do the same thing for the checkpoints, and configuration files, and all other Hyper-V VM components.

I can tolerate about 2 hours of downtime, to do the MOVE through the wizard for all the VM's will not only wear out my mouse but take about 6 hours.

I have also been researching this and testing out different strategies for a couple weeks now.

====One More Shot====

I am not looking to "Move" all i want to be able to do is change the settings from within hyper-V moving will take way to long, it is much quicker for me to copy the files over the network and just update the paths in Hyper-V, I can shut the machines down.

Im thinking it cannot be done?

powershell
Martin Hope
Anthony Fornito
Asked: 2017-07-11 13:33:10 +0800 CST
  • 12

I have two fresh installs of Windows server 2016

Everytime I try to run Configuration Manager Client (5.00.8458.1000) i get an error

Configuration Manager Client (5.00.8458.1000) - Error 0x80070643

I have disabled UAC

Ran C:\Windows\SoftwareDistribution\Download\Install\ccmsetup.exe as administrator and from the local administrator account

Most everything I find online refers to Server 2012 r2, trying as many as I can find makes no difference.

My question, is Configuration Manager Client update important?

It is the only update I see when running windows update so i am concerned there are more updates that are dependent on it.

Yes PC Is joined to domain

No i am not running SCCM anywhere.

On each server:

[X] File and Storage Services                           FileAndStorage-Services        Installed
    [X] File and iSCSI Services                         File-Services                  Installed
        [X] File Server                                 FS-FileServer                  Installed
    [X] Storage Services                                Storage-Services               Installed
[X] Hyper-V                                             Hyper-V                        Installed
[X] .NET Framework 4.6 Features                         NET-Framework-45-Fea...        Installed
    [X] .NET Framework 4.6                              NET-Framework-45-Core          Installed
    [X] WCF Services                                    NET-WCF-Services45             Installed
        [X] TCP Port Sharing                            NET-WCF-TCP-PortShar...        Installed
[X] Failover Clustering                                 Failover-Clustering            Installed
[X] Multipath I/O                                       Multipath-IO                   Installed
[X] Remote Server Administration Tools                  RSAT                           Installed
    [X] Feature Administration Tools                    RSAT-Feature-Tools             Installed
        [X] Failover Clustering Tools                   RSAT-Clustering                Installed
            [X] Failover Cluster Management Tools       RSAT-Clustering-Mgmt           Installed
            [X] Failover Cluster Module for Windows ... RSAT-Clustering-Powe...        Installed
    [X] Role Administration Tools                       RSAT-Role-Tools                Installed
        [X] Hyper-V Management Tools                    RSAT-Hyper-V-Tools             Installed
            [X] Hyper-V GUI Management Tools            Hyper-V-Tools                  Installed
            [X] Hyper-V Module for Windows PowerShell   Hyper-V-PowerShell             Installed
[X] SMB 1.0/CIFS File Sharing Support                   FS-SMB1                        Installed
[X] Windows Defender Features                           Windows-Defender-Fea...        Installed
    [X] Windows Defender                                Windows-Defender               Installed
    [X] GUI for Windows Defender                        Windows-Defender-Gui           Installed
[X] Windows PowerShell                                  PowerShellRoot                 Installed
    [X] Windows PowerShell 5.1                          PowerShell                     Installed
    [X] Windows PowerShell ISE                          PowerShell-ISE                 Installed
[X] WoW64 Support                                       WoW64-Support                  Installed

C:\Windows\ccmsetup\Logs\ccmsetup.log

<![LOG[==========[ ccmsetup started in process 2544 ]==========]LOG]!><time="17:26:40.078+240" date="07-10-2017" component="ccmsetup" context="" type="1" thread="7240" file="ccmsetup.cpp:9498">
<![LOG[Updated security on object C:\Windows\ccmsetup\cache\.]LOG]!><time="17:26:40.078+240" date="07-10-2017" component="ccmsetup" context="" type="0" thread="7240" file="ccmsetup.cpp:9342">
<![LOG[Launch from folder C:\Windows\SoftwareDistribution\Download\Install\]LOG]!><time="17:26:40.078+240" date="07-10-2017" component="ccmsetup" context="" type="1" thread="7240" file="ccmsetup.cpp:627">
<![LOG[CcmSetup version: 5.0.8458.1007]LOG]!><time="17:26:40.078+240" date="07-10-2017" component="ccmsetup" context="" type="1" thread="7240" file="ccmsetup.cpp:633">
<![LOG[Folder 'Microsoft\Microsoft\Configuration Manager' not found. Task does not exist.]LOG]!><time="17:26:40.078+240" date="07-10-2017" component="ccmsetup" context="" type="0" thread="7240" file="wintask.cpp:648">
<![LOG[Folder 'Microsoft\Microsoft\Configuration Manager' not found. Task does not exist.]LOG]!><time="17:26:40.078+240" date="07-10-2017" component="ccmsetup" context="" type="0" thread="7240" file="wintask.cpp:648">
<![LOG[[ACD-FO3] Running on 'Microsoft Windows Server 2016 Datacenter Evaluation' (10.0.14393). Service Pack (0.0). SuiteMask = 400. Product Type = 18]LOG]!><time="17:26:40.125+240" date="07-10-2017" component="ccmsetup" context="" type="1" thread="7240" file="util.cpp:2075">
<![LOG[Ccmsetup command line: "C:\Windows\SoftwareDistribution\Download\Install\ccmsetup.exe" ]LOG]!><time="17:26:40.125+240" date="07-10-2017" component="ccmsetup" context="" type="1" thread="7240" file="ccmsetup.cpp:3813">
<![LOG[Local Machine is joined to an AD domain]LOG]!><time="17:26:40.125+240" date="07-10-2017" component="ccmsetup" context="" type="0" thread="7240" file="lsad.cpp:768">
<![LOG[Current AD forest name is autoscribe.com, domain name is autoscribe.com]LOG]!><time="17:26:40.250+240" date="07-10-2017" component="ccmsetup" context="" type="1" thread="7240" file="lsad.cpp:896">
<![LOG[Domain joined client is in Intranet]LOG]!><time="17:26:40.250+240" date="07-10-2017" component="ccmsetup" context="" type="1" thread="7240" file="lsad.cpp:1122">
<![LOG[DhcpGetOriginalSubnetMask entry point is supported.]LOG]!><time="17:26:40.250+240" date="07-10-2017" component="ccmsetup" context="" type="0" thread="7240" file="ccmiputil.cpp:117">
<![LOG[Begin checking Alternate Network Configuration]LOG]!><time="17:26:40.250+240" date="07-10-2017" component="ccmsetup" context="" type="0" thread="7240" file="ccmiputil.cpp:1095">
<![LOG[Finished checking Alternate Network Configuration]LOG]!><time="17:26:40.250+240" date="07-10-2017" component="ccmsetup" context="" type="0" thread="7240" file="ccmiputil.cpp:1172">
<![LOG[Adapter {B8FE7238-D527-4919-A40A-50BB111B3575} is DHCP enabled. Checking quarantine status.]LOG]!><time="17:26:40.250+240" date="07-10-2017" component="ccmsetup" context="" type="0" thread="7240" file="ccmiputil.cpp:436">
<![LOG[Adapter {B73BEA2F-3662-4CDB-AB5A-7C106DDD5BC5} is DHCP enabled. Checking quarantine status.]LOG]!><time="17:26:40.250+240" date="07-10-2017" component="ccmsetup" context="" type="0" thread="7240" file="ccmiputil.cpp:436">
<![LOG[Current AD site of machine is SRV1]LOG]!><time="17:26:40.250+240" date="07-10-2017" component="ccmsetup" context="" type="1" thread="7240" file="lsad.cpp:824">
<![LOG[Attempting to query AD for assigned site code]LOG]!><time="17:26:40.250+240" date="07-10-2017" component="ccmsetup" context="" type="0" thread="7240" file="lsad.cpp:2133">
<![LOG[Performing AD query: '(&(ObjectCategory=MSSMSRoamingBoundaryRange)(|(&(MSSMSRangedIPLow<=3232261336)(MSSMSRangedIPHigh>=3232261336))(&(MSSMSRangedIPLow<=3232251010)(MSSMSRangedIPHigh>=3232251010))(&(MSSMSRangedIPLow<=3232238296)(MSSMSRangedIPHigh>=3232238296))(&(MSSMSRangedIPLow<=3232253561)(MSSMSRangedIPHigh>=3232253561))(&(MSSMSRangedIPLow<=2851995933)(MSSMSRangedIPHigh>=2851995933))))']LOG]!><time="17:26:40.281+240" date="07-10-2017" component="ccmsetup" context="" type="0" thread="7240" file="lsad.cpp:710">
<![LOG[Performing AD query: '(&(ObjectCategory=mSSMSSite)(|(mSSMSRoamingBoundaries=192.168.100.0)(mSSMSRoamingBoundaries=192.168.60.0)(mSSMSRoamingBoundaries=192.168.10.0)(mSSMSRoamingBoundaries=192.168.70.0)(mSSMSRoamingBoundaries=169.254.0.0)(mSSMSRoamingBoundaries=SRV1)))']LOG]!><time="17:26:40.281+240" date="07-10-2017" component="ccmsetup" context="" type="0" thread="7240" file="lsad.cpp:710">
<![LOG[Failed to get assigned site from AD. Error 0x80004005]LOG]!><time="17:26:40.281+240" date="07-10-2017" component="ccmsetup" context="" type="2" thread="7240" file="ccmsetup.cpp:260">
<![LOG[GetADInstallParams failed with 0x80004005]LOG]!><time="17:26:40.281+240" date="07-10-2017" component="ccmsetup" context="" type="3" thread="7240" file="ccmsetup.cpp:300">
<![LOG[SslState value: 224]LOG]!><time="17:26:40.281+240" date="07-10-2017" component="ccmsetup" context="" type="0" thread="7240" file="ccmsetup.cpp:4587">
<![LOG[Ccmsetup was run without any user parameters specified. Running without registering ccmsetup as a service.]LOG]!><time="17:26:40.281+240" date="07-10-2017" component="ccmsetup" context="" type="1" thread="7240" file="ccmsetup.cpp:4652">
<![LOG[No sitecode is specified or detected. Assume AUTO sitecode.]LOG]!><time="17:26:40.281+240" date="07-10-2017" component="ccmsetup" context="" type="1" thread="7240" file="ccmsetup.cpp:4656">
<![LOG[CCMHTTPPORT:    80]LOG]!><time="17:26:40.281+240" date="07-10-2017" component="ccmsetup" context="" type="1" thread="7240" file="ccmsetup.cpp:8730">
<![LOG[CCMHTTPSPORT:    443]LOG]!><time="17:26:40.281+240" date="07-10-2017" component="ccmsetup" context="" type="1" thread="7240" file="ccmsetup.cpp:8742">
<![LOG[CCMHTTPSSTATE:    224]LOG]!><time="17:26:40.281+240" date="07-10-2017" component="ccmsetup" context="" type="1" thread="7240" file="ccmsetup.cpp:8757">
<![LOG[CCMHTTPSCERTNAME:    ]LOG]!><time="17:26:40.281+240" date="07-10-2017" component="ccmsetup" context="" type="1" thread="7240" file="ccmsetup.cpp:8772">
<![LOG[FSP:    ]LOG]!><time="17:26:40.281+240" date="07-10-2017" component="ccmsetup" context="" type="1" thread="7240" file="ccmsetup.cpp:8813">
<![LOG[CCMFIRSTCERT:    1]LOG]!><time="17:26:40.281+240" date="07-10-2017" component="ccmsetup" context="" type="1" thread="7240" file="ccmsetup.cpp:8859">
<![LOG[No MP or source location has been explicitly specified.  Trying to discover a valid content location...]LOG]!><time="17:26:40.297+240" date="07-10-2017" component="ccmsetup" context="" type="1" thread="7240" file="ccmsetup.cpp:4907">
<![LOG[Looking for MPs from AD...]LOG]!><time="17:26:40.297+240" date="07-10-2017" component="ccmsetup" context="" type="1" thread="7240" file="ccmsetup.cpp:4915">
<![LOG[Current AD forest name is autoscribe.com, domain name is autoscribe.com]LOG]!><time="17:26:40.297+240" date="07-10-2017" component="ccmsetup" context="" type="1" thread="7240" file="lsad.cpp:896">
<![LOG[Domain joined client is in Intranet]LOG]!><time="17:26:40.297+240" date="07-10-2017" component="ccmsetup" context="" type="1" thread="7240" file="lsad.cpp:1122">
<![LOG[DHCP entry points already initialized.]LOG]!><time="17:26:40.297+240" date="07-10-2017" component="ccmsetup" context="" type="0" thread="7240" file="ccmiputil.cpp:75">
<![LOG[Begin checking Alternate Network Configuration]LOG]!><time="17:26:40.297+240" date="07-10-2017" component="ccmsetup" context="" type="0" thread="7240" file="ccmiputil.cpp:1095">
<![LOG[Finished checking Alternate Network Configuration]LOG]!><time="17:26:40.297+240" date="07-10-2017" component="ccmsetup" context="" type="0" thread="7240" file="ccmiputil.cpp:1172">
<![LOG[Adapter {B8FE7238-D527-4919-A40A-50BB111B3575} is DHCP enabled. Checking quarantine status.]LOG]!><time="17:26:40.297+240" date="07-10-2017" component="ccmsetup" context="" type="0" thread="7240" file="ccmiputil.cpp:436">
<![LOG[Adapter {B73BEA2F-3662-4CDB-AB5A-7C106DDD5BC5} is DHCP enabled. Checking quarantine status.]LOG]!><time="17:26:40.297+240" date="07-10-2017" component="ccmsetup" context="" type="0" thread="7240" file="ccmiputil.cpp:436">
<![LOG[Current AD forest name is autoscribe.com, domain name is autoscribe.com]LOG]!><time="17:26:40.297+240" date="07-10-2017" component="ccmsetup" context="" type="1" thread="7240" file="lsad.cpp:896">
<![LOG[Domain joined client is in Intranet]LOG]!><time="17:26:40.297+240" date="07-10-2017" component="ccmsetup" context="" type="1" thread="7240" file="lsad.cpp:1122">
<![LOG[Current AD site of machine is SRV1]LOG]!><time="17:26:40.297+240" date="07-10-2017" component="ccmsetup" context="" type="1" thread="7240" file="lsad.cpp:824">
<![LOG[Attempting to query AD for assigned site code]LOG]!><time="17:26:40.297+240" date="07-10-2017" component="ccmsetup" context="" type="0" thread="7240" file="lsad.cpp:2133">
<![LOG[Performing AD query: '(&(ObjectCategory=MSSMSRoamingBoundaryRange)(|(&(MSSMSRangedIPLow<=3232261336)(MSSMSRangedIPHigh>=3232261336))(&(MSSMSRangedIPLow<=3232251010)(MSSMSRangedIPHigh>=3232251010))(&(MSSMSRangedIPLow<=3232238296)(MSSMSRangedIPHigh>=3232238296))(&(MSSMSRangedIPLow<=3232253561)(MSSMSRangedIPHigh>=3232253561))(&(MSSMSRangedIPLow<=2851995933)(MSSMSRangedIPHigh>=2851995933))))']LOG]!><time="17:26:40.312+240" date="07-10-2017" component="ccmsetup" context="" type="0" thread="7240" file="lsad.cpp:710">
<![LOG[Performing AD query: '(&(ObjectCategory=mSSMSSite)(|(mSSMSRoamingBoundaries=192.168.100.0)(mSSMSRoamingBoundaries=192.168.60.0)(mSSMSRoamingBoundaries=192.168.10.0)(mSSMSRoamingBoundaries=192.168.70.0)(mSSMSRoamingBoundaries=169.254.0.0)(mSSMSRoamingBoundaries=SRV1)))']LOG]!><time="17:26:40.312+240" date="07-10-2017" component="ccmsetup" context="" type="0" thread="7240" file="lsad.cpp:710">
<![LOG[Failed to get assigned site from AD. Error 0x80004005]LOG]!><time="17:26:40.312+240" date="07-10-2017" component="ccmsetup" context="" type="2" thread="7240" file="ccmsetup.cpp:260">
<![LOG[GetADInstallParams failed with 0x80004005]LOG]!><time="17:26:40.312+240" date="07-10-2017" component="ccmsetup" context="" type="3" thread="7240" file="ccmsetup.cpp:300">
<![LOG[Couldn't find an MP source through AD. Error 0x80004005]LOG]!><time="17:26:40.312+240" date="07-10-2017" component="ccmsetup" context="" type="1" thread="7240" file="ccmsetup.cpp:4932">
<![LOG[Current directory 'C:\Windows\SoftwareDistribution\Download\Install' is not a valid source location.]LOG]!><time="17:26:40.312+240" date="07-10-2017" component="ccmsetup" context="" type="1" thread="7240" file="ccmsetup.cpp:4969">
<![LOG[No valid source or MP locations]LOG]!><time="17:26:40.312+240" date="07-10-2017" component="ccmsetup" context="" type="3" thread="7240" file="state.h:54">
<![LOG[Failed to get client version for sending state messages. Error 0x8004100e]LOG]!><time="17:26:40.312+240" date="07-10-2017" component="ccmsetup" context="" type="2" thread="7240" file="state.cpp:164">
<![LOG[[] Params to send '5.0.8458.1007 Deployment "C:\Windows\SoftwareDistribution\Download\Install\ccmsetup.exe" ']LOG]!><time="17:26:40.312+240" date="07-10-2017" component="ccmsetup" context="" type="0" thread="7240" file="state.cpp:209">
<![LOG[A Fallback Status Point has not been specified and no client was installed.  Message with STATEID='322' will not be sent.]LOG]!><time="17:26:40.312+240" date="07-10-2017" component="ccmsetup" context="" type="1" thread="7240" file="state.cpp:240">
<![LOG[Failed to send status 322. Error (87D00215)]LOG]!><time="17:26:40.312+240" date="07-10-2017" component="ccmsetup" context="" type="3" thread="7240" file="state.cpp:253">
<![LOG[Failed to connect to policy namespace. Error 0x8004100e]LOG]!><time="17:26:40.312+240" date="07-10-2017" component="ccmsetup" context="" type="3" thread="7240" file="localpolicy.cpp:367">
<![LOG[Failed to revoke client upgrade local policy. Error 0x8004100e]LOG]!><time="17:26:40.312+240" date="07-10-2017" component="ccmsetup" context="" type="3" thread="7240" file="localpolicy.cpp:394">
<![LOG[CcmSetup failed with error code 0x80004005]LOG]!><time="17:26:40.312+240" date="07-10-2017" component="ccmsetup" context="" type="1" thread="7240" file="ccmsetup.cpp:10711">
windows-update
Martin Hope
Anthony Fornito
Asked: 2017-03-29 07:51:25 +0800 CST
  • 14

I am taking over a project and the local domain name is domain.com; they also have a website at domain.com.

I have always used domain.local for AD, and am wondering if that is a best practice or is there a reason for not doing so.

Running an nslookup internal for domain.com does resolve to the proper IP and the rDNS records are configured correctly.

I would like to start connecting some of the servers and the vCSA through LDAP, and am wondering if this might start causing problems?

domain-name-system
Martin Hope
Anthony Fornito
Asked: 2017-01-12 12:11:11 +0800 CST
  • 15

I are using a product from a vendor that has to use Apache on Windows.

We have our own CA.

For naming purposes:

AppServer - Server2012r2 - Apache 2.4

OldCertsha1 - Server2012r2

NewCertsha2 - Server2012r2

I created the CSR on the AppServer using the two commands below.

genrsa –des3 –out name.sub.domain.com.key 2048

req –new –key name.sub.domain.com.key –out name.sub.domain.com.csr

Thats all goes fine 

req -noout -text -in name.sub.domain.com.csr
Certificate Request:
    Data:
    Version: 0 (0x0)
    Subject: C=xx, ST=xx, L=xx, O=xx, OU=xx, CN=name.sub.domain.com
    Subject Public Key Info:
        Public Key Algorithm: rsaEncryption
        RSA Public Key: (2048 bit)
            Modulus (2048 bit):
                e1:ae:5a:e8:26:81:fd:a0:49:f9:a3:c0:77:75:0f:
                e1:ae:5a:e8:26:81:fd:a0:49:f9:a3:c0:77:75:0f:
                e1:ae:5a:e8:26:81:fd:a0:49:f9:a3:c0:77:75:0f:
                e1:ae:5a:e8:26:81:fd:a0:49:f9:a3:c0:77:75:0f:
                e1:ae:5a:e8:26:81:fd:a0:49:f9:a3:c0:77:75:0f:
                e1:ae:5a:e8:26:81:fd:a0:49:f9:a3:c0:77:75:0f:
                e1:ae:5a:e8:26:81:fd:a0:49:f9:a3:c0:77:75:0f:
                e1:ae:5a:e8:26:81:fd:a0:49:f9:a3:c0:77:75:0f:
                e1:ae:5a:e8:26:81:fd:a0:49:f9:a3:c0:77:75:0f:
                e1:ae:5a:e8:26:81:fd:a0:49:f9:a3:c0:77:75:0f:
                e1:ae:5a:e8:26:81:fd:a0:49:f9:a3:c0:77:75:0f:
                e1:ae:5a:e8:26:81:fd:a0:49:f9:a3:c0:77:75:0f:
                e1:ae:5a:e8:26:81:fd:a0:49:f9:a3:c0:77:75:0f:
                e1:ae:5a:e8:26:81:fd:a0:49:f9:a3:c0:77:75:0f:
                e1:ae:5a:e8:26:81:fd:a0:49:f9:a3:c0:77:75:0f:
                e1:ae:5a:e8:26:81:fd:a0:49:f9:a3:c0:77:75:0f:
                321:rf
            Exponent: 65537 (0x10001)
    Attributes:
        a0:00
Signature Algorithm: sha1WithRSAEncryption
    aa:e4:b7:1d:9a:56:b4:22:e8:a5:1a:e8:43:1d:6f:ef:86:d8:
    aa:e4:b7:1d:9a:56:b4:22:e8:a5:1a:e8:43:1d:6f:ef:86:d8:
    aa:e4:b7:1d:9a:56:b4:22:e8:a5:1a:e8:43:1d:6f:ef:86:d8:
    aa:e4:b7:1d:9a:56:b4:22:e8:a5:1a:e8:43:1d:6f:ef:86:d8:
    aa:e4:b7:1d:9a:56:b4:22:e8:a5:1a:e8:43:1d:6f:ef:86:d8:
    aa:e4:b7:1d:9a:56:b4:22:e8:a5:1a:e8:43:1d:6f:ef:86:d8:
    aa:e4:b7:1d:9a:56:b4:22:e8:a5:1a:e8:43:1d:6f:ef:86:d8:
    aa:e4:b7:1d:9a:56:b4:22:e8:a5:1a:e8:43:1d:6f:ef:86:d8:
    aa:e4:b7:1d:9a:56:b4:22:e8:a5:1a:e8:43:1d:6f:ef:86:d8:
    aa:e4:b7:1d:9a:56:b4:22:e8:a5:1a:e8:43:1d:6f:ef:86:d8:
    aa:e4:b7:1d:9a:56:b4:22:e8:a5:1a:e8:43:1d:6f:ef:86:d8:
    aa:e4:b7:1d:9a:56:b4:22:e8:a5:1a:e8:43:1d:6f:ef:86:d8:
    aa:e4:b7:1d:9a:56:b4:22:e8:a5:1a:e8:43:1d:6f:ef:86:d8:
    aa:e4:b7:1d:9a:56:b4:22:e8:a5:1a:e8:43:1d:6f:ef:86:d8:
    aa:e4:b7:1d:9a:56:b4:22:e8:a5:1a:e8:43:1d:6f:ef:86:d8:
    aa:e4:b7:1d

Then on the CA server

https://NewCertsha2/CertSrv

Request a certificate

advanced certificate request.

Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file.

Open the CSR on the AppServer and paste the CSR info in the box

-----BEGIN CERTIFICATE REQUEST-----
MIIC0zCCAbsCAQAwgY0xCzAJBgNVBAYTAlVTMREwDwYDVQQIEwhNaWNoaWdhbjER
MA8GA1UEBxMIRGVhcmJvcm4xFjAUBgNVBAoTDWRmY3VmaW5hbmNpYWwxDDAKBgNV
BAsTA2l2cjEyMDAGA1UEAxMpcDAxMWRjMDEtY3JlYzAzLmNlbnRyYWwuZGZjdWZp
bmFuY2lhbC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCej1o0
EEq6UcgB4uhr9bYzA4u8pvxvaCE0JXCqW/8m8D2DBHnJFA2Ui4kEjQlKy1eRTfE0
6lRmowrsJVvvlz0pfsdfghksdkjfgsjskhgfksgfdfmjwHd1D/Bgg60AOPmUBIFl
rgaGcw9CasdkjlhaslkdjhsaklfjhdsfkhsldfjhsdlkjfhdlFOoGVtQdgticLqy
dzpLnAnqwezEnsdflsjhdfksdkfjhwsdkfjhLqKDx1b0z1n7tV4F8DS261dmm8+r
ONz9oYqZfdAFu55gG7sHgOn14P5gP2QIoV/c6CJ2hzbtlifKmZp2A+9F/csXTMIJ
w2sgfQzgv+UPEkH9AgMBAAGgADANBgkqhkiG9w0BAQUFAAOCAQEAMwjmg96iCLnB
uTF4LOoeA788NAt9cYdsWuaUsHptnw70Mj5wWIiaZYgY0hCvWPezRsgOfFrWinN0
y4n0trlyEYXJquBKZbxJZ2yscNMqOJyKl70Ckb83IwpIdhxRYr0JZffEmFlx+2yv
4rhFquS3HZpWtCLopRroQx1v74bYGZHBiz2cM4peowzqGrs8r5NKYYqLRiH00VTs
GEEB+Rihen4tnrn0Y1KLkumrSOrTghIrpQ0j2MZrmvhAIlcZ0W+6bJQcbl0lQ3Hv
STaH9EyIj+47jpMhpfazRPOjSDdFiokjchVDS0Wj/iQJlNDurU7xd+570gduZfcF
M4YoMCwv7Q==
-----END CERTIFICATE REQUEST-----

Template Web Server (10 Years)

Here I get two Choices

DER encoded or Base 64 encoded

No matter which one I select It downloads a .cer and a .p7b file

I did the same steps on the OldCertsha1 server and I get the same results

When i Edit the httpd-ssl.conf file add the following and restart the Apache2.4 service

SSLCertificateFile "E:/Apache24/conf/Certs/name.sub.domain.com.crt"

SSLCertificateKeyFile "E:/Apache24/conf/Certs/name.sub.domain.com.key"

I get the following errors, different errors for different types from the choices above (DER encoded or Base 64 encoded):

DER encoded:

[Wed Jan 11 08:37:44.471616 2017] [proxy:error] [pid 4804:tid 1780] (OS 10061)No connection could be made because the target machine actively refused it.  : AH00957: HTTP: attempt to connect to 127.0.0.1:8080 (127.0.0.1) failed
[Wed Jan 11 08:37:44.471616 2017] [proxy:error] [pid 4804:tid 1780] AH00959: ap_proxy_connect_backend disabling worker for (127.0.0.1) for 60s
[Wed Jan 11 08:37:44.471616 2017] [proxy_http:error] [pid 4804:tid 1780] [client ::1:61346] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://name.sub.domain.com/knoahsoft/faces/client/index1.jspx?_afPfm=5600447c
[Wed Jan 11 13:13:56.437605 2017] [ssl:emerg] [pid 20860:tid 540] AH02562: Failed to configure certificate name.sub.domain.com:443:0 (with chain), check E:/Apache24/conf/Certs/name.sub.domain.com.cer
[Wed Jan 11 13:13:56.437605 2017] [ssl:emerg] [pid 20860:tid 540] SSL Library Error: error:0906D06C:PEM routines:PEM_read_bio:no start line (Expecting: TRUSTED CERTIFICATE) -- Bad file contents or format - or even just a forgotten SSLCertificateKeyFile?
[Wed Jan 11 13:13:56.437605 2017] [ssl:emerg] [pid 20860:tid 540] SSL Library Error: error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib
[Wed Jan 11 13:14:14.375459 2017] [ssl:emerg] [pid 23800:tid 544] AH02562: Failed to configure certificate name.sub.domain.com:443:0 (with chain), check E:/Apache24/conf/Certs/name.sub.domain.com.cer
[Wed Jan 11 13:14:14.375459 2017] [ssl:emerg] [pid 23800:tid 544] SSL Library Error: error:0906D06C:PEM routines:PEM_read_bio:no start line (Expecting: TRUSTED CERTIFICATE) -- Bad file contents or format - or even just a forgotten SSLCertificateKeyFile?
[Wed Jan 11 13:14:14.375459 2017] [ssl:emerg] [pid 23800:tid 544] SSL Library Error: error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib

Base 64 encoded:

[Wed Jan 11 14:35:15.024474 2017] [ssl:emerg] [pid 141796:tid 508] AH02577: Init: SSLPassPhraseDialog builtin is not supported on Win32 (key file E:/Apache24/conf/Certs/name.sub.domain.com.key)
[Wed Jan 11 14:35:15.024474 2017] [ssl:emerg] [pid 141796:tid 508] AH02564: Failed to configure encrypted (?) private key name.sub.domain.com:443:0, check E:/Apache24/conf/Certs/name.sub.domain.com.key
[Wed Jan 11 14:35:15.024474 2017] [ssl:emerg] [pid 141796:tid 508] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Wed Jan 11 14:35:15.024474 2017] [ssl:emerg] [pid 141796:tid 508] SSL Library Error: error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error
[Wed Jan 11 14:35:15.024474 2017] [ssl:emerg] [pid 141796:tid 508] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Wed Jan 11 14:35:15.024474 2017] [ssl:emerg] [pid 141796:tid 508] SSL Library Error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error (Type=RSA)
[Wed Jan 11 14:35:15.024474 2017] [ssl:emerg] [pid 141796:tid 508] SSL Library Error: error:04093004:rsa routines:OLD_RSA_PRIV_DECODE:RSA lib
[Wed Jan 11 14:35:15.024474 2017] [ssl:emerg] [pid 141796:tid 508] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Wed Jan 11 14:35:15.024474 2017] [ssl:emerg] [pid 141796:tid 508] SSL Library Error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error (Type=PKCS8_PRIV_KEY_INFO)
[Wed Jan 11 14:36:12.355215 2017] [ssl:emerg] [pid 145468:tid 512] AH02577: Init: SSLPassPhraseDialog builtin is not supported on Win32 (key file E:/Apache24/conf/Certs/name.sub.domain.com.key)
[Wed Jan 11 14:36:12.355215 2017] [ssl:emerg] [pid 145468:tid 512] AH02564: Failed to configure encrypted (?) private key name.sub.domain.com:443:0, check E:/Apache24/conf/Certs/name.sub.domain.com.key
[Wed Jan 11 14:36:12.355215 2017] [ssl:emerg] [pid 145468:tid 512] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Wed Jan 11 14:36:12.355215 2017] [ssl:emerg] [pid 145468:tid 512] SSL Library Error: error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error
[Wed Jan 11 14:36:12.355215 2017] [ssl:emerg] [pid 145468:tid 512] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Wed Jan 11 14:36:12.355215 2017] [ssl:emerg] [pid 145468:tid 512] SSL Library Error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error (Type=RSA)
[Wed Jan 11 14:36:12.355215 2017] [ssl:emerg] [pid 145468:tid 512] SSL Library Error: error:04093004:rsa routines:OLD_RSA_PRIV_DECODE:RSA lib
[Wed Jan 11 14:36:12.355215 2017] [ssl:emerg] [pid 145468:tid 512] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Wed Jan 11 14:36:12.355215 2017] [ssl:emerg] [pid 145468:tid 512] SSL Library Error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error (Type=PKCS8_PRIV_KEY_INFO)

I read a couple articles saying CER and CRT files are interchangeable just rename them.

If I rename the cer to crt and update httpd-ssl.conf then I get a lot of errors in the logs about 100 of these:

[Wed Jan 11 14:06:43.943865 2017] [autoindex:error] [pid 70976:tid 1784] [client 10.1.41.110:50933] AH01276: Cannot serve directory E:/KnoahSoft/EmpPhotos/: No matching DirectoryIndex (index.html) found, and server-generated directory index forbidden by Options directive

Now the vendor put server.crt, server.cre, server.csr and server.key file that they loaded when the box was delivered, if i change the two lines in the httpd-ssl.conf back to what they had it will restart fine and everything works but I get the SSL warning

SSLCertificateFile "E:/Apache24/conf/Certs/server.crt"

SSLCertificateKeyFile "E:/Apache24/conf/Certs/server.key"

Can someone tell me what I might be doing wrong, if you need to see the configs just ask I will put them up.

Update:

I took their server.csr opened the CertSrv page on both OldCertsha1 and NewCertsha2, when i used the Web Server Web Server (10 year) template i got an error:

Your Request Id is 118. The disposition message is "Denied by Policy Module The certificate validity period will be shorter than the WebServer(10Years) Certificate Template specifies, because the template validity period is longer than the maximum certificate validity period allowed by the CA. Consider renewing the CA certificate, reducing the template validity period, or increasing the registry validity period. ".

So then i tried the Web Server (5 year) same error then i tired the (Web Server) didnt get an error and download both the DER encoded or Base 64 encoded cer and p7b files.

Changed the Base 64 encoded server.cer to server.crt, renamed the old server.crt to server1.crt and restarted apache,

No error worked perfectly,

Why? What did I do wrong from the beginning?

This was my first time working with SSL and apache and using my own CA, what did I do wrong? The only think i can think of i used the Web Server (10 year) template but that really doesnt make sense to me.

If i view both crt files the both have same info

The certificate is intended for the following purposes

  • Ensure the identity of a remote computer

Issued to: name.sub.domain.com

Issued by: OldCertsha1

The only real difference from the General tab is how long that are valid, the cst from my csr is valid for 10 years, the crt from their csr is valid for 2 years.

I will take a deeper looking into the other parts of the SSL and see if I can find differences tomorrow.

windows ssl apache-2.4
Martin Hope
Anthony Fornito
Asked: 2017-01-06 11:26:32 +0800 CST
  • 13

Before you mark this duplicate I read all the suggestions an none answer my question.

I am being told something by a hosting provider, however what they are telling me is contradictory to what I am seeing online, this information is coming from the CEO of the company so I do not want to call him out unless I make sure I know what Im talking about.

Question: What do Virtual Private Server vs Dedicated Cloud run on?

This is what im being told/sold

VPS average cost is about ~$80/mo 2 CPU, 4 GB RAM, 60 GB Disk

Dedicated Cloud cost ~$350 for the same specs, that includes the server a Virtual Firewall, CPU Burstability and some other bells and whistles.

What im being told from the potential new hosting provider:

VPS is a single machine that usually has windows installed on it, the windows machine is the host which provides you the VPS (guests), an application installed on the box is what separates the different guests, all the resources for that 1 machine are shared, noisy neighbor is a big problem. If someone were to gain access to the windows host they would have access to every guest. Also any other guest could gain access to your guest, I am assuming some skill would have to be involved.

Real world description big room with a curtain separating customers

Dedicated Cloud is a cluster of servers using VMWare as the host application, you server could be on any one of the servers in the cluster and if a server goes down you will be vmotioned to a new one, DRS, QOS. Resources are not shared and noisy neighbor is not an issue. Storage is 3 tiered iSCSI appliance

Real world description a hotel, anyone who whats in has to get past the front desk, anyone who has a room can only access their room and has no way of knowing there are other rooms in the hotel.

I run a couple VMWare servers myself, not clustered just single however each guest is in fact sharing the resources from the pool of resources available.

I understand you get what you pay for, and the Dedicated Cloud does in fact seem more robust than their description of VPS,

Are they down playing VPS?

On the flip side the company where my application is currently hosted is telling me there is no difference between VPS and Dedicated Cloud some hosting providers like to put a fancier name on VPS. After giving their sales the run down of what the other hosting provider told me they said they are really trying to sell me a lot of fluff. However they will not really give me any good details on how their VPS runs and its either VPS or Dedicated server which is about ~$500 depending.

My application is fairly simple, runs on php been on a shared server for years, privately used. The reason for the move is I made some big updates to the application and have noticed some sluggishness also there are some custom changes to PHP and MySQL I want to make that shared hosting will not allow.

Sorry for the wall of text just looking for a straight forward answer.

hosting vps cloud
Martin Hope
Anthony Fornito
Asked: 2016-12-21 08:15:00 +0800 CST
  • 19

A user was having trouble connecting to the internet, some sites worked some sites did not.

I do not think it has anything to do with networking gear, but just in case.

2 firewall, Palo-Alto

4 Cisco Nexus 55XXT Switch

We did not make any network changes since last week about 10 days ago and everything ran fine.

The only thing I can see that stands out is if I ping one of the machines in question is it will resolve to a different IP than what the machine Actually has

We are getting multiple network alarms about IP conflicts 2 per hour for the last day.

This was only affecting 2 users

From one of the PC having the issue:

C:\>ipconfig | find "IPv4"
   IPv4 Address. . . . . . . . . . . : 12.43.168.248

C:\>hostname
    hostname-18

Ping from different machine.

C:\>ping hostname-18
Pinging hostname-18.domain.com [12.43.168.105] with 32 bytes

Nslookup from different machine.

C:\>nslookup 12.43.168.105
Server:  ad-server.domain.com
Address:  12.43.168.83

Name:    hostname-18.domain.com
Address:  12.43.168.105


C:\>nslookup 12.43.168.248
Server:  ad-server.domain.com
Address:  12.43.168.83

Name:    hostname-18.domain.com
Address:  12.43.168.248

C:\>nslookup hostname-18
Server:  ad-server.domain.com
Address:  12.43.168.83

Name:    hostname-18.domain.com
Address:  12.43.168.105

We found out there were two reverse DNS entries hostname-18.

How or why would this happen? What could cause this?

internal-dns active-directory nslookup
Martin Hope
Anthony Fornito
Asked: 2016-12-01 08:07:58 +0800 CST
  • 14

Server 2012 R2 ESXI 6

I am having an issue with resetting the local admin password on a windows server 2012 VM.

I first booted to a windows server 2012 cd, hit the repair option -> toubleshooting -> command prompt

c: 

The system cannot find the the drive specified

wmic logicaldisk get name

name

d:

x:

Neither of these are the drive where the OS lives.

So i booted to a windows 8 recovery disk

Couple other option when i select the repair windows option under that recovery console i get an error:

The drive where windows is installed is locked.

I have tried various way to unlock it but cannot get anywhere.

Things I have tried

diskpart

list disk

there are no fixed disks to show.

bootrec /ScanOS

Total identified Windows installations: 0

Why is the local c: not showing up?

If i reboot the vm and not boot to CD the OS will load fine. Just can't log in.

UPDATE:

I just tried to install the OS from the boot media, and could not find the local disk there either, defiantly a driver issue, I will try again tomorrow when i find the right driver and can slipstream it into the ISO

vmware-esxi windows-server-2012-r2
Martin Hope
Anthony Fornito
Asked: 2016-11-17 08:05:56 +0800 CST
  • 13

I have a CA setup on Server 2012 R2, the person who ran the server left the company and I have setup a new CA server.

I am trying to figure out what systems / URL's the certs are for.

In the List of Issued Certificated is the following:

Request ID: 71

Requester Name: DOMAIN\UserName

Certificate Template: Basic EFS (EFS)

Serial Number: 5f00000047c60993f6dff61ddb000000000047

Certificate Effective Date: 11/05/2015 8:46

Certificate Expiration Date: 11/04/2016 8:46

Issued Country/Region:

Issued Organization:

Issued Organization Unit: Org Users Employees

Issued Common Name: Employee Name <-- Acutal Name of Employee

Issued City:

Issued State:

Issued Email Address:

When I ask the employee why they requested the certificate they don't remember why or what system it was for.

I am looking for a way to see all requested certs and what machines they are tied to:

Things I have tried/Googled:

  1. A command similar to Netstat that could tell me any listening or established connection to the server on 443, I may be way off base on my logic and thinking.

  2. I have looked through the event viewer looking at the "Certificate Effective Date: 11/05/2015 8:46" time stamp and cannot find any logs that show me anything.

  3. I tried to look at the database using certutil command however I have to stop the service before I can view the database, looking over the schema it looks like a lot of the information I am looking for might be in there.

If i stop the service will SSL certs still be ok or will the end user get that SSL warning?

If I take a backup of the database can i move the file to a differnet PC and be able to read it.

Does anyone know if I will be able to find what servers / URL's are using the certs on my CA?

Is there a different better way I can find the information?

ad-certificate-services certutil
Martin Hope
Anthony Fornito
Asked: 2016-11-01 09:34:14 +0800 CST
  • 13

Spin off from these previously asked questions

How to get free space from mounted drive Redhat 7

Update crypttab asks for Passphrase for fstrim

We have a HP 3PAR StoreServ 7400 with 170 VM's speread out across 38 hosts.

Here is the problem as I understand it: (Also I have been told some information that im not sure if it's true or not, I have read over the HP 3PAR StoreServ 7400 whitepaper and really cannot find anything that backs up what my storage guy is telling me. So throughout the below if anyone notices anything not true please let me know.)

The 3 PAR is broken up into 3 sections,

Layer 1: SSD used to cache and quick access of commonly accessed files.

Layer 2: and Layer 3: Some kind of spinning disc, what and why there are additional 2 layers im unsure of but my assumption is Layer 2 is used for data that is not most commonly accessed but access a bit and Layer 3 is used for storage of the rest.

Within the SSD portion as I have read in many articles when data is written to a SSD block and then deleted that block is not zeroed until new data is written to it, So when the data within the block is deleted the table that stores the mapping info gets updated, then when new data is written to that same block the block first needs to be zeroed and then it can be written to. This process within SSD if the drive is not trimed periodicity can lead to lower w/r speeds.

The 3PAR LUN is thin provisioned the VM's are Eager Thick provisioned.

According to my storage guy the 3PAR has a special feature built in that allows SSD storage not being used to be available to the other VM's as needed which makes no sense.

Fact Check:

A thick provisioned VM is a VMDK files, when the VM is created you specify the size of the VM and this creates a VMDK file. In my mind that tells me that if the VM is being accessed regularly the entire VMDK file is then moved to SDD, and what they are telling me is that even if the VMDK is set to use 40GB that some of that 40GB can be used on other VM's? That sounds more to me like a thin provisioned VM not a thick.

Ok getting to the problem.

On our windows systems we use sdelete to find and zero out unused blocks.

On our Linux Fedora system I have been all over trying to figure out how to get fstrim to work.

I did try the dd=write-big-file delete-big-file command and that sent the disk I/O through the roof, which was noticed, and I was told not to do that again.

Doing a little research it looks to me that sdelete pretty much does the same thing as dd=write-big-file delete-big-file so why does the disk I/O not go through the roof on windows systems?

So i think i have whittled it down to two solutions. Neither of which I know how to do.

  1. Somehow without v-motioning the VMs to a different storage array be able to run a fstrim like function on the entire SSD portion of the SAN.

Side note: If i understand everything I have read fstrim looks at every block to see if data is there and if it is needed, if not needed will zero out the block, where as sdelete writes a huge file and then deletes it. Which is why I am looking for a fstrim option across the entire SSD portion of the 3PAR.

  1. Longshot but the error i get with fstrim is:

[root@rhtest ~]# fstrim -v / fstrim: /: the discard operation is not supported

I have read that the discard option needs to be set on both the OS and the datastore but i cannot figure out where or how to set a discard option on the 3PAR i have both SSH and GUI access to the 3PAR.

I have been through countless walkthroughs on setting up discards within the OS and not matter how many different ways I spin it I always get the same error.

Yes i have also looked into other options zerofree was one, and a couple others that do not come to mind however they either worked like zdelete, or i read that they were very dangerous, I looked into the hdparam etc.

Below I will put some output about the OS in question they are all the same.

[root@rhtest ~]# hostnamectl
    Static hostname: rhtest.domain.com
    Icon name: computer-vm
    Chassis: vm
    Machine ID: f52e8e75ae704c579e2fbdf8e7a1d5ac
    Boot ID: 98ba6a02443d41cba9cf457acf5ed194
    Virtualization: vmware
    Operating System: Red Hat Enterprise Linux Server 7.2 (Maipo)
    CPE OS Name: cpe:/o:redhat:enterprise_linux:7.2:GA:server
    Kernel: Linux 3.10.0-327.el7.x86_64
    Architecture: x86-64

[root@rhtest ~]# blkid
    /dev/block/8:2: UUID="2OHGU8-ir1w-LLGB-6v72-zZqN-CIaX-FjGImJ" TYPE="LVM2_member"
    /dev/block/253:1: UUID="ad872f09-5147-4252-af56-aa6244219515" TYPE="xfs"
    /dev/block/8:1: UUID="83aac355-a443-4ff9-90fa-9f6da8e31cc2" TYPE="xfs"
    /dev/block/253:0: UUID="dbe56f6a-2a4a-42da-82e2-bef9a73caafb" TYPE="swap"

[root@rhtest ~]# lsblk
    NAME                           MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
    fd0                              2:0    1    4K  0 disk
    sda                              8:0    0   50G  0 disk
    ââsda1                           8:1    0  500M  0 part /boot
    ââsda2                           8:2    0 49.5G  0 part
        âârhel_-rhtest-swap 253:0    0    2G  0 lvm  [SWAP]
        âârhel_-rhtest-root 253:1    0 47.5G  0 lvm  /
    sdb                              8:16   0   50G  0 disk
    sr0                             11:0    1 1024M  0 rom


[root@rhtest ~]# df -h
    Filesystem                              Size  Used Avail Use% Mounted on
    /dev/mapper/rhel_-rhtest-root   48G  883M   47G   2% /
    devtmpfs                                991M     0  991M   0% /dev
    tmpfs                                  1001M     0 1001M   0% /dev/shm
    tmpfs                                  1001M  8.5M  993M   1% /run
    tmpfs                                  1001M     0 1001M   0% /sys/fs/cgroup
    /dev/sda1                               497M  124M  374M  25% /boot
    tmpfs                                   201M     0  201M   0% /run/user/0
redhat ssd hp-smart-array trim
Martin Hope
Anthony Fornito
Asked: 2016-10-26 06:22:54 +0800 CST
  • 15

When trying to run any rpm command I get the follow error. I am not sure why i am getting a curl error but i have tried many different options which have all failed.

Running CentOS7 and behind a proxy

[root@CentOS7]# rpm -Uvh https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
Retrieving https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
curl: (60) Peer's certificate issuer has been marked as not trusted by the user.
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.
error: skipping https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm - transfer failed

So I ran a check as per a website that I think worked.

[root@CentOS7]# curl -k https://google.com
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>301 Moved</TITLE></HEAD><BODY>
<H1>301 Moved</H1>
The document has moved
<A HREF="https://www.google.com/">here</A>.
</BODY></HTML>

I am behind an proxy and ran the export command.

export https_proxy=https://USERNAME:[email protected]:8080/

My question(s) are:

  1. What is the equivalent of curl -k to rpm?

  2. Is there an curl.config somewhere i can tell curl to not check for ssl certs? I have read this is a bad idea but I have tested the two repos on a different server that did not give me the error also not behind the proxy.

  3. Im not exactly sure the relationship of rpm to curl, but i am assuming because i am getting a curl error that curl is the one giving the error?

I did RTM for both rpm and curl and cannot figure out what needs to be done. I did read somewhere i need to import the keys or something but im not sure what i am suppose to be doing there either.

ssl rpm centos7 curl
Martin Hope
Anthony Fornito
Asked: 2016-10-19 09:17:48 +0800 CST
  • 14

In our VM infrastructure, we have clustered hosts going to a SAN.

What i am trying to figure out is how much "white space" is left over when deleting files within our Redhat servers. On our Windows server we use sdelete and that clears up that problem, however with Linux i am struggle to find a solution.

I am defining "white space" as the sectors? left over that are not zeroed out that SSD drives have to first zero out before they can write to it.

One thing I will point out is when it comes to Linux I know enough to be dangerous but am not a super user.

Looking over the drives and partitions:

[root@rhserver1-DATA10 /]# fdisk -l

Disk /dev/sda: 53.7 GB, 53687091200 bytes, 104857600 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk label type: dos
Disk identifier: 0x0005d52e

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *        2048     1026047      512000   83  Linux
/dev/sda2         1026048   104857599    51915776   8e  Linux LVM

Disk /dev/sdb: 53.7 GB, 53687091200 bytes, 104857600 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes

Disk /dev/mapper/rhel_rhserver1--data10-root: 51.0 GB, 50964987904 bytes, 99540992 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes

Disk /dev/mapper/rhel_rhserver1--data10-swap: 2147 MB, 2147483648 bytes, 4194304 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes

Now looking at the disk usage:

[root@rhserver1-DATA10 /]# df -h
Filesystem                              Size  Used Avail Use% Mounted on
/dev/mapper/rhel_rhserver1--data10-root   48G  6.1G   42G  13% /
devtmpfs                                906M     0  906M   0% /dev
tmpfs                                   921M  340K  920M   1% /dev/shm
tmpfs                                   921M   90M  831M  10% /run
tmpfs                                   921M     0  921M   0% /sys/fs/cgroup
/dev/sdb                                 50G  3.5G   44G   8% /ACMS01Backup
/dev/sda1                               497M  210M  288M  43% /boot
tmpfs                                   185M   20K  185M   1% /run/user/1000
tmpfs                                   185M     0  185M   0% /run/user/1002

After many hours of googling i found this, I think it is showing me how much "white space" is available to be cleared up.

[root@rhserver1-DATA10 /]#  parted /dev/sda unit MB print free | grep 'Free Space' | tail -n1 | awk '{print $3}'
1.02MB
[root@rhserver1-DATA10 /]#  parted /dev/sda unit '%' print free | grep 'Free Space' | tail -n1 | awk '{print $3}'
0.00%

I think a reasonable output for a 497M partition.

So now i want to do the same thing only on my mounted drive (i think its mounted.)

 parted /dev/mapper/rhel_rhserver1--data10-root unit MB print free | grep 'Free Space' | tail -n1 | awk '{print $3}'
 parted /dev/mapper/rhel_rhserver1--data10-root unit '%' print free | grep 'Free Space' | tail -n1 | awk '{print $3}'

Which give me nothing.

My /etc/fstab/:

[root@rhserver1-DATA10 /]# cat /etc/fstab
/dev/mapper/rhel_rhserver1--data10-root /                       xfs     defaults        0 0
UUID=2f97a17c-a6d5-4904-ad5c-7c16b4510201 /boot                   xfs     defaults        0 0
/dev/mapper/rhel_rhserver1--data10-swap swap                    swap    defaults        0 0
/dev/disk/by-uuid/be4c45cf-5d72-4b97-b647-2e585947041f /ACMS01Backup auto nosuid,nodev,nofail,x-gvfs-show 0 0

So my question is am I on the right path?

Did i explain what I am looking for well?

Is there a term for "white space" that might help my googling?

I have found that i can run "fstrim -v /" on the root but I would really like to know how much space is there.

Also i am trying to figure out being that theses are production system is fstrim I/O intensive, should it be run in off peak hours?

Any chance of data loss running "fstrim -v /"?

redhat storage-area-network virtual-machines
Martin Hope
Anthony Fornito
Asked: 2014-11-25 13:35:30 +0800 CST
  • 15

I am trying to create a couple of files that I can save on my local desktop to launch PowerShell sessions.

The Windows Server 2008 and Windows Server 2012 are both Server Core installations.

Currently, I can open Powershell and type:

Enter-PSSession -computername Win2012SrvCore -credential administrator

Using this, I can connect and run commands and everything is great.

What I have tried to do is:

Create file called Win2012SrvCore1.ps1 with the following:

$passwd = convertto-securestring -AsPlainText -Force -String MYPASSWORD

$cred = new-object -typename System.Management.Automation.PSCredential -argumentlist "administrator",$passwd

$session = new-pssession -computername Win2012SrvCore -credential $cred

Create file called Win2012SrvCore2.ps1 with the following:

PowerShell.exe -Command Enter-PSSession -computername Win2012SrvCore -credential administrator

Each ps1 file will launch and close quickly with some red text that I cannot read.

I have tried to add PAUSE to each script but that doesn't seem to stop the window from closing.

What I would like to do is create scripts that I can double click and open to the powershell prompt, similar to a saved RDP session.

I have configured ps1 files to execute:

C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe

Any help would be greatly appreciated.

powershell
Martin Hope
Anthony Fornito
Asked: 2014-11-21 09:32:27 +0800 CST
  • 13

I am trying to find out is IIS_IUSRS has FullControl of certain folders under directories.

Example

I have c:\inetpub\sites\

Under c:\inetpub\sites\ i have about 50 site folders

In each folder i have 3 folders called uploads, media, requests.

I would like to find out if BUILTIN\IIS_IUSRS has FullControl

Couple of problems, Not all sites have uploads, media, requests some might only have uploads, media or media, requests or just media etc.

Couple of commands I have tried using Powershell. 

Get-ChildItem -Recurse | Get-Acl | out-string -stream | select-string -pattern "media"

Get-ChildItem -Recurse | Get-Acl | out-string -stream | select-string -pattern "uploads"

Get-ChildItem -Recurse | Get-Acl | out-string -stream | select-string -pattern "requests"

I would like modify this to look for BUILTIN\IIS_IUSRS as the user

windows-server-2012
Martin Hope
Anthony Fornito
Asked: 2014-09-11 14:11:55 +0800 CST
  • 13

I need to add about 500 users to an OU in AD

I have scripted out everything I need, however, it gives the error: the name provided is not a properly formed

Here is the script

New-ADUser -Name C080CAB1-9756-409F-914D-AE3971F67DE7 -Path "OU=Staging,DC=domain,DC=local" -accountPassword (convertto-securestring "zagreb+scotch8355" -asplaintext -force) -PasswordNeverExpires $True -CannotChangePassword $false -Enabled $true

I ran a couple test to confime what the problem is:

New-ADUser -Name "C080CAB1-9756-409F-914D-AE3971F67DE7" -Path "OU=Staging,DC=domain,DC=local" -accountPassword (convertto-securestring "zagreb+scotch8355" -asplaintext -force) -PasswordNeverExpires $True -CannotChangePassword $false -Enabled $true

New-ADUser -Name 'C080CAB1-9756-409F-914D-AE3971F67DE7' -Path "OU=Staging,DC=domain,DC=local" -accountPassword (convertto-securestring "zagreb+scotch8355" -asplaintext -force) -PasswordNeverExpires $True -CannotChangePassword $false -Enabled $true

New-ADUser -Name C080CAB1`-9756`-409F`-914D`-AE3971F67DE7 -Path "OU=Staging,DC=domain,DC=local" -accountPassword (convertto-securestring "zagreb+scotch8355" -asplaintext -force) -PasswordNeverExpires $True -CannotChangePassword $false -Enabled $true

Along with a couple other variations

What did work:

New-ADUser -Name C080CAB1-9756-409F -Path "OU=Staging,DC=domain,DC=local" -accountPassword (convertto-securestring "zagreb+scotch8355" -asplaintext -force) -PasswordNeverExpires $True -CannotChangePassword $false -Enabled $true

So I think it may be a length issue but I'm not sure how to get the script to work.

active-directory
Martin Hope
Anthony Fornito
Asked: 2013-10-23 11:54:14 +0800 CST
  • 13

I would like to get a couple opinions

Found this article online and wanted to know if it is good to follow

http://www.msserverpro.com/migrating-active-directory-domain-controller-from-windows-server-2003-sp2-to-windows-server-2008-r2/

Couple of things that need to be done.
1. Move over all active directory settings from old Server 2003 server to new Server 2008R2
2. Setup all users on new server using csvde.

csvde -f output.csv -- on old server
csvde -i -f output.csv -- on new server

Any advice would be greatly appreciated.

windows-server-2008