uSlackr's questions

I have a Powershell script that I'm running via nrpe as an external script. The windows server (2008) is running nsclient++ (nscp.exe) v 0.4.1.102.

The return section of my powershell script looks like this

 } else {
                    write-host "ok $queue|queue = $queue"
                    exit 0
 }

And the wrapper script to call the ps1 file looks like this:

ps1 = cmd /c echo C:\\NetAdmin\\%SCRIPT% %ARGS%; exit($lastexitcode) | powershell.exe -command -

If I run this from a windows command prompt the output looks something like:

ok 93|queue = 93

But when I run is using check_nrpe from my nagios server the output changes to:

ok 93|'queue''=0 '93'=0

Nagios is having an issue processing the performance data.

UPDATE: After filing a bug report, the software author replied that this is desired behavior, but that there are two options for disabling it in the nsclient.ini:

Globally (All scripts)

[/settings/external scripts/scripts/default]
ignore perfdata = true

Single script

[/settings/external scripts/scripts/check_foo]
ignore perfdata = true

We recently put up an IIS site (on WinSvr 2008r2 running as a Hyper-V guest) that is used almost exclusively for downloading files over the internet. The data exists as a large collection of .zip files ranging from 1MB - 35GB in size. We want to allow a lot of downloads during a day (more than 500GB) but have implemented an outbound ASA throttle at 60mbps in order to preserve bandwidth for other uses. The total link speed is 100mbps.

Here's the interesting part: While we can serve up multiple downloads to hit the 60mbps cap, we cannot get any single download to exceed 2.5M bytes/sec (20 Mbits/s). Is there any TCP or IIS tuning we can do to push up individual download speeds? Or something else to look at?

We're using Nagios to monitor some of our web sites. We have a script that uses the older plugin that we are trying to switch to using webinject.pl from cpan. When the script runs, it generates this error:

LWP::Protocol::https::Socket: SSL connect attempt failed with unknown error error:1407741A:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert decode error at /usr/local/share/perl5/LWP/Protocol/http.pm line 51.

It appears the web site does not support TLSv1 for https. If it matters, the site is a Cisco WebVPN. I've pointed the same script at a different site that does support TLSv1 and it seems to work fine.

My web search is coming up empty. Successful connect:

<case
id="1"
description1="Metro Home Page"
description2="Metro, login test"
method="get"
url="https://metro.myco.com/index.php"
verifypositive="restricted"
logrequest="yes"
logresponse="yes"
sleep="1"

/>

Failing connect:

<case
id="2"
description1="WebVPN Home Page"
description2="webvpn.myco.com login test"
method="get"
url="https://webvpn.myco.com/webvpn.html"
verifypositive="Authorized"
logrequest="yes"
logresponse="yes"
sleep="1"

/>

I'm working with a small business that uses an Access-based database for work order mgmt. The system has been around for years and they have 6-7 PCs using custom software from an ISV to access the database. The database is accessed over a mapped drive (Z:) connection.

Several months ago they began getting this error intermittently:

Data source name not found and no default driver specified

This results in the ISV having to connect to the database and run a repair in order to recover the database. The error they see is a bit more specific and suggests that the file format is corrupt. The support tech suggests that the issue is caused by a transaction failing across the network. To that end we've tried several things

• moved the database to a different host in case the original "server" PC had issues
• replaced the network switch
• started taking the clients off the network one by one in an attempt to isolate the problem child with no consistent results

So far, no luck.

My question(s) - Could one of the PCs be closing its drive mapping and corrupting the open database - Is there anything new in Windows 7 that might be getting in the way - Can you recommend a better approach to isolating the cause.

I was given a set or re-write rules for a new website. I've never used them before and I'm trying to understand what we are doing here

RewriteEngine on  
RewriteCond %{HTTP_HOST} .   
RewriteCond %{HTTP_HOST} !^www\.myco\.com  
RewriteRule (.*) http://www.myco.com/$1 [R=301,L]

RewriteCond $1 !^(CCSFG|images|fonts|themes|robots\.txt|index\.php) [NC]  
RewriteRule ^(.*)$ /index.php/$1 [L]

If I understand this, the first ruleset

RewriteCond %{HTTP_HOST} .   
RewriteCond %{HTTP_HOST} !^www\.myco\.com  
RewriteRule (.*) http://www.myco.com/$1 [R=301,L]

says:
If HTTP_HOST is anything AND
if HTTP_HOST doesn't start with www.myco.com
then
rewrite any page request to start with http://www.myco.com/, return a 301 redirect and stop processing more rules

The next ruleset

RewriteCond $1 !^(CCSFG|images|fonts|ee-system|themes|robots\.txt|index\.php) [NC]  
RewriteRule ^(.*)$ /index.php/$1 [L]

says: If the request doesn't start with CCSFG,image or fonts or, etc (non-case sensitive) then rewrite the whole request to prepend /index.php/ and stop processing more rules

Is my interpretation correct?

If so, what would be the purpose of the second ruleset? Why would I want to prepend /index.php/ to these entries?

This may be somewhat subjective, so if you feel the topic should be closed - go ahead.

We make heavy use of Netbackup and a large, multi-drive LTO-4 library. We regularly struggle with getting everything done in the appropriate backup window. One of the things we've avoided is using the multiplex function to drive multiple backup jobs to the same tape. We've heard different reasons for this such as the benefit doesn't justify the risk and have not done it.

As we talk through various options towards solving our throughput issues, this one invariably crops up. I'm looking for opinions and approaches to this issue.

We have a moderately sized AD installation with approx 1000 employees and maybe 1800 valid computer accounts (servers, PCs, virtuals). Because we replace desktop hardware on a 3-4 yr cycle, cleaning up old computer accounts is a necessary task that usually get's put off. We currently have 3200 accounts!). We have a robust process in place for identifying unused user accounts and disabling/deleting them, but nothing in place for computer accounts.

We know about tools like oldcomp, powershell, etc and we even have a windows batch script which uses dsquery and dsrm to handle this, but we've not actually production-alized anything.

My question is simple - What process do you use to clean up these accounts?

In this thread today I got clarification on the meaning of the various DNS actions. Very helpful. Now to the real question. We have a Windows DNS secondary zone that maintains a copy of our parent company's DNS. When I open the zone in DNS mmc, "all" the entries show up yet the Status for the zone is listed as "zone never loaded".

This seems odd since we can apparently resolve the hosts we need to access in this dns. What is this status trying to tell us about this zone?

I'm managing a secondary server for DNS and the right click menu has three actions which confuse me

• Reload
• Transfer from Master
• Transfer new copy of zone from Master

These all sound suspiciously similar. Could you explain what these different action mean?

Thanks

We have a number of locally installed .Net applications that communicate via web services. Authentication in IIS is handled by Windows Authentication so no additional login is required. We recently began seeing a problem where users are getting a IIS 403 forbidden eror when their password reset falls within the password exiration notification period (7 days at the moment).

As this sometimes happens in the the middle of the day (login in the morning OK, but password reaches < 7 days during the day), this comes as a surprise as they haven't been warned to change their password. Of course, I would expect they should be able to work until the password is expired.

Any idea on what could be happening here? Why would IIS reject a login if the passsword hasn't actually expired? Can we change that behaviour?

Thanks

\\Greg