chris's questions

We have a load-balanced web app that serves some images off an NFS mounted drive.

When the NFS server goes down, it ends up bringing all of the web instances down.

Currently the volume is mounted with:

ip:/path/to/images /docroot/images nfs soft,intr,rw,rsize=32768,wsize=32768 0 0

I ran a siege test against a selection of images that live on this volume, and when it went down requests ended up timing out based on the apache Timeout value (which was set to 600 sec for this test).

I changed the mount options to:

bg,soft,intr,rw,rsize=32768,wsize=32768,timeo=5,retrans=2,actimeo=60,retry=15

And this was better, but still took too long to fail: The first set of request timed out in about 30 seconds, but the next set took anywhere from 180 to 300s.

I know the long-term solution is to move these to S3, but is it possible to reduce this to under 5-10s without affecting performance?

I'm trying to do some processing on an exim log, but my script is not receiving the rotated log file name as a parameter - rather, it's getting the original log file name (which no longer exists)

/var/log/exim/*log" {
  daily
  rotate 3650
  delaycompress
  missingok
  notifempty
  nosharedscripts
  postrotate
   echo $0 $1 $2 >> /tmp/out
   /path/to/script $1
  endscript
}

The results in /tmp/out:

  logrotate_script /var/log/exim/main.log

I'm running

logrotate --force -v /etc/logrotate.conf

Output seems to indicate that it's renaming, then running:

renaming /var/log/exim/main.log to /var/log/exim/main.log-20160105
running postrotate script

This is on an amazon linux instance. I've tried it with both sharedscripts and nosharedscripts options with no difference.

How can I get the old renamed file name?

I have 3 SSD EBS volumes mounted to my database server. The main data volume is 10TB, the journal volume is 1TB, and a 3rd volume is 100GB.

When I take a snapshot of the 3 volumes, the 1TB journal volume consistently takes much, much longer to snapshot than the 10TB data volume, even though there's only about 100GB of space used on it. (It's been over 8 hours, and it's only 55% done. The 10TB snapshot finished after about 2 hours).

Is there anything I can do to speed up the process?

Redhat 6 includes cloud-init hooks, which means in AWS you can install cfn-init and use CloudFormation.

Redhat 5 doesn't appear to have cloud-init. Is there any way to get this working?

I have created my own CA cert, and created a wildcard ssl cert for *.domain.com.

But we use a lot of sub-domains of the form abc.xyz.domain.com, and I can't seem to create a wild card that will work with this.

*.domain.com fails on abc.xyz.domain.com, and creating a wildcard for *.*.domain.com didn't seem to work.

Is there a way to do this, or do I need to create a wildcard for each subdomain?

I'm stuck in some sort of strange loop.

I tried to create an office 365 user, and did not have any available licenses. I followed the link to purchase an additional license, then went back and created my new user.

You guessed it - I now had two, identical mailboxes.

I deleted the Office365 user, and used Powershell to remove the mailboxes.

I then attempted to recreate the user, but it failed again because the email address wasn't considered available.

Using Powershell: When I run get-mailbox, it does not show anything. When I run get-user, it shows name as "User" and name_ also as user.

Using the web interface, there is no user in Office365, but 3 identical users with the same email address in "Deleted Users". I have restored one of these, but there is no corresponding mailbox.

How can I purge everything so I am able to re-create the user, or at least be able to recreate the user?

When I go to the Office365 admin interface, there's a notice that I have an error:

Exchange: The value "<name@domain>" of property "UserPrincipalName" is used by 
another recipient object "namprd07.prod.outlook.com/Microsoft Exchange Hosted 
Organizations/<domain>.onmicrosoft.com/<user>_a999aaa999". Please specify a unique 
value.Exchange: An unknown error has occurred. 
Refer to correlation ID: d2effba4-de7d-45de-8984-02002fb04fe5

I'm trying to create an instance to run apache, and everything seems to be working, but the web server is not being started.

It starts up fine manually. If I reboot the instance, it does not automatically start the web server.

My Resources section contains:

"Resources" : {
  "CfnUser" : {
    "Type" : "AWS::IAM::User",
    "Properties" : {
      "Path": "/",
      "Policies": [{
        "PolicyName": "root",
        "PolicyDocument": { "Statement":[{
          "Effect":"Allow",
          "Action":"cloudformation:DescribeStackResource",
          "Resource":"*"
        }]}
      }]
    }
  },

  "HostKeys" : {
    "Type" : "AWS::IAM::AccessKey",
    "Properties" : {
      "UserName" : {"Ref": "CfnUser"}
    }
  },

  "testInstance" : {
    "Type" : "AWS::EC2::Instance",
    "Metadata" : {
        "Comment1" : "Just testing",
        "AWS::CloudFormation::Init" : {
          "config" : {
              "packages" : {
                  "yum" : {
                      "mysql"        : [],
                      "mysql-server" : [],
                      "mysql-libs"   : [],
                      "httpd24"      : [],
                      "php54"        : [],
                      "php54-common" : [],
                      "php54-mysql"  : [],
                      "php54-pdo"    : [],
                      "php54-xml"    : [],
                      "php54-mcrypt" : [],
                      "php54-gd"     : []
                  }
              }
          },

          "services" : {
              "sysvinit" : {
                  "httpd"    : { "enabled" : "true", "ensureRunning" : "true" },
                  "mysqld"   : { "enabled" : "true", "ensureRunning" : "true" }
              }
          }

      }
  },

  "Properties" : {
    "ImageId" : { "Fn::FindInMap" : [ "RegionMap", { "Ref" : "AWS::Region" }, "64"] },
    "InstanceType"   : { "Ref" : "InstanceType" },
    "SecurityGroups" : [ {"Ref" : "StackWebAccess"} ],
    "KeyName"        : { "Ref" : "KeyName" },

    "UserData"       : { "Fn::Base64" : { "Fn::Join" : ["", [
      "#!/bin/bash -v\n",
      "yum update -y aws-cfn-bootstrap\n",
      "# Install LAMP packages\n",
      "/opt/aws/bin/cfn-init -s ", { "Ref" : "AWS::StackName" }, " -r testInstance ",
      "    --access-key ",  { "Ref" : "HostKeys" },
      "    --secret-key ", {"Fn::GetAtt": ["HostKeys", "SecretAccessKey"]},
      "    --region ", { "Ref" : "AWS::Region" }, " || error_exit 'Failed to run cfn-init'\n"
        ] ] } }        
  }
},

"StackWebAccess" : {
  "Type" : "AWS::EC2::SecurityGroup",
  "Properties" : {
    "GroupDescription" : "Enable SSH access and HTTP access on the inbound port",
    "SecurityGroupIngress" : [ 
      {
        "IpProtocol" : "tcp",
        "FromPort" : "22",
        "ToPort" : "22",
        "CidrIp" : "0.0.0.0/0"
      },
      {
        "IpProtocol" : "tcp",
        "FromPort" : "80",
        "ToPort" : "80",
        "CidrIp" : "0.0.0.0/0"
      }
    ]
  }
  }
},

My cfn-init.log:

2013-01-23 13:55:58,064 [INFO] Running configSets: default
2013-01-23 13:55:58,065 [INFO] Running configSet default
2013-01-23 13:55:58,065 [INFO] Running config config
2013-01-23 13:57:23,097 [INFO] Yum installed [u'php54-common', u'php54-xml', u'php54', u'httpd24', u'php54-gd', u'mysql-server', u'php54-mcrypt', u'mysql-libs', u'php54-mysql', u'php54-pdo', u'mysql']
2013-01-23 13:57:23,102 [INFO] ConfigSets completed

Is there something missing, or should this be starting the services?

My ELB keeps taking my instances out of service, because the HTTP health check is failing.

We have a DNS wildcard, and redirect everything to www:

vhost.conf:

ServerName www.example.com
ServerAlias *.example.com
RewriteEngine on
RewriteCond %{HTTP_HOST} !^www\.example\.com$ [NC]
RewriteRule ^ http://www.example.com/$1 [R=301,L]

This works fine for actual browsers, but the HTTP health check to / fails, presumably because it's getting a 302.

Is the best option to use a TCP health check, or is there a way to get HTTP to work?

When setting up DNS records for clients moving to hosted email, typically there are multiple MX records created.

I have a client using Office365, and the DNS section of the Admin tool only lists a single MX option.

Is this something I should be concerned about?

I am trying to set up a mysql master/slave configuration in two EC2 instances.

However, every time I reboot an instance, the IP address (and hostname) changes. I could assign an Elastic IP address, but would prefer to use the internal IP address.

I can't be the first person to do this, but I can't seem to find a solution. There are a lot of "getting started" guides, but none of them mention how to handle changing IP addresses. So what are the best practices to manage master/slave replication in EC2?

I am trying to install an SSL certificate, and I get the following errors:

AH02241: Init: Unable to read server certificate from file /path/my.crt
SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
SSL Library Error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error (Type=X509)
AH02312: Fatal error initialising mod_ssl, exiting.

Here's the process I followed:

I generated my private key with:

openssl genrsa -out my.key 2048

I created the CSR with:

openssl req -new -key my.key -out my.csr

I provided the CSR to our IT department, and they returned a crt - it starts with

-----BEGIN CERTIFICATE-----

My ssl.conf has (my.example.com matches the Common name used during the generation of the CSR):

 <VirtualHost my.example.com:443>
   SSLEngine On
   ServerName my.example.com 
   SSLCertificateFile /path/my.crt
   SSLCertificateKeyFile /path/my.key
 </VirtualHost> 

I do not have SSLCertificateChainFile or SSLCACertificate file set.

The private key starts with

----BEGIN RSA PRIVATE KEY-----

The csr starts with

-----BEGIN CERTIFICATE REQUEST-----

I have verified that both:

openssl rsa -noout -modulus -in my.key
openssl req -noout -modulus -in my.csr 

produce the same output. I cannot figure out how to verify the crt - trying both x509 and rsa produce an error.

Should this process have worked? Can I verify that my.crt matches the key somehow?

I have an EBS-backed instance with a 2nd mounted volume (I followed the steps in Eric's Article)

I then created an AMI from that instance, and ran an instance from that AMI.

That 2nd instance then created two volumes.

Is there a way to control how the volumes associated with with an AMI are created, or is the solution just to unmount the 2nd volume before creating the AMI?

I have an instance I created from the web console, using the "Classic" wizard & the default Amazon Linux image.

When I go to Instance Actions, Connect, and select the "Connect with a standalone SSH Client" option, it has the correct string, using ec2-user@.

I saved that as an AMI, and then created a new instance via the ec2 command-line tools:

ec2-run-instances <ami> -k <my key> -g <my security group>

Now when I get the connect string, it uses root@, which doesn't work - I need to change that to ec2-user to actually connect.

This isn't a big deal, but I'm wondering why there's a difference - is there a missing parameter when I create it via the command line?

This seems like it should be easy to answer, but as a php newbie, I can't find out what exactly I need to install.

Some sites recommend just httpd, php and php-common; other suggestions include php-fpm and mod_fastcgi, as well as a bunch of php packages.

My goal is to be able to set up my dev machine and an amazon EC2 instance to be as similar as possible.

What do I need to install?

Can I install TFS 2010 on top of a SQL Server 2012 RC0 installation? I do not need the sharepoint integration.

I have inherited a VSS server, but do not have the admin password.

How can I reset it? I have admin login to the box (Win2003 Server).

What would cause log entries to be out of order?

For the most part, the log entries are in chronological order, but every once in a while there will be a request logged with a time stamp that's much older than the surrounding requests - sometimes, it can be a minute or so older.

It seems that most of these are POST requests, and the back-end server has been experiencing some problems - is the request only logged at the end of the pipeline?

I'm running a Windows XP desktop in a corporate environment. How can I find out what AD groups I belong to?

I need to move some domains to a different DNS server, and I'm wondering if there's any way to obtain a complete copy of the zone file without going though the current DNS provider?

I'm trying to monitor my database connections with Performance Monitor, but for some reason I can no longer add the counters.

Every set of counters OTHER than the two .NET Data Providers (for Oracle and SQL Server) works fine.

This was working not 10 minutes ago, when it just stopped. I've tried rebooting the box, which made no difference.

An suggestions on how to figure out how to re-enable these?