Roy's questions

Attempting to deliver more than a few hundred e-mails per day via SMTP to our own employees on Google G-Suite tends to cause significant delays due to arbitrary quota limitations on the Google side.

We currently have a single corporate postfix server responsible for outgoing SMTP. This server relays any e-mail from internal services to internal recipients to G-Suite.

I have SFP records configured and the e-mail server is registered within G-Suite as a company e-mail gateway.

Often e-mail delivery to G-Suite is rejected with a 450-4.2.1 response from the Google mail exchangers, causing hours of delay.

Specifically this message:

Jan 10 11:57:03 smtp postfix/smtp[7127]: A067338013: host aspmx.l.google.com[173.194.73.26] said: 450-4.2.1 The user you are trying to contact is receiving mail at a rate that 450-4.2.1 prevents additional messages from being delivered. Please resend your 450-4.2.1 message at a later time. If the user is able to receive mail at that 450-4.2.1 time, your message will be delivered. For more information, please 450-4.2.1 visit 450 4.2.1 https://support.google.com/mail/?p=ReceivingRate r22-v6si64987734ljb.4 - gsmtp (in reply to RCPT TO command)

This illustration shows the current flow of e-mail from internal systems:

What options may be available to increase the capacity for e-mail from internal systems to employees?

Might we have overlooked some configuration option in G-Suite? Is there some other way to deliver e-mail to G-Suite from internal sources? Can we add more SMTP relays to increase the quotas?

I have discussed the matter with G-Suite Support, who's only recommendation was to send less e-mail. Go figure :)

Considering we are only sending a couple of dozen e-mails per user per day, I'm guessing we are not the first company to see this issue. Hopefully there is a simple solution!

I have lots of machines running the Red Hat compatible kernel and this has not been as issue before. However, the latest default behaviour appear to be that the repository configuration file is updated with UEK4 enabled on "yum update"

The next "yum update" will install UEK4 and set it as the default kernel. Any problems caused by this, will be discovered when the next boot fails.

It would be best if I could pre-emptively disable the UEK4 repository, before the repository file is even updated by yum.

The default yum repository configuration file /etc/yum.repos.d/public-yum-ol6.repo installed with OL6 Update 9 contains references to variables $uek, $uek3 and $uek4 suggesting that the UEK repositories can be disabled in some central way.

[public_ol6_UEKR4]
name=Latest Unbreakable Enterprise Kernel Release 4 for Oracle Linux $releasever ($basearch)
baseurl=http://yum.oracle.com/repo/OracleLinux/OL6/UEKR4/$basearch/
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
gpgcheck=1
enabled=$uekr4

Where might yum be getting these values?

Can I set them somewhere, thus preventing a "yum update" from inadvertently changing the kernel and messing things up?

Ansible makes it easy enough to ensure that a process is running on every host.

I could do something like:

---
- hosts: app_cluster
  tasks: 

  - name: Look for the "foo" process
    shell: ps -ef |  grep foo | grep -v grep
    register: process_list
    changed_when: false  

  - name: Start "foo" if needed
    shell: nohup /bin/foo &
    when: "process_list.stdout.find('foo') == -1"  

However, I need to have exactly one instance of a certain process across the cluster. Ie. it can run on any host, just as long as it is running somewhere and so long as there is only one such process anywhere in the cluster.

Might there be a convenient way to do this in an ansible playbook?

My conclusion to this was to pipe VLAN trunks through EoIP tunnels and encapsulate those in hardware assisted IPSec. Two pairs of fairly inexpensive Mikrotik RB1100AHx2 routers proved capable of saturating a 1 Gbps connection while adding less than 1 ms latency.

I would like to encrypt traffic between two data centres. Communication between the sites is provided as a standard provider bridge (s-vlan/802.1ad), so that our local vlan tags (c-vlan/802.1q) are preserved on the trunk. The communication traverse several layer 2 hops in the provider network.

Border switches on both sides are Catalyst 3750-X with the MACSec service module, but I assume MACSec is out of the question, as I don't see any way to ensure L2 equality between the switches over a trunk, although it may be possible over a provider bridge. MPLS (using EoMPLS) would certainly allow this option, but is not available in this case.

Either way, equipment can always be replaced to accommodate technology and topology choices.

How do I go about finding viable technology options that can provide layer 2 point-to-point encryption over ethernet carrier networks?

edit:

To sum up some of my findings:

• A number of hardware L2 solutions are available, starting at USD 60,000 (low latency, low overhead, high cost)

• MACSec may in many cases be tunneled through Q-in-Q or EoIP. Hardware starting at USD 5,000 (low-medium latency, low-medium overhead, low cost)

• A number of hardware assisted L3 solutions are available, starting at USD 5,000 (High latency, high overhead, low cost)

I'm trying to configure a http_check using the -u parameter to check a specific URL, but while this works fine from the command line, the nagios check only returns Temporary failure in name resolution

# /usr/lib/nagios/plugins/check_http -H 176.67.169.157 -u http://dolicapax.org/
HTTP OK: HTTP/1.1 200 OK - 10960 bytes in 0.360 second response time |time=0.359959s;;;0.000000 size=10960B;;;0

Here's the command and service definitions

# 'check_http_url' command definition
define command{
        command_name    check_http_url
        command_line    /usr/lib/nagios/plugins/check_http -I '$HOSTADDRESS' -u '$ARG1$'
}


define service {
        host_name               frank.olsenit.no
        service_description     HTTP-wiki
        check_command           check_http_url!http://dolicapax.org/
        ...
}

Any ideas?

Appearantly Small Business Server insists on using remote.yourcompany.com for the virtual directories/connection points for Exchange, OWA and Remote Workplace.

However, if my trusted SSL certificate is issued to say secure.yourcompany.com the users will be hassled with security prompts warning of the mismatch.

Can this default be easily changed to match the SSL certificate?

I'm trying to find some good references for best practices for planning and configuring an MS-SQL 2008 R2 server.

I'm thinking in the lines of storage configuration, file locations, recommended application or user separation, common pitfalls etc.

I need to ensure PCI compliance by limiting mod_ssl to SSLv3 and TLSv1, and ensuring long keys. I've tried the following configuration, but certain combinations of SSLv2 seems to still be valid:

SSLCipherSuite HIGH:MEDIUM:!aNULL:+SHA1:+MD5:+HIGH:+MEDIUM

What should the SSLCipherSuite configuration look like to completely disable SSLv2 and meet the PCI requirements?

On RHEL and similar distributions such as CentOS and OEL you can set the hostname by adding a hostname entry in /etc/sysconfig/network.

HOSTNAME=hydrogen.lan

If you don't have such an entry, the system will fall back to the default behaviour - referencing the hostname configured on the first matching entry in /etc/hosts.

192.168.92.101 hydrogen.lan hydrogen

Now, my question is. Are there any good reasons to use the direct hostname configuration in /etc/sysconfig/network or is it simply redundant in most scenarios?

For some reason MTU still seem to be an occasional issue with trunked connections.

In this case I have a trunk connected to an Enterprise Linux 5 server. I use standard vlan seperation in Linux, and have the vlan interface bridged with virtual interfaces for Xen.

If a guest has the MTU set to the default of 1500, networking breaks. If I configure the guest's MTU to 1496, everything is fine.

As I understand it, Intel Pro/1000 PT is VLAN aware and should let the VLAN tag through, on top of the 1500 byte network package.

What is the trick to make this work? Is there a driver setting or some special way to configure the VLANs?

Additional information:

Dom0 is using the e1000e driver.

Support for jumboframes is disabled on the switches.

Strangely enough, this is only a problem for guests. Dom0 has no MTU problems, despite having connectivity on an alias of a vlan bridge (eg. vlan10:1)

How do you properly configure vlan bridges on RHEL5 or OEL5?

I've tried the following network-scripts, but no packets are recieved on the bridge. If I add an ip address to vlan60 I'm unable to reach the gateway for that subnet.

If I add the same address to eth0.60 it works fine.

I also notice that vlan60 has hardware address 00:00:00:00:00:00. Shouldnt the bridge inherit the hardware address of the physical controller/vlan interface?

What am I missing?

/etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE=eth0
BOOTPROTO=none
ONBOOT=yes

/etc/sysconfig/network-scripts/ifcfg-eth0.60

DEVICE=eth0.60
BOOTPROTO=none
ONBOOT=yes
VLAN=yes
TYPE=Ethernet
Bridge=vlan60 <-- This one should be BRIDGE=vlan60

/etc/sysconfig/network-scripts/ifcfg-vlan60

DEVICE=vlan60
BOOTPROTO=none
ONBOOT=yes
TYPE=Bridge

Here's the output from ifconfig, notice the 0 RX packets and the empty hardware address:

[root@hydrogen]# ifconfig vlan60
vlan60    Link encap:Ethernet  HWaddr 00:00:00:00:00:00
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:69 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 b)  TX bytes:8512 (8.3 KiB)

[root@hydrogen]# ifconfig eth0.60
eth0.60   Link encap:Ethernet  HWaddr 00:26:12:FB:80:0D
          inet addr:192.168.0.201  Bcast:192.168.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:8616 errors:0 dropped:0 overruns:0 frame:0
          TX packets:11472 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:546437 (533.6 KiB)  TX bytes:2283066 (2.1 MiB)

Update:

[root@hydrogen network-scripts]# brctl show
bridge name     bridge id               STP enabled     interfaces
vlan60          8000.000000000000       no  

I have a simple four node Oracle VM environment. A management server running in vmware, a nfs server for shared storage and two Oracle VM servers running the actual hypervisor.

For some reason the node running the pool master service will suddenly reboot for no obvious reason. I'm fairly sure it's a software issue, possibly a cluster watchdog of some sort. Just to be clear, it's the vm server/hypervisor that reboots, not the guest machines.

Have anyone seen similar issues, or have any suggestions as to where I should start looking for the root cause?

I don't see anything suspicious in the /var/log/ovs*/ logs, any other place I shold look?

The documentation from Oracle leaves a little something to be desired.

I'm configuring a 4 node Oracle VM environment. One management server, two vm servers and a storage server with direct attached storage.

The storage server is running Linux and I thus have the option of providing the shared storage for the VM servers on iSCSI (with OCFS2) or NFS.

Is it likely that one would perform better or more reliably than the other? Any other things one should take into consideration when deciding between the two?

Note that Oracle VM is the Xen based virtualization product from Oracle, not a generic term for virtualized Oracle databases.

There are a number of Xen based virtualization products on the market, and like with other new software, there is a need to try them out in a lab environment before doing production installation on customer sites.

I'm wondering if you could possibly run Oracle VM, XenServer or Virtual Iron inside VMware ESX, ESXi or VMware Server for testing purposes.

Or essentially, is there any way to avoid purchasing a new hardware cluster for each product?

update> I've now virtualized a complete Oracle VM environment within VMware without issues. Naturally all the guests are PVM. This makes is possible for me to gain experience with the Oracle VM platform without a hardware budget. Thanks everyone.

I would like to create a loop that repeats a ncftp transfer if it returns an error.

I'm a little unsure how the exit code variable can be used in a loop. Would something like this work?

until [$? == 0]; do
    ncftpput -DD -z -u user -p password remoteserver /remote/dir /local/file
done

I have some fairly large file transfers going across the atlantic every morning by ftp. From time to time the transfers will be distrupted, likely due connectivity issues, and the files will be left in an incomplete state.

I'm wondering if there is a better way to handle these file transfers. Would say, rsync or scp be more resilient to periodic loss of connectivity? The best would be if the transfer would reconnect and continue where it left off, should it be disrupted.

Large in this case means files up to several GiB and transfers spanning several hours.

I want to put together some scripts to run an automated health check of Oracle 9i and 10g databases. Before I start from scratch, I was wondering if anyone know of any available open source scripts that I could use as a base for this project.

I'm running a VMware Server 2.x with a number of guests. I now need to bridge in another network interface so that it will be available for a new guest machine.

The interface is visible and working on the host:

root@vmhost:/# ifconfig vlan72
vlan72    Link encap:Ethernet  HWaddr 12:34:56:78:9A:BC
UP BROADCAST RUNNING MULTICAST  MTU:1496  Metric:1

This is a trivial task using the configuration script vmware-config.pl. However that would require a full shutdown of the VMware Server software. So the big question is, can this be done without having to disrupt all the guests?

I've noticed that there is a "refresh network list" button in the web interface, which kinda implies that some changes to the network configurations must be possible while VMware Server is running.

My filer currently has two basic md-type software raid 5 sets. One 8 x 500 GB and one 4 x 1TB. To make the configuration a little more flexible I'm considering adding LVM. Before I do, I figured I should also look into ZFS.

Is ZFS available on Ubuntu, and can it replace md-raid and lvm?

I've had a few issues running software raid on XenServer, and I would also like to try out VMware ESXi which won't easily be combined with a software raid.

Are there any low cost PCI cards that would run 8 s-ata spindles in raid 5 and is supported by VMware ESXi 4? Performance don't need to be great, but a few hundred iops and somwhere around 100 MB/s sequential transfer would be nice.

To clearify, I was originally looking for a standard PCI card, however I also have a PCIe x16 slot that can be used instead.

As for the definition of low cost, i was hoping for a little less than $400-500.