Jason Antman's questions

I've got a bunch of LibVirt-managed (locally using virsh) KVM VMs on standalone Linux hosts (local KVM, local storage).

Is there any web-based application out there that will track the inventory - i.e. what VMs are on what hypervisor hosts, and are they running or not - and that has a working, usable API?

We're looking to move to "real" virtualization software sometime soon (some sort of butt-y stuff, probably either RHEV/oVirt or Open-something). My main concern is that I need to keep these current VMs with their current configuration - I need something that plays well with existing infrastrucutre. It's not really an issue if it doesn't also do what we want in the future (full management).

To be clear, I'm definitely not looking for a local GUI application as that's useless in our environment. I need something that's either a web application, or just a daemon, and which exposes an API.

I have a sizeable deployment of qemu/KVM VMs already, managed through libvirt. They're all CentOS 5 or 6 hosts and guests (the kernel lacks the 9p filesystem flags, so the "mount" shared filesystem won't work).

I'd like to pass an arbitrary string (or one or more key/value pairs, or a file, if that's easiest) from the host to the guest.

Requirements: 1) don't alter the networking setup (i.e. no host/guest local network and NFS on the host) 2) don't require new/custom kernels on the guests 3) Ideally, something we can do through libvirt. But that doesn't look possible, so this isn't required

Any ideas? I haven't been able to find much on this out there that doesn't fit into one of: 1) the "mount" filesystem stuff in the libvirt XML (as I said, CentOS lacks the 9p kernel flags, so this is a no-go) 2) NFS export on the host (which won't help at all unless I add a private network, which I can't) 3) The ugly hack to set the smbios serial number to... whatever arbitrary string.

I don't have much experience working with NIS at all, as I came from an LDAP environment. I have a project to move a bunch of clients within a NIS domain to point at a new NIS master server. There's no config management in place, and no real authoritative list of every machine in the domain.

How do I verify that no NIS clients are talking to the old master? I don't see any ypserv log files (the old master is a RedHat AS 3 box...), and AFAIK there's no reliable way to tcpdump for NIS traffic since it uses RPC.

Any ideas?

Does anyone have any ideas on mapping out a Cisco-based network via SNMP? I have SNMP access to all of the switches (obviously), and a list of all of the hostnames. From this, I need to be able to build out a network map (or at least find which switch is the parent of another switch). SNMP is pretty much the only option, as CLI logins are enigmatized.

I can get CDP neighbors via SNMP, but I'm not quite sure how to figure out which interface they're coming from, or which interface is the uplink.

My initial sample is 360 devices, after that I have to tackle the remainder of 1,900. It's a mix of IOS and CatOS, everything from 2948's running 8.3(2)GLX to 3750's running 12.2.

Any advice would be greatly appreciated.

We're currently using Puppet (with the manifests and related files in SVN) to manage configuration of our *nix hosts. However, I've hit a bit of a perplexing issue.

Many of our hosts have scripts specific to the host - cron jobs, data mining scripts, scripts that dynamically generate config files, etc. I'm looking for a way to manage these scripts, specifically version them and allow a relatively simple restore solution if a host is rebuilt, while not changing the existing layout.

I can't seem to find a solution that "works" for our environment.

• We've got scripts in arbitrary locations on the filesystem. Especially given the age of some of these apps, moving locations isn't an option.
• Most of the developers have an edit-in-place workflow. It's unlikely that this can be changed.
• SVN doesn't have a way to dereference symlinks, so I can't just create one directory with links to the scripts and version that.
• The developers don't have access to Puppet repos. This needs to work within existing filesystem permissions - i.e. a user should only be able to modify the scripts they have access to, nothing else.

I guess the easiest way to explain what I'm looking for is what I wanted but doesn't exist:

• SVN that handles symlinks (i.e. symlink all configs into a directory, then work as normal and have them versioned)
• An easy way for SVN to manage a given list of paths or directories on a host, but leave everything else untouched.

Any suggestions?

The shop I work in is pretty laid-back. We're on a documentation kick, only because historically we've been very bad with it. We do a lot of our brainstorming in face-to-face meetings, and also do a lot of communication via IM in addition to email.

While I'm usually pretty good about documentation and keeping copious lab notes, I just finished a build of a host and spent hours searching through IMs, emails, files on my workstation, etc. to pull out anything I missed in my lab notes, which formed a large amount of the basis for the internal documentation.

Does anyone have any thoughts on, aside from manually saving things to a project directory, managing various data sources (especially email and IM) and tracking them on project basis? Ideally, I'd like an easy way to put copies of emails, IM logs, etc. into a project-specific directory on my workstation and then just have a cron job that syncs that up with a shared folder. This isn't really a candidate for anything more advanced, as the bulk of the data will be copies of configs, code, etc.

Here are the big restrictions:

1. Email is via a centralized Zimbra install, so nothing can happen server-side.
2. My workstation is Linux.

Aside from writing Pidgin and Thunderbird plugins that let me tag chats and emails as belonging to a project, and then copy them to the appropriate place... any thoughts? Suggestions?

Thanks, Jason

Virtualization is one of the areas where I could really use some experience. I also run quite a few services (web, mail, dns, etc.) out of my home. Since most of my hardware is getting a bit old (I'm running on stuff that was surplused years ago...) I decided that it's about time I start renewing some things, and also play around with virtualization a bit more. My plan is to setup a SAN box (simple iSCSI target, relatively inexpensive gigE switch), get a pair (for starters) of new servers, and start building some new stuff with Xen, specifically planning on playing with live migration and full virtualization.

Does anyone have recommendations for used, older "servers" (really anything in a rack-mount form factor, I'm not too worried about things like iLO/iLOM for the test nodes) that support VT-x/AMD-V? I'm biased to HP, but it looks like they didn't make Proliants with VT-x/Vanderpool processors until G6 (for the DL360) or so, which is way out of my price range.

I'm looking in the sub-$300 range (or less, if possible), used, probably Ebay.

Any recommendations are greatly appreciated.

Edit:And, to catch this before the comments start coming - these are personal systems. I have first-generation Proliants still in use (I got them as corporate surplus in 05, they've been running since then, and probably were running since 01 or 02 prior to being sold). I don't need anything shiny and new - I've got a bunch of old boxes, at least one complete replacement for every model in use, and that's fine for me (and easy on the wallet).

A non-profit volunteer organization that I do some admin work for is in the process of planning a major renovation to their building, which is more or less a converted house (no basement, uninsulated attic, pretty much every other inch of space in use). We currently have the network hardware and servers - 1x 2U switch, 1x 1U router, patch panel, 5U UPS, 12U of servers of different heights, all Proliant - in a mechanical room, split between the network gear on a 12U wall-mounted rack and the servers on a big beefy wall-mounted shelf.

Since we're doing a major renovation to the building, I'd like to plan for a new TC / server closet from the beginning. The problem is that, as the building is a converted house and even relatively small at that, space is at a premium. I don't think it will be possible to expand the structure enough to allow for any "real" sized TC.

Does anyone have any ideas for setting up a short rack with both network equipment and servers in the minimum space possible? I assume the most we'll be able to come up with is something the size of a normal home closet (say, 3-4 feet wide, maybe 6 feet deep at best). The best theory I can come up with is to put a half-height rack all the way forward against the door (something with air movement like a screen door or metal mesh) and leave just enough space for a small-ish person to get around to the back of the rack, leaving about 2 feet behind the back of the rack and the wall.

If this were just network equipment, I'd do a wall mount rack, but the need to keep the servers in the same space complicates things a bit...

As a bit of background, one of my primary responsibilities at my day job is wireless, but we're running about 1,000 APs, all the higher-end BlueSocket and Meru stuff with the expensive controllers.

I do some admin work for a non-profit and am searching for an access point to install for them. My main concerns are security, stability and - above all - easy remote management. It also needs to be something standalone - we only need one, so a controller/dumb-AP architecture won't work.

If at all possible, I'd like something manageable over telnet or SSH, as I'll be doing a lot of administration remotely. In terms of features, all I really need is WPA and MAC filtering.

The organization is totally funded by donations, with a VERY small budget, so cost is a major factor. (Up to now, we've been managing with a Soekris board running Linux).

Any suggestions? Specifically in terms of cost vs reliability, and remote management?

Update 2009-10-20

I've done some research (looked through almost every AP on NewEgg and Amazon) and came up with a few that I'm considering: - D-Link DWL-3200AP - 3com 3CRWE675075, 3CRWE776075 - Cisco (Small Business) WAP200, WAP2000, WAP4400N

The main features that I used to come up with the list:

• 802.11n isn't important, as we won't be upgrading to Gig-E any time soon.
• Telnet/SSH and SNMP management (see below)
• External antennae are good...
• Multiple WPA options (we may have embedded Linux devices connected, so something simple is good)
• MAC-based ACL / client whitelisting (hopefully configurable via SNMP and/or CLI)
• 802.1x is a plus, but by no means required
• Multiple BSSIDs, 802.1q VLAN to SSID mapping is a plus

(The only thing I'm really wondering about is how full-featured the Telnet and SNMP management is. I have an inexpensive Brother printer with Telnet management, but you can only access about 5% of what the web interface does...)

Any opinions on those models?

Background: I'm a sysadmin at a relatively large university (about 15,000 users in residential space/ResNet). While my group is responsible for administering ResNet space (authentication, DHCP, etc.) the actual network devices are owned and run by another department. Most dorm buildings are on their own router and, by policy, VLANs cannot cross routers.

We're experiencing some strange DHCP problems, most likely related to viruses that run DHCP servers. Our DHCP failover plan is based on our DHCP servers not being authoritative, so when a box with a DHCP server (virus) pops up on a network, everyone starts taking its offers instead of the ones from the actual DHCP box.

Troubleshooting is greatly complicated by the fact that, since we don't have any devices in the subnet or on the VLAN, our only method of identifying the infected user is to physically drive out to the site, hook up to a port, and run a traffic capture (then associate a MAC with a switch port and turn off the port).

So, my idea is to make a few traffic sniffers/probes to install on problem networks (with one interface in the affected network and one in a known good subnet, to communicate back to us).

I've got two theories on how to do this:

1. Setup the device with vtund, and (as needed) tunnel all traffic from the interface in the affected network back to one of our boxes.
2. Install tcpdump and SShd on the device, write a little script that phones home with the device's known good IP, and then SSH into the device and do a packet capture as needed.

Any alternate theories? Has anyone had to handle a problem like this (specifically capturing traffic on a network that you can get a route to but can't actually hop on). Unfortunately, this needs to be a zero-budget solution (though I have a few Soekris boards with 3 interfaces each lying around).

Thanks, Jason