Bastien974's questions

I'm running CentOS7, PHP 8.0.30, postfix 2.10.1-9.el7 Sometimes emails we try to send through php mail() function are not sent and after enabling verbose logging for postfix's pickup, cleanup, qmgr, smtp we noticed nothing is being pickup.

pickup unix n - n 60 1 pickup -v

The email is lost between mail() (which call is logged in syslog) and postfix.

Sendmail is correctly defined in php.ini

sendmail_path = /usr/sbin/sendmail -t -i

Our exact same code runs perfectly on another server from the pool, but not this one server in particular. Any idea ?

We have Apache 2.4 setup with over 1000 vhosts, and multiple instances of logger in each :

CustomLog "|/usr/bin/logger -t apache-access -p local6.notice -n x.x.x.x" access_log

Restarting httpd takes 90+ seconds because it's opening thousands of connections to the rsyslog server.

Any advices on how to make it more efficient ?

I'm trying to make a script that will test if a website is using a non-self-signed certificate valid for its domain. Meaning it would not show a warning in browser.

I have tried with

openssl s_client -connect www.example.com:443 -servername www.example.com

Even though the certificate is not valid for the domain, I still get :

Verify return code: 0 (ok)

Any idea how I can achieve that ?

I would like to filter the result of a grep command, eg :

myRepo/path/to/my/file.php:123:                             error_log(' - myError');

If I do the following, it works.

echo " myRepo/path/to/my/file.php:123: error_log(' - myError');" | awk -F': ' '{print $1}'

But when it's the result of a grep command, it outputs the whole line, why ?

grep -rn "myError" | awk -F': ' '{print $1}'

I have CentOS 6 with Awk 3.1.7, bash 4.1.2

I have CentOS 7 and it comes with Rsync 3.0.9. I downloaded the 3.1.1 el7 rpm and installed with rpm -Uvh.

Now the daemon refuse to start. I tried to create :

/usr/lib/systemd/system/rsyncd.service

[Unit]
Description=A program for synchronizing files over a network
After=syslog.target network.target
ConditionPathExists=/etc/rsyncd.conf

[Service]
EnvironmentFile=-/etc/sysconfig/rsyncd
ExecStart=/usr/bin/rsync --daemon --no-detach "$OPTIONS"

[Install]
WantedBy=multi-user.target

No luck :

/bin/systemctl status  rsyncd.service
● rsyncd.service
   Loaded: not-found (Reason: No such file or directory)
   Active: failed (Result: exit-code) since Thu 2016-04-21 15:27:00 EDT; 56min ago
 Main PID: 1452 (code=exited, status=20)

Note those referenced file in the configuration exist:

-rw-r--r-- 1 root root 1699 Feb  4 14:27 /etc/rsyncd.conf
-rw-r--r-- 1 root root 11 Apr 21 16:09 /etc/sysconfig/rsyncd

I have haproxy 1.5.8, it proxies some requests (based on the path) to a third-party we have no control over.

Since the IP of backend server is resolved once at startup, it breaks if the IP change.

If there a workaround for that ? In nginx it's possible to declare an internal variable and have it cached for X seconds. I didn't found a similar solution for HAProxy.

I have a JSON file I need to update a particular value.

{
  "Comment": "comment",
  "test": {
    "enabled": true
  },
  "enabled": true,
  "otherStuff": blah,
  "otherStuff2": blah,
  "otherStuff3": blah,
}

I would like to change the value of the second "enabled" to false. With JQ Parser, I can easily retrieve it with jq '.enabled', but I'm not sure what's the best way to manipulate the JSON.

The JSON is a respond i get from an API and may change in the future, I cannot rely on the line or value before/after.

I have HAProxy setup in TCP mode, with client/server/connect timeout of 120s.

When I reload the configuration too fast, I sometime end up with multiple processes. By design, this is expected, so all established connections are drained.

My issue is that they not never terminated, even though all connections are closed.

ps aux | haproxy

    haproxy  12483  0.0  0.1 103748  1084 ?        Ss   20:45   0:00 /usr/sbin/haproxy -D -f /etc/haproxy/haproxy.cfg -p /var/run/haproxy.pid -sf 12405
    haproxy  12485  0.0  0.1 103748  1088 ?        Ss   20:45   0:00 /usr/sbin/haproxy -D -f /etc/haproxy/haproxy.cfg -p /var/run/haproxy.pid -sf 12405
    haproxy  12487  0.0  0.1 103748  1084 ?        Ss   20:45   0:00 /usr/sbin/haproxy -D -f /etc/haproxy/haproxy.cfg -p /var/run/haproxy.pid -sf 12405
    haproxy  25115  0.0  0.1 103748  1084 ?        Ss   21:26   0:00 /usr/sbin/haproxy -D -f /etc/haproxy/haproxy.cfg -p /var/run/haproxy.pid -sf 12488

netstat -pant | grep haproxy

tcp        0      0 0.0.0.0:443                 0.0.0.0:*                   LISTEN      25115/haproxy
    tcp        0      0 0.0.0.0:1936                0.0.0.0:*                   LISTEN      25115/haproxy
    tcp        0      0 0.0.0.0:80                  0.0.0.0:*                   LISTEN      25115/haproxy

I waited longer than the timeout of 120s. I don't understand what is holding them.

The following lsof for one of those old process show that there are still some FD for TCP LISTEN

# lsof -p 12483
COMMAND   PID    USER   FD   TYPE  DEVICE SIZE/OFF   NODE NAME
haproxy 12483 haproxy  cwd    DIR   202,1     4096      2 /
haproxy 12483 haproxy  rtd    DIR   202,1     4096      2 /
haproxy 12483 haproxy  txt    REG   202,1  4381869 412355 /usr/local/sbin/haproxy
haproxy 12483 haproxy  mem    REG   202,1    62864 396140 /lib64/libnss_files-2.17.so
haproxy 12483 haproxy  mem    REG   202,1   126288 396526 /usr/lib64/libselinux.so.1
haproxy 12483 haproxy  mem    REG   202,1   141760 396148 /lib64/libpthread-2.17.so
haproxy 12483 haproxy  mem    REG   202,1    89312 396076 /lib64/libgcc_s-4.8.2-20140120.so.1
haproxy 12483 haproxy  mem    REG   202,1    98720 396150 /lib64/libresolv-2.17.so
haproxy 12483 haproxy  mem    REG   202,1    13224 396957 /lib64/libkeyutils.so.1.5
haproxy 12483 haproxy  mem    REG   202,1    43768 396966 /lib64/libkrb5support.so.0.1
haproxy 12483 haproxy  mem    REG   202,1    19512 396128 /lib64/libdl-2.17.so
haproxy 12483 haproxy  mem    REG   202,1   170784 396962 /lib64/libk5crypto.so.3.1
haproxy 12483 haproxy  mem    REG   202,1    12744 396594 /usr/lib64/libcom_err.so.2.1
haproxy 12483 haproxy  mem    REG   202,1   937952 396964 /lib64/libkrb5.so.3.3
haproxy 12483 haproxy  mem    REG   202,1   273672 396958 /lib64/libgssapi_krb5.so.2.2
haproxy 12483 haproxy  mem    REG   202,1   486512 396073 /lib64/libfreebl3.so
haproxy 12483 haproxy  mem    REG   202,1  2000552 396122 /lib64/libc-2.17.so
haproxy 12483 haproxy  mem    REG   202,1  1967496 400756 /lib64/libcrypto.so.1.0.1j
haproxy 12483 haproxy  mem    REG   202,1   445424 400761 /usr/lib64/libssl.so.1.0.1j
haproxy 12483 haproxy  mem    REG   202,1    88568 396529 /lib64/libz.so.1.2.7
haproxy 12483 haproxy  mem    REG   202,1    36856 396126 /lib64/libcrypt-2.17.so
haproxy 12483 haproxy  mem    REG   202,1   152376 396115 /lib64/ld-2.17.so
haproxy 12483 haproxy    0u  0000     0,9        0   5420 anon_inode
haproxy 12483 haproxy    4u  IPv4 1435667      0t0    TCP *:http (LISTEN)
haproxy 12483 haproxy    5u  IPv4 1435668      0t0    TCP *:https (LISTEN)
haproxy 12483 haproxy    6u  IPv4 1435673      0t0    TCP *:jetcmeserver (LISTEN)

We are trying to design an architecture that will be able to handle more than 64k websockets.

We first tried with Amazon ELB, but its design doesn't allow unexpected spike of traffic nor websocket. (TCP mode timeout the websockets unexpectedly)

With HAProxy, those limits do not apply, but we'll be limited to ~64k websockets maintained between HA and the back-end servers.

Multiple solutions that came to mind :

• Multiple HAProxy instances, load balance with DNS (Route53 have a weighted option)
• Two HAProxy instances with Keepalived, multiple internal IP addresses (not sure if it's doable)

Is there a better way to do this ?

I have two servers, both have nginx. Server A is listening to 443 and is configured to authenticate with a Client SSL certificate.

Server B has an internal process that needs to communicate to Server A through nginx.

I'd like to configure Nginx on server B that will listen to 8080 (no encryption, since it's all local communication) and proxy_pass to ServerA:443.

The question is how do I inject a Client Certificate ? I didn't found any proxy_xxxx function that would do that.

I do know how to make an equivalent to that with socat, but my requirement is to use nginx.

I'm monitoring my IBM ServeRAID M5015 controller for RAID status with MegaCLI, I have this on one of the disk :

Enclosure Device ID: 252
Slot Number: 6
Enclosure position: 0
Device Id: 14
Sequence Number: 2
Media Error Count: 32
Other Error Count: 0
Predictive Failure Count: 18
Last Predictive Failure Event Seq Number: 8119
PD Type: SAS
Raw Size: 279.396 GB [0x22ecb25c Sectors]
Non Coerced Size: 278.896 GB [0x22dcb25c Sectors]
Coerced Size: 278.464 GB [0x22cee000 Sectors]
Firmware state: Online, Spun Up
SAS Address(0): 0x5000c50042c319c9
SAS Address(1): 0x0
Connected Port Number: 5(path0)
Inquiry Data: IBM-ESXSST9300653SS     B6336XN04HC10525B633
IBM FRU/CRU: 81Y9671
FDE Capable: Not Capable
FDE Enable: Disable
Secured: Unsecured
Locked: Unlocked
Needs EKM Attention: No
Foreign State: None
Device Speed: 6.0Gb/s
Link Speed: 6.0Gb/s
Media Type: Hard Disk Device
Drive:  Not Certified
Drive Temperature :33 Celsius

What does this mean exactly ? I can't find an exact description, is there a way to have more details ? The RAID array has the Optimal state.

Media Error Count: 32

Predictive Failure Count: 18

Is there a way through the CLI to power-on the front LED so I physically know which disk I need to replace ?

I have a mysql user connecting from Server2 to Server1 over SSL (mysql 5.0.77).

Here is the grants for this user on Server1, (server2 has an ip in the range xx.xx.xx.%)

mysql> show grants for user@'xx.xx.xx.%';
+-------------------------------------------------------------------------------------------------------------------------------+ 
| Grants for [email protected].%                                      |
+-------------------------------------------------------------------------------------------------------------------------------+ 
| GRANT USAGE ON *.* TO 'user'@'xx.xx.xx.%' IDENTIFIED BY PASSWORD 'xxx' REQUIRE SSL |

I did a flush privileges, but even with no privileges, I'm still able to show databases, show tables, select. How is that possible ?!!!

I checked that in 'show full processlist' the user is not always connected, fresh new mysql connection. Once the connection opened, I do a 'show grants', the effective permission is the same... USAGE.

--

The table mysql.db have an entry for this user that says he has select,insert,update and delete in the database. So is this kind of a hidden permission table ? How those permission could have gone there instead of mysql.user ?

I have a backup script that has this syntax "tar -czvf backup.tar.gz -T filelist" In this filelist, I'm listing folder to backup, but I also need to backup every file that has a given extension like "*.jpeg"

The file name are changing everyday, that's why I need to use a wildcard but it's not accepted in a file list.

Is there a workaround to make this work ?

Thanks !

I'd like to monitor a MySQL 5.0.77 server and log every incoming connection for a day. I need to know who is connecting to the database.

I tried with the general logging but it's logging way too much and I can't keep it on long enough, log file is growing too fast.

Is there a way to do that ? Thanks

I have a need to copy files between servers through the web. I'm using RSYNC over ssh to do so. The problem is, I need to be able to transfer files, no matter where the files is.

I created a user rsync and : usermod -G root -a rsync to give him the right to read/write anywhere on both servers.

During the transfer, I see this error:

rsync: mkstemp "/root/.myFile.RDr2HY" failed: Permission denied (13)

I don't understand what's happening.

edit: I just found out that the destination folder didn't have the write access for the root group. How would I give 100% access to this rsync user ? If I change its uid to 0, rsync stop working.

I need my cronjobs to still continue to output errors in some files, but I also want them to be emailed at the same time. That doesn't seem to be possible without some tricks.

I found this but didn't helped me.

What would be the most simple way to do that ?

I have a particular server : 50GB SSD for the OS (CentOS) , 128GB of RAM and 320GB SSD for MySQL.

I'm wondering if I really need SWAP? I often read that 2GB is good even with lots of RAM.

This server will be a MySQL database mainly. Is there any good reason for keeping a 2GB SWAP?

On a Fedora 11, I have more than 250 processes: migration, ksoftirqd and watchdog.

They are not taking any CPU or memory resources, just sleeping.

What is that?

I have SBS 08 and users with XP/Vista/7. I'd like to know if it's possible to broadcast a message to AD users while they are logged in the domain(for example to told users a reboot will be done, something like that) I'm not using terminal server.

I don't find the "Send message" in the Computer Management -> Shared Folders -> right click, All task.

Thanks for your help.

I'm having an issue with my sqlservr.exe which is always reading the SBSMonitoring.mdf, around 50MB/sec. I saw that in Reliability and Performance mmc. I don't think my hard drive love it... and it slows down my server. We have a SBS 2008.

I found nothing about it, help me please :) Thanks.