natxo asenjo's questions

We have an 'old' Dell PE r740xd server with quite high specs, installed with rhel 7 (latest). Running ls -l on / can take minutes.

Some specs:

# lscpu
Architecture:          x86_64
CPU op-mode(s):        32-bit, 64-bit
Byte Order:            Little Endian
CPU(s):                80
On-line CPU(s) list:   0-79
Thread(s) per core:    2
Core(s) per socket:    20
Socket(s):             2
NUMA node(s):          2
Vendor ID:             GenuineIntel
CPU family:            6
Model:                 85
Model name:            Intel(R) Xeon(R) Gold 6148 CPU @ 2.40GHz
Stepping:              4
CPU MHz:               2400.000
BogoMIPS:              4800.00
Virtualization:        VT-x
L1d cache:             32K
L1i cache:             32K
L2 cache:              1024K
L3 cache:              28160K
NUMA node0 CPU(s):     0,2,4,6,8,10,12,14,16,18,20,22,24,26,28,30,32,34,36,38,40                                                                                            ,42,44,46,48,50,52,54,56,58,60,62,64,66,68,70,72,74,76,78
NUMA node1 CPU(s):     1,3,5,7,9,11,13,15,17,19,21,23,25,27,29,31,33,35,37,39,41                                                                                            ,43,45,47,49,51,53,55,57,59,61,63,65,67,69,71,73,75,77,79
Flags:                 fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca                                                                                             cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1g                                                                                            b rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonst                                                                                            op_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 s                                                                                            sse3 sdbg fma cx16 xtpr pdcm pcid dca sse4_1 sse4_2 x2apic movbe popcnt tsc_dead                                                                                            line_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch epb cat_l3 cdp_l3                                                                                             invpcid_single intel_ppin intel_pt ssbd mba ibrs ibpb stibp tpr_shadow vnmi fle                                                                                            xpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm                                                                                             cqm mpx rdt_a avx512f avx512dq rdseed adx smap clflushopt clwb avx512cd avx512bw                                                                                             avx512vl xsaveopt xsavec xgetbv1 cqm_llc cqm_occup_llc cqm_mbm_total cqm_mbm_lo                                                                                            cal dtherm ida arat pln pts pku ospke md_clear spec_ctrl intel_stibp flush_l1d

# free -h
              total        used        free      shared  buff/cache   available
Mem:           376G        4.5G        371G         10M        342M        370G
Swap:          4.0G          0B        4.0G

# lsblk
NAME                     MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT
sda                        8:0    0  17.5T  0 disk
└─sda1                     8:1    0  17.5T  0 part
sdb                        8:16   0 111.7G  0 disk
├─sdb1                     8:17   0     1G  0 part /boot
└─sdb2                     8:18   0 110.7G  0 part
  ├─rhel_lab110--16-root 253:0    0    50G  0 lvm  /
  ├─rhel_lab110--16-swap 253:1    0     4G  0 lvm  [SWAP]
  └─rhel_lab110--16-home 253:2    0  56.7G  0 lvm  /home

Only sdb is being used right now, I have just installed the OS. What can be affecting the performance so dramatically?

somewhere in our network an ldap client is querying our AD servers without the proper CA information. This provokes the (in my view useless) system critical (source: schannel) event id 36887 on the domain controllers' event log:

The following fatal alert was received: 46.

How can I locate the misconfigured client?

using certutil is pretty straight forward:

certutil -exportpfx -p "" my serialnr path\to\hostname.pfx noroot

I need to convert it from pfx to pem, so I need to do some scripting. This is what I have so far:

   $output = ( certutil -store my | findstr /i seri )
   $separator = ":"
   $serialstring = $output.split( $separator )
   $serialnr = $serialstring[1]
   $exportpfx = "certutil -exportpfx -p `"`" my" + $serialnr + " path\to\"+$env:computername+".pfx noroot" 
   invoke-expression $exportpfx

This nearly works, but the resulting pfx file has a password. So apparently my $exportpfx var is saving more info than it should, but I cannot see what.

Any tips? Thanks!

in bind9 I can use rndc flushname zone.tld from a shell.

In the Windows DNS mmc I can select the zone and delete it.

With dnscmd I can flush the whole cache, but I just need to flush a zone's cache every now and then.

Is it possible and how? TIA