Mr Shoubs's questions

We have a new server (2012 R2), at the moment it doesn't do anything and I'm using it to test some SQL by running pgAdmin.

I access this using both standard remote desktop and remote desktop connection manager but have problems where the (only the pgAdmin) window goes black when I have more that a couple of pgAdmin windows open (had to orange box some bits, so ignore those). It stops being black if I make the window smaller (to about just under 1/4 screen size) and parts of the screen (e.g buttons) appear when I click on them.

I know MS made a lot of changes to RDP for 2012 and wondered if that was the reason or if anyone else experience this? How can I stop this from happening?

I am running the RDCM 2.2b2.462 and RD v? (whatever comes with win7, fully updated). I've tried a windows 8 r2 client and experience the same problem.

I have a web site (used to manage various parts of our software) that needs the permissions required to start/stop other application pools.

I've created a user and set the app pool identity to custom, however the web app still can't start/stop the app pools. I get the following Error:

System.UnauthorizedAccessException: Filename: redirection.config
Error: Cannot read configuration file due to insufficient permissions
   at Microsoft.Web.Administration.Interop.AppHostWritableAdminManager.GetAdminSection(String bstrSectionName, String bstrSectionPath)
   at Microsoft.Web.Administration.Configuration.GetSectionInternal(ConfigurationSection section, String sectionPath, String locationPath)
   at Microsoft.Web.Administration.ServerManager.get_ApplicationPoolsSection()
   at Microsoft.Web.Administration.ServerManager.get_ApplicationPools()

Discussion here suggests setting the application pool to local system or administrator, this does work, but I don't want to do this for security reasons (external support will need access this site).

I did give the user higher permissions (as suggested here), starting by making it part of the local administrators group, but initially this didn't work, and giving the user read/write/mod permission on C:\Windows\System32\inetsrv\config also didn't work. I must have done something wrong as local administrator now works, however this still isn't what I want.

So can anyone suggest the permissions I need to add to this user, and how can I apply them?

An answer my problem (but different question) is here, but to clarify, I think I need to give an individual user "IIS Runtime Operation Permissions", does anyone know how to do this, if indeed this is the permissions I require?

I have a number of batch files, which all work when ran separably to back up various Postgres dbs across the network. However when ran through task scheduler the backup files aren't created. There are no job warnings or errors, nothing to indicate anything is wrong except that the files don't exist. There is nothing in the event logs either.

So how can I work out what is wrong and fix it, what should I look at first?

I have a folder that has over 1000 text files in it and I need to check if they all have the same contents, they are all the same size so I can't tell that way - does anyone know of a mass file comparison too that will accept many files as an input and highlight any changes that differ from the first file that was loaded?

OS=Windows

Just installed Ubuntu Server 10.04 on VMWare ESXi 4.0.0 (201167) and changed the interfaces file.

My (modified) interfaces file looks like this:

auto lo
iface lo inet loopback

iface eth0 inet static
 address 192.168.254.159
 netmask 255.255.255.0
 network 192.168.254.0
 broadcast 192.168.254.255
 gateway 192.168.254.1

On reboot (or /etc/init.d/networking restart) ifconfig -a shows the following:

eth0      Link encap:Ethernet  HWaddr 00:0c:29:cc:0b:95
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

So eth0 won't work until I type:

ifup eth0

I've had this working in previous versions of Ubuntu without any problems, does anyone know how to get this working in 10.04?

I have an old capture file that needs analysis, and I need to know which interface was chosen to capture the traffic, is there a way to find out?

I'm trying to diagnose a network related problem - please understand these points before suggesting an answer (apologies if more information is required, I will add anything people ask).

• We have a server only network (5 app server, 4 db servers, few other servers) that appears to be suffering packet loss between servers
• I can see this happening on wireshare - there are a lot of TCP Retransmissions, TCP_Out-of-Order, TCP DupACK and I think some TCP_ZeroWindow packets too.
• There appears to be a lot of Bad Checksums on the IP protocol
• I think the network adapters have a very constant and high (90-100%) load due to the extra retries caused by this packet loss
• As the external requests on this network increase (to the app servers) the network performance decreases
• the app servers generate their own traffic when used by the external request
• The external requests come through a core router and the network is on it's own segment
• This high load "magically" dissapeared after 1-2 days, I say magically as we where only monitoring at the adapters at the time the load dropped, there is still packet loss showing in wireshark, albeit a lesser amount.
• Nothing points to a compromised server.
• Unfortunately we don't have physical access to any of the hardware
• We can't disrupt the current service

Given the above, what is the best way to determine what is causing the packet loss (we expect it to be a managed switch).

Is there any software that can provide us with empirical evidence of what is causing the issues?

Thanks in advance

I've been looking at wireshark, and have a lot of UDP traffic to port 2557 (from 25322), the port is reportedly used for nicetec-mgmt, does anyone know what this is?

I'm trying to run the following command:

Backup-SPFarm -Directory E:\Backups -BackupMethod full -Verbose

However it errors saying there isn't enough disk space... the backup will be about 1.8Gb in size, I have 27.52GB free, so why does it think I need 30Gb?

VERBOSE: Leaving BeginProcessing Method of Backup-SPFarm.
VERBOSE: Performing operation "Backup-SPFarm" on Target "SHAREPOINTSERV".
Backup-SPFarm : There is not enough disk space. Free additional space on your h
ard disk and then try again. Approximate amount of space needed: 30.12 GB. Amou
nt of space free on disk: 27.52 GB.
At E:\Backups\Script\BackupSharePointFarm.ps1:3 char:14
+ Backup-SPFarm <<<<  -Directory E:\Backups -BackupMethod full -Verbose
    + CategoryInfo          : InvalidData: (Microsoft.Share...mdletBackupFarm:
   SPCmdletBackupFarm) [Backup-SPFarm], SPException
    + FullyQualifiedErrorId : Microsoft.SharePoint.PowerShell.SPCmdletBackupFa
   rm

VERBOSE: Leaving ProcessRecord Method of Backup-SPFarm.
VERBOSE: Leaving EndProcessing Method of Backup-SPFarm.

I've installed Splunk (4.1.5(85165) on windows) and have uploaded some logs without any issues.

I now want to monitor a linux server, but I'm having problems adding the datasource and always get the message:

Encountered the following error while trying to save: In handler 'monitor': Path must be absolute.

I'm using Splunk Web and have set the host field value to the two servers IP address and the full path on server to /var/log (and tried various other combinations).

On the Linux server I've added *.*@192.168.254.100 to syslog.conf.

I've read the manual, but it doesn't really help. and I'm finding a lack of tutorials. Pretty much thinking of abandoning the idea of Splunk now. I'm obviously missing some sort of basic information here. Can anyone help out? Being pointed in the direction of some decent tutorials would be good...

I'm having trouble understand how all this data gets sent to Splunk and how Splunk intercepts/retrieves it.

I've just installed Postgres9 and it is up and running without any issues. There is one thing however that is confusing me:

If I type /usr/local/pgsql/bin/psql test then postgres command line loads and I can use it as expected, however...

If I cd /usr/local/pgsql/bin then type psql test I get the following error:

The program 'psql' is currently not installed. To run 'psql' please ask your administrator to install the package 'postgresql-client-common'

Does anyone know why? (please don't say install postgresql-client-common as this doesn't solve the problem)

I'm looking for advice/best-practices/+ve/-ve or other idea's on deployment and maintenance of many (50) Web Services and Web Service Applications on IIS across an application server cluster of 10 machines for Service Orientated Client (WinApp) Software.

Currently we have one solution that contains many Web Service Projects. Software is developed separately and later integrated when ready for release. This involves the integration manager (unfamiliar with the code), adding the project to the main solution and ensuring everything works, e.g. references etc. aren't broken. This means we end up with one site in IIS that serves many web services.

An recent alternative idea, is to have multiple sites - possibly grouping related web services into one site, but keeping other web services in different sites, although this increases maintenance (as there are more sites) it means parts of the software can be updated separably and tested, by the dev who wrote the code.

May be relevant: We use source control for the code, have many users (around 1million hits a day) and can tolerate 0 downtime during working hours.

Currently to update a single web service, the application server must be taken out of the cluster, updated, then added back into the cluster.

Is there a more efficient/flexible, yet still maintainable way of going about this?

I am trying to set up VPN using routing and remote access.

I've tried two configurations, one using a single network card, and one using two network cards.

I can connect through my VPN and get assigned an IP address by the DHCP server, but I can't "SEE" anything. By this I mean the client appears completely blind to the office network, this means:

• No ping to any office server including the VPN server (I've stopped ICMP being filtered in and out)
• No DNS resolution (isn't surprising if I can't connect by IP address. I tried accessing the VPN Server Share and a web page hosted on it using the domain name and the IP address, e.g. http://host.com/abc and http://192.169.254.199/abc)
• Can't access any network resources (also not surprising given the above)

I've not had any problems connecting the VPN at all (I thought I had, but this was to do with the test router I given).

This doesn't appear to be a firewall/router problem as I configured it to allow VPN traffic through and forward to the correct server.

This, I think, is confirmed as the VPN server event logs shows success audits (that is, logon events).

However it does show the following event directly after the success audit logon event occurs (and I don't know if this is normal but wouldn't expect it to be - the VPN client doesn't disconnect).

An account was logged off.

Subject:
    Security ID:        [DomainName]\[UserName]
    Account Name:       [UserName]
    Account Domain:     [DomainName]
    Logon ID:       0x[xxxxxx]

Logon Type:         3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.

I am not sure if this is of any use, but Wireshark shows me connecting successfully and then a load of encrypted packets, which is what I would suspect:

• There's a PPP LCP/CHAP configuration conversation which is the client connecting.
• I don't see any ICMP on either side when I do a ping to the VPN public interface (I assume this is because it is encapsulated on the GRE packets).

However the following is interesting (which I can't explain):

1. Pinging the public interface (A) (of VPN Server) I see increased PPP and GRE traffic
2. Same if I ping the private interface (B) (of VPN Server)
3. If I ping another server (C) on the network I can see the ICMP packet requests but no replies (I'm not sure if (C) server is replying directly to the VPN IP of the client (D) or not - this does appear the case as I see the traffic in (A))

I can't explain points 1 or 2 - I'd expect to see ICMP, but the problem does appear to be sending traffic to (D). To check this I pinged (D) from (C) and RECIEVED a reply, however I DID NOT see correlating ICMP traffic on (D) (could this have been GRE traffic?). I find this strange, but (C) is definitely pinging the correct machine as it stops responding when I disconnect (D) from the VPN.

Also note, I don't see any traffic on (D) to the VPN network addresses, only to the routers which have the port forwarding set up. Could this be some sort of routing problem?

The VPN server does seem to have a problem pinging the (D)- says NO RESOURCES, PathPing shows it is using interface (A). and this problem only occurs when pinging (D), it pings everything else without problem.

I changed RRAS to single NIC setup and the no resources problem went away - I can seemingly ping the client from all machines, but can't ping anything from the client. I say seemingly as when I ping the client it takes less than 1 ms (bear in mind this is across the Internet and different ISP's) and I don't see any ICMP traffic on the VPN server - plus when I disconnect the client, it is still pingable!?! (As if the VPN server is replying to pings on the client's behalf.) Whilst this is happening the VPN server gets timeouts when it pings the disconnected client. VERY STRANGE!

After leaving it for some time (drinking tea, eating food sort of length) the VPN server has gone back to the No resources problem, and not I have no ping in either direction. Disabling RRAS and enabling it again put me back to where I was just now, I can now ping from LAN to client.

I cloned a vmware machine on vSphere client, which meant I needed to run NewSID or sysprep to change the SID. As newSID isn't available any more, I ran sysprep without checking the generalise option, this didn't solve the problem (inconsistent sid), so I ran it again but chose the generalise option this time. This solved the problem, but for some reason created another - the server won't configure the static IP address that I assigned to it - it uses a 169 address instead. If I choose to have it automatically assigned an IP it picks up the correct address. There isn't anything wrong with my network, the problem will be on this box.

I have quite proficient networking skills, but this problems eludes me. No other servers have this problem, just the cloned one.

I have a document library to which I have full permissions. There is a document and a folder in the library. I want to move the document into the folder. How do you do this?

I've had someone set up a domain controller on windows 2008 on one server, and sql server 2008 on another. The domain seems to be working fine, I'm logged on as a domain user on both servers, nothing seems to be a problem there.

However, when I try to add a domain user/group to SQL Server Security (e.g. clicking ok from the create login screen) it says it can't find it (even though I've used the search to find the correct account in the first place), when I try to logon (even though I haven't added it yet) it says something about the account being part of an untrusted domain instead of saying I don't have permission to log on.

Anyone have any ideas on what is set up incorrectly?

We have two sites, one linux (Ubuntu) based, the other windows based which we would like to connect permently over VPN (using openVPN).

We need to backup some files on a number of linux (Ubuntu) servers to the windows Server at a remote site.

I'm considering using Bacula. Does anyone else have any experience with this scenario?

I'd be greatful for any other helpful resources you could point me to.

We have two sites, one linux based, the other windows based which we would like to connect permently over VPN.

Does anyone know which linux VPN software is best for this? (I'm using PPTP on windows atm, but will change to IPSec once I understand what I am doing)

The primary reason to to run an offsite backup (I think we will use bacula for this).

I'm trying to set up SASL to a relayhost to send external email. I've read a hell of a lot and done everything I'm supposed to have done. However our provider won't accept me relaying emails with (we are not on their network, but they say this is ok as long as we auth with SASL).

Can anyone suggest how to get around these errors?

My mail log shows the following:

Nov 16 12:17:36 db3 postfix/smtpd[11576]: connect from 82-69-111-139.dsl.in-addr.zen.co.uk[82.69.111.139]
Nov 16 12:17:36 db3 postfix/smtpd[11576]: warning: SASL authentication failure: realm changed: authentication aborted
Nov 16 12:17:36 db3 postfix/smtpd[11576]: warning: 82-69-111-139.dsl.in-addr.zen.co.uk[82.69.111.139]: SASL DIGEST-MD5 authentication failed: authentication failure
Nov 16 12:17:37 db3 postfix/smtpd[11576]: NOQUEUE: reject_warning: RCPT from 82-69-111-139.dsl.in-addr.zen.co.uk[82.69.111.139]: 504 5.5.2 <danpc>: Helo command rejected: need fully-qualified hostname; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<danpc>
Nov 16 12:17:37 db3 postfix/smtpd[11576]: C52C6258073: client=82-69-111-139.dsl.in-addr.zen.co.uk[82.69.111.139], sasl_method=LOGIN, [email protected]
Nov 16 12:17:37 db3 postfix/cleanup[11578]: C52C6258073: message-id=<001301ca66b6$d01fdab0$705f9010$@[email protected]>
Nov 16 12:17:37 db3 postfix/qmgr[10775]: C52C6258073: from=<[email protected]>, size=6496, nrcpt=1 (queue active)
Nov 16 12:17:37 db3 amavis[6836]: (06836-19) ESMTP::10024 /var/lib/amavis/tmp/amavis-20091111T171538-06836: <[email protected]> -> <[email protected]> SIZE=6496 Received: from db3.wsautovhc.co.uk ([127.0.0.1]) by localhost (db3.wsautovhc.co.uk [127.0.0.1]) (amavisd-new, port 10024) with ESMTP for <[email protected]>; Mon, 16 Nov 2009 12:17:37 +0000 (GMT)
Nov 16 12:17:37 db3 amavis[6836]: (06836-19) Checking: vAhNgVoszXXC [82.69.111.139] <[email protected]> -> <[email protected]>
Nov 16 12:17:37 db3 amavis[6836]: (06836-19) cached 7a4790212196723b5d7702c38770fe2c from <[email protected]> (1,1)
Nov 16 12:17:37 db3 amavis[6836]: (06836-19) p001 1 Content-Type: text/plain, size: 5609 B, name:
Nov 16 12:17:37 db3 postfix/smtpd[11581]: connect from localhost[127.0.0.1]
Nov 16 12:17:37 db3 postfix/smtpd[11581]: 380D425823E: client=localhost[127.0.0.1]
Nov 16 12:17:37 db3 postfix/cleanup[11578]: 380D425823E: message-id=<001301ca66b6$d01fdab0$705f9010$@[email protected]>
Nov 16 12:17:37 db3 postfix/smtpd[11581]: disconnect from localhost[127.0.0.1]
Nov 16 12:17:37 db3 postfix/qmgr[10775]: 380D425823E: from=<[email protected]>, size=6983, nrcpt=1 (queue active)
Nov 16 12:17:37 db3 amavis[6836]: (06836-19) FWD via SMTP: <[email protected]> -> <[email protected]>,BODY=7BIT 250 2.6.0 Ok, id=06836-19, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 380D425823E
Nov 16 12:17:37 db3 amavis[6836]: (06836-19) Passed CLEAN, [82.69.111.139] [82.69.111.139] <[email protected]> -> <[email protected]>, Message-ID: <001301ca66b6$d01fdab0$705f9010$@[email protected]>, mail_id: vAhNgVoszXXC, Hits: 0.468, size: 6496, queued_as: 380D425823E, 168 ms
Nov 16 12:17:37 db3 postfix/smtp[11579]: C52C6258073: to=<[email protected]>, relay=127.0.0.1[127.0.0.1]:10024, delay=0.63, delays=0.46/0/0/0.17, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 380D425823E)
Nov 16 12:17:37 db3 postfix/qmgr[10775]: C52C6258073: removed
Nov 16 12:17:37 db3 amavis[6836]: (06836-19) TIMING [total 171 ms] - SMTP greeting: 1 (1%)1, SMTP EHLO: 0 (0%)1, SMTP pre-MAIL: 0 (0%)1, SMTP pre-DATA-flush: 1 (1%)2, SMTP DATA: 38 (22%)24, check_init: 0 (0%)24, digest_hdr: 0 (0%)24, digest_body: 0 (0%)24, gen_mail_id: 0 (0%)25, mime_decode: 5 (3%)28, get-file-type1: 15 (9%)36, decompose_part: 1 (1%)37, parts_decode: 0 (0%)37, check_header: 1 (1%)38, spam-wb-list: 1 (1%)39, update_cache: 1 (0%)39, decide_mail_destiny: 0 (0%)39, fwd-connect: 13 (8%)47, fwd-mail-pip: 1 (1%)48, fwd-rcpt-pip: 0 (0%)48, fwd-data-chkpnt: 0 (0%)48, write-header: 1 (0%)48, fwd-data-contents: 0 (0%)48, fwd-end-chkpnt: 81 (48%)96, prepare-dsn: 0 (0%)96, main_log_entry: 5 (3%)99, update_snmp: 1 (1%)99, SMTP pre-response: 0 (0%)100, SMTP response: 0 (0%)100, unlink-1-files: 0 (0%)100, rundown: 0 (0%)100
Nov 16 12:17:37 db3 postfix/smtp[11582]: 380D425823E: to=<[email protected]>, relay=mailhost.zen.co.uk[212.23.3.98]:25, delay=0.4, delays=0.08/0.01/0.22/0.08, dsn=5.0.0, status=bounced (host mailhost.zen.co.uk[212.23.3.98] said: 550-This is not an open relay. To send through this server you must either be 550 on a Zen Internet IP address or be authenticated over TLS. (in reply to MAIL FROM command))
Nov 16 12:17:37 db3 postfix/cleanup[11578]: A9DBC25823F: message-id=<[email protected]>
Nov 16 12:17:37 db3 postfix/bounce[11583]: 380D425823E: sender non-delivery notification: A9DBC25823F
Nov 16 12:17:37 db3 postfix/qmgr[10775]: A9DBC25823F: from=<>, size=9245, nrcpt=1 (queue active)
Nov 16 12:17:37 db3 postfix/qmgr[10775]: 380D425823E: removed
Nov 16 12:17:37 db3 postfix/virtual[11584]: A9DBC25823F: to=<[email protected]>, relay=virtual, delay=0.16, delays=0.08/0/0/0.08, dsn=2.0.0, status=sent (delivered to maildir)
Nov 16 12:17:37 db3 postfix/qmgr[10775]: A9DBC25823F: removed
Nov 16 12:17:39 db3 postfix/smtpd[11576]: disconnect from 82-69-111-139.dsl.in-addr.zen.co.uk[82.69.111.139]

I'm trying to set up SASL to a relayhost to send external email. I've read a hell of a lot and done everything I'm supposed to have done. However our provider won't accept me relaying emails with (we are not on their network, but they say this is ok as long as we auth with SASL):

host mailhost.zen.co.uk[212.23.3.98] said: 550-This is not an open relay. To send through this server you must either be 550 on a Zen Internet IP address or be authenticated over TLS. (in reply to MAIL FROM command)

We agree that I'm not sending the username and password other wise it would either send, or say my username password is incorrect.

The question is, why isn't postfix sending it:

Heres the parts of my main.conf that I think are relevent:

    smtpd_helo_restrictions = permit_mynetworks, warn_if_reject reject_non_fqdn_hostname, reject_invalid_hostname, permit

    smtpd_client_restrictions = reject_rbl_client sbl.spamhaus.org, reject_rbl_client blackholes.easynet.nl, reject_rbl_client dnsbl.njabl.org

    smtpd_recipient_restrictions = reject_unauth_pipelining, permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unauth_destination, check_policy_service inet:127.0.0.1:60000, permit

    smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_non_fqdn_sender, reject_unknown_sender_domain, reject_unauth_pipelining, permit

    relayhost = mailhost.zen.co.uk
    smtpd_sasl_auth_enable = yes
    smtpd_sasl_password_maps = hash:/etc/postfix/sasl_passwd
    smtpd_sasl_type = cyrus
    smtpd_sasl_authenticated_header = no
    broken_sasl_auth_clients = yes
    smtpd_sasl_security_options = noanonymous
    smtpd_sasl_local_domain =

of couse I've set the password in sasl_passwd and postmapped it. Here's some of the resources I've been using are:

Would be great is anyone has any other suggestions :)