Zizzencs's questions

I have a strange slowdown problem with a Firebird database. During the daily use of the database the clients experience significant slowdowns while the system still have lots of resources available. Some information about the environment:

• 64 bit Firebird 2.5.2 server running in SuperServer mode
• the database is running on a 64 bit Windows 2008 R2 server OS
• the server OS is running in a VMware 4.1 VM with 4 CPU cores and 16 GB of RAM
• the database size is around 37 GB and the number of concurrent connections to the database is around 150.

While observing the slowdowns:

• the CPU usage on the machine is between 40-60% without higher spikes and the load is nicely distributed among all 4 cores
• the memory usage of the server is around 4-6 GB and the rest of the memory is used as OS cache
• the disc queue lenghts almost never go over 0.3 with around 2-5 ms latency
• there is almost no network activity on the server.

Still, the slowdown seems to be linked to the general load on the server. During the night when no users are connected to the database/no background jobs are running a test query used for reference executes in 4-5 seconds while during the day when all the users are connected to the database executing the same reference query requires 60+ seconds to finish. It should be added though that the slowdown is general in nature, there are no specific queries that are slower while the server is under load, everything gets slower within the specific Firebird database. The server has other databases with a very low number of transactions executed daily and these other databases show no sign of slowdowns. I even created a copy of the live database experiencing slowdowns and executed the same query against both the originaly and the duplicate database - the original did execute the query slow and hte duplicate fast. The only difference between the original and the duplicate I know is the number of connected users/concurrent transactions.

As I found no evident reasons of all these in the available OS resources so I tried to fetch statistics from Firebird.

The observations:

• at peak times the databse has 30-40 transactions running in parallel according to mon$statements (where mon$state == 1 which according to the archives means the transactions are running or are waiting for a lock)
• fb_lock_print displays the following about the database:

LOCK_HEADER BLOCK

    Version: 145, Active owner:      0, Length: 2097152, Used: 1335440
    Flags: 0x0001
    Enqs: 9993237, Converts:  93191, Rejects: 1417230, Blocks:      2
    Deadlock scans:      0, Deadlocks:      0, Scan interval:  10
    Acquires: 19972846, Acquire blocks:      0, Spin count:   0
    Mutex wait: 0.0%
    Hash slots: 1009, Hash lengths (min/avg/max):    0/   2/   7
    Remove node:      0, Insert queue:      0, Insert prior:      0
    Owners (38):    forward:  20824, backward: 872088
    Free owners (126):      forward: 973360, backward: 728016
    Free locks (370):       forward: 852200, backward: 195936
    Free requests (12425):  forward: 614608, backward: 1230536
    Lock Ordering: Enabled

Here I noted that the "rejects" field accounts for ~14% of "enqs" field but unfortunately I don't know the exact meaning of these values. I guess about 14% of the lock requests are rejected for some reason but I might be completely wrong.

So the questions:

• How should the output of fb_lock_print interpreted in this case? Are these numbers "wrong" in some sense? Can they be improved by some parameter tuning?
• What additional steps should be taken to pinpoint what causes the slowdowns?

I have a new Winwdows Sever 2008 R2 machine with two network cards. The situation is as follows:

• One network card is connected to CompanyLAN_1 (10.0.0.0/24)
• Through this card the machine can reach 10.0.0.254
• Through 10.0.0.254 the machine can reach 10.0.0.0/16
• The other network card is connected to CompanyBackup_1 (192.168.0.0/24)
• Through this card the machine can reach 192.168.0.254
• Through 192.168.0.254 the machine can reach 192.168.0.0/16
• The machine should NOT be able to access any networks beyond 10.0.0.0/16 and 192.168.0.0/16 (the machine should have no internet access at all)

What is the proper/recommended way of setting this up in Win2k8R2?

A) set up the network cards with the proper netmasks and put default gateways to each one

B) set up the network cards with the proper netmasks and put a default gateway to the normal one and add a static route to the backup one

C) set up the network cards with the proper netmasks and add two static routes, one for each?

Any link to official Microsoft references detailing recommendations would be welcome as well.

I have a VMware infrastructure with some ESXi 4.1 hosts and a vCenter Server 5.0 installed. I need to extend our hardware inventory with the following info:

• how many memory slots are available in each ESXi host
• how many and what type (DDR2/DDR3, size, MHz) of memory modules are installed in the slots

To collect this info I have to use PowerCLI and if needed, I can use ESXCli from within it. However I do not have ssh access to the ESXi hosts, so running native ESXi commands is not a possibility.

Is there a way to query the memory information from PowerCLI?

(As a bonus it would be lovely to query if the RAID controllers in the ESXi hosts have a BBWC module installed...)

I have an application on linux that puts randomly (truly randomly, not following any pattern) named log files in /opt/application/logs.

I need to read all these files with rsyslog and forward their content to a central rsyslog server.

The forwarding part is easy but how could I push these logs to the local rsyslog?

I'm looking for a suitable program to copy files from one linux machine to another one. The program should be able to do authentication but it should not do encryption. The reason behind the latter is the lack of CPU power to do the encryption.

I copy backups from ~70 machines to a single backup server simultaneously. The single server is an HP Proliant DL360 G7, with 10 Gbps ethernet connection and an FC storage backend that can do 4 Gbps. Through FTP I can write ~400MB/sec to the storage (that's about what I want) but through ssh with arcfour I can only do ~100MB/sec while having 100% CPU usage. That's why I want file transfers not to be encrypted.

The alternatives that I found not really suitable:

• rcp: no authentication, forget it
• FTP: making the authentication "secure" (at least preventing plain-text password exchange) is possible but not really easy and I haven't found a method to force any FTP daemon to encrypt the control channel (for the authentication) and not to encrypt the data channel (for data transfers)
• SCP/SFTP: in farely recent ssh(d) implementations you can't turn off encryption. The best you can do is to use the arcfour cypher for the encryption but it sill uses too much CPU power for my needs.
• rsync over ssh: same problems as with SCP/SFTP.
• plain rsync: from the documentation of rsyncd: "The authentication protocol used in rsync is a 128 bit MD4 based challenge response system. This is fairly weak protection, though (with at least one brute-force hash-finding algorithm publicly available), so if you want really top-quality security, then I recommend that you run rsync over ssh." It's a no-go.

Is there a protocol/program that can do exactly what I want?

(A big plus would be if it could work on windows as well and/or if it would support rsync-stlye copying/synchronization (e.g. copy only the differences).)

Some syslog implementations on linux (sysklogd, rsyslog) include the following line in their default configuration:

mail.*    -/var/log/maillog

As far as I know the dash sign means that it is not required to do sync() after a log message is written to this logfile.

Why is that and why should we handle maillog differently?

I have a linux machine on a network where the machine only has access to exactly one NTP server. After the time synchronization the status looks like this:

[root@test ~]# ntpq -p
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
 <ip address>    <ip address>     3 u    8   64   17    1.397    2.510   1.954
*LOCAL(0)        .LOCL.          10 l    6   64   17    0.000    0.000   0.001

My problem here is that even though the remote NTP server has way lower stratum and a decent jitter value, ntpd always picks the local clock as the time source, and in time its clock gets late. The situation remains the same, even after one day, so it's not about me not waiting enough for things to come together.

Questions:

• is it possible to get reliable time synchronization with only one NTP server on the network? (my guess is no)
• can I force ntpd somehow to prefer the NTP server over the local clock in this situation?

I have a small test network that includes Win2k8 R2 machines, an Enterprise CA server and an Exchange 2010 SP1 RU1 CAS server. I would like to issue a certificate for Exchange from the CA.

As the first step, I created the certificate request, which (according to OpenSSL) contains the following info:

C:\OpenSSL\bin>openssl req -in e.req -noout -text
Certificate Request:
    Data:
        Version: 0 (0x0)
        Subject: CN=mail.mnet.com, OU=IT, O=MNet, L=Budapest, ST=Budapest, C=HU
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (2048 bit)
                ...snip...
                Exponent: 65537 (0x10001)
        Attributes:
            1.3.6.1.4.1.311.13.2.3   :6.1.7600.2
            1.3.6.1.4.1.311.21.20    :unable to print attribute
            1.3.6.1.4.1.311.13.2.2   :unable to print attribute
        Requested Extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Subject Alternative Name:
                DNS:cas.int.mnet.com, DNS:mail.mnet.com, DNS:autodiscover.mnet.com, DNS:pop.int.mnet.com, DNS:imap.int.mnet.com
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Key Identifier:
                F0:7E:53:47:BE:04:0F:5C:78:FD:63:8C:D6:5C:BC:0D:45:A3:4F:48
    Signature Algorithm: sha1WithRSAEncryption
        ...snip...

As the second step, I would like to submit this request to the CA, but I get the following message:

The request contains no certificate information.

Denied by Policy Module 0x80094801, The request does not contain a certificate template extension of the CertificateTemplate request attribute.

What would be the best way to get this working?

How should I generate the same request from Exchange to include the info on which certificate to use?

How should I convince the CA to issue the certificate, even if the request doesn't match a certificate template?

(I'm actually interested in the answer to all three questions to learn more about both Exchange and the CA services.)

I would like to have a single webserver with a single certificate that hosts the following domains:

• onenameofthecompany.com
• othernameofthecompany.com
• www.onenameofthecompany.com
• www.othernameofthecompany.com
• bla.onenameofthecompany.com
• bla.othernameofthecompany.com
• ...

In theory, I could create a certificate with the following characteristics:

• Subject contains (*.)onenameofthecompany.com
• SubjectAlternateName contains:
  • onenameofthecompany.com
  • othernameofthecompany.com
  • *.onenameofthecompany.com
  • *.othernameofthecompany.com

I tested this setup with and it seems to be working in a recent version of Firefox and IE8.

Questions:

• Should I expect client compatibility problems with this setup? Any known issues with e.g. IE6 or other older browsers?
• Should I put *.onenameofthecompany.com or simply onenameofthecompany.com to the Subject field in the certificate? (I know that in theory, when SubjectAlternateNames are present in a certificate, the browser should ignore the subject, in practice, I wish I knew what happens)
• Are there any widely-trusted CAs who could create such a certificate for me?

I'm trying to set up up AD attributes for some groups to hide them from the OCS/MOC address book. According to this article:

http://technet.microsoft.com/en-us/library/ee323528(office.13).aspx

There should be two attributes that control this visibility: msExchangeHideFromAddressBook and msExchHideFromAddressLists.

What are the differences between these attributes?

Let's say a large enterprise opens a new office in (insert random location here) and want the new colleagues up to speed as fast as possible. Let's also say this enterprise is a very typical one with a complex environment, lots of history and almost full lack of documentation.

What's already been decided is that the new colleagues will receive howto-style documentation for the most typical tasks and will get seme architecture documentation for some of the more complicated systems.

Any ideas about improving this process? And more specifically, what should such a howto document look like to be helpful?

I'd like to setup a postfix host (using RHEL 5.4's default postfix, which is version 2.3) with the following characteristics:

• an SMTP listener listens on 10.0.0.1:25 and relays all e-mails to 10.0.0.1:2525
• an SMTP listener listens on 10.0.0.1:2525 and relays all e-mails to 10.0.0.2:25

Basically the challenge here is to use two different relayhosts for the different SMTP listeners.

Is it possible? Is there a better solution to achieve similar behavior?

I'm trying to set up a few vsftpd instances on a machine that I have no root access to. The authentication should be done through PAM with pam_listfile, like this:

pam_listfile.so item=group sense=allow file=/path/filename onerr=fail

I can ask the administrator to set up a PAM service for me and include that line but he is not willing to create 6 PAM services for my 6 vsftpd instances and I really need different /path/filename set for each vsftpd server.

Is there a way to solve this problem? Can I somehow not use absolute path as the parameter?

(I know the correct solution would be to use one vsftpd instance and set up virtual users properly. However unfortunately I have to work what I have and the users already exist in an Active Directory and are authenticated to the system using another PAM service.)