I would like to ask question about rsyslog.

I am using rsyslog v7 and gathering stats using impstats module. According to document, default naming of action queue is sequential based on occurrence of action inside rsyslog configuration.

name word

This names the action. The name is used for statistics gathering and documentation. If no name is given, one is dynamically generated based on the occurence of this action inside the rsyslog configuration. Actions are sequentially numbered from 1 to n.

However, after the definition of dynFile the action number jumps from 3 to 5

Sep 10 15:42:54 B rsyslogd-pstats: dynafile cache RemoteHost: requests=1427979 level0=871360 missed=57000 evicted=56990 maxused=10 
Sep 10 15:42:54 B rsyslogd-pstats: action 1: processed=1427979 failed=0 
Sep 10 15:42:54 B rsyslogd-pstats: dynafile cache Dashboard: requests=7018 level0=5941 missed=4 evicted=0 maxused=4 
Sep 10 15:42:54 B rsyslogd-pstats: action 2: processed=7018 failed=0 
Sep 10 15:42:54 B rsyslogd-pstats: action 3: processed=85295 failed=0 
Sep 10 15:42:54 B rsyslogd-pstats: action 5: processed=82487 failed=0 
Sep 10 15:42:54 B rsyslogd-pstats: action 7: processed=609 failed=0 
Sep 10 15:42:54 B rsyslogd-pstats: action 9: processed=832 failed=0

After action 3 , I use the forwarding rule using legacy format

:hostname, isequal, "BC" @BF
& ~

Is this numbering result natural behavior?

I would like to get help with my Ubuntu desktop 18.04.01 .

I just installed Ubuntu 18.04.01 running top of kvm (fedora server 28) and having hard time setting up dns access.

While diagnosing why DNS queries from Ubuntu desktop is not responded from my router, I found below packets was sent from Ubuntu.

12:29:53.596586 IP 192.168.11.100.45415 > 192.168.11.1.domain: 31141+ AAAA? ntp.ubuntu.com. (32)
12:29:53.597703 IP 192.168.11.100.37220 > 192.168.11.1.domain: Flags [S], seq 574811215, win 29200, options [mss 1460,sackOK,TS val 3560337742 ecr 0,nop,wscale 7], length 0
12:29:53.597902 IP 192.168.11.100.37222 > 192.168.11.1.domain: Flags [S], seq 3169117583, win 29200, options [mss 1460,sackOK,TS val 3560337742 ecr 0,nop,wscale 7], length 0
12:29:53.598020 IP 192.168.11.100.37224 > 192.168.11.1.domain: Flags [S], seq 4965594, win 29200, options [mss 1460,sackOK,TS val 3560337742 ecr 0,nop,wscale 7], length 0

What is this SYN request from Ubuntu desktop ?

Best Regards, Yu Watanabe

I am searching all over internet but could not find any information about INVALIDARGUMENT .

After stopping service in systemd, I got this response.

Oct 18 21:17:04 BSU00383 systemd: Stopping filebeat...
BUNCH OF APPLICATION ERROR HERE
Oct 18 21:17:04 BSU00383 systemd: filebeat.service: main process exited, code=exited, status=2/INVALIDARGUMENT

It looks like the application side failed to process the SIGTERM signal before receiving SIGKILL signal from systemd but in what situations does systemd returns INVALIDARGUMENT in general?

I am using Red Hat Enterprise Linux 7.4 .

I appreciate if some one can help me out...

Thanks,

Yu Watanabe

I would like to ask question about fromhost message properties.

http://www.rsyslog.com/doc/v7-stable/configuration/properties.html

I am using rsyslog 7.4.7 on RHEL 7.3 . However, the fromhost message properties seems to set the hostname in lowercase letters even though uppercase letters are used for hostname in /etc/hosts/

/etc/hosts

[root@RHEL73-1 log]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

10.0.2.12 RHEL73-1
10.0.2.13 RHEL73-test

However, when log from remote log is received fromhost is set as lowercase letters.

Debug line with all properties:
FROMHOST: 'rhel73-test', fromhost-ip: '10.0.2.13', HOSTNAME: 'RHEL73-2', PRI: 30,
syslogtag 'systemd:', programname: 'systemd', APP-NAME: 'systemd', PROCID: '-', MSGID: '-',
TIMESTAMP: 'Nov 13 20:01:01', STRUCTURED-DATA: '-',
msg: ' Removed slice user-0.slice.'
escaped msg: ' Removed slice user-0.slice.'
inputname: imudp rawmsg: '<30>Nov 13 20:01:01 RHEL73-2 systemd: Removed slice user-0.slice.'

Is the resolved hostname set as lowercase or uppercase ? Document seems to not mention about this behavior...

I just installed virt-viewer on RHEL7.3 using yum install virt-viewer and now I am getting below error

[root@host ~]# virt-viewer 
virt-viewer: symbol lookup error: /lib64/libspice-client-gtk-3.0.so.5: undefined symbol: gdk_keymap_get_scroll_lock_state

virt-manager also crashes when I try to see graphical console.

Target library seems to exist so something is wrong with the dependency.

[root@host ~]# ls -l /lib64/libspice*
lrwxrwxrwx. 1 root root      33 Aug 12 15:56 /lib64/libspice-client-glib-2.0.so -> libspice-client-glib-2.0.so.8.6.0
lrwxrwxrwx. 1 root root      33 Aug 12 15:06 /lib64/libspice-client-glib-2.0.so.8 -> libspice-client-glib-2.0.so.8.6.0
-rwxr-xr-x. 1 root root 1200664 Jun  8 00:49 /lib64/libspice-client-glib-2.0.so.8.6.0
lrwxrwxrwx. 1 root root      32 Aug 12 16:08 /lib64/libspice-client-gtk-3.0.so.5 -> libspice-client-gtk-3.0.so.5.0.0
-rwxr-xr-x. 1 root root  132176 Jun  8 00:49 /lib64/libspice-client-gtk-3.0.so.5.0.0
lrwxrwxrwx. 1 root root      28 Aug 12 15:56 /lib64/libspice-controller.so -> libspice-controller.so.0.0.0
lrwxrwxrwx. 1 root root      28 Aug 12 15:07 /lib64/libspice-controller.so.0 -> libspice-controller.so.0.0.0
-rwxr-xr-x. 1 root root   69096 Jun  8 00:49 /lib64/libspice-controller.so.0.0.0
lrwxrwxrwx. 1 root root      24 Dec 25  2016 /lib64/libspice-server.so.1 -> libspice-server.so.1.8.0
-rwxr-xr-x. 1 root root 1194648 Sep  9  2016 /lib64/libspice-server.so.1.8.0

Is there anyone else faced the same problem?

I am trying to configure TCP wrapper to deny access from ftp clietn. I want to use domain format syntax in client list of /etc/hosts.deny as below. FTP service is the target daemon in my case.

vsftpd : .ywlocal.net

However, I have defined host name of ftp client(tester1) in /etc/hosts as below but vsftpd is still accepting the connection from the client.

127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

192.168.11.17 tester1 tester1.ywlocal.net

I also have hostname of client in fqdn form.

[root@tester1 ~]# hostname
tester1.ywlocal.net

Where should I define the fqdn of client side to deny access from the ftp client?

I would like to ask question regarding to forward-port rule for firewalld.

OS I am using is ,

CentOS Linux release 7.3.1611 (Core)

My Goal

Forward requests to httpd listening on 127.0.0.1:80

[root@development /]# netstat -atunp | grep httpd
tcp        0      0 127.0.0.1:80            0.0.0.0:*               LISTEN      2601/httpd          

Problem

I have set firewalld rule as below.

[root@development /]# firewall-cmd --list-all --zone=external
external (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 
  services: ssh
  ports: 
  protocols: 
  masquerade: yes
  forward-ports: 
  sourceports: 
  icmp-blocks: 
  rich rules: 
    rule family="ipv4" forward-port port="8080" protocol="tcp" to-port="80"

However, if I send request from external host, firewalld rejects request to port 8080.

In this case,

192.168.11.2 (client) -------> 192.168.11.13 (8080)

[root@dellinspiron13z asset]# curl -XGET 192.168.11.13:8080
curl: (7) Failed to connect to 192.168.11.13 port 8080: Connection refused

If the process is running as 0.0.0.0:80 , it works perfectly.

Is there anyway to redirect requests to localhost port?

I am trying to configure keepalived on RHEL's team driver.

http://rhelblog.redhat.com/2014/06/23/team-driver/

My keepalived instance is recognizing MASTER and BACKUP but virtual ip is not created on team interface.

Below is keepalived configuration.

global_defs {
   notification_email {
     [email protected]
   }

   notification_email_from [email protected]
}

vrrp_script check_service {
  script /usr/local/src/check_service.sh
  interval 2 # every 2 seconds
  weight 2 # add 2 points if OK
}

vrrp_instance SERVICE_1 {
    state MASTER
    interface team0
    virtual_router_id 50
    priority 101
    advert_int 1
    }
    virtual_ipaddress {
        10.213.140.xx dev team0
    }
    track_script {
      check_service
    }
}

Does anyone know whether team driver support virtual ip with keepalived?

I am in a situation where I need to set 2 VRRP instances on same interface. I need to achieve this because rsyslogd and elasticsearch needs to use interface eth0 for network communication.

This post seemed to be a similar one did not mention about the configuration so I decided to ask a question.

I created a configuration below but two masters are created on different host.

Master side configuration

vrrp_script chk_rsyslog {
  script "netstat -atunp | grep rsyslogd | grep '0.0.0.0:514' &>/dev/null"
  interval 2 # every 2 seconds
  weight 2 # add 2 points if OK
}

vrrp_script chk_es {
  script "netstat -atunp | grep java | grep '192.168.21.14:9300' &>/dev/null"
  interval 2 # every 2 seconds
  weight 2 # add 2 points if OK

vrrp_instance RH_1 {
    state MASTER
    interface eth0
    virtual_router_id 50
    priority 10
    advert_int 1
    virtual_ipaddress {
        192.168.11.250/24
    }

    track_script {
      chk_rsyslog
    }
}

vrrp_instance ES_1 {
    state MASTER
    interface eth0
    virtual_router_id 51
    priority 10
    advert_int 1
    virtual_ipaddress {
        192.168.11.251/24
    }

    track_script {
      chk_es
    }
}

Backup side configuration

vrrp_script chk_rsyslog {
  script "netstat -atunp | grep rsyslogd | grep '0.0.0.0:514' &>/dev/null"
  interval 2 # every 2 seconds
  weight 2 # add 2 points if OK
}

vrrp_script chk_es {
  script "netstat -atunp | grep java | grep '192.168.21.15:9300' &>/dev/null"
  interval 2 # every 2 seconds
  weight 2 # add 2 points if OK
}

vrrp_instance RH_1 {
    state BACKUP
    interface eth0
    virtual_router_id 50
    priority 9
    advert_int 1
    virtual_ipaddress {
        192.168.11.250/24
    }

    track_script {
      chk_rsyslog
    }
}

vrrp_instance ES_1 {
    state BACKUP
    interface eth0
    virtual_router_id 51
    priority 9
    advert_int 1
    virtual_ipaddress {
        192.168.11.251/24
    }

    track_script {
      chk_es
    }
}

Log on the backup side shows both instances first starts up but ES_1 is not reflected to ip setting for os.

Apr 19 08:49:54 rhel2 Keepalived_vrrp[23321]: Netlink reflector reports IP 192.168.11.15 added
Apr 19 08:49:54 rhel2 Keepalived_vrrp[23321]: Netlink reflector reports IP 192.168.21.15 added
Apr 19 08:49:54 rhel2 Keepalived_vrrp[23321]: Netlink reflector reports IP fe80::ab04:d4e4:841e:e3e1 added
Apr 19 08:49:54 rhel2 Keepalived_vrrp[23321]: Netlink reflector reports IP fe80::812:1dd8:9ed1:a6af added
Apr 19 08:49:54 rhel2 Keepalived_vrrp[23321]: Registering Kernel netlink reflector
Apr 19 08:49:54 rhel2 Keepalived_vrrp[23321]: Registering Kernel netlink command channel
Apr 19 08:49:54 rhel2 Keepalived_vrrp[23321]: Registering gratuitous ARP shared channel
Apr 19 08:49:54 rhel2 Keepalived_vrrp[23321]: Opening file '/etc/keepalived/keepalived.conf'.
Apr 19 08:49:54 rhel2 Keepalived_vrrp[23321]: Configuration is using : 69267 Bytes
Apr 19 08:49:54 rhel2 Keepalived_vrrp[23321]: Using LinkWatch kernel netlink reflector...
Apr 19 08:49:54 rhel2 Keepalived_vrrp[23321]: VRRP_Instance(RH_1) Entering BACKUP STATE
Apr 19 08:49:54 rhel2 Keepalived_vrrp[23321]: VRRP_Instance(ES_1) Entering BACKUP STATE
Apr 19 08:49:54 rhel2 Keepalived_vrrp[23321]: VRRP sockpool: [ifindex(2), proto(112), unicast(0), fd(10,11)]
Apr 19 08:49:54 rhel2 Keepalived_healthcheckers[23320]: Configuration is using : 7722 Bytes
Apr 19 08:49:54 rhel2 Keepalived_healthcheckers[23320]: Using LinkWatch kernel netlink reflector...
Apr 19 08:49:54 rhel2 Keepalived_vrrp[23321]: VRRP_Script(chk_rsyslog) succeeded
Apr 19 08:49:58 rhel2 Keepalived_vrrp[23321]: VRRP_Instance(RH_1) Transition to MASTER STATE

My ip addr command result.

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 52:54:00:12:0e:da brd ff:ff:ff:ff:ff:ff
    inet 192.168.11.15/24 brd 192.168.11.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet 192.168.11.250/24 scope global secondary eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::ab04:d4e4:841e:e3e1/64 scope link
       valid_lft forever preferred_lft forever

Is it possible to set multiple VRRP instances on same interface?

My platform information is below.

[root@rhel2 keepalived]# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.3 (Maipo)
[root@rhel2 keepalived]# rpm -qa | grep keepalived
keepalived-1.2.13-8.el7.x86_64

Problem

I have java process which does not die neither with SIGTERM nor SIGKILL.

logstash  2591     1 99 13:22 ?        00:01:46 /usr/bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+DisableExplicitGC -Djava.awt.headless=true -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError -Xmx1g -Xms256m -Xss2048k -Djffi.boot.library.path=/usr/share/logstash/vendor/jruby/lib/jni -Xbootclasspath/a:/usr/share/logstash/vendor/jruby/lib/jruby.jar -classpath : -Djruby.home=/usr/share/logstash/vendor/jruby -Djruby.lib=/usr/share/logstash/vendor/jruby/lib -Djruby.script=jruby -Djruby.shell=/bin/sh org.jruby.Main --1.9 /usr/share/logstash/lib/bootstrap/environment.rb logstash/runner.rb --path.settings /etc/logstash

It respawns everytime signal is received.

Sep 15 13:22:17 test init: logstash main process (2546) killed by KILL signal
Sep 15 13:22:17 test init: logstash main process ended, respawning

It sounds strange but even I reboot the server, it still does not die.

Process was executed through init script with below command:

NAME=logstash
LS_USER=logstash
LS_OPTS="--path.settings=/etc/logstash"
LS_PIDFILE=/var/run/$NAME/$NAME.pid
LS_STDERR="/var/log/logstash/logstash.stderr"
DAEMON="/usr/share/logstash/bin/logstash"

runuser -s /bin/sh -c "exec $DAEMON ${LS_OPTS}" ${LS_USER} &>${LS_STDERR} &

Is there any way to force this process to kill other than reinstalling the OS?

Environment

Process :

logstash 5.0.0~alpha5

OS :

Red Hat Enterprise Linux Server release 6.7 (Santiago)

Java version :

openjdk version "1.8.0_101"
OpenJDK Runtime Environment (build 1.8.0_101-b13)
OpenJDK 64-Bit Server VM (build 25.101-b13, mixed mode)

Server is deployed on Microsoft Azure.

I would like to ask regarding to fluentd.

My fluentd versions is below.

td-agent-2.1.5-0.x86_64
fluentd 0.10.61

I now have a tail input plugin using multiple line format which parses multiple lines from log and set as a single record as below.

2016-07-31T14:48:06+09:00       arm       {"val1":"15:49:18.602384","val2":"5009","val3":"4896","val4":"3905","val5":"1811","val6":"10287","val7":"10271","val8":"1509","val9":"11064","val10":"10832","val11":"10673","val12":"9553","val13":"10660","val14":"9542","val15":"15:49:18.602509","val16":"3759","val17":"4758","val18":"2930","val19":"1261","val20":"7761","val21":"7767","val22":"1023","val23":"7905","val24":"7711","val25":"7918","val26":"7292","val27":"7940","val28":"6907"}

I will need to split all the fields from 1 record to 28 records for elasticsearch to recognize as different documents.

Like ,

val1

val2

val3

...

val28

Is there any way to achieve this in fluentd configuration ? Perhaps, embed ruby code?

Best Regards, Yu Watanabe

I would like to ask question to people in this community about Xen Center.

I use Xen 6.5 in production environment. However, I quite don't understand the value shown in memory graph of "Performance" tab in each server. My purpose is to exactly understand the value used and use for troubleshooting.

Could someone educate me which command does Xen use to calculate the memory, or perhaps script?

Thanks, Yu

I would like to ask question and appreciate if someone can help me to find solution.

I am using haproxy ver 1.4.15

[root@HAProxy tmp]# haproxy -v
HA-Proxy version 1.5.14 2015/07/02
Copyright 2000-2015 Willy Tarreau <[email protected]>.

Problem

However, I am having a problem that it is dropping same HTTP Response every time and not forwarding back to the client.

When below two requests are sent to HA Proxy, only the response of second one is sent back to the client. For the first one , haproxy is receiving back from the backend but drops the 200 OK when it is forwarding to the client.

Oct 14 14:31:17 localhost haproxy[11601]: xxx.xxx.xxx.xxx:50114 [14/Oct/2015:14:31:17.193] http-in console/Console 0/0/0/22/25 200 78668 - - --NI 1/1/0/1/0 0/0 "GET /Console/MultiLanguageSvc?Domain=xxxx&SYS=Care&LatestTime=&SVC= HTTP/1.1"
Oct 14 14:31:19 localhost haproxy[11601]: xxx.xxx.xxx.xxx:50115 [14/Oct/2015:14:31:19.225] http-in console/Console 0/0/0/104/104 200 3948 - - --NI 1/1/0/1/0 0/0 "GET /Console/CareLoginSvc?AgentID=91007@xxxx&Password=8BA0FC9468973A97956AA849462406C2&ExtNo=7603&Lang=ja_JP&SVC= HTTP/1.1"

Debug log showed any sign of errors.

Below are the part of debug log results.

/usr/local/haproxy/sbin/haproxy -f /usr/local/haproxy/etc/haproxy.cfg -d -V
Available polling systems :
      epoll : pref=300,  test result OK
       poll : pref=200,  test result OK
     select : pref=150,  test result FAILED
Total: 3 (2 usable), will use epoll.
Using epoll() as the polling mechanism.

** Below are the 200OK that is not sent to the client.**
00000000:iconsole.srvrep[0008:0009]: HTTP/1.1 200 OK
00000000:iconsole.srvhdr[0008:0009]: Cache-Control:
00000000:iconsole.srvhdr[0008:0009]: Pragma:
00000000:iconsole.srvhdr[0008:0009]: Expires: Wed, 31 Dec 1969 23:59:59 GMT
00000000:iconsole.srvhdr[0008:0009]: Content-Type: text/xml;charset=utf-8
00000000:iconsole.srvhdr[0008:0009]: Content-Length: 78470
00000000:iconsole.srvhdr[0008:0009]: Date: Wed, 14 Oct 2015 09:11:24 GMT
00000000:iconsole.srvhdr[0008:0009]: Server: MMCC
00000001:http-in.clicls[0008:0009]
00000001:http-in.closed[0008:0009]

** Below are the 200OK that is sent to the client. **
00000002:iconsole.srvrep[0008:0009]: HTTP/1.1 200 OK
00000002:iconsole.srvhdr[0008:0009]: Cache-Control:
00000002:iconsole.srvhdr[0008:0009]: Pragma:
00000002:iconsole.srvhdr[0008:0009]: Expires: Wed, 31 Dec 1969 23:59:59 GMT
00000002:iconsole.srvhdr[0008:0009]: Content-Type: text/xml;charset=utf-8
00000002:iconsole.srvhdr[0008:0009]: Content-Length: 3751
00000002:iconsole.srvhdr[0008:0009]: Date: Wed, 14 Oct 2015 09:11:26 GMT
00000002:iconsole.srvhdr[0008:0009]: Server: MMCC
00000005:http-in.clicls[0008:0009]
00000005:http-in.closed[0008:0009]

Does anybody have any guess why HA Proxy drops certain requests?