smusumeche's questions

I am attempting to manage cache invalidation by using cache tags in a header field called X-Cache-Tags. The relevant headers from a typical response look like this:

Age:218
Cache-Control:public, s-maxage=300
Via:1.1 varnish-v4
X-Cache-Tags:product-395378,brand-54,product-374977,product-419381,product-184166,product-419380,category-974
X-Varnish:1737663 852286
X-Varnish-Cache:HIT

This object is cached correctly and I get hits when I request the page.

I am also able to issue a ban on these headers. After issuing the ban for the tag product-395378, my ban.list looks like this:

1435166652.596926   117    obj.http.X-Host ~ .* && obj.http.X-Url ~ .* && obj.http.content-type ~ .* && obj.http.X-Cache-Tags ~ (product\-395378)(,.+)?$

So it looks like the ban is set correctly. However, when I request this same page after the ban, the cache is not invalidated and I get a cache hit instead of a miss.

What could be the issue?

I'm trying to filter varnishlog (version 4) to only show requests to certain URLs or certain IP addresses. All of the examples online are for version 3. Version 4 seems to use a different method of filtering and I can't find any documentation on it. Is it possible to filter this way?

Someone has setup a CDN server which is directing traffic to my server and setting the HOST header to match one of my real domains. Because of this, Apache uses the virtual host for my real domain name instead of the host name for the CDN domain.

For example, the URL is:

http://cdn.example.com/pictures/www.mydomain.com/images/product/6a/229326.jpg

It appears this CDN is a proxy that is overriding the HOST header. Apache sees the host as www.mydomain.com instead of cdn.example.com.

I'd like to block this traffic, but I can't block via host or IP (because it changes). There is a host header:

HTTP_X_FORWARDED_HOST=cdn.example.com

Possible?

edit: don't have mod_security installed

I just migrated an existing fairly high traffic website to a Digital Ocean droplet and I viewed the Apache extended server status page. It shows the information below. One thing I noticed is that the CPU is listed at 269% load. How can that be? Is this good or bad? How can I interpret these numbers?

Apache Server Status for xx.xx.xxx

Server Version: Apache/2.2.15 (Unix) DAV/2 PHP/5.4.40 mod_ssl/2.2.15 OpenSSL/1.0.1e-fips
Server Built: Oct 16 2014 14:48:21
Current Time: Tuesday, 19-May-2015 04:11:17 EDT
Restart Time: Tuesday, 19-May-2015 04:06:06 EDT
Parent Server Generation: 0
Server uptime: 5 minutes 10 seconds
Total accesses: 1139 - Total Traffic: 280.7 MB
CPU Usage: u778.49 s54.72 cu0 cs0 - 269% CPU load
3.67 requests/sec - 0.9 MB/second - 252.4 kB/request
12 requests currently being processed, 11 idle workers

My logs are being rotated properly, however, I am not being emailed the rotated log. What am I doing wrong?

My main logrotate.conf is:

include /etc/logrotate.d

here is my /etc/logrotate.d/php-errors:

/var/log/php-errors.log {
    rotate 7
    daily
    missingok
    notifempty
    mail [email protected]
}

I currently have Apache setup to use a certificate on all my domains using these settings in ssl.conf:

<VirtualHost _default_:443>
SSLEngine on
SSLCertificateFile /etc/httpd/conf/mycert.crt
SSLCertificateKeyFile /etc/httpd/conf/mykey.key
SSLCertificateChainFile /etc/httpd/conf/digicert/DigiCertCA.crt
</VirtualHost>

I would like to use a different self-signed certificate for one domain/virtual host on the server. I tried adding this to my httpd.conf file, but the old certificate is still being presented to the browser.

<VirtualHost *:443>
        ServerName myotherdomain.com
        DocumentRoot /var/www/symfony/web
        SSLEngine on
        SSLCertificateFile /etc/httpd/conf/selfsigned.crt
        SSLCertificateKeyFile /etc/httpd/conf/selfsigned.key
        SSLCertificateChainFile /etc/httpd/conf/digicert/DigiCertCA.crt
</VirtualHost>

Is there a way to set this up so that this one domain using a different certificate than the others?

I've set my server's timezone to Central:

/etc/localtime -> /usr/share/zoneinfo/US/Central

After rebooting, when I run the date command, the time is still listed in UTC.

[root@dev etc]# date
Sat Oct  5 16:14:28 UTC 2013

How can I get it to display in the local timezone?

I recently migrated our server away from using FTP to exclusively SFTP. I would like to block port 21 in the firewall now that it is not needed for incoming FTP connections. However, when I did this, any PHP script run on my server which connected to FTP servers ON OTHER SYSTEMS all failed. It was my understanding that port 21 was only used for incoming FTP connections, but my experience says otherwise.

Do I have to leave 21 open if I want to use FTP connections to other servers?

iptables before modifications:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
RH-Firewall-1-INPUT  all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
RH-Firewall-1-INPUT  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain RH-Firewall-1-INPUT (2 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere            icmp any
ACCEPT     esp  --  anywhere             anywhere
ACCEPT     ah   --  anywhere             anywhere
ACCEPT     udp  --  anywhere             224.0.0.251         udp dpt:mdns
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ipp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ipp
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:mysql
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:domain
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:domain
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:smtp
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ftp
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:https
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited

iptables after modification:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
RH-Firewall-1-INPUT  all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
RH-Firewall-1-INPUT  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain RH-Firewall-1-INPUT (2 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere            icmp any
ACCEPT     esp  --  anywhere             anywhere
ACCEPT     ah   --  anywhere             anywhere
ACCEPT     udp  --  anywhere             224.0.0.251         udp dpt:mdns
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ipp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ipp
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:mysql
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:domain
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:domain
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:smtp
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:https
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited

I am running CentOS 5.7 and need to upgrade OpenSSH to the latest stable version (PCI compliance issues). However, the most recent version available via the CentOS yum repository is 4.3p2. How can I update to the latest stable version using yum? Is there a different repository I should setup?

We are in the process of switching to a new RAID array and need to copy our MySQL InnoDB database to the new RAID array while minimizing downtime (50GB database). I understand that using rsync on a running MySQL database will not produce a usable copy of the database. However, can I get an exact copy by using rsync on the running database, then completely shutting down mysqld, and running a final rsync? Are there any possibilities of data corruption in this case, if I ensure that mysql is not running with the final rsync is run?

I am running CentOS and have yum-updatesd running everyday and notifying me of any updates. A few days ago, yum started telling me that there are 131 updates available. What would cause it to do this? Was the CentOS repo just updated?

I am trying to setup yum-updatesd to send email notification when there are updates available to the packages on my system. However, I am not receiving any notifications even though there are updates available (as seen in yum check-update)

I have verified that the yum-updatesd service is running.

This is my /etc/yum/yum-updatesd.conf:

[main]
# how often to check for new updates (in seconds)
run_interval = 3600
# how often to allow checking on request (in seconds)
updaterefresh = 600

# how to send notifications (valid: dbus, email, syslog)
emit_via = email
email_to = [email protected]
email_from = [email protected]

# should we listen via dbus to give out update information/check for
# new updates
dbus_listener = yes

# automatically install updates
do_update = no
# automatically download updates
do_download = no
# automatically download deps of updates
do_download_deps = no

I have a list of queries that I use to warmup my InnoDB database tables. Currently, I run these queries sequentially and they take some time to run. I was wondering if there was a way I could run them in parallel to speed up the time it takes to run all the queries?

I am trying to create a zone file which points example.com and www.example.com to my server's IP address. I read the docs, but am still having a hard time with it. Currently, the non-www version works, but the www doesn't. I don't get an config errors when I start bind. Here is my zone file:

$TTL 86400

@ IN SOA ns1.myserver.com.  postmaster.myserver.com. (
                        2010121801      ; serial number YYMMDDNN
                        1800 ; Refresh
                        600 ; Retry
                        864000 ; Expire
                        1800 ; Min TTL
                        )
                IN NS ns1.myserver.com.
                IN NS ns2.myserver.com.


IN A 99.99.99.99
www IN CNAME @

I recently installed Bind on a CentOS box. Everything appears to be working with only port 53 open. However, I noticed in the config file that there is a line in rndc.conf that says "default-port 953;" I don't have port 953 open and Bind appears to be working. Can I keep 953 closed? What is the point of RNDC listening on 953?

I have 1 master and 2 slaves. I am using MySQL 5.1.42 on all servers. I am attempting to use mk-table-checksum to verify that their data is in sync, but I am getting unexpected results on one of the slaves.

First, I generate the checksums on the master like this:

mk-table-checksum h=localhost --databases MYDB --tables {$table_list} --replicate=MYDB.mk_checksum --chunk-size=10M

My understanding is that this runs the checksum queries on the master which then propagate via normal replication to the slaves. So, no locking is needed because the slaves will be at the same logical point in time when they run the checksum queries on themselves. Is this correct?

Next, to verify that the checksums match, I run this on the master:

mk-table-checksum --databases MYDB --replicate=IRC.mk_checksum --replicate-check 1 h=localhost,u=maatkit,p=xxxx

If there are any differences, I repair the slaves like this:

mk-table-sync --execute --verbose --replicate IRC.mk_checksum h=localhost,u=maatkit,p=xxxx

After doing all of this, I repaired both slaves with mk-table-sync. However, everytime I run this sequence (after everything has already been repaired), one slave is perfectly in sync but one slave always has a few tables out of sync. I am 99.999% sure that the data on the slaves matches, since I repaired everything and the tables were not even updated on the master between runs of the checksum script. What would cause a few tables to always show out of sync on only one of the slaves? I am stuck. Here is the output:

Differences on h=x.x.x.x,p=...,u=maatkit  

DB TBL CHUNK CNT_DIFF CRC_DIFF BOUNDARIES
IRC product 10 0 1 product_id >= 147377 AND product_id < 162085
IRC post_order_survey 0 0 1 1=1
IRC mk_heartbeat 0 0 1 1=1
IRC mailing_list 0 0 1 1=1
IRC honey_pot_log 0 0 1 1=1
IRC product 12 0 1 product_id >= 176793 AND product_id < 191501
IRC product 18 0 1 product_id >= 265041
IRC orders 26 0 1 order_id >= 694472
IRC orders_product 6 0 1 op_id >= 935375

I am running CentOS which has Apache installed. It automatically starts up (script is in /etc/init.d). Since this is a standalone database server, I have no need for Apache to be running. How do I disable the startup? Just delete the file in /etc/init.d?

I am new at Linux administration. I created a new SSH user and password, and edited iptables to allow FTP access to my server. I am able to login with my user via FTP, however, when I try to upload files or create directories, I get "550 Permission Denied" errors. I am sure that it is similar a matter of permissions for my user account, but since I am new, I have no idea how to configure the permissions. Is there a certain config file that I need to edit?

I current run a LAMP server all on one dedicated box. I am considering moving to VPS.net which is a virtualized VPS system on a SAN. Does anyone have any experience with a similar setup? Will being on a SAN hurt or help MySQL performance?

I will be upgrading a large database (9GB) from MySQL 4.1 to MySQL 5.1. I have 2 options (that I know of). Which is the better option and why?

1. Dump entire DB using mysqldump, upgrade the server, then import the mysqldump file. This ensures that the tables are in the new 5.1 format.
2. Use the same table files on the new server, but update them using "REPAIR TABLE" command. Not sure about this method's reliability.

All tables are MyISAM.