roelvanmeer's questions

We're running a php-fpm container in Kubernetes. This is a test setup, so to preserve resources, php-fpm (8.1) is configured with:

pm = ondemand
pm.max_children = 5
pm.max_requests = 1000

The application is not in use (e.g. no requests to the application, nothing in the access log). Still, there is always one worker process running in this pool.

Question: How can I find out what is causing php-fpm to spawn this worker?

Things I looked at:

• netstat: php-fpm: master process listening on port 9000, and connected to two unix sockets (which would be stdout and stderr), nothing else
• access logs: empty
• config: pm.min_spare_servers is set to 1 (which is the default) but the config file states this is only used with the 'dynamic' scheduler
• when running php-fpm with identical config outside of Kubernetes no children are spawned (or all of them exit) when the site is idle

Is it possible to use SNMP to read the spanning-tree status from Arista switches?

Although it is possible to set up SNMP traps for spanning-tree, I did not find anything related to spanning-tree in the Arista SNMP MIBs list, or any mention of the possibility of querying STP status via SNMP in the documentation.

We have several models, in case that is important (DCS-7050T, DCS-7050QX, DCS-7060CX)

This is a question about a difference in networking behavior between Debian Buster (kernel 4.19.0-18) and Debian Bullseye (kernel 5.10.0-9). On Buster, proxy arp entries survive if the link on the interface goes down. On Bullseye they don't.

Situation: create a static proxy ARP entry on a specific interface:

ip neigh add proxy 1.2.3.5 dev eth0

I can verify that the entry exists:

ip neigh show proxy

Now, if the link on that interface goes down and comes back up again, on Buster the proxy arp entries are still there, on Bullseye they are gone.

I would like to know the reason behind this difference. Is it a kernel feature? Is it udev that does this? Is there a sysctl setting governing this?

Could someone point me in the right direction? If you know how to create static ARP entries on Bullseye / kernel 5.10 that would be even better.

Note that I'm using sysvinit, not systemd. Thanks!

Is it possible to set MySQL client flags when using the command line client?

I would like to set the CLIENT_FOUND_ROWS client flag, but the manpages of the mysql client do not mention the setting of client flags. This is only documented in the documentation of the mysql_real_connect() function.

Is using client flags in the command line client at all possible? If so, how?

The problem at hand is this. I am using the command line mysql client. After an update statement, I would like to be able to issue a SELECT ROW_COUNT() command, and have it return the number of rows matched, not the number of rows changed. When accessing the database via a library where you can call the mysql_real_connect() function, this can be achieved by setting the CLIENT_FOUND_ROWS client flag. I would like to achive the same behaviour but with the command line client instead.

I know I could screen scrape the output of the sql update statement, but I'd prefer not to.

I am looking for a way in iptables to match forwarded packets where the source address is in the same network as the destination address, without specifying the network.

Of course, when I specify the network, this is simple:

iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -d 192.168.1.0/24

But let's say I want to do this for any class C network (and I don't want to specify all of them, obviously).

I looked at the rpfilter match, but according to the manpage:

This match can only be used in the PREROUTING chain of the raw or mangle table.

So that's of no use to me. The u32 match looks promising, but is too complex, I don't understand it.

I tried a different approach: match packets that go out on the same interface as they came in, like so:

iptables -t nat -A POSTROUTING -i eth0 -o eth0

but that doesn't work either, since -i cannot be used in the POSTROUTING chain:

iptables v1.4.21: Can't use -i with POSTROUTING

One solution I have thought of is to use packet marking: mark packets coming on in eth0 and match the outgoing interface and the mark in the POSTROUTING chain, like so:

iptables -t mangle -A PREROUTING -i eth0 -j MARK --set-mark 0x01/0xff
iptables -t nat -A POSTROUTING -o eth -m mark --mark 0x01/0xff

This works in most cases, based on the assumption that you run only one network on a given interface, but it does not exactly what I want, since it works on interfaces and not networks.

So as yet the problem is unsolved. I'm not looking for a complete working solution, but for advice about a way to solve this that I have missed. Thanks!

-EDIT-

The reason I need this is as follows. I have multihomed linux host, let's call it alice. Alice has an interface eth0, and Bob and Charly are hosts on that network. Some ports on Alice are forwarded with iptables DNAT rules. Lets say I forward Alice's tcp port 456 to port 456 on Bob. I want this forward to work also for traffic coming from hosts on eth0. With only the DNAT rule in place, a packet sent by Charly to Alice port 456 is forwarded to Bob, bit its source address remains that of Charly. So, the return packet is sent by Bob to Charly directly, which makes the traffic flow non-symmetrical.

To fix this, I want to SNAT this traffic on Alice. So, if traffic leaves Alice, has a destination address in eth0, and a source address in the eth0 network (but not Alice's) then I need to SNAT it.

This is not hard to do if you specify the address ranges. But now I have several interfaces, and I would like to do this generically.

I am looking for a way to list all partitions of a specific type on linux. (Specifically: all EFI system partitions).

I know blkid can filter on filesystem type: the command blkid -t TYPE=vfat returns the correct results, but is not very robust: there might be other vfat filesystems which aren't ESPs, or there might be ESPs formatted with a different filesystem.

So, is there an equivalent command that can list devices but filter on partition type?

EDIT

I need a list of all EFI System Partitions (or ESPs). These partitions have partition type EF00 in gdisk or partition type ef in fdisk. They are most commonly formatted as vfat. Now, I can use blkid to list all partitions which are formatted with vfat, but that leaves two problems:
a) There might be EFI partitions not formatted with vfat (or not formatted at all) which would be missing from the list, and
b) there might be regular filesystemes formatted as vfat, which would be included in the list incorrectly. So matching on filesystem type is not the way to go. That's why I am looking for something that can match on partition type, so EF00 or ef.

If such a command does not exist, I would probably need to do the following to get at the information I want:
- list all disks
- for each disk, find out if there is an MBR or GPT partition table on it
- list the partition table
- filter the results to only print the ESP partitions

This is cumbersome and error-prone, so if an equivalent of blkid exists that is able to match partition types, I would like to use that.

I have a Slackware linux box where I cannot start any service that listens on one particular port on localhost. By using strace I found out that the error happens on the bind() call, and the error is EADDRINUSE (Address already in use):

bind(3, {sa_family=AF_INET, sin_port=htons(874), sin_addr=inet_addr("127.0.0.1")}, 16) = -1 EADDRINUSE (Address already in use)

This happens with any process I try to start listening on that port, so it is not related to the process itself. The above strace output comes from the command strace -ff nc -l -p 874 -s 127.0.0.1.

So, this suggests there is a process already listening on localhost port 874. However, I can't seem to find it. The following commands all return nothing:

netstat -aplunt | grep :874
netstat -na | grep :874
lsof -i :874
lsof -i tcp | grep 874
fuser 874/tcp
socklist | grep 874
iptables -t filter -S | grep 874
iptables -t nat -S | grep 874
iptables -t mangle -S | grep 874
conntrack -L | grep 874

If I try to listen on 0.0.0.0:874 it fails with the same error. Listening on one of the IP addresses configured on a nic works OK, and listening to 127.0.0.2:874 also works OK. Listening on a different port works fine, also on 127.0.0.1 or 0.0.0.0.

So, now I am curious. How can I find out why the network stack returns EADDRINUSE here? What other things could I look at, or what other commands can I run to get more information?

Additional info:

• Kernel 4.1.31.
• Selinux is not used here.
• Trying to connect to 127.0.0.1 with telnet returns "Connection refused"
• I'm running the commands as root

I have an OpenVPN server where I want to log how much bandwidth is used by client connections. I only need to know the bandwidth used in total by a client connection, at the end of the connection. OpenVPN has this information in the Bytes Received and Bytes Sent fields in its status file.

What is a practical way to get the value of these fields at the end of a client connection?

I know about the --status parameter, that lets OpenVPN write out its status periodically, but that seems inconvenient: the status file would have to be updated often, and it would need to be parsed just as often.

I've tried using the --client-disconnect option with a script that sends the USR2 signal to the openvpn process to dump the status, but unfortunately whenever that triggers the just-disconnected client is no longer present in the status output. So that's not working either.

I know I can log the bandwith by using iptables, as answered in How to log OpenVPN bandwidth used?, but I'm trying to find a solution that uses that data within OpenVPN itself.

For VMware ESXi guests that are booted with a BIOS boot firmware it is possible to configure the boot order directly in the .vmx file of the guest, according to this VMware kb article, by specifying these options:

bios.bootOrder = "ethernet5,ethernet2,hdd,cdrom,floppy"
bios.hddOrder = "scsi2:2,scsi0:1,ide1:0"

Q: Is something similar possible if the guest is booted with an EFI firmware?

I know I can change the boot order by accessing the EFI setup screen, but I would like to have something that can be automated.

I have a VMware ESXi 6 host with several guests running on it. There is a datastore with an ISO file that is in use by one or more of these clients. I am accessing the ESXi host through ssh from linux, so PowerCLI is not an option.

Q1: How can I, from the VMware CLI, find out which guests have this ISO file mounted?

Q2: How can I, once I know that, unmount this ISO file from these guests, also from the VMware CLI?

I expect it to be vim-cmd vmsvc subcommands, but I haven't been able to find them.

I have an application that stores contacts in OpenLDAP. It uses the c attribute to store a string describing a country name. The syntax of c only allows a two-letter country code, but the application uses full country names. Therefore the attribute it should be using is co, or friendlyCountryName. Unfortunately I cannot change this application. (It's Mozilla).

I am looking for a way to make this work. I can, of course, change the schema definition of c to that of co, but that seems bad practice. I could also disable schema checking, but that is even worse.

I have also tried using the rwm overlay to map c onto co, which works (as in: client saves c, database contains co), but then the syntax of c is still enforced, so that doesn't work.

So, the best option I have now is to change the syntax of c in the core schema. But I am curious: are there better ways to work around this?