Paul Kroon's questions

We currently have Brocade 200E fiber switches, connecting 2 EMC CLARiiONs to 4 VMware ESXi hosts. We are looking into new storage options using iSCSI with our existing ethernet network, including the possibility of gradually upgrading to 10 gigabit. I have been searching for any kind of 10GBASE-T switch, that is backwards-compatible to 1 gigabit, and includes the fiber channel ports necessary to connect to the Brocades/CLARiiONs as well.

I am not very experienced with storage administration and fiber channel, so I understand this question might have an obvious answer of "no", but it did seem like the Cisco Nexus 5010 with a module (N5K-M1008) might work.

I also thought about using a 10Gb switch (Dell Powerconnect 8024) that has the SFP ports for uplink to other switches. Are these SFP ports capable of connecting to the fiber ports on the Brocade (not necessarily just on this Dell switch, but any switch like this), or are they designed only to work as uplink to the same model?

Any insight into the specifics of fiber switching, and how fiber ports are classified would be helpful.

EDIT: I've held off commenting because I was learning a good deal from the answers, and wanted to be able to clarify as best I could. I don't necessarily need a simple switch, but more a single device that can do this (so a Cisco Nexus with the necessary modules could work). Also, it seems like for this to function, I would need my new storage to be able to support FCoE over the 10Gbps links, so that it could then reach my hosts over FC.

I understand that getting the zoning right on the FC switch might be overly complicated, but I want to see if my understanding of the technologies is now correct. So, assuming this could be accomplished, would a Nexus switch that has the 10Gbps ports, as well as FC ports from a module that connect to exisiting FC switches, be able to connect a new storage device (that can speak FCoE) to my existing hosts?

I figured this would be an easy one, but I've had a good amount of trouble finding this answer myself. I have a Cisco router that I'm setting up to have my Internet connection on one interface (external) that obtains an IP via DHCP, and my LAN on another interface (internal) that has an internal static IP. I also have port 80 forwarded to an internal address (using "ip nat inside source static...interface fa0/0...).

Everything works properly, but I have a question about the ACL I am applying inbound to the external interface. I currently have this: "permit tcp any any eq www". This works, but I am wondering if this is secure. Typically I would specify the external IP to match more specifically, but I don't necessarily have the IP since it's learned via DHCP. Is there a way to accurately specify this, or is this permit line appropriate.

Our server room is a converted closet, and we have a pair of wall-mounted air conditioning units to cool the room. These are both pointed towards the front of the server racks, and there are a couple small vents for hot air. We definitely don't have an ideal environment, but it's what I'm working with.

My question is related to an ionization feature of the A/C units. I know that this feature will basically spit out negative ions that attach to dust and other particles, and make them heavy enough to drop to the ground. With this basic understanding, I am trying to figure out if it is better for a server room to have this turned on or off.

I would imagine turning it on would mean purer air, which would mean the intake of air to the servers would have less dust (ie, good to turn it on).

However, I could also imagine that the ionized air would contain bigger, heavier dust particles that would normally drop to the ground, but could get sucked up into the servers because of the air flow. This would lead to bigger dust particles in the servers, which would be more likely to cause issues (ie, good to turn it off).

I haven't found much looking around online, so I'm hoping that someone out there might have done some deeper research into this already. Or, hopefully someone can factually show me that I'm considering something that is so minor it won't make a difference.

I am looking into MS SQL 2005 encryption (not 2008, so TDE is out), and I believe I understand the concept of how a column is encrypted. The OS uses the service credentials to encrypt the service master key, which is used to encrypt the database master key (which I create using a password), and then database master key is used for a certificate and then a symmetric key.

So, I see how an application or user needs to be able to use this cert in order to decrypt the data. However, I am wondering what kinds of attacks are possible on this setup.

If someone was able to access the MDF/LDF files for the database, they would have access to the master key. Would this not be a problem because the master key is encrypted with a strong password?

How about the case where someone has the whole server? Would the encryption scheme be protected because the service accounts' credentials that SQL runs under would be necessary to extract anything, which, again, are protected by a strong password?

My impression is that even with complete physical access, the only types of attacks would be brute force on either the service user credentials, or the master key password. Am I correct in thinking this, or am I missing something?

We are running a mirror on SQL Server 2005 SP2 Enterprise edition for a few databases. These are running on VMWare with Server 2008 R2. On the mirror server, I see the CPU go up to 50% for about a minute every 10 minutes (on the tens). Here's what it looks like:

From what I have seen so far, this is definitely the sqlserv.exe process going up to 50% (using up 1 of its 2 CPU cores). I have done a SQL profile, and not seen anything running during those times. This server is only used for mirroring the database, so my theory is that it's something related to that. Does anyone have any ideas, or other things I can do to investigate?

I am looking for some way to archive all files on our network drive. The files that would be retained are on a single volume on a single file server, which is currently about 800 gigs total. I would like to be able to retain a copy of every file even after it is deleted. If a file is modified, I would like to have every version of the file. All of this would preferably be indexed and searchable.

This wouldn't be like a normal "archiving" solution out there in that I don't want old files removed from our main file server. I'd want the file server to remain the same, and have a separate copy stored somewhere else (separate disk, server, etc.). This can be thought of as a solution for legal discovery purposes. Does anyone know if there is anything that exists out there that would do this?

UPDATE: The file server is Windows Server 2008 R2. There's probably about 10 TB free that we could use for this, but we are able to add on additional storage as necessary, and I know storage will have to be worked into whatever option we go with.

I am running Symantec BackupExec CPS 2010 on Server 2008 R2. I have everything set up ok, the backups are running and I can perform restores. I also have configured the snapshots, but they do not run according to the schedule. I can, however, manually run the snapshots through CPS without any error, but when I look to restore something I do not see any of the snapshot restore points. I can see something that appears relevant in the CPS logs:

[RPCc] RxCsAdminSnapshotWrapper:d096274b-d79f-11df-a54f-001517b02006 failed with error code 0

I also sometimes see:

HLS703E Folder failed for CRXTreeIterator::InternalDoShortCut -- RXRESULT_IllegalOperation: HLS739E (InternalDoShortCut) Problem in shorthand notation 'F:' -- Not a shortcut

I see the latter error more often in the log (not just when the snapshots should run), and F is the drive where the CPS backups are located, but the normal backups all run fine. Through the Windows shadow copy interface, I have set the F drive snapshots to be stored on a different, larger drive, but the snapshots didn't work even before I made that change. Has anyone worked with CPS 2010 and seen an issue like this before?

UPDATE: I have also found that if I go into the Shadow Copies tab for the drive I'm working with (or vssuirun), I am not able to Enable and set a Schedule for the Shadow Copies (this would be outside of BackupExec). I get this error:

Failed to create a default schedule for creating shadow copies of volume F:\.
Error 0x80070005: Access is denied.

I believe this might be related to this issue if BackupExec relies on the Windows Shadow Copy scheduling for its own scheduling. Hopefully this might help someone see what issue I might be experiencing.

We have been using a sql job to back up our SQL 2005 databases locally, and then copy them to tape with BackupExec. At the same time, we use MS Data Protection Manager to take incremental backups throughout the day. The tapes are just a nightly backup that we take offsite, and DPM allows us to restore from any 15-minute increment (or nightly Full backup to restore faster). Our most common use is to restore DBs to development servers, which we do several times a day. We're looking to replace DPM, and we are also upgrading BackupExec.

We will continue to use BackupExec as our disaster recovery backups, but I need a replacement for DPM that will primarily be used for putting copies of databases onto development servers. Ideally, I'd like to find a solution that does the incremental backups every 15 minutes or so, and allows me to restore to any time to any server like we do now. In addition, I would prefer if I could automate restores, and/or grant other users access to restore a database to server(s) they have access to. We would like to store copies for weeks or months (probably just a Full copy a day for anything after a week), or basically as long as local disk will let us.

I'm beginning my Google searching today, but I was hoping to hear some expert opinions from here, too.

We currently run CollabNet Subversion on a Windows server. I recently got the opportunity to move the Subversion server to another machine, and I basically have the choice between a Windows server or a Linux server for it. We are primarily a Windows shop, so I'd probably go with a Windows server with all things being equal, but I was wondering if there are any benefits to putting it on a Linux server instead. I'm not looking for a dispute between Windows and Linux servers, but rather specific features, documented performance differences, or any other reason I might prefer Linux for the Subversion server.

Our clients use TortoiseSVN, and, if it matters, the server versions would probably be Windows Server 2008 R2 or Ubuntu 10.04, but this is probably flexible, too.

Edit: A few extra comments after some answers: the licensing isn't an issue for us for this, our VMWare cluster has plenty of spare resources, so that's not much of an issue, and I'm comfortable with both Linux and Windows, so that doesn't affect this either. It sounds like I'm hearing there isn't a difference though, so that might be my answer.

I've searched high and low for this, but have yet to find anything. I'm running Exchange 2010, and I have a mailbox set to forward all mail to another user. When this other user has their out of office turned on, anyone e-mailing the first user will get the response from the second user, even though they were not on the original e-mail. I've been trying to come up with out of office rules that could make it only respond when the e-mail was sent directly, or even a different way to do the forwarding so it doesn't trigger out of office. Anyone have any ideas?

I'm not running into a problem or anything, I was just curious about this when I saw I have 2 folders with around 20,000 items in each. Everything works fine (using Thunderbird), but I couldn't find anything with Google about this. Anyone ever heard of a limit on this with Courier IMAP?

First off, note that I am not doing this recovery because of any actual problem, I'm just testing it. I'm running Exchange 2010 on Server 2008 R2, and using Windows Server Backup to a remote file share for the backups. I have to assume I'm doing something wrong because all of the documentation I've found hasn't helped me.

I back up the 2 separate volumes that I store database files and log files on. I use Windows Server Backup to restore a given EDB file and it's corresponding log files to an alternate location. Normally I would assume I can then create a new recovery database, specifying the location of these restored files, and I could then mount it to try to restore specific mail. However, it always gives me errors because it's in a "Dirty Shutdown" state. Running eseutil /mh shows me this state. From what I've found online, it seems as though this state should only appear if there is a genuine corruption. The backups are supposed to be Exchange-aware, so I would imagine this should not be the state the database is in after recovery. I've tried to go through the whole repair process suggested when there's corruption, but this always destroys all the data I need.

Am I doing something wrong with the backup, or something with the restore? Should the database be in this "Dirty Shutdown" state after restoring?