Max Allan's questions

I have a Centos box with 2 interfaces that have routes to the internet. One 192.168.1.254, the other 192.168.133.11. I can route through 133.11 perfectly OK when it is the only route specified. When I add the other route to the table, the first stops working.

[root@sinister2 yum.repos.d]# ip route
default via 192.168.133.11 dev ens2u3
192.168.1.0/24 dev eno1 proto kernel scope link src 192.168.1.70 metric 100
192.168.133.0/24 dev ens2u3 proto kernel scope link src 192.168.133.108
[root@sinister2 yum.repos.d]# curl ifconfig.me
92.40.187.117
[root@sinister2 yum.repos.d]# route del default
[root@sinister2 yum.repos.d]# ip route add default scope global nexthop via 192.168.133.11 dev ens2u3 weight 1 nexthop via 192.168.1.254 dev eno1 weight 1
[root@sinister2 yum.repos.d]# curl ifconfig.me
86.133.6.21
[root@sinister2 yum.repos.d]# ip route
default
        nexthop via 192.168.133.11 dev ens2u3 weight 1
        nexthop via 192.168.1.254 dev eno1 weight 1
192.168.1.0/24 dev eno1 proto kernel scope link src 192.168.1.70 metric 100
192.168.133.0/24 dev ens2u3 proto kernel scope link src 192.168.133.108
[root@sinister2 yum.repos.d]# curl https://developer.download.nvidia.com/
curl: (7) Failed to connect to developer.download.nvidia.com port 443: Connection timed out
[root@sinister2 yum.repos.d]# traceroute developer.download.nvidia.com
traceroute to developer.download.nvidia.com (152.199.20.126), 30 hops max, 60 byte packets
 1  * * *
...manually clipped all the stars...
30  * * *
[root@sinister2 yum.repos.d]# route del default
[root@sinister2 yum.repos.d]# route add default gw 192.168.133.11
[root@sinister2 yum.repos.d]# traceroute developer.download.nvidia.com
traceroute to developer.download.nvidia.com (152.199.20.126), 30 hops max, 60 byte packets
 1  _gateway (192.168.133.11)  2.525 ms  2.667 ms  2.942 ms
 2  * * *
 3  172.25.83.33 (172.25.83.33)  301.910 ms  307.052 ms  306.962 ms
 4  * * *
 5  * * *
 6  172.25.88.89 (172.25.88.89)  305.709 ms * 172.25.88.93 (172.25.88.93)  292.299 ms
 7  * * *
 8  172.25.67.146 (172.25.67.146)  48.475 ms 172.25.67.158 (172.25.67.158)  53.182 ms 172.25.67.146 (172.25.67.146)  53.096 ms
 9  * * *
10  185.153.238.161 (185.153.238.161)  46.396 ms  57.785 ms  57.785 ms
11  ae-65.core1.lhc.edgecastcdn.net (152.195.96.139)  29.347 ms  39.733 ms  51.525 ms
12  152.199.20.126 (152.199.20.126)  39.295 ms  39.182 ms  39.041 ms
13  152.199.20.126 (152.199.20.126)  39.250 ms  39.251 ms  39.015 ms

That nvidia site routes through ens2u3, I can see the traffic on the interface :

tcpdump -i ens2u3
16:26:37.528360 ARP, Request who-has 192.168.133.11 tell sinister2, length 28
16:26:37.530385 ARP, Reply 192.168.133.11 is-at 76:e6:8d:8e:99:a8 (oui Unknown), length 28
16:26:39.256368 IP sinister2.42630 > 152.199.20.126.https: Flags [S], seq 1095059191, win 29200, options [mss 1460,sackOK,TS val 1024650559 ecr 0,nop,wscale 7], length 0
16:26:47.768368 IP sinister2.42630 > 152.199.20.126.https: Flags [S], seq 1095059191, win 29200, options [mss 1460,sackOK,TS val 1024659071 ecr 0,nop,wscale 7], length 0
etc...

None of my syns ever got an ack. Earlier, when I was routing everything through ens2u3, it did :

16:23:18.233472 IP sinister2.55236 > 152.199.20.126.https: Flags [S], seq 1471928043, win 29200, options [mss 1460,sackOK,TS val 466587424 ecr 0,nop,wscale 7], length                    0
16:23:18.276348 IP 152.199.20.126.https > sinister2.55236: Flags [S.], seq 2554681057, ack 1471928044, win 14600, options [mss 1220,nop,wscale 12,sackOK,TS val 371740                   3495 ecr 466587424], length 0
16:23:18.276428 IP sinister2.55236 > 152.199.20.126.https: Flags [.], ack 1, win 229, options [nop,nop,TS val 466587467 ecr 3717403495], length 0

Traceroute just shows stars for any address over ens2u3 and a connection to anything on eno1.

Anyone got any good ideas? Spot anything I've done wrong?

Do I need to do some sort of clearing of existing routes when changing them? In the first example, I can get to ifconfig.me via the new route, but not use the old route to nvidia, which makes me think it isn't that simple...

I'm new to dnf, so this is probably obvious to someone.

I did check versionlock and checked for any exclude lines in any of the /etc/yum.repos.d files. But, when I have any other repos enabled, I cannot find mysql server to install. I can try to install it with all other repos disabled, but then it cannot find all the dependencies.

[root@ip-10-9-10-242 yum.repos.d]# dnf clean all
42 files removed
[root@ip-10-9-10-242 yum.repos.d]# dnf --disablerepo "*"  --enablerepo "mysql56-community" list available
Last metadata expiration check: 0:07:40 ago on Tue 30 Jul 2019 12:38:45 UTC.
Available Packages
mysql-community-bench.x86_64                                                                                        5.6.45-2.el7                                                                          mysql56-community
...
mysql-community-server.x86_64                                                                                       5.6.45-2.el7                                                                          mysql56-community
mysql-community-test.x86_64                                                                                         5.6.45-2.el7                                                                          mysql56-community
[root@ip-10-9-10-242 yum.repos.d]# dnf --enablerepo "mysql56-community" search mysql-community-server.x86_64
Last metadata expiration check: 0:07:59 ago on Tue 30 Jul 2019 12:38:48 UTC.
No matches found.
[root@ip-10-9-10-242 yum.repos.d]# dnf search mysql-community
Last metadata expiration check: 0:10:57 ago on Tue 30 Jul 2019 12:38:48 UTC.
============================================================================================== Name Matched: mysql-community ==============================================================================================
mysql-community-bench.x86_64 : MySQL benchmark suite
mysql-community-release.noarch : MySQL repository configuration for yum
mysql-community-release.noarch : MySQL repository configuration for yum
mysql-community-embedded.i686 : MySQL embedded library
mysql-community-embedded.x86_64 : MySQL embedded library
mysql-community-embedded-devel.i686 : Development header files and libraries for MySQL as an embeddable library
mysql-community-embedded-devel.x86_64 : Development header files and libraries for MySQL as an embeddable library

So, you can see some of the stuff in mysql56 repo is found (like bench) but the server isn't. I'd also previously done :

yum-config-manager --disable mysql80-community
yum-config-manager --enable mysql56-community

And can see :

[root@ip-10-9-10-242 yum.repos.d]# dnf repolist
Last metadata expiration check: 0:00:04 ago on Tue 30 Jul 2019 13:03:47 UTC.
repo id                         repo name                                status
mysql-connectors-community      MySQL Connectors Community                 118
mysql-tools-community           MySQL Tools Community                       95
mysql56-community               MySQL 5.6 Community Server                 169
rhui-client-config-server-8     Red Hat Update Infrastructure 3 Client C     3
rhui-rhel-8-appstream-rhui-rpms Red Hat Enterprise Linux 8 for x86_64 -  5,472
rhui-rhel-8-baseos-rhui-rpms    Red Hat Enterprise Linux 8 for x86_64 -  2,029

For anyone still confused, what can't be found, can't be installed.

[root@ip-10-9-10-242 ~]# dnf install mysql-community-server
Last metadata expiration check: 0:00:12 ago on Thu 01 Aug 2019 09:14:02 UTC.
No match for argument: mysql-community-server
Error: Unable to find a match

OK, so a bit of "-v" action and it says the packages are excluded. BUT I can disable all excludes and it still says they're excluded.

[root@ip-10-9-10-242 dnf]# dnf repoquery --repo mysql56-community --available mysql-community-server-0:5.6.45-2.el7.x86_64
Last metadata expiration check: 0:13:17 ago on Thu 01 Aug 2019 17:12:25 UTC.
mysql-community-server-0:5.6.45-2.el7.x86_64


[root@ip-10-9-10-242 dnf]# dnf --enablerepo=mysql56-community  --disableexcludepkgs all --disableexcludes all  install mysql-community-bench
Last metadata expiration check: 0:14:46 ago on Thu 01 Aug 2019 17:13:30 UTC.
Error: 
 Problem: package mysql-community-bench-5.6.45-2.el7.x86_64 requires mysql-community-server(x86-64) >= 5.6.10, but none of the providers can be installed
  - cannot install the best candidate for the job
  - package mysql-community-server-5.6.15-4.el7.x86_64 is excluded
  - package mysql-community-server-5.6.16-1.el7.x86_64 is excluded
.....
  - package mysql-community-server-5.6.44-2.el7.x86_64 is excluded
  - package mysql-community-server-5.6.45-2.el7.x86_64 is excluded


  [root@ip-10-9-10-242 dnf]# dnf --disablerepo "*" --enablerepo=mysql56-community  --disableexcludepkgs all --disableexcludes all  install mysql-community-bench
  Last metadata expiration check: 0:18:12 ago on Thu 01 Aug 2019 17:12:25 UTC.
  Error: 
   Problem: cannot install the best candidate for the job
    - nothing provides /usr/bin/perl needed by mysql-community-bench-5.6.45-2.el7.x86_64
    - nothing provides perl(Getopt::Long) needed by mysql-community-bench-5.6.45-2.el7.x86_64
    - nothing provides perl(Data::Dumper) needed by mysql-community-bench-5.6.45-2.el7.x86_64
    - nothing provides perl(POSIX) needed by mysql-community-bench-5.6.45-2.el7.x86_64
    - nothing provides perl(Cwd) needed by mysql-community-bench-5.6.45-2.el7.x86_64
    - nothing provides perl(DBI) needed by mysql-community-bench-5.6.45-2.el7.x86_64
    - nothing provides perl(Benchmark) needed by mysql-community-bench-5.6.45-2.el7.x86_64
    - nothing provides perl(sigtrap) needed by mysql-community-bench-5.6.45-2.el7.x86_64
  (try to add '--skip-broken' to skip uninstallable packages or '--nobest' to use not only best candidate packages)

I've got an ML350eG8 and tried to add a P410 RAID controller. When I add the card it will try to start up and throws a "exceeded option ROM space" type error. I can get into the RBSU but if I disable the PXE boot and exit, it doesn't save the changes. If I try to disable the internal network card or internal RAID card, it doesn't even update the setting on screen in RBSU.

I think the too many ROMs issue breaks the RBSU. Amongst other things. Which is pretty useless.

I can take the P410 out and set the options (disable PXE, disable RAID, disable onboard network) and that's all fine. Then I put the P410 back in and it puts everything back to "default" values.

If I try to run the setup util for the internal B210i controller, it runs the "intelligent provisioning" thing which gets about 1/3rd of the way through booting and crashes. I don't actually want to use it as a RAID card, just SATA mode, but it resets to RAID mode and if I turn it back to SATA mode, it doesn;t save the changes.

Is there a way I can disable network/internal RAID with hardware switches?? The software seems to be designed to break itself. Or any other option ROMs I can disable somehow?? (Other than using an axe on the stupid thing...)

Occasionally, in the middle of the night, DNS fails to resolve our smarthost address. And sendmail decides to send the mail as a "rejected" message. Because "root" is aliased to an off-box address, that also tries to use the smart host, and fails. And then I get a savemail panic. Is there any way to persuade sendmail that if it can't resolve the smart host, it can queue the message for later?

I have a horrible feeling I just need to get up at 3am and see wtf is going on with the DNS server :-(

I have a VPC with some routes and subnets. I want to get ansible to work with it but I can't see a way to link the subnet with the route table ID. I've used the ec2_vpc_route_table_facts, ec2_vpc_subnet_facts and ec2_vpc_net_facts modules but unless I'm missing something, none of them provide tell me which subnet is associated with which route table.

TASK [ec2_vpc_route_table_facts] ***********************************************
ok: [localhost]

TASK [display routes] **********************************************************
ok: [localhost] => {
    "msg": {
        "changed": false, 
        "route_tables": [
            {
                "id": "rtb-83fd25e7", 
                "routes": [
                    {
                        "destination_cidr_block": "172.31.0.0/16", 
                        "gateway_id": "local", 
                        "instance_id": null, 
                        "interface_id": null, 
                        "origin": "CreateRouteTable", 
                        "state": "active", 
                        "vpc_peering_connection_id": null
                    }, 
                    {
                        "destination_cidr_block": "0.0.0.0/0", 
                        "gateway_id": "igw-6f792c0a", 
                        "instance_id": null, 
                        "interface_id": null, 
                        "origin": "CreateRoute", 
                        "state": "active", 
                        "vpc_peering_connection_id": null
                    }
                ], 
                "tags": {}, 
                "vpc_id": "vpc-e749a683"
            }, 
            {
                "id": "rtb-abf02bcf", 
                "routes": [
                    {
                        "destination_cidr_block": "172.31.0.0/16", 
                        "gateway_id": "local", 
                        "instance_id": null, 
                        "interface_id": null, 
                        "origin": "CreateRouteTable", 
                        "state": "active", 
                        "vpc_peering_connection_id": null
                    }
                ], 
                "tags": {}, 
                "vpc_id": "vpc-e749a683"
            }
        ]
    }
}

TASK [ec2_vpc_subnet_facts] ****************************************************
ok: [localhost]

TASK [display subnets] *********************************************************
ok: [localhost] => {
    "msg": {
        "changed": false, 
        "subnets": [
            {
                "availability_zone": "eu-west-1b", 
                "available_ip_address_count": 4091, 
                "cidr_block": "172.31.16.0/20", 
                "default_for_az": "true", 
                "id": "subnet-3ac33c4c", 
                "map_public_ip_on_launch": "true", 
                "state": "available", 
                "tags": {}, 
                "vpc_id": "vpc-e749a683"
            }, 
            {
                "availability_zone": "eu-west-1c", 
                "available_ip_address_count": 4091, 
                "cidr_block": "172.31.32.0/20", 
                "default_for_az": "true", 
                "id": "subnet-4efbef17", 
                "map_public_ip_on_launch": "true", 
                "state": "available", 
                "tags": {}, 
                "vpc_id": "vpc-e749a683"
            }, 
            {
                "availability_zone": "eu-west-1a", 
                "available_ip_address_count": 4091, 
                "cidr_block": "172.31.0.0/20", 
                "default_for_az": "true", 
                "id": "subnet-9a3deafe", 
                "map_public_ip_on_launch": "true", 
                "state": "available", 
                "tags": {}, 
                "vpc_id": "vpc-e749a683"
            }
        ]
    }
}

The only way I can see to make this work is to include tags on the route with a sensible value (like the subnet ID). But that would still need someone to manually keep it up to date, there is no way to automate that from Ansible, is there?

My audispd keeps logging lots of queue full errors.

 Jun  9 08:46:29 web audispd: queue is full - dropping event

I'd like to understand better why the queue is filling up and whether there is a better way to resolve the problem than continually increasing the q_depth (currently up to 300). My thoughts are that I shouldn't be seeing so many messages that the queue can't be processed. So, how do I find out what is in the queue and why it isn't being flushed out? (There shouldn't be many events, it's a very quiet web server)

I need to reset a whole load of user passwords and then set them as expired or "User must change password on next login" The password is easy to change with SetADAccountPassword.

Looking at the SetADAccountControl cmdlet instructions suggests there is a "PasswordExpired" parameter in the description, but there is no mention of that parameter in the rest of the text. If I try it, it doesn't exist.

Ideally I'm hoping for a fairly simple, Powershell command to do it! I don't have any other scripting language on the server.

Thanks.