flumignan's questions

I was investigating a problem on a Mac OS X 10.6.8 Server, where users were complaining of access slowdowns. Network throughput slowed to a crawl. It felt like the server was overburdened. System metrics showed the data rate at the NIC to be under 10MBps, while the web management interface for the Promise VTrak 610fD RAID chassis showed 40MBps. The chassis showed 8500 IOPS for one array.

Using fs_usage, I observed AppleFileService doing a RdMeta on a particular HFS+J volume at an excessive rate.

13:48:05.783    RdMeta   D=0x00009fc9  B=0x1000     /dev/disk6s2   0.000095 W AppleFileServer     
13:48:05.783    RdMeta   D=0x00009fca  B=0x1000     /dev/disk6s2   0.000097 W AppleFileServer     
13:48:05.783    RdMeta   D=0x00009fcb  B=0x1000     /dev/disk6s2   0.000096 W AppleFileServer 

The problem was resolved when I temporarily ceased sharing the volume on disk6. I would like to know what data are associated with these disk block numbers (40905, 40906, 40907, etc) on the device listed.

What tools can I use to identify the file(s) associated with these blocks?

I'm a system administrator and have never used Matlab, so forgive my general ignorance of the program.

My users have encountered problems when executing scripted Matlab actions over AFP to a Mac OS X Server 10.6.7 where the access control list (ACL) should allow actions, but the POSIX-style permissions disallow the activity.

It seems as if Matlab, run locally on the Mac workstations on datasets on the remote server, ignores the ACLs entirely. This is the only application I've ever seen behave this way. The server's filesystem is HFS+J and all other activity is performing as expected. These users cannot use CIFS because of our integration with external directory systems.

In this example, the directory bxdata, the members of the group cibturner should be able to modify the files. Indeed, they can using any other method except via Matlab scripts. When the Matlab script hits these files, the POSIX permissions of 644 disallow modification. It's as if the ACLs are irrelevant.

[root@cib 16:00:24 /14181.2_5sM]# ls -leh@ bxdata/
total 128
-rw-r--r--+ 1 kel32  staff    18K Feb 15 09:31 TS-5sMath030708-21073-1.edat  
 0: group:cibturner inherited allow read,write,execute,append,readattr,writeattr,readextattr,writeextattr,readsecurity,writesecurity,chown
 1: group:cibsrlocaladmins inherited allow read,write,execute,append,readattr,writeattr,readextattr,writeextattr,readsecurity,writesecurity,chown
 2: group:crcservergroup inherited allow read,write,execute,append,readattr,writeattr,readextattr,writeextattr,readsecurity,writesecurity,chown
-rw-r--r--+ 1 kel32  staff    25K Feb 15 09:31 TS-5sMath030708-21073-1.txt
 0: group:cibturner inherited allow read,write,execute,append,readattr,writeattr,readextattr,writeextattr,readsecurity,writesecurity,chown
 1: group:cibsrlocaladmins inherited allow read,write,execute,append,readattr,writeattr,readextattr,writeextattr,readsecurity,writesecurity,chown
 2: group:crcservergroup inherited allow read,write,execute,append,readattr,writeattr,readextattr,writeextattr,readsecurity,writesecurity,chown

Because this server has HIPAA data, security is critical. We are not using networked home directories or SAN technology. The MatLab program is run on the user's hard drive; access is granted via Kerberized AFP.

Our enterprise firewall is configured to disconnect ssh connections after 30 minutes of of inactivity. Sometimes, I need to perform an operation on a server that requires a sustained connection exceeding this period, but which my shell appears inactive (at least to the firewall).

It seems that opening a second ssh connection with continuous activity (say, running top) isn't enough to sustain the shell. I'd prefer not to set the process to the background and then foreground something more interactive, because any alerts or warnings might escape my attention. I could periodically, repeatedly hit the return key in the shell window every x-minutes, but that's undesirable.

Some programs, like sweep (from Sophos) have a cursor that rotates in the shell, sustaining the connection (that is, it cycles through \ | / – and so on). That works nicely.

Is there some trick, perhaps associated with bash, that could serve this purpose?

I understand that performance degrades with single disk volumes and small RAID volumes as the volumes fill up. Some admins say that they perceive slowdowns at 80% and use that as a general rule of thumb to increase available storage. Others say 90%. I'll also accept that different file types present different experiences, too — say, video files, version small database files, to general Office type documents, partition table and filesystem format. There are, I'm sure, other contributing factors that affect performance, like RAID vs SAN vs virtualized storage, RAID block size, NFS vs CIFS and other aspects.

My question is: in large, direct-attached, non-SAN, RAID 60 HFS+J volumes, of, say, 50TB, attached via fibre channel and made available to an office 100 concurrent users using typical network filesharing protocols -- does that same rule of thumb (80% or 90% used) hold true, or can administrators expect performance degradation to occur much later, at, say, 95% volume usage? In other words, if my 50TB RAID volume is at 80% now, at what point am I pressed to increase storage? When should I be alarmed?,

I'm drawing up some documentation for users with the intent on educating them on certificate revocation. I would like to include screen shots of browsers to demonstrate the user experience when encountering a revoked cert. The revocation can occur via either OCSP or CRL.

I've tried digging around CRLs, but they list the serial number of a certificate and don't provide a URL for me to try connecting.

Could someone provide a URL to a live site with a non-self-signed but revoked cert? Or perhaps there's a way to look up certs in a CRL and cross reference them to a URL?