edgester's questions

I'm having a really weird problem with systemd on RHEL7.The /run/puppetboot.lock file is not being removed at the end of execution for the unit file. Strangely, when I replace the 'puppet agent' lines with '/usr/bin/true', then them lock file is deleted as expected.

[Unit]
Description=Extra Puppet runs
Wants=basic.target
Before=puppet.service
After=basic.target network.target puppetmaster.service

[Service]
Type=oneshot
RemainAfterExit=yes
EnvironmentFile=-/etc/sysconfig/puppetagent
EnvironmentFile=-/etc/sysconfig/puppet
ExecStart=/usr/bin/touch /run/puppetboot.lock
ExecStart=/usr/bin/puppet agent --onetime --no-daemonize --ignoreschedules
ExecStart=/usr/bin/puppet agent --onetime --no-daemonize --ignoreschedules
ExecStart=/usr/bin/rm -f /run/puppetboot.lock
ExecStart=/bin/bash -c "/bin/test -x /usr/local/sbin/reboot-if-needed && /usr/local/sbin/reboot-if-needed"

[Install]
WantedBy=multi-user.target puppet.service

I'm using the lock file as a signal that the early-booting config and setup is done so that I can send an email to the admins for post-build configuration. I'm hoping to avoid adding a systemd unit file just to send me nag emails after a new server is built.

Is there a way to force my Dell BMCs and iDrac cards to only use the lanplus interface and not use the insecure "lan" interface. I understand that there are some "firewall" features in the IPMI spec. to restrict certain functions between chassis and such, but I don't know if it can be used in this manner.

Update: All out my boxes are in a switched environment. There is no NAT going on between my servers or my work desktop. I'm using ipmitool -I lanplus -H myhost -u root -p password -K sol activate" to talk to the serial console over IPMI.

update2: While I'm in a switched environment, I have no control of the switches. If I can't do it on the host or the idrac itself, then it's a non-starter.

I'm trying to secure the iDRAC's and BMC's on some of my Dell servers (R210, R410, R510). I want to restrict access to IPMI commands to only a few IP addresses. I've successfully restricted access to the iDrac using the instructions from http://support.dell.com/support/edocs/software/smdrac3/idrac/idrac10mono/en/ug/html/racugc2d.htm#wp1181529 , but the IP restrictions do not affect IPMI. A separate management network is not practical at this time because of lack or ports and some Dell BMC's don't offer a separate port. I'm told by my networking group that our switches don't support trunking, so using the vlan tagging is not an option either.

Is there a way restrict the IPMI access to a list of allowed addresses?

FYI, for various reasons, I have a mix of Dell servers with BMC's, iDrac Express and iDrac enterprise management features.

Update: All out my boxes are in a switched environment. There is no NAT going on between my servers or my work desktop. I'm using ipmitool -I lanplus -H myhost -u root -p password -K sol activate" to talk to the serial console over IPMI.

Update2: While I'm in a switched environment, I don't have access to change the network switches, which are managed by a different department. The networking department doesn't like setting ACL's on routers and can't/won't use vlan tagging on our ports.

I'm running apache 2.2 with PHP 5.2 in FastCGI mode with mod_fcgid. The platform is RedHat Enterprise Linux 5.5 x86_64. I have my minimum and maximum fastcgi slaves set to 35. How do I track how many php-cgi processes are busy at a certain point in time? I want to see if I'm running out of php-cgi processes and need to increase the number of processes running. I can use "ps" to see how many processes are running, but not how many are busy. How can I see if Apache is blocking on a free php-cgi process?

I'm running Apache on RedHat Enterprise 5.5 with PHP 5.1 from the Rackspace IUS community repository.

Occasionally, I have server spikes of 8+ load. top shows that httpd.worker is consuming 120-150% CPU but the hits don't appear to be coming that fast. I do notice that our craftysyntax URL seems to keep coming up when that happens.

I also have mod_security installed with one of the core rules sets.

I'm scrathcing my head about how to figure out what's causing the high CPU usage. My prime suspects are PHP and mod_security.

I have the following oprofile output form during a load spike, but it doesn't tell me which process is calling libpcre:

% opreport
CPU: Intel Architectural Perfmon, speed 2793.09 MHz (estimated)

Counted CPU_CLK_UNHALTED events (Clock cycles when not halted)
with a unit mask of 0x00 (No unit mask) count 100000

CPU_CLK_UNHALT...|
  samples|      %|
------------------
  7061182 91.9105 libpcre.so.0.0.1
   206901  2.6931 php-cgi
   142239  1.8514 mod_security2.so
   138121  1.7978 vmlinux
    53809  0.7004 libc-2.5.so
    20909  0.2722 libapr-1.so.0.2.7
    16585  0.2159 oprofiled
     9230  0.1201 oprofile

FYI, ldd shows that mod_security is linked to libpcre, but php-cgi is not (weird).