John Mee's questions

We're using google's pagespeed service. From what I can gather it just draws the page from our webserver and runs it through the mod_pagespeed optimisation module. I'm wondering does it do any proxy/caching as well, or is it strictly one request in/one request out?

Now we're also using google's cloudflare CDN/proxying service (elsewhere). From what I can gather cloudflare is a big proxy/caching network/service. Does it do any page optimisation as well, or does it strictly store and forward exactly what it received from our webserver?

I'm working with a business critical website and have been instructed not to try anything 'just to see what happens' so I'm forced to ask "what happens if you use both pagespeed and cloudflare together"?

I'm expecting nothing bad. I expect the cloudflare cache would draw our pages from pagespeed which in turn is drawing from our webserver. The end result being optimized pages in the cloudflare cache.

Is my understanding correct?

We only want to be alerted if the service fails to restart. Is this possible?

That is if, on the first check the service is down then restart it and don't bother to send us an alert; but if the service is still down after two cycles then we want to know.

Tried if not exist for 2 cycles then alert but found that whilst we'd get an alert it would not try to restart.

So then tried the below but same result: sends an alert without attempting a restart.

check process mysql with pidfile /var/run/mysqld/mysqld.pid
   start program = "/etc/init.d/mysql start"
   stop program = "/etc/init.d/mysql stop"
   if not exist then restart
   if not exist for 2 cycles then alert

Can we set it to only send the alert when pain persists?

Is it possible to redirect the output of an exec command to the monit log?

check host example.org with address example.org
   if failed port 80 protocol http for 2 cycles then
      exec "/root/cloudflare.py >> /var/log/monit.log"

This doesn't seem to work:

[EST Mar  6 16:02:19] error    : 'example.org' failed, cannot open a connection to INET[example.org:80] via TCP
[EST Mar  6 16:02:24] info     : 'example.org' exec: /root/cloudflare.py
[EST Mar  6 16:02:24] error    : 'nginx' process is not running
[EST Mar  6 16:02:24] info     : 'nginx' trying to restart
[EST Mar  6 16:02:24] info     : 'nginx' start: /etc/init.d/nginx
[EST Mar  6 16:02:24] error    : monit: Error reading pid from file '/var/run/nginx.pid'

As you can see it records that it invoked the script, and the script does actually do what it is expected to do, but the directed output is not captured in the log. It does, of course, if I run from the cmdline.

Is there a problem with two processes trying to append to the same log? or is this too much for a monit exec?

To keep an eye on what's happening with our production servers I recently discovered Munin. It was trivial to install but I'm having a lot of trouble working out how to add/remove graphs.

I found some documentation suggesting I can reorder them but very little discussion about how to manage plugin configuration. The bulk of the plugin documentation discusses how to create plugins; rather than use them.

The question is pretty basic: How do I use the vast library of plugins so I can see what's happening with, for example, nginx, mysql and memcache.

vagrant@precise64:~$ sudo tasksel install lamp-server
tasksel: aptitude failed (100)

I'm hoping to get a LAMP server from a clean install of ubuntu. All the googles suggest tasksel, which going into a pretty ascii gui, downloads stuff, then dies with this message.

I'm guessing I should try doing it via apt-get of the individual packages but seems a fair chance somebody else is going to search for this error message and want the right answer.

This message appears when I login to my machine:

There is 1 zombie process.

• What is it telling me?
• Is this anything I should worry about?
• If yes, then what should I do, and how?

My website is throwing up large batches of "Broken link" messages. I assume I'm being probed for a specific vulnerability.

I want to know what the perp is looking for, how they hope it will work, is it coming directly, or from an unwitting victim... all that kind of thing. Anything at all you might be able to tell me about it.

One concern is that there is a spot on the site where users can enter their own HTML which is then presented by our webserver; could this be related to that?

There is about two dozen variations of these:

Referrer: http://210.11.22.33/<script>cross_site_scripting.nasl</script>.jspa
Requested URL: /<script>cross_site_scripting.nasl</script>.jspa

Referrer: http://210.11.22.33/<IMG%20SRC="javascript:alert(cross_site_scripting.nasl);">.jspa
Requested URL: /<IMG SRC="javascript:alert(cross_site_scripting.nasl);">.jspa

Referrer: http://210.11.22.33/<meta%20http-equiv=Set-Cookie%20content=%22testbvny=9424%22>
Requested URL: /<meta http-equiv=Set-Cookie content="testbvny=9424">

Referrer: http://210.11.22.33/<IMG%20SRC="javascript:alert(cross_site_scripting.nasl);">.idc
Requested URL: /<IMG SRC="javascript:alert(cross_site_scripting.nasl);">.idc