Home / user-43734

organicveggie's questions

Martin Hope
organicveggie
Asked: 2012-11-08 12:44:50 +0800 CST
  • 13

I'm having a terrible time trying to get a recent version of ImageMagick installed on a CentOS 6.3 x86_64 server. First, I [downloaded] 1 the RPM from the ImageMagick site and tried to install it. That failed due to missing dependencies:

error: Failed dependencies:
    libHalf.so.4()(64bit) is needed by ImageMagick-6.8.0-4.x86_64
    libIex.so.4()(64bit) is needed by ImageMagick-6.8.0-4.x86_64
    libIlmImf.so.4()(64bit) is needed by ImageMagick-6.8.0-4.x86_64
    libImath.so.4()(64bit) is needed by ImageMagick-6.8.0-4.x86_64
    libltdl.so.3()(64bit) is needed by ImageMagick-6.8.0-4.x86_64

I have libtool-ltdl installed, but that includes libltdl.so.7, not libltdl.so.4. I have a similar problem with libHalf, libIex, libIlmImf and libImath. Typically, you can install OpenEXR to get those dependencies. Unfortunately, CentOS 6.3 includes OpenEXR 1.6.1, which includes ilmbase-devel 1.0.1. And that release of ilmbase-devel includes newer versions of those dependencies:

  • libHalf.so.6
  • libIex.so.6
  • libIlmImf.so.6
  • libImath.so.6

I next tried following the [instructions] 2 for installing ImageMagick from source. No luck there either. I get a build error:

RPM build errors:
  File not found by glob: /home/sean/rpmbuild/BUILDROOT/ImageMagick-6.8.0-4.x86_64/usr/lib64/ImageMagick-6.8.0/modules-Q16/coders/djvu.*

I even re-ran configure to explicitly exclude djvu and I still get the same error. At this point, I'm pulling my hair out.

What's the easiest way to get a relatively recent version of ImageMagick (> 6.7) installed on CentOS 6.3? Does someone offer RPMs with dependencies somewhere?

centos
Martin Hope
organicveggie
Asked: 2012-05-18 09:37:39 +0800 CST
  • 0

I have an EC2 instance running CentOS 5.6 86_64. I use xfs_freeze to freeze/thaw a file system before taking a snapshot. Normally this works great, but today it stopped working - the freeze operation never finished. I checked the process list and found a handful of xfs_io processes running that seem to be stuck:

  337 pts/0    D      0:00 /usr/sbin/xfs_io -r -p xfs_freeze -x -c freeze /var/lib/pgsql
32138 pts/0    D      0:00 /usr/sbin/xfs_io -r -p xfs_freeze -x -c freeze /var/lib/pgsql
32228 pts/0    D      0:00 /usr/sbin/xfs_io -r -p xfs_freeze -x -c freeze /var/lib/pgsql
32261 pts/0    D      0:00 /usr/sbin/xfs_io -r -p xfs_freeze -x -c freeze /var/lib/pgsql
32305 ?        D      0:00 /usr/sbin/xfs_io -r -p xfs_freeze -x -c freeze /var/lib/pgsql

kill -TERM and kill -9 don't seem to kill these processes off. I really don't want to reboot the machine, because it happens to be a primary database server.

Any suggestions?

centos process kill
Martin Hope
organicveggie
Asked: 2012-05-04 10:03:15 +0800 CST
  • 2

I have Graphite setup on three instances on EC2:

  • carbon-relay - relay1.graphite.prod.example.ec2
  • carbon-cache + webapp - cache3.graphite.prod.example.ec2
  • carbon-cache + webapp - cache4.graphite.prod.example.ec2

The relay is working perfectly with consistent-hashing. The problem is the two web servers are not communicating with each other, so I only see the metrics from one server.

I spent a lot of time looking at https://answers.launchpad.net/graphite/+question/114206 and I can't figure out what I have setup incorrectly. I can run a wget from cache3 against cache4, get data back and see it in the Apache logs. So I don't think it's a firewall issue. I tried enabling suppressError = False in remote_storage.py and turned on DEBUG in local_settings.py, but I don't see any errors in Firebug.

cache3 - local_settings.py

CLUSTER_SERVERS = [ 'cache4.graphite.prod.example.ec2', 'localhost' ]

cache4 - local_settings.py

CLUSTER_SERVERS = [ 'cache3.graphite.prod.example.ec2', 'localhost' ]

I have tried using IP addresses as well and that had no impact.

I did a little more debugging and modified storage.py to directly hard code my remote hosts:

STORE = Store(settings.DATA_DIRS, remote_hosts=["cache4.graphite.prod.example.ec2", "127.0.0.1"])

That worked. So, somehow my CLUSTER_SERVERS value isn't getting pulled in from local_settings.py correctly.

Any suggestions?

monitoring cluster metrics graphite
Martin Hope
organicveggie
Asked: 2012-03-16 07:01:23 +0800 CST
  • 1

We have a really strange issue with DNS on our EC2 instances. An application we're running on some of our instances is Java-based service that provides a back-end for an Android application. As part of it's functionality, it sends push notifications to phones through a Google API. To do this, it has to make an SSL request to android.apis.google.com. Unfortunately, when running this on our EC2 instances, we get a certificate error because the hostname doesn't match the certificate name:

hostname in certificate didn't match: <android.apis.google.com> != <.gstatic.com> OR <gstatic.com> OR <.gstatic.com>

We have tracked the problem down to a difference in DNS results. When we query DNS for android.apis.google.com from our office (where everything works), we get back the following:

android.apis.google.com. 300    IN      CNAME   clients.l.google.com.
clients.l.google.com.   160     IN      A       74.125.226.230
clients.l.google.com.   160     IN      A       74.125.226.231
clients.l.google.com.   160     IN      A       74.125.226.232
clients.l.google.com.   160     IN      A       74.125.226.233
clients.l.google.com.   160     IN      A       74.125.226.238
clients.l.google.com.   160     IN      A       74.125.226.224
clients.l.google.com.   160     IN      A       74.125.226.225
clients.l.google.com.   160     IN      A       74.125.226.226
clients.l.google.com.   160     IN      A       74.125.226.227
clients.l.google.com.   160     IN      A       74.125.226.228
clients.l.google.com.   160     IN      A       74.125.226.229

When we perform the same query from an EC2 server, we get back a different set of DNS results:

android.apis.google.com. 300    IN      CNAME   clients.l.google.com.
clients.l.google.com.   300     IN      A       72.14.204.138
clients.l.google.com.   300     IN      A       72.14.204.100
clients.l.google.com.   300     IN      A       72.14.204.101
clients.l.google.com.   300     IN      A       72.14.204.102
clients.l.google.com.   300     IN      A       72.14.204.113

Any ideas why the DNS results would be so dramatically different out at EC2? And, more importantly, how we can fix this?

We did try using a custom hostname validator. According to our developers, that allowed the connection to proceed, but the problem is that it's connected to the wrong server, so the request still fails.

domain-name-system amazon-ec2 google android
Martin Hope
organicveggie
Asked: 2012-02-28 08:48:46 +0800 CST
  • 4

I have setup Graphite Web 0.9.9 on CentOS 6.2 x86_64 at EC2 and I'm trying to get LDAP authentication to work against 389 Directory Server. I have configured local_settings.py with:

  • USE_LDAP_AUTH
  • LDAP_URI
  • LDAP_SEARCH_BASE
  • LDAP_BASE_USER
  • LDAP_BASE_PASS
  • LDAP_USER_QUERY

But I still get "Authentication attempt failed" every time I try to log in. Looking at the logs on the LDAP server, it doesn't look like graphite-web is connecting to the LDAP server at all. Unfortunately, I don't see anything useful in the logs on the graphite server - I only see "access.log" and "info.log". "error.log" and "exception.log" are empty.

Any bright ideas on what can I do to further troubleshoot this?

django ldap 389-ds graphite
Martin Hope
organicveggie
Asked: 2012-01-26 14:50:52 +0800 CST
  • 0

We're trying to setup Apache on a public server to proxy requests to Apache with WordPress on another server, but we're getting infinite redirect loops.

Requests starting with www.example.com/about should get proxied to the internal server wp.example.corp. e.g.

www.example.com/about/about/team => proxy => wp.example.corp/about/team

To further complicate matters, our WordPress installation is in a subdirectory called "wp". So, on the WordPress server, we have the following settings:

Here are some of the relevant bits from the Apache config on the public server:

<VirtualHost *:80>
  #...
  ProxyPreserveHost On
  ProxyRequests off
  ProxyErrorOverride On
  <Proxy *>
    Order allow,deny
    Allow from all
  </Proxy>


  RewriteCond %{REQUEST_URI} ^/about/?$
  RewriteRule ^/about/?$ http://wp.example.corp/ [P,L]

  RewriteCond %{REQUEST_URI} ^/about/.+
  RewriteRule ^/about/(.*) http://wp.example.corp/$1 [P,L]

  #...
</VirtualHost>

The Apache config on the WordPress server is pretty straightforward:

<VirtualHost *:80>
  #...
  DocumentRoot /var/lib/publicpages

  <Directory /var/lib/publicpages/>
    Options Indexes FollowSymLinks MultiViews
    AllowOverride FileInfo Indexes Limit Options
  </Directory>
</VirtualHost>

And here is the .htaccess file from the root of the WordPress server:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

With LogLevel set to debug, I can see the requests hitting the public server and responding with 301 redirects:

x.x.x.x, y.y.y.y (y.y.y.y) - - [25/Jan/2012:16:44:28 -0600] "GET /about/about/team/ HTTP/1.1" 301 20 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.106 Safari/535.2"
x.x.x.x, y.y.y.y (y.y.y.y) - - [25/Jan/2012:16:44:28 -0600] "GET /about/about/team/ HTTP/1.1" 301 20 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.106 Safari/535.2"

And I can see the same requests hitting the WordPress server, who is responding with 301 redirects:

z.z.z.z - - [25/Jan/2012:16:44:28 -0600] "GET /about/team/ HTTP/1.1" 301 20 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.106 Safari/535.2"
z.z.z.z - - [25/Jan/2012:16:44:29 -0600] "GET /about/team/ HTTP/1.1" 301 20 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.106 Safari/535.2"

I also enabled full Rewrite logging on the WordPress server and see the following repeated over and over again:

x.x.x.x - - [26/Jan/2012:09:54:04 --0600] [www.example.com/sid#80e06c20][rid#80fa4200/initial] (3) [perdir /var/lib/publicpages/] add path info postfix: /var/lib/publicpages/about -> /var/lib/publicpages/about/team
x.x.x.x - - [26/Jan/2012:09:54:04 --0600] [www.example.com/sid#80e06c20][rid#80fa4200/initial] (3) [perdir /var/lib/publicpages/] strip per-dir prefix: /var/lib/publicpages/about/team -> about/team
x.x.x.x - - [26/Jan/2012:09:54:04 --0600] [www.example.com/sid#80e06c20][rid#80fa4200/initial] (3) [perdir /var/lib/publicpages/] applying pattern '^index\.php$' to uri 'about/team'
x.x.x.x - - [26/Jan/2012:09:54:04 --0600] [www.example.com/sid#80e06c20][rid#80fa4200/initial] (3) [perdir /var/lib/publicpages/] add path info postfix: /var/lib/publicpages/about -> /var/lib/publicpages/about/team
x.x.x.x - - [26/Jan/2012:09:54:04 --0600] [www.example.com/sid#80e06c20][rid#80fa4200/initial] (3) [perdir /var/lib/publicpages/] strip per-dir prefix: /var/lib/publicpages/about/team -> about/team
x.x.x.x - - [26/Jan/2012:09:54:04 --0600] [www.example.com/sid#80e06c20][rid#80fa4200/initial] (3) [perdir /var/lib/publicpages/] applying pattern '.' to uri 'about/team'
x.x.x.x - - [26/Jan/2012:09:54:04 --0600] [www.example.com/sid#80e06c20][rid#80fa4200/initial] (4) [perdir /var/lib/publicpages/] RewriteCond: input='/var/lib/publicpages/about' pattern='!-f' => matched
x.x.x.x - - [26/Jan/2012:09:54:04 --0600] [www.example.com/sid#80e06c20][rid#80fa4200/initial] (4) [perdir /var/lib/publicpages/] RewriteCond: input='/var/lib/publicpages/about' pattern='!-d' => matched
x.x.x.x - - [26/Jan/2012:09:54:04 --0600] [www.example.com/sid#80e06c20][rid#80fa4200/initial] (2) [perdir /var/lib/publicpages/] rewrite 'about/team' -> 'index.php'
x.x.x.x - - [26/Jan/2012:09:54:04 --0600] [www.example.com/sid#80e06c20][rid#80fa4200/initial] (3) [perdir /var/lib/publicpages/] add per-dir prefix: index.php -> /var/lib/publicpages/index.php
x.x.x.x - - [26/Jan/2012:09:54:04 --0600] [www.example.com/sid#80e06c20][rid#80fa4200/initial] (2) [perdir /var/lib/publicpages/] trying to replace prefix /var/lib/publicpages/ with /
x.x.x.x - - [26/Jan/2012:09:54:04 --0600] [www.example.com/sid#80e06c20][rid#80fa4200/initial] (5) strip matching prefix: /var/lib/publicpages/index.php -> index.php
x.x.x.x - - [26/Jan/2012:09:54:04 --0600] [www.example.com/sid#80e06c20][rid#80fa4200/initial] (4) add subst prefix: index.php -> /index.php
x.x.x.x - - [26/Jan/2012:09:54:04 --0600] [www.example.com/sid#80e06c20][rid#80fa4200/initial] (1) [perdir /var/lib/publicpages/] internal redirect with /index.php [INTERNAL REDIRECT]

What am I missing?

apache-2.2 proxy wordpress reverse-proxy
Martin Hope
organicveggie
Asked: 2011-11-01 15:43:07 +0800 CST
  • 3

A significant portion of the users in our company use Macs, mostly MacBook Pros with a few iMacs and Airs thrown in for good measure. We're running a mixture of 10.6 and 10.7. So far we've been providing USB drives to each employee for use as a Time Machine backup, but that's becoming fairly cumbersome.

After searching around, I'm pretty confident we can centralize this with NAS (QNAP, Drobo, etc.) or a Mac Server running on either a Mini or a Pro. From what I have read, the newer firmware for QNAP (and others) can handle the Netatalk changes that went out with OS 10.7. And obviously Mac Server 10.7 plays nicely with everyone.

The problem is that I can't figure out what kind of system I need to support our employees. I'm certain Time Machine is heavy on disk I/O, but does that mean I should treat it like a database server? e.g. increase my spindle count? Is memory or CPU a constraint at all? Or is it strictly network and disk I/O?

More simply: can one Mac Mini running Server 10.7 handle 12 users performing Time Machine backups? Or can a single Drobo B800fs handle the load? What about a QNAP TS-459U+? Or do I need something beefier?

I guess I'd love to see some information about resource utilization in general. First hand knowledge such as "I'm using a Mac Pro w/8GB RAM and 4x disk RAID-10 array to support 20 people" would be immensely beneficial.

Any advice would be appreciated.

backup mac-osx mac time-machine
Martin Hope
organicveggie
Asked: 2011-06-30 07:13:10 +0800 CST
  • 5

I have a simple script that uses rsync to copy a Postgres database to a backup location for use with Point In Time Recovery. The script is run every 2 hours via a cron job for the postgres user. For some strange reason, I can see three copies of rsync running in the process list. Any ideas why this might the case?

Here's the cron entry:

# crontab -u postgres -l
PATH=/bin:/usr/bin:/usr/local/bin
0 */2 * * * /var/lib/pgsql/9.0/pitr_backup.sh

And here's the ps list, which shows two copies of rsync running and one sleeping:

# ps ax |grep rsync
 9102 ?        R      2:06 rsync -avW /var/lib/pgsql/9.0/data/ /var/lib/pgsql/9.0/backups/pitr_archives/20110629100001/ --exclude pg_xlog --exclude recovery.conf --exclude recovery.done --exclude pg_log
 9103 ?        S      0:00 rsync -avW /var/lib/pgsql/9.0/data/ /var/lib/pgsql/9.0/backups/pitr_archives/20110629100001/ --exclude pg_xlog --exclude recovery.conf --exclude recovery.done --exclude pg_log
 9104 ?        R      2:51 rsync -avW /var/lib/pgsql/9.0/data/ /var/lib/pgsql/9.0/backups/pitr_archives/20110629100001/ --exclude pg_xlog --exclude recovery.conf --exclude recovery.done --exclude pg_log

And here's the uber simple script that seems to be the cause of the problem:

#!/bin/sh

LOG="/var/log/pgsql-pitr-backup.log"
base_backup_dir="/var/lib/pgsql/9.0/backups"

wal_archive_dir="$base_backup_dir/wal_archives"
pitr_archive_dir="$base_backup_dir/pitr_archives"

timestamp=`date +%Y%m%d%H%M%S`
backup_dir="$pitr_archive_dir/$timestamp"

mkdir -p $backup_dir

echo `date` >> $LOG

/usr/bin/psql -U postgres -c "SELECT pg_start_backup('$backup_dir');"

rsync -avW /var/lib/pgsql/9.0/data/ $backup_dir/ --exclude pg_xlog --exclude recovery.conf --exclude recovery.done --exclude pg_log

/usr/bin/psql -U postgres -c "SELECT pg_stop_backup();"
linux bash rsync
Martin Hope
organicveggie
Asked: 2011-06-08 07:54:41 +0800 CST
  • 2

I'm trying to setup a pair of LDAP servers running 389 (formerly Fedora DS) in high availability using Pacemaker with a floating IP. In addition, 389 supports multi-master replication, where all changes on one node are automatically replicated on one or more other nodes.

I'm fairly close to having everything working. Failover works just fine. And multi-master replication works fine. However, my current Pacemaker config stops the directory service on the non-active node. Which means that the backup node is not receiving replication data from the other node.

What is the right way to setup Pacemaker so that:

  1. LDAP directory services are always running on both nodes
  2. Floating IP is assigned to one of the nodes
  3. Failover occurs if the master node dies or LDAP service stops running on the master

Initially, my Pacemaker config looked like the following:

property stonith-enabled=false
property no-quorum-policy=ignore

rsc_defaults resource-stickiness=100

primitive elastic_ip lsb:elastic-ip op monitor interval="10s"
primitive dirsrv lsb:dirsrv op monitor interval="10s"
order dirsrv-after-eip inf: elastic_ip dirsrv
colocation dirsrv-with-eip inf: dirsrv elastic_ip

I then explored using Pacemaker clones:

property stonith-enabled=false
property no-quorum-policy=ignore

rsc_defaults resource-stickiness=100

primitive elastic_ip lsb:elastic-ip op monitor interval="10s"
primitive ldap lsb:dirsrv op monitor interval="15s" role="Slave" timeout="10s" op monitor interval="16s" role="Master" timeout="10s"

ms ldap-clone ldap meta master-max=1 master-node-max=1 clone-max=3 clone-node-max=1 notify-true

colocation ldap-with-eip inf: elastic_ip ldap-clone:Master
order eip-after-promote inf: ldap-clone:promote elastic_ip:start
order ldap-after-eip inf: elastic_ip ldap-clone

Unfortunately, that doesn't quite work. pengine complains that "ldap-clone: Promoted 0 instances of a possible 1 to master" and then stops the LDAP service.

ldap high-availability failover pacemaker 389-ds
Martin Hope
organicveggie
Asked: 2011-06-02 19:16:00 +0800 CST
  • 27

Are there any major alternatives for automatic failover on Linux besides the typical Heartbeat/Pacemaker/CoroSync combinations? In particular, I'm setting up failover on EC2 instances, which only supports unicast - no multicast or broadcast. I'm specifically trying to handle the few pieces of software we have which don't already have automatic failover and don't support multi-master environments. This includes tools like HAProxy and Solr.

I have Heartbeat+Pacemaker working, but I'm not thrilled with it. Here are some of my issues:

  • Heartbeat - By itself, limited to two nodes. I'd like to have 3+.
  • Pacemaker - Impossible to configure automatically. Cluster has to be running with a quorum and then it still requires manual configuration.
  • CoroSync - Does not support unicast.

Pacemaker works very well, although it's power makes it difficult to setup. The real problem with Pacemaker is that there is no easy way to automate the configuration. I really want to launch an EC2 instance, install Chef/Puppet and have the entire cluster launch without my intervention.

linux high-availability heartbeat pacemaker corosync
Martin Hope
organicveggie
Asked: 2011-05-21 10:52:40 +0800 CST
  • 2

I'm having trouble getting my CentOS 5.5 EC2 instances (both i386 and x86_64) to properly populate resolv.conf after booting. No matter what I do, I end up with the default EC2 resolv.conf:

; generated by /sbin/dhclient-script
search compute-1.internal
nameserver 172.16.0.23

What I really want to do is set my own search domain and prepend two nameservers. First, I tried adding /etc/dhclient.conf:

prepend domain-name "mydomain.ec2 "
prepend domain-name-server 1.2.3.4
prepend domain-name-server 1.2.3.5

That didn't work. So I also tried placing the dhclient.conf file in /etc/dhcp/ and /etc/dhcp3. Neither worked. So I also tried creating /etc/dhclient-enter-hooks and overriding the _make_resolv_conf()_ method to prevent dhclient-script from overwriting resolv.conf:

make_resolv_conf() {
 ;
}

That had no impact either.

The only solution I have come up with is to add an extra init script that rewrites resolv.conf. That works, but I'd really like to do this the "right" way. What am I doing wrong?

centos domain-name-system resolv.conf dhcp dhclient
Martin Hope
organicveggie
Asked: 2011-04-23 16:20:19 +0800 CST
  • 7

I have god installed on at least a dozen (or more) servers running CentOS 5.5 in both i386 and x86_64 flavors that work perfectly. I just setup two new CentOS 5.5 x86_64 servers and installed God, but I'm getting an event system error: 

$ tail /var/log/god.log 
E [2011-04-22 12:33:17] ERROR: Condition 'God::Conditions::ProcessExits' 
requires an event system but none has been loaded 

$ god check 
using event system: none 
[fail] event system did not load 

$ uname -a 
Linux server2.example.com 2.6.18-238.9.1.el5 #1 SMP Tue Apr 12 18:10:13 EDT 2011 x86_64 x86_64 x86_64 GNU/Linux

I can't find any cn or netlink kernel module on any of my CentOS servers. Yet I have other servers that work fine: 

$ god check 
using event system: netlink 
starting event handler 
forking off new process 
forked process with pid = 17559 
killing process 
[ok] process exit event received 

$ uname -a 
Linux server1.example.com 2.6.18-194.el5 #1 SMP Fri Apr 2 14:58:14 EDT 2010 x86_64 x86_64 x86_64 GNU/Linux

All servers run ruby v1.8.6-399:

# ruby -v
ruby 1.8.6 (2010-02-05 patchlevel 399) [x86_64-linux]

Ruby comes from the ELFF repo:

# rpm -qi ruby
Name        : ruby                         Relocations: (not relocatable)
Version     : 1.8.6.399                         Vendor: Bravenet ELFF <[email protected]>
Release     : 2.el5                         Build Date: Fri Apr 16 18:53:48 2010
Install Date: Thu Mar 24 11:23:48 2011         Build Host: el-build.local
Group       : Development/Languages         Source RPM: ruby-1.8.6.399-2.el5.src.rpm
Size        : 1738695                          License: Ruby or GPLv2
Signature   : DSA/SHA1, Fri Apr 16 19:07:49 2010, Key ID 551751dfe8b071d6
Packager    : Bravenet ELFF <[email protected]>

I did a little digging and can see the exception getting thrown when God tries to load the Netlink event handler:

no such file to load -- netlink_handler_ext

What could possibly be different between my servers? Am I missing something simple?

centos monitoring god
Martin Hope
organicveggie
Asked: 2011-03-04 13:18:35 +0800 CST
  • 0

I have fairly simple BIND setup on CentOS 5.5 (in a chrooted env) that handles DNS for two domains. I just added a third domain, but it's not working. It has to be something simple.

Here's an excerpt of my named.conf:

acl "trusted" {
        192.168.100.0/24;
        localhost;
};

options {
        directory "/var/named";
        dump-file "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named.stats";
        zone-statistics yes;
        notify no;
        transfer-format many-answers;
        max-transfer-time-in 60;
        interface-interval 0;
        version "Not Available";

        forwarders {
         8.8.8.8;
         8.8.4.4;
        };

        allow-query {
                trusted;
        };
};

zone "." {
        type hint;
        file "named.root";
};

zone "localdomain." IN {
        type master;
        file "localdomain.zone";
};

zone "localhost" {
        type master;
        file "localhost.zone";
};

zone "example.corp" {
        type master;
        file "example.corp.zone";
};

zone "tudy.it" {
        type master;
        notify no;
        file "tudy.it.zone";
};

And here's my tudy.it zone file:

$TTL    3600
$ORIGIN tudy.it.
@       3600    SOA     dns1.example.corp. sean.example.corp. (
                        2011030306      ; serial YYYYMMDDnn
                        24h             ; Refresh (24 hours)
                        2h              ; Retry (2 hours)
                        1000h           ; Expire (1000 hours)
                        2d )            ; Minimum (2 days)

       IN      NS      dns1.example.corp.

@               IN      A       192.168.100.40
s               IN      A       192.168.100.40

When I query the DNS server, I don't get an answer back:

$ dig @192.168.100.10 s.tudy.it ANY

; <<>> DiG 9.7.1-P2 <<>> @192.168.100.10 s.tudy.it ANY
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 64075
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;s.tudy.it.                     IN      ANY

;; Query time: 0 msec
;; SERVER: 192.168.100.10#53(192.168.100.10)
;; WHEN: Thu Mar  3 15:16:32 2011
;; MSG SIZE  rcvd: 27

I'm sure I'm missing something obvious. Any suggestions?

domain-name-system bind zones
Martin Hope
organicveggie
Asked: 2011-03-03 17:46:00 +0800 CST
  • 1

We have a slightly complex Apache 2.2 setup in front of a Tomcat 6.0 instance. The main Tomcat webapp is deployed in:

/opt/tomcat/webapps/ROOT

But we also have static content that we update semi-regularly. We didn't want to force a new build and deploy of the webapp, so that's stored separately in folders like:

/opt/tomcat/webapps/css
/opt/tomcat/webapps/foo
/opt/tomcat/webapps/bar

To handle this from Apache, we use mod_rewrite and rules look something like the following:

RewriteCond %{REQUEST_FILENAME} -f
RewriteRule ^/css/(.*)$ - [L]

RewriteCond ROOT/%{REQUEST_FILENAME} -f
RewriteRule ^/css/(.*)$ ROOT/$1 [L]

RewriteCond %{REQUEST_FILENAME} -f
RewriteRule ^(.*)\.(jpg|png|html|js)$ - [L]

RewriteCond ROOT/%{REQUEST_FILENAME} -f
RewriteRule ^(.*)\.(jpg|png|html|js)$ - [L]

RewriteRule ^/(.*)$ http://localhost:8080/$1 [P,L]
ProxyPassReverse / http://localhost:8080/

I now think I might want to start using mod_jk and I have two questions:

  1. Is it even worth using mod_jk? I don't need load balancing.
  2. Is it even possible to handle the cases I outlined where the static content is referenced as "http://www.example.com/css/foo.css", but we don't know if it's located in the Tomcat webapp or in one of the static folders.
tomcat apache-2.2 mod-rewrite mod-jk
Martin Hope
organicveggie
Asked: 2011-03-03 10:32:28 +0800 CST
  • 3

I'm trying to monitor Tomcat 6.0 using JMX. Specifically, I want to monitor the number of active threads servicing requests so I can get an alert if it approaches the maximum. While I have JMX monitoring working in general, I can't seem to get the number of threads. Everything I have read suggests looking at:

Catalina:type=ThreadPool,name=http-8080

And examining the currentThreadsBusy attribute. Unfortunately, I only ever seem to get -1 as a value. I've tried it on five different Tomcat instances and I always get -1.

Is there something I'm missing? Should I be looking at a different value?

EDIT #1

I'm using an Executor, so I checked the activeCount attribute in the Executor and it always returns 0.

tomcat monitoring jmx threadpool
Martin Hope
organicveggie
Asked: 2010-12-06 13:22:33 +0800 CST
  • 14

So we run Groundworks (with Nagios) on CentOS to monitor our various servers and processes. I have it setup to automatically send emails and SMS texts when things reach a WARNING or CRITICAL state. Normally this works perfectly. However, twice we've had problems with Postfix on that server where Postfix decides to stop sending email. The most recent time lasted 4 days because none of us noticed.

That leads me to a important question: how am I supposed to monitor my monitoring server?

email monitoring postfix nagios sms
Martin Hope
organicveggie
Asked: 2010-10-05 19:28:46 +0800 CST
  • 1

I'm trying to sign the Java JDK 1.6u21 64-bit RPM on CentOS 5.5 for use with Spacewalk and I'm running into problems. It seems to sign okay, but then when I check the signature it seems to be missing the key I just used to sign it. Yet RPM shows the key in it's list...

# rpm --addsign jdk-6u21-linux-amd64.rpm 
Enter pass phrase: 
Pass phrase is good.
jdk-6u21-linux-amd64.rpm:
gpg: WARNING: standard input reopened
gpg: WARNING: standard input reopened

# rpm --checksig -v jdk-6u21-linux-amd64.rpm 
    jdk-6u21-linux-amd64.rpm:
    Header V3 DSA signature: NOKEY, key ID ecfd98a5
    MD5 digest: OK (650e0961e20d4a44169b68e8f4a1691b)
    V3 DSA signature: OK, key ID ecfd98a5

Yet I have the key imported (edited for privacy):

# rpm -qa gpg-pubkey* |grep ecfd98a5
gpg-pubkey-ecfd98a5-4caa4a4c
# rpm -qi gpg-pubkey-ecfd98a5-4caa4a4c
Name        : gpg-pubkey                   Relocations: (not relocatable)
Version     : ecfd98a5                          Vendor: (none)
Release     : 4caa4a4c                      Build Date: Mon 04 Oct 2010 10:20:49 PM CDT
Install Date: Mon 04 Oct 2010 10:20:49 PM CDT      Build Host: localhost
Group       : Public Keys                   Source RPM: (none)
Size        : 0                                License: pubkey
Signature   : (none)
Summary     : gpg(FirstName LastName <[email protected]>)
Description :
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: rpm-4.4.2.3 (NSS-3)
...key goes here...
=gKjN-----END PGP PUBLIC KEY BLOCK-----

And I'm definitely running a 64-bit version of CentOS:

# uname -a
Linux spacewalk.mycompany.corp 2.6.18-194.11.4.el5 #1 SMP Tue Sep 21 05:04:09 EDT 2010 x86_64 x86_64 x86_64 GNU/Linux

Without a valid signature, Spacewalk refuses to install the RPM unless I completely disable signature checking. I have tried this with two different keys and two different users on the same machine without any success.

Any bright ideas?

centos rpm gpg public-key digital-signatures
Martin Hope
organicveggie
Asked: 2010-07-02 08:05:23 +0800 CST
  • 2

I want to protect an entire virtual host in Apache, but I still want to allow public access to a single file. The virtual host proxies all requests to a Tomcat server on the back end. What's the best way to do this?

I tried setting up my virtual host definition as follows, but it still requires a password for the file I want to be exposed publicly:

<VirtualHost *>
    ServerName example.com

    <Location / >
      Order Allow,Deny
      Allow from all
      AuthType Basic
      AuthName "Restricted Access"
      AuthUserFile /etc/apache2/secrets.htpasswd
      Require valid-user
    </Location>

    <Location /foo/bar.html>
      Order Allow,Deny
      Allow from all
    </Location>

</VirtualHost>

Any suggestions?

apache-2.2 virtualhost authentication password