Matt Simmons's questions

I'm using puppet to (theoretically) get npcd to start upon installation, however on Ubuntu, that service comes installed with the default setting in /etc/default/npcd of RUN="no":

 $ cat /etc/default/npcd 
 # Default settings for the NPCD init script.

 # Should NPCD be started? ("yes" to enable)
 RUN="no"

 # Additional options that are passed to the daemon.
 DAEMON_OPTS="-d -f /etc/pnp4nagios/npcd.cfg"

I would think that this block of puppet config would take care of things:

    service { "npcd":
       enable   => true,
       ensure   => "running",
       require  => Package["pnp4nagios"],
    }   

But alas, it doesn't, and short of actually rewriting the file in /etc/default, I'm not sure what to do. Is there a straightforward way to enable the service that I'm not seeing?

For the record, I'm using Ubuntu 12.04.2 and puppet version 3.1.0.

I have a sneaking suspicion that this may be a bug, but I'm definitely willing to entertain the possibility that I'm doing things wrong.

I have a VMware virtual machine in $vm, and I'm trying to assign a boot CD for it. $vm is powered off.

The documented method seems pretty straightforward:

Set-CDDrive -CD (Get-CDDrive -vm $vm) -IsoPath "[datastorename] \whatever.iso" -StartConnected 1

Now, when I start the VM, it immediately tries to PXEboot. I turn off the machine, and in the vSphere client, I edit the VM's properties, go to "CD/DVD drive 1", and verify, "Device Status" has a checkmark next to "Connect at power on".

Here's the crazy thing. When I uncheck that box, then check it again, then start the VM, it boots from the ISO.

I've done it again and again, with the console open, with it closed, and every time, I can set the StartConnected flag on the CLI, and the GUI reflects the setting, but only after I mark the checkbox manually does it actually boot from the ISO.

Is there a step that I'm neglecting to perform in PowerCLI to get this setting to "take"?

I love the smell of new machines in the morning.

I'm automating a machine creation workflow that involves several separate systems across my infrastructure, some of which involve 15 year old perl scripts on Solaris hosts, PXE Booting Linux systems, and Powershell on Windows Server 2008.

I can script each of the individual parts, and integrating the Linux and Unix automation is fairly straightforward, but I'm at a loss as to how to reliably tie together the Powershell scripts to the rest of the processes.

I would prefer if the process began on a Linux host, since I imagine that it will end up as a web application living on an Apache server, but if it needs to begin on Windows, I am hesitantly okay with that.

I would ideally like something along the lines of psexec for Linux to run against Windows, but the answer in that direction appears to by Cygwin, and as much as I appreciate all of the hard work that they put in, it has never felt right, if you know what I mean. It's great for a desktop and gives a lot of functionality, but I feel like Windows servers should be treated like Windows servers and not bastardized Unix machines (which, incidentally, is my argument against OSX servers, too, and they're actually Unix). Anyway, I don't want to go with Cygwin unless that's the last and only option.

So I guess what I'm asking is if there is a way to execute jobs on Windows machines from Linux. Without Cygwin. I'm open to ideas and suggestions, including "Look idiot, everyone uses Cygwin, so suck it up and deal with it". Thanks in advance!

I'm attempting to set up Cacti to monitor a router's interfaces, and I'm having trouble getting the graph templates to show the information that I'd like.

Our interface configuration looks like this:

 interface GigabitEthernet3/6
  description WalljackNumber # Server info 
  no ip address
  no shutdown
  switchport
  switchport access vlan 116
  switchport mode access
  ip dhcp snooping trust
  spanning-tree portfast

The "Server Info" string is really just the machine name, and a short relevant description, such as "PolarSprings vmnic2". The important part appears to be that it follows the hashmark.

When I run snmpwalk, I get the proper output:

 IF-MIB::ifAlias.230 = STRING: WalljackNumber # Server info

But in Cacti, when I go into the graph templates and set the title to this:

 |host_description| - Traffic - |query_ifName| (|query_ifAlias|)

All that shows up in the graph is:

switchname - Traffic - Gi3/6 (WalljackNumber #) 

Which strikes me as a little weird. What I suppose MAY be happening is that somewhere in the cacti stream, it's interpreting # as being a comment and stripping everything after, but I'm not sure.

I was hoping someone could tell me that this was a known documented behavior, or that I could change it in a setting that I wasn't aware of. The alternative answer is to change the delimiter from # to something else, but I've got over a thousand lit switchports on an old college infrastructure, and I'm not sure what else might be relying on them.

I, like many people, have a relatively out-of-the-box Apache installation with a lot of default "LoadModule" lines.

Since the beginning, I've installed a lot of software, and to be honest, I don't know what software is is using which modules.

I would like to reduce the memory footprint of my Apache instances, and to do that, I'd like to remove modules from being used. The only way that I know of to determine if a module is in use is to remove it from the configuration and see if anything breaks. This is bad in more ways than I have time to describe.

I would like to know if anyone is aware of a way to get Apache to report which modules have been used, or if there's another way to programmatically determine whether a module is safe to un-configure.

I'm trying very hard to get away from a set of Kemp Loadmasters that I bought years ago to provide HA access to our website. Part of that process is going to be putting the key and certificate in the new solution (HAproxy with nginx doing SSL). Unfortunately, I've come up against a problem...

The Kemp has built-in certificate management, and it generates CSR's at the touch of a button. It also supported importing of signed certificates, however it does not, so far as I can tell, allow any kind of export of the key itself.

There is a "backup key and certificates" ability, however here's the text from the manual:

LoadMaster supports exporting of ALL certificate information.  
This includes private key, host and intermediate certificates.  
The export file is designed to be used for import into another 
LoadMaster and is encrypted.  Export and import can be completed 
using the WUI at Certificates -> Backup/Restore Certs.  Please 
make sure to note the pass phrase used to create the export, it 
will be required to complete the import. 

You can selectively resort only Virtual Service certificates 
including private keys, intermediate certificates or both.

Well, that is great, but as for actually DEALING with the certs, I'm apparently out of luck.

Of course, I'm not going to give up that easily. I ran "file" on the saved cert bundle and got this:

$ file client1.certs.backup 
 client1.certs.backup: gzip compressed data, from Unix

Well, awesome, I thought. Maybe it's just a .tar.gz, so I unzipped it, and that went fine, but my attempts to untar it didn't work, and running "file" on it now just gives this:

$ file client1.certs.backup 
client1.certs.backup: data

So that's where I'm stuck. Anyone have experience with these?

I've got a hosted exchange solution through Apptix, which isn't the problem, I think, but it may be relevant.

I have my main account, [email protected], and to that, I have an alias, [email protected].

Whenever I send an email to [email protected], I examine the headers, and I see the "To:" field being correct, "To: [email protected]". All is well.

I recently set up another user, [email protected] to function as a multipurpose mailbox. I aliased "[email protected]" to the services account in the same method that I did "[email protected]", however nothing I have sent to "[email protected]" actually goes TO "[email protected]". All of the headers say "To: [email protected]". This makes it extremely difficult to filter based on headers alone.

Does anyone have any feedback on what settings I would need to look at in order to fix that?

I'm building VMs in my lab and I want to replicate the situation that my fileservers will be encountering in production. Here's a brief overview of what I want to do.

I have multiple ESXi 4 servers. They are accessing a SAN, and each virtual machine will exist in its own LUN on the array. I also have LUNs which house data that needs accessed by the VMs.

My goal is to have a VM (lets call it fs, for fileserver) started on VMhostA. I want fs to be able to access a data LUN in raw mode, meaning that if fs goes away, I want to be able to mount it as ext3 (or whatever) from a physical (non-virtual) machine. This means that the data on the LUN must not be housed in a vmdk file. In addition, I want to be able to use VMotion to move that VM to VMhostB (and obviously, maintain access to the data LUN)

It is my understanding that I need to present the LUN as a Raw Disk Mapping (RDM)? From what I have read, the RDM file created can be stored with the fs virtual machine or on another datastore. Would it be correct to assume that it should be stored with fs?

Also, there exists two types of RDM, it seems. There are physical and virtual modes. I have encountered conflicting documentation from various sources, so I'm not sure what to think. Does it matter which I select in this case? What are the differences, as they apply to my situation?

Thanks very much for reading all the way through ;-)

I'm planning to virtualize some Linux hosts that I've got, and I'm going to be putting ESXi on the physical machines. Currently, I've got two switches set up for redundancy, and I've got bonding setup in mode 1 (active/backup).

Here's the simple logical layout:

Essentially, any switch, NIC, or firewall can die and everything still maintains connectivity.

I would very much like to continue this when I move to ESXi, but I haven't seen any evidence that it's possible (in fact, Duncan Epping from Yellowbricks indicates that it might not be possible, if I'm understanding the question and answers correctly).

Since I am relatively new to this whole "bare-metal virtualization" thing, I figured I'd ask people who knew more than me.

Can you set up your NICs in ESXi to be highly available? And if so, how?

From the title, this sounds a whole lot like a repeat of this question, but it isn't, I promise. Because he wanted to know whether you could tell from looking at a cable whether it was Cat-5 or Cat-5e, based on a few pictures and some really shoddy termination.

My question is a lot more theoretical.

What, if any, is the actual, real, honest-to-God, difference between Cat-5 and Cat-5e? I've read the wikipedia entry, and while informative, it could really do with a rewrite. One of the few sections that mentions Cat-5e is The Cat 5e 350mhz debacle. The title makes me believe that maybe the 350mhz denotation is how you can tell, but then it goes and says this:

"Although the performance of this new 350 MHz cable was slightly better it was an easy way to sell the consumer on future proofing their needs while charging around 15% more and leading to a higher margin on the 350 MHz cable than the standard 5e cable.

Well, alright then, what IS a standard 5e cable?

I looked at some more resources, and found some sadly incorrect suggestions and no real answers. For instance, this wiki answers post says that you need Cat-5e to get Gb/s speeds, that 5e is rated at 350mhz, and that there's less crosstalk (though it doesn't say why). Of course, it also says "Unless every single component in the network is gigabit rated, then you will never have a gigabit network, because your network will always run at the speed of your slowest device.", so you can understand my skepticism.

The second table on this page sounds pretty solid, basically displaying that there are standards for Cat5E that don't exist for Cat5, with the assumption that the cable meeting those standards will perform better/faster than a cable without those particular requirements.

But of course, I wanted to ask, because you can't trust everything you read on the internet. Case in point? connectworld.net, who either desperately need to update their page, or desperately need to stop taking drugs:

"The Simple Answer: CAT-5 is rated to 100M CAT-5e is rated to 350M CAT-6 and CAT6e is rated to 550M or 1000M depending on your source CAT-7 is supposedly rated to 700M or presumably 1000M

Today there is no approved CAT-6 or CAT-7. While some folks are selling products they call Level 6 or 7, there aren't even specs for them, making CAT-5e the best available option.

Sad, really. I blame the schools.

So now I ask you. I assume that there is an actual, real difference between Cat-5 and Cat-5e. what is it?

Edit

Hrm. The plot thickens.

It appears that Cat-5 cable is defined by the TIA/EIA-568-A standard. The only time I've ever paid attention to that standard was when crimping my own ends, because TIA/EIA-568-A specifies the order of the wires in the RJ45 (really 8P8C) end. It also uses the green pair first, which I thought was weird, since I learned orange first.

However, when I go to the TIA/EIA-568-A wiki page, I'm redirected to the TIA/EIA-568-B page. At a table way down at the bottom are the lines:

Cat 5: Currently unrecognized by TIA/EIA. Defined up to 100 MHz, and was frequently used on 100 Mbit/s Ethernet networks. May be unsuitable for 1000BASE-T gigabit ethernet.

Cat 5e: Currently defined in TIA/EIA-568-B. Defined up to 100 MHz, and is frequently used for both 100 Mbit/s and 1000BASE-T Gigabit Ethernet networks.

Fascinating!

I still don't know what the actual difference is, aside from orange going first in Cat-5e, apparently, but hey, more light on the subject, I guess.

Edit 2

It appears that Able Cables hired someone to research and write a paper on the difference between TIA/EIA-568A and TIA/EIA-568B. Here is his conclusion:

9.0 Conclusion

Historically 568B was the specification on choice due to its early development and implemented base, but as the market and the political climate has changed over the years 568A has become the more dominate and preferred specification. This is only due to a desire by world standards organizations to provide a specification as backwardly compatible as possible. All new installations should be carried out using the 568A standard and cables only to be terminated to 568B specification on existing 568B systems.

I'm not entirely sure what to think of that.

I have an old, old, old EMC AX100 RAID array. It's not being used for anything important, but I would like to use it for testing and lab work.

One of the problems is that the OS itself is stored across the first few drives, and they're original model 250GB SATA drives. I have no shortage of these around to replace in the event that something fails, but I'd much prefer to migrate to newer disks.

Despite many claims to the contrary, non-EMC branded disks do work (although with the caveats that data loss will probably ensue if I lose chassis power because of drive caching, performance hits, yadda yadda, like I said, nothing remotely important).

I've managed to get up to 500GB drives to be recognized by FLARE, but I've added those to the otherwise-empty spaces, not the ones used by the OS.

Is there a way that I can migrate, through a process of swapping out the original disks with new ones, from the original 250GB drives to more modern models? Anyone have any experience doing anything this foolish?

Alright, so I want to start leveraging my SAN a little more than I have been, and at the same time, take advantage of ESXi.

Currently, I've got an array of Dell PowerEdge 1955 blades connected to a single-enclosure EMC AX4-5 FC storage array. I'm essentially using the SAN as DAS. I've got LUNs on the SAN that are pointing at specific physical machines, and those machines utilize the LUNs for whatever (mostly databases and Samba/NFS shares, depending on the target server).

I've got multiple physical file servers, and each one has a samba config setup to serve the appropriate shares. Since I never got RHCS to work, only one of the file servers has the LUNs mounted at a time. In the event that a fileserver dies, I fence it manually (either by unmounting and unpresenting the drive, using the navisphere utility, or by killing the power via DRAC) then use the navisphere utility to bring up the presented LUNs on the next contender (after which, start apache and the other daemons). All by hand, right now.

I feel sort off like Ferris Bueller playing the clarinet. Never had a lesson!

Anyway, I'm trying to improve. What I want to do is install ESXi on the physical hosts, then create LUNs to hold two fileserver images (in case one gets corrupt/fubar), one of which will be the active, the other will be the standby. At least this way, I don't improve the automation (although I'll get around to writing a script to switch the "active" server at some point soon), but I feel like I'm adding flexibility, plus I can use the ESXi hosts to hold other VMs, and the hardware won't be wasted, like it is now.

My questions are:

1) How stupid is my plan?

2) When it comes to the actual implementation, should I create a normal vmdk image on the LUN, or should I give it a "raw" partition (if that's even possible with ESXi?)

3) Is there a "good" way to use non-clustered fileservers?

I've just authenticated my first Apple machine onto the active directory infrastructure. Yay!

The only thing I'm having problems with is specifying that the AD user is an administrator, and able to make changes. I don't see any interface for that.

Is there an interface in the system by default, or do I have to download the Server Admin Tools?

I've been working on getting my snort machine up and running, and working through Snort IDS and IPS Toolkit.

The authors suggest using Oinkmaster, but on that website, the last update was February of 2008. That seems sort of...odd. Maybe there haven't been any issues with oinkmaster in the past year and a half, but it made me wonder if there was another solution that I don't know about.

If you use snort, do you automatically update your rules, and if so, how?

I've got a Windows 2003 Active Directory infrastructure, and there are times (such as when terminating an employee) that I want instantaneous propagation across both of my AD servers. Currently, I make the change in both places, which I suspect is unhealthy, but it's the only way I know to make sure that the account is disabled to every machine.

Is there a better way? Do I have to wait for the normal propagation time for convergence, or is there a way to "force" it?

I'm working on converting my users from local machine based profiles to network profiles stored on a centralized fileserver.

The majority of my users are "local", in that they work in the office 75% of the time. I think I will get some resistance from them, but I can minimize the pain using the folder redirection technique.

The real problem is going to be my salespeople, who are in the office 25% of the time, and who really need access to their files. But of course, they really want their files backed up. And of course, they're the most likely to require a loaner machine. Really, I think salespeople might be my problem in general, but that's an entirely different issue.

Anyway, here's the deal. Since my salespeople roam away from the network, they frequently log in using cached credentials, then gain access to network resources via an SSL VPN connection. This seems problematic if I switch them to network-based profiles. They won't have access to many of the profile contents until they connect to the VPN, but they'll probably need something on their network shares (i.e. the contents of their start menu, or desktop?) to do it.

It seems like a catch-22. I know that the profiles attempt to sync at user logoff. If the user is away from the network at logoff, does everything remained cached? When they come back in to the office, will things magically resync and cause a 20 minute login?

What do you do keep your truly roaming users tied into the domain?

IANADBA, but I'm writing a script that will take action as long as the oracle standby database hasn't been activated. What I'm looking for is two queries (or sets of queries, if necessary).

1 - Is the database mounted (as in, has someone done "alter database mount standby database")

2 - How can I tell if the database is activated (as in, "alter database activate standby database")?

As I mentioned, I'm looking for queries, but if there's a way to tell in the system, I'm open to that, too. Thanks!

Update

I took the suggestion below (modified, slightly, because I'm dealing with Oracle 8i, and I get this:

 SQL>  SELECT INSTANCE_NAME, DATABASE_STATUS, INSTANCE_ROLE from v$instance; 

 INSTANCE_NAME    DATABASE_STATUS   INSTANCE_ROLE
 ---------------- ----------------- ------------------
 RGR01            ACTIVE            PRIMARY_INSTANCE

Right now, this instance is actively recovering archive logs, but is not "live". I'm still looking for a way to tell if it isn't mounted as a standby database.

I want to start providing managed Windows XP images to my users, however I've only done this with Linux servers, and I'm unsure of where to begin.

Ideally, I want to start buying machines in groups, but until then, I'm stuck with differing models.

The particulars: I will always have local physical access to the machine. I don't need PXE boot, since I'll be working with 3-4 machines at a time, maximum, but PXE boot would be alright, too. Not all of the machines are the same model. I'm alright with creating multiple images if I have to, though an auto-install ala-kickstart would be great. Free OpenSource Software (FOSS) would be ideal, although if a commercial product (like Ghost or whatever) is the only way (or has useful features that I need that free softwares lack), then I can accept that, too.

What is the best way to do this?

Also, I don't have bulk licenses (yet). Each machine has its own XP license. I'm sure this complicates things, but I don't really know how. I apologize profusely for my ignorance.

It seems like there's a lot of disagreement in mindsets when it comes to installing rackmount servers. There have been threads discussing cable arms and other rackmount accessories, but I'm curious:

Do you leave an empty rack unit between your servers when you install them? Why or why not? Do you have any empirical evidence to support your ideas? Is anyone aware of a study which proves conclusively whether one is better or not?

I'm the IT admin for a company with a small number of users (15-20). We currently run an astonishing array laptops, each bought sometime in the previous four years. Because of this, no two are alike, and support is a nightmare.

I want to switch from the process we have in place now to a lease based plan, where my users are upgraded in "flights", so to speak. The benefits will be tremendous. I'll be able to roll out a standard image instead of wondering who has what version of what software, issues will be much easier to debug, and I can conduct thorough tests before rollout.

My problem is that I've never done leases nor planned rollouts like this. What advice would you give to someone who is just doing this for the first time?

Edit

Since machine lifetime plays a part in this, but is a completely valid question on its own, I have asked that question here: What is your end user machine lifetime?