Amos's questions

I'm running a server on Ubuntu 18.04 with Tomcat and I saw the following in the access log.

<my.ip> - - [13/Sep/2020:19:33:40 +0000] "POST /path/path HTTP/1.1" 200 53
<my.ip> - - [13/Sep/2020:19:33:41 +0000] "POST /path/path HTTP/1.1" 200 82080
<my.ip> - - [13/Sep/2020:19:33:41 +0000] "POST /path/path HTTP/1.1" 200 21
<my.ip> - - [13/Sep/2020:19:33:41 +0000] "POST /path/path HTTP/1.1" 200 21
<my.ip> - - [13/Sep/2020:19:33:41 +0000] "POST /path/path HTTP/1.1" 200 16
<my.ip> - - [13/Sep/2020:19:33:41 +0000] "POST /path/path HTTP/1.1" 200 18
<my.ip> - - [13/Sep/2020:19:33:41 +0000] "POST /path/path HTTP/1.1" 200 262
<my.ip> - - [13/Sep/2020:19:33:42 +0000] "POST /path/path HTTP/1.1" 200 19
<my.ip> - - [13/Sep/2020:19:33:42 +0000] "POST /path/path HTTP/1.1" 200 19
<my.ip> - - [13/Sep/2020:19:33:42 +0000] "POST /path/path HTTP/1.1" 200 174
<my.ip> - - [13/Sep/2020:19:33:42 +0000] "POST /path/path HTTP/1.1" 200 19
<my.ip> - - [13/Sep/2020:19:33:42 +0000] "POST /path/path HTTP/1.1" 200 140863
<my.ip> - - [13/Sep/2020:19:33:42 +0000] "POST /path/path HTTP/1.1" 200 254
<my.ip> - - [13/Sep/2020:19:33:42 +0000] "POST /path/path HTTP/1.1" 200 162
<my.ip> - - [13/Sep/2020:19:33:42 +0000] "-" 400 -
<my.ip> - - [13/Sep/2020:19:33:42 +0000] "POST /path/path HTTP/1.1" 200 459
<my.ip> - - [13/Sep/2020:19:33:58 +0000] "POST /path/path HTTP/1.1" 200 53
<my.ip> - - [13/Sep/2020:19:33:58 +0000] "POST /path/path HTTP/1.1" 200 21
<my.ip> - - [13/Sep/2020:19:33:58 +0000] "POST /path/path HTTP/1.1" 200 82080
<my.ip> - - [13/Sep/2020:19:33:58 +0000] "POST /path/path HTTP/1.1" 200 21
<my.ip> - - [13/Sep/2020:19:33:58 +0000] "POST /path/path HTTP/1.1" 200 16
<my.ip> - - [13/Sep/2020:19:33:59 +0000] "POST /path/path HTTP/1.1" 200 18
<my.ip> - - [13/Sep/2020:19:33:59 +0000] "POST /path/path HTTP/1.1" 200 262
<my.ip> - - [13/Sep/2020:19:33:59 +0000] "POST /path/path HTTP/1.1" 200 19
<my.ip> - - [13/Sep/2020:19:33:59 +0000] "POST /path/path HTTP/1.1" 200 19
<my.ip> - - [13/Sep/2020:19:33:59 +0000] "POST /path/path HTTP/1.1" 200 162
<my.ip> - - [13/Sep/2020:19:33:59 +0000] "POST /path/path HTTP/1.1" 200 19
<my.ip> - - [13/Sep/2020:19:33:59 +0000] "POST /path/path HTTP/1.1" 200 174
<my.ip> - - [13/Sep/2020:19:33:59 +0000] "POST /path/path HTTP/1.1" 200 459
<my.ip> - - [13/Sep/2020:19:34:00 +0000] "POST /path/path HTTP/1.1" 200 193
<my.ip> - - [13/Sep/2020:19:34:00 +0000] "POST /path/path HTTP/1.1" 200 254
<my.ip> - - [13/Sep/2020:19:34:00 +0000] "POST /path/path HTTP/1.1" 200 140863

As you can see, before and after the 400 response, everything is ok, it looks as if from time to time, for no apparent reason, it responses with 400 and the client receives it as "network error". There is no certain scenario for this to happen but it does happen several times a day (grep) to different IPs/users. Are there any other logs I can search, to find more info about this? Thanks

I have a VPS with ubuntu 18.04.4 with 2gb and 512mb swap. Working regularly with 600-800mb and 100mb swap and all is well.

2 weeks ago I updated the WAR (tomcat) and the memory jumped to 1.2gb and 400-500mb swap. At first I thought it's normal because I did change something that should consume more memory.

I needed to restart the server (for another reason). Only then I realized that the memory got down again to 600-800mb and 300mb swap and it was like that for some time. Meaning previously, something hogged the memory and it was released with the restart.

After 2 weeks with the same consumption, I updated the WAR and again I noticed that after the re-deployment, the memory jumped to 1.2gb with 400mb swap. This time I only restarted the tomcat service and the memory consumption got down to 600mb and 100mb swap.

htop shows that Java is the one that consumes the memory but how can I know what is it exactly that is hogging the memory after undeploy/deploy that only a service restart releases it?

Thanks

I'm about to install a new ubuntu server after having this virus https://askubuntu.com/questions/1115770/crond64-tsm-virus-in-ubuntu .

When installing the new VPS I'm going to install clamav and follow these protection tips: https://www.eurovps.com/blog/20-ways-to-secure-linux-vps/

Is it enough or are there any other tips in general or specifically to this virus that I should apply to the new VPS?

Thanks

I'm using a rest service to fetch data. Twice in the past several months, I received the following error: javax.net.ssl.SSLHandshakeException: No subject alternative DNS name matching example.com found.

I've read several posts that says it's something to do with LDAPS but LDAPS has nothing to do with the server/service I'm using. The problem seems to happen for several seconds and disappears on its own.

I don't have access to that server and the support told me that they did nothing nor changed anything from their side.

Not sure if it's related, I updated my lets encrypt certificate few days ago and the problem happened for several seconds a day and a half after I restarted my tomcat/java with the new certificate.

Any idea what to look for? Thanks

I have a VPS with ubuntu.

1.I don't need postfix so I shut it down. Today I saw it is up again. how can I stop it completely? does a sudo service postfix stop enough? What about dovecot? Do I need it or can I stop it as well?

2.I have 40+ users in usermin. I only use root but maybe other processes use other users? How can I know which user I can remove? Or if it's not me who created it, I can delete it?

3.auth.log and mail.log were too big so I deleted them and they were not recreated. I created auth.log and sudo chown syslog:adm /var/log/auth.log but it is still empty. What should I do so those files will be created with logs?

Thanks

I read the following in the docs for Java appengine:

standard: Most cost-effective for applications that have significant periods where they are not serving traffic.

flexible: No free tier. Application always has a minimum number of running instances. Most cost-effective for applications that serve traffic continuously.

What does "serve traffic continuously" means? I'm asking because my WAR will not serve traffic continuously but it will need to "stay up" all the time because of caching.

Also, for flexible, I saw the following pricing:

vCPU per core hour $0.0526

Memory per GB hour $0.0071

Persistent disk per GB per month $0.0400

Does the above means I should multiply each with *24*31 (month of uptime) in order to understand how much I'm going to pay?

For example:

2CPU = 0.0526 * 2 (cpus) * 24 (hours) * 31 (days in a month) = $78

2GB = 0.0071 * 2 (gb) * 24 (hours) * 31 (days in a month) = $10

1GB(disk) = 0.04 * 1 (month) = $0.04

A general question: Does Google cloud also serves a VPS-like computer where the user (me) can install what he wants? If so, where can I read about it?

I have a VPS and when I send an email, I get a delivery error email with one of the following (the email is not in the spam, it is not being sent at all):

1. all hosts for 'gmail.com' have been failing for a long time (and retry time not reached)
2. host alt4.gmail-smtp-in.l.google.com [74.125.193.26] retry timeout exceeded

All other domains receive my emails with no problem. mail-tester grade is 10/10. MXToolbox is ok except for

Reverse DNS is not a valid Hostname: Your Reverse DNS Record (PTR) is not a valid host name. According to email sending best practices, a PTR Record should be a valid host name. If the PTR Record is not a valid hostname, there is a likelihood that you will experience email delivery issues with anti-spam services.

Is Google (and only Google) so sensitive about this issue that it can fail solely because of this issue? Can it be that Gmail is blocking my IP?

What frustrates most is that I have no indication about any problem, just a notification saying that the email was not delivered and that it will keep trying... Until it fails completely.

I have no problem receiving emails from Gmail. My mail is not marked as spam. The only issue is with Gmail, other providers work well.