jsjw's questions

Looking for some validation of my thought process here. I don't have the stats to hand to back up my claims, but have enough experience with web hosting with and without EFS to be comfortbale in making it.

A Joomla or WordPress PHP site being served entirely from EFS (e.g. the document root is in EFS) - making use of Apache and PHP-FPM will be slower than one that is served from EBS. This is because of the inherent latency of EFS for per-file operations. My understanding was that with Opcache enabled, all PHP scripts are compiled into Opcodes and stored in memory. if validate_timestamps is set to =0 then once a file is read from the file storage and compiled into Opcodes it is not then subsequently read.

What I don't understand is that even with the above set, requests to a page will still be slower on EFS. Even if the code base is held in memory.

Is my understanding incorrect and what else could be causing this latency?

On an AWS EC2 T3.large instance I'm hosting a website built with the Cake PHP framework. It utilises the MariaDB version 10.2.35. I'm having an issue whereby the memory for the server is spiking.

When MariaDB starts, it uses a small portion of memory - perhaps a few hundred MB of the total available (~ 8GB). However, I can't seem to find any specific web request that is causing the database memory to spike. Then out of seemingly nothing, the memory usage will spike by a couple of GB until the kernel eventually comes along and kills the MariaDB. This is a little infuriating as there doesn't seem to be an obvious cause for this memory usage. Perhaps someone could assist me in diagnosing this further and looking for what the cause may be.

This is all running within AWX which is hosted on-prem. I'm trying to manage some EC2 instances within AWS. I've setup the bastion jump and can get all my other plays to work correctly.

However there is one simple job template I want to provide to a few devs. Essentially when they make a change to the code, it enables opcache to be cleared and invalidates the specific files in CloudFront.

I want the CloudFront API Call (cloudfront_invalidations module) to run off AWX locally and then if this is successful, notify the two web servers instances to restart their PHP and Apache process.

---
- name: Restart httpd and php-fpm
  remote_user: ec2-user
  hosts: all
  become: true

  tasks:
    - name: Invalidate paths in CloudFront
      cloudfront_invalidation:
        distribution_id: "{{ distribution_id }}"
        aws_access_key: "{{ aws_access_key }}"
        aws_secret_key: "{{ aws_secret_key }}"
        target_paths: "{{ cloudfront_invalidations.split('\n') }}"
      delegate_to: 127.0.0.1
      notify:
        - Restart service httpd
        - Restart service php-fpm
  
  handlers:
    - name: Restart service httpd
      service:
        name: httpd
        state: restarted

    - name: Restart service php-fpm
      service:
        name: php-fpm
        state: restarted

However when running the play it seems to ignore the 'delegate_to' action and instead runs the invalidation twice, for each host. I'm unsure if it's actually running locally. I've tried adding the run_once flag, but this only then restarted httpd + PHP on one host.

Any ideas?

I'm trying to get a list of all of the datastores across multiple ESXi hosts (they all sit in different vCenters so I'm having to use a loop with a dictionary to get the correct vCenter for the ESXi host otherwise the hosts do not appear)

My problem is trying to comprehend the output. I've read the docs and I can't seem to figure a clear way to get the output I want. Consider the following from the docs as a working example - on one ESXi host.

- name: Gather vmware host facts from vCenter
  vmware_host_facts:
    hostname: "{{ vcenter_server }}"
    username: "{{ vcenter_user }}"
    password: "{{ vcenter_pass }}"
    esxi_hostname: "{{ esxi_hostname }}"
  register: host_facts
  delegate_to: localhost
- debug:
    var: host_facts['ansible_facts']['ansible_datastore']

In my example, I add a loop to this to get the correct combination:

- name: Gather vmware host facts from vCenter
  vmware_host_facts:
    hostname: "{{ item.vcs }}"
    username: "{{ vcenter_user }}"
    password: "{{ vcenter_pass }}"
    esxi_hostname: "{{ item.host }}"
  register: host_facts
  delegate_to: localhost
  loop:
     - { host: 'mtboskt1bl07.oam.eeint.co.uk', vcs: 'vmtvcsakt01.oam.eeint.co.uk' }
     - { host: 'mtaoskt1bl10.oam.eeint.co.uk', vcs: 'vmtvcsakt01.oam.eeint.co.uk' }

The var 'host_facts' is a dictionary containing three entries: msg, changed and result.

If I access result - it is a list of dictionaries but I cannot seem to access any entries.

I've looked at the 'subelement' documentation but can't see how I'd apply it here. Anyone able to assist me further?

So I've been in the process of setting up a PDNS Recursive and Authoritative server for an internal network. The recursive server runs on port 53 and the authoritative runs on 5300. Requests are forwarded using the below:

forward-zones=example.com=127.0.0.1:5300, 30.168.192.in addr.arpa=127.0.0.1:5300  
forward-zones-recurse=.=8.8.8.8 

I have a subdomain specifically for active directory that I have delegated to the AD DNS system

v-dc-1.ad.example.com A 192.168.30.15

When I perform a dig query to anything in the subdomain, the recursor correctly talks to the AD nameserver. However whenever I try to lookup the NS IP, I am returned 'servfail.' I have traced the query, as below:

Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343] v-dc-1.ad.example.com: Wants DNSSEC processing, auth data in query for A
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343] v-dc-1.ad.example.com: Looking for CNAME cache hit of 'v-dc-1.ad.example.com|CNAME'
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343] v-dc-1.ad.example.com: No CNAME cache hit of 'v-dc-1.ad.example.com|CNAME' found
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343] v-dc-1.ad.example.com: No cache hit for 'v-dc-1.ad.example.com|A', trying to find an appropriate NS record
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343] : got TA for '.'
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343] : setting cut state for . to Secure
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343] v-dc-1.ad.example.com: initial validation status for v-dc-1.ad.example.com is Indeterminate
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343] v-dc-1.ad.example.com: Cache consultations done, have 1 NS to contact
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343] v-dc-1.ad.example.com: Domain has hardcoded nameserver
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343] v-dc-1.ad.example.com: Resolved 'example.com' NS (empty) to: 127.0.0.1
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343] v-dc-1.ad.example.com: Trying IP 127.0.0.1:5300, asking 'v-dc-1.ad.example.com|A'
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343] v-dc-1.ad.example.com: Got 3 answers from (empty) (127.0.0.1), rcode=0 (No Error), aa=0, in 2ms
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343] v-dc-1.ad.example.com: accept answer 'ad.example.com|NS|v-dc-1.ad.example.com.' from 'example.com' nameservers? ttl=3600, place=2 YES! - This answer was received from a server we forward to.
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343] v-dc-1.ad.example.com: accept answer 'v-dc-1.ad.example.com|A|192.168.30.15' from 'example.com' nameservers? ttl=3600, place=3 YES! - This answer was received from a server we forward to.
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343] v-dc-1.ad.example.com: OPT answer '.' from 'example.com' nameservers
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343] : got initial zone status Indeterminate for record ad.example.com
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343] : got initial zone status Indeterminate for record v-dc-1.ad.example.com
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343] v-dc-1.ad.example.com: determining status after receiving this packet
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343] v-dc-1.ad.example.com: got NS record 'ad.example.com' -> 'v-dc-1.ad.example.com.'
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343] v-dc-1.ad.example.com: status=did not resolve, got 1 NS, looping to them
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343] v-dc-1.ad.example.com.: Nameservers: v-dc-1.ad.example.com.(0.00ms)
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343] v-dc-1.ad.example.com: Using NS to resolve itself, but only using what we have in cache (1/1)
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343] v-dc-1.ad.example.com: Trying to resolve NS 'v-dc-1.ad.example.com' (1/1)
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343]    v-dc-1.ad.example.com: Wants DNSSEC processing, NO auth data in query for A
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343]    v-dc-1.ad.example.com: Recursion not requested for 'v-dc-1.ad.example.com|A', peeking at auth/forward zones
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343]    v-dc-1.ad.example.com: forwarding query to hardcoded nameserver '127.0.0.1:5300' for zone 'example.com'
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343] v-dc-1.ad.example.com: Failed to get IP for NS v-dc-1.ad.example.com, trying next if avaicomle
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343] v-dc-1.ad.example.com: Failed to resolve via any of the 1 offered NS at level 'ad.example.com'
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343] v-dc-1.ad.example.com: Ageing nameservers for level 'ad.example.com', next query might succeed
Jan 20 16:42:23 v-dns-1 pdns_recursor[1174]: [343] v-dc-1.ad.example.com: failed (res=-1)

Can anyone point me in the right direction with this?