Ror's questions

I'm switching from Grafana 8 with legacy alerting to Grafana 10.3 with the new unified alerting system. I'd like the email notifications to have buttons to access the dashboard and panel linked to the alert, just like the old alerting system. I know this is possible since I managed to do it on accident when testing notification templates a few months ago. However, due to multiple changes in the configuration since then, I can't remember what the configuration was and the buttons completely disappeared from my email notifications. Looking at the grafana documentation and old versions of the configuration did not help either. I'm trying to get the following in my email notifications :

Here's my notification template :

{{- define "email.message_alert" -}}
  {{ .Labels.alertname }} has value of {{ .Values.B }}
{{- end -}}

{{ define "email.message" }}
  There are {{ len .Alerts.Firing }} firing alert(s), and {{ len .Alerts.Resolved }} resolved alert(s)

  {{ if .Alerts.Firing -}}
    Firing alerts:
    {{- range .Alerts.Firing }}
      - {{ template "email.message_alert" . }}
    {{- end }}
  {{- end }}

  {{ if .Alerts.Resolved -}}
    Resolved alerts:
    {{- range .Alerts.Resolved }}
    - {{ template "email.message_alert" . }}
    {{- end }}
  {{- end }}

{{ end }}

I have a directory that looks like so :

/path/to/files/data-file.1
/path/to/files/data-file.2
/path/to/files/data-file.3
/path/to/files/data-file.4
/path/to/files/data-file.5
/path/to/files/data-file.6

I'd like to make a script to list all the files between two values in variables like the following :

#!/bin/bash
fileA="/path/to/files/data-file.2"
fileB="/path/to/files/data-file.5"
ls -v /path/to/files/*-file.[0-9]* | sed -n '/$fileA/,/$fileB/p'

with the output :

/path/to/files/data-file.2
/path/to/files/data-file.3
/path/to/files/data-file.4
/path/to/files/data-file.5

However, the sed command does not seem to work. I'm guessing because of the slashes in the variables. Is there a way to overcome this without changing the variables ? I'd like to use this bit of code in a script where fileA and fileB are dynamic.

I've been trying to install monit with an ansible playbook. I'm changing the monitrc file and when the playbook restarts monit, I get :

Jun  8 08:00:30 myserver monit[1857462]: Starting daemon monitor: monit
Jun  8 08:00:30 myserver monit[1857465]: /etc/monit/monitrc:10: invalid mail format '#015'
Jun  8 08:00:30 myserver monit[1857465]: /etc/monit/monitrc:11: syntax error 'subject: $HOST -- $EVENT $SERVICE#015'
Jun  8 08:00:30 myserver monit[1857466]:  failed!
Jun  8 08:00:30 myserver systemd[1]: monit.service: Control process exited, code=exited, status=1/FAILURE
Jun  8 08:00:30 myserver systemd[1]: monit.service: Failed with result 'exit-code'.
Jun  8 08:00:30 myserver systemd[1]: Failed to start LSB: service and resource monitoring daemon.

The conflicting lines in monitrc :

set mail-format {
  from: Monit <[email protected]>
  subject: $HOST -- $EVENT $SERVICE
  message: $EVENT Service $SERVICE
                Date: $DATE
                Action: $ACTION
                Host: $HOST
}

Here are the different tests I did :

• Installing monit from playbook ( Installing from apt then copy the monitrc file to its location) : Does not work
• Installing monit manually (installing from apt then copy-pasting the configuration to monitrc) : Works
• Copy-pasting monitrc after the ansible install : Does not work

Monit version is 5.27.2 in both cases and the machine is Debian 11.

I have a Debian 9 Server with multiple virtual interfaces (eth0:0->4). I need to send messages to a set of different urls and i'd like to use a random interface as the source IP for each message, ideally in a round robin way.

What would be the best practice to do this ?

We recently got a "too many open files" error in our production Wildfly 17 on debian 9. A simple restart of the wildfly service got rid of the error but I'd like to avoid the problem to come back. I'd like to increase the limit but I'm not sure what I should change and how can i know the configuration as been taken into account.

I checked the ulimit for the loginless wildfly user :

    sudo su - wildfly -c 'ulimit -a' -s '/bin/bash'

core file size          (blocks, -c) 0
data seg size           (kbytes, -d) unlimited
scheduling priority             (-e) 0
file size               (blocks, -f) unlimited
pending signals                 (-i) 117724
max locked memory       (kbytes, -l) 64
max memory size         (kbytes, -m) unlimited
open files                      (-n) 1024
pipe size            (512 bytes, -p) 8
POSIX message queues     (bytes, -q) 819200
real-time priority              (-r) 0
stack size              (kbytes, -s) 8192
cpu time               (seconds, -t) unlimited
max user processes              (-u) 117724
virtual memory          (kbytes, -v) unlimited
file locks                      (-x) unlimited

The limit seems to be set at 1024 for the user. However I can check the number of open files by my wildfly processes and I have this :

sudo ls -l /proc/PID/fd |wc -l
1296

Which is bigger than the limit and I'm not getting any error right now. Is there a way to set the limit higher permanently ? Maybe in the wildfly configuration files ? I'm a bit lost.

I need to set up multi-source replication (3 masters and 1 slave). Since all masters have users with the same name but not the same rights, I'd like to avoid replicating users' changes on the slave because it breaks replication.

I've followed this : MySQL Replication failing on `mysql`.`user` changes but it didn't seem to work.

I've tried different configurations but none works.

• Ignore table mysql on the slave :

replicate_ignore_db=mysql

• Ignore table mysql for each connection on the slave:

master1.replicate_ignore_db=mysql
master2.replicate_ignore_db=mysql
master3.replicate_ignore_db=mysql

• Ignore the mysql table in the master's binlog :

binlog-ignore-db=mysql

I'm working with Mariadb 10.6 on Debian 9. The master's binlog format is ROW.

I'm still getting errors in the replication regarding users changes. How can I make the replication ignore the users' changes ?

I'm setting up multi-source replication with Mariadb 10.6 servers. I have 2 mariadb servers with databases that have the same name "database". I want those two servers to replicate their DB on a single slave server so master1's database is replicated in database1 and master2's database is replicated in database2.

Here's the masters configurations :

# Replication
log-bin
server_id=1 # 2 for master2
log-basename=master1 # master2 for master2
binlog-format=mixed
gtid_domain_id=1 # 2 for master2

Here's the slave configuration :

#Replication

log-bin
server_id=3
master1.replicate_rewrite_db="database->database1"
master2.replicate_rewrite_db="database->database2"

I backup master1 by doing a mysqldump :

sudo mysqldump --master-data=2 -u root -p database > master1_test.sql

and import it on the slave.

I use these commands on the mariadb cli to start replication :

stop slave 'master1';
reset slave 'master1';
CHANGE MASTER 'master1' TO MASTER_HOST='XXXX', MASTER_USER='replication', MASTER_PASSWORD='XXXXXXX', MASTER_PORT=3306, MASTER_LOG_FILE='master1-bin.000001', MASTER_LOG_POS=710, MASTER_CONNECT_RETRY=10, MASTER_USE_GTID = slave_pos;
SET GLOBAL gtid_slave_pos = "1-1-2"
start slave 'master1';

MASTER_LOG_FILE, MASTER_LOG_POS and gtid_slave_pos are taken from the dump file.

everything works fine. I tried to add a new table in master1, the creation of the new table is replicated.

However, when I tried to put some data in the new table the following commands tells me :

show slave 'master1' status \G;
Last_SQL_Error: Error 'Table 'database.test' doesn't exist' on query. Default database: 'database1'. Query: 'INSERT INTO `database`.`test` (`test`) VALUES ('1242')'

It should replace database by database1.

I want to set up replication on my existing Mariadb 10.6 servers. I backup the databases automatically everyday with a custom script. Basically, it runs the following command :

mariabackup --defaults-file=${defaults_file} --extra-lsndir=${todays_dir}" --backup --compress --stream=xbstream --parallel=8 --compress-threads=8 --target-dir=${todays_dir} > "${todays_dir}/${backup_type}-${now}.xbstream" 2> "${log_file}"

I've added --binlog-info to this command so that I can get the name of the binlog file, the position and the GTID in the xtrabackup_binlog_info file and therefore use my daily backup to set up replication.

However I can't find xtrabackup_binlog_info after the backup is done. Where should it be ?

I've recently upgraded my MariaDB servers from 10.1 to 10.6 and now when I restart services for example wildfly, I get this message :

sudo service wildfly restart
Failed to get properties: Unit name [email protected] is missing the instance name.
Failed to get properties: Unit name [email protected] is missing the instance name.

How can I get rid of this ?

Monit's documentation states the following for the restart action :

RESTART restarts the service and send an alert. Restart is performed by calling the service's registered restart method or by first calling the stop method followed by the start method if restart is not set.

I'm monitoring some processes and I recently found out that the stop method is not called even though the restart method is not set. Here's the configuration :

check process myProcess matching "myProcess"
    start program = "/etc/init.d/myProcess start"
    stop program = "/etc/init.d/myProcess stop"
    if not exist then restart

It crashed yesterday and the log said :

[CET Nov  9 12:30:36] error    : 'myProcess' process is not running
[CET Nov  9 12:30:36] info     : 'myProcess' trying to restart
[CET Nov  9 12:30:36] info     : 'myProcess' start: '/etc/init.d/myProcess start'
[CET Nov  9 12:30:36] debug    : Starting myProcess ...
myProcess is already running ... //The output of the init.d script. The process does not start since the PID file was not deleted by the stop method
[CET Nov  9 12:31:06] error    : 'myProcess' failed to start (exit status 0) -- '/etc/init.d/myProcess start': Starting myProcess ...
myProcess is already running ...

Monit calls the start method which fails since the init.d script looks for the PID file that wasn't deleted since the process crashed. However, according to the documentation, Monit should first call the stop method (which in my case would delete de PID file) and then call the start method.

Is there a way to have this behavior in Monit or should I modify all my init.d scripts ?

I'm trying to set up response policy on my existing Bind9 server because I'd like to override some of my company public domain to redirect them to our private network ips.

I've followed this tutorial : https://www.linuxbabe.com/ubuntu/set-up-response-policy-zone-rpz-in-bind-resolver-on-debian-ubuntu

However, I'm getting this error for the two domains I'm trying to override :

named[17104]: /etc/bind/zones/db.rpz:17: ignoring out-of-zone data (xxx.mydomain1.com)
named[17104]: /etc/bind/zones/db.rpz:19: ignoring out-of-zone data (yyy.mydomain2.com)
named[17104]: (re)loading policy zone 'rpz' changed from 0 to 2 qname, 0 to 0 nsdname, 0 to 0 IP, 0 to 0 NSIP, 0 to 0 CLIENTIP entries
named[17104]: zone rpz/IN: loaded serial 14

here's my configuration : named.conf.local :

zone "rpz" {
    type master;
    file "/etc/bind/zones/db.rpz";
    allow-transfer { IP_DNS2; };
};

named.conf.options :

options {
        ...OPTIONS...
        response-policy {
                zone "rpz";
        };
}

/etc/bind/zones/db.rpz :

;
; BIND data file for local loopback interface
;
$TTL    604800
@       IN      SOA     localhost.rpz. root.rpz. (
                              14         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;

@       IN      NS      localhost.rpz.

localhost.rpz.  A       127.0.0.1

xxx.mydomain.com.    A       PRIVATE_IP

yyy.mydomain2.com.      A       PRIVATE_IP

We use phpldapadmin with Openldap on Debian 9. We use Let's Encrypt certificates on Openldap. Since the expiration of the IdentTrust DST Root CA X3, we experienced a shutdown of our LDAP System. We managed to make it work by updating the certificates and truststores but it seems that phpldapadmin does not work since then. When I try to connect to my admin user, I get :

Error: Could not start TLS. Please check your LDAP server configuration.
Unable to connect to LDAP server myldapdomain.com
Error: Can't contact LDAP server (-1) for user
Failed to Authenticate to server
Invalid Username or Password.

I used to have this configuration for TLS in the config.php file :

$servers->setValue('server','host','myldapdomain.com');
$servers->setValue('server','tls',true);

After searching a bit on the web, I changed the configuration to :

$servers->setValue('server','host','ldaps://myldapdomain.com');
#$servers->setValue('server','tls',true);

Which made it work somehow ? I'm not sure why the old configuration is not working anymore. Is the new configuration secure ? I suppose so since we use ldaps://

ps : I checked with ldapsearch and openssl s_client and the certificate is ok on the LDAP server, I can connect.

I have a grafana server (6.3.5) and I'd like to add the Flowcharting plugin. I've followed the installation instructions in the official documentation and did as follow :

sudo grafana-cli plugins install agenty-flowcharting-panel

installing agenty-flowcharting-panel @ 0.9.1
from: https://grafana.com/api/plugins/agenty-flowcharting-panel/versions/0.9.1/download
into: /var/lib/grafana/plugins

✔ Installed agenty-flowcharting-panel successfully


Restart grafana after installing plugins . <service grafana-server restart>

sudo service grafana-server restart

I can see the plugin installed in the plugins list but when I create a new dashboard and add a flowchart panel, I can't configure it. In the visualization tab there's nothing and the panel appears invisible except for a little arrow to change the size.

I don't see any error in the grafana log.

The absence of configuration in the visualization tab :

The invisible panel :

I have multiple public cloud instances at OVH. Each one as a public interface and one or multiple private interfaces. All intances are on Debian 9. Since the naming is done automatically and I don't want to change the IP configuration every time the servers reboot, I used to set the private interfaces names persistently in

/etc/udev/rules.d/70-persistent-net.rules

like so

SUBSYSTEM=="net", ACTION=="add", ATTR{address}=="MAC ADDRESS", NAME="interface_name"

But on my most recent installations, I noticed that this configuration does not work anymore (On reboot the servers get the automatic naming like ens4 or eth1). Is there any alternative so that I can persistently name the interfaces ?

Let's say I have a 3 nodes Galera cluster with MariaDB composed of servers A, B and C. Server A and server B can't communicate between each other but both servers can communicate with Server C. How would the cluster react to this situation ?

From what I tested, it seems that when the connection is lost between A and B, the cluster is still working. I could not however restart the cluster. Is there any documentation on this particular case ? I can't seem to find any.

I have set up an OpenVPN Server on a Debian9 device so that my company can reach our server infrastructure from the outside. I'd like them to use hostnames to reach the servers so I've set up Bind9 as an internal DNS. I've modified OpenVPN's server.conf so that the DNS and Domain are pushed to client :

push "dhcp-option DNS X.X.X.X"
push "dhcp-option DOMAIN mydomain.com"

I have no problems pinging hostnames and FQDN on a Linux client, however, on Windows, I can only ping the FQDN. If I do a ipconfig /all on the Windows client, I can see that the DNS suffix mydomain.com is affected to the right NIC. Running a nslookup shows me that the DNS in use is my computer's default and not the one provided by the OpenVPN server so my guess is that my computer only searches the hostname on the default DNS.

I'm setting an OpenVPN server (Debian9) with LDAP authentication for our company's cloud infrastructure. It works great but now I'd like to restrict access for specific users to some servers. I've defined some LDAP groups and I was wondering if there was any way to restrict access based on these groups. I first thought of assigning a specific IP range to each group and restricting access via IPtables but I think ccd is only user specific.

Do I have to assign an IP to each user or can I specify an IP range to an entire group ?

My company has a public cloud at OVH. Each server is a Debian 9 instance. I've configured the servers to be on the same private network and I would like to configure a internal DNS so that the servers query each other with their names. Basically each server has a public interface with the OVH DNS configured and a private interface where I have configured the internal DNS. I've configured the internal DNS server with Bind9 and the hosts private interface to query that DNS. /etc/resolv.conf is actually configured with both the public and private DNS and searches for my private domain. The problem is that when I try to query my private DNS (with nslookup for instance), only the public one answers.

EDIT

I can reach my private DNS using

dig -b X.X.X.X mydomain.com

with X.X.X.X the IP address of my private interface. I guess the problem comes from my host configuration. It seems that nslookup stops its searches at the first DNS in /etc/resolv.conf even though it does not find the private domain.

EDIT 2

As stated by Lasse Michael Mølgaard in the comments, manually setting the private DNS in the first line of resolv.conf solved the problem. However, that file is automatically modified by the resolvconf program and I need to find a way to make the changes persistent

I'm setting up montinoring on my company infrastructure. I installed Grafana with the Prometheus Datasource. I built my dashboards and have rather "Spiky" graphs. I was wondering if there was any way to smooth it up a bit so it would be more readable.

Thanks !

I have some servers at OVH. OVH provides a service called Vrack to connect your servers to a VLAN. I have created 5 VLANs and i'd like those VLANs to communicate. Since OVH does not provide routers to do so, I decided to use Debian servers connected to each one of my VLANs so that they can act as routers. I've set up 2 of them so that I can have redundancy. When one of the routers is down, the other one ensures that the communication is still working. Here's basically what the infrastructure looks like from the hosts on the VLANs :

 Primary Router ------------ "Switch" ---------------- Backup Router  
                                |  
                                |  
                                |  
                              Host

The problem here is that I have 2 possible gateways on the same network and I'm not sure how to do this. I tried to set up static routes on hosts with metrics but when a router is down, it is not detected by the host.

------------- EDIT -----------------

As mention by eKKiM, using VRRP is exactly what I needed to achieve redundancy. I used Keepalived on both my routers. When the primary one is down, the backup one takes over the routing. I've set a virtual IP to use as gateway on the hosts. It works like a charm.