Linker3000's questions

I am looking to use Drew Kerrigan's JSON Nagios plugin on GitHub (drewkerrigan/nagios-http-json) to monitor the output from a REST API, but I am struggling to get the query syntax right.

Here is a sample of the JSON that's returned when I hit the Web API:

{"Checks":[
{"description":"can read interconnect 0910", 
"result":"passed"},
{"description":"can read interconnect 1011", 
"result":"passed"},
{"description":"can read linknode 1112", 
"result":"passed"},
{"description":"can read linknode 1213", 
"result":"passed"},
{"description":"can read dbnode 1314", 
"result":"passed"},
{"description":"can read dbnode 1415", 
"result":"passed"},
{"description":"can read dbnode 1516", 
"result":"passed"},
{"description":"can read dbnode 1617", 
"result":"passed"},
{"description":"can read dbnode 1718", 
"result":"passed"},
{"description":"can read main table", 
"result":"passed"},
{"description":"can read secondary table", 
"result":"passed"},
{"description":"can read postcode table", 
"result":"passed"},
{"description":"can read/write to docs folder", 
"result":"passed"},
{"description":"can read/write to config folder", 
"result":"passed"},
{"description":"la integration enabled", 
"result":"passed"},
{"description":"webservice password", 
"result":"passed"},
{"description":"can authenticate in largedb", 
"result":"passed"},
{"description":"can import locales", 
"result":"passed"}
]}

Drew's plugin has an equality test switch:

-q [KEY_VALUE_LIST [KEY_VALUE_LIST ...]], --key_equals [KEY_VALUE_LIST [KEY_VALUE_LIST ...]]
                        Checks equality of these keys and values
                        (key[>alias],value key2,value2) to determine status.
                        Multiple key values can be delimited with colon
                        (key,value1:value2). Return warning if equality check
                        fails

and Drew gives examples of how to structure a query for various key/value syntaxes, but I cannot seem to get it right and I am getting python errors which I expect are down to my query syntax not reflecting the JSON structure.

Can anyone help me with an example for checking whether, say, "can read main table" is "passed".

I have a linux server that has logged the following mcelog error:

Hardware event. This is not a software error.
MCE 0
CPU 0 BANK 20
MISC 800000
TIME 1476167381 Tue Oct 11 06:29:41 2016
MCG status:
MCi status:
Corrected error
MCi_MISC register valid
MCA: BUS error: 0 0 Level-3 Generic Generic Other-transaction
Request-did-not-timeout
QPI:
Intel QPI physical layer detected a QPI in-band reset but aborted
initialization
STATUS 8800004000200e0f MCGSTATUS 0
MCGCAP 7000c16 APICID 0 SOCKETID 0
CPUID Vendor Intel Family 6 Model 63

I can find reference to this error in Intel system programming docs, and monitoring code on github, but nothing explaining the cause, effect and suggested actions. I have read through the latest microcode update notes to see if it's mentioned but can't find anything.

The error might be a 'cosmic radiation-type' one-off or a 'non-event' to ignore, but can anyone elaborate with some real world System Admin-level guidance?

Thanks

I'm involved in the setup of a demo/user lab environment comprising several racks of server kit. The idea is that potential hardware/software customers can be given a VPN account that will allow them into specific kit only. The main challenge is that the users can do whatever they want with the servers in terms of OS (Windows, Linux, ESXi, Xen...), so I believe isolating them to a specific VLAN, with their kit on the matching switch ports, is a possible solution.

I envisage using a bastion server to manage the VPN accounts and was looking at ClearOS because its GUI makes setup/access control easier for the lab techs to work with, but I can't see a way of configuring the VLAN control so that, for example, VPN user 1 is on VLAN 10 and VPN user 2 is on VLAN 15..etc

I'm hoping to end up with a GUI-based setup where the work effort extends to setting up a user VPN account, specifying their target VLAN and making sure their target systems are connected to the relevant bank of switch ports. In essence, I'm hoping to avoid the need for regular editing of tons of iptables stuff etc..

From some work I did a few years back, I also have it in my mind that a Mikrotik box with RouterOS might do this kind of thing, but I don't have one to play with right now.

I have asked this question over at the ClearOS forums, but ("crickets") so does anyone here have experience with this type of setup - any guidance or thoughts appreciated.

Thanks.

I have a non-critical CentOS 6.5 server with a rather quirky disk setup:

The main logical volume (mounted as /) comprises two RAID 1 disk pairs, so it's made up from md1 (2TB) and md2 (1.5TB). Recently, one of the drives in md2 failed so, having a spare, I failed it, removed it from the array, replaced it and fired up the server. This caused md2 to turn up as md127, which I corrected by re-assembling the pair as md2, but this resulted in the logical volume deciding it was corrupt and fsck throws up a ton or errors.

I do have a full backup of the data from this server so I can either work out the problem - if quick and simple - or just setup from scratch and restore the data. I get the feeling it would be simpler to start again from scratch (with a more sensible mount structure).

Any thoughts!?

Has anyone tried to setup a dual or triple boot (ESXi 5.5, Linux, Windows Server 2012R2) machine? This is for an app and controller card testing environment - at the moment we're dual-booting Linux/Windows and changing the startup disk through the server's boot menu for ESXi.

I'll give it a go myself if necessary, but if anyone else has tried and knows whether it's possible and/or there's any gotchas that would save some time and be appreciated.

Thanks.

I have recently setup a new Windows 2003 server for a regional office in Germany. The server has been setup as a child domain on our corporate setup and, being in Germany, the domain was called de, so the full name for the child is de.ourcompanyname.lan

This seems to have upset DNS resolution for any public .de domains (eg: www.microsoft.de).

The (DNS) server has forwarders set to an external DNS service (Google at the moment), so I presumed that this would ensure any names not resolved internally would be handled, but apparently not so.

The setup process has created a forward lookup zone called de - not sure if this is part of the problem,

Was the internal naming convention not a good idea, or should it not have been an issue!? Any guidance or hints on diagnosing this would be appreciated.

Edit:

I might have fixed this by replacing the 'de' forward lookup zone with one called 'de.ourcompany.lan' - would that be a correct/expected fix?

I have modified an off-the-shelf Nagios plugin perl script to (in theory) return a one or zero according to the existence, or not, of a file on a remote linux server. The script runs a remote ssh session and logs in as the nagios user. The remote linux servers have private keys setup for that user, and on the bash command line the script works as expected, but when run as a plugin it always returns '1' (true) even if the file does not exist. Some help with the logic or a comment on why things are not working as expected within Nagios would be appreciated. I'd prefer to use this ssh login method rather than having to install nrpe on all the linux servers.

To run from a command line (assuming remote server has a user called nagios with a valid private key):

./check_reboot_required -e ssh -H remote-servers-ip-addr -p 'filename-to-check' -v

Ta.

#! /usr/bin/perl -w
#
#
# License Information:
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
#
############################################################################

use POSIX;
use strict;
use Getopt::Long;
use lib "/usr/lib/nagios/plugins" ;
use vars qw($host $opt_V $opt_h $opt_v $verbose $PROGNAME $pattern $opt_p $mmin $opt_e $opt_t $opt_H $status $state $msg $msg_q $MAILQ $SHELL $device $used $avail $percent $fs $blocks $CMD $RMTOS);
use utils qw(%ERRORS &print_revision &support &usage );

sub print_help ();
sub print_usage ();
sub process_arguments ();

$ENV{'PATH'}='';
$ENV{'BASH_ENV'}=''; 
$ENV{'ENV'}='';
$PROGNAME = "check_reboot_required";

Getopt::Long::Configure('bundling');
$status = process_arguments();

if ($status){
    print "ERROR: processing arguments\n";
    exit $ERRORS{'UNKNOWN'};
}

$SIG{'ALRM'} = sub {
    print ("ERROR: timed out waiting for $CMD on $host\n");
exit $ERRORS{'WARNING'};
};

$host = $opt_H;
$pattern = $opt_p;

print "Pattern >" . $pattern . "< " if $verbose;
alarm($opt_t);

#$CMD = "/usr/bin/find " . $pattern . " -type f 2>/dev/null| /usr/bin/wc -l";
$CMD = "[ -f " . $pattern . " ] && echo 1 || echo 0";

alarm($opt_t);

## get cmd output from remote system

if (! open (OUTPUT, "$SHELL $host $CMD|" ) ) {
    print "ERROR: could not open $CMD on $host\n";
    exit $ERRORS{'UNKNOWN'};
}

my $perfdata = "";
my $state = "3";
my $msg = "Indeterminate result";
# only first line is relevant in this iteration.
while (<OUTPUT>) {
                my $result = chomp($_);
                $msg = $result;
                print "Shell returned >" . $result . "< length is " . length($result)     . " " if $verbose;
                if ( $result == 1 ) {
                  $msg = "Reboot required (NB: Result still not accurate)" . $result ;
                  $state = $ERRORS{'WARNING'};
                  last;
                } elsif ( $result == 0 ) {
                  $msg = "No reboot required (NB: Result still not accurate) " .    $result ;
              $state = $ERRORS{'OK'};
              last;
            }
            else {
              $msg = "Output received, but it was neither a 1 nor a 0" ;
              last;
            }   

}

close (OUTPUT);
print "$msg | $perfdata\n";
exit $state;

#####################################
#### subs


sub process_arguments(){
    GetOptions
        ("V"   => \$opt_V, "version"    => \$opt_V,
         "v"   => \$opt_v, "verbose"    => \$opt_v,
         "h"   => \$opt_h, "help"   => \$opt_h,
         "e=s" => \$opt_e, "shell=s"    => \$opt_e,
             "p=s" => \$opt_p, "pattern=s"  => \$opt_p,
         "t=i" => \$opt_t, "timeout=i"  => \$opt_t,
         "H=s" => \$opt_H, "hostname=s" => \$opt_H
     );

if ($opt_V) {
    print_revision($PROGNAME,'$Revision: 1.0 $ ');
    exit $ERRORS{'OK'};
}

if ($opt_h) {
    print_help();
    exit $ERRORS{'OK'};
}

if (defined $opt_v ){
    $verbose = $opt_v;
}

    if (defined $opt_e ){
    if ( $opt_e eq "ssh" ) {
        if (-x "/usr/local/bin/ssh") {
        $SHELL = "/usr/local/bin/ssh";
        } elsif ( -x "/usr/bin/ssh" ) {
        $SHELL = "/usr/bin/ssh"; 
        } else {
                    print_usage();
                    exit $ERRORS{'UNKNOWN'};
                }

    } elsif ( $opt_e eq "rsh" ) {
        $SHELL = "/usr/bin/rsh";
    } else {
        print_usage();
                exit $ERRORS{'UNKNOWN'};
    }
    } else {
   print_usage();
       exit $ERRORS{'UNKNOWN'};
}

unless (defined $opt_t) {
    $opt_t = $utils::TIMEOUT ;  # default timeout
}

unless (defined $opt_H) {
    print_usage();
    exit $ERRORS{'UNKNOWN'};
}


return $ERRORS{'OK'};
}

sub print_usage () {
    print "Usage: $PROGNAME -e <shell> -H <hostname> -p <directory/file pattern> [-t <timeout>] [-v verbose]\n";
}

sub print_help () {
print_revision($PROGNAME,'$Revision: 0.1 $');
print "\n";
print_usage();
print "\n";
print "   Checks for the presence of a 'reboot-required' file on a remote host via SSH or RSH\n";
print "-e (--shell)     = ssh or rsh (required)\n";
print "-H (--hostname)  = remote server name (required)";
print "-p (--pattern)   = File pattern for find command (default = /var/run/reboot-required)\n";
print "-t (--timeout)   = Plugin timeout in seconds (default = $utils::TIMEOUT)\n";
print "-h (--help)\n";
print "-V (--version)\n";
print "-v (--verbose)   = debugging output\n";
print "\n\n";
support();
}

We have an HP tape autochanger mounted in a rack, but it's so deep that with the external mini-SAS cable plugged in we cannot close the rear rack door - if we did we'd crush the SAS cable well beyond a sensible bend radius! Has anyone come across an external mini SAS cable with a 90 degree plug, or a 90 degree adapter? I've spent a while searching online without success.

I'd like to pipe the output of an ldapsearch to sanitize the dates returned - I presume sed and/or awk can help with this but would appreciate a bit of help.

The fixed length date format in the LDIF output file is like this:

whenCreated: 20111209103130.0Z

Any pointers to get it in this format would be great:

whenCreated: DD-MM-YY hh:mm 

eg (using above example):

whenCreated: 09-12-2011 10:31

I have two systems in a rack that are directly linked together with a 0.25m Cat 5e cable so they can exchange data via NFS. As you may know, plain NFS does not inherently support encryption or user authentication so the data is potentially sniffable/interceptable/accessible to third parties, but since the two systems are locked in a server room inside a locked rack the risk is considered sufficiently mitigated at the moment.

I may have a need for one of the systems to be put in a locked room+cabinet elsewhere on the LAN which means the two units will be linked via the building's data wiring (data point to data point via a patch panel link), but this means the link is no longer contained in a secure environment so I am looking for a pair of devices that will encrypt the link. I cannot use any form of s/w tunnelling or encryption as one of the systems is proprietary (it's not running an off-the-shelf OS) and there's no such app/functionality to install on it - the only link option is via NFS.

I imagine I could create a hardware VPN link using a pair of 'xDSL' routers that support such functionality and have gigabit WAN ports - this would be a cheap option, but the ones that I know have relatively slow VPN functionality (40-50Mbit/s). I have also found some multi-port 'security' devices/switches that will do the job, but the cost is looking very high and the kit is overkill for a single link.

I have considered a pair of gigabit powerline adaptors locked inside the cabinets, but distance and power phasing may mean this doesn't work. Fibre is an option too, but before I go there...

Has anyone come across a simple 'dongle-type' pair of devices - preferably gigabit speed - that can be plugged onto the ends of a cat 5e data link that will transparently encrypt the link traffic? Thanks

I have an HP ML330-G6 server with a single SAS/SATA drive bay unit containing a pair of mirrored 250GB SATA disks, running off a P410 SAS controller - all working fine. Now I have just fitted an Ultrium 1760 SAS tape unit into the server and I can't get both the tape and the disks recognised under VMware.

So far I have tried two SAS configurations:

1. Disk unit on one port of the P410 + tape unit on the other port using its provided cable
2. Disk unit + tape unit on the SAS splitter cable supplied with the tape unit - tried on port 1 and port 2 of the P410 controller

If I use the Array Configuration Utilities for the server it always shows that I have a tape unit + disks attached, but VMware stubbornly only shows the tape unit.

I have tried generic ESXi 4.1 and also the 'HP tweaked' version.

Any relevant words of wisdom appreciated. Thanks.

I have a Linux server running CentOS 5.6 (64-bit) that was running fine using the onboard NIC. For testing an HP PCI-e NIC was installed too but the server wouldn't respond on the network through eth0 or eth1 and the server then threw a debug message that it was disabling INT 50 so I presumed there was some conflict between the two NICs.

Unfortunately, the server will now not communicate through either the onboard NIC (HP card removed) or the HP card with the onboard NIC disabled - in both cases the server confirms it has an eth0 card and ifconfig returns sensible values, but the server's not PINGable and you can't PING anything on the network. If the NIC is set to use DHCP it won't get an address. The patch lead has been tested and also replaced.

I get the feeling that this is still an interrupt-related issue (lspci shows the NIC on INT 50), so when Linux/CentOS disables an interrupt is this written down in a config file somewhere that now needs to be manually edited?

Any thoughts appreciated before I try resetting the BIOS config back to factory defaults and/or begin to suspect that something's been damaged.

I currently have an HP DL360-G7 server with a P411 SAS controller connected to an HP Storageworks D2600 storage array. The server boots VmWare ESXi 4.1 from its own drives (not from drives in the D2600). The storage array holds a number of VmWare datastores.

In the event of a server failure, would the array run 'as is' using a P411 card in a non-HP server, or is HP server hardware/firmware needed to make the system work as a whole? I am looking at the options for business continuity and the possibility of shutting down the array, moving it to another server and just firing it all up again.

I could buy another compatible HP server but we have a few non-HP units in-house that could be used if the setup's going to work so any insight would be appreciated before I arrange to try it out.

I have a shiny, new D2600 storage array with 6 x 2TB disks fitted, together with the licence pack that allows me to configure this all as a RAID 6 array. A few questions for you:

1) The array has two SAS controllers - can these be connected to two separate servers for fault tolerance and dual-access? One server has a P411 array controller and I have a P600 I could fit into a second.

2) As far as I can see, the BIOS-based config utility in the P411 controller will only let me create a single, RAID 6 LUN. Is it possible to setup a RAID 6 array and then divide the available storage into multiple LUNs? Specifically, this is so I can create several 2TB datastores for VMware ESXi.

If this is not possible, what options are worth considering to make all this storage available for ESXi - for example I have read elsewhere about using a separate server (in a VM?) to make the array available via iSCSi or NFS.

3) If I setup the Array on the P411 controller and then connect it later to the P600, will the P600 see it properly and allow correct access? I am thinking of the option to have the P600 card in a 'standby server' that can run the array if the main server croaks.

Any pointers or guidance appreciated.

Thanks

I have been asked to look at an interesting Linux routing issue and thought it worth sharing for comments. Both machines are running SuSE 11.2.

Machine A:

• IP Address 172.16.200.1 eth0
• Manual route added to specify that the route to network 192.168.192.0 is via eth0

Machine B:

• IP Address 192.168.192.100 eth0
• Manual route added to specify that the route to network 172.16.200.0 is via eth0

That's it; no more network configuration on the machines, no aliases on the NICs etc. Both machines are on an unmanaged switch.

The user has pointed out that the machines can only see each other intermittently and if PING stops working it can be 'fixed' by rebooting.

Now I am off to do some digging, but in my book this isn't the way to setup routing, but the customer insists they have done it this way many times before and it has always worked reliably. Sitting in front of these machines I can see them happily PINGing each other.

I am not after a tutorial on setting up routing (I know how I would have done it, and how it can be done with one NIC if you really really want) - my question is:

Has anyone else seen this type of setup used for routing before (ie: just a route add) as my understanding is that there is nothing in the above setup that should actually make routing work between the two networks!!?

My first thought is that luck is playing a big part in making the above configuration work.