HUB's questions

The following SNMP trigger configuration

{Template_SNMPv2_GENERAL:15minload.nodata(180)}=1

produces an alert each time the load average for 15 minutes on a RHEL machine running snmpd is 0.00 (value from uptime command, CPU is really idle).

It seems that zero value is interpreted as missing data.

What's the way to make Zabbix accept 0.00 load as normal data?

UPD Zabbix server version is "Zabbix 2.0.4" I'm not sure where it was installed from but I'm almost sure it's the one from zabbix.com public download area.

How can I get server-group status (started|stopped) via jboss-cli.sh?

Is there a way to return from Chef recipe without rising an exception?

Say I have a long recipe. I want to add a ruby block to it's beginning which will check some condition (for example directory presence) and stop processing this recipe (but continue to execute the rest of run_list) without raising an exception if condition succeeds.

Conditional execution (only_if/not_if) doesn't solve the problem because I have to add the condition to every resource call in the recipe while there may be very many of them.

There is a comment in Opscode's wiki where the commenter asks about the same but no answer.

One of chef node's attributes is an array of hashes:

"array_of_hashes": [
      {
        "hash_key_1": "value1",
        "hash_key2": "value2",
      },
      {
        "hash_key_2": "value4",
        "hash_key_1": "value3",
      }
    ]

I need to cycle through every array element and generate a configuration file with template parameters defined by values in hashes:

# cat my_config.conf
key1=value1; key2=value2
key1=value3; key2=value4

I can't achieve this result using template resource because it owerwrites the config file (doesn't append it) on every cycle iteration and I get only the last string as a result.

What's the best way to generate such a config file mentioned above?

I'm trying to set up PPTP server with Debian Squeeze.

The problem is nothing is being written in the logs (neither in messages nor in debug nor in daemon.log) though debug and dump options are set. The only line I get after pptpd restart is:

# tail -n 1 /var/log/daemon.log
Dec 21 00:25:09 vpn pptpd[1965]: MGR: Manager process started

The daemon starts, the port is listened and available to connect. But no logs... I've tried to find pptpd-dbg but debian has no such package. Any ideas on what's wrong with my config? pptpd or rsyslog ones. Is there any way to get pptpd debug output on stdout?

pptpd version 1.3.4-3 (set up from stable repository)
rsyslog version 4.6.4-2 (set up from stable repository)

Configurations: pptpd.conf

# egrep -v '^#.*' /etc/pptpd.conf  | egrep -v '^$'
ppp /usr/sbin/pppd
option /etc/ppp/pptpd-options
debug
logwtmp
delegate

pptpd-options

# egrep -v '^#.*' /etc/ppp/pptpd-options  | egrep -v '^$'
name vpn
domain example.com
refuse-pap
refuse-chap
refuse-mschap
require-mschap-v2
require-mppe-128
nomppe-40
nodefaultroute
debug
dump
lock
nobsdcomp 
auth

rsyslog.conf

# egrep -v '^#.*' /etc/rsyslog.conf  | egrep -v '^$'
$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$IncludeConfig /etc/rsyslog.d/*.conf
auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
daemon.*                        -/var/log/daemon.log
kern.*                          -/var/log/kern.log
lpr.*                           -/var/log/lpr.log
mail.*                          -/var/log/mail.log
user.*                          -/var/log/user.log
mail.info                       -/var/log/mail.info
mail.warn                       -/var/log/mail.warn
mail.err                        /var/log/mail.err
news.crit                       /var/log/news/news.crit
news.err                        /var/log/news/news.err
news.notice                     -/var/log/news/news.notice
*.=debug;\
        auth,authpriv.none;\
        news.none;mail.none     -/var/log/debug
*.=info;*.=notice;*.=warn;\
        auth,authpriv.none;\
        cron,daemon.none;\
        mail,news.none          -/var/log/messages
*.emerg                         *
daemon.*;mail.*;\
        news.err;\
        *.=debug;*.=info;\
        *.=notice;*.=warn       |/dev/xconsole

I'm setting up an FTP server with TLS/SSL encryption (FTPS, not SFTP). The server would be placed in DMZ. This means that it has tho interfaces: one for connections from the company's network and the other (statically NATed to Internet-valid ip address on a border router) for connections from the Internet.

A small ASCII-art to illustrate the setup:

                  |<----------------------------- DMZ --------------------->|

Inet  <---------> |    border router       |  <-------> FTPS server <------->  Internal network
        1.2.3.4   | 1.2.3.4 <NAT> 10.0.1.1 |     10.0.1.1         10.0.2.2

Active mode works well. But for the passive mode, FTP server has to send its IP address to the client. First problem is that the server doesn't know its external address (1.2.3.4), only DMZ-external (10.0.1.1). FTP server software allows to set this address (ForceIpAddress in pure-ftpd), but in this case users from internal network will be unable to work with this FTP (because it will send them 1.2.3.4 instead of 10.0.2.2)

So, the question is if there is a method to choose the IP to send according to client IP address or the interface, the request came to? Note that if a client connects from the Internet, he should get Internet-valid IP address (1.2.3.4) insted of server's internal (10.0.1.1). I'm using pure-ftpd but can change to anything else.

I used two FTP servers on different ports and redirected the request using iptables, but this is not the best way, I think. Some FTP clients (ex. WinSCP) also allow to force the server's address, but not all of them.

Any options to solve the situation?

I'm trying to set up a two-node squid proxy cluster. It would be a normal proxy (neither reverse, nor transparent).

I'm using LVS (kernel 2.6.32, ipvsadm v.1.2.1, tunneling) for load balancing, ldirectord (v. 1.0.3) for HA, squid (v.3.1.7) as a proxy server.

The cluster works OK for most sites, but experiences problems with (for instance) login to google accounts, login to serverfault.com via OpenID, etc. It seems that problems appear at sites with some kind of redirect, though on other sites 301-coded redirects work fine. When I work directly through each proxy node, everything is OK. I tried different types of job scheduling algorithms in LVS, but it didn't help. Leaving only one node in the cluster also doesn't solve the problem. Squid's access.log and cache.log are also "clean", no errors appear, just a normal acivity.

Did anybody met such problems? Does anybody have a working cluster of this type (balanced with IPVS)? Any ideas on troubleshooting?

Here are some parts of config files: ldirectord.cf:

# Virtual Server for HTTP_PROXY
virtual=10.128.0.109:8080
        fallback=127.0.0.1:80
        real=10.128.1.43:8080 ipip 30
        real=10.128.0.106:8080 ipip 40
        service=http_proxy
        request="http://www.google.com/index.html"
        receive="Google Search"
        scheduler=wlc
        #persistent=600
        protocol=tcp
        checktype=negotiate

squid.conf:

http_port 10.128.0.106:8080 # "real" IP of the node
http_port 10.128.0.109:8080 # "Virtual" IP of the cluster on tunl0 interface
http_port 127.0.0.1:8080
cache_mem 300 MB
cache_dir ufs /opt/squid/var/cache 500 16 256
cache_effective_user squid
cache_effective_group squid
visible_hostname AQUA-node
cachemgr_passwd SquidCM all
access_log /opt/squid/var/logs/access.log
logfile_rotate 5

# ICQ connect (experimental)
acl ICQ_ADDR dst 64.12.0.0/16 205.188.0.0/16
acl ICQ_PORT port 5190 443
acl CONNECT method CONNECT
acl ICQ_PROTO proto HTTPS
acl ICQ_DOMAIN dstdomain .icq.com .aol.com .aim.com
always_direct   allow   ICQ_DOMAIN ICQ_PORT CONNECT
always_direct   allow   ICQ_ADDR   ICQ_PORT CONNECT

acl allnet_temp src 10.0.0.0/8
http_access allow allnet_temp

http_access deny all

If any other information needed, just let me know.