Greg Hendershott's questions

Let's say we have an SSL certificate for a site. According to a web browser, the certificate expires tomorrow, Dec 10 2011.

OK, but that glosses over time zones. When will it expire, exactly?

• 00:00 local time of the server (e.g. ET)
• 00:00 local time of the user browsing the site (wherever)
• 00:00 UTC

?

(Context of question: An admin who likes to wait until the last day before expiration, to set up the new cert. Why? To "get the most value out of it", he says. I don't follow that logic, exactly, and probably he should just replace it a few days earlier? But anyway I'm concerned/curous whether the cert may stop working for some/all users, before 00:00 our local time.)

Amazon CloudWatch has a decent console, and an alarm system which uses Amazon SNS for notifications.

Originally it only gave you AWS metrics, e.g. EC2 instance CPU utilization.

Recently they added custom metrics. You can use the CloudWatch REST API to push your own arbitrary metrics.

I'm wondering if anyone has tried to use an agent that would poll various servers (some at EC2, some not) via SNMP and/or WMI, and push those samples as custom metrics to CloudWatch? So now in CloudWatch you can see all your metrics (both AWS and not) together in one place.

Note: I understand that some monitoring tools can pull from EC2, which is another way to get everything in one place, and might be superior to some people for a variety of reasons. But I'm asking about the way where CloudWatch is the one place.

If anyone is doing this, what are you using as the agent?

We have SSRS (SQL Server Report Service) running on an Amazon EC2 instance.

It had been named report.foo.com using an A record. Recently we changed it to a CNAME referencing the EC2 public DNS name. (Why: This way, report.foo.com resolves to the EC2 public IP address outside EC2, but to the private IP address inside EC2. As you want, for security groups and data transfer charges.)

All is working well, except certain Microsoft web clients started to behave differently.

Example: Deploying a report from Visual Studio to https://report.foo.com/reportserver.

• Before: It would simply deploy.
• After: There is a login prompt asking for a username and password for https://report.foo.com/reportserver. If I supply valid credentials, it does work. But I'm puzzled why it's prompting at all, vs. before?

A similar example is links in Excel spreadsheets -- there's a prompt now that didn't exist before.

When using MS SQL mirroring, changed rows on the principal are pushed to the mirror.

What I imagine/guess is that the data itself is pushed over, but not indexes. (I imagine this because I think of indexes as a secondary entity that exists to improve performance, not the data per se.)

And so for example after reorganizing or rebuilding the indexes on the principal, I imagine this would not be pushed to the mirror. Good news is, it doesn't cause a surge in mirror traffic. Bad news is, the indexes must also be reorgged or rebuilt on the mirror (if desired).

Is this correct -- are indexes part of what is pushed to the mirror, or not?

We have some databases with index fragmentation that is > 95%. As best I can tell the indexes have never been rebuilt much less reorganized. In years.

(In fairness, these tables do seem to have auto-updated statistics enabled. Also in fairness, he is diligent about backups: full daily and trx logs hourly.)

When I asked, the DBA said he was reluctant to rebuild or reorg the indexes. When I asked why, he couldn't really articulate it. Eventually he said he was concerned about potential data loss. For instance one of the databases is used by our Great Plains Dynamics accounting application, and he seemed very anxious about that.

I am not a DBA but from what I've read, his anxiety seems ... difficult for me to understand.

I am not sure what do to next. Suggestions how I should proceed?

I have the sendmail daemon disabled (by setting DAEMON=no in /etc/sysconfig/sendmail). It is not listening on port 25.

Instead I'm using a custom SMTP server.

• Before: It listened on port 25. It accepted mail from outside and local mail, both (as I want). But bad to run as root.
• After: I just changed it to listen to port 25252, and used iptables to redirect traffic from 25 to 25252.

This works fine for other machines connecting to port 25; it's redirected to 25252.

However mail sent locally (e.g. cron, monit) is still trying to connect on port 25 and there is nothing there anymore.

To get local mail routed to my replacement SMTP server, it seems like the two choices are:

1. Change local mail sends to connect to port 25252.
2. Make iptables work on local traffic and redirect that from 25 to 25252, too.

I'd prefer 2 (if possible) because it's extending the same approach I'm already using (and sendmail mc files make my head spin). But either way, 1 or 2, I'd be grateful to anyone who can help me learn how to do this. Thank you.