Malvineous's questions

I have a few hosts connected to the same switch, which are all on the same subnet (10.0.0.0/16). Two of these hosts have faster network interfaces so I have connected them together, meaning these two machines now have a direct link with each other without going through a switch.

I now need to set up the routing such that when these two machines try to talk to each other, the packets go over this faster direct link in preference to the slower link via the switch.

The easiest way would be to configure the direct link to be on a different subnet, however then I will need to use different IPs or hostnames depending on which interface to use, and as I would like to be able to deploy standard configs to all machines (e.g. NFS mounts using hostnames) and not have to maintain custom IP overrides in /etc/hosts, I feel this solution would be too easy to get a hostname wrong and send traffic over the wrong interface.

What I am looking for is a way to tell the two Linux machines that even though eth0 handles 10.0.0.0/16, when you want to communicate with 10.0.0.5, even though it's in eth0's subnet, send the packets through eth1 instead.

I tried adding a host routing rule with route add -host 10.0.0.5 dev eth1 which does send the packet out on the correct interface, however it comes from the wrong IP address (the direct link's subnet rather than the original subnet.)

I guess the only way to fix this is to set the same IP address on both interfaces, but will this cause any problems? Can a machine correctly have the same IP on multiple NICs without causing problems? I'm assuming I'll need to set routing metrics properly so that the NIC connected to the switch is given priority (to avoid all traffic for the subnet being sent to the other host by mistake), but is there anything else I need to be aware of with this set up? Can it lead to any other issues or difficult-to-resolve problems?

Or is there a better, more robust way to achieve this?

EDIT: Here is the extra into requested by @A.B:

$ ip -br link
lo               UNKNOWN        00:00:00:00:00:00 <LOOPBACK,UP,LOWER_UP> 
eth0             UP             ec:f4:xx:xx:xx:a4 <BROADCAST,MULTICAST,UP,LOWER_UP> 
eth1             UP             ec:f4:xx:xx:xx:a5 <BROADCAST,MULTICAST,UP,LOWER_UP> 

$ ip -br address
lo               UNKNOWN        127.0.0.1/8
eth0             UP             10.0.0.4/16
eth1             UP             10.0.99.4/24

$ ip route
default via 10.0.0.1 dev eth0 proto static 
10.0.0.0/16 dev eth0 proto kernel scope link src 10.0.0.4
10.0.0.5 dev eth1 scope link 
10.0.99.0/24 dev eth1 proto kernel scope link src 10.0.99.4

I set up the direct link (eth1) on a separate subnet and then tried the route command in my original post, and this is where things are now. It looks like perhaps I need to get the src attribute set for my direct route.

I'm replacing some failing disks with new ones, and rather than replace them one by one I have created a new ZFS pool on the new disks, and copied the old pool over to the new one. I did this at the pool level so all the volumes within would be copied.

# zfs snapshot -r oldpool@moving
# zfs send -R oldpool@moving | zfs recv -F -v newpool

This worked, and I now have the @moving snapshot on the new pool:

# zfs list -t snapshots
oldpool@moving
oldpool/vol1@moving
oldpool/vol2@moving
newpool@moving
newpool/vol1@moving
newpool/vol2@moving

Now I can already see all the files in the newpool mount point, and even modify them, even though they are from a snapshot (everything I read said snapshots are read-only and must be cloned to become writable, so I'm not sure whether zfs recv already created clones of the snapshot or what).

So I am wondering how to discard the newpool@moving snapshot and promote this state to be the new pool (i.e. the base state with no snapshots at all).

I tried cloning the snapshot however this just appeared to move the snapshot to a different path:

# zfs clone newpool@moving newpool/clone
# zfs promote newpool/clone
# zfs destroy newpool@moving
could not find any snapshots to destroy; check snapshot names.
# zfs list -t snapshots
oldpool@moving
oldpool/vol1@moving
oldpool/vol2@moving
newpool/clone@moving    # was newpool@moving
newpool/vol1@moving
newpool/vol2@moving

It seems to have renamed the top-level volume and snapshot (but not any of the child volumes within it), and kept it as a snapshot instead of turning it into a "base volume with no snapshot".

Before I make anything worse, what am I missing? How can I make the snapshot on newpool go away by merging everything into the base volumes, so that it reflects the state of oldpool as it was before I took the snapshot in order to replicate it onto newpool?

I have monit configured to mount an NFS filesystem if it is ever not mounted, however for some reason monit won't mount the share automatically and I have to run monit start myshare in order to get the filesystem mounted.

The system often can't mount NFS shares at boot time (as the remote system is typically booting at the same time and isn't up yet) which is why I want monit to keep retrying the mount, which will eventually succeed when the remote system finishes booting.

However it seems that monit just gives up too soon and stops trying, meaning I have to manually run monit start myshare in order to get it to try again. This always succeeds, suggesting the start command in monitrc is correct.

I can see in the monit manual how to limit a service so that it will stop trying after a certain number of failures, but I can't see how to disable this so it just keeps trying forever.

Here is my monitrc:

set daemon 30
set log syslog
set mailserver ...
check filesystem myshare with path /mnt/myshare
        start program = "/bin/mount /mnt/myshare"
        group nfs

And this is what it says after booting the machine:

$ monit status myshare
Filesystem 'myshare'           
  status                       Execution failed
  monitoring status            Monitored
  monitoring mode              active
  on reboot                    start
  filesystem type              nfs

$ monit start myshare
$ monit status myshare
Monit 5.25.1 uptime: 5d 10h 32m

Filesystem 'myshare'
  status                       OK
  monitoring status            Monitored
  monitoring mode              active
  on reboot                    start
  filesystem type              nfs

What am I missing?

Some security updates have just come out and I want to rebuild my Docker images to take advantage of the updates.

However when I run docker build . it completes immediately without updating anything because nothing has changed in the Dockerfile, and everything is cached. It doesn't even try to run the apt-get update line in my Dockerfile.

How can I force Docker to run the apt-get update command again, even though nothing has changed?

There is a --no-cache option that says it won't use the cache during the build, but I want it to use the cache for the commands before apt-get update and I want the results saved into the cache for the next run (replacing the currently cached images), so I definitely want to be using the cache.

I also can't use docker rmi to remove the image generated at the point after apt-get has been run, because it refuses to delete this image as the image has dependent child images.

I'm trying to set an encryption key on an LTO-4 drive under Linux. I successfully did this once, power cycled the drive, and now I cannot get the drive to accept the key again.

The command I am using is this:

$ stenc -f /dev/nst0 -a 1 -e on -k test.key
Provided key length is 256 bits.
Key checksum is 7a43.
Turning on encryption on device '/dev/nst0'...
Sense Code:              Illegal Request (0x05)
 ASC:                    0x26
 ASCQ:                   0x00
 Additional data:        0x00000000000000000000000000000000
Error: Turning encryption on for '/dev/nst0' failed!
Usage: stenc --version | -g <length> -k <file> [-kd <description>] | -f <device> [--detail] [-e <on/mixed/rawread/off> [-k <file>] [-kd <description>] [-a <index>] [--protect | --unprotect] [--ckod] ]
Type 'man stenc' for more information.

The drive is HP so I need to use -a 1 however different values don't change the result. Using /dev/sg1 instead has the same issue.

The tape is LTO-4 so encryption is supported:

$ mt-st -f /dev/nst0 status
SCSI 2 tape drive:
File number=0, block number=0, partition=0.
Tape block size 0 bytes. Density code 0x46 (LTO-4).
Soft error count since last status=0
General status bits on (41010000):
 BOT ONLINE IM_REP_EN

I ran the HP Tape & Library Tools and did an encryption test with this same tape and it passed, so the drive seems to be able to have keys set, just not via the stenc program for some reason.

I found a SCSI manual that said ASC 0x26 is "Invalid field in parameter list" which doesn't really explain much.

Has anyone else seen this error before or have any ideas how to get the drive to accept the key?

As I understand it, LTO tapes write data in "wraps", where the first wrap unspools the tape into the drive, and the second wrap spools it back into the cartridge. This process is repeated a number of times, with the idea being that once the end of the tape has been reached, all the tape will be back in the cartridge and it can be ejected with little rewinding.

However I have noticed that when you get to the end of a tape, the drive sounds like it is about half way through the final wrap, and so the drive spends some time rewinding the tape before ejecting it, even though it has reported that the end of the tape has been reached.

Is this because there is some reserved capacity on the tape, to allow for things like rewriting failed blocks or to skip over bad sections of tape without reducing total capacity? Or is there some other reason for this apparently early finish of the tape?

I have an LTO4 drive that when given even new LTO4 tapes, only writes around 460GiB to the tape even though the tape's uncompressed capacity is supposed to be 800GB.

I have noticed that in one direction the drive writes close to the stated 80MB/sec, however in the reverse direction it only manages close to 40MB/sec.

The drive is a supported HP model and needed a firmware upgrade which I have done, however the problem remains. The drive's self test fails when run through HP Tape Tools, however there are no error messages just warnings on the lines where it shows the amount of data written at each different tape speed.

What could be causing this problem? The tape motors sound like they are running at the same speed in both directions, so I am wondering whether writing at barely 40MB/sec means the drive is encountering errors and having to write the data again, causing the apparent loss of write speed and capacity. Is this possible?

Does anyone else know what would cause similar problems but have the HP Tape Tools drive assessment come back as otherwise OK?

EDIT: I've tried with encryption on (462GB) and off (467GB) and the data I'm writing is not very compressible so the drive's compression doesn't do much.

EDIT2: @Mark I tried with an LTO3 tape and instead of the expected 400GB it only writes 296GiB. Watching the write amounts, it seems to write 9GiB on the forward wrap but only 4.4GiB on the reverse wrap, but the motors run at the same speed. So looks like your theory is right, and the drive is getting a lot of verify-after-write errors and having to rewrite quite a lot of data. It's a bit weird that a reason for this doesn't show up in any of the Tape Tools tests, they all say the head life is excellent and there are no issues, other than there's an issue with the amount of data written (approx 2GB during the test, but I only know from other tests with other drives this figure is normally around 6GB.)

How can I tell BIND to stop forwarding queries to my provider's DNS servers for a specific list of domains, but to forward for everything else?

I'm using BIND as an authorative nameserver for my domain. It also provides DNS resolution for other queries on the host, by forwarding them to my provider's DNS servers:

forward first;
forwarders {
    1.2.3.4;
    5.6.7.8;
};

However I am running SpamAssassin and my queries to various DNS blocklists are being rejected, since they are going through my provider's nameservers (along with many of my fellow customers) and reaching the limit for free queries originating from their IP addresses. Since I only have a small number of queries myself (maybe 5-10 a day) I would like to configure BIND so that it does NOT forward DNSBL queries to my provider's servers, but it DOES forward everything else.

This should allow me to continue to use DNS blocklists to spam check the small amount of e-mail I get, without having to turn off the forwarding/caching entirely.

How can I tell BIND not to forward just a handful of domains, but keep it forwarding everything else?