David Mackintosh's questions

I have four EX4300-48T switches -- two in a VC, and two stand-alone -- both running JunOS 13.2X51-D35.3. I have, because I miraculously found some budget, added to these switches a pair of EX4550-32F switches in a second VC. I installed 13.2X51-D35.3 on this VC so that it will be consistent with my 4300s. (In the long run I'm going to bring the rest of my switches, a fleet of EX2200-48T switches, up to the same firmware.)

Topology wise, I'm using the two stand-alone EX4300s as concentrator switches, with runs from each of them to each edge switch. The 4550 VC is an edge switch in this topology. I'm relying on Spanning Tree to prevent loops from forming.

However, when I go to configure spanning tree, I discover that these switches apparently speak different dialects of this firmware.

On the 4300s, unless I explicitly enable spanning tree on a port as so:

set protocols rstp interface ge-0/0/47

...spanning tree isn't active on that port and it will form a loop (discovered in a lab). However, when I try the same thing on the EX4550:

root@sa3-40# set protocols rstp interface xe-0/0/31
                                                    ^
missing argument.

The EX4550 seems to want me to say:

set protocols rstp interface xe-0/0/31 mode point-to-point

...which it then records in the config as:

set protocols rstp interface xe-0/0/31.0 mode point-to-point

...which kind of implies to me that when you turn on rstp, it is turned on for all ports by default.

I have not plugged this in yet because I don't want to create a 10G loop as that might be somewhat detrimental to my network. However since I'm using spanning-tree to provide redundant paths here (been burned by the VC in the core once already which is why I'm not VC everywhere) I need to get this right.

The only other configuration on the switches with regards to STP is setting the bridge priority (16K on the stand-alone EX4300s, 32K on the EX4550 VC).

Any historically, all I've done with my EX2200 switches (currently all running 12.3 versions of varying vintages) is to say

set protocols rstp

...and rstp is enabled on all ports.

So, to my questions:

1. Is RSTP enabled automatically on my xe ports without me explicitly asking for it (ie the same way that it was in JunOS 12 on my EX2200s)?
2. Should I be explicitly defining the rstp mode as point-to-point on my up/down/crosslinks?
3. Is there, perhaps, something else I'm missing?
4. Is there, perhaps, a better way to do this?
5. Is there a way to get these switches to all speak the same dialect of JunOS?

I have been handed an old Dell and RAID box that needs to be resurrected, however I can't figure out the magical combination of switches and cables needed to get the thing to go properly.

I have:

• a Dell Poweredge 2850
• a PERC 42/DI onboard
• a PERC 4/DC expansion card
• a PowerVault 220S with two Ultra-320 SCSI controllers
• 14 disks
• two SCSI cables.

I don't know if the PowerVault is supposed to be in split-bus mode or not. The locals were playing with it (with everything, actually) before I got here.

The most promising configuration so far has been:

• put the PowerVault into split-bus mode
• connect the 4/DC channel-0 to the controller on the left - the one behind disks 0 - 8
• connect the 4/DC channel-1 to the controller on the right

When I did this, each of the disks identified themselves as being a member of a 13-disk RAID-5 array. I then imported the configuration into the controller. However on reboot it is telling me that SCSI IDs 0, 2, 3, 4, 5, and 8 are not responding (ID 1 is flashing as bad so I presume that's a failed disk).

Is there something obvious I am doing wrong? Is there a way to read the disk configuration so that I can understand what the controller is expecting?

Is there a way to manage a Hyper-V cluster that runs on a Windows Server 2008 R2 Datacenter from a Windows 8.1 Pro workstation?

I've downloaded and installed the Remote Server Admin Tools for 8.1 (http://www.microsoft.com/en-us/download/details.aspx?id=39296), but when I enable the Hyper-V manager, it tells me that I can't manage Hyper-V servers on 2K8 or 2K8R2.

Related, the Failover Cluster Manager barfs with a similar error.

How do I manage my old servers with my new workstation?

I have a Hyper-V cluster on two physical machines. I have a small pile of VMs running on that cluster of varying operating systems. I am trying to collect operating metrics for the VMs so that we can have some visibility into what is happening in there.

The things I am interested in are things like disk IO and CPU usage. Ideally I would be able to monitor things like memory usage and swapping, CPU states (IO-wait verses working) and the like.

Traditionally I have installed SNMP clients on the VMs and monitored each VM as if it was a physical computer. However I have been reading that one shouldn't monitor VMs directly, one should try to do it through the hypervisor host instead.

Is there a better way to collect running metrics from my VMs on this cluster?

I have a desire to pass iSCSI traffic between my Windows 2K8 Server lab system and my NetApp filer across two separate network stacks*.

My configuration is as follows:

• one Win2K8 server with the iSCSI software initiator installed, the MPIO component installed, and two network interfaces: 192.168.201.85/24 and 192.168.202.85/24
• one NetApp filer with a LUN published to the Windows server's IQN, and two interfaces: 192.168.201.200/24 and 192.168.202.200/24
• two separate switches, one for 192.168.201.0/24 and one for 192.168.202.0/24. Both are flat (un-VLAN'd) and are not connected to any other network equipment -- including each other.

I have configured the MPIO component to register the iSCSI software initiator "adapter" class.

Then I have gone into the the iSCSI initiator control panel and added both filer addresses as "targets" and run discovery against them. This shows the single LUN available.

I have then "logged on" to the LUN twice, selecting a different "source" IP address for each connection. Both connections have "re-connect at boot" checked and "MPIO" checked.

When I examine the target, I see two connections to the target, one for each IP address that the NetApp is using.

When I examine my persistent connections, I see two connections, one for each IP address that the NetApp is using.

(I should mention at this point that I have tested both filer IPs by demonstrating a single connection to each IP, mounting and then using a drive across that IP.)

I then go into my Disk Mangler and set up the partition on the LUN, and mark it Online. The disk works as expected.

Now I go into the new disk's properties, and click the MPIO tab. I can see two connections in use for this disk. However I don't know how to associate the connection I see in this tab with the connection I see in the iSCSI initiator screens -- so while I presume there's one connection for each connection in the iSCSI initiator screen, I can't prove it.

In the MPIO tab, I have several options.

I have reduced the timers all down to 1 second each and enabled the Path Verification. So my understanding of these settings mean:

• each second the Windows server will verify that the path is valid ie the remote target IP is answering properly;
• the server will retry only once after a failure is detected, one second after the failure is detected;
• the server will mark as invalid and remove the path one second after a failure.

Regarding redundancy, there are a couple things I have tried:

• If I set up both connections as Active/Active and select Round Robin use, the disk works. If I set up a copy operation on the disk and simulate a network failure by pulling one of the network cables out, the connection stops for ~30 seconds and then keeps going.
• If I set up the connection as a Failover-only by marking one connection as Standby/Passive and selecting Failover-only, again the connection works. (Interestingly, disk-to-disk copies appear to consistently flow at about twice the speed of the Round Robin, but anyways.) If I simulate a failure by pulling the standby cable out, the connection stops for about 1 second and then keeps going. If I simulate a failure by pulling the Active cable out, the connection stops -- and I can't ping the filer across either wire. Eventually the OS tells me the disk has failed. The network stays in this state for several hours (after which time I got tired of waiting on it and rebooted the server).

I did some research and found a Microsoft KB 968287 which talks about failover not completing because of a counter error in the MPIO.sys driver in Win2K8 and Vista, but installing this hotfix has not changed anything that I can see.

All this makes me suspect I'm missing something fundamental. Am I doing this wrong?

The real goal here is to provide a more-reliable iSCSI transport over which to run VMs and mount Exchange stores on my Hyper-V cluster. We do know that Exchange in particular will unmount information stores very quickly if a disk hiccup is detected, so we were hoping that MPIO would permit data to flow even if one path failed.

*= We currently have a single iSCSI switch, but when that started to misbehave we had to take down our entire world in order to flash the firmware on the one switch. Therefore we want two totally isolated network paths -- NICs, switches, and interfaces on the other end -- so that we can take half of them out of service at any given time for maintenance without killing the world.

At one of my customer sites, the local guy shut down their local Solaris 10 x86 server, pulled the power inputs, moved it, and now it won’t start properly. It boots and then presents a prompt which lets you log in. This appears to be single user milestone (or equivalent).

Digging into it, I think that SMF isn’t permitting the system to go multi-user. SMF was generating a ton of errors on autofs, after some fooling with it I got it to generate errors on inetd and nfs/client instead. This all tells me that the problem is in some SMF state file or database that needs to be fixed/deleted/recreated or something, but I don’t know what the actual issue is.

By “generate errors”, I mean that every second I get a message on the console saying “Method or service exit timed out. Killing contract <#>.” This makes interacting with the computer difficult.

Running svcs –xv shows the service as “enabled”, in state “disabled”, reason “Start method is running”. Fooling with svcadm on the service does nothing, except confirm that the service is not in a Maintenance state.

Logs in /lib/svc/log/$SERVICE just tell you that this loop has been happening once per second. Logs in /etc/svc/volatile/$SERVICE confirm that at boot the service is attempted to start, and immediately stopped, no further entries. Note that system-log isn’t starting because system-log depends on autofs so I have no syslog or dmesg.

Googling all these terms ends up telling me how to debug/fix either autofs or nfs/client or inetd or rpc/gss (which was the dependency that SMF was using as an excuse to prevent nfs/client from “starting”, it was claiming that rpc/gss was “undefined” which is incorrect since this all used to work. I re-enabled it with inetadm, but inetd still won’t start properly). But I think that the problem is SMF in general, not the individual services.

Doing a restore_repository to the “manifest_import” does nothing to improve, or even detectibly change, the situation. I didn’t use a boot backup because the last boot(s) were not useful.

I have told the customer that since the valuable data directories are on a separate file system (which fsck’s as clean so it is intact) we could just re-install solaris 10 on the / partition. But that seems like an awfully windows-like solution to inflict on this problem.

So. Any ideas what piece is broken and how I might fix it?

Update 1: I should probably mention that this system has two file systems, / and /export. Both fsck clean and mount properly.

I have two devices here, a Netscreen SSG520 and a Cisco 3750.

#show ver
Cisco IOS Software, C3750 Software (C3750-IPSERVICES-M), Version 12.2(35)SE5, RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2007 by Cisco Systems, Inc.

The Cisco is currently being used as the central router. It has an IP interface defined on VLAN1. The revision of IOS is the one recommended to us by Cisco to cover some other oddities we have uncovered in the switch's behavior.

Right now my Netscreen has only an untagged interface. The Cisco treats this as VLAN1, and it works.

I want to add tagged interfaces to the netscreen (I need to remove the Cisco from routing certain VLANs for reasons I won't go into here). So the first thing I do is define the Cisco interface as trunked:

interface GigabitEthernet1/0/1
 description Netscreen SSG520
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 10,11,102
 switchport mode trunk

Now, when I plug in my netscreen, the Cisco reports all the "trunk allowed" VLAN interfaces are UP. It does not report the interface on VLAN1 as up. And the expected traffic does not flow between the Cisco and the Netscreen. Neither can ping the other.

If I plug the Netscreen into an access port defined as so:

interface GigabitEthernet1/0/11
 description castor

...the Cisco then reports VLAN1 as up, both devices can ping each other, and traffic can flow between the Cisco and the Netscreen properly.

I have even tried defining the VLANs as tagged sub-interfaces on the Netscreen, and while the tagged VLANs work, VLAN1 does not.

I've played with the switchport trunk native vlan 1 command and the no switchport trunk native vlan command and the switch still does not use VLAN1 on that interface.

I already have a no shutdown command in the definition for interface vlan1; the fact that when the netscreen is plugged into the access port the VLAN comes up proves that.

For various reasons (mostly involving history) we can't just not use VLAN1.

I've spent the last two hours trying to get these devices to talk to each other the way I want them.

So.

How do I get the Cisco to recognize, and use, VLAN1 when I have a trunk defined?

I have a CUPS server with two print queues defined. Once this was defined, all the CUPS clients on the same subnet could see the two print queues automatically, no problem.

Now I have a collection of machines on a separate subnet, reachable from the first subnet by a router.

How do I enable CUPS browsing on the second set of machines so that they can see the print queues defined on the first machine?

Let's call the server A.B.C.7. The first subnet is A.B.C.0/24. The second subnet is A.B.D.0/24, and there is a router with arms on both networks.

I am trying to create a NIS group with a member list that exceeds 1024 characters. Now I can't do that because the database that NIS uses restricts the value part of the key/value pair to 1024 characters.

The internet suggests that I should be able to break up the list and have sub-lists as members of the main list, but it doesn't seem to work for me.

Theoretically, I should be able to go:

group:x:999:sublist1,sublist2
sublist1:x:998:a,b,c, [...]
sublist2:x:997:m,n,o, [...]

Then make and deal with nscd caches... if I then check a user account involved:

$ id
[...]
groups=[...],998(sublist2)

Since I want to use the group group, I should be able to go:

$ newgrp group
Sorry.

...but it doesn't work.

What am I doing wrong here?

I have a connection to a network service provider with two VLANs on it.

One VLAN has the internet. The service provider has defined a default router and assigned me a subnet of IPs attached to that router for me to use.

The other VLAN is a connection to two remote sites.

(It is set up this way for historical reasons.)

What I really want to do is use the IPs assigned to me on the second VLAN.

So. Is there any reason why I can't:

• untag a port on the internet VLAN
• untag a port on the remote-site VLAN
• turn spanning tree off on those two ports
• connect them together with a crossover cable

...besides the fact that it just looks wrong?

Second part of the question.

Assuming I have a Dell PowerConnect 6224, is there a way to do this "correctly" within the switch without the wrong-looking cable?

I have a nice set up in my unixland where I have all my host information (names, IPs, mac addresses) in DNS and the associated NIS maps. This makes it easy to write a script which can generate a file containing DHCP lease reservation information, which can then be included by the isc dhcpd.conf for each scope. This means whenever a system is booted, it always gets the same IP whether it is static or not, and can figure out its DNS name trivially. This means for example that when I kickstart nodes, the post-install scripts can do host-specific things based on what name the system finds for itself at install time.

Now I'm being assimilated by a new organization, and their infrastructure runs on Windows. I am about to receive my brand new Windows DC, which will be the site's DNS and DHCP server.

So. Is there a way to put DHCP reservations in the new DHCP server, without having to do it manually?

Update:

So how this works in unix is that for each machine on my subnet, I can (effectively) do this:

$ ypmatch $MACHINE hosts
$ ypmatch $MACHINE ethers

...and generate a file full of entries like this:

host amstel
{
    hardware ethernet 00:04:76:f8:d8:71;
    option host-name "amstel";
    fixed-address 10.16.5.23;
}

...the filename of which is included in my dhcpd.conf as so:

subnet 10.16.0.0 netmask 255.255.240.0
{
...
        # Include automatically-generated reservations
        include "/etc/dhcpd-10.16.0.0-20.conf";    
}

Then whenever I make an update, all I have to do is run the updater script and restart dhcpd.

So. Starting from the ypmatch ... what can I run on unixland that will insert this kind of reservation into a Windows DHCP server?

Let's say I have a incoming connection which is fixed 1Gb/s with tagged packets. And lets say that I need to connect that connection to a device which is a 10/100 device, which deals with the tagged packets.

Can I use a dumb (ie: non-VLAN-aware) 1Gb switch to connect that 1Gb connection and the 10/100 Mb device?

I have a pile of Sun X2200-M2 servers. These servers have ECC memory.

In some of these servers, I am getting warnings in the eLOM about "correctable ECC errors detected", eg:

# ssh regress11 ipmitool sel elist
   1 | 05/20/2010 | 14:20:27 | Memory CPU0 DIMM2 | Correctable ECC | Asserted
   2 | 05/20/2010 | 14:33:47 | Memory CPU0 DIMM2 | Correctable ECC | Asserted

...some more frequently than others.

The kernel on this particular system is throwing EDAC errors as well, although with far more frequency than the eLOM is recording ECC events:

EDAC k8 MC0: general bus error: participating processor(local node response), time-out(no timeout) memory transaction type(generic read), mem or i/o(mem access), cache level(generic)
MC0: CE page 0x42a194, offset 0x60, grain 8, syndrome 0xf654, row 4, channel 1, label "": k8_edac
MC0: CE - no information available: k8_edac Error Overflow set
EDAC k8 MC0: extended error code: ECC chipkill x4 error
EDAC k8 MC0: general bus error: participating processor(local node response), time-out(no timeout) memory transaction type(generic read), mem or i/o(mem access), cache level(generic)
MC0: CE page 0x48cb94, offset 0x10, grain 8, syndrome 0xf654, row 5, channel 1, label "": k8_edac
MC0: CE - no information available: k8_edac Error Overflow set
EDAC k8 MC0: extended error code: ECC chipkill x4 error

Now if the server is detecting Uncorrectable ECC, the system resets, so clearly that's bad and removing/replacing the identified stick or pair corrects the issue.

But I am thinking that if the error is Correctable, then there's no immediate issue -- I can treat this as a warning and be prepared to pull the stick/pair if an uncorrectable error starts occurring?

I've noticed this several times: a switch starts to behave oddly. Usually if the switch doesn't fail outright, what tends to get noticed is that DHCP doesn't work.

We had a Linksys SRW-224P fail today. Systems which were still connected worked properly, until it came time to renew their DHCP lease. Once the lease expired, they stopped working, but up until then we couldn't detect a failure. This includes PoE VoIP phones -- they work fine until their lease is up, at which point they're done.

I've noticed this on the above-mentioned Linksys, three varieties of 3Com, and possibly half a dozen dumb switches.

What is it about DHCP that makes it sensitive to failing switches?

I have a APC Smart-UPS 3000 with a management card (I believe it is an AP9617).

So last night, I had an automatic weekly self-test run. The test failed, claiming I have at least one failed battery:

Dec 27 21:19:10 10.16.15.50 UPS: Started a self-test. 0x0137
Dec 27 21:19:12 10.16.15.50 UPS: At least one faulty battery exists. 0x0119
Dec 27 21:19:28 10.16.15.50 UPS: Failed a self-test. 0x0106

The management card obediently sent me two emails to tell me about this: one that the test had failed, and one that told me I have a faulty battery.

The problem is, every two minutes since then, it has sent me the same two emails. The device logs imply that the tests are not constantly re-running, so it looks like this is some kind of alert that needs to be cleared or acknowledged.

According to my email server logs, these are emails being generated by the management card -- they are not stuck or looping somehow in my email systems.

It is starting to bother the on-call guy. Now I can turn email notification off, but that sort of defeats the purpose of having it.

So does anyone know how to make it stop? Ideally without having to go in (since this is the holidays) or powering it off (there's stuff plugged into it for a reason).

Thanks.

I have a Dell PowerEdge SC1435 that has come back after doing duty at a partner site. I am trying to configure it for local use. The only problem I have with it is that every time it boots it always requres a manual F1 press after the POST sequence.

The last thing it does is give me the opportunity to configure the BMC, and then it says:

Press F1 to continue or press F2 for Setup

It will wait there forever (well, at least an hour). Pressing F1 starts the OS booting.

I can't see the setting in the BIOS which controls this and I can't find it in the documentation.

What am I missing?

A previous employer has asked me to come by and see if I can resurrect a computer which has failed since I left -- 8 years ago.

The computer in question is a HP 9000 rp2430, HP part A6889A (A Class rackmount).

However, I cannot find hardware documentation on this unit on the HP site, nor on docs.hp.com -- and my Google-fu is weak, since I can't find anything through there either.

Does anyone have a link to documentation on such an old beast?

I'm hoping HP has a site like Sun's site (http://sunsolve.sun.com/handbook_pub/validateUser.do?target=Systems/index) which lists current and EOL systems, along with links to whatever documentation was last available for them.

At one of my new customer sites, I have a SSL certificate which is about to expire. I've been notified by my provider of expiry. The previous admin was pretty detailed and I've located the .CSR which was used to request the about-to-expire certificate.

However, this host is a debian host, and I've confirmed that the .CSR was generated when Debian was suffering from the OpenSSL random number generation issue.

So. Now that I've updated OpenSSL on my debian host, I presume I have to regenerate the .CSR for the renewal. Is there a way to find out what values were used in the .CSR I have, to ensure that the new .CSR is consistant?

So one of the things that many (most?) Linux distributions can do is to either accept the dhcp option telling it what its node name should be, and/or do a reverse-lookup on the ip address it has been given via dhcp and apply its initial node name from that answer.

Is there a way to make XP do either of those?

I have imported a VM into an ESXi server using the VMware "Converter stand alone utility". However, this process is a little tedious. Since I eventually want several copies of this VM (or, to be more accurate, several more-or-less identical instances of this VM) to be running at the same time, is there a way to clone the already imported VM? Or do I have to re-import for each instance I want?