jmreicha's questions

I'm seeing some strange behavior with a script getting executed by cron and I'm not really sure what's happening. The script just looks like it is going to remove the package but then just hangs at the end and never does anything.

Here's the cronjob.

06 15 * * * root /myscript.sh > /tmp/script.log 2&>1

Here's (a simplified version of) the script.

#!/bin/bash

PACKAGES_TO_PURGE="htop"

if [ -n "$PACKAGES_TO_PURGE" ]; then
    echo "Purging $PACKAGES_TO_PURGE"
    echo
    #sudo apt-get purge -y $PACKAGES_TO_PURGE
    apt-get purge -y $PACKAGES_TO_PURGE
    echo "Done"
    echo
else
    echo "Nothing to purge"
fi

Here's the output of the log file.

0 upgraded, 0 newly installed, 1 to remove and 62 not upgraded.
After this operation, 188 kB disk space will be freed.
Done

Running this script by hand works, I only run into issues running it with cron so I'm not exactly sure what the deal is.

I can even get this script to work if I add a sudo into the apt-get command.

I'm thinking there is something easy I'm overlooking but nothing is jumping out at me.

I have searched Google and SO and surprisingly haven't been able to find a very good answer to this.

Basically, I want to know if there is any sort of method or best practice for migrating cache data from a Memcached cluster into a Redis cluster. Are there are any tools or tricks to help with this process?

If it's not possible, is there any recommendation for how to handle this? I assume that pointing to a new cache that hasn't been pre-warmed will cause some application slowness, I'm just wondering if there are any workaround for this, assuming a migration of the Memcache data isn't possible.

I am 1) looking for ideas of how to manage and 2) test complex nginx configurations across different environments.

1. Currently I am storing Nginx configurations in a github repo, separating environments in to different directories (dev, test, stage, prod, etc) and reusing identical configs via include directives.

   To deploy the correct configs I am running a simple script to copy in all the correct configurations in to place but I am starting to hit scaling issues as the configurations are getting more complicated and more environments are being added to the repo.

   Is there a good workflow or method for managing and testing configs? I was thinking of templating the configs somehow but don't know where to start.

2. Is there any sort of unit/integration framework for testing separate components of an Nginx configuration? Things like, "is Nginx listening on X port?" to make sure things don't break as new pieces get added to configurations.

   I'd eventually like to add this kind of logic in to some kind of CI/CD to ensure that things aren't getting broken.

I am having trouble getting the following nginx error log message to parse in the grok debugger. I have a feeling there is a stupid trick that I should use but can't figure out what it may be.

2015/03/20 23:35:52 [error] 8#0: *10241823 testing "/www" existence failed (2: No such file or directory) while logging request, client: 201.45.203.78, server: $domain, request: "GET /ritikapuri_"

Here is my Grok pattern so far:

(?<timestamp>%{YEAR}[./]%{MONTHNUM}[./]%{MONTHDAY} %{TIME}) \[%{LOGLEVEL:severity}\] %{POSINT:pid}#%{NUMBER}: %{GREEDYDATA:errormessage} client: %{IP:client}

This pattern gets me to the "server" section but I can't seem to get the rest to parse and it isn't clear to me why.

If I use another %{GREEDYDATA} pattern to grab the end of the log it sometimes wont' parse logs that don't match the above and give me a _grokparsefailure.

Would the best route be to use if statements to trap the different variations of log messages in nginx?

I have followed methods including this one but can't get them working.

I am seeing some strange behavior running the tail -f command inside a Docker container in CoreOS.

There are a number of variables I can think of that may be contributing to the problem but I am not sure what I need to do to troubleshoot first. On CoreOS I am running the newest version with overlayfs support, as well as a newer version of Docker (1.4.1).

What is interesting is that I am able to tail logs successfully on a different host OS (Ubuntu 14.04) which is running a different version of Docker (1.3).

I can produce strace logs if that helps to troubleshoot, they seem to be significantly different across hosts. For example, on the host that isn't working the strace stops after reading in the following in the strace output:

04:03:03 inotify_add_watch(4, "f017f0a1-a1e9-11e4-90bc-027e0f87cac6-paster.log", IN_MODIFY|IN_ATTRIB|IN_DELETE_SELF|IN_MOVE_SELF) = 1 <0.000028>
04:03:03 fstat(3, {st_mode=S_IFREG|0644, st_size=12229, ...}) = 0 <0.000022>
04:03:03 read(4, 0x7711f0, 64)          = ? ERESTARTSYS (To be restarted if SA_RESTART is set) <3.101545>

I am just not familiar enough with strace to be very good at interpreting the results.

I am attempting to set up a web server (nginx) that needs access to the internet while also being hooked up to an ELB but I am having trouble getting this solution working.

Details:

• 3 public subnets
  • a
  • b
  • c
• 3 private subnets
  • a
  • b
  • c
• 1 ELB
  • This has the three public subnets included in its default pool
• 1 NAT instance in public subnet

The various guides I have found useful for getting the public subnets hooked up to the ELB by pointing the subnets to the IGW. These set ups do not take in to consideration the need for internet access.

When I change the route table for the single NIC from the IGW to the nat instance I get internet access but I lose the ability to connect to the ELB and visa versa, when I update the route table to use the IGW I lose the ability to connect to the internet.

I can allocate an EIP and give it access that way but was hoping to avoid exposing this server the internet via a public address if possible.

What I am thinking is that I can either 1) add a second NIC to the web servers that need internet access so they have a leg out via a NAT instance and also have a leg in the public subnet to connect to the load balancer or 2) I can use the nat instance as the gateway for my network.

Has anybody set something similar to this up?

My brain is a little bit fried trying to figure this out but I can't seem to get private subnets to connect to the internet to grab updates for example. Basically all I want is web access for these servers. I have tried solutions found in other posts but could easily be missing something since I have been looking at this for quite awhile.

So far I have done the following set up:

• Disable source/destination checking on my NAT instance
• Create a route table for public subnet and set its source to IGW (verified this works)
• Create a route table for private subnet and set its source to the NAT instance
• Create security group for NAT instance with inbound and outbound rules for 80/443 and ssh
• Create security group for private instance with inbound and outbound 80/443 and ssh

I am able to jump on the NAT instance via SSH and then pivot onto the private server, so I know that much is working. I have verified my rules by pinging internal addresses but when I leave the local network that is when I start having problems.

Where do I need to look or what do I need to troubleshoot to help get this narrowed down? Is there some configuration that needs to be done on the NAT instance that I have overlooked?

EDIT: Configuration update

• VPC: 172.16.0.0./16
• Private subnet: 172.16.1.0/24
• Public subnet: 172.16.0.0/24

Private subnet routing table:

Points to NAT instance in public subnet. Unable to access internet, attached EIP to public internet facing interface.

Public subnet routing table:

Points the public subnet at the IGW, I have verified internet access.

Thoughts:

I'm starting to think there is something that needs to be set up or created on the NAT instance that lives in the public subnet to forward traffic from private instances, but I'm not exactly sure what needs to added. I found this post that explains adding a masquerade rule in iptables, is that something that apply to my situation?

I am looking for a way to essentially reverse file and folder redirection after it has been set up and configured using Group Policy.

Right now I have a file server that I am hanging a file share off to enable network storage for the redirected profiles. In my testing so far, everything is working correctly with my file and folder redirection setup.

What I would like to be able to do is copy down all of the contents from the network redirected shares back to the local computer for a given user, is this possible? Or is it a one way street? I have followed the steps from numerous guides to reverse the file and folder redirection process but I am still unable to get this to work.

More Details:

Here is an example of what the File and Folder Group Policy looks like. As I said this is working correctly.

I have set up a new policy which I am applying to the given OU to apply the local profile and folder redirection back to the PC. Here is what it looks like.

I'm getting the impression that this will help by pointing all the file and folder locations but I still have to manually copy the files housed on the network share back to the computer. Can somebody confirm? Is there a way to automatically get the copy working?

I am having issues getting multiple VLAN's set up on my Hyper-V cluster. Here is the scenario; I need to have 2 separate (potentially more in the future) VLAN's to span across the Hyper-V environment. So far I have set up a trunk to the Hyper-V hosts on the switch side of things. Here is what the trunk config looks like;

interface GigabitEthernet1/0/20
 description TEST
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 10
 switchport trunk allowed vlan 5,10
 switchport mode trunk

Now, on the Hyper-V side of things I have created identical virtual switches across all hosts, named "Inside".

I have created the logical network for this "Inside" vSwitch, set up the VLAN's on the logical network and built the IP pools for each. I will gladly post the configuration if that helps at all.

This is where the issue arises. If I leave the VM NIC's untagged (no VLAN ID), they all seem to work fine, and connect to the VLAN 10 network like they should. Once I tag the NIC then traffic to either the VLAN 5 or 10 networks seemingly will not pass over the network as I cannot even ping the gateway for each of these. I have tried both static and dynamic addresses for the VLAN ID tagged traffic, no help.

Here is an illustration of what works.

And what does not work.

Where should I be looking? There has to be something I am overlooking here, it seems like this would be a very common setup, but I feel like I may have been looking at this for too long.

Okay, so I have a little bit of a challenge for the Exchange pros.

I am looking for the mailbox database that a specific user was on... Before their account (and mailbox) was destroyed, around 7 months ago.

I have backups from this time period, however the way the backups are configured is to backup by database, and I can't seem to think of a way to find the database this user was on without guessing which database their data was living on. Anybody have thoughts on how to proceed?

TL;DR - User no longer with company, need to get files from backup but have no idea which mailbox database their files were stored on.

The higher ups have recently asked about this as I'm sure there are compliance issues that need to be addressed. I was under the assumption that Exchange uses opportunistic TLS or StartTLS to try to encrypt all outbound emails and falls back to unencrypted transport.

Is this the case with newer versions of Exchange? How reliable is this and how often is StartTLS employed by other mail servers?

If this method for encrypting mail traffic cannot be used reliably what are some other alternatives on the server side of things?

Myself and one other indivdual will be taking over some of the daily firewall management duties soon and I'm looking for a way to track changes on our firewall configurations for auditing purposes and need some ideas on a good way to track changes the changes that are made.

I don't have a lot of specific criteria but here are some of the basic things I would like to be able to do:

• Access to previous revisions of firewall configs
• Access to changes made and by whom
• When specific changes were made

I'm wondering if some sort of revision control software would work here as a way to track the the changes? Or if some other approach would work better for managing the change control in this situation.

I'm open to any and all suggestions at this point.

EDIT:

We are using a Checkpoint pair, one passive one active configuration. I will update again with specific model numbers when I get a chance.

I am working on troubleshooting a Lync 2010 deployment and have hit a snag. I have just about everything working except for the external meeting piece and don't really know where to look.

Environment is as follows:

• 1 Edge server (av, webconf, sip)
• 2 Directors
• 2 Front Ends
• 1 ISA (reverse proxy for address book, dialin, meetings)

I receive the following error when attempting to join an online meeting outside of the internal network with Chrome as both a guest and as an authenticated user. Sometimes it hangs, sometimes it fails right away, but it always fails eventually. I can join and run meetings between clients on the same domain but outside of that (internet), I keep getting this error.

I have double checked all client side settings through LCP. Another interesting symptom I’ve noticed, not sure if it is related but when joining the meeting via IE and choosing audio/video the client will connect briefly and then immediately disconnect even with devices that have mics and webcams.

So at this point the external users are only able to join using IM only but are not able to use any of the sharing features, screen viewing, etc.

I was able to capture the following screen shot, but cannot reproduce the issue. I am hoping this gives some clues, my googling has led me to believe that this error is unrelated to my others as this one seems to refer to mic/webcam problems.

Where should I begin looking in order to troubleshoot and hopefully solve this issue? I would be happy to provide more details if I have missed anything here. Your help is much appreciated, thank you.

Alright, all research thus far has failed me, this must be a somewhat obscure problem. I think I am close but I need an answer as to whether or not what I am trying to do is possible so I don't waste more of my time if I am heading down a dead end.

Here is the situation. I have been asked by the powers that be to disable the "Mobile Options" in Outlook 2010 using group policy. I have looked through the Microsoft Control ID spreadsheets but haven't found the ID's to disable the options they options they are requesting. Here is what "they" (the powers that be) would like to have disabled for users:

Is there a quick way to determine what (assuming they exist) these control ID's would be?

I have been able to disable the button on the ribbon, but that's as far as I've gotten.

Can anybody help me out with this or point me in the right directions?

I am knee deep in an Exchange migration currently of about 850 users from an Exchange 2007 environment to an Exchange 2010 environment. The mailbox databases are connected to a SAN via fiber and from the testing I've done so far I figure I can get about 24GB of mailboxes moved a night.

I have about a million questions with regard to this migration but right now but I think the most important is the following:

Is there a standard best practice for moving mailboxes?

• Should I spread users out across all the mailbox databases?
• Should I fill them up to say 70GB one at a time?
• Move a chunk of users to a mailbox every night?
• What’s the best way to keep track of how full databases are, where users are, etc.
• Is there a good way to spread users out automatically or should I just do it by best judgment?

Obviously I’ve never done a move like this so I guess I’m just wondering how I should approach this. Thanks.

EDIT:

I just realized that I should post my database structure, I think it may help show what I'm doing. Here are some pieces I forgot to mention:

• I have a DAG set up for 3 Exchange mailbox servers. Two on-site and one off-site
• I have 28 databases cut up across the 2 on-site mailboxes (14 and 14) with the third as a fail over.
• Currently about 2 TB of mail to migrate so we have a little bit of breathing room on these servers

I want to create a folder for each user if they do not already have one on a Windows file server when the user logs in each time.

So for example, I have user "jdoe", I would like to be able to create a share called "jdoe" automatically the first time this user logs in. And subsequently make this share available every time this user logs in after the share is created.

I have the policy working to the point where, if I manually create the share name for the user, the network drive gets mapped correctly. The last piece would be to create the share if it does not exist.

The policy setting looks like this:

Is there is a way to fully automate this process/policy or does this need to be done with a custom logon script or something?

Update 1:

These are what the folder permissions look like. Maybe this will help give you a better clue as to why the share isn't being created the first time the drive is mapped.

And here are the advanced options for Authenticated Users.

Update 2:

I have something working now at least, although I don't really think this is the best or cleanest way to do this. I have created two scripts, 1 for creating the share if it does not exist and the other to map the share.

I'm thinking that there has to be an easier, or at least less complicated, more obvious way to do this?

I have been working on setting up video streaming for employees from a website over http via Windows Media Services on Windows server 2008.

I have almost everything working the way I want but can't, for the life of me, figure out how to display items in Media Player to stream.

Here is the situation so far:

• Streaming internally over mms/http works but no playlist (both .asx/.wsx)
• Streaming externally over mms/http works but no playlist (both .asx/.wsx)
• Streaming locally with .asx works
• Streaming on the server itself with .asx works
• Streaming internally using UNC path works and displays playslist (it is the only way I have gotten it to show up and how it looks in the pic below. This is with .asx)

From what I have read, there should be a way to get this same playlist effect using the .wsx server side playlist feature in WMS but it is driving me crazy and google has failed me.

Here is what my semi functional .wsx file looks like so far, but again no right side playlist shows up with this:

<?wsx version="1.0"?>
<smil>
<seq>

<media src="Dental benefits 2011.wmv" mediaName="Dental">
<clientData title="Dental Benefits"/>
</media>

    <media src="Benefits Meeting Nov 2011 2.wmv" mediaName="Benefits">
<clientData title="Benefits Meeting"/>
</media>

    <media src="FSA 2011 presentation.wmv" mediaName="FSA">
<clientData title="FSA Presentation"/>
</media>

    <media src="Walk .wmv" mediaName="Walk">
<clientData title="Walk"/>
</media>

</seq>
</smil>

I have no real background in media streaming so any help would be appreciated!

I have been working on getting SpamAssassin up and running for awhile now and am pretty close to being finished. However, there is one last thing that is grinding away at me that I can't seem to figure out. I have searched around a bit but have been unable to find an answer that I find to be conclusive, so I just want a little clarity so I can sleep better at night.

I have read that SpamAssassin needs at least 200 messages, preferably 1000 to do an effective job of Bayesian filtering. I have been feeding it spam (at least I think) by issuing the following command:

sa-learn --showdots --mbox --spam spamfolder

As far as I can tell it is being processed by SpamAssassin. So I run:

sa-learn --dump magic

and get the following output:

bruticus@bruticus:~$ sa-learn --dump magic
0.000          0          3          0  non-token data: bayes db version
0.000          0        306          0  non-token data: nspam
0.000          0        210          0  non-token data: nham
0.000          0      68430          0  non-token data: ntokens
0.000          0 1318421928          0  non-token data: oldest atime
0.000          0 1319141693          0  non-token data: newest atime
0.000          0 1319142287          0  non-token data: last journal sync atime
0.000          0 1319142287          0  non-token data: last expiry atime
0.000          0          0          0  non-token data: last expire atime delta
0.000          0          0          0  non-token data: last expire reduction count

Are the items in the nspam and nham column indicative of the actual amount of learning and messages that SpamAssassin is using for its Bayesian analysis?

Do I need to get these two sets of numbers up into the 1,000's to get SpamAssassin to really start doing its job or how do I know when I have fed it enough spam to start working correctly?

So here's the deal.

Basically, I am looking for a convenient way to get spam from my Exchange 2010 mail server to my spam filter/proxy (whatever you want to call it) in a mail format for SpamAssassin to do its Bayesian filtering (Maildir or Mbox apparently).

I have created a gateway that filters mail and then passes it through to my Exchange server, as per this tutorial. From the research I have done it should be easy to apply the Bayesian filtering once the mail is in a format that it knows how to use:

sa-learn -mbox --spam ~/mbox/spam ~/mbox/bad-spam

Essentially, SpamAssassin needs a certain number of SPAM and HAM emails to do its thing and was thinking I could have users dump their emails into this public folder.

My initial inclination was to use something like IMAP2mbox and then dumping it into a directory on the SpamAssassin gateway. Therein lies my problem, it seems that this has become tricky to do with Exchange Server 2010 as there is no longer support for IMAP public folders built in.

I am stumped trying to come up with a way to get spam emails from my Exchange server into a format that SpamAssassin can use.

I am guessing there is a similar way to do this, but I'm not sure where to look next.

I just set up a new Ubuntu 11.04 test VM which I hope in the future to use as a wiki for internal documentation.

My problem is that I cannot seem to reach it via hostname through a web browser (IP address works fine). The environment I am testing on is predominantly a Windows domain with Windows Server 2008 running our DNS and DHCP service. I would like to keep the address of this test box dynamic if possible and simply access it by hostname.

Is there something that I need to do in Ubuntu to have it get picked up by DNS (most googling suggests modifying dhclient.conf)? Or is this something that should be configured through Apache?

The Windows machines seem to configure to DNS automagically.