I want my chef-client to run when something is changed in cookbooks. Is it possible?
I find this "run once in X min" not very optimal. When I change something I want it to be applied immediately so I can notice if something went wrong. Other than that it can run once in say 4 hours just to make sure that config is in good shape.
My apache server is producing lots of processes in "write" state until all slots are filled and the whole webserver hangs. Here's what I got:
root@viking:/# uname -a
Linux viking 2.6.32-51-server #113-Ubuntu SMP Wed Aug 21 20:01:09 UTC 2013 x86_64 GNU/Linux
root@viking:/# apache2 -V
Server version: Apache/2.2.14 (Ubuntu)
Here's a stack of hanged process:
root@viking:/# cat /proc/14475/stack
[<ffffffff81158c39>] poll_schedule_timeout+0x39/0x60
[<ffffffff81158e93>] do_poll+0x233/0x2c0
[<ffffffff81159965>] do_sys_poll+0x155/0x210
[<ffffffff81159c1c>] sys_poll+0x7c/0x110
[<ffffffff81013172>] system_call_fastpath+0x16/0x1b
[<ffffffffffffffff>] 0xffffffffffffffff
This is hot it appears in server-status:
Srv PID Acc M CPU SS Req Conn Child Slot Client VHost Request
0-0 14472 0/1033/1033 W 8.65 965 0 0.0 8.43 8.43 178.129.218.193 ***.com GET /programs/ HTTP/1.0
What may cause such behavior?
I have a few port forward rules like this
iptables -t nat -A PREROUTING -p tcp --dport 46000 -j DNAT --to-destination 172.16.8.2:46000
iptables -A FORWARD -p tcp -d 172.16.8.2 --dport 46000 -j ACCEPT
I wonder if there is a way to add new forward rules in one line instead of two so I don't have to enter the same data twice. I mean rules like this:
Is it possible?
Here's the problem:
root@home:~# ping 8.8.8.8
connect: Network is unreachable
root@home:~# dhclient eth0
RTNETLINK answers: File exists
root@home:~# ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_req=1 ttl=51 time=16.8 ms
64 bytes from 8.8.8.8: icmp_req=2 ttl=51 time=16.6 ms
^C
--- 8.8.8.8 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 16.654/16.737/16.820/0.083 ms
root@home:~#
Network is working only after I manually invoke dhclient. I don't have NetworkManager (removed it). Here are relevant lines from /etc/network/interfaces:
auto eth0
iface eth0 inet dhcp
And here is startup log:
root@home:~# cat /var/log/syslog | grep dhclient
May 28 21:39:44 home kernel: [ 7.237076] type=1400 audit(1369762781.497:2): apparmor="STATUS" operation="profile_load" name="/sbin/dhclient" pid=405 comm="apparmor_parser"
May 28 21:39:44 home kernel: [ 7.238298] type=1400 audit(1369762781.497:4): apparmor="STATUS" operation="profile_load" name="/usr/lib/connman/scripts/dhclient-script" pid=405 comm="apparmor_parser"
May 28 21:39:45 home dhclient: DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 8 (xid=0x79607e29)
May 28 21:39:45 home dhclient: DHCPREQUEST of 192.168.0.103 on eth0 to 255.255.255.255 port 67 (xid=0x79607e29)
May 28 21:39:45 home dhclient: DHCPOFFER of 192.168.0.103 from 192.168.0.1
May 28 21:39:45 home dhclient: DHCPACK of 192.168.0.103 from 192.168.0.1
May 28 21:39:45 home dhclient: bound to 192.168.0.103 -- renewal in 234779 seconds.
May 28 21:39:45 home kernel: [ 11.695666] type=1400 audit(1369762785.953:10): apparmor="STATUS" operation="profile_replace" name="/sbin/dhclient" pid=1154 comm="apparmor_parser"
May 28 21:40:11 home dhclient: DHCPREQUEST of 192.168.0.103 on eth0 to 255.255.255.255 port 67 (xid=0x2aa61c47)
May 28 21:40:11 home dhclient: DHCPACK of 192.168.0.103 from 192.168.0.1
May 28 21:40:11 home dhclient: bound to 192.168.0.103 -- renewal in 243414 seconds.
Any ideas what may cause such problem?
Update: I found that default gateway is not added on boot, but it is added when I restart networking service or run dhclient manually. But i didn't found yet what causes such behavior.
Typically my nginx config looks like this:
server {
listen 80;
server_name example.com;
<some long config>
}
server {
listen 443;
server_name example.com;
ssl on;
ssl_certificate qwe.crt;
ssl_certificate_key qwe.key;
<the same long config>
}
How to forward all https requests to http server directive (not send redirect to client but forward within nginx) so that I will not need to write the same config twice?
lsof -n contains thousands of entries like this:
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
java 27181 root 5044u FIFO 0,8 0t0 359768953 pipe
java 27181 root 5045u 0000 0,9 0 4734 anon_inode
java 27181 root 5046u FIFO 0,8 0t0 359781352 pipe
java 27181 root 5047r FIFO 0,8 0t0 359798491 pipe
java 27181 root 5048u FIFO 0,8 0t0 359768702 pipe
java 27181 root 5049u FIFO 0,8 0t0 359771810 pipe
java 27181 root 5050u FIFO 0,8 0t0 359771810 pipe
java 27181 root 5051u 0000 0,9 0 4734 anon_inode
java 27181 root 5052u 0000 0,9 0 4734 anon_inode
java 27181 root 5053u 0000 0,9 0 4734 anon_inode
java 27181 root 5054u FIFO 0,8 0t0 359778526 pipe
java 27181 root 5055u FIFO 0,8 0t0 359798491 pipe
java 27181 root 5056u FIFO 0,8 0t0 359828660 pipe
java 27181 root 5057u 0000 0,9 0 4734 anon_inode
java 27181 root 5058u FIFO 0,8 0t0 359778518 pipe
java 27181 root 5059u FIFO 0,8 0t0 359778518 pipe
java 27181 root 5060u FIFO 0,8 0t0 359828660 pipe
java 27181 root 5061u 0000 0,9 0 4734 anon_inode
java 27181 root 5062u 0000 0,9 0 4734 anon_inode
java 27181 root 5063u FIFO 0,8 0t0 359778520 pipe
java 27181 root 5064u FIFO 0,8 0t0 359778520 pipe
java 27181 root 5065u 0000 0,9 0 4734 anon_inode
java 27181 root 5066u FIFO 0,8 0t0 359781378 pipe
java 27181 root 5067u FIFO 0,8 0t0 359843851 pipe
java 27181 root 5068u FIFO 0,8 0t0 359828693 pipe
java 27181 root 5069u FIFO 0,8 0t0 359831577 pipe
java 27181 root 5070u FIFO 0,8 0t0 359781378 pipe
java 27181 root 5071u 0000 0,9 0 4734 anon_inode
java 27181 root 5072u 0000 0,9 0 4734 anon_inode
java 27181 root 5073u 0000 0,9 0 4734 anon_inode
java 27181 root 5074u 0000 0,9 0 4734 anon_inode
java 27181 root 5075u FIFO 0,8 0t0 359943483 pipe
java 27181 root 5076u 0000 0,9 0 4734 anon_inode
java 27181 root 5077u FIFO 0,8 0t0 359835297 pipe
java 27181 root 5078u FIFO 0,8 0t0 359932954 pipe
java 27181 root 5079u 0000 0,9 0 4734 anon_inode
java 27181 root 5080u FIFO 0,8 0t0 359940230 pipe
java 27181 root 5081u 0000 0,9 0 4734 anon_inode
java 27181 root 5082u FIFO 0,8 0t0 359835267 pipe
java 27181 root 5083u FIFO 0,8 0t0 359838075 pipe
java 27181 root 5084u FIFO 0,8 0t0 359895241 pipe
java 27181 root 5085u FIFO 0,8 0t0 359843844 pipe
java 27181 root 5086u FIFO 0,8 0t0 359828661 pipe
java 27181 root 5087r FIFO 0,8 0t0 359787185 pipe
java 27181 root 5088w FIFO 0,8 0t0 359787185 pipe
java 27181 root 5089u FIFO 0,8 0t0 359840961 pipe
java 27181 root 5090u 0000 0,9 0 4734 anon_inode
java 27181 root 5091u FIFO 0,8 0t0 359835297 pipe
java 27181 root 5092u FIFO 0,8 0t0 359828661 pipe
java 27181 root 5093u 0000 0,9 0 4734 anon_inode
java 27181 root 5094u 0000 0,9 0 4734 anon_inode
java 27181 root 5095u FIFO 0,8 0t0 359835267 pipe
java 27181 root 5096u FIFO 0,8 0t0 359838075 pipe
java 27181 root 5097u FIFO 0,8 0t0 359840961 pipe
java 27181 root 5098u 0000 0,9 0 4734 anon_inode
java 27181 root 5099u 0000 0,9 0 4734 anon_inode
java 27181 root 5100u FIFO 0,8 0t0 359843851 pipe
java 27181 root 5101u FIFO 0,8 0t0 359895241 pipe
java 27181 root 5102u 0000 0,9 0 4734 anon_inode
java 27181 root 5103u FIFO 0,8 0t0 359843710 pipe
Looks like our java service is leaking some handles. How to find out what is causing this? Is it handles to real files or something else?
I have a server with about 65k connections in ip_conntrack. How can I optimize munin script that counts various types of connections (default fw_conntrack script):
cat /proc/net/ip_conntrack | awk '
BEGIN {
STATE["ESTABLISHED"]=STATE["FIN_WAIT"]=STATE["TIME_WAIT"]=0;
TOTAL=ASSURED=NOREPLY=STATE["SYN_SENT"]=STATE["UDP"]=0;
}
/^tcp/ { STATE[$4]++; }
/^udp/ { STATE["UDP"]++; }
/ASSURED/ { ASSURED++; }
{
TOTAL++;
}
END {
print "established.value " STATE["ESTABLISHED"];
print "fin_wait.value " STATE["FIN_WAIT"];
print "time_wait.value " STATE["TIME_WAIT"];
print "syn_sent.value " STATE["SYN_SENT"];
print "udp.value " STATE["UDP"];
print "assured.value " ASSURED;
print "total.value " TOTAL;
}'
Currently it takes about 30 sec to execute.
I have a mysql (MyISAM) database with size around 30Gb. It has single large table (and some smaller ones but it makes no difference). It performs around 2000 selects (single row by primary key)/second, 300 updates/second and 50 inserts/second. We have around 10 independent servers with similar database.
I want to backup that database (incremental preferred) without taking it offline, how to do that?
Recently my friend told me that it is a good idea to turn off swap on linux webservers with enough memory. My server has 12 GB and currently uses 4GB (not counting cache and buffers) under peak load.
His argument was that in a normal situation server will never use all of its RAM so the only way it can encounter OutOfMemory situation is due to some bug/ddos/etc. So in case swap is turned off system will run out of memory that will eventually crash the program hogging memory (most likely the web server process) and probably some other processes. In case swap is turned on it will eat both RAM and swap and eventually will result in the same crash, but before that it will offload crucial processes like sshd to swap and start to do a lot of swap operations resulting in major slowdown. This way when under ddos system may go into a completely unusable condition due to huge lags and I probably will not be unable to log in and kill webserver process or deny all incoming traffic (all but ssh).
Is this right? Am I missing something (like the fact that swap partition is very useful in some way even if I have enough RAM)? Should I turn it off?
I mean pure javascript client that uses HTML5 sockets and doesn't need to be installed, just open single js file in browser. Is it possible to write such client at all?
I'm using rotatelogs to create my daily apache logs in format host.<day>.<month>.<year>.access.log. Now I want to gzip and move log to different directory after it's been finished. How to do that?
Update: There was a little mistake. logrotate -> rotatelogs
I have backup server that gathers backups from few other servers. I want to make directory structure like this
/backup/snapshots/<hostname>/<period>.0/<files>
Instead of default
/backup/snapshots/<period>.0/<hostname>/<files>
How to do this? I tried to specify parameter
backup root@remote-host:/backup/snapshots/hourly.0 . snapshot_root=/backup/snapshots/myhost/
but it doesn't work
How to see the full list of ip addresses in 'recent' module? I want to see current hitcounts to adjust my values accordingly so no valid users gets accidentally blocked
I have Ubuntu Server 10.04 with all packages updated. When I type nginx -v I get nginx version: nginx/0.7.65. When I go to nginx.org I see that the latest stable version is 1.0.10
Is it different version numeration or ubuntu in fact is running very old version? If so why? It's one of the essential packages for server (like apache, mysql etc.)
I'm installing ubuntu server 10.04 over kvm switch. I have no physical access to the server. The server has ubuntu installation cd inserted. How to prevent setup from ejecting it after completion?
Does IPMI always include KVM? Is it always able to mount remote .ISO's and show viewport image?
I have SuperMicro 1U 6016T-MTHF with Winbond WPCM450 BMC server. Here's my problem:
root@foo:~# ipmitool -I open sensor
FAN 1 | 8281.000 | RPM | ok | 400.000 | 576.000 | 784.000 | 33856.000 | 34225.000 | 34596.000
FAN 2 | 9216.000 | RPM | ok | 400.000 | 576.000 | 784.000 | 33856.000 | 34225.000 | 34596.000
FAN 3 | 9216.000 | RPM | ok | 400.000 | 576.000 | 784.000 | 33856.000 | 34225.000 | 34596.000
FAN 4 | 8281.000 | RPM | ok | 400.000 | 576.000 | 784.000 | 33856.000 | 34225.000 | 34596.000
FAN 5 | na | RPM | na | na | na | na | na | na | na
FAN 6 | na | RPM | na | na | na | na | na | na | na
CPU1 Vcore | 0.864 | Volts | ok | 0.776 | 0.800 | 0.824 | 1.352 | 1.376 | 1.400
CPU2 Vcore | na | Volts | na | na | na | na | na | na | na
CPU1 DIMM | 1.520 | Volts | ok | 1.288 | 1.312 | 1.336 | 1.656 | 1.680 | 1.704
CPU2 DIMM | na | Volts | na | na | na | na | na | na | na
+5 V | 5.120 | Volts | ok | 4.416 | 4.448 | 4.480 | 5.536 | 5.568 | 5.600
+5VSB | 5.088 | Volts | ok | 4.416 | 4.448 | 4.480 | 5.536 | 5.568 | 5.600
+12 V | 12.137 | Volts | ok | 10.600 | 10.653 | 10.706 | 13.250 | 13.303 | 13.356
-12 V | -12.680 | Volts | ok | -13.650 | -13.456 | -13.262 | -10.546 | -10.352 | -10.158
VTT | 1.112 | Volts | ok | 0.808 | 0.816 | 0.824 | 1.320 | 1.336 | 1.352
+3.3VCC | 3.312 | Volts | ok | 2.880 | 2.904 | 2.928 | 3.648 | 3.672 | 3.696
+3.3VSB | 3.264 | Volts | ok | 2.880 | 2.904 | 2.928 | 3.648 | 3.672 | 3.696
VBAT | 3.168 | Volts | ok | 2.880 | 2.904 | 2.928 | 3.648 | 3.672 | 3.696
CPU1 Temp | 0x0 | discrete | 0x0000| na | na | na | na | na | na
CPU2 Temp | 0x7 | discrete | 0x0700| na | na | na | na | na | na
System Temp | 29.000 | degrees C | ok | -9.000 | -7.000 | -5.000 | 75.000 | 77.000 | 79.000
P1-DIMM1A | 35.000 | degrees C | ok | -9.000 | -7.000 | -5.000 | 65.000 | 70.000 | 75.000
P1-DIMM2A | 37.000 | degrees C | ok | -9.000 | -7.000 | -5.000 | 65.000 | 70.000 | 75.000
P1-DIMM3A | 38.000 | degrees C | ok | -9.000 | -7.000 | -5.000 | 65.000 | 70.000 | 75.000
P2-DIMM1A | na | degrees C | na | na | na | na | na | na | na
P2-DIMM2A | na | degrees C | na | na | na | na | na | na | na
P2-DIMM3A | na | degrees C | na | na | na | na | na | na | na
Chassis Intru | 0x0 | discrete | 0x0000| na | na | na | na | na | na
PS Status | 0x1 | discrete | 0x01ff| na | na | na | na | na | na
Here I can see 'VTT' sensor, but this command fails:
root@foo:~# ipmitool -I open sensor get VTT
Locating sensor record...
Sensor data record "VTT" not found!
All other sensors work fine. Any Ideas why that single sensor is not working?
in /proc/net/ip_conntrack I have:
established 3076
time_wait 4346
total 7468
and in netstat I have:
established 1051
time_wait 73
total 1165
Why is that? Where are other connections? How to figure out what are they doing?
Update: Some more stats on ip_conntrack
assured 5230
unreplied 2133
total 7427
I'm developing a server application for ubuntu server, clients will connect to in through socket connection. It's in beta stage and under heavy development. At the moment lots of people are using it and it is updated almost every day. So I seed to seriously consider security issues and in the same time don't restrict myself too much. Now I have two questions:
Where is the appropriate place to store its files? Application consists of executable, some config files and startup script. But I don't want to spread it accross the filesystem just store in single folder for convenience since app is under heavy development. My guess would be to create new dir under /var. Right now I store it in my home folder.
Do I need to create separate user for it? I start it up using init.d script via sudo -u me. I want to restrict its access to system for security purposes but in the same time I want to be able to update it through FTP and not run into access issues (user that uploads it is different from user that runs it, and it sometimes need write access to some files). How to do that?
UPDATE: I forgot to mention that this application isn't redistributable. It is a web service that will exist in single instance at our server.
Possible Duplicate:
How to provide proper backups for multiple Linux based servers?
I want to do nightly backups of the whole system and be able to rollback to any of last 7 days. And, it must be incremental backups. What tool should I use? The tutorials I've read about rsync tell only how to store latest incremental backup and I need last 7.