Massimo's questions

To analyze postgres logs, our workflow is:

1. postgres logs via syslog
2. rsyslog writes to one text file
3. at midnight we stop postgres
4. pgbadger reads and parses the daily logfile (about 2 Gbyte)

We want to esclude some outliers, for examples when the application starts, because for us they are useless data and just pollute the logfile.

To accomplish this: how/where can I specify a working hours (from..to) filter ?

The ideal solution is to set the filter in postgres.

Less than ideal, filter at rsyslog.

Last choice is to filter at pgbadger: the html output will be trimmed, but our servers keep writing fat logfiles.

current rsyslog configuration:

:msg, contains, "connection authorized: user=root database=root" ~
:msg, contains, "FATAL:  database \"root\" does not exist" ~
local0.*    -/var/log/postgresql.log

If - for example - cron jobs output to stdout, which is the process collecting the output and writing to these directories ?

/var/spool/clientmqueue /var/spool/mqueue /var/spool/mail

Where can I find docs on the inner details (pipe, rpc, ...) of the "redirection" from stdout to mail files ?

If I send an email whith sendmail, does it do the same routing as above ? docs ?

Under linux, at least centos and I think also debian, there is a "iptables" listed in the daemons. But it is really a script to load and save them, it doesn' start a process, neither write a pidfile.

How can I check iptables up and running with monit ?

On our linux servers we have this basic check:

check system localhost
    every "* 08-18 * * 1-5"
    if loadavg (1min) > 4 then alert
    if loadavg (5min) > 2 then alert
    if memory usage > 75% then alert
    if swap usage > 25% then alert
    if cpu usage (user) > 70% then alert
    if cpu usage (system) > 30% then alert
    if cpu usage (wait) > 20% then alert

On 3 servers we have postgresql. Is it possible to configure monit so:

• when the basic test alerts, execute a specific program ?

Example:

check process system_busy
    depends on system
    exec "/usr/bin/psql -U postgres -c \"SELECT * FROM pg_stat_activity;\" > /var/log/postgres_busy.log"

We want another check, to not modify the localhost one.

in my /etc/init.d/blabla script, which is the correct way to determine if the system is booting or the user root is runnig the script ?

I am thinking about * parent pid * euid * terminal... pts ?

We have a linux 3.16 with squid 3.4.8 listening on port 3128 ( not transparent proxy ).

And about 1200 windows clients, spread on 50 different sites. They use the proxy to navigate on internet.

Our proxy.pac simplified :

function FindProxyForURL( url, host ) {
    return "PROXY 10.1.1.108:3128; DIRECT";
}

The questions :

1. I cannot find the value of backlog used by squid3 on its listening socket. Is there a setting or does squid use the linux default ?

2. squid3 / debian / demon script : why the mainteners set ulimit -n 65535 ?

3. How can I check if the clients go direct because of the linux server too slow / undersized to accept the incoming connections ? Are there specific logging settings for linux and squid3 ?

The linux server has this tcp backlog :

cat /proc/sys/net/ipv4/tcp_max_syn_backlog

256

Does squid3 inherit this settings when calling

listen( socketfd, backlog )

or does squid3 set its specific value ?

About max open file descriptors

Use operating system limits set by ulimit

It isn't so simple. Our server can open a maximum of

cat /proc/sys/fs/file-max

818029

How many fd can squid3 handle ?

squidclient mgr:info | grep 'file descri'

Sending HTTP request ... done.

Maximum number of file descriptors: 65535

It is a debian 8, and the mantainers built this daemon script

cat /etc/init.d/squid3 | grep ulimit

ulimit -n 65535

So, what is the rationale to limit squid3 fd to 65535 ?

best regards, Sala

In squid.conf we have some

http_access deny ACL

catching a lot of connection attempts, so filling the access.log with TCP_DENIED lines.

It is normal behaviour, but too much verbose for us. Is it possible to avoid logging these ones ?

best regards, Sala

I have a windows 2003 server running under vmware esx.

For weird reasons, outside of our control, sometimes the guest tcp/ip stack stops working. So, for example, remote desktop connections don't work.

My goal is trobleshooting this network ( and other ) guest errors.

I can develop and put inside the guest some scripts, to monitor and detect tcp/ip and other application specific faults.

Can I run some console tool, to report a fault from the guest to the hypervisor ?

This tool has to work without network's apis, due to the failures we want to troubleshoot. I think it is possible : the supervisor works, I use it while the guest tcp/ip stack was faulty.

I have secured a linux box, starting with

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

and after adding rules to enable specific protocols and streams.

• Which are the correct rules to add multicast support ?

I am trying with these - for both client and server multicast :

iptables -A INPUT  -m pkttype --pkt-type multicast -j ACCEPT
iptables -A OUTPUT -m pkttype --pkt-type multicast -j ACCEPT
iptables -A INPUT  --protocol igmp -j ACCEPT
iptables -A OUTPUT --protocol igmp -j ACCEPT
iptables -A INPUT  --dst "224.0.0.0/4" -j ACCEPT
iptables -A OUTPUT --dst "224.0.0.0/4" -j ACCEPT

Linux 2.6.38-12 / iptables 1.4.10

• Is there any internet service to test my multicast set ( pc + adsl router + provider ) ?