Dylan Beattie's questions

I'm using CloudFormation to manage an Amazon API Gateway stack, and trying to (re)use a nested stack to add an OPTIONS method to each of my HTTP endpoint methods so I can respond with CORS headers.

Here's the CloudFormation snippet that refers to the nested stack:

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "AWS CloudFormation template for example HTTP endpoint",
  "Resources": {
    "MyRestApi": {
      "Type": "AWS::ApiGateway::RestApi",
      "Properties": {
        "Name": "api.example.com"
      }
    },
    "HelloResource": {
      "Type": "AWS::ApiGateway::Resource",
      "Properties": {
        "RestApiId": { "Ref": "MyRestApi" },
        "ParentId": { "Fn::GetAtt": [ "MyRestApi", "RootResourceId" ] },
        "PathPart": "hello"
      }
    },
    "GETHello": {
      "Type": "AWS::ApiGateway::Method",
      "Properties": {
        "RestApiId": { "Ref": "MyRestApi" },
        "ResourceId": { "Ref": "HelloResource" },
        "HttpMethod": "GET",
        "AuthorizationType": "NONE",
        "Integration": {
          "Type": "HTTP",
          "IntegrationHttpMethod": "GET",
          "Uri": "https://my-api-server.example.com/hello",
          "IntegrationResponses": [ { "StatusCode": "200" } ],
          "RequestParameters": { "integration.request.header.Authorization": "method.request.header.Authorization" }
        },
        "MethodResponses": [
          {
            "StatusCode": "200",
            "ResponseModels": { "text/html": "Empty" }
          }
        ],
        "RequestParameters": { "method.request.header.Authorization": true }
      }
    },
    "OPTIONSHello": {
      "Type": "AWS::CloudFormation::Stack",
      "Properties": {
        "Parameters": {
          "RestApiId": "MyRestApi",
          "ResourceId": "HelloResource"
        },
        "TemplateURL": "https://s3-eu-west-1.amazonaws.com/my-cloudformation-bucket/api-gateway-cors-headers.json"
      }
    }
  }
}

and then the CloudFormation template it refers to - api-gateway-cors-headers.json - looks like this:

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "AWS CloudFormation template for CORS headers,
  "Parameters": {
    "RestApiId": { "Type": "String" },
    "ResourceId": { "Type": "String" }
  },
  "Resources": {
    "CORSHeader": {
      "Type": "AWS::ApiGateway::Method",
      "Properties": {
        "AuthorizationType": "NONE",
        "RestApiId": { "Ref": "RestApiId" },
        "ResourceId": { "Ref": "ResourceId" },
        "HttpMethod": "OPTIONS",
        "Integration": {
          "IntegrationResponses": [
            {
              "StatusCode": 200,
              "ResponseParameters": {
                "method.response.header.Access-Control-Allow-Headers": "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'",
                "method.response.header.Access-Control-Allow-Methods": "'POST,OPTIONS'",
                "method.response.header.Access-Control-Allow-Origin": "'*'"
              },
              "ResponseTemplates": {
                "application/json": ""
              }
            }
          ],
          "PassthroughBehavior": "WHEN_NO_MATCH",
          "RequestTemplates": { "application/json": "{\"statusCode\": 200}" },
          "Type": "MOCK"
        },
        "MethodResponses": [
          {
            "StatusCode": 200,
            "ResponseModels": {
              "application/json": "Empty"
            },
            "ResponseParameters": {
              "method.response.header.Access-Control-Allow-Headers": false,
              "method.response.header.Access-Control-Allow-Methods": false,
              "method.response.header.Access-Control-Allow-Origin": false
            }
          }
        ]
      }
    }
  }
}

The problem is, I cannot work out how to pass the RestApiId and ResourceId parameters from the parent stack into the nested stack. Depending what syntax I try, I'm getting three or four different error messages - most recently Template format error: Unresolved resource dependencies [RestApiId, ResourceId] in the Resources block of the template - but cannot find any examples of how to pass the REST API ID and Resource ID into the nested stack template. What am I doing wrong?

We have a web app and API hosted at Amazon AWS, with three environments - development (dev), testing/staging (uat), and live. Each environment has a load balancer, two EC2 instances and an RDS database. We're relatively new to AWS and learning as we go to some extent, but on the whole it's working pretty well for us.

At 08:25 on Wednesday morning, we saw a sudden increase in response time from the boxes in the dev environment:

The three environments are running the same code and the same data schema. There is no corresponding increase in network activity, CPU utilisation, disk read/write activity. None of us has the faintest idea what's caused this sudden increase, or what we can do to troubleshoot it. A few people have said "oh, that's just cloud computing for you" but I can't quite accept that hosting at AWS just means sometimes your entire website will slow down by 1 second per request, for no reason, and you just shrug and ignore it.

What are my next steps here? How do I go about troubleshooting an issue like this?

I'm trying to create a Windows 2012 sysprepped image that I can boot from script, for creating automated test environments, and finding myself a little confused.

My understanding was that I could sysprep the box using this syntax:

C:\>sysprep /generalize /oobe /shutdown /unattend:A:\unattend.xml

Then, by modifying the appropriate unattend.xml and storing it in a FAT12 image mounted as drive A:, the server would use those modified settings during first boot to set the Administrator password, etc.

Thing is, it doesn't seem to work... and I suspect I may have got it completely backwards.

Does the /unattend parameter to sysprep tell sysprep 'hey, this is where you should read your settings when you first boot', or does it say 'hey, here are some settings you should bake into your sysprepped state and then use them next time you boot' ?

In other words, can I modify unattend.xml AFTER running sysprep but BEFORE I first boot the system? And if so, can I read the modified unattend.xml from a separate device (virtual floppy drive), or do I need to find and modify something stored within the sysprepped virtual machine image?

I have some Powershell scripts for setting up IIS web applications, message queues, etc.

They use a set of shared function libraries we've created - so each script starts with the line

. .\common.ps1

to reference the shared library. The shared library contains a set of functions like Create-IisApplicationPool, Create-MessageQueue and the like, which are then called from the actual script. The problem with these scripts is that you need to log on via Remote Desktop and run them locally, so I'm writing some new scripts for deploying code to an Amazon EC2 instance, and using Powershell remoting to invoke them locally.

What I can't work out is how to make this shared library available in a remote Powershell session.

Here's a simple example:

functions.ps1

function Add-Title([string] $name) {
    "Mr. $name"
}

function Say-HelloWorld([string] $name = "World") {
    $computerName = $env:COMPUTERNAME
    $greeting = Add-Title($name)
    Write-Host "Hello, $greeting ($computerName)"
}

example.ps1

. ./functions.ps1


$remoteUsername = "username"
$remotePassword = "password"
$remoteHostname = "172.16.0.100"

$securePassword = ConvertTo-SecureString -AsPlainText -Force $remotePassword
$cred = New-Object System.Management.Automation.PSCredential $remoteUsername, $securePassword


Say-HelloWorld("Spolsky")

Running locally, this works great - and says "Hello, Mr. Spolsky (DYLAN_PC)" as expected.

Now, if I replace the Say-HelloWorld call with this remote script invocation:

Invoke-Command -computerName $remoteHostname -Credential $cred -ScriptBlock {
    Say-HelloWorld("Spolsky")
}

I get the Powershell error:

The term 'Say-HelloWorld' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is co
rrect and try again.
    + CategoryInfo          : ObjectNotFound: (Say-HelloWorld:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException

Clearly, the remote session can't see the functions that have been imported locally.

For simple functions, this syntax works:

Invoke-Command -computerName $remoteHostname -Credential $cred -ScriptBlock ${function:Add-Title } -argumentlist "Spolsky"

but this fails for any function which depends on other functions.

I've tried various things using PS-ExportSession and trying to pass a -Session argument to Invoke-Command, but can't find any way of capturing local functions and their dependencies in a module that can be imported into a remote session. Any help gratefully received!

We use Varnish as our front-end web cache and load balancer, so we have a Linux server in our development environment, running Varnish with some basic caching and load-balancing rules across a pair of Windows 2008 IIS web servers.

We have a wildcard DNS rule that points *.development at this Varnish box, so we can browse http://www.mysite.com.development, http://www.othersite.com.development, etc. The problem is that since Varnish can't handle HTTPS traffic, we can't access https://www.mysite.com.development/

For dev/testing, we don't need any acceleration or load-balancing - all I need is to tell this box to act as a dumb proxy and forward any incoming requests on port 443 to a specific IIS server. I suspect iptables may offer a solution but it's been a long while since I wrote an iptables rule. Some initial hacking has got me as far as

iptables -F
iptables -A INPUT -p tcp -m tcp --sport 443 -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to 10.0.0.241:443
iptables -t nat -A POSTROUTING -p tcp -d 10.0.0.241 --dport 443 -j MASQUERADE
iptables -A INPUT -j LOG --log-level 4 --log-prefix 'PreRouting '
iptables -A OUTPUT -j LOG --log-level 4 --log-prefix 'PostRouting '
iptables-save > /etc/iptables.rules

(where 10.0.0.241 is the IIS box hosting the HTTPS website), but this doesn't appear to be working.

To clarify - I realize there's security implications about HTTPS proxying/caching - all I'm looking for is completely transparent IP traffic forwarding. I don't need to decrypt, cache or inspect any of the packets; I just want anything on port 443 to flow through the Linux box to the IIS box behind it as though the Linux box wasn't even there.

Any help gratefully received...

EDIT: Included full iptables config script.

We have an internal test version of our website, which is available (via internal DNS zones) as www.mysite.com.test

I'd like to create an SSL certificate for www.mysite.com.test, so that our testers don't get an invalid certificate warning (the 'real' certificate is bound to www.mysite.com)

I know how to create self-signed certs using OpenSSL, but I'm wondering if there's some way of associating the certificate authority with our Active Directory domain, so that any user on a PC that's a member of the domain will accept the self-signed cert without having to explicitly install it (or explicitly install the self-signing certificate authority as a trusted authority)

Any ideas?

Possible Duplicate:
What tool do you use to monitor your servers?

I'm looking for something to monitor intranet apps and internal web services, and provide logs of historical response times, uptime, alerts if the system becomes unavailable...

In short, I'm looking for something that's almost identical to Pingdom, but which can be run on an internal monitoring server so we don't have to expose our intranet pages and API endpoints to the outside world.

Open source, commercial, free - doesn't really matter. Just curious to know what's out there!

I'm setting up a custom 403.4 handler so that non-SSL requests to my site are redirected to a different URL - and what I'd like to do is to include the script path and query string in the redirect, so that a user who requests http://www.site.com/foo?bar=1 will be redirected to https://www.site.com/foo?bar=1

I know something similar is possible when configuring a top-level site redirect, using the $S, $Q, %v tokens referred to in this IIS reference page - but this syntax doesn't seem to work when configuring a custom error redirect.

I have a website running on Windows Server 2008 Web Edition, that has suddenly in the last few days started freezing and giving users a "503 Service Unavailable" message.

There's a bunch of errors showing up in the event log, but the most interesting one is:

    **Log Name:      System
    Source:        Microsoft-Windows-WAS
    Date:          22/08/2011 12:11:16
    Event ID:      5146
    Task Category: None
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      myserver.mydomain.com
    Description:
    Application pool www.mysite.com has been disabled. The request from protocol http to create the application pool failed. Restart the application pool so that Windows Process Activation Service (WAS) can determine the correct state of the protocol. The data field contains the error number.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-WAS" Guid="{524B5D04-133C-4A62-8362-64E8EDB9CE40}" EventSourceName="WAS" />
        <EventID Qualifiers="49152">5146</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2011-08-22T11:11:16.000Z" />
        <EventRecordID>37</EventRecordID>
        <Correlation />
        <Execution ProcessID="0" ThreadID="0" />
        <Channel>System</Channel>
        <Computer>myserver.mydomain.com</Computer>
        <Security />
      </System>
      <EventData>
        <Data Name="AppPoolID">www.mysite.com</Data>
        <Data Name="ProtocolID">http</Data>
        <Binary>B7000780</Binary>
      </EventData>
    </Event>

A server reboot fixes the problem temporarily - for ca. 24 hours - after which we start seeing 503 error messages again. There's nothing much to go on in the IIS event logs; restarting the application pool doesn't fix it, neither does an iisreset.

EDIT: The site is now failing immediately, and we still have no idea what's causing it.

Any ideas?

Thanks

-D-

I'm looking to set up at-a-glanoe monitoring of CPU. disk, network and memory usage for half-dozen Windows servers.

Windows Performance Monitor is far too complex for what I need - the array of counters and statistics is overwhelming and the UI quickly becomes unusable once you've added more than 5-6 counters to a particular display.

The Resource Monitor (resmon.exe) tool included with Windows 2008 is EXACTLY what I want - but doesn't appear to have any sort of remote monitoring capability.

Is there anything out there (ideally free but I'm happy to pay money if it will save time) that offers this capability?

Thanks,

Dylan

We're migrating the main media store for our website to a new server. I'm investigating using distributed file system (DFS) to do this, so that instead of replacing all the hard-coded references to \\oldserver\media with \\newserver\media in our website code and config files, I can:

1. Set up \\mydomain.com\dfs as a DFS share
2. Add a media folder to that DFS share, with a target pointing at \\oldserver\media
3. Update all my code and config files to use \\mydomain.com\dfs\media instead of \\oldserver\media

and then when that's all done, add a DFS target of \\newserver\media\, remove the \\oldserver\media target, and (theoretically?) my web servers will then start finding the new server instead of the old one when following that media share.

Nice theory. Doesn't work. Right now, if I go to \\mydomain.com\dfs\media from my workstation in Windows Explorer, I can see the NEW server (which is correct), but virtual directories in IIS that are mapped to \\mydomain.com\dfs\media are still seeing content on the OLD server.

What's bizarre is that the DFS configuration on the domain controller doesn't even have a reference to the old server any more - I've removed the target, and done a dfsutil cache domain flush and dfsutil cache referral flush on my workstation.

Is my local machine maintaining a separate referral cache that's used by IIS but not by Windows Explorer? Is there some other resolution mechanism that could explain why different processes on the same host are seeing different results?

I'm using WebDrive to map a drive letter to a WebDAV share running on Subversion with the SVNAutoversioning flag enabled. The Subversion server is running CollabNet Subversion Edge with LDAP authentication.

When trying to connect using WebDrive, I get:

Connecting to site myserver
Connecting to http://myserver/webdrive/
Resolving url myserver to an IP address
Url resolved to IP address 192.168.0.12
Connecting to 192.168.0.12 on port 80
Connected successfully to the server on port 80
Testing directory listing ...
Connecting to 192.168.0.12 on port 80
Connected successfully to the server on port 80

Unable to connect to server, error information below

Error: Socket receive failure (4507)
Operation: Connecting to server
Winsock Error: WSAECONNRESET (10054)

The httpd.conf file running on the server contains the following section:

<Location /webdrive/>
    DAV svn
    SVNParentPath "C:\Program Files\Subversion\data\repositories"
    SVNReposName "My Subversion WebDrive"
    AuthzSVNAccessFile "C:\Program Files\Subversion\data/conf/svn_access_file"
    SVNListParentPath On
    Allow from all
    AuthType Basic
    AuthName "My Subversion Repository"
    AuthBasicProvider csvn-file-users ldap-users
    Require valid-user
    ModMimeUsePathInfo on
    SVNAutoversioning on
</Location>

and in the Apache error_yyyy_mm_dd.log file on the server, I'm seeing this when I try to connect via WebDAV:

[Mon Jan 10 14:53:22 2011] [debug] mod_authnz_ldap.c(379): [client 192.168.0.50] [5572] auth_ldap authenticate: using URL ldap://mydc/dc=mydomain,dc=com?sAMAccountName?sub
[Mon Jan 10 14:53:22 2011] [debug] mod_authnz_ldap.c(484): [client 192.168.0.50] [5572] auth_ldap authenticate: accepting dylan.beattie
[Mon Jan 10 14:53:22 2011] [info] [client 192.168.0.50] Access granted: 'dylan.beattie' OPTIONS webdrive:/
[Mon Jan 10 14:53:22 2011] [debug] mod_authnz_ldap.c(379): [client 192.168.0.50] [5572] auth_ldap authenticate: using URL ldap://mydc/dc=mydomain,dc=com?sAMAccountName?sub
[Mon Jan 10 14:53:22 2011] [debug] mod_authnz_ldap.c(484): [client 192.168.0.50] [5572] auth_ldap authenticate: accepting dylan.beattie
[Mon Jan 10 14:53:22 2011] [info] [client 192.168.0.50] Access granted: 'dylan.beattie' PROPFIND webdrive:/
[Mon Jan 10 14:53:25 2011] [notice] Parent: child process exited with status 3221225477 -- Restarting.
[Mon Jan 10 14:53:25 2011] [debug] util_ldap.c(1990): LDAP merging Shared Cache conf: shm=0xcd0f18 rmm=0xcd0f48 for VHOST: myserver.mydomain.com
[Mon Jan 10 14:53:25 2011] [debug] util_ldap.c(1990): LDAP merging Shared Cache conf: shm=0xcd0f18 rmm=0xcd0f48 for VHOST: myserver.mydomain.com
[Mon Jan 10 14:53:25 2011] [info] APR LDAP: Built with Microsoft Corporation. LDAP SDK
[Mon Jan 10 14:53:25 2011] [info] LDAP: SSL support unavailable: LDAP: CA certificates cannot be set using this method, as they are stored in the registry instead.
[Mon Jan 10 14:53:25 2011] [notice] Apache/2.2.16 (Win32) DAV/2 SVN/1.6.13 configured -- resuming normal operations
[Mon Jan 10 14:53:25 2011] [notice] Server built: Oct  4 2010 19:55:36
[Mon Jan 10 14:53:25 2011] [notice] Parent: Created child process 4368
[Mon Jan 10 14:53:25 2011] [debug] mpm_winnt.c(487): Parent: Sent the scoreboard to the child
[Mon Jan 10 14:53:25 2011] [debug] util_ldap.c(1990): LDAP merging Shared Cache conf: shm=0xca2bb0 rmm=0xca2be0 for VHOST: myserver.mydomain.com
[Mon Jan 10 14:53:25 2011] [debug] util_ldap.c(1990): LDAP merging Shared Cache conf: shm=0xca2bb0 rmm=0xca2be0 for VHOST: myserver.mydomain.com
[Mon Jan 10 14:53:25 2011] [info] APR LDAP: Built with Microsoft Corporation. LDAP SDK
[Mon Jan 10 14:53:25 2011] [info] LDAP: SSL support unavailable: LDAP: CA certificates cannot be set using this method, as they are stored in the registry instead.
[Mon Jan 10 14:53:25 2011] [error] python_init: Python version mismatch, expected '2.5', found '2.5.4'.
[Mon Jan 10 14:53:25 2011] [error] python_init: Python executable found 'C:\\Program Files\\Subversion\\bin\\httpd.exe'.
[Mon Jan 10 14:53:25 2011] [error] python_init: Python path being used 'C:\\Program Files\\Subversion\\Python25\\python25.zip;C:\\Program Files\\Subversion\\Python25\\\\DLLs;C:\\Program Files\\Subversion\\Python25\\\\lib;C:\\Program Files\\Subversion\\Python25\\\\lib\\plat-win;C:\\Program Files\\Subversion\\Python25\\\\lib\\lib-tk;C:\\Program Files\\Subversion\\bin'.
[Mon Jan 10 14:53:25 2011] [notice] mod_python: Creating 8 session mutexes based on 0 max processes and 64 max threads.
[Mon Jan 10 14:53:25 2011] [notice] Child 4368: Child process is running
[Mon Jan 10 14:53:25 2011] [debug] mpm_winnt.c(408): Child 4368: Retrieved our scoreboard from the parent.
[Mon Jan 10 14:53:25 2011] [info] Parent: Duplicating socket 288 and sending it to child process 4368
[Mon Jan 10 14:53:25 2011] [info] Parent: Duplicating socket 276 and sending it to child process 4368
[Mon Jan 10 14:53:25 2011] [debug] mpm_winnt.c(564): Child 4368: retrieved 2 listeners from parent
[Mon Jan 10 14:53:25 2011] [notice] Child 4368: Acquired the start mutex.
[Mon Jan 10 14:53:25 2011] [notice] Child 4368: Starting 64 worker threads.
[Mon Jan 10 14:53:25 2011] [debug] mpm_winnt.c(605): Parent: Sent 2 listeners to child 4368
[Mon Jan 10 14:53:25 2011] [notice] Child 4368: Starting thread to listen on port 49159.
[Mon Jan 10 14:53:25 2011] [notice] Child 4368: Starting thread to listen on port 80.
[Mon Jan 10 14:53:25 2011] [debug] mod_authnz_ldap.c(379): [client 192.168.0.50] [4368] auth_ldap authenticate: using URL ldap://mydc/dc=mydomain,dc=com?sAMAccountName?sub
[Mon Jan 10 14:53:25 2011] [debug] mod_authnz_ldap.c(484): [client 192.168.0.50] [4368] auth_ldap authenticate: accepting dylan.beattie
[Mon Jan 10 14:53:25 2011] [info] [client 192.168.0.50] Access granted: 'dylan.beattie' PROPFIND webdrive:/
[Mon Jan 10 14:53:28 2011] [notice] Parent: child process exited with status 3221225477 -- Restarting.
[Mon Jan 10 14:53:28 2011] [debug] util_ldap.c(1990): LDAP merging Shared Cache conf: shm=0xcd4f90 rmm=0xcd4fc0 for VHOST: myserver.mydomain.com
[Mon Jan 10 14:53:28 2011] [debug] util_ldap.c(1990): LDAP merging Shared Cache conf: shm=0xcd4f90 rmm=0xcd4fc0 for VHOST: myserver.mydomain.com
[Mon Jan 10 14:53:28 2011] [info] APR LDAP: Built with Microsoft Corporation. LDAP SDK
[Mon Jan 10 14:53:28 2011] [info] LDAP: SSL support unavailable: LDAP: CA certificates cannot be set using this method, as they are stored in the registry instead.
[Mon Jan 10 14:53:28 2011] [notice] Apache/2.2.16 (Win32) DAV/2 SVN/1.6.13 configured -- resuming normal operations
[Mon Jan 10 14:53:28 2011] [notice] Server built: Oct  4 2010 19:55:36
[Mon Jan 10 14:53:28 2011] [notice] Parent: Created child process 5440
[Mon Jan 10 14:53:28 2011] [debug] mpm_winnt.c(487): Parent: Sent the scoreboard to the child
[Mon Jan 10 14:53:28 2011] [debug] util_ldap.c(1990): LDAP merging Shared Cache conf: shm=0xda2bb0 rmm=0xda2be0 for VHOST: myserver.mydomain.com
[Mon Jan 10 14:53:28 2011] [debug] util_ldap.c(1990): LDAP merging Shared Cache conf: shm=0xda2bb0 rmm=0xda2be0 for VHOST: myserver.mydomain.com
[Mon Jan 10 14:53:28 2011] [info] APR LDAP: Built with Microsoft Corporation. LDAP SDK
[Mon Jan 10 14:53:28 2011] [info] LDAP: SSL support unavailable: LDAP: CA certificates cannot be set using this method, as they are stored in the registry instead.
[Mon Jan 10 14:53:28 2011] [error] python_init: Python version mismatch, expected '2.5', found '2.5.4'.
[Mon Jan 10 14:53:28 2011] [error] python_init: Python executable found 'C:\\Program Files\\Subversion\\bin\\httpd.exe'.
[Mon Jan 10 14:53:28 2011] [error] python_init: Python path being used 'C:\\Program Files\\Subversion\\Python25\\python25.zip;C:\\Program Files\\Subversion\\Python25\\\\DLLs;C:\\Program Files\\Subversion\\Python25\\\\lib;C:\\Program Files\\Subversion\\Python25\\\\lib\\plat-win;C:\\Program Files\\Subversion\\Python25\\\\lib\\lib-tk;C:\\Program Files\\Subversion\\bin'.
[Mon Jan 10 14:53:28 2011] [notice] mod_python: Creating 8 session mutexes based on 0 max processes and 64 max threads.
[Mon Jan 10 14:53:28 2011] [notice] Child 5440: Child process is running
[Mon Jan 10 14:53:28 2011] [debug] mpm_winnt.c(408): Child 5440: Retrieved our scoreboard from the parent.
[Mon Jan 10 14:53:28 2011] [info] Parent: Duplicating socket 288 and sending it to child process 5440
[Mon Jan 10 14:53:28 2011] [info] Parent: Duplicating socket 276 and sending it to child process 5440
[Mon Jan 10 14:53:28 2011] [debug] mpm_winnt.c(564): Child 5440: retrieved 2 listeners from parent
[Mon Jan 10 14:53:28 2011] [notice] Child 5440: Acquired the start mutex.
[Mon Jan 10 14:53:28 2011] [notice] Child 5440: Starting 64 worker threads.
[Mon Jan 10 14:53:28 2011] [debug] mpm_winnt.c(605): Parent: Sent 2 listeners to child 5440
[Mon Jan 10 14:53:28 2011] [notice] Child 5440: Starting thread to listen on port 49159.
[Mon Jan 10 14:53:28 2011] [notice] Child 5440: Starting thread to listen on port 80.

Browsing http://myserver/webdrive/ from a web browser is working fine, and I have a similar set-up working perfectly on a different SVN server that isn't running Collabnet but has had Subversion and Apache installed and configured separately.

Any ideas? The python version error might be red herring - I've seen it in a couple of places in the log files and in other scenarios it doesn't appear to be breaking anything...

I have been told that it's good practise to keep your SQL Server data files and log files on physically separate disks, because it'll allow you to recover your data to the point of failure if the data drive fails.

So... let's say that mydata.mdf is on drive D:, and my mydata_log.ldf is on drive E:, and it's 16:45, and drive D: has just died horribly.

So - I have last night's full backup (mydata.bak). I have hourly transaction-log backups that will bring the data back up to 16:00... but that means I'll lose 45 minutes worth of updates.

I still have mydata_log.ldf on the E: drive, which should contain EVERY transaction that was committed right up to the point where the drive failed.

How do I go about recreating the database and restoring data from the backup file and the live transaction log, so I don't lose any updates? Is this possible?

I'm trying to set up fine-grained control of external websites based on our users' and computers' AD group memberships.

Generally, we block sites such as YouTube, Facebook, MySpace et al - but our video department need YouTube access; the Marketing department need access to Facebook, and so on. We also have a number of PCs that should have unrestricted Web access. Currently this is administered using static IPs entered into our firewall configuration - which is time-consuming and error-prone, and it'd be much easier to do it via AD group membership, and it turns out our existing hardware firewall doesn't support this scenario :(

So, our requirements are:

1. Control USER-LEVEL access to particular websites via Active Directory group membership. Users who are members of the ''Facebook Users'' group in Active Directory can access Facebook during office hours, regardless of which computer they are using, and users who are NOT members of the ''Facebook Users'' should not be able to access this site during office hours. We want to repeat this for 5-6 different websites, and manage access entirely through AD group membership.

2. Control COMPUTER-LEVEL access to particular websites - i.e. I'd like to be able to make a specific domain computer a member of the ''Facebook Users'' group, so that any user who is using that computer has access to Facebook, regardless of the user's AD group memberships.

Ideally, all this is completely transparent to the end user - they shouldn't need to enter their network credentials again. Also, setting up a local proxy, etc. is fine as long as it's managable via group policy.

Thanks,

Dylan

I'm using WMI to gather stats on some of our servers, and I'm trying to get details of the physical disks that are installed in each server.

The servers are various Dell PowerEdge models. Windows' built-in providers is reporting on the RAID volumes and the logical partitions, but I can't find any way to report on what the actual physical drives installed in the server are (presumably because Windows can only see as far as the RAID volumes being presented by the controller, and has no information about what's going on underneath that layer)

Is there a Dell RAID WMI provider I can install for this, or something else I can do to gather these stats?

I'm using msdeploy.exe to duplicate our live web environment to an offsite disaster-recovery server. This offsite server also hosts an FTP site that we use for transferring database backups and logs.

By default, a full webserver sync using MSDEPLOY will remove any site on the target server that isn't on the source server, so to avoid nuking our FTP server every night, I've explicitly ignored it in the msdeploy command line.

The command line is as follows (formatted for readability)

msdeploy.exe -verb:sync 
    -source:webserver,computername=HAPPYWEB 
    -dest:webserver 
    -enableRule:DoNotDeleteRule 
    -disableRule:SkipInvalidSource 
    -skip:WebSite="FTP Backups"

In IIS7, under the "FTP Backups" site, there's a node called "FTP Authorization Rules". For the FTP site to work, I have to add an Allow entry to this section, granting read/write permissions to the appropriate users.

The msdeploy command line is completely erasing this setting - although the FTP site remains online and intact, the FTP Authorization Rules section is being wiped, which means our scheduled transfers fail until someone logs in and re-creates the appropriate rules.

Is this a known issue? Can I work around it using some setting in msdeploy? And if not, does anyone know where I file a bug report against the Web Deployment Tool?