davidmytton's questions

In New Relic, one of the metrics they display as part of the application response time is "Request Queue".:

To collect request queuing time, you need to mark the HTTP request with a timestamp when queuing starts. [1]

This is done by adding an HTTP header in the Apache httpd.conf:

RequestHeader set X-Request-Start "%t"

New Relic mention that:

For the request queuing bucket, a site operator can provision more application instances.

However we have seen adding new application instances (i.e. web nodes) doesn't affect the request queuing time - it stays constant. We're seeing this measured at around 250ms.

What factors affect the request queue length and how can it be reduced?

[1] http://support.newrelic.com/help/kb/features/tracking-front-end-time

When ordering co-location services, a certain amount of power is included, for example 0.25 amps, 0.5 amps, 1 amps, 2 amps, etc. How do I calculate how much a server is going to require?

I have an init.d script to start a Python script:

#!/bin/sh
#
###############################################################################
# sd-agent
#
# Written by Boxed Ice <[email protected]>
# A server monitoring daemon for www.serverdensity.com
#
# Licensed under Simplified BSD License (see LICENSE)
#
###############################################################################
#
# chkconfig: 345 85 15
# description: Server Density Monitoring Agent

AGENTPATH="/usr/bin/sd-agent/agent.py"

[ -f $AGENTPATH ] || echo "/usr/bin/sd-agent not found"

# Source function library.
if [ -f /etc/init.d/functions ]; then
        . /etc/init.d/functions
fi

if [ -f /etc/SuSE-release ]; then
        . /etc/rc.status
        rc_reset
fi

# Action to take
case "$1" in
  start)
        python $AGENTPATH start
        if [ -f /etc/SuSE-release ]; then
                rc_status -v
        elif [ -f /etc/debian_version ] || [ -f /etc/lsb-release ] || [ -f /etc/gentoo-release ]; then
                echo " Started"
        else
                success
                echo
        fi
        echo
    ;;
  stop)
        python $AGENTPATH stop

        if [ -f /etc/SuSE-release ]; then
                rc_status -v
        elif [ -f /etc/debian_version ] || [ -f /etc/lsb-release ] || [ -f /etc/gentoo-release ]; then
                echo " Stopped"
        else
                success
                echo
        fi
        echo
    ;;
  restart)
        $0 stop
        $0 start
        ;;
  *)
        echo "Usage: /etc/init.d/sd-agent start|stop|restart"
        exit 1
esac

exit 0

This has been "installed" into chkconfig:

[root@test ~]# chkconfig --list sd-agent
sd-agent        0:off   1:off   2:off   3:on    4:on    5:on    6:off

If I execute:

service sd-agent start

Then the script runs as expected. The Python code creates a PID file at /tmp/sd-agent.pid as it is supposed to. Equally, if I execute

service sd-agent stop

then the script is terminated and the PID file is removed.

If I stop the script and then reboot the server, it is started when the server finished the boot cycle. This is expected because I have set it to do that with chkconfig.

However, if I start the script, then reboot the server, the stop command does not seem to execute because when the server comes back up, the old /tmp/sd-agent.pid file still exists. This is preventing the start command from executing because it checks for the existence of the PID file and will not start if one already exists.

It seems that the stop command is not being executed when I issue the reboot command even though calling it directly works fine.

Any suggestions as to why?

This is on CentOS 5.2.

What are the correct permissions for /etc/init.d/ scripts and what chmod options sets them?

To ensure the data on the slave and master are in the same place for replication, the new master should be stopped and data transferred to the new slave before starting the master again, at least this is one option.

How can I start replication of a MySQL server without stopping the master?

Filesystem intrusions can be detecting using tools such as Snort but it is more difficult to detect intrusions into a database, such as deletion of rows, modification of tables, etc. What is the best way to monitor this to detect unwanted changes in the DB?

I am using MySQL so anything that is not database-agnostic should ideally be aimed at MySQL.

I have Apache configure with several IP addresses:

Listen 111.111.111.111:80
Listen 111.111.111.111:443

Listen 222.222.222.222:80
Listen 222.222.222.222:443

Listen 333.333.333.333:80
Listen 333.333.333.333:443

(IPs are fake)

I have several VirtualHosts, one of which is a wildcard subdomain.

<VirtualHost *:80>
        ServerName *.example1.com
        DocumentRoot /var/www/vhosts/example1-wc/docs
</VirtualHost>

<VirtualHost *:80>
        ServerName www.example1.com
        DocumentRoot /var/www/vhosts/example1/docs
</VirtualHost>

<VirtualHost *:80>
        ServerName www.example2.com
        DocumentRoot /var/www/vhosts/example2/docs
</VirtualHost>

This works fine. Requests to www.example1.com are served under the example1 docroot, requests for example.example1.com are served under the example1-wc docroot and www.example2.com for example2 docroot.

I can change www.example2.com to use a specific IP without any problems however if I change the wildcard vhost *.example1.com to a specific IP:

<VirtualHost 111.111.111.111:80>
        ServerName *.example1.com
        DocumentRoot /var/www/vhosts/example1-wc/docs
</VirtualHost>

Then requests to www.example1.com create an infinite redirect loop on itself. This happens regardless of whether I use:

<VirtualHost 222.222.222.222:80>
        ServerName www.example1.com
        DocumentRoot /var/www/vhosts/example1/docs
</VirtualHost>

or

<VirtualHost *:80>
        ServerName www.example1.com
        DocumentRoot /var/www/vhosts/example1/docs
</VirtualHost>

Why is this happening and how can I get each virtualhost on its own IP?

I have a number of remote servers I lock down by restricting SSH to specific IPs. Equally, our internal customer admin tools are also locked down by IP. This is fine when working from the office but if I am at a different location (perhaps on public wifi) or on my iPhone, the IPs will be changing.

What is the best way to set up remote access so that access can be allowed from any location but still maintaining security?

My answer would be to set up a VPN to tunnel all connections through and only allow the VPN IP access. If this is the route to go down, I do not want the VPN located in the office but would rather have it remotely managed. Are there any VPN-as-a-service providers?