jwegner's questions

I have a server that runs a bunch of VirtualHosts for each of our client sites (~ 30 sites). I've got the VHosts configured so that each site has its own log, which is stored in <public>/../log/access.log, and similarly for an error log.

I would like to create a server-wide log of some basic information from every request - specifically time, status code, and virtual host. Preferably, I would like to store this information in one file, rather than parsing each of the separate access logs.

Is there a way to tell Apache to follow one CustomLog in addition to all the ones in the actual VHost files?

I'm planning out a new Lync 2010 deployment (mixed with Office 365 E4, completely replacing a legacy PBX system), and am getting a bit confused with some of the docs that MS provides.

The company I'm building this for is very lightweight - only 50 full-use phones, and then about 15 common area phones. The 50 full-use phones will get full external telephony, and about half of the common area phones will be strictly internal calls.

Because of the very lightweight environment (and small budget), I'm trying to virtualize as many of the server roles onto a single box as I can. This document gives an example of hosting the four main compontents, FrontEnd, Edge, SQL, Monitor, and Archive on a single physical server, in 4 separate VMs. This arch is said to support 2000 users. Check out the visual:

So that would be pretty awesome. That would mean that I need to get one incredibly beefy server for all of those roles, and then one additional lightweight server for the director. However, according to this article, collocating Mon/Arch and FE is only supported in a test environment.

Standard Edition server with Monitoring Server and Archiving Server (for test purposes only) You can collocate the Monitoring Server, Archiving Server, or both on the Standard Edition server in a test environment.
Important: Do not collocate these two server roles on a Standard Edition server in a production environment.

So who do I believe? Ideally I could drop everything onto a single box, but I don't want to end up getting awful service because of it. The single-box solution is approved for 2000 users, which is way more than what we are shooting for. Does that mean that I should be totally find to virtualize everything?

We are a couple months into using WSUS for rolling out updates for our company computers. So far it's gone wonderfully - clients are auto-updating daily, and servers are waiting for our permission every Friday. It's a wonderful thing.

Every once in a while, though, I check in the WSUS client to make sure computers/servers are successfully updating - my goal is to have the "Needed Count" field be 0 (or close to 0). Unfortunately, all of my servers are showing a Needed Count above 7.

I did a status report on one of the servers, and it is showing all the updates that the server "needs", regardless of the approval I've given it. For instance, we generally do not approve Silverlight updates for our servers (it's unnecessary). So, as I'm marking them as approved for our workstations, I hit the "Not Approved" button for the servers group. It would appear, though, that updates that are Needed and Declined still count into the "Needed Count" field.

Is there a way to change that field so it only includes approved updates that are needed?

I've been having IP issues with my local box for a couple months now. Usually when it starts acting up I don't have the patience to look into it, so I just drop onto DHCP, but this morning I've finally decided to figure out what's going on.

I'm on a network that has 192.2.40.1 as the gateway, and is a 255.255.254.0 subnet (so IP Range is 192.2.40.1-192.2.41.254). My static IP address is 192.2.40.17. We have a Watchguard Fireware XTM Firewall/Router that sits on 192.2.40.1 . Also, our DHCP range is 192.2.41.200-192.2.41.254

The issue is that I occasionally lose my network connection, and when I try to reconnect I get errors regarding an IP Address conflict. We're pretty strict about documenting IP addresses here, so I found it quite odd that someone else would be using my IP address. I did a couple network scans, checked my DNS and DHCP logs, and found nothing using 192.2.40.17 (aside from my computer).

Grasping at straws, I ran "arp -a" to check if that could give me any information. Oddly enough, this is what I saw (note: I am on DHCP right now):

C:\Users\jwegner>arp -a

Interface: 192.2.41.107 --- 0xa
  Internet Address      Physical Address      Type
  192.2.40.1            00-90-7f-42-3f-30     dynamic
  192.2.40.17           00-90-7f-42-3f-30     dynamic
  //Truncated, because the rest is not important

Interesting - it would appear that my local computer is viewing 192.2.40.1 and 192.2.40.17 as the same device. I checked that MAC Address, and it is indeed the MAC Address for our firewall/router. I cleared my arp cache, thinking that something just got turned around somewhere. I then pinged 192.2.40.17 to recache the arp, and arp -a output the same thing.

There is nothing in my Firewall/Router that would make it take over the 192.2.40.17 address. Also, if I ping 192.2.40.17 I get nothing, so I must be getting some sort of false positive here. Any ideas on what might be causing this?

My company is in the process of upgrading all of our users from old Windows XP computers to newer quad-core Win7 computers. This is a good thing - it's long overdue that we upgrade our workstations - but I now spend a ton of time configuring new computers. Is there any way to automate this process?

The steps that I go through with just about every computer:

• Run through Win7 setup process (we do mostly HPs, so we get the stupid "The computer is personal again" thing.
• Uninstall bloatware (norton, bing bar, roxio, etc.)
• Install Updates
• Add to domain & configure network settings
• Install Office, and other company-specific applications
• Configure important shortcuts (Outlook on task bar)

There's a couple other things that I do after that that would be nice to automate, but it's unlikely due to license keys, passwords, etc.

• Configure Outlook
• Pull in files/settings with easy transfer wizard
• Map network drives

I know that it's possible to create a complete image of a computer, but how does that work with different hardware/drivers? What about Win7 license keys? If there is a way to make this work, what is the best (preferably free/open source) software out there to do this?

My boss and I were sitting in our server room today when we all of a sudden heard one of our servers go into hyper-speed, indicating that it was restarting. You can imagine the immediate "oh crap" expressions on our faces.

We dug into the logs, and it appears that there were some updates automatically installed that required a restart. AU, seeing that there was no one logged in, automatically did the restart. This is a production server, so we have automatic updates turned off (not even downloading then waiting.. It should wait for us to tell it before it does anything).

I ran both rsop.msc and gpedit.msc to check if there was a rogue group policy that forced the automatic updating. Nothing.

Our windowsupdate.log shows this:

2011-12-16  09:00:12:092     964    17f4    AU  Setting AU scheduled install time to 2011-12-16 20:00:00

(there were many more lines like that, and one pointing to a scheduled install just minutes before we heard the restart)

So, somewhere, AU is getting the bright idea that it should schedule automatic installs. Any ideas on why that might be happening?

A bit of pertinent information:

We recently (one month ago) installed a WSUS server, and two weeks ago pointed all of our servers at it. With WSUS came forefront client security, with a policy set up to do automatic definition updates every 6 hours. This could possibly be the problem, but it seems like a major flaw that by checking for definition updates it would automatically install other updates.

I also rolled out (I believe last Thursday) a new GPO for our workstations that forces automatic updating at 2:00 PM. This was applied to a select few workstations in the company and NONE OF THE SERVERS. I confirmed that that group policy wasn't applied through rsop.msc

As far as I can tell, this has only happened on or 2003 servers, but I can't make any promises that it isn't happening on the 2008 servers and I just haven't noticed.

Ideas?