Mei's questions

I have two pfSense clusters, one is 2.1.4 and one is 2.1.3.

The directions suggest that Manual Outbound NAT is required, but the 2.1.3 cluster is working just fine using Automatic NAT, servers and all (including SSH and OpenVPN).

The 2.1.4 cluster is using Manual Outbound NAT and is causing grief. The NAT has three automatically added rules - labeled thusly:

• Auto created rule for ISAKMP - LAN to WAN
• Auto created rule for LAN to WAN
• Auto created rule for localhost to WAN

These were also created for both our internal network (192.168.6.0/24) and our Dev Network (10.2.0.0/8). There are two manual rules:

• IPs from the OpenVPN clients (192.168.7.0/24) to the outside are NAT
• IPs from the Internet Net to the Dev Net are NAT

This firewall cluster was a test cluster - then the primary was broken out for a single system production firewall - and is now returned to being a cluster.... and has a number of IP changes along the way.

Things are now NAT to the Cluster address, but OpenVPN still uses the primary's address. What am I missing? Should I return to Automatic NAT? If, on the other hand, I move the 2.1.4 Cluster to Manual NAT (to handle communicating to the secondary via the VPN) am I going to be causing problems?

EDIT I should note that everything else seems to be working - including SSH to the cluster address, and outgoing HTTP shows the cluster address, and so on. SSH of course is port 22 - and OpenVPN is 1194 (over 1024). The OpenVPN client works (site to site VPN). It seems to be just the outgoing traffic from the OpenVPN server on port 1194 that is not NAT.

I tried running OpenVPN on port 23 with the appropriate firewall rules - and it still sent out the replies from the WAN address, not the cluster address.

UPDATE I did mention what was wrong, but not properly explicitly. This is what I expect:

1. Packet arrives destined for cluster IP on port 1194.
2. Packet is accepted by the OpenVPN Server.
3. Packet is sent back to source from cluster IP on port 1194.

This is what I am seeing:

1. Packet arrives destined for cluster IP on port 1194.
2. Packet is accepted by the OpenVPN Server.
3. Packet is sent back to source from primary IP on port 1194.

You suggested checking the IP that the OpenVPN server is bound to; was ANY and changed to Cluster IP; haven't tested it yet.

I have two pfSense Clusters, and am trying to connect them with an OpenVPN site-to-site VPN. Initially, the client was a single pfSense system, and all was well. Now that one system is a cluster, and the OpenVPN site-to-site would go down on a regular and cyclical basis with a ping restart.

After much hair-pulling, it turned out that the problem was the secondary client. The server (cluster) was configured not to allow duplicate CNs to connect.

Apparently, in a cluster, running services are mirrored. Thus, two OpenVPN servers are actually running - and two OpenVPN clients. Turning off the secondary OpenVPN client was insufficient: next pfsync, it restarts. Disconnecting the external network fixed it.

The "new" pfSense cluster (client) is v2.1.4; the "old" pfSense cluster (server) is v2.1.3.

When I turn on the Duplicate CN option on the server (v2.1.3) I get this error:

openvpn[41232]: Options error: --duplicate-cn requires --mode server

When I added mode server to the the Advanced Settings section of the server, the site-to-site VPN worked.

Question is this: Is it feasible to have OpenVPN failover? Do I want both clients to be running? Will having both server (or client) nodes running OpenVPN cause troubles? I read that OpenVPN failover is not possible - but pfSense is acting like it is.

UPDATE: We're using OpenVPN for site-to-site as that was what was set up in the beginning, and using IPSec wasn't considered. It's still a possibility in the future.

We have this now: M1 -+ +- Q1 | | +---inet--+ | | M2 -+ +- Q2

Before M2 was brought up, the OpenVPN to Q1/Q2 worked fine.

It's been trouble since. I've heard that OpenVPN doesn't handle failover - and also that mixing IPsec and OpenVPN on the same pfSense system is a bad idea. If I could phase in IPsec I'll bet that would improve matters. (I control all four endpoints by the way.)

UPDATE 2 Tried enabling "Duplicate Connections" ... that actually turned out to actually shutdown the link invisibly (everything appeared normal). Disabling that made things flow again. What am I missing?

I have a problem similar to this one... if you look at the photo there, you'll see that the icinga server is marked as down.

I checked everything according to the answer given there, but it has already been done - and I'm seeing new hosts and services whenever I add them. But the icinga monitor is not being updated.

The cgi.cfg has this line in it:

icinga_check_command=/usr/lib/nagios/plugins/check_nagios -F /var/lib/icinga/status.dat -e 5 -C '/usr/sbin/icinga'

Running the command produces this:

# /usr/lib/nagios/plugins/check_nagios -F /var/lib/icinga/status.dat -e 5 -C '/usr/sbin/icinga' NAGIOS OK: 6 processes, status log updated 1 second ago

I went to /etc/icinga-web/ and looked around, but didn't find any appropriate settings.

I checked the ido2utils and restarted them just in case - but they've been running.

How do I fix this? Everything else is working ok, but not the icinga server status in the summary.

EDIT I was remiss in not mentioning that I am using Ubuntu Trusty Server on an amd64 machine. The installed icinga instance is from the Repositories.

We've a Cisco 2960e that services our VoIP phones and other things. I inherited it.

The question I have is the cut cables: there are about four network connectors that are cut about 1cm away from the end - making it nothing more than a physical connector. These connectors are paired with a working cable either on above or beneath.

I feel certain these connectors are some sort of flag; they can't be loop-backs as there is no cabling to do so (the connectors are cut and nothing else). There's no electrical connections: the only indicator the switch might realize is there is a physical presence in the jack - and I doubt that too.

The free ports are ominously quiet (of network traffic) as well: is this related? Are these connectors marking active ports?

UPDATE: I thought I was very clear; I don't know how I could have explained it any better. In any case, here's a picture:

We had an extended power outage (almost four hours); now I have a Dell PowerEdge 2850 server which is giving me this error (from a PERC 4e/DI) on boot up:

All drives are listed in the PERC configuration menu:

The failed drive does not show any indications of failure on the LEDs; the bottom appears to be green and the top is unlit. None of the disk drive LEDs are flashing.

All drives are in one RAID5 array with 6 stripes of 64K in size.

I do have one or two spare Dell PE2850s available for test. However, from what I've read, the Unresolved configuration mismatch... error would show up then - but perhaps I could activate the good drives anyway.

What if I remove the bad drive and try to boot that way? I may try that - but both the PERC 4e/DI and the Adaptec 2410SA card (activated later in the boot process) list all ports as not functioning.

Here are the specific questions:

1. Is it possible to get this (degraded) array running again on this system? How?
2. Will it help to configure a new configuration and save it (without initializing)?
3. Is it possible to move a degraded array to a new system and power up?
4. What if the "bad" disk was removed or replaced? How does that affect the system boot? How does that affect a disk array move?

EDIT: I found this question which appears to detail how to move drives from one host to another; is there anything more that should be added to the process detailed there? In my case, the move would be different in two ways: one, I have an apparently degraded array (RAID5), and two, the array is RAID5 not RAID1. The first is the biggest question mark; RAID5 should import just like RAID1 I'd say.

I found this question which talks about "repairing" a failed mirror, but there is no clear answer on how to fix it, and I'm using a RAID5 anyway - a RAID5 which hasn't been moved or rearranged.

UPDATE: The replacement system has a PERC 4/DC in it - compared to the old system which has a PERC 4e/Di in it. I hope this will recognize the old (degraded) array and import it just fine. If this works well, I'll even be able to use the old drives (no failures there) as a replacement for the failed drive.

I'm trying to set up SSL with a server running OpenLDAP (and using OpenSSL, not GnuTLS).

The server seems to be working fine: I can authenticate using ldap:// and can also use ldaps:// from Apache Directory Studio. I can use LDAPS from the client as well, as long as I have this setting in /etc/ldap.conf:

tls_checkpeer no

As soon as I try to use tls_checkpeer yes the SSL connection is refused.

I have the following settings on the server:

olcTLSCACertificateFile  /etc/ssl/certs/cacert.pem
olcTLSCertificateFile    /etc/ssl/private/newcert.pem
olcTLSCertificateKeyFile /etc/ssl/private/newreq.pem

The client has these related entries:

# ssl on
uri ldaps://192.168.1.15
tls_checkpeer no
# tls_cacertdir /etc/ssl/certs
# tls_cacertfile /etc/ssl/certs/cacert.pem

The file /etc/ssl/certs/cacert.pem is accessible to users for reading. With the above configuration, it works. If I uncomment one of the two commented tls_* configuration entries and change to tls_checkpeer yes it fails.

I've tried using both cacert.pem and newcert.pem for the certificate (tls_cacertfile) and it didn't work. The cacert.pem has a -----BEGIN CERTIFICATE----- section, as does newcert.pem.

However, the cacert.pem has this under X509v3 extensions:

X509v3 Basic Constraints: 
    CA:TRUE

...and the newcert.pem file has this in the same section:

X509v3 Basic Constraints: 
    CA:FALSE
Netscape Comment: 
    OpenSSL Generated Certificate

Other certificates in /etc/ssl/certs have nothing in them except the block marked by BEGIN CERTIFICATE.

Using this command:

openssl s_client -connect 192.168.6.144:636 -showcerts

I can see the contents of cacert.pem and newcert.pem being used for the session.

I've not made changes to /etc/ldap/ldap.conf on either the client or the server.

Errors from the client include:

Feb  8 14:32:24 foo nscd: nss_ldap: could not connect to any LDAP server as cn=admin,dc=example,dc=com - Can't contact LDAP server
Feb  8 14:32:24 foo nscd: nss_ldap: failed to bind to LDAP server ldaps://bar: Can't contact LDAP server
Feb  8 14:32:24 foo nscd: nss_ldap: could not search LDAP server - Server is unavailable

There's no special log entries on the server. The client is Ubuntu Lucid Lynx 10.04, as is the server. All are using nscd.

Attempting to replicate the problem on a Red Hat Enterprise Linux 5.7 system fails in the opposite direction: something that should probably fail, does not: using tls_checkpeer yes with an empty tls_cacertdir directory. I need SSL to work on both systems; we have a mix of both Ubuntu and RHEL.

I restarted nscd after each configuration change.

These are my actual questions:

• How do I get the tls_checkpeer option working? (main question)
• Does ssl on actually do anything on the client?

Thanks.

I'm using a Vsphere client on Windows XP over a VNC link (Vinagre) from an Ubuntu 10.10 desktop running WindowMaker. It all works pretty well, but I can't find any way to press the Magic SysReq key (used to reset Linux hard). Neither Vinagre nor Vsphere has any sort of keyboard that can be pressed; trying to use the SysReq key just results in the local system being reset. Running Vinagre in full screen makes no difference.

How do I press SysReq in this combination of software? I thought that sending a BRK would help, but there's no way to do that either. I thought PrScr would do it, but don't know how. Switching from Vinagre to xtightvncviewer didn't help at all.

Am I missing something or is sending a SysReq just not possible?

UPDATE: I found information about /proc/sys/kernel/sysrq-key (which allows you to specify the key) but that seems to have been removed sometime during the Red Hat Enterprise Linux 5.x kernel lifetime. This was a feature in the mainline kernel at one time.

I'm interested in finding out what people's experiences with standard usernames is. I've always been in places that used {firstInitial}{lastname} (sometimes with a length-limit). Now I've users that want {firstname}.{lastname} - and now it comes up that the period may cause problems.

Specifically:

• What is the best username length limit to use to maintain compatibility across all uses?
• What characters should be avoided?

UPDATE: The reason I didn't mention specifics is that I wanted to be general enough to handle anything that might come up in the future. However, that may be too general of a requirement (anything can happen, right?).

This is our environment: Ubuntu Server Lucid Lynx 10.04 LTS, Red Hat Enterprise Linux 5.6 and up, Windows Server 2003 and Windows 2000 Server (with Active Directory in Windows 2000 Native Mode), Zimbra 7.x for mail, and OpenLDAP in the near future.

UPDATE: I should mention (for completeness) that I saw this question (though it didn't answer my asked question) and also this web post, both of which were very informative.

I've seen other questions and documents about doing this, but there are some things that still confuse me. Here are the documents and questions I've seen:

• Retire a Dead Windows 2003 Domain Controller
• Seizing FSMO Roles from Petri
• Using NTDSUtil.exe to transfer or seize FSMO roles to a domain controller - Microsoft Knowledgebase
• FSMO placement and optimization on Active Directory domain contollers - Microsoft Knowledgebase
• How to remove data in Active Directory after an unsuccessful domain controller demotion

The environment contains two Windows servers and numerous clients. The Domain Controller is Windows 2003 SP2 running with a Windows 2000 Native AD. The other server (not a DC at all) is Windows 2000 SP4 (it's hosting a virus checking utility).

Results from netdom query fsmo:

Schema owner                missing.office.local

Domain role owner           myself.office.local

PDC role                    missing.office.local

RID pool manager            missing.office.local

Infrastructure owner        missing.office.local

The command completed successfully.

Results from dcdiag:

Domain Controller Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site\MYSELF
      Starting test: Connectivity
         The host 841d395a-2139-49d9-82c1-7c7e31ccb33b._msdcs.office.local could not be resolved to an
         IP address.  Check the DNS server, DHCP, server name, etc
         Although the Guid DNS name
         (841d395a-2139-49d9-82c1-7c7e31ccb33b._msdcs.office.local) couldn't be
         resolved, the server name (MYSELF.office.local) resolved to the IP
         address (192.168.9.101) and was pingable.  Check that the IP address
         is registered correctly with the DNS server. 
         ......................... MYSELF failed test Connectivity

Doing primary tests

   Testing server: Default-First-Site\MYSELF
      Skipping all tests, because server MYSELF is
      not responding to directory service requests

   Running partition tests on : ForestDnsZones
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom

   Running partition tests on : DomainDnsZones
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom

   Running partition tests on : Schema
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom

   Running partition tests on : Configuration
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom

   Running partition tests on : office
      Starting test: CrossRefValidation
         ......................... office passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... office passed test CheckSDRefDom

   Running enterprise tests on : office.local
      Starting test: Intersite
         ......................... office.local passed test Intersite
      Starting test: FsmoCheck
         Warning: DcGetDcName(PDC_REQUIRED) call failed, error 1355
         A Primary Domain Controller could not be located.
         The server holding the PDC role is down.
         ......................... office.local failed test FsmoCheck

Here are my questions (pardon me if they are too much of beginner questions):

• Are the roles listed from netdom query fsmo the same ones I've seen listed elsewhere? For example, is Domain role owner the same as Domain Naming Master? Is RID Pool Manager the same as the RID role?
• What are the bad things that could happen if I seize one of these roles?
• Will users notice?
• This set up has been going for a long time and people have been functioning more or less normally; is seizing the PDC role going to change this?
• Some of these documents predict dire consequences to having all roles on one DC. With a client base of no more than 20 - and perhaps less than 10 most days - is having all roles on one DC a real problem?
• Are there any caveats to performing the cleanup process recommended by Microsoft to remove the old DC from Active Directory?

Also - an almost tangential question - if I were upgrade the domain to a Windows 2003 AD (now or in the future) does this change anything in the seizing of FSMO roles?

PS: I suspect the DNS problems have to do with trying to use a non-Microsoft DNS that didn't support Microsoft's Dynamic DNS; I think there is a Windows DNS running but haven't audited it for proper functioning and set up yet.

I am considering connecting two (and possibly three) HP Procurve 1800 switches together with trunks or with LACP. I can't find any substantial answer to my questions via Google or here.

I did find this question Server-to-Switch Trunking in Procurve switch, what does this mean? but the answer to the question seems to be: a) Trunking could mean anything; and b) LACP is defined. The question Is a Trunk or LACP preferred? is not answered - and it is not switch-to-switch but switch-to-server.

I also found this question LAN Design Question with HP Procurve but it also does not answer the question posed above: Is a Trunk or LACP preferred? In any case, this question is relevant to the HP Procurve 2510 and not the HP 1800.

Neither of these questions seem to discuss our exact situation. There are three switches (all HP 1800s):

SW1(VLAN1) <-> SW2(VLAN1) <-> SW3(VLAN1)
               SW2(VLAN6) <-> SW3(VLAN6)

The switches are all HP 1800-24G (Hardware Version R01) with the following Software Versions:

• SW1: PB.03.01
• SW2: PB.03.01
• SW3: PB.03.04

The links between switches SW2 and SW3 all allow Tagged Packets only and have no PVID (according to the help documentation's recommendations). Other ports are either VLAN 1 or VLAN 6, and allow All Packets. All ports are autonegotiate except the occasional 100Mb Full Duplex settings; others are all 1Gb - none are 10Mb.

The problem is that SW2 seems to not respond to pings quickly and often loses packets (as monitored from the monitoring host on SW3). Other switches are fine and respond appropriately. Connection between hosts seem okay. HTTP response from both SW1 and SW2 on their management interfaces seem slow - slower than SW3.

I suspect a traffic bottleneck and would like to create a bigger pipe. The pings are to the IP address of the switch, and connections to the HTTP port also show slow response times. Presumably, the connections (HTTP and ICMP) are on VLAN1 as that is where the IP would be - and VLAN1 is the management VLAN anyway.

From reading other questions, it sounds like a "trunk" would make it possible to combine the traffic for both VLANs on the same wire - reducing the two connections down to one, or make the traffic go across multiple wires for multiple VLANs. It also sounds like trunks can be combined with LACP, but is that desirable?

My questions:

1. Is a trunk or LACP preferred in this situation? Why?
2. What does HP call a "trunk" in this situation?
3. How should the VLANs be handled in this situation?
4. Am I trying to solve the wrong problem?
5. Would a firmware upgrade help?

I'd like an answer to all questions in any case.

UPDATE I forgot to mention that I found this web page which seemed helpful, but also did not answer my questions directly. It sounds like (from the answers there) that trunking is for switch-to-switch communication and LACP is for server-to-switch communication.

I'm trying to clean up a rackmount power environment, and wanted to check on the power cords. Currently, it seems that what I would consider to be appropriate are labeled mostly as 14AWG:

• 14AWGX3C
• 3X14AWG

Some are labeled as 18AWG, though most I wouldn't want to put on a rackmount server power supply:

• 3X18AWG
• 18AWGX3C
• 3C/18AWG

The questions I have are: which ones are appropriate for rackmount servers? What does the labeling mean? Should I remove all 18AWG cords from the racks?

If you want some specifics, the servers are all Dells and include (PowerEdge) server models like these: 2950s; r710s; 2850; 2650; 1850; 1650...

I'm trying to make sense of the (thin provisioned) disk space on VMware ESXi 4.1 (using vSphere Client). The numbers I see don't add up and don't make sense.

Looking at the machine properties for an example VM, I see Hard disk 1 takes up 20Gb on datastore1 - and there are no other hard disks for this VM. However, the Summary tab for the VM has the VM using 24Gb on datastore1 and datastore2 - what's the extra 4Gb for? Also, the only thing on datastore2 is CD ISOs.

On top of this, this running VM instance is only taking up 2.23kb on disk according to the virtual host's Virtual Machines tab.

How can a full installation of Ubuntu Lucid Lynx take up 2.23kb? Would be a marvel... Even with data deduplication (which I wonder if VMware even supports) there would be a lot more than 2kb of unique data.

Ultimately, I want to be able to get an accurate report on amount of disk provisioned for each datastore (and per VM) and the amount of disk used (and per VM). Right now, it seems the only thing I can get from the command line is the total amount of disk used; any way to get the rest? I couldn't find any. The GUI has varying numbers as I reported.

I just can't seem to get this to work at all. I want to have puppet send a log message that shows up in the reports whenever a file changes. This seems so simple from what I've heard and read, but nothing works at all.

Here is the init.pp file:

# sudo init.pp

# 21 Sep 2011: Changed to test for notification only

class sudo {
    package { 'sudo':
        ensure  => present,
        before  => File['/etc/sudoers'],
    }

    file { '/etc/sudoers':
        ensure  => file,
        mode    => 440,
        owner   => root,
        group   => root,
        source  => 'puppet:///modules/sudo/sudoers',
        replace => false,
        audit   => content,
    }

#   exec { "/bin/date":
#       cwd => "/tmp",
#       subscribe => File['/etc/sudoers'],
#       refreshonly => true,
#   }

#   notify { "sudoers has been changed.":
#       refreshonly => true,
#   }
}

If I add the exec, nothing happens. If I add the notify, it complains about the refreshonly parameter.

If I remove all of the options for the file except audit, then the file permissions change from 440 to 644.

If I remove replace then puppet overwrites the file.

My test has been:

1. Run puppet agent --test
2. Change file (/etc/sudo)
3. Rerun puppet agent --test (possibly with a touch site.pp or a service apache2 reload first)

I have yet to see any messages from audit. I'm running puppet v2.6.3 on Ubuntu Lucid Lynx server 10.04.

There are multiple questions here - but it starts with this: we've a Dell PowerEdge R710 with a PERC 6/i RAID controller (or controllers) in a RAID10 configuration.

The system is running Ubuntu Server 10.04 LTS with MySQL doing a read-intensive workload.

I increased readahead using blockdev --setra ### /dev/sda to increase readahead (the reads are, at least in theory, sequential reads). This does not seem to have had a significant impact. I've not changed the disk elevator (I've seen noop and deadline recommended).

The load on the system skyrockets and it appears to be related to disk I/O waits. The system can be waiting up to 50% of the time for disk I/O - while CPU % is at about 7-10%. A comparable system with a RAID5 and a write-intensive MySQL installation smokes this system entirely.

The RAID10 system appears to have two PERC 6/i controllers given what Dell OpenManage reports; however, only Controller 0 has an enclosure and only Controller 0 has the RAID on it. The RAID is made up of four disks (slots 0-3 I believe) with two free slots.

The system is also running in a PowerSaving profile that lets the operating system manage the CPU speeds.

The system is also afflicted with the fsync() bug found in some Linux kernels.

Lastly, the PERC 6/i is reporting that the firmware is out of date: it has 6.2.0-0013 and wants 6.3.0-0001.

Now the questions:

• Is it possible to move one part of the RAID10 array to a second controller?
• Are there actually two controllers that can be used in the same backplane or am I missing something?
• Would a firmware update fix the disk speed issue?
• Would the RAID level have anything to do with the large disk IO wait?
• How much of an effect would the PowerSaving mode have? (Some reports seem to say it slows the kernel down.)

I strongly suspect that there is some kind of configuration that will zap the disks into frighteningly high speeds, but I can't seem to pin it down.

Update: The four disks used here are the Hitachi HDS721010CLA332 model, which is listed as having a SATA "Bus Protocol" but having a "SAS Address" as well? Are these disks those SAS-impersonating drives I've heard about that are supposed to be quite slow? In any case, these are 7200 RPM drives apparently.

The comparison system has SAS drives in it: the Seagate ST31000640SS - also 7200 RPM. This comparison system also has both RAID controllers utilized and with "backplane" entries associated with them.

The machine is an IBM ThinkCentre (model 8115LUA) with two PCI slots - x1 and x16 if I recall (the designations) correctly.

There are two identical network cards in these PCIe slots. Initially, the system would not start - it appeared that it was trying to use one of the network cards for a video card (with expected results) - presumably the x16 slot. The video is from the Intel 82945G Chipset.

I removed the network card in the oversize PCIe slot, set the BIOS to use on-board video only, and rebooted. Booting was good. After putting the network card back in, booting was still good.

However, only one network card is recognized (as eth1) - then gets "implemented" as eth2 (!).

[    5.148758] eth1: Tigon3 [partno(BCM95761) rev 5761100] (PCI Express) MAC address 00:10:18:80:de:36
[    5.148765] eth1: attached PHY is 5761 (10/100/1000Base-T Ethernet) (WireSpeed[1])
[    5.148771] eth1: RXcsums[1] LinkChgREG[0] MIirq[0] ASF[0] TSOcap[1]
[    5.148776] eth1: dma_rwctrl[76180000] dma_mask[64-bit]

lspci:

00:00.0 Host bridge: Intel Corporation 82945G/GZ/P/PL Memory Controller Hub (rev 02)
00:02.0 VGA compatible controller: Intel Corporation 82945G/GZ Integrated Graphics Controller (rev 02)
00:02.1 Display controller: Intel Corporation 82945G/GZ Integrated Graphics Controller (rev 02)
00:1b.0 Audio device: Intel Corporation N10/ICH 7 Family High Definition Audio Controller (rev 01)
00:1c.0 PCI bridge: Intel Corporation N10/ICH 7 Family PCI Express Port 1 (rev 01)
00:1c.1 PCI bridge: Intel Corporation N10/ICH 7 Family PCI Express Port 2 (rev 01)
00:1d.0 USB Controller: Intel Corporation N10/ICH 7 Family USB UHCI Controller #1 (rev 01)
00:1d.1 USB Controller: Intel Corporation N10/ICH 7 Family USB UHCI Controller #2 (rev 01)
00:1d.2 USB Controller: Intel Corporation N10/ICH 7 Family USB UHCI Controller #3 (rev 01)
00:1d.3 USB Controller: Intel Corporation N10/ICH 7 Family USB UHCI Controller #4 (rev 01)
00:1d.7 USB Controller: Intel Corporation N10/ICH 7 Family USB2 EHCI Controller (rev 01)
00:1e.0 PCI bridge: Intel Corporation 82801 PCI Bridge (rev e1)
00:1f.0 ISA bridge: Intel Corporation 82801GB/GR (ICH7 Family) LPC Interface Bridge (rev 01)
00:1f.2 IDE interface: Intel Corporation N10/ICH7 Family SATA IDE Controller (rev 01)
00:1f.3 SMBus: Intel Corporation N10/ICH 7 Family SMBus Controller (rev 01)
02:00.0 Ethernet controller: Intel Corporation 82573E Gigabit Ethernet Controller (Copper) (rev 03)
04:00.0 Ethernet controller: Broadcom Corporation NetXtreme BCM5761 Gigabit Ethernet PCIe (rev 10)

The two cards in question are identical; one is seen above at 04:00.0. The networking device at 02:00.0 is the internal network device.

I get link lights on all three devices (both PCIe Gigabit cards, and internal network device), with traffic flow lights to match. Linux recognizes link loss on both eth0 and eth2 (recognized devices) but logs nothing when using unrecognized device in PCIe 16x slot.

In the BIOS, I set the active video to IGD (Integrated Graphics Device, I assume).

How do I make the second network card work? There are no other PCIe slots available in this system; just these two.

I can't find anything that specifically elucidates the number of concurrent connections that are reasonable - nor can I find any treatises or research on this topic.

The boss says "The server needs to handle 50,000 concurrent users - so measure with 50,000 concurrent connections."

Then I see in at least one popular blog that measuring 50 concurrent connections is equivalent to being Slashdotted or Farked.

What are the numbers? What is reasonable? What isn't? How do the concurrent connections translate to number of users online at any given time?

I've looked around, and can't find any detailed explanation of the output at all. Most is indeed easy to understand, but there is one part that flummoxes me:

Time per request:       109537.505 [ms] (mean)
Time per request:       109.538 [ms] (mean, across all concurrent requests)

This means - to me - that if you measure across all concurrent requests (whatever that means) then the requests are suddenly returned 100x faster. Why would the time per request change that much? This makes no sense.

Is there any detailed explanation of this and other parts of the ab output?

From the looks of things, fixing ksh to make history alteration impossible is fairly easy. I've seen all the recommendations to make HIST* environment variables read-only, and the use of chattr to make the history file append-only (with chattr +a .sh_history).

Bash, however, has two things which seem to make it impossible to prevent history alteration: the history command (with history -c and history -d) and the separation of the history file from the actual run-time history (kept in memory). I also read here on serverfault that if you kill the current shell, then history won't be written out.

Is there any way to prevent history alteration for Bash? I want to be able to save all user commands without the user being able to remove anything from the history whatsoever.

Any further tips on Korn shell are also welcome. (I know about ksh-93 auditing... don't know if we can use it.)

I want to run mysql_tzinfo_to_sql whenever the tzinfo package (on Ubuntu Server) changes. I figured Puppet can take care of this.

I thought that either Puppet would react to a change in the package version, or if not, then to a change in timestamps of a file contained in the package.

The only way I can see to do this is to have a resource with no direct action, and have an exec depending on it.

The questions I have are:

1. Is it possible to define a file that is only used to Notify another resource (such as exec)?
2. Is it possible to define a package resource so that another resource (such as exec) is activated when the package changes or updates?
3. Is it possible to define an exec resource that runs a shell command line (with pipes and redirection for instance) instead of a command from the filesystem?

Taken all together, it seems overwhelming.

FOLLOWUP: Fantastic answers! In the interest of completeness (and for the record), I should note the following:

1. The complete shell command of interest is mysql_tzinfo_to_sql | mysql -u root -p password (it loads tzinfo into a MySQL database for MySQL use).
2. Auditing of /etc/tzinfo would be futile as this is merely the local time zone configuration; the goal is to watch for changes in the tzinfo data itself (thus the watching of /usr/share/zoneinfo).
3. Likewise, the contents would be the wrong thing to watch - as they're likely not to change; the best would be to watch the mtime or all since the filetimes should change after every tzinfo update.

Also, James Turnbull wrote all about auditing when it was introduced. The Metaparameter Reference contains a short description of the workings of the audit parameter.

How can this be?

Running a cp or rsync (with -W --inplace) takes two hours for 93Gb; a tape restore over the dedicated backup network is 41 minutes. Tape restore is 50 Mb/s; disk to disk was measured and calculated to be 16 Mb/s tops - 2 Mb/s if the CPU is busy.

The restore software is Veritas NetBackup; the disks are on an EMC Symmetrix array over fiber. The box is an HP rx6600 (Itanium) with 16 Gb running HP-UX 11i v2. All the disks are on one fiber card, listed as:

HP AD194-60001 PCI/PCI-X Fibre Channel 2-port 4Gb FC/2-port 1000B-T Combo Adapter (FC Port 1)

The disks are also all using Veritas Volume Manager (instead of HP LVM).

Update: It occurs to me that this is not just a straight disk-to-disk copy; in reality, it is a snapshot to disk copy. Could reading the snapshot be slowing things down that much? The snapshot is an HP VxFS snapshot (not a vxsnap); perhaps the interaction between the snapshot and VxVM is causing speed degradation?

Update: Using fstyp -v, it appears that the block size (f_bsize) is 8192; the default UNIX block size is 512 (or 8192/16). When testing with dd, I used a block size of 1024k (or 1048576, or 8192*128).

I really wonder if it is the block size. I read over at PerlMonks that the Perl module File::Copy is faster than cp; that is intriguing: I wonder.

If NetBackup is using tar, then it is not using cp: that might explain the speed increase as well.

Update: It appears that reading from snapshot is almost twice as slow as reading from the actual device. Running cp is slow, as is tar writing to the command line. Using tar is slightly better (when using a file) but is limited to 8Gb files (file in question is 96Gb or so). Using perl's File::Copy with a non-snapshot volume seems to be one of the fastest ways to go.

I'm going to try that and will report here what I get.