Mike Purcell's questions

Given the following NGinx config, how would I alter it to issue a Retry-After header to ONLY 429 reponses?

limit_req_zone $binary_remote_addr zone=ip:10m rate=5r/s;
limit_req_status 429;
limit_conn_status 429;

server {

    listen 80;

    location /api {

        limit_req zone=ip burst=12 nodelay;

        proxy_pass http://website;
    }
}

I created a virtual mail user for postfix virtual mailboxes with a gid/uid of 5555, but now every new user I create starts at > 5555, is it possible to reset the autonumbering so normal users will be back in the low 100s? I know this appears pedantic, but I am OCD AND 5555 is supposed to signify a "special" user, much like 65534 does for anonymous NFS user.

--Update--

Confirming that ssgelm's solution works. I changed /etc/login.defs and set the UID_MAX and GID_MAX to 5000, and all new users are now getting uids/gids in the low 500s (expected behavior).

I'm trying to setup 2 different mount points on an NFS4 server but can't get it working as desired.

/etc/exports (on server)

/mnt/raid/nas                   10.1.0.0/18(rw,fsid=0,sync)
/mnt/raid/nas/file/perm         10.1.0.0/18(rw,sync,all_squash,no_subtree_check,anonuid=501,anongid=503)
/mnt/raid/nas/mail              10.1.0.0/18(rw,sync,all_squash,no_subtree_check,anonuid=5555,anongid=5555)

With the above mount points, in theory I should be able to mount the subdirs, separately, like:

$ -> mount -v -t nfs4 nas.vpc1.j1n.us:/mnt/raid/nas/file/perm /mnt/nas/store/file/perm/

But I keep getting these errors: ... failed, reason given by server: No such file or directory, but if I mount like this:

$ -> mount -v -t nfs4 nas.vpc1.j1n.us:/ /mnt/nas/

It works. But there are other dirs in the /mnt/raid/nas folder on the NFS server which I do not want to expose to NFS clients, so this option really doesn't help.

What can I do to use NFS4, but specify mount points so I don't end up sharing everything in /mnt/raid/nas?

Trying to figure out the best practice for implementing DKIM on a single EC2 which will have multiple, elastic IPS.

# /etc/opendkim.conf
...
Mode                    sv
Canonicalization        relaxed/simple
ExternalIgnoreList      refile:/etc/opendkim/TrustedHosts
InternalHosts           refile:/etc/opendkim/TrustedHosts
KeyTable                refile:/etc/opendkim/KeyTable
SigningTable            refile:/etc/opendkim/SigningTable
SignatureAlgorithm      rsa-sha256
...

# /etc/opendkim/KeyTable
default._domainkey.example.com example.com:hp-hv-1:/etc/opendkim/keys/default.private
default._domainkey.example.com example.com:hp-hv-2:/etc/opendkim/keys/default.private

# /etc/opendkim/SigningTable
*@example.com default._domainkey.example.com

Then I have two DNS records:

hp-hv-1._domainkey.example.com TXT "v=DKIM1;k=rsa;p=default.txt_key_goes_here"

hp-hv-2._domainkey.example.com TXT "v=DKIM1;k=rsa;p=default.txt_key_goes_here"

For both postfix instances on the same EC2 instance, each have the following $myhostname:

# postfixmulti instance #1
myhostname = hp-hv-1

# postfixmulti instance #2
myhostname = hp-hv-2

Both postfix instances are on the same EC2 instance, so they both share the same default.private/default.txt private/public key pair, so there is no need to add more rows to KeyTable and SigningTable. As far as I can tell, I only need to add extra rows to KeyTable and SigningTable if I want to implement multiple domains (which I do not).

But when I test my DKIM settings I keep getting 'pass: neutral' responses, saying that the emails are not signed, but they are, I can see it in the log file:

# snippet from /var/log/maillog
Sep 25 15:15:31 service-a-4 opendkim[27420]: 5B4A3625F0: DKIM-Signature field added (s=hp-hv-1, d=example.com)

What am I missing?

Versions:

CentOS 6.5
Postfix v2.6.6
Opendkim v2.9

I am getting denied errors when postfix tries to connect to the unix socket for opendkim, actual error:

Sep 24 15:41:43 service-a-4 postfix/cleanup[17414]: warning: connect to Milter service unix:var/run/opendkim/opendkim.sock: Permission denied

According to postfix docs, postfix is run in "chroot mode" by default, so postfix is locked down to /var/spool/postfix/, and according to the postfix docs, if running in "chroot mode", all milter (socket) references are relative (to /var/spool/postfix).

So my configs look like:

# /etc/opendkim.conf
Socket local:/var/spool/postfix/var/run/opendkim/opendkim.sock

# /etc/postfix/main.cf
smtpd_milters = unix:/var/run/opendkim/opendkim.sock

Now when I try to send a test email I get the permission denied error, so I tried a few permission tests:

# Correctly lists the socket file
sudo su -s /bin/bash postfix -c "ls /var/spool/postfix/var/run/opendkim/opendkim.sock"

But when I try to connect as postfix, nothing happens:

# Does not work
sudo su -s /bin/bash postfix -c "nc -U -D /var/spool/postfix/var/run/opendkim/opendkim.sock"

# Does work (as root)
nc -U -D /var/spool/postfix/var/run/opendkim/opendkim.sock

SELinux is temporarily disabled (permissive) whilst debugging this sitch. And I am restarting both processes (opendkim and postfix) after every config change.

What else am I missing?

Versions:

CentOS 6.5
Postfix v2.6.6
Opendkim v2.9

I recently switched all my lab servers from apache pre_fork/mod_php to apache worker/fcgi/php-fpm, and after getting everything set-up correctly, I noticed one last issue; php-fpm is adding it's own logging "header" to the php error log.

So this (php-fpm adding it's own header):

Sep 21 22:01:50 dev-a-1 php-fpm: pool www: 2014-09-21@22:01:50 dev-a-1.sn1.j1n.us DEBUG(7): VB9KzAoAAAQAAFGbEuQAAAAQ: Hobis_Api_Bootstrap initalized (should only happen once)

Should look like this (an example of a log entry using mod_php):

2014-09-21@22:01:50 dev-a-1.sn1.j1n.us DEBUG(7): VB9KzAoAAAQAAFGbEuQAAAAQ: Hobis_Api_Bootstrap initalized (should only happen once)

Because I am logging everything to syslog, and filtering there, I can add a regex like:

.*(pool www:)

But I am hoping for a more elegant solution. Is there a config option I can set so php-fpm just does a straight pass-thru? I tried setting the catch_workers_output to yes, but it didn't help.

Without getting to far into the weeds, Nginx is forcing my hand in order to accomplish some magic with vhosts and the map directive.

Is there an elegant (relative) solution to sharing a variable across multiple define calls, which allows each define call to append it's data to the global variable? In software this would be known as a singleton.

-- The weeds --

Nginx has a map directive which dictates which upstream server pool the request should be passed to, like so:

map $http_host $upstream_pool {

    hostnames;

    blog.example.com     blog_example_com;
    repo.example.com     repo_example_com;

    default example_com;
}

As you can see, any requests for blog.example.com will be passed to the blog_example_com upstream server pool (by way of proxy_pass).

The problem is the map directive syntax is that it can only be included within the main http block (nginx.conf), whereas vhost specific directives such as upstream and location can be included in the server block of a vhost config.

My nodes.pp manifest looks something like this:

 service-a-1.example.com inherits project_dev {

     nginx::vhost { 'mothership': }
     nginx::vhost { 'mothership_blog': }
     nginx::vhost { 'repo': }
}

As you can see, after a successful puppet run, I should end up with 3 distinct vhost config files in /etc/nginx/vhost.d/ dir.

The problem I am having is that in order for the map directive to work, I need to know which vhosts were loaded, so I can add their respective upstream ids to the map directive, which I have defined in the primary config: /etc/nginx/nginx.conf within the http block (of which there can only be one).

-- What I have tried --

I have a global.pp file which does some "bootstrapping" and in this file I added a $singleton = '' syntax, then in the nginx::vhost define, I added this syntax:

$tpl_upstream_pool_labels = inline_template("<% tpl_upstream_pools.keys.sort.each do |role| %><%= role %>_<%= tpl_domain_primary %>_<%= tpl_domain_top_level %>|<% end %>")

$singleton = "${singleton}${tpl_upstream_pool_labels}"

notify { "\n--------------------- Nginx::Conf::Vhost::Touch | Timestamp: ${timestamp} | Pool labels: ${singleton} -------------------------\n": }

Which should result in a pipe delimited list of upstream ids. As mentioned earlier, in the nodes.pp manifest, I make three calls to nginx::vhost, and would expect the $singleton global variable to be appended for every call, however it is not, it only contains the last call's data.

I also tried to hack my way around this by writing a temp file like so:

$temp_file_upstream_pool_labels_uri = "/tmp/puppet_known_upstreams_${timestamp}.txt"

exec { "event_record_known_upstream_${name}" :            
    command     => "touch ${temp_file_upstream_pool_labels_uri} && echo ${tpl_upstream_pool_labels} >> ${temp_file_upstream_pool_labels_uri}",            
    provider    => 'shell'
}

Then in the nginx::conf::touch define, where the primary config nginx.conf is to be written by puppet, I tried this:

$temp_file_upstream_pool_labels_uri = "/tmp/puppet_known_upstreams_${timestamp}.txt"

$contents = file($temp_file_upstream_pool_labels_uri)

Which should, in theory, load the contents of the file into the $contents variable. But when I run puppet using this approach I get an error that the file does not exist. I ensured that the nginx::conf::touch call is not made until after all the vhosts were considered, but still to no avail.

I have a local NTP server running on the subnet to keep other subnet nodes in sync, without every node syncing with upstream servers. But, while implementing the check_ntp_time plugin for Nagios I am noticing a frustrating issue, where nagios keeps reporting critical error for local nodes syncing up with the local ntp server.

Here is the ntp config on the local ntp server, notice the upstream server entries and the restrict entry, according to my research this qualifies the node as an ntp server which local nodes can sync against.

driftfile /var/lib/ntp/drift

# Permit time synchronization with our time source, but do not
# permit the source to query or modify the service on this system.
restrict default kod limited nomodify notrap nopeer noquery
restrict -6 default kod limited nomodify notrap nopeer noquery

# Permit all access over the loopback interface.  This could
# be tightened as well, but to do so would effect some of
# the administrative functions.
restrict 127.0.0.1
restrict -6 ::1

# Makes me able to answer requests from local nodes
restrict 10.0.0.0 mask 255.255.192.0 nomodify notrap

# My source
server 0.centos.pool.ntp.org iburst
server 1.centos.pool.ntp.org
server 2.centos.pool.ntp.org

logfile /var/log/ntp/server.log

statistics loopstats
statsdir /var/log/ntp/
filegen peerstats file peers type day link enable
filegen loopstats file loops type day link enable

And on the local non-ntp server nodes, everything is the same except the restrict entry is removed, and the server entries reference only the local ntp server: server ntp.example.com iburst.

Every local node can resolve ntp.example.com.

The problem I am having is when I run the following command from the nagios server:

/usr/lib64/nagios/plugins/check_ntp_time -H node-a-1 -v

And the output:

sending request to peer 0
response from peer 0: offset -0.002921819687
sending request to peer 0
response from peer 0: offset -0.0001939535141
sending request to peer 0
re-sending request to peer 0
re-sending request to peer 0
re-sending request to peer 0
re-sending request to peer 0
re-sending request to peer 0
re-sending request to peer 0
discarding peer 0: stratum=0
overall average offset: 0
NTP CRITICAL: Offset unknown|  

This happens for all the nodes, except the local ntp server, which references upstream servers. At first I thought it was IPTables issue, but I have the ports pinholed on every local ntp node (to allow nagios access to check the time diff):

ACCEPT     udp  --  eth0   *       10.0.0.0/18          0.0.0.0/0           multiport dports 123 /* 777 allow ntp access */ state NEW

Versions:

nagios-plugins-ntp: 1.4.16
ntp: 4.2.6p5-1.el6.centos

Any help is greatly appreciated, I really can't submit the nagios work until I get this resolved, as you know keeping server times in sync is priority 1.

-- Edit --

Per the comments, here are the results of ntpq -p, on various nodes:

# Actual NTP Server (10.0.0.2)
==============================================================================
+propjet.latt.ne 241.199.164.101  2 u  105  128  337   14.578   12.954   7.138
+x2la01.hostigat 63.145.169.2     3 u   21  128  377   16.037   13.546   4.090
*pacific.latt.ne 241.199.164.101  2 u   72  128  377   15.148   24.434   7.403

# Local node 1
==============================================================================
*service-a-1.sn1 204.2.134.163    3 u    9  128  377    0.228    5.217   1.296

# Local node 2
==============================================================================
*service-a-1.sn1 204.2.134.163    3 u   91  128  377    0.200    3.608   1.167

Running nginx 1.0.15 on CentOS 6.5. I have three upstream servers and everything works fine, however when I simulate an outage, and take one of the upstream servers down, I notice considerable lag in response times (additional 5-7 seconds). The second I bring the downed server back online, the lag disappears. Also, another weird thing I noticed, if I simply stop the httpd service on the simulated outage server, the response times are normal, the lag only occurs if the server is completely down.

Here is my conf:

upstream prod_example_com {

    server app-a-1:51000;

    server app-a-2:51000;

    server app-a-3:51000;

}


server {

    # link:  http://wiki.nginx.org/MailCoreModule#server_name
    server_name example.com www.example.com *.example.com;

    #-----
    # Upstream logic
    #-----


    set $upstream_type prod_example_com;


    #-----

    include include.d/common.conf;

    # Configure logging
    access_log  /var/log/nginx/example/access/access.log access;
    error_log   /var/log/nginx/example/error.log error;

    location / {

        # link: http://wiki.nginx.org/HttpProxyModule#proxy_pass
        proxy_pass  http://$upstream_type$request_uri;

        # link: http://wiki.nginx.org/HttpProxyModule#proxy_set_header
        proxy_set_header    Host    $host;
        proxy_set_header    X-Real-IP   $remote_addr;
        proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
    }

    location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {

        # link: http://wiki.nginx.org/HttpProxyModule#proxy_pass
        proxy_pass  http://$upstream_type$request_uri;

        # link: http://wiki.nginx.org/HttpProxyModule#proxy_set_header
        proxy_set_header    Host    $host;
        proxy_set_header    X-Real-IP   $remote_addr;
        proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;

        proxy_hide_header expires;
        proxy_hide_header Cache-Control

         # Even tho this reads like the older syntax, it is handled internally by nginx to set max age to now + 1 year
         expires max;

        # Allow intermediary caches the ability to cache the asset
        add_header Cache-Control "public";
    }
}

I have tried the suggestions on similar posts like this. And apparently my version of nginx is too old to support health_checks as outlined in the nginx docs. I've also tried to explicitly set the max_fails=2 and fail_timeout=120 on the app-a-3 upstream definition, but none of these seem to avoid the additional 5-7 seconds lag for every request if app-a-3 is offline.

-- Update --

Per request, here is the output for a single request when app-a-3 is completely down. The only thing I could see out of the ordinary is the 3 second lag between initial event and subsequent event.

-- Update #2 --

Looks like a few years ago Nginx decided to create Nginx Plus, which adds active health checks, but for a yearly support contract. Based on some articles I've read, Nginx got sick of making companies millions, and getting nothing in return.

As mentioned in the comments we are bootstrapping and don't have the $$ to throw at a $1,350 contract. I did find this repo which provides the functionality. Wondering if anyone has any experience with it? Stable? Performant?

Worst case scenario I will just have to bit the bullet and pay the extra $20 / month for a Linode "Node Balancer" which I am pretty sure is based off of Nginx Plus. The only problem is there is no control over the config other than a few generic options, so no way to support multiple vhost files via one balancer, and all the nodes have to be in the same datacenter.

-- Update #3 --

Here are some siege results. It seems the second node is misconfigured, as it is only able to handle about 75% of the requests the first and third nodes are handling. Also I thought it odd, that when I took the second node offline, the performance was as bad as if I took the third (better performing) node offline. Logic would dictate that if I removed the weak link (second node), that I would get better performance because the remaining two nodes perform better than the weak link, individually.

In short:

node 1, 2, 3 + my nginx = 2037 requests

node 1, 2 + my nginx  = 733 requests

node 1, 3 + my nginx = 639 requests (huh? these two perform better individually so together should be somewhere around ~1500 requests, based on 2000 requests when all nodes are up)

node 1, 3 + Linode Load Balancer = 790 requests

node 1, 2, 3 + Linode Load Balancer = 1,988 requests

I have a business requirement to run an unorthodox crontab schedule as follows:

Everyday run a script from 1-21

Everyday but saturday, run from 21-0

So I was thinking this would work:

5       1-20    *       *       *       /path/to/script.php
5       21-00   *       *       0-5,7   /path/to/script.php

Or is there a better way?

-- Edit --

Blah this is what happens when you post before morning coffee, there is no 7 in crontab syntax as its 0-6, so the entry should be:

5       *    *       *       0-5       /path/to/script.php
5       1-21   *       *       6   /path/to/script.php

A few days ago I had ntp setup on my network, and everything was running fine. One node was set to sync with upstream servers, and the rest of the nodes from the one set to sync upstream.

Yesterday I updated from CentOS 6.4 -> 6.5 and now all of the ntp functionality has ceased to operate as expected.

In efforts of trying to debug the situation, I ran the following on the upstream server:

$ -> ntpq -pnd
::1: timed out, nothing received
***Request timed out

$ -> ntpq -4 -pnd
1 packets reassembled into response
remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
2 packets reassembled into response
*50.116.55.65    64.246.132.14    2 u   42   64   37   77.742  189.392  14.812
2 packets reassembled into response
 199.102.46.73   .GPS.            1 u   44   64   37   73.786  216.082  18.406
2 packets reassembled into response
 198.60.22.240   .GPS.            1 u   48   64   37   22.617  189.405  15.996
2 packets reassembled into response
 127.127.1.0     .LOCL.          10 l  306   64   20    0.000    0.000   0.000

I get the same results (save for diff ip) on the nodes. It seems, somehow the ntp service is defaulting to ipv6, which I do not have configured. I've read some sites saying to pass -4 to the ntpd service, but how would I do that using chkconfig? Some other readings indicated that I should disable ipv6 via the kernel, but this seems like overkill.

Any suggestions?

For the sake of completeness, adding config file:

driftfile /var/lib/ntp/drift

# Permit time synchronization with our time source, but do not
# permit the source to query or modify the service on this system.
restrict default kod nomodify notrap nopeer noquery
restrict -6 default kod nomodify notrap nopeer noquery

# Permit all access over the loopback interface.  This could
# be tightened as well, but to do so would effect some of
# the administrative functions.
restrict 127.0.0.1

restrict 10.0.0.0 mask 255.255.192.0 nomodify notrap


server 0.centos.pool.ntp.org iburst

server 1.centos.pool.ntp.org

server 2.centos.pool.ntp.org


# In case net access is temporarily down
server 127.127.1.0
fudge 127.127.1.0 stratum 10

Anyone know a clever way to get the last element of an array within a puppet manifest?

Existing code looks like:

class nginx {

    define vhost {

        #-----
        # Init vars
        #-----
        $app_parts = split($name, '[_]')

        # I can access any element using numeric notation
        notify { "Element: ${app_parts[0]}": }

        # How do I access the last element?

I've been Googling around and haven't seen any examples of a more complex hieradata yaml config. Consider this:

# /path/to/hieradata/vhost/config.yaml
vhost_config_melikedev:
  port: 53002
  framework: wordpress
  static_asset_dirs:
    - wp-content

vhost_config_melikedrinks:
  port: 53001
  framework: symfony
  static_asset_dirs:
    - image
    - js
    - css

How would I access the port value for the vhost_config_melikedev entry?

Surprisingly, could not find any clear information on how to delete a range of ports by way of semanage port. Here is a list of permutations I tried:

semanage port -d -t http_port_t -p tcp 0-60000
semanage port -d -t http_port_t -p tcp [1-60000]
semanage port -d -t http_port_t -p tcp 1,60000
semanage port -d -t http_port_t -p tcp 1-60000
semanage port -d -t http_port_t -p tcp 1 60000
semanage port -d -t http_port_t -p tcp 1,60000
semanage port -d -t http_port_t -p tcp <60000
semanage port -d -t http_port_t -p tcp '1-60000'
semanage port -d -t http_port_t -p tcp '1,60000'
semanage port -d -t http_port_t -p tcp 1000-10000

The help message wasn't clear on how to indicate a range:

root@service1 /etc/yum/pluginconf.d # -> semanage -h
/usr/sbin/semanage: 
semanage [ -S store ] -i [ input_file | - ]
semanage [ -S store ] -o [ output_file | - ]

semanage login -{a|d|m|l|D|E} [-nrs] login_name | %groupname
semanage user -{a|d|m|l|D|E} [-LnrRP] selinux_name
semanage port -{a|d|m|l|D|E} [-nrt] [ -p proto ] port | port_range

I am compiling php extensions (memcached and xdebug), and when I run make install, they keep getting installed into /usr/local/php/lib/php/extensions/no-debug-non-zts-20090626. So a few questions:

1. What does no-debug-non-zts-20090626 even mean, and why is it the default?

2. Is it good practice to edit the php.ini file and set the extension_dir directive to the aforementioned directory? Or should I compile each module with a PREFIX=/usr/local/php/extensions? So when I do make install, they are put into a custom extensions directory, then I can add extension=/usr/local/php/extensions/memcached.so lines to my .ini files.

3. Is there ever a risk when compiling a new module, that it will go in a different directory than the directory in question #1?

I have successfully configured and compiled php on my dev server, and works great, but after talking to a sysadmin buddy, he informed that custom compiles of the latest builds are not recommended for production (or even development) systems. He noted a situation where they custom configured and compiled PHP 5.3.6, only to find that there was some issue with a low-level Postgres driver, so they had to revert back to 5.3.3.

So I am considering going back to yum to install PHP, however I have several custom configuration settings and was wondering if it's possible to pass or configure how PHP will be compiled through YUM?

My current configure line:

Configure Command =>  './configure'  '--with-libdir=lib64' '--prefix=/usr/local/_custom/app/php' '--with-config-file-path=/usr/local/_custom/app/php/etc' '--with-config-file-scan-dir=/usr/local/_custom/app/php/etc/modules' '--disable-all' '--with-apxs2=/usr/sbin/apxs' '--with-curl=/usr/sbin/curl' '--with-gd' '--with-iconv' '--with-jpeg-dir=/usr/lib' '--with-mcrypt=/usr/bin' '--with-pcre-regex' '--with-pdo-mysql=mysqlnd' '--with-png-dir=/usr/lib' '--with-zlib' '--enable-ctype' '--enable-dom' '--enable-hash' '--enable-json' '--enable-libxml' '--enable-mbstring' '--enable-mbregex' '--enable-pdo' '--enable-session' '--enable-simplexml' '--enable-xml' '--enable-xmlreader' '--enable-xmlwriter'

I am trying to compile libmemcached (1.0.7) on CentOS6, and keep getting the following warning:

...
checking for event.h... no
configure: WARNING: Unable to find libevent
...

I manually compiled libevent (2.0.19) and built it using the following configure line:

OPTIONS="--prefix=/usr/local/_custom/app/libevent"

Everything compiled and installed fine, but I couldn't figure out how to make the system aware that the lib files are in the custom /usr/local/_custom/app/libevent/libdir. I stumbled upon an article and read that I can make the system aware of custom lib paths by adding a custom file to /etc/ld.so.conf.d/ directory:

# /etc/ld.so.conf.d/customApp.conf
/usr/local/_custom/app/libevent/lib

Then I issued the ldconfig command and was able to confirm that libevent was included by issuing this command:

ldconfig -p | ack -i libevent

Seeing that libevent was now included in the ldconfig output, I figured I would be able to compile libmemcached and satisfy the aforementioned warning. Unfortunately it did not. So I took another look at the ldconfig output and noticed this:

libevent_pthreads-2.0.so.5 (libc6,x86-64) => /usr/local/_custom/app/libevent/lib/libevent_pthreads-2.0.so.5
libevent_openssl-2.0.so.5 (libc6,x86-64) => /usr/local/_custom/app/libevent/lib/libevent_openssl-2.0.so.5
libevent_extra-2.0.so.5 (libc6,x86-64) => /usr/local/_custom/app/libevent/lib/libevent_extra-2.0.so.5
libevent_core-2.0.so.5 (libc6,x86-64) => /usr/local/_custom/app/libevent/lib/libevent_core-2.0.so.5
libevent-2.0.so.5 (libc6,x86-64) => /usr/local/_custom/app/libevent/lib/libevent-2.0.so.5

There are no references to the base links, for example, I would expect to see links to these (ls -la /usr/local/_custom/app/libevent/lib):

libevent.so -> libevent-2.0.so.5.1.7
libevent_openssl.so -> libevent_openssl-2.0.so.5.1.7
libevent_core.so -> libevent_core-2.0.so.5.1.7

So either I am doing something wrong, or the system still does not know where to look to find libevent.so.

-- Update #1 --

I wasn't able to get libmemcached to compile without the warning notice, even after trying to compile using the following configure command:

./configure --prefix=/usr/local/_custom/app/libmemcached CFLAGS="-I/usr/local/_custom/app/libevent/include" LDFLAGS="-L/usr/local/_custom/app/libevent/lib"

I thought for sure this would work because I am directly passing the include and lib directories to the configure command. But it did not.

Is it possible to specify a mirror for YUM to target when doing updates? I've noticed on my CentOS 6.2 servers that it takes up to a minute for YUM to respond from a given command. I did some Googling and found that YUM reads from a timedhosts.txt file, so I viewed the contents and it was pretty nasty. There were 49 lines, 32 of which had a value of 99999999999, which I assume to be a timeout.

There has to be a way for me to specify a mirror I know would be lightning fast (being from SoCal I would like to use http://mirrors.usc.edu/.

I recently upgraded one of my application servers to CentOS 6(.2) and was getting it ready for production use when I can across the following issue; Whenever I try to add a custom http port by way of semanage, I keep getting the following error messages:

libsemanage.semanage_exec_prog: Child process /sbin/setfiles did not exit cleanly.
libsemanage.semanage_install_active: setfiles returned error code -1.
libsemanage.semanage_exec_prog: Child process /sbin/setfiles did not exit cleanly.
libsemanage.semanage_install_active: setfiles returned error code -1.
/usr/sbin/semanage: Could not commit semanage transaction

The command I am trying to run:

semanage port -a -t http_port_t -p tcp 27960

Current kernel:

 2.6.32-220.4.1.el6.x86_64 #1 SMP Tue Jan 24 02:13:44 GMT 2012 x86_64 x86_64 x86_64 GNU/Linux

Current policycoreutils-python:

2.0.83-19.18.el6

And finally, current selinux settings:

SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 24
Policy from config file:        targeted

Anyone come across this issue before? If so how did you resolve?

Thanks in advance

-- Edit --

I checked /var/log/messages and it looks like semanage is failing due to " kernel: Out of memory: Kill process 1648 (semanage) score 769 or sacrifice child". This is odd because I have an near exact clone (on linode.com) with same cpu/mem specs and the command runs fine.

free -t -m on server where semanage keeps failing:

             total       used       free     shared    buffers     cached
Mem:           489         79        410          0          0         11
-/+ buffers/cache:         67        422
Swap:            0          0          0
Total:         489         79        410

I am trying to solve an issue where my HTTPD is denied access to binding custom ports and I believe it has to do with SELinux. Whilst doing some googling I came across some posts where users were typing semanage followed with flags and commands to view certain data. In following these posts I too typed in semanage, but it's not on my system.

Results of yum list *semanage*:

Installed Packages
  libsemanage.x86_64 | 2.0.43-4.el6 | @anaconda-CentOS-201106060106.x86_64/6.0
Available Packages
  libsemanage-devel.x86_64 | 2.0.43-4.el6 | base                                    
  libsemanage-python.x86_64 | 2.0.43-4.el6 | base                                    
  libsemanage-static.x86_64 | 2.0.43-4.el6 | base

Is the binary available in one of these other packages?