I am trying to query IP addresses from Forefront Firewall logs, and I am a little stuck on the IP formatting
C0A8E008-FFFF-0000-0000-000000000000
Can anyone give me the MSSQL command to turn this into standard human redable?
UPDATE, I now see that I kust need to convert the first 8 charecters from hex to decimal....which I can then convert to IP. the trick is to parse those first charecters from the field with SQL
When attempting to import new AD users (Shared Services Administration > Shared Service > User Profiles and Properties) I receive an error on the top of the User Profiles and Properties page.
"An error has occurred while accessing the SQL Server database or the Office SharePoint Server Search service. If this is the first time you have seen this message, try again later. If this problem persists, contact your administrator."
I have tried the following:
I have 2 fortinet firewalls (fully patched); fw1 is providing an IPSEC tunnel in transparent mode. beneath this firewall is a fw2, a NAT firewall with a VIP address that has been confirmed to work. This configuration is required for my customers who want to connect to a public address space inside of the tunnel, in order to prevent cross over in IP space. This configuration works great for traffic going outbound to the remote side of the tunnel, but not inbound. While sniffing the traffic, I can see the inbound traffic going out of the fw1, but it is never seen at the fw2.
Cust Net > 10.1.1.100
|
|
|
FW1 >TRANSPARENT IPSEC
|
|
|
FW2 EXT >99.1.1.1.100-VIP
|
FW2 NAT >192.1.1.100-NAT
I have 3 full trust domains (2 child and one root). I need to use LDAP to allow authntication for domain users. The trick is that I need the application to use an AD server for the child domain BUT proxy the LDAP query and authentication for the root domain. I see that it maty be possible with AD LDS and some trusts and synching, but it looks pretty hairy and overly complicated.
The short of it is:
I have a a requirement to analyze 13gb of Windows logs by feeding it into a LogLogic Log aggregator. LogLogic is essentially Linux Syslog server, it can take a Syslog (Tcp/udp 514) feed or log on to a windows share and pull a flat file log. The only problem is that it cannot read the binary .EVT files from Windows Event logs.
Normally, I would use Lasso to end the logs to a loglogic as syslog, but it has to read the logs from WMI and uses the DLLs on the log source host to format them and transmit them as syslog in the formatting that LogLogic expects.
Does anyone know:
A. Is there some kind of product out there to do this?
B. Is there some way to import them into a Windows event veiwer in a way that lasso (or snare for that matter) will see them as actual real event logs on that host and forward them to the loglogic device as syslog.
I have a network with 10,000 workstations that are all currently trying to download SP3 and are flooding the network (this was do to an errant AD policy change). What is the best way to block this traffic at the network level with either firewalls, Web Content Filtering or inline IPS? Is there a good list of IP addresses out there that is current for Microsoft update servers?
The trick is that we have to do this quickly since the network is flooded. We can't wait for a policy change...
I am using the incoming mail feature of SharePoint 2007 to catch mail from the drop folder and add it to a configured list. We have multiple systems that send automated reports to SharePoint every night, and for some reason it only handles some of the attachments.
For example, an automated email was sent to a SharePoint list with 23 attachments (before you ask, the total size of the combined attachments was less than 1 MB and I have removed all size restrictions from Exchange 2007). Out of the 23 reports, only about 5 were turned into a document item in the list.
The results of this are sporadic and unpredictable, but it always works for some of the attachments and usually not all of the attachments. The lists are configured not to overwrite existing copies of the reports, and I have noticed that SharePoint renames the files by placing a 4 digit number at the end of the name (since each day produces the same report titles).
I have been looking through logs for days and can't seem to come up with an explanation.
Update - I found the following in the Event Logs:
An error occurred while attempting to create an attachment for an item sent via e-mail. The e-mail was sent to the list "Reports", and the error was: Object reference not set to an instance of an object..
I have about 3.6 'Terabyte' drive that is used for the root of the filesystem. When I look at the Disk Usage Analyzer, it shows that only about 1 'Terabyte' of that space is used. I have a 2 Terrabyte USB drive that is mounted to /media/disk. Whatever amount of data I store on this disk seems to be counted as used space on the root drive path. So the USB drive has 1.5 'Terabyte' of data used and the disk usage analyzer still only shows the 1 tb of space youed on the inteernal root drive, however a DF reveals that there is only less than a 'Terabyte' avalable on the root drive. Also, when I dismount the USB drive, I can still read and right the data to the /media/disk directory, so I am sure that Linux is keeping a temporary copy on the main file system.
Am I crazy or is this really how it works? Does it really store a copy of the data on the USB drive somewhere on the primary root drive? How can I change this or can you change it?
I am using rsync on a linux system to synchronize a directory between the local disk and an attached USB drive. The problem I am experiencing is that the 3rd party system that creates the backup daily on the server actually changes the name of a directory nested deep in the backup. This directory has the majority of the data required in the backup. When rsync looks at the directory, it sees that the name has changed and considers it to be a totally new directory. So my rsync copy on the USB drive has a new directory for every day that it runs.
I have written scripts that will actually change the directory name back, but it is a cumbersome way to do it!
I am looking for an "elegant" way to deal with this. Is it possible to create a link to the directory that remains constant? Can rsync be configured to detect that the directory is the same even though the name is changed? I am sure someone has had to deal with this before!
The following Shell script is used to check and see if a backup directry is named "ll_backup", then changes it to equal the content of a file RESULT.VAR. The result.var file is copied for log purposes to another directory. I had this working in a test enviorenment but in production it throughs a weird error that I can't for the life of me figure out!
#!/bin/bash
#!/bin/cat
# Restores original directory name for next LogLogic Update
#TCJ 6/1/09
declare RESULT
declare FILE
FILE=result.var
cd /home/nb-backup/backups/nb-st3000/ll_bkup_65.99.220.172/
if [ -d ll_bkup ]
then
cat result.var | while IFS=: read RESULT
mv "ll_bkup" "$RESULT"
mv result.var /home/storegrid/scripts/results/result-`date +%y%m%d%s`.var
else
exit 0
fi
exit 0
nb-script-restorellbackup.sh: line 14: syntax error near unexpected token
else' nb-script-restorellbackup.sh: line 14:else'
I recently had to acquire a new CA cert for my Exchange 2007 server for OWA and Outlook Anywhere (RPC over HTTPS). Since then, all Iphone access to Exchange accounts has broken. I have tried deleting the email account on the iphone, rebooting and reconfiguring accounts (thinking it needed to clear some cache related to the certificate). On entering the new account, Iget"Exchange account verification failed"
I am using a Dell Powerconnect 6248 (layer 3 48 port gigabit Switch) and a Fortigate 310. I am attempting to use the switch in layer two mode and assign a vlan to each port where a server is attached and a "Trunk" line directly connected to the fortinet. on the Fortinet, I have virtual interfaces designed to match the vlan's for each port. The Goal here is to require any communications from server to serverto be evaluated by policiesdefined for the virual interfaces that corresponds to the vlans for the servers attempting to communicate.
So essentially, server A wants to talk to server B. Server A is in port 2 (defined as vlan 2) and Server B is in port 3 (defined as vlan 3). The firewall is attached to the switch port 1, and has virtual interface A (defined as vlan2) and virtual interface B (defined as vlan3). I have a policy that allows virtual interface A to communicate with virtual interface B. All of the server Apackets should flow up to the firewall and be passed back to the switch with a new vlan tag to go to the server B.
My question is, should port 1 on the switch be defined as a "TRUNK" and if so what is the method for doing so (docs are weak)? is there anything else I need to consider here?
THANKS!