thepocketwade's questions

I've got about 10 machines configured with nrpe and Dell's OMSA to report to nagios. For each of those machines, output on the command line from the nagios server a la

./check_nrpe -H $HOSTNAME -c check_om_tag

matches the output I see in the web interface.

I've got one machine, though, that returns successful output from the command line on the nagios server, but on the web interface reports

NRPE: Unable to read output.

Every discussion I can find of the "unable to read output" error assumes that the command always fails, whether command line or web and suggests permissions or SELinux fixes. But the command line success should mean I don't have permissions or SELinux issues. Does anyone have experience with this kind of mismatch?

EDIT:

I'm trying to test some Splunk-y things with my Windows logs. But I want to be sure of the logs that are coming in so I can be sure I'm keeping and discarding logs properly. What I'm really looking for is something like the Windows (7, if possible) equivalent of 'logger' on unix/linux.

I found EventCreate, but as far as I can tell, I'd need to change some of my Splunk configs to use that data.

Does such a thing exist?

EDIT

I should include that my hope is to write to the system and/or security logs. I realize that being able to do that presents some risks, but I'm hoping it's possible.

It's fallen to me recently to sift through Windows logs and do some analysis on them. To start, I'm trying to get familiar with the EventCodes, but I've not had much success finding any comprehensive information on the EventCodes. Does anybody know of anywhere that might have this kind of information?

I did download a spreadsheet from Microsoft, but it had less than helpful explanation of what each EventCode meant.

I stumbled across this question earlier and it got me thinking. Everyone's encountered systems that require you change your password every x days and not reuse any of your last y passwords. This kind of thing has always left me vaguely unsettled -- how are the old passwords stored? Shouldn't old passwords be deleted entirely? Isn't it insecure not to?

Is there something that I'm missing or forgetting to think about here?

At my office I recently wondered aloud to all, "Why shouldn't these logs be redirected to /dev/null instead of /dev/lognull?" I was told that there is (or was) a reason, but no one could remember it. I was told that the reasons is in the syslog-ng documentation somewhere, but so far I haven't been able to find it. Does anybody know the reason?

I'm trying to determine who was recently logged into a specific machine in my office. So I used last, but wtmp begins yesterday (Monday) around 14:30. I was hoping to find info stretching back to Sunday, at least. Is there anyway to get that info without plodding through the authorization log file?

I've seen in subversion tutorials that the way to add a folder to your repo is to do

 mkdir foo
 svn add foo


But running  svn mkdir foo

I was just trying to find a file on my test webserver so I ran "locate foo.conf" and it told me it was in /usr/lib. But then when I went to /usr/lib, I couldn't find the file.

So I tried running "ls $(locate foo.conf)" and it told me that the file didn't exist. Does anybody know why this would happen?

I've heard often that it is better to su to root rather than log in directly as the root user (and of course people also say that it's even better to use sudo). I've never really understood why one is better than the other(s), insight?

I just discovered this today and haven't been able to find any info elsewhere. On one of our labs running Ubuntu 8.04, I tried to switch to a virtual console (Ctrl-Alt-F[1-6]). Instead of switching to the console, though, the machine reboots.

I don't even know where to start trying to fix this, any ideas?

I ran all the updates and messed with the restricted drivers we were using and got nowhere. We're about to roll out 9.04 on our machines and hope that fixes it; if not, I'll be back here, I'm sure.

I'm setting up a console server and I need to determine the correct baud rate of my port. I'd like to do this from the command line, if possible. Does anyone know how?

I'm using Splunk 3.4.10 with the free license on a CentOS machine. I've created a saved form search called "Trace Mail" that I hope to use to trace a single message through my mail servers as it gets new queue IDs. Now, this form search worked until yesterday, now when I try to run it a Splunk error is logged that says "Error while replacing variable name="foo". Could not find variable in the argument map."

The current syntax for my saved search is: ID = ": $first$:" OR ID = ": $second$:" where ID is an extracted field.

When I used ID = ": $first$:" The search completes properly, returning all expected results. Has anyone else experienced this?