Ryan Detzel's questions

I have a file server that files get dumped on through-out the day. They can be any size, any type, etc. I then want to sync those files down to a remote backup server but the trick is once they're on the backup server they get renamed and moved so a simple rsync won't work.

Currently I keep track of what files I've downloaded by running an ls on the dir and saving that locally after I sync them. Then when I run the job again I rsync files by excluded the files in that list. This works for the most part but sometimes a file with have an odd character and the re-downloads. Also, if for some reason the network flakes out and the "ls" fails next time it will try and re-download everything because the exclude list is empty.

Is there a better way to do this?

Is there a better way to do this? I can't find a way to nest or apply boolean operators to conditions in nginx.

Basically if there is a cookie set(non-anonymous user) we want to hit the server. If the cookie is not set and the file exists we want to server the file otherwise hit the server.

        set $test "D";
        if ($http_cookie ~* "session" ) {
            set $test  "${test}C";
        }
        if (-f $request_filename/index.html$is_args$args) {
            set $test  "${test}F";
        }
        if ($test = DF){
            rewrite (.*)/ $1/index.html$is_args$args?
            break;
        }
        if ($test = DCF){
            proxy_pass http://django;
            break;
        }
        if ($test = DC){
            proxy_pass http://django;
            break;
        }
        if ($test = D){
            proxy_pass http://django;
            break;
        }

Is this way too high? How can we improve this?

We're having complaints from user that emails are showing up in their spam folders. I've checked some of the headers but I can't get a straight answer as to what to check for and what they really mean. Is there a tool I can use to check our emails and possible fix them?

The load has been sitting at around 6 but there is very little running on the box. Any ideas what's causing this? It's a large AWS instance.

procs -----------memory---------- ---swap-- -----io---- -system-- ----cpu----
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa
 0  4      0 4815700 179440 548200    0    0     0     3    2    3  5  1 91  0
 0  4      0 4821256 179444 548192    0    0     0     0  228  373  1  1 48 48
 0  4      0 4821296 179444 548196    0    0     0     0   96  150  0  0 50 50
 0  4      0 4822832 179444 548200    0    0     0     0  158  197  1  1 49 49
 0  4      0 4823452 179444 548200    0    0     0     0   98  149  0  0 50 50
 0  4      0 4823452 179444 548200    0    0     0     0   94  149  0  0 50 50

I've been following a few spiders in our logs and I did a traceroute on their ip to find out they are in fact EC2 instances. The user agents are listed as Google bot and msnbot but they are not Google or MS ip's. Is there anything I can do, is spoofing user agents a common practice? I'm guessing that if I ban their ip(which I've done) they will just start a new instance and carry on. I don't want to ban all EC2 instances though.

I have a location block for / that does all of my fastcgi stuff and it has a normal timeout of 10s. I want to be able to have different timesouts for certain files(/admin, sitemap.xml). Is there an easy way to do this without copying the entire location block for each location?

location /admin{
 fastcgi_read_timeout 5m;
 #also use the location info below.
}

location /sitemap.xml{
 fastcgi_read_timeout 5m;
 #also use the location info below.
}

location / {
            fastcgi_pass 127.0.0.1:8014;
            fastcgi_param PATH_INFO $fastcgi_script_name;
            fastcgi_param REQUEST_METHOD $request_method;
            fastcgi_param QUERY_STRING $query_string;
            fastcgi_param CONTENT_TYPE $content_type;
            fastcgi_param CONTENT_LENGTH $content_length;
            fastcgi_pass_header Authorization;
            fastcgi_intercept_errors off;
            fastcgi_param  SERVER_ADDR        $server_addr;
            fastcgi_param  SERVER_PORT        $server_port;
            fastcgi_param  SERVER_NAME        $server_name;
            fastcgi_param  SERVER_PROTOCOL    $server_protocol;
            fastcgi_param  REMOTE_ADDR        $remote_addr;
            fastcgi_param  REMOTE_PORT        $remote_port;
            fastcgi_param  HTTP_X_FORWARDED_FOR $http_x_forwarded_for;
        }

My django app saves images and they're being saved as nobody:nobody instead of www-data: like they previously were under a different server. nginx is setup as user www-data and I ran the manage.py runfcgi as root so permission shouldn't be an issue.

The issue I'm having is I want to upgrade that instance often(security patches, etc) but I'm affriad something will fail and the site will be down. So, I want to have another server setup and load balance between the two that way I can easily disable one, upgrade it and once it's working add it back in the mix and repeat. What kind of machine is needed for a load balancer? Would the micro instance work just fine? The site gets anywhere from 3-10k hits/day.

I plan on using nginx as the load balancer.

Web server: us-east-1a DB Server us-east-1b

The ping between them is under 2ms so I'm guessing it's fine but I wanted to check.

I'm using Cherokee(uwsgi) with Django and my timeouts are ridiculous(according to Cherokee). How can I track down what pages are causing these timeouts?

We have three main servers on ec2, web, database, and search. I logged in today to find:

77 packages can be updated. 45 updates are security updates.

which scares the crap out of me so I want to update these machines asap but I'm scared to just run the updates on a live running system. Is this safe to do, what's the best approach when it comes to doing security updates on production machines?

This started a few weeks ago and we thought it was a virus so we checked every computer and all though 50%(Yeah, that's right) were infected once they were cleaned the problem didn't go away. It's really frustrating so I want to figure it out so I need suggestions on how to find the culprit. I think the router has logging but it logs everyone so it's hard to tell and I might be able to setup a proxy but again it's hard to tell when and what to monitor. What are your suggestions?

We have our log files gzipped to save space. Normally we keep them compressed and just do

gunzip -c file.gz | grep 'test'

to find important information but we're wondering if it's quicker to keep the files uncompressed and then do the grep.

cat file | grep 'test'

There has been some discussions about how gzip works if it would make sense that if it reads it into memory and unzips then the first one would be faster but if it doesn't then the second one would be faster. Does anyone know how gzip uncompresses data?

We currently have a T3 line for about 28 people and it gets deadly slow during the day so I need something to help track down why. I'm assuming someone is downloading something that they may not be aware of.

We are using the basic Verizon router but it sucks so we're looking for a new one that allows us to limit users and our hadoop cluster to certain limits. Our problem is one person can start downloading something and kill the network and every hour we download logs into our cluster but it floods the network unless we rate limit it. Ideally we want to be able to say:

• total: 35 mbps Hadoop Cluster (15
• mbps) Phones (1 mbps) Office(25
• people) (19mbps but no one machine can have more than 5mbps)

So looking over the logs the average response time is around 20-30ms but the load on the machine is 20+ and using an external test things seem to take over a second to load. I can't imagine this is all network latency so I'm curious at what point the apache logs start to track the request. If the load is at 20 does that mean things are waiting in line to even get to the acpache process but once they get there it only takes 30ms to process?

It's a dual-core machine and the load is around 24 but CPU usage is bouncing around from 60-80% and never reaching 100% so how can there be that many processes waiting? I/O is pretty much nill since everything is being read from memory databases and the network is only using around 7mbit from a gigabit connection. Would adding additional cores reduce the load or is the CPU not the issue since it's not even topping out?

We have 25 instances with one load balance on Ec2. If we hit any single one the speed is fast(<300ms) but if we us AB to test multiple connections we get poor results often with an average of 1800ms. Does anyone know if this is EC2 limiting us, we're only hitting these servers from 27 outside servers with about 2 million requests and hour so maybe they think it's a DOS?

We're going to purchase some new hardware to use just for a Hadoop cluster and we're stuck on what we should purchase. Say we have a budget of $5k should we buy two super nice machines at $2500/each, four at around $1200/each or eight at around $600 each? Will hadoop work better with more slower machines or fewest much faster machines? Or, as like most things "it depends"? :-)