Tag Info

Hot answers tagged

22

What exactly do you need? wireshark - network sniffer/analyzer iftop - bandwidth usage darkstat - traffic analyzer nmap - network port scanner nessus - vulnerability scanner metasploit - penetration testing


18

When the computer bluescreens it'll most likely create a dump of the memory. The content from memory is written to the Pagefile as the system is going down. It uses the Pagefile as placeholder for the data since it is too dangerous to try to create a new file on disk. When the machine starts up again it'll detect the dump, and move the data into a separate ...


18

In depsite of people got used to netstat for such kind of operations, it's good to know, that Linux has another great (and, actually superior) networking tool — ss. For e. g., to find out which process has opened port 80 you run it so: sudo ss -pt state listening 'sport = :80' so there's no need to pipe through external filters. Surely it has lots more ...


15

In terms of analysis, there's nothing wrong with Wireshark. In fact, many enterprise products make use of Wireshark's code. I think where things change are how captures are done in larger environments. Whereas in smaller shops, if you need to run packet captures, a laptop running Wireshark is fine. However, once you get to larger environments with higher ...


12

In the log files analyzer domain, these are the most widely used: AWStats Webalizer Analog W3Perl Analog and Webalizer are written in C and are the faster (10000-20000 lines per second). As mentioned earlier by @MadHatter Analog has been developed by an ex-Cambridge statistician, that makes Analog a really precise and technical tool, but since the ...


7

I'm not sure but the following changes in operating_systems.pm seem to work for us. Only the iPod didn't work in the OS section, it should be incl. under iPhone ...(not sure) in @OSSearchIDOrder add '[_+ ]cpu[_+ ]os', #iPad 'iphone[_+ ]os', before 'mac[_+ ]os[_+ ]x', in %OSHashID add '[_+ ]cpu[_+ ]os','maciosipad', 'iphone[_+ ]os','maciosiphone', ...


7

Mark Russinovich (of SysInternals fame) has an excellent blog entry where he describes how one can use the debugging tools to track down the module name and even the stack frame (i.e. function call) during which the blue screen occurred. It's illustrated, well written, and has helped me get my feet under me when I started learning how to debug Blue Screen ...


7

How about this? grep 'on line' /var/log/httpd/error_log | cut -d' ' -f6- | sort | uniq -c | sort -nr I.e. Get the right lines from the logfile Chop the date off the front Sort them Aggregate and count the duplicates Sort by number of duplicates


5

For completenesss, I'll also throw in a suggestion of Webalizer, although it's been a while since I used it last. (My more recent experience has been with the already-mentioned AWStats.


5

cat file_with_ips | sort -nr | uniq -c | sort -nr -k 1 will sort desc by ip counts, showing the counters on first column e.g. root@pinkpony:~# cat /tmp/xx 123.33.22.33 221.23.128.2 123.33.22.33 92.222.192.12 92.222.192.12 123.33.22.33 root@pinkpony:~# cat /tmp/xx | sort -nr | uniq -c | sort -nr -k1 3 123.33.22.33 2 92.222.192.12 1 ...


4

For basic crash dump analysis no particular skills are needed. If you can follow the instructions and open a dump with crash then you can do some basic diagnostics without any in depth knowledge of the kernel. However, for anything beyond the basics you're going to need to know how to debug code using gdb, develop a good knowledge of kernel structure and ...


4

Doesn't look like there's any analytics code on there, so that's most likely the problem. :-) Copy and paste your code from the analytics site to your website and paste it down near the BOTTOM of the page before the ending </body> tag. Also, I don't think you're going to see any reporting right away. I think it takes 12-24 hours before you start ...


3

I appreciate that it doesn't always suit to have mod_status available and on all of the time, but it and apachetop are the best ways to diagnose these problems. However there are many ways to skin a cat. This trick is useful in a number of circumstances and isn't just Apache specific. It does depend on a number of factors however, and you need to know what ...


3

You haven't found any metrics because they don't exist. There is no such thing as a "typical" LAMP setup, given the variances in database schema, data quantity, code quality, and a million other things. That being said, unless your 5000 UV/day are each doing a lot of page views, a shared hosting plan should do the trick nicely. I wouldn't necessarily be ...


3

Source ports and destination ports are normally going to be different. This is normal. When you connect to web site as a client to destination port 80, the OS will likely give the packet a high number source port that is maybe random. Go read about Ephemeral Ports. This aids in the OS keeping track of which session is which.


3

You might check out crm114. It's commonly used for spam, but can be directed at other stuff as well, like information firewalling. It's installable in Debian: Description: versatile classifier for e-mail and other data CRM114, the Controllable Regex Mutilator, is a system to examine incoming e-mail, system log streams, data files, or other data streams, ...


3

To expand on Niall's answer, you might try tshark -r <capture file> -q -z conv,ip The -q disables normal output and -z conv,ip dumps the IP conversation data. More information can be found in the man page and in Sake Blok's Sharkfest presentation.


3

Roll 3d6 for savings, and 1d20 as a saving throw against not actually saving anything. Or, to be a little less facetious, there's no guarantee that you'll save anything using EC2. It depends on your IO, availability, and traffic profiles. Be careful not to underestimate the hard-to-estimate bits in EC2's cost calculator -- do you know how many IOPS you do ...


3

Have you tried Wireshark's own "statistics" tools. You have some pretty nice tools to do endpoint conversation analysis (somehow similar to netflow), IO graphs, per protocol statistics, protocols hierarchies, flow graphs, packet length distributions plus several others. Also, many of these tools accepts Wireshark's filter syntaxis so the drill down you can ...


2

I've been banging my head against this problem all day, with no solution found. You can turn up the debugging of the NFS server, but that doesn't provide much detail (if that exmaple is accurate) and will probably dominate a busy NFS server's disk with useless baggage logged in addition to the bare filenames. Another solution is adding rules to ...


2

Find which partition the sector is in by running fdisk -lu /dev/sdb. Suppose it is "sdb2" which starts at sector 45612307. Subtract that from 95891008 to get 50278701. Next determine how many sectors per block: tune2fs -l /dev/sdb2 | grep Block. Suppose it is 4096. Calculate the block / sector ratio: 512 bytes/sector / 4096 bytes/block = 0.125 ...


2

rsyslog can work pretty well, and if the amount of data that you are attempting to log is small enough you can even get away with using the free version of Splunk. The full version is probably a more comprehensive solution that maybe in line with what you want to accomplish saving you the time of developing your own in house monitoring tools. At my work ...


2

Jason, you mentioned an interest in using Ganglia to monitor your Apache web servers. Have you considered using mod-sflow with Ganglia? Using Ganglia to monitor web farms mod-sflow Recently, active, idle, max worker metrics have been added. While Ganglia is great for trending cluster metrics, you will need to use a log analyzer to report on the detailed ...


2

MSDN subscribers get up to four technical support tickets per subscription year. Without a solid reference to what you are referring to, this is likely the support that you read about. Open a ticket up with Microsoft, tell them your problem, and submit your dump file. They're usually very thorough in their ticket resolution.


2

FWIW, Slicehost is now Rackspace Cloud Servers I believe. I use Rackspace currently for a couple of sites. One of the great features of a "cloud" style VPS like this, is that you can provision more resources as needed. So you could start with a 256MB slice and then bump it up to 512 right from the control panel. You only pay for the resources you use (on ...


2

I have been working on putting in database schema linting support into SchemaCrawler. SchemaCrawler comes with several linters for common database design issues, as well as the ability to extend them with your own checks. SchemaCrawler also automatically detects what seem like foreign-key relationships, even if a foreign-key constraint is not defined. ...


2

Maybe try out piwik its a Google Analytics clone that easy on the eyes, and has several plugins for adding additional functionality. demo site can be found here: http://piwik.org/demo/index.php


2

squid deployed as a transparent proxy (everything outoging TCP/80 redirected through it) without an on-disk cache (usually pointless on today's bandwidth, but you can use it if you want), with access logging turned on, then periodically run SARG from a cron job on the log files. Haven't had complaints from management about the solution. Edit: Ah, didn't ...


2

There are plenty of good reporting tools that can be used with squid. Lightsquid is pretty lightweight and will do what you want. It also has an online demo.



Only top voted, non community-wiki answers of a minimum length are eligible