New answers tagged

0

The 4027092k cached should explain the memory usage, no? I'm working at the moment on a similar problem elsewhere, and so far I've managed to figure out the memory transfer can be regulated with the following params: vfs_cache_pressure vm.dirty_ratio vm.dirty_background_ratio This is not a complete fix and any feedback's most welcome. I hope it's a right ...


1

Nope. Apache won't be better, however it can do the same work exactly. The canonical way of fullfilling your wish is to create different servers in nginx, and proxy to different backends according to the Host HTTP header, along with passing that header, is necessary: server { listen 80; server_name myshoppingapp.com; proxy_set_header Host $host; ...


1

In Suse start and stop order of services are managed by insserv package and based on dependency with other services. So it is little different. The answer to your question is given in details with examples in the following Suse article: Manipulating the start and stop order of Linux services Under the LSB (Linux Standards Base), the start and stop order ...


0

run sudo zypper install pam_ldap # then you will be able to run the following command with no error. pam-config --add --ldap The following files will be modified by the pam-config command /etc/pam.d directory: common-password common-auth common-session-pc This is the line was added auth required pam_ldap.so use_first_pass


1

Run file transport.db which may indicate some version of a Berkeley DB file; if so, something like db_dump -p transport.db (assuming db4-utils or such is available) would be one way of recovering the data. Another way would be to use some other interface to the BDB format, e.g. the Perl DB_File module or such. If the file is not in BDB format (or uses an ...


0

"sudo -u peter echo ~" will interpret the value of ~ before executing the command sudo. Try sudo -s -H -u peter echo \$HOME or sudo -i -u peter echo \$HOME Also, to view all environment variables set by sudo try: sudo -i -u peter export # actually, use /usr/bin/env instead of export UPDATE When using -i or -s you are implying that the ...


0

The first rule seems correct. The problem seems to be with the second rule. When the packet returns from 192.168.1.231:8080, you want to check that the sport is 8080 (not the dport). You may want to use iptables -t nat -nvL PREROUTING and iptables -t nat -nvL POSTROUTING And check the packet counters in order to undersand what goes through each rule.


0

I would like add more details to above answer in order to start the scrips especially in centos there is no such alternative like update-rc.d in Debain , Easiest way is to change the scripts manually as described here and e.g. code from /etc/init.d/postfix #!/bin/bash # # postfix Postfix Mail Transfer Agent # # chkconfig: 2345 80 30 # ...


0

It may be worth noting that in Debian Jessie with systemd, the -4 option in /etc/default/bind9 may be ignored. See bug #767798. In that case, you need to modify the systemd bind9.service file: Move bind9.service to avoid it being overwritten on updates cd /etc/systemd find . -name "bind*" -delete cp /lib/systemd/system/bind9.service system/ Edit ...


1

You need to specify the -i flag to make sudo read the login scripts & such and set the environment variables as they should be. Without making sudo load the environment, the home environment variable is not updated to reflect the running-as-user.


0

You have the error right there in your output: Feb 8 09:37:24 aname kernel: [1984823.682079] type=1400 audit(1454924244.439:45): apparmor="DENIED" operation="open" profile="/usr/sbin/named" name="/var/log/bind9/query.log" pid=27279 comm="named" requested_mask="c" denied_mask="c" fsuid=109 ouid=0 Add a /var/log/bind9/query.log rw, Stanza to ...


0

It could be done using a bridging firewall. I had to do that at an old workcenter where our department wasn't allowed to create a private network, so I put up a bridging firewall (linux iptables and bridging software) between the link outside our network, and everything inside. You have to do some extra tricks to do it but it works. Here is one link that ...


1

Public vs private doesn't really matter here, you can use either one. However, I think you'll find that it's very tricky to implement what you're looking for without placing your existing servers into a dedicated subnet, private or public, for which the new server/FW acts as a gateway, because that's the most natural way to get traffic to flow systematically ...


-1

This link is explaining about constraint violation, and how to copw with: http://cat.devtwo.org/post/An-SELinux-constraint-violation-(p-1-of-5)


2

I merge them in the configuration file using: shopt -s histappend This is usually enough for me to see session info after the logout (by examining the history file). I also timestamp with: export HISTTIMEFORMAT='%m-%d-%Y %H:%M:%S ' Some people also set the history to reload and popular after each command. I don't, but this is the popular recipe for ...


0

I found that I need. Adding the parameter "-V" in the file "/etc/default/keepalived" keep the VRRP and VIPs on daemon stop. I need this for the configuration changes on our production environment. Thanks!


2

Seeing as how you have hardware RAID, my advice is: Divide the hardware RAID in two logical partitions: Your OS Volume group for any number of logical volumes You will then get a sda (say 50 or 100 GB) on which you can install your OS and an sdb on which you run pvcreate, vgcreate and then 'lvcreate' (read up on logical volumes). I would not put the ...


0

1) 2nd option is more fault tolerant. 2) You should arrage hardware RAID first, then pattition but not vice versa.


3

An alternative will be to change the line starting with # chkconfig: in the service init script directly. This is explained in the chkconfig(8) man page. Runlevel Files Each service which should be manageable by chkconfig needs two or more commented lines added to its init.d script. The first line tells chkconfig what runlevels the service ...


0

You can manually rename symlinks in your /etc/rcX.d directories to change boot order. UPD: Under RHEL / CentOS you use command called ntsysv or chkconfig.


0

Reference to xvda is in your xen config. For example: # Created Mon Oct 12 08:38:43 CEST 2015 name='clone0' kernel='/etc/xen/vm-kernels/vmlinuz-3.2.0-4-amd64' ramdisk='/etc/xen/vm-kernels/initrd.img-3.2.0-4-amd64' memory=256 # Networking nics = 1 vif = [ 'bridge=xenbr0' ] disk = [ 'phy:/dev/vg0/clone0.root,xvda1,w', # there you can rename device ...


0

Simply change the ownership of the file: chown bind:bind /var/log/bind9/query.log


2

On my VPS, I want to block access of certain IP addresses to the whole server. Use a firewall e.g. iptables -I INPUT -s 192.0.2.1 -j DROP or iptables -I INPUT -s 192.0.2.1 -p tcp --dport 80 -j DROP Also if I want to block a whole range of IP addresses, ege 123.123.123.[0-255], how would I do it? iptables -I INPUT -s 192.0.2.0/24 -j DROP or ...


-1

Single Bracket i.e. [] For comparison ==, !=, <, and > and should be used and for numeric comparison eq, ne,lt and gt should be used. Enhanced Brackets i.e. [[]] In all the above examples, we used only single brackets to enclose the conditional expression, but bash allows double brackets which serves as an enhanced version of the single-bracket ...


1

This is way out of scope for the New Relic agents and what they can offer. There are plugins available for New Relic, but this type of task (software inventory) is better suited to another application. I'd place it in the realm of configuration management.


0

If I understand correctly, you want to resolve your domains to public IP addresses for the clients that reach them through WAN, and to local IP addresses for your LAN clients, that reach your domains through LAN. If so, then yes, it's possible with named and it's called views. Check this article for examples: Understanding views in BIND 9, by example


0

My situation is very similar to the one described by @telemaco. I have some test VMs running on KVM on my laptop computer. My laptop receives its IP address via DHCP, thus the VPN endpoint IP address is assigned by Strongswan to my laptop via leftsourceip=%config. The VMs use a private network 192.168.100.0/24. My laptop (KVM host) receives the IP address ...


0

Place the root administration machine into the room locked with two keys, and give only one for each of the two admins. The admins will always work together, observing each other activities. It should be the only machine containing the private key to login as root. Some activities may need no root rights, so only part of the work would require to go to ...


5

The kernel documentation says it best: Sometimes it happens that a request enters the io scheduler that is contiguous with a request that is already on the queue. Either it fits in the back of that request, or it fits at the front. That is called either a back merge candidate or a front merge candidate. Due to the way files are typically laid out, ...


1

Red Hat says: front_merges: You can set this tunable to 0 if you know your workload will never generate front merges. Unless you have measured the overhead of this check, it is advisable to leave it at its default setting (1). So the recommended setting is to leave at default. I can tell you that I don't usually modify this setting in my tuning ...


2

You'll need to ensure your Linux servers are CIM enabled and then use the CIM powershell cmdlets to interact with the Linux server remotely. You can read more about it here: CIM Cmdlets for Non-Windows OS If you're new to CIM, as in this is the first you've heard of it, you'll want to familiarize yourself with what CIM is and how it works. Then attempt ...


0

You could assign the service.vars.backup_downtime value "22:00-24:00,00:00-05:00" so that you get downtime from 22:00 to 05:00 the next day. ie. service definition will be: apply Service "foo" { display_name = "foo process" import "generic-service" check_command = "foo-process" command_endpoint = host.address vars.backup_downtime = ...


2

As fruglemonkey said 1 sec is a bad choice. Try at least 5 sec mean. It will help to have more consistent graph. Of course you can show both data ;-) I can't see anything wrong on your math. But I suggest you to track number of packet/s too. This metric is a lot of important to understand problems. Is not rare you have pps limit reached with low traffic on ...


0

You can use a flexible and strong solution which support clustering, multipathing, multi plex and cache like VXFS (Veritas Storage Fundation ) with SF-CACHE. If you improve writing collisions or fs corruption, it is possible to rebuild the filesystem with the redologs of VXFS and it is also possible to rebuild a scratched diskgroup if there are some ...


0

All variables looked quite normal. However, I wrote a cronjob to output the date/time and filedescriptors every minute, and found the filedescriptors to be within normal values. However, at 3am, the servers clock suddenly went 2 hours back in time(took me a while to notice that from the logfile), and then it died without any errors in logs. It turned out to ...


0

Using the TCP option does not guarantee that your file will be received intact. TCP only provides 16 bits of error protection. That means that 1 in 65,536 transmission errors will get through. To safely transmit files between systems you should calculate a hash of the entire file before sending and validate it after reception. If you are doing that, ...


2

I have done this using a combination of TC and iptables hashlimit. I created a TC bandwidth limiter outbound on the LAN interface (to target download traffic) set to 5 Mbits/second. I then use the iptables hashlimit module in the interface's output mangle chain such that if the packet rate exceeds a certain threshold, between any two distinct source and ...


2

Debian Linux and its derivative (Ubuntu, Mint, etc) have some peculiarities that may prevent your cron jobs from executing; in particular, the files in /etc/cron.d, /etc/cron.{hourly,daily,weekly,monthly} must : be owned by root only be writable by root not be writable by group or other users have a name without any dots '.' or any other special character ...


0

configure your receive connector in exchange management console(EMC)>server config>hub transport>"name of your receive connector" to accept communication on 25, set your local addresses to recieve mail from all v4 IPs, on port 25 and your remote servers that has your IP on the linux machine: x.x.x.145 for basic testing use auth TLS and permissions ...


1

you can solve this problem in a simple way, try to use recent module with iptables, recent keep track of the source address: iptables -m recent -h recent match options: [!] --set Add source address to list, always matches. [!] --rcheck Match if source address in list. [!] --update Match if source ...


0

You might be able to solve this using the connlimit module: http://www.cyberciti.biz/faq/iptables-connection-limits-howto/


0

I would take a look at the smbstatus command. There you could grep for READ/WRITE locks (e.g.) smbstatus | grep RDWR Add sed or awk magick to get to the file name.


1

The poster who referred to SElinux hit the nail on the head for my problem, I don't want to use selinux but had forgotten to disable it, and server came up with selinux enabled on boot. ssh -v Debug helped. The key is accepted: debug1: Found key in /var/lib/amanda/.ssh/known_hosts:19 debug1: ssh_rsa_verify: signature correct And then I get the error ...


1

If the Squid is listening on port, let's say 3128, you can list all connected IP addresses to this port by using command like netstat in the server. For example: netstat -na | grep :3128 will display something like below: tcp 0 0 0.0.0.0:3128 0.0.0.0:* LISTEN tcp 1 0 10.12.0.1:3128 ...


1

The hplog -v command will show you the system event log on servers that have the health management agents installed.


-1

Change the permission to squid analyzer location to chmod 644 -R /location-squid-analyzer Also check the cache.log chmod 644 and no need of cache to change make sure you given cache effective users in squid.conf with user you trying to access log files.


3

That level of latency is just fine for talking to a database. Many high traffic sites use a similar architecture and may even have higher latencies to their databases. I wouldn't worry about that. The only thing I would worry about is whether others can sniff the traffic. On OVH's network it's not likely, as their switches generally don't flood unwanted ...


1

We do it by creating a file /etc/profile.d/notify.sh with the following content: #!/bin/sh sender="hostname@example.com" recepient="admingroup@example.com" subject="Privileged Account logon used" message="`env`" echo "$message" | mail -s "$subject" -r "$sender" -S smtp=mail.example.com "$recepient"


0

I'm thinking this question might not be possible to answer fully without some more details, such as: How many sysadmins do you expect to keep "restricted"? What do people need "sysadmin" access to do? First of all, be aware of what you can do with sudo. With sudo, you can permit elevated permissions to run only a single command (or variations, like ...


1

Depending on the cron version/type you are using, the output from the command usually gets sent via email to someone. In the traditional style you can put MAILTO=your.login or maybe even MAILTO=your_email@example.com and get the output from the script. In the worst case try 0 */3 * * * /usr/bin/php /var/acme/cron/api_update_db.php > ...



Top 50 recent answers are included