Tag Info

Hot answers tagged

12

Yep, that'll about do it for you. Using the -T{traceflag} startup parameter, that is.


12

You don't need any third party software. You need to turn on object access auditing and set the auditing options on the file(s) and or folder(s) you want to monitor. This article explains the process for Windows XP but it's the same for W2K3. http://support.microsoft.com/kb/310399


8

This is the way I use these words. Others may have additional or different usages. Depending on the job at hand, I will use the terms differently. Development teams and operations teams have different needs an usage. Monitoring is monitoring. Usually it is ongoing, and preferably automated. Open source tools like Munin, Nagios, and MRTG fall into this ...


5

Something that I learned the hard way is that you have to have semicolons before each trace flag. For example, if you were enabling logging of deadlock info to file, your example would become... -dD:\MSSQL10.MSSQLSERVER\MSSQL\DATA\master.mdf;- eD:\MSSQL10.MSSQLSERVER\MSSQL\Log\ERRORLOG;- lD:\MSSQL10.MSSQLSERVER\MSSQL\DATA\mastlog.l ...


5

In 99% of cases, the penultimate hop of a traceroute will not be the default gateway of the destination host. This is because of the way that traceroute works. All IP packets have a -somewhat misnamed- time-to-live (TTL) field. This field is decremented by one by every router that forwards a packet. If a router decrements the TTL to 0, it drops the packet ...


5

If you've got a non-Windows machine, whois <ip> is your first step. This will tie the IP to a network and possibly even supply you with an 'abuse' contact, usually an email address. You can email an abuse report there. You can also try nslookup <ip> to get a domain name, and look that up on abuse.net. If you're running Windows start with ARIN's ...


5

Seems like a job for SystemTap, the SystemTap beginners guide by Red Hat has some disk and IO sample scripts to get you started as does sourceware.org.


3

The ISP that owns the IP is the only group that really know the identity of the person registered to an IP. The best info you can hope for is what you can get from dnsstuff. If the matter is serious and you want something done about it, then your only option would be to report it to the police. You could drop everything from that IP address in your ...


2

Depending on the attack, (DoS, certain port scans, etc), the IP Address will most likely be spoofed. And, as others have already stated, even if you do get a valid (non-spoofed) IP, most likely the end host is a compromised machine that is being used as a stepping stone/ relay. Also, never "hack-back" This is unethical, most likely illegal where you live, ...


2

A TCP trace works in much the same way as a more traditional trace, except that instead of sending out ICMP ECHO or UDP packets (which are often blocked by firewalls and load balancers) with an increasing TTL (time-to-live) in each subsequent batch of packets, it sends out TCP SYN packets, again with an ever-increasing TTL until a response is received from ...


2

Okay, well it looks to me like the latency comes in with the TATA communications network. So your provider KEMS Peers only with TATA communications. If another ISP peers with a different provider in your area (Kuwait?) then maybe you will get better performance. If the other ISPs still peer with TATA it looks like you won't do any better with them unless ...


2

It's not necessarily Apache's configuration that's doing this - is Apache handing the request off to a dynamic content generator? Look for two things in your Apache config; Redirect, and RewriteRule directives that have an R flag. If those aren't in place, then Apache isn't doing the redirect (with the exception of /directoryname redirecting to ...


2

This suggests you are running your database server and your web server on the same box and they are connecting using the socket rather than via the network. To achieve what is shown in that article, you will need to change your web-app's connection string so that it uses the network.


1

Have you tried using -f ? It tells truss to follow any children the original command spawns. I'm not sure if that will work because the tar command isn't actually spawning the gzip command. The other option that might work is: truss -leDo /tmp/truss.tar.out tar cvf - dirs/ | truss -leDo /tmp/truss.gzip.out gzip -1 > archive.tar.gz Again, however, I ...


1

I discovered that the URL_CACHE_ACCESS_END trace entry happens before the ASP.NET page process is complete, and HTTPSYS_CACHEABLE happens after it's complete. I discovered this by adding a 5-second sleep into my code and then comparing the traces with and without the sleep. The sleep's delay appears in the HTTPSYS_CACHEABLE timestamp. So, this is not an IIS ...


1

Disclaimer: i haven't done this before. I think syslod is the deamon for logging in *nix systems, maybe there are better ones. But essentially works for similar goals. I think if your application can be configured to use syslogd instead of they having their own logging file then i think you can have a centralized place to see , compare all the logs. This ...


1

For Windows you can use: http://code.google.com/p/ospy/. In Linux you have strace.


1

What SQL Version? Post SQL 2005 you can create a logon trigger and log all logon event into a table. The eventdata() and sys.dm_exec_connections will contain some, if not all, the detail's you're looking for.


1

I think that your idea of running a trace for a while is the best idea at this point. There is no other way of finding this info out definitively - you can't know what clients "might" connect, you can only see what clients "do" connect. Some things may help you guess though: Make a list of all the databases. Try to figure out that applications are likely ...


1

You might want to take a look at WireShark. You can install it on the SQL box, and monitor all the incoming requests to the SQL server. I'd narrow the filter in wireshark down to just things making requests on your SQL ports. I'm not sure how long you want it to run for - but once you are done you can then take that trace and run queries against it via ...


1

DNS scavenging does not affect manually created DNS records, only dynamic DNS records. You probably want to go in and clean up the reverse lookup zone by hand (assuming that the incorrect records were added manually to the forward lookup zone).


1

See this article: http://technet.microsoft.com/en-us/library/cc293611.aspx


1

Do you need currently running requests, or just recent requests? You may want to consider LogParser and running directly against your IIS Logs. You can get impressive results in near real time. It supports checkpoints too so it will only give results since the last time you ran it. Various stats programs like SmarterStats are good for that too.


1

Wireshark and Follow TCP stream?


1

Seems you mixed some points... Check SQL Server Service Startup Options description for details about command line parameters: -g (memory allocation) and -T (trace flags)


1

If you are looking to log output in case of a kernel panic with Linux, kdump is the way to go. This is what Red Hat trains people to use and what I have known to be the standard approach.


1

The .trc files are safe to delete. .trc files generated by SQL Server in process of saving events to a physical file without using the Profiler client tool. Server-side tracing is enabled and controlled by using SQL Server system-supplied stored procedures and functions. With these system-supplied processes, you can identify what to trace, when to start ...


1

If the trace files are no longer in use, then they should be fine to delete. I'd say someone was doing some troubleshooting of an application and forgot to delete the trace files when they were done. A trace file would only be in use if the trace is still running. If the files are more than a day old then it's a safe bet that the trace is no longer running. ...


1

Kyle is basically right. The latency problem appears to be upstream from your ISP, so there's little they can do about it directly, since the problem isn't in their own network. At 17:00, you had: 5 180 ms 187 ms 188 ms if-11-2.core1.RSD-Riyad.as6453.net [116.0.78.89] 6 209 ms 222 ms 204 ms 195.219.167.57 7 541 ms 536 ms 540 ms ...



Only top voted, non community-wiki answers of a minimum length are eligible