Reputation
64,424
Next tag badge:
120/100 score
19/20 answers
Badges
12 86 168
Newest
 Enlightened
Impact
~2.4m people reached

Jun
18
revised What is a solid process for designing a monitoring system?
Fix link rot
Jun
18
comment Can I turn on HSTS for 1 subdomain
@AaronGibralter That's my understanding (and my interpretation of the original question was "only for xxx.yyy.com" which is why I said not to set includeSubDomains) - If you want the subdomains of xxx.yyy.com to also enforce HSTS then you should set includeSubDomains in the header.
Jun
2
awarded  Nice Answer
May
27
awarded  Good Answer
May
25
awarded  Revival
Apr
28
comment What is the best way to get PRECISE domain name from ip address logged in iptables log
@Samir Yes, that's another failing of trying to use an IP log to determine "what happened" all it can tell you is who talked to whom, but not what they talked about. You can't really get what you want using IP addresses alone - like sciurus said you're ultimately examining the wrong layer (proxy systems get the information you want by examining the application-layer content rather than the network/transport layers, they're pretty good at it too).
Apr
27
comment What is the best way to get PRECISE domain name from ip address logged in iptables log
@Samir Note that DNS correlation is not without limitations too (only an initial request will show up, so if a site has a 12-hour TTL or something and is in the machine's cache you may have to go back quite a ways to find the DNS query that matches the corresponding request). The web-logging software can employ a number of techniques, but deep packet inspection (actually looking at the content of each packet) is probably the most reliable. (Reverse DNS lookups are also generally reliable, though not bulletproof as I described above. They're often "Good Enough" for what you need.)
Apr
27
answered What is the best way to get PRECISE domain name from ip address logged in iptables log
Apr
25
awarded  Enlightened
Apr
25
awarded  Nice Answer
Apr
24
comment What should NOT be managed by puppet?
@thinice That's a good point, but my usual counterpoint to it is to smack people on the back of the head and shout REDUNDANCY really really loud :-) (It's a worse situation with radmind because that just blasts the filesystem. Our policy is to have the load-balancer unload half the servers so we can patch/test those, then we move everyone to the patched machines so we can do the other half. Works well, but you need the redundancy built into your environment.)
Apr
3
awarded  Famous Question
Mar
29
awarded  Enlightened
Mar
28
awarded  Nice Answer
Mar
23
awarded  Nice Answer
Mar
19
reviewed Close List of groups and users on Windows 2003 Server
Mar
19
comment Installing Debian with a writable flash drive
This is really outside the scope of professional system administration. It MIGHT be appropriate on Unix & Linux, but I won't migrate it there as it currently stands (for no other reason than you can answer it with a Google search for "Debian live USB with persistence" and get many tutorials).
Mar
19
comment Wait Time (TTFB) Difference Between Apache and IIS 8.5
This is not a question, and is therefore de facto Off Topic for this Question and Answer site. If it were a question it would be a duplicate of the capacity planning question, because the answer would be "If you want to know why the Time To First Byte varies between these systems you need to perform load tests and profiling to determine where your system bottlenecks are."
Mar
19
reviewed Close Wait Time (TTFB) Difference Between Apache and IIS 8.5
Mar
19
reviewed Close How does NIC bonding in Linux work?