Reputation
387
Top tag
Next privilege 500 Rep.
Access review queues
Badges
3 14
Impact
~13k people reached

  • 0 posts edited
  • 0 helpful flags
  • 5 votes cast
Mar
21
comment how to get a subset of NTP servers from *.pool.ntp.org?
I completely understand that the provider of an NTP host may not want to have it published (I probably would have had the same concerns). I do not want to overuse the NTP service and since the visibility of the hosts does not seem to be provided outside of DNS queries I will leave my quest there. The 13 hosts I gathered are enough for a test (which is a one shot one (or seldom-shot one so to speak)). Thank you for providing resources to the community, BTW :)
Mar
21
comment how to get a subset of NTP servers from *.pool.ntp.org?
@ott--: I could, yes, but even right now when querying the pool (fr.pool.ntp.org, not the servers 0.pool...) 100 times in a row I get 13 distinct servers. By seeding the DNS servers I could try to go around the cache -- but what I am looking for is a straight list of servers, not one which is built up indirectly.
Mar
21
comment how to get a subset of NTP servers from *.pool.ntp.org?
I understand why I am getting a limited number of servers (and this is fine and expected). My question was about the direct availability of a larger list (as opposed to one built-up from DNS queries). I will make that clear in the question.
Feb
6
comment syslog-ng error on CentOS, works fine on other distributions
Thank you, this is a life saver. I was suspecting a problem with the versions, now I know. As for the format: I saw this but need to have raw JSON logs (a JSON per line) which was not obvious to have with the built-in formatter
Jan
1
comment Reverse DNS Lookups
This would work if the hosts are always-on. If the machines are also laptops then some (or a lot, depends on the activity) may get lost.
Jun
14
comment how to manage the whole /var/log for centralization?
I use splunk extensively, including forwarders. This is a fantastic tool.
Jun
13
comment how to manage the whole /var/log for centralization?
I will end up building a wrapper around text File Input Monitor to dynamically create configuration entries for each non-rsyslogd-managed file. Thanks!
Jun
13
comment how to manage the whole /var/log for centralization?
@JennyD: I do not know about your case but mine, details aside, is that I need to have these logs centralized without relying on the admins to always configure the forwarding - and a technical solution to that.
Jun
13
comment “POSSIBLE BREAK-IN ATTEMPT!” in /var/log/secure — what does this mean?
@Iain: true, but having experienced that on many servers when such attacks became fashionable years ago I saw a drastic reduction (almost to zero) of this noise in the logs.
Jun
13
comment how to manage the whole /var/log for centralization?
@JennyD: no, this is not a fairly urgent issue. The systems are handled by various people (they do know what will appear), the servers are peripheral helpers, not key servers etc. The background story is long but the TLDR; version is that it would be good to be able to feed these various logs to splunk> in a reasonably simple way, with the constraints mentioned in my question.
Jun
13
comment “POSSIBLE BREAK-IN ATTEMPT!” in /var/log/secure — what does this mean?
Another solution is to move the ssh server to a port other than 22. That should remove most of the messages (and break the standard "22/ssh", whether it is important or not depends on your system)
Jun
13
comment how to manage the whole /var/log for centralization?
Thanks for the comments, but as mentioned in the comment of the first answer I do not know which files will be present in /var/log - this is why I need to handle it as a whole. I will stress and highlight this in my question.
Jun
13
comment how to manage the whole /var/log for centralization?
Thanks - but the Text File Input Monitor module forces me to handle each file separately. I do not know which files will be created, this is why I wanted to handle /var/log as a whole (including all the changes: files appearing and disappearing)
Jun
13
comment how to manage the whole /var/log for centralization?
@Iain: that would have been the easiest solution (and directly implemented in splunk from the receiving side) but all of the logs are not created by rsyslog. Some are updated by the application itself (like the example I gave - Apache) and I also cannot assume that I will know all the services which log to a file in /var/log.
Apr
11
comment how to unify package installation tasks in ansible?
The zoo is fortunately only two animals large but this is the lowest number I can go to :)
Apr
10
comment how to unify package installation tasks in ansible?
This is more or less what I was expecting (unfortunately :)) so I wonder how salt manages to unify both package managers. Anyway, I will resort to a double configuration, then.
Apr
3
comment winbindd: kinit succeeded but ads_sasl_spnego_krb5_bind failed: Cannot contact any KDC for requested realm
I checked and there is a registration similar to the ones in point 3/ in my question: _ldap._tcp.pdc._msdcs.DOMAIN.EXAMPLE.COM has SRV record 0 100 389 someserver.example.com.
Apr
2
comment How to correctly register in my DNS servers whose IPs and names are handled by someone else?
I completely understand this and it is not my question. I know that a change of the IP will break both of the configurations and that the PTR will point to the example.com entry. Now since both of the configurations work I wanted to understand if one is preferred over the other.
Apr
2
comment How to correctly register in my DNS servers whose IPs and names are handled by someone else?
@MadHatter: I do not particularly fear it changing - what I meant is that neither of the solutions would protect me from a change of the IP (as opposed to having, say, myowngoogle IN CNAME www.google.com which would automatically adapt to changes on the www.google.comserver). This is why the question is about best practices and possibly standards in such a registration.
Apr
2
comment How to correctly register in my DNS servers whose IPs and names are handled by someone else?
@MadHatter: it is static (I mentioned in my question that DHCP is not used and the IP is hardcoded in the server - it is actually automatically reserved (and communicated to me) and updated in the example.com DNS)