Need For Entropy

1-  http://uselessuseofcat.com/?p=312

Understanding Linux Load Average

1- http://uselessuseofcat.com/?p=5

2- http://prutser.wordpress.com/2012/04/23/understanding-linux-load-average-part-1/

Expanding a Lun (Linux)

http://blogs.utexas.edu/hcoyote/2009/11/12/resizing-a-linu-multipathd-san-lun/

Redhat 6 Clustering & HA

http://www.linuxtopia.org/online_books/rhel6/rhel_6_cluster_admin/index.html

Linux Performance Tuning

http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Performance_Tuning_Guide/index.html

https://events.linuxfoundation.org/slides/2010/linuxcon2010_hoch.pdf


http://memorize.com/rh442-table-of-contents/jandro

Wireless Securtiy

http://www.wirelessdefence.org/Contents/Wireless%20Pen%20Test%20Framework_001.html

http://cisco.iphelp.ru/faq/35/0074.html

Http Attacks:

http://www.securiteam.com/securityreviews/5WP0E2KFGK.html
http://deadlytechnology.com/web-development/http-attack/
http://www-01.ibm.com/support/docview.wss?uid=swg27019020

Others:
http://www.sysforensics.org/2012/04/ietabie65-malware-memory-analysis.html

Back Reference!

http://backreference.org/

AWK and Beyond...

history | awk '{a[$2]++}END{for(i in a)print a[i] "" i} }'

awk 'NR==FNR{a[$2]=$1;next} {$1=a[$1]}1' mapfile datafile

# prints lines that are both in file1 and file2 (intersection)
awk 'NR==FNR{a[$0];next} $0 in a' file1 file2

# replace each number with its difference from the maximum
awk 'NR==FNR{if($0>max) max=$0;next} {$0=max-$0}1' file file

# prints lines from /beginpat/ to /endpat/, not inclusive
awk '/beginpat/,/endpat/{if (!/beginpat/&&!/endpat/)print}'


# prints lines from /beginpat/ to /endpat/, excluding /endpat/
awk '/endpat/{p=0} /beginpat/{p=1} p'

http://www.tomschaefer.org/web/wordpress/?p=1692
http://backreference.org/page/3/
http://www.catonmat.net/blog/ten-awk-tips-tricks-and-pitfalls/

Started to Learn More about Oracle...

I've started to learn more about Oracle DB.

I am collecting some of the useful links for my personal reference:

http://www.mhprofessional.com/downloads/products/0071591028/0071591028_errata.txt


http://www.idevelopment.info/

http://www.datadisk.co.uk/html_docs/oracle/db_control.htm

Linux NIC duplex settings & Routing

On Redhat:

/etc/sysconfig/network-scripts/ifcfg-ethX:

ETHTOOL_OPTS="speed 100 duplex full autoneg off"


Note: ETHTOOL_OPTS is documented in /usr/share/doc/initscripts-/sysconfig.txt.

Ref:

http://www.redhat.com/archives/taroon-list/2003-October/msg00014.html
http://www.cyberciti.biz/tips/howto-linux-add-ethtool-duplex-settings-permanent.html
http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch03_:_Linux_Networking


Staitc Routes in RH:
/etc/sysconfig/network-scripts/route-
Try vi /etc/sysconfig/network-scripts/ifup-routes

Ref:
http://www.cyberciti.biz/tips/configuring-static-routes-in-debian-or-red-hat-linux-systems.html
http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch03_:_Linux_Networking

Some changes in RHEL6 vs RHEL5 for RH Admins

1- If you have a HP server, onboard disks are always named: /dev/cciss/c0d0, etc.
In RHEL6, for devices attached to Smart Array using the hpsa dirver, the device
names will be /dev/sd but with ciss driver, you will see the old style name
convention.

2- Emergency mode has been removed from list of boot modes

3- Dracut has been replaced mkinitrd.

4- lvconvert --merge : Reverting to a previous snapshot

5- Tickless kernel and power management porfile support.

6- NFSv4 is the default NFS.

7- EXT-4 is the default filesystem.

8- Automated I/O alignment. SCSI and ATA standards have been extended to provide alignment and I/O hints, allowing automated tuning and I/O alignment

9- The new System Security Services Daemon (SSSD) provides centralized access to identity and authentication resources, enables caching and offline support

10- In virtualized environments, sVirt (powered by SELinux) protects guests from one another


To see more, http://www.europe.redhat.com/products/rhel/server/details/

I got this issue with a Redhat5/HP Proliant,

root]# vgs
File descriptor 4 (/dev/pts/1) leaked on vgs invocation. Parent PID 28768: sh
/dev/sdb: read failed after 0 of 4096 at 0: Input/output error
Found duplicate PV QSsOVbn2hAYPzWhviPc3nK0sT89rsB1n: using /dev/sdr not /dev/sdq
/dev/sdd: read failed after 0 of 4096 at 0: Input/output error
/dev/sde: read failed after 0 of 4096 at 0: Input/output error
/dev/sdg: read failed after 0 of 4096 at 0: Input/output error
/dev/sdj: read failed after 0 of 4096 at 0: Input/output error
/dev/sdl: read failed after 0 of 4096 at 0: Input/output error
/dev/sdm: read failed after 0 of 4096 at 0: Input/output error
/dev/sdo: read failed after 0 of 4096 at 0: Input/output error
VG #PV #LV #SN Attr VSize VFree
VG01 1 4 0 wz--n- 650.05G 180.05G
VolGroup00 1 11 0 wz--n- 136.56G 42.19G
VolGroup02 3 4 0 wz--n- 399.91G 0

root]#

I had to edit /etc/lvm/lvm.conf and define a filter.


# filter = [ "a/.*/" ]
filter = [ "a/dev/cciss/.*/", "a/dev/mpath/.*/", "r/.*/" ]

After finish with editing, you need to run pvscan and vgscan to make the change,
active.

Please consult with official manual to find a proper filter for your own environment.

https://access.redhat.com/knowledge/solutions/2989

Stale Lun!!!

[root /]# multipathd -k"show paths"|egrep -v "active\]\[ready|cciss|next_check"
1:0:1:0 sdba 67:64 1 [failed][faulty] XXXX...... 2/5
1:0:1:3 sdbf 67:144 1 [active][faulty] XXXXXXXX.. 4/5

I removed two luns in our SAN and then manually deleted the luns. Now I stuck with
this situation. Let's see if a reboot in the weekend will fix the issue!

[read my previous post!]

Update: a reboot fixed the issue.

Dont remove a LUN cleanly!!! (LVM)

Recently I've added some FC LUNs and created LVM partitions on top of that in my RHEL 5 Box. Later on we had to delete the LUNs in our SAN and recreate them. I deleted the LUNs from our SAN before clean them up in the system! later on when I wanted to remove the volume groups:

UPDATE: if you haven't removed the LUNs from SAN and just deleted the LUNS
with echo 1>/sys/block//device/delete without deleteing the related
volume group, vgs command will hangs. To fix that you need to delete the
mpaths with dmsetup remove /dev/mpath/mpath and rescan the luns with
echo "- - -" > /sys/class/scsi_host/host#n/scan. It brings up sanity to
the system! (at least for me)


# vgremove VG
/dev/VG/otestapps: read failed after 0 of 4096 at 4096: Input/output error
/dev/VG/odevlapps: read failed after 0 of 4096 at 106300375040: Input/output error
/dev/VG/odevlapps: read failed after 0 of 4096 at 106300432384: Input/output error
/dev/VG/odevlapps: read failed after 0 of 4096 at 0: Input/output error
..
Volume group "VG" not found

So, dmsetup comes to rescue (after you probably lost some pounds and pulling some hair!)

# dmsetup remove --force /dev/mpath/mpath41
# for i in `ls /dev/VG/LV-0*`;do dmsetup remove $i;done

# ls -l /dev/mapper/VG* (should be gone)
# ls -l /dev/VG/* (soft link to /dev/mapper/VG*)

I also had to remove the LUNs with this commands:

echo 1 > /sys/class/scsi_device/0\:0\:0\:0/device/delete
echo 1 > /sys/class/scsi_device/0\:0\:0\:1/device/delete
echo 1 > /sys/class/scsi_device/0\:0\:1\:0/device/delete
echo 1 > /sys/class/scsi_device/0\:0\:1\:1/device/delete

multipath -F


To prevent this issue, let's see what is the best practice recemmended by Redhat:

Procedure 1. Ensuring a Clean Device Removal
1. Close all users of the device and backup device data as needed.

2. Unmount any file systems that mounted the device.

3. Remove the device from any md and LVM volume using it. If the device is a member of an LVM Volume group, then it may be necessary to move data off the device using the pvmove command, then use the vgreduce command to remove the physical volume, and (optionally) pvremove to remove the LVM metadata from the disk.

4. If the device uses multipathing, run multipath -l and note all the paths to the device. Afterwards, remove the multipathed device using multipath -F device.

5. Run blockdev –flushbufs device to flush any outstanding I/O to all paths to the device. This is particularly important for raw devices, where there is no umount or vgreduce operation to cause an I/O flush.

6.Remove any reference to the device's path-based name, like /dev/sd, /dev/disk/by-path or the major:minor number, in applications, scripts, or utilities on the system. This is important in ensuring that different devices added in the future will not be mistaken for the current device.

7.Finally, remove each path to the device from the SCSI subsystem. To do so, use the command echo 1 > /sys/block/device-name/device/delete where device-name may be sde, for example.
Another variation of this operation is echo 1 > /sys/class/scsi_device/h:c:t:l/device/delete, where h is the HBA number, c is the channel on the HBA, t is the SCSI target ID, and l is the LUN


Ref: http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/Online_Storage_Reconfiguration_Guide/removing_devices.html

Resize a Lun (multipath) Linux

# multipath -ll mpath0

# for i in `multipath -ll mpath0 | grep sd | awk '{print $2}'`; do
> echo $i ; done
1:0:1:0
2:0:1:0
1:0:0:0
2:0:0:0

>>>> to reread the current (storage-based) size parameters of the devices

# for i in `multipath -ll mpath0 | grep sd | awk '{print $3}'`; \
do \
lockdev --rereadpt /dev/$i ;\
done

>>>> You can check with: blockdev –getsz /dev/$i


# multipathd -k"resize multipath mpath0"

# multipath -ll mpath0

# pvresize /dev/mapper/mpath0

# lvresize -L 50G /dev/VolGroup01/san1

# resize2fs /dev/VolGroup01/san1

# df


Ref:
http://blogs.utexas.edu/hcoyote/2009/11/12/resizing-a-linu-multipathd-san-lun/
http://run.tournament.org.il/hot-resize-multipath-disk-linux/
http://zenhat.org/2011/04/02/how-to-extend-lun-without-reboot-redhat/

Scan for New/Removed LUNs Linux (FC)

more /sys/class/scsi_host/host*/state

echo "- - -" > /sys/class/scsi_host/hostN/scan

# Re-scans


multipath -F && multipath

ls -ltra /dev/mapper


# Removing a LUN

umount /path/to/volume

multipath -l

multipath -F

lsof /dev/sdX

# Delete the drives.
# Do this for EACH drive

echo 1 > /sys/block/sdX/device/delete

# Unmap the volume on the SAN

multipath
multipath -l

Migrating Data form one San to another

This is not an offical post, just to keep what I did, I hope I can add more later on!

I used both these weblogs and came up with a little bit better solution
to recreate the old VG on old san:

http://saharageeks.com/2011/07/26/migrated-data-using-lvm-mirroring/

http://codeworks.gnomedia.com/archives/2005/general/lvm_recovery/

http://storagemeat.blogspot.com/2010/07/migrating-volumes-with-linux-lvm.html

Old VG: /dev/loop0 and /dev/loop1
New VG: only /dev/loop5

888 dd if=/dev/zero of=LUN01 bs=4096 count=250000
889 dd if=/dev/zero of=LUN02 bs=4096 count=250000
890 dd if=/dev/zero of=LUN03 bs=4096 count=2500000

897 losetup /dev/loop0 LUN01
898 losetup /dev/loop1 LUN02
901 losetup /dev/loop5 LUN03

1031 pvcreate /dev/loop5
1032 pvcreate /dev/loop0
1033 pvcreate /dev/loop1

1034 vgcreate TestEMC /dev/loop0 /dev/loop1
1035 lvcreate -L 800M -n testLV01 TestEMC
1037 lvcreate -L 1100M -n testLV02 TestEMC
1041 lvcreate -l 13 -n testLV03 TestEMC
1042 vgs

1054 mkfs.ext2 /dev/mapper/TestEMC-testLV01
1055 mkfs.ext2 /dev/mapper/TestEMC-testLV02
1057 mkfs.ext2 /dev/mapper/TestEMC-testLV03

1059 mount /dev/mapper/TestEMC-testLV01 test1
1060 mount /dev/mapper/TestEMC-testLV02 test2
1066 mount /dev/mapper/TestEMC-testLV03 test3

1067 lvs
1068 vgs
1069 lvs -m
1070 lvdisplay -m

1071 cp /etc/lvm/backup/TestEMC .

1073 vgextend TestEMC /dev/loop5

1074 vgs

1075 lvconvert -m1 --corelog TestEMC/testLV01 /dev/loop5
1092 lvconvert -m1 --corelog TestEMC/testLV02 /dev/loop5
1093 lvconvert -m1 --corelog TestEMC/testLV03 /dev/loop5

1094 umount test1
1096 umount test2
1097 umount test3

1098 lvconvert -m0 TestEMC/testLV01 /dev/loop0 /dev/loop1
1099 lvconvert -m0 TestEMC/testLV02 /dev/loop0 /dev/loop1
1100 lvconvert -m0 TestEMC/testLV03 /dev/loop0 /dev/loop1

1101 vgsplit TestEMC OldTestEMC /dev/loop0 /dev/loop1
1102 cp /etc/lvm/backup/TestEMC ./OldTestEMC

1110 vi OldTestEMC

(I made a copy of TestEMC, named it OldTestEMC, and I changed the UUID for LVs and VG and the name of VG in OldTestEMC)

1111 vgcfgrestore -f OldTestEMC OldTestEMC
1112 vgs
1113 lvs -v

1118 mkdir test1old
1119 mkdir test2old
1120 mkdir test3old

1121 vgs

1125 vgchange -ay OldTestEMC

1126 mount /dev/mapper/OldTestEMC-testLV01 test1
1127 mount /dev/mapper/OldTestEMC-testLV02 test2
1128 mount /dev/mapper/OldTestEMC-testLV03 test3
1137 umount test1
1138 umount test2
1139 umount test3

1140 fsck /dev/mapper/OldTestEMC-testLV01
1141 fsck /dev/mapper/OldTestEMC-testLV03
1142 fsck /dev/mapper/OldTestEMC-testLV02

1143 mount /dev/mapper/OldTestEMC-testLV03 test3
1144 mount /dev/mapper/OldTestEMC-testLV03 test2
1145 mount /dev/mapper/OldTestEMC-testLV03 test1

Clean UP and destory the lab!

1155 lvremove TestEMC
1156 lvremove OldTestEMC (it will remove LVs one by one in this VG)

1159 umount test1
1160 umount /test/test1
1161 umount /test/test2
1162 umount /test/test3
1163 mount | grep test
1164 lvremove OldTestEMC
1178 vgchange -a n NetApp
1187 umount /dev/mapper/NetApp-orappl
1188 fuser /dev/mapper/NetApp-orappl
1190 umount /dev/mapper/NetApp-orappl
1194 losetup -d /dev/loop0
1195 losetup -d /dev/loop1
1196 losetup -d /dev/loop2
1197 losetup -d /dev/loop3
1198 losetup -d /dev/loop4
1199 losetup -d /dev/loop5
1200 losetup -a

My Experience with DirectAccess

Recently I had to troubleshoot DirectAccess for a customer.


This is the summary of what I did:

1- on public NIC:
- removed the dns settings on public NIC

2- On private NIC:
- change the order of NIC cards, LAN should be above Public in list! (ref #1)
- remove the default GW from Private NIC

3- Fixed IPv6 from previous setup and routing with netsh command

4- Symantec Antivirus had conflict with Windows firewall which is important for DA to work (uninstalled)

5- When they setup CRL (Certificate Revocateion List) url, they had missed "/" in the url and preventing IP-HTTPS to come up (fixed it in DC04 -> CA)

6- The IIS on DA shouldn't have 443 configured (confilcts with DA), [REMOVED]

7- Directory browsing needed to be enabled on DA's IIS, so clients can see /CRLD folder remotely over HTTP.

8- There is a bug in Win2008 which preventing system to accept a new cert once you run the setup in DA! (ref #2)

9- Generating proper certifications for DA and Clients

10- Installing DA connectivity assistant which monitor DA connection and can generate advanced logs.
(configuration has to be done in GroupPolicy editor and documents comes in the setup files) (ref# 5 )


On the client:

1- join the laptop to domain

2- add the computer name to da_clients group

3- make sure the laptop cert is correct,

4- install direct access connectivity assistance


More troubleshooting:

here are 3 methods of communications between clients and server and you can disable one to force

the other one:



1- 6TO4: if user has a public IPv4


netsh interface 6to4>set state state=enabled

netsh interface 6to4>set state state=disabled

netsh interface 6to4> show relay


2- Teredo: if users is behind NAT but has access to UDP port 3544



to disable/enable Teredo to see if it will fail over to IPHTTPS method


netsh interface teredo>set state disabled

netsh interface teredo>set state client 1.2.3.4

netsh interface teredo>show state


ping -6 file01


3- IPHTTPS: if user is behind NAT but no access has given in FW for UDP/3544 (slowest method)


netsh interface httpstunnel show interfaces

Interface IPHTTPSInterface (Group Policy) Parameters
---------------------------------------------------
Role : client
URL : https://da-gw.mydomain.com:443/IPHTTPS
Last Error Code : 0x0
Interface Status : IPHTTPS interface active


On the client:

nslookup -q=aaaa file01.mydoamin.com [ipv6 address of DNS]

ping -6 file01

To monitor IPSec tunnels:

netsh advfirewall monitor show mmsa

netsh advfirewall monitor show qmsa





Ref:

1- blog.concurrency.com/infrastructure/uag-directaccess-ip-addressing-the-server/

2- support.microsoft.com/kb/973982/en-us

3- blogs.technet.com/b/edgeaccessblog/archive/2009/10/27/deep-dive-into-uag-directaccess-certificates.aspx

4- www.techrepublic.com/blog/10things/10-things-you-should-know-about-directaccess/1371

5- www.microsoft.com/download/en/details.aspx?displaylang=en&id=10322

Callback in Android!

Whenever one class might need notifications of changes in another—
especially if the association changes dynamically, at runtime—consider implementing
the relationship as a callback. If the relationship is not dynamic, consider using
dependency injection—a constructor parameter and a final field—to make the required
relationship permanent.

Programming Android By Zigurd Mednieks (Page 137)

IPSET and IPTABLES

I really need to do more study on ipset . This post is just a reminder for
myself.

Example #1:

ipset -N myset iphash
ipset -A myset 1.1.1.1
ipset -A myset 2.2.2.2
iptables -A INPUT -m set --set myset src -j DROP

Example #2:

ipset -N routed_nets nethash
ipset -A routed_nets 10.30.30.0/24
ipset -A routed_nets 10.40.40.0/24
ipset -A routed_nets 192.168.4.0/23
ipset -A routed_nets 172.22.0.0/22
iptables -t nat -A POSTROUTING -s 10.0.0.0/24 \
-m set ! --set routed_nets dst -j MASQUERADE


Ref: Linux Journal (October 2011)