ITSA Blog

I recently had an issue where a file copy from a celerra NAS to a server outside the network was failing and I couldn’t figure out why. The file copy was a pull from the outside server which needed access inside the network. The BGP route had somehow changed to go over Integra’s network rather than Verizon and I couldn’t get anyone to fess up to blocking ports 445 and 139. To solve this issue, I turned to SSH tunnelling.

To setup a tunnel from inside a protected network to expose a resource to an external client, you can use the following format:

$ sudo ssh -N -R 445:cifsNAS:445 outsideserver.com

I then created a hosts file entry on the outside server to map cifsNAS to 127.0.0.1.

#/etc/hosts
127.0.0.1  cifsNAS

What this does is SSH to outsideserver.com and open up port 445 on that host, which will then tunnel all traffic from outsideserver1:445 to cifsNAS:445. This solved my temporary issue and I was able to copy the needed files over.

I recently setup a new Awstats install and used mod_rewrite to make it easier to view web stats. Using the following configuration within a virtual host declaration, you can simply make requests in the following format:

http://awstats/$CONFIG/$YEAR/$MONTH/$DAY/

This is assuming that you run daily rollups.

  ServerAlias awstats

  RewriteCond %{REQUEST_URI} !^/awstats/awstats.pl [NC]
  RewriteCond %{REQUEST_URI} !^/icon               [NC]
  RewriteRule ^/(.*)/(.*)/(.*)/(.*)/ http://%{HTTP_HOST}/awstats/awstats.pl?databasebreak=day&day=$4&month=$3&year=$2&config=$1 [L,NE]

This morning I needed to audit some log files that I had recently processed through AWstats and received a report that there was a discrepancy in the data. The complaint was that one day was missing. I used the following bash script to print out the start and end timestamp of each log file:

for file in $( ls -tr *.gz ) ;
do
  BEGIN=$(zcat ${file} | head -n 1 | awk '{print $4}');
  END=$(zcat ${file} | tail -n 1 | awk '{print $4}');
  echo "${file} - ${BEGIN} - ${END}";
done

Note that each log file was named uniquely by web server and logrotate number, eg webserver1.access_log.XX.gz.

Here is a quick awk command that will parse apache web logs and print a simple virtual host/date/referral csv report that only includes referrals from google, bing, or yahoo:

awk 'tolower($11) ~ "google|bing|yahoo" {print $2 "," $4 "," $11}' ${input_file} >> report.csv

Having recently upgraded the Virtual Infrastructure at work to vSphere, I have encountered many scenarios with CentOS 5.3 guests not booting or taking a long time to boot. The last message on the console typically indicates that it’s hanging while starting udev.

The fix for this issue is to ensure proper time keeping practices have been adhered to in accordance with the VMware Timekeeping KB.

The basic steps are:
1. Modify the kernel line of /boot/grub/grub.conf to include the following line:

clocksource=acpi_pm notsc divider=10

clocksource=acpi_pm – uses the Power Management Timer (PMTMR) available in some southbridges as primary timing source
notsc – disable the timestamp counter
divider=10 – reduces the frequency of timer interrupts by 10 (from 1000/second to 100/second)

2. Disable time sync through VMware tools (note that this will continue to happen on bootup, pause, resume, etc..):

vmware-guestd --cmd "vmx.set_option synctime 1 0"

3. Setup time sync through NTP:
a. Setup your /etc/ntp.conf to point to a good NTP server pool.
b. Set NTP to start and persist across reboots.

# yum -y install ntp
# chkconfig ntpd on
# /etc/init.d/ntpd start

One problem that I’ve had with Fedora 12 is that when enabling compliz the focus starts to follow the mouse pointer. This behavior is annoying to me as I don’t like events to occur unless I explicitly ask for them (aka click).

To disable this feature, perform the following:
1. install control-center-extra
2. Open with Applications -> System Tools -> Configuration Editor
3. Select the checkbox at /apps/compiz/general/allscreens/options/click_to_focus

That worked for me.

I was auditing a set of mail servers at work the other day getting a list of all active user accounts and developed this little one liner:

zgrep LOGIN /var/log/mail.log.[1-9].gz | sed -n 's/.*user=\(.*\), ip.*/\L\1/p' | sort | uniq >> /tmp/mailbox.list

This script finds all logins from the mail log and prints out only the account@domain portion in lowercase sorting and printing one of each occurrence.