rsyslog gnutls: could not load module

Starting rsyslog with gnutls configured I got this error:

Nov 27 21:57:03 prometeo rsyslogd-2068: could not load module '/usr/lib64/rsyslog/lmnsd_gtls.so', rsyslog error -2078 [try http://www.rsyslog.com/e/2068 ]

The suggested link is not useful as the description (module could not be loaded - init failed) is too generic.

The problem here was that in the config file, the line DefaultNetstreamDriverCAFile was pointing to a non existent file.

OMD: python problem after CentOS yum update

After yum update I got a problem, related to python, with check_mk in the OMD implementation.

Environment:

• CentOS 7
• check_mk 1.2.4p5
• omd-1.20

In the check_mk web page you can see a lot of messages like this in each "Check_MK inventory" check.

(Return code of 5 is out of bounds)

and if you issue the check_mk command you get

Cannot read file /omd/sites/prod/share/check_mk/modules/check_mk_base.py: 'frozenset' object is not callable

My solution was:

cp /omd/versions/1.20/lib/python/hashlib.py /omd/versions/1.20/lib/python/hashlib.py.OLD

cp /usr/lib64/python2.7/hashlib.py /omd/versions/1.20/lib/python/hashlib.py

tomcat sloooow to start, smartos, kvm: urandom?

A fresh installation of CentOS 7 in a SmartOS KVM virtual machine using a dataset (     image_uuid: d8e65ea2-1f3e-11e5-8557-6b43e0a88b38).
CentOS updated just after the installation.

• apache-tomcat-7.0.64
• Java(TM) SE Runtime Environment (build 1.7.0_80-b15)

I noticed that Tomcat, at startup was very very very, help me, very slow to start.

I used strace to look at what was happening (even if I don't understand anything).

I got a lot of

[pid  1279] futex(0x7f5a880a7154, FUTEX_WAIT_BITSET_PRIVATE, 1, {348, 455527976}, ffffffff) = -1 ETIMEDOUT (Connection timed out)

[pid  1279] futex(0x7f5a880a7128, FUTEX_WAKE_PRIVATE, 1) = 0

Just googled around. I found something similar.

So the solution is: to add the following option to java in the tomcat startup script

-Djava.security.egd=file:/dev/urandom

 (like CATALINA_OPTS="$CATALINA_OPTS -Djava.security.egd=file:/dev/./urandom").

Who knows?

CentOS 7, ipv6 and yum

If you need to disable IPv6 on CentOS 7, you can follow this method that you can find on a lot of sites using google:


vi /etc/sysctl.d/disable-ipv6.conf

net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

Then issue sysctl -p

However you still try to contact IPv6 addresses, so the solution consists in adding this line

ip_resolve=4

to

/etc/yum.conf

"Bundled JRE is not binary compatible with host OS/Arch or it is corrupt. Testing bundled JRE failed."

I was installing SUN STORAGE COMMON ARRAY MANAGER SOFTWARE 6.9, LINUX on a Centos 6 installation.
Such Centos 6 server was installed using the SmartOS image.

Running the script

./HostSoftwareCD_6.9.0.16/RunMe.bin -c

I got
 
"Bundled JRE is not binary compatible with host OS/Arch or it is 
corrupt.  Testing bundled JRE failed."

I've solved in that way:

yum install glibc.i686

install gparted inside smartos Centos VM

Well. I'm not so virtuous to use parted inside a Centos VM to expand the filesystem.
By default the Centos Linux image dataset from SmartOS is large 10GB.
You can add another disk (it will be mounted in /data).
Or you can grow the ZFS volume related to disk0.

So, from the global zone grow the volume related to the Linux VM:

zfs set volsize=20G zones/<UUID>-disk0

I don't know, maybe you must stop the VM and start it again.

Now, from inside the VM, yes, you must install various rpms.
Firts of all the EPEL repository.

rpm --import https://fedoraproject.org/static/0608B895.txt
rpm -ivh https://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm

yum install gparted
yum install xauth
yum install dejavu-lgc-sans-fonts.noarch

Now you can connect to the VM via ssh with the -X option (or -Y) and run gparted

iPxe server (on CentOS) to serve SmartOS

This document talks about how I set up an iPXE server on CentOS 6 mainly to serve SmartOS.
Although I've not understood some things (like undionly or the fact that there are many dhcp requests from the pxe client) the following procedure works for me

Links

• iPXE server using Ubuntu http://blog.alainodea.com/en/ipxe-smartos
• SmartOS wiki http://wiki.smartos.org/display/DOC/PXE+Booting+SmartOS 
• The iPXE site http://boot.ipxe.org
• Take a look to http://networkboot.org/

Install dhcp and tftp services

yum install dhcp.x86_64
yum install tftp-server.x86_64 

Get iPXE undionly

cd /var/lib/tftpboot/
curl http://cuddletech.com/IPXE-100612_undionly.kpxe > undionly.kpxe 

curl http://boot.ipxe.org/undionly.kpxe > undionly.kpxe

Download iPxe

Optional.
Useful to get some network modules if the client uses gPxe (like KVM one) that is unable to work with iPxe

cd /root
mkdir git
cd git/
git clone git://git.ipxe.org/ipxe.git
cd ipxe/src
make
make bin/ipxe.pxe
cp bin/ipxe.pxe /var/lib/tftpboot/

DHCP Configuration

It is useful to configure the DHCP server to provide IP addresses only to known MAC addresses. I think it is also useful to link MAC addresses with IP addresses. So a server always get the usual IP.

Note: 192.168.56.10 is the TFTP server (may be the same server as DHCP)

vi /etc/dhcp/dhcpd.conf

ddns-update-style none; option domain-name "my.domain"; option routers 192.168.56.1; option domain-name-servers 192.168.56.2, 192.168.56.3; default-lease-time 600; max-lease-time 7200; log-facility local7; subnet 192.168.56.0 netmask 255.255.255.0 { deny unknown-clients; next-server 192.168.56.10; host hcn2 { hardware ethernet 00:19:99:e0:87:30; fixed-address 192.168.56.20; if exists user-class and option user-class = "iPXE" { filename = "menu.ipxe"; } else { filename = "undionly.kpxe"; } } }

Configuring iPXE

vi /var/lib/tftpboot/menu.ipxe

#!ipxe ######## MAIN MENU ################### :start menu Welcome to iPXE's Boot Menu item item --gap -- ------------------------- Operating systems --------------- item smartos Boot SmartOS (platform-20121228T011955Z) item --gap -- ------------------------------ Utilities ------------------ item shell Enter iPXE shell item reboot Reboot item item exit Exit (boot local disk) choose --default smartos --timeout 30000 target && goto ${target} ########## UTILITY ITEMS #################### :shell echo Type exit to get the back to the menu shell set menu-timeout 0 goto start :failed echo Booting failed, dropping to shell goto shell :reboot reboot :exit exit ########## MENU ITEMS ####################### :smartos set base-url ${boot-url}/images/smartos/20130111T010112Z/platform/i86pc kernel ${base-url}/kernel/amd64/unix -v -B console=text,smartos=true module ${base-url}/amd64/boot_archive boot || goto failed goto start

Preparing the SmartOS image

From the SmartOS wiki:
There are 2 files of importance, the kernel ("unix") and the boot archive ("boot_archive"). The paths to these files are significant and should not be omitted. They should be:

• (prefix)/platform/i86pc/kernel/amd64/unix
• (prefix)/platform/i86pc/amd64/boot_archive

The prefix may be anything you wish (a common prefix would be "/tftpboot/smartos/20121004T212912Z/") but the path after the prefix must be in the form above. If you do not the OS will fail to boot with an error saying "krtld: error during initial load/link phase"; in this case the image make sure your path is in the proper form. The important point being, don't just untar the latest platform image into your TFTP directory and boot it, you'll have problems unless you change the typical "platform_20121004T212912Z/" to simply "platform/".

So:

cd /var/lib/tftpboot/
mkdir images
cd images/
mkdir smartos
cd smartos
curl https://download.joyent.com/pub/iso/platform-latest.tgz > /tmp/platform-latest.tgz
cat /tmp/platform-latest.tgz | tar xz
ls | grep platform- | sort | tail -n1
platform-20130111T010112Z
mv platform-20130111T010112Z 20130111T010112Z
cd 20130111T010112Z/
mkdir platform
mv i86pc/ platform/

Please note: change 20130111T010112Z with the current version

Configuring iptables

To allow DHCP

vi /etc/sysconfig/iptables-config

IPTABLES_MODULES="ip_conntrack_tftp"

vi /etc/sysconfig/iptables

-A INPUT -m udp -p udp --dport 67:68 --sport 67:68 -j ACCEPT -A INPUT -m tcp -p tcp --dport 69 -j ACCEPT -A INPUT -m udp -p udp --dport 69 -j ACCEPT

/sbin/service iptables restart 

Configuring xinetd

To enable TFTP

vi /etc/xinetd.d/tftp

... disable = no ...

/etc/init.d/xinetd restart

linux scp and umask

I use CentOS 5.x
The problem is that if I use scp or sftp to copy a file on such CentOS server, the umask is not taken in consideration.
Behavior of scp and sftp is different.

Btw, a solution is to use openssh 5, but I don't like to alter the distribution, since CentOS 5 install openssh 4.

Using google I've found different solution (pam? etc.) but no one works for me.

So, a way to make what I want is:

For sftp

vi /etc/ssh/sshd_config
...
# override default of no subsystems
# Subsystem       sftp    /usr/libexec/openssh/sftp-server
Subsystem sftp /bin/sh -c 'umask 0002; /usr/libexec/openssh/sftp-server'

and restart sshd


And for scp

vi /home/myuser/.bashrc




adding (0002 or what you want)

umask 0002

Centos Apache and Directory index forbidden

Today I struggled a little bit to make directory index module working.
I'm on Centos.

Installed apache (httpd) rpm.
No changes to configuration. Nothing.

I have created a conf file /etc/httpd/conf.d/my.conf

Alias /images "/var/www/images"

<Directory "/var/www/images">
    Options Indexes MultiViews FollowSymLinks
    AllowOverride All
    Order allow,deny
    Allow from all
</Directory>

I have created the /var/www/images directory.
In this directory I don't want to put any html page. I want to use the Apache autoindex module to serve a list of files contained in this directory.

WTF autoindex not working...

And in the logs /var/log/httpd/error_log you can read

[Thu Jan 03 03:44:05 2013] [error] [client 192.168.56.1] Directory index forbidden by Options directive: /var/www/images/


The problem was that in /etc/httpd/conf.d/welcome.conf there was

Options -Indexes

So:
- you can delete such file
- you can change in +Indexes

nagios linux software raid plugin

Until now, I was using Hari Sekhon 0.7.2 check_md_raid plugin to monitor Centos software disk RAIDs.

There was an issue: in Centos there is a weekly cron job /etc/cron.weekly/99-raid-check that resync all the md raid devices.
So every weekends there were Nagios warnings for each Centos linux server about unclean md status, until resync finished.

Not so nice.

So I switched to a plugin found under the contrib directory of official Nagios plugins: /usr/lib64/nagios/plugins/check_md_raid

command[check_raid]=/usr/lib64/nagios/plugins/contrib/check_linux_raid.pl

centos kvm console

To enable console access from the host command line to a CentOS guest, this was an useful link

Centos 6: bridge vlan and bond

/etc/sysconfig/networking/devices/ifcfg-em1
/etc/sysconfig/network-scripts/ifcfg-em1

DEVICE=em1
BOOTPROTO=none
HWADDR=78:2b:cb:xx:xx:xx
ONBOOT=yes
MASTER=bond0
SLAVE=yes
TYPE=Ethernet
IPV6INIT=no
USERCTL=no

/etc/sysconfig/networking/devices/ifcfg-em1
/etc/sysconfig/network-scripts/ifcfg-em2

DEVICE=em2
BOOTPROTO=none
HWADDR=78:2b:cb:yy:yy:yy
ONBOOT=yes
MASTER=bond0
SLAVE=yes
TYPE=Ethernet
IPV6INIT=no
USERCTL=no

/etc/sysconfig/networking/devices/ifcfg-bond0
/etc/sysconfig/network-scripts/ifcfg-bond0


DEVICE=bond0
ONBOOT=yes
BOOTPROTO=none
BONDING_OPTS="mode=4 miimon=100 lacp_rate=1"
TYPE=Ethernet
IPV6INIT=no
USERCTL=no
NOZEROCONF=yes


/etc/init.d/network restart

vconfig add bond0 11
brctl addbr brvlan11
brctl addif brvlan11 bond0.11


/etc/sysconfig/network-scripts/ifcfg-bond0.11

DEVICE=bond0.11
ONBOOT=yes
BRIDGE=brvlan11
VLAN=yes


/etc/sysconfig/network-scripts/ifcfg-brvlan11

DEVICE=brvlan11
ONBOOT=yes
TYPE=Bridge
BOOTPROTO=static
IPADDR=10.96.11.40
NETMASK=255.255.255.0
GATEWAY=10.96.11.1
VLAN=yes
STP=on
DELAY=0


On the HP switch

configure

trunk 3-4 Trk4 LACP

vlan 11
tagged Trk4
end

Can't load log handler *.FileHandler

Starting Tomcat (installed from binary http://tomcat.apache.org/download-60.cgi, on a CentOS 5.5 server), I was getting an error like this in ''catalina.out''

Can't load log handler "4host-manager.org.apache.juli.FileHandler"


This was because I set ''JAVA_OPTS'' at the end of the startup script ''catalina.sh'', overwriting all the default ''JAVA_OPTS''...

So the solution is (obviously):

JAVA_OPTS="blablabla $JAVA_OPTS"

How to install Apache Tomcat Native library on CentOS 5.5

If you see this in your tomcat log

INFO: The APR based Apache Tomcat Native library which allows optimal performance in production environments was not found on the java.library.path:
/usr/java/jdk1.6.0_24/jre/lib/amd64/server:/usr/java/jdk1.6.0_24/jre/lib/amd64:/usr/java/jdk1.6.0_24/jre/../lib/amd64:/usr/java/packages/lib/amd64:/usr/lib64:/lib64:/lib:/usr/lib

Do so:

yum install apr-devel

Download package from http://tomcat.apache.org/download-native.cgi

cd tomcat-native-1.1.20-src/jni/native/

You must have java installed (I use sun-java). Since you are using tomcat, it is already installed, isn't it?

./configure --with-apr=/usr/bin/apr-1-config

In any case you will get (I don't know, I've not investigated)

configure: error: can't locate a valid JDK location

btw

./configure --with-apr=/usr/bin/apr-1-config --with-java-home=/usr/java/jdk1.6.0_24

make

su -

make install

At this point you must inform tomcat where this library is located

We can add
-Djava.library.path=/usr/local/apr/lib
to JAVA_OPTS in the catalina.sh script

or add
export LD_LIBRARY_PATH="/usr/local/apr/lib"
at the begginning of the same script