SysAdmins' Chronicles - Home

MacGivingTree and MacHeist

2008-12-20T18:15:00Z

These guys are at it again!

I wanted to make it known to all the Mac SysAdmins out there that MacHeist is such a wonderful package. I have purchased the last two MacHeist bundles and have been more than happy with every single app that I have received.

So get there and sign up!

http://givingtree.macheist.com/ http://www.macheist.com/

Regards, Ron

Setting you HostName in Mac OS X

2008-12-14T15:01:00Z

Tip of the Day – Setting Hostname on Mac OS X 10.5

So if you are a road warrior and travel around a lot. You may be annoyed by your terminal displaying your DHCP hostname rather than the real hostname of your machine. That being said here is a simple way to permanently fix your problem.


sudo scutil --set HostName

Enjoy!

FreeBSD 6.4 Released

2008-11-30T07:03:00Z

Just if you missed it, FreeBSD 6.4 (if you’re still on the 6 series of releases) was released two days ago. Checkout the release notes here.

LISA '08 Invited Talks Summaries

2008-11-24T21:09:00Z

I attended USENIX’s Large Installation System Administration conference in San Diego, CA from November 12th to 14th, 2008. I was lucky enough to receive a student grant from USENIX and the NSSA department at RIT to attend the conference. I took part in four of the Solaris system administration training sessions, and spent my third day attending two invited talks. As part of my student grant I volunteered my time to summarize the two invited talks. The summaries are to be included in the February issue of ;Login:, the USENIX magazine. I’ve included below those two summaries. I will post more later on the vendors I thought were neat, as well as my overall feelings of the conference (which are all positive).

Designing, Building, and Populating a 10-Megawatt Datacenter
Doug Hughes, D.E. Shaw Research, LLC

Doug Hughes from D.E. Shaw Research, LLC (Deshawresearch.com) a firm that develops novel algorithms and machine architectures for high-speed molecular dynamics simulations of proteins and other biological macromolecules, presented on building his company’s new data center and many of the choices, gotchas, and tips he found along the way.

Hughes went on to show the benefits and differences between wet and dry cooling systems. The main benefit of a wet cooling system is efficiency. However, water pipes take of quite a bit space and pipes can leak. Electronics and water do not mix well. In addition, humidity control with a wet system can be problematic. Lastly, if your environment freezes in the winter consideration must be made to ensure cooling water pipes do not freeze during maintenance periods. Dry systems on the over hand, can control humidity well using waste heat and can be placed almost anywhere with no major structural pipes required. However, dry systems are less efficient.

In a data center there are two competing factors. First human comfort, no one wants to work in a frigid environment, nor a blistering hot one. Second is creating the highest delta-t or difference in temperature difference in temperature at the inlet and outlet. For example a high delta-t would result in the coldest possible “cold aisle”, and hottest possible “hot aisle.” The best cooling design is a compromise between human comfort and delta-t.

Humidification is used in a data center to moderate static electricity. Various sources of humification are available such as plant steam, a steam canister, an infrared system, or an ultrasonic system. A general recommendation of 40-60% humidification is the industry standard but Hughes believes this tolerance is a bit tight.

Various economizing techniques are available to decrease the cost of cooling a data center. On the air side, venting waste heat directly outside can save a lot of cost. In addition, humidification of cooler air is more efficient as cooler air’s dew point is lower. On the water side, a heat exchanger placed outdoors can increase savings especially in colder regions.

Hughes recommends a few things when using wet cooling system. First disable humidification on all but one of your cooling units, or use a purpose specific humidifier. The other option is to ensure precise calibration of all cooling units. Hughes recommended this because the cooling units will fight to humidify and dehumidify. Next, keep an eye out for changing conditions in your environment such as increased load on servers, increase or decreased number of servers, and change in outside temperatures. Next, disable reheat. Reheating is the process of dehumidification where the system chills the air down to the dew point, and then reheats it. It is much more efficient to have one unit bypass warm air from outside.

A number of consideration must be made for the flooring a data center. Generally two choices are available, cement/epoxy floors or raised floors. A cement/epoxy floor has a high weight load, but is bad for chilled water cooling as pipes are usually run under the floor. A raised floor is more expensive, but allows room for chilled water piping and cables. The a raised floor becomes more expensive when high load capacities are needed or as the height of the floor increases. In addition, when using a raised floor with chilled water cooling a consideration must be made that leaking water pipes and power cables do not mix well.

Hughes presented various fire suppression techniques and technologies available for data centers. Pre-action system is a water based system with sprinklers. However the pipes of the system are filled with air during normal operation. When smoke is detected a pump is a turned on and floods the pipes. Water is only released when the individual sprinkler heads reaches a certain temperature. The biggest problem with using a water based system is cleanup. In addition to cleanup, water is not efficient at putting out interior fires or fires inside contained areas as it takes a little while for the water to reach inside the contained area. The next type of fire suppression is a dry agent based system. The benefits of a dry system is minimal downtime as there’s no dry-out period, and interior fires are extinguished quickly. However some systems require room sealing, and have a corrosion potential. A new system named Aero-K is potassium based and is safe for humans and hardware.

A number of suggestions were presented on power efficiency. High voltages and fewer voltage conversions equal better efficiency. Typically each power conversion made about 1% to 2% of the energy is lost to waste. The use of 3-phase allows for 173% more power to be carried in a power line than a single phase system. When buying equipment insist on high efficiency and correctly sized power supplied from vendors with power factor correction. Lastly, only use as much redundancy as required.

Another consideration when building a data center is the density required, or how many kilowatts per rack. Hughes noted that while blade servers offer cabling advantages and space savings, their typical power requirements per compute unit is about the same as new servers. In general, as density increases cooling and power requirements increase too.

Lastly during Q&A the suggestion was made by an audience member to ensure that your sump pumps and drip pan pumps are on protected power. A question of flywheel use in Hughes’ data center was brought up. Flywheels are used as an alternative to uninterruptible power supplies, but only offer a short duration of power, but are typically designed to allow enough time for generators to turn on. Flywheels are a less toxic, require less maintenance, and are more efficient than uninterruptible power supplies.

Beyond VDI: Why Thin Client Computing and Virtual Desktop Infrastructures Aren’t Cutting It
Monica Lam, MokaFive and Stanford University

Monica Lam presented on the current issues and myths of Virtual Desktop Infrastructure (VDI) and MokaFive’s LivePC product. MokaFive can be found at mokafive.com where the player portion of LivePC is available for free.

Thin-client computing does not reduce the cost of hardware because of a few reasons. First is the reduced cost of a PC today, and the similar cost of thin-client hardware. Monika gave the example of a suitable PC costing $499 and thin-client hardware costing $300 plus $60 a year. In addition, employer’s can depend on employees use of their own computers. Another reason is when moving desktop virtualization into a data center additional cost of data center operation is incurred like having to provide cooling and power. If the virtualization is running at the end-point often passive cooling can be used. Lastly, when designing the systems for servers in a data center to support virtualization you must provision for the “Super Bowl effect” or the theoretical event when all your users login and use their virtualized desktops at the same time.

Centralized management does not have to lead to a bad user experience. Regarding VDI, where the virtual machine’s are run on a central server, introduces a few factors that lead to a bad user experience. First the overhead of VDI, running multiple virtual machines on a single server causing resources are being shared among many users. Next, the user is running on a remote display, so all display information has to be sent and received across whatever network connection the user is on. Often this leads to very slow interaction performance. In addition, 3D graphics or other graphic intensive applications are very difficult to interact with over a remote desktop.

MokaFive’s LivePC product attempts to solve the problems of VDI by offering a centralized management interface that allows administrators the ability to create, update, and publish virtual machines. The virtual machines are published to a HTTP server and made available for downloading by the client. The client portion of the product lives on the user’s machine and downloads and runs the virtual machine. Virtual machines created by LivePC maintain two virtual hard drives. The first drive is managed by the administrator remotely, and the second is used to store any local changes to the virtual machine. LivePC will automatically pull differential updates to the first virtual hard drive as its updated by the administrator. In addition, LivePC allows the user to revert back to the original virtual machine undoing any changes to the operating system.

During the Q&A session the use case of users needing shared access to large pools of data was asked. Monica noted this is the one application where VDI is quite useful. Another question was asked how to backup local changes in the LivePC product. Monica responded that MokaFive decided to let users decide how to backup local changes as most enterprises have their own backup solutions in place. A security based question asking does LivePC prevent the host OS from screen capturing the guest OS. Monika said MokaFive treats as any data that is displayed on the screen is gone and not securable. She then noted that the only real solution to this problem is a trusted computing environment. The last question of the session was if MokaFive offered a bare metal install of their LivePC product. Monika answered that MokaFive initially developed a bare metal installation before going to using the virtual machine player model and it is still available.

Great Rails Plugin

2008-11-21T15:08:00Z

Tip of the Day

This is a great plugin that I feel everyone should implement.

Solaris 10 Time Machine Server with ZFS Backend

2008-11-16T21:35:00Z

Introduction

Wow, this process is a huge pain in the ass. I have been going back and fourth between changing sources files and configure statements. I will be documenting this whole process here to save everyone else the trouble. If you want to setup a TimeMachine server with a ZFS back end you will need this guide more than anything else. I will be using a Solaris 10u6 installation booting from ZFS as well.

More information as well as source patch files will come soon!

Overview

Considering this was not an easy process I will be trying to explain everything as well as possible. Basically the netatalk package supports Solaris 9 just fine, Solaris 10 changes the way it plays the game. With all the improvements there also came some compromises.

Goals of Project

So I had an idea which was sparked by this blog post. It was able to get me inspired to really do some damage with my backup issues that I have. Yes even I consider myself to have backup issues. I have time machine, but I can only backup one out of my two machines at a time. I am currently using a Western Digital 500GB MyBook Studio Edition. I will post a picture of an overview of my topology.

Requirements

What you will need for this guide is a free machine that will you will be able to use as a server. You will also want to have at least one Mac OS X Leopard machine that you could leverage TimeMachine. Specifics on that hardware and software below.

Hardware

Here is the description of my Solaris 10 server

Intel Core 2 Duo 1.83GHz
2GB DDR2 RAM
5×750GB WD RE3 HD (ZFS RAID Drives)
1×300GB WD VelociRaptor HD (Boot Drive)

Software

For my server I will be running Solaris 10 u6 which is the latest release of Sun’s operating system. The open souce software that is used is as follows:

netatalk
avahi
Berkeley DB 4.2.52 (Version is imperative!)

Installing

Setting Up Environment

Make sure that we have our source directory created, this is where we will be downloading and building all of our source code for our server.

mkdir -p /opt/local/src

Another very important step is to update where your system will look for installed libraries, Solaris gives is this amazing command to update it globally, so whenever compiling new apps from source your libraries are available to the linker.

crle -u -l /usr/sfw/lib:/opt/local/lib

Besides those two options you must also add the following directories to your path.

/usr/sfw/bin
/usr/ccs/bin
/opt/local/bin

Depending on your shell that can be done either in your:

.profile (bash)
.zshenv (zsh)
.tcshrc (tcsh)

It is up to you to update your profile accordingly.

Berkeley DB 4.2.52

Again, remember the version number. 4.2.52 is the recommended version number, anything newer will not work.

Compiling and Installing

Follow the steps below and you will have a completely working Berkeley DB installation on your Solaris 10 server.

cd /opt/local/src
wget http://download.oracle.com/berkeley-db/db-4.2.52.NC.tar.gz
gzip -cd db-4.2.52.NC.tar.gz | tar xf -
cd db-4.2.52.NC/build_unix
../dist/configure—prefix=/opt/local
gmake -j3
gmake install

Netatalk 2.0.3

Here is the monster, well for me. Now that I have all the kinks worked out, it will be a walk in the park for you. Lucky you, oh and how I mean that.

First off you will need to download the source code as usual.

cd /opt/local/src
wget http://voxel.dl.sourceforge.net/sourceforge/netatalk/netatalk-2.0.3.tar.gz
gzip -cd netatalk-2.0.3.tar.gz | tar xf -
cd netatalk-2.0.3

Configuration

RANLIB=echo CC=gcc LDFLAGS=-R/opt/local/lib ./configure—prefix=/opt/local—with-ssl-dir=/usr/sfw—without-pam—disable-ddp—with-bdb=/opt/local—without-srvloc

Once that completes we are ready to move on to the next step.

Patching

First you will need to download the patch files.

wget http://tek-ops.com/files/patches.tar.gz

Extract the patch files

gzip -cd patches.tar.gz | tar xf -
cd patches

Patch the source code

patch -i at.h.patch ../sys/netatalk/at.h
patch -i config.h.patch ../config.h
patch -i endian.h ../sys/netatalk/endian.h
patch -i tpi.c.patch ../sys/solaris/tpi.c

Compiling the Code

This is now the simple step, run the following two commands and you will have built and installed your netatalk source code.

gmake -j3
gmake install

Configuration

Netatalk Configuration

Make sure the services look like these in your netatalk.conf file

vi /opt/local/etc/netatalk/netatalk.conf

ATALKD_RUN=no
PAPD_RUN=no
CNID_METAD_RUN=yes
AFPD_RUN=yes
TIMELORD_RUN=no
A2BOOT_RUN=no

vi /opt/local/etc/netatalk/afpd.conf

- -transall -uamlist uams_randnum.so,uams_dhx.so -nosavepassword -advertise_ssh

Here I have a zpool for my timemachine setup, I will use its mountpoint for my AFP drive.

vi /opt/local/etc/netatalk/AppleVolumes.default

/tank/timemachine TimeMachine allow:rvalente,rovalent cnidscheme:cdb options:usedots,upriv

Once all of the configuration is complete you will now want to make it so your Solaris server can run the service. For this we will use the sysv script that is included in the package.

cd /opt/local/src/netatalk-2.0.3
cp distrib/initscripts/rc.atalk.sysv /lib/svc/method/netatalk
chmod 744 /lib/src/method/netatalk

Once the initscript is in place we need to create an xml file for svc to import. Create a netatalk.xml file in your home directory that looks like this:

<?xml version='1.0'?>
<!DOCTYPE service_bundle SYSTEM '/usr/share/lib/xml/dtd/service_bundle.dtd.1'>
<service_bundle type='manifest' name='netatalk'>

  <service 
    name='site/netatalk' 
    type='service' 
    version='0'>

    <create_default_instance enabled="true"/>

    <dependency 
        name="netatalk-config-file" 
        grouping="require_all" 
        restart_on="none" 
        type="path">
          <service_fmri value="file:///opt/local/etc/netatalk/netatalk.conf"/>
    </dependency>

    <dependency 
        name="afpd-config-file" 
        grouping="require_all" 
        restart_on="none" 
        type="path">
              <service_fmri value="file:///opt/local/etc/netatalk/afpd.conf"/>
        </dependency>

    <dependency 
        name="AppleVolumes-default-config-file" 
        grouping="require_all" 
        restart_on="none" 
        type="path">
        <service_fmri value="file:///opt/local/etc/netatalk/AppleVolumes.default"/>
    </dependency>

    <dependency 
        name='loopback' 
        grouping='require_all' 
        restart_on='error' 
        type='service'>
        <service_fmri value='svc:/network/loopback:default'/>
    </dependency>

    <dependency 
        name='physical' 
        grouping='optional_all' 
        restart_on='error' 
        type='service'>
        <service_fmri value='svc:/network/physical:default'/>
    </dependency>

    <dependency 
        name='fs-local' 
        grouping='require_all' 
        restart_on='none' 
        type='service'>
        <service_fmri value='svc:/system/filesystem/local'/>
    </dependency>

    <exec_method 
        name='start' 
        type='method' 
        exec='/lib/svc/method/netatalk start' 
        timeout_seconds='60'>
    </exec_method>

    <exec_method 
        name='stop' 
        type='method' 
        exec='/lib/svc/method/netatalk stop' 
        timeout_seconds='60'>
    </exec_method>

    <template>
        <common_name>
                  <loctext xml:lang='C'>
                Netatalk Server
            </loctext>
            </common_name>
    </template>

  </service>
</service_bundle>

Then you need to import and enable the service.

svccfg import ~/netatalk.xml
svcadm enable netatalk

.... Still In Progress – Check back soon! ....

Cisco Systems, Inc. and Me

2008-11-14T19:56:00Z

Welcome

I am not sure how many people know, especially the people who only know of my life through this blog, which in turn must seem quite bland and slow. It is actually the exact opposite, I am currently working remotely for Cisco Systems, Inc. while finishing my degree and Rochester Institute of Technology. That part of my life everyone already knows from my last post. Now I am here to talk a little about what I am working on with Cisco.

Cisco Systems, Inc.

As you may or may not know, Cisco Systems, Inc. is a large networking company and I am a small spec in their culture trying to make an impact. I work for Cisco as a student coop worker the summer of 2007. That summer I was quite productive with other side projects, I got my CCNA which is where I will stop because I am a System Administration. I also started this site with Ben Allen. As a coop I was able to finagle my way into working with the SysAdmin at Cisco rather than working on cases. That is where it all started, now I am back one summer later and working with one of their VMware deployment in their tech support division.

What Is Coming

Everyone is wondering when are the next posts. To answer that I need to explain a few things. I have been involved mostly with Solaris and VMware so must of my upcoming posts will involve my experiences with those platforms. I will try and finish my Ubuntu guide asap once I get some free minutes in my day. It has become quite busy due to work/masters degree.

Best Regards,

Ron Valente

Network Management

2008-10-11T18:09:00Z

Introduction

I thought I would give everyone an update about what is happening around here. Like to keep everyone in the loop even though the time that Ben and I have is very slim…

We are both working to get out Masters Degrees in System Administration. Ben is attending the LISA conference in San Diego in November which will be pretty slick. I will let him comment on that separately.

Masters of Science

Now on to more of the MS stuff. It has been quite an interesting ride. The exact degree is called Network and System Administration as you would expect by the title there would be both network and system administration classes in the degree and you would pick a path and follow it. Unfortunately that is not the case. I guess RIT likes adding in system administration for the fun of it because there are 0 true sys admin classes in the degree.

Yeah I said ZERO, a couple can come off as system administration so I will give them a reluctant 3 classes. That being said, we are stuck between a rock and a hard place. So we went to our department head and essentially told him this is unacceptable, the good news is that he compromised with us. The bad news is that it added much more work on our part.

I guess you could consider us people who enjoy punishment as long as there is some return on our end.

The big task included rewriting the labs and project for one of the hardest and most important classes that is offered. Note: Hardest that the school offered, not hardest for Ben or I.

Network Management

In a nutshell the class was original teaching network management using Net-SNMP and the students would then poll devices/servers and collect information. After collecting about 10 sets of data they would perform some quick analysis on the data and present the user with a simple report which shows throughput or something along those lines.

Nothing too spectacular

Within 2 hours of having the task of rewriting the labs for the course Ben and I came up with a complete outline for the labs. Traditionally they were written like a cookbook, we despise labs written in such a fashion. So we decided to kick it up a notch. BAM

I promise I will never have another Emeril innuendo again, I just couldn’t resist.

Due to the potential of students reading this before taking the class I cannot list the lab outlines but what I will do is say one thing summarizing the experience the students will have while taking this class.

Welcome to the Big Leagues.

Ruby on Rails Ubuntu 8.04.1 Guide

2008-09-19T00:32:00Z

Introduction

I am making this bridge post to let everyone know in preparation of the part 3 of my guide I have updated both of the previous parts. Some of the ubuntu package names changes as well as some defaults were removed/included. I will be turning this guide into a static page on the site due to the popularity.

Input

What I would like to do is to get everyone’s input on if I should enable this guide to be editable wiki style by the users? Any and all input will be greatly appreciated! Thanks!

Tip of the Day: Free SSL Certificates

2008-09-13T07:44:00Z

Now I know what you’re thinking. What good is a SSL certificate that’s free? In other words, one that you self-sign, use an untrusted certificate authority to sign it, etc. Well crazy as its sounds the first step to widespread free SSL certificates happened a few months ago. The Firefox 3.0 release. Firefox 3.0 included the StartSSL CA root certificate, StartSSL offers a free Class 1 SSL certificate. Equivalent to GoDaddy’s cheapest SSL certificate, i.e. no verification and no customer information in the certificate. Sadly Safari 3.1.2 (really OS X since Safari uses system wide root certificates), and Internet Explorer as of IE 8 Beta 2 do not ship with StartSSL’s root certificate. But at least its a start in the right direction. Hopefully Apple and Microsoft will take a hint from Mozilla and include StartSSL in upcoming releases of their browsers.

Ben

rake blog:migrate

2008-09-10T23:00:00Z

Moving To Mephisto

We are in the process of moving away from typo. Currently we feel it is not the best blog engine for us to be running and at this time we will be moving to Mephisto until we finish out custom blog engine. We will be migrating to mephisto as soon as possible and hopefully the transition will go smoothly.

If anyone has any comments on why we should or should not move to mephisto from typo speak now or forever hold your peace!

Best Regards,

Ron

We Are Back!

2008-09-09T23:30:00Z

Dear Dedicated Readers and Newcomers Alike,

Just wanted to make a formal post to everyone stating that we are back! Sorry for all the major delays in posting, both Ben and I have been quite busy with our respective jobs. I am now working for Cisco Systems, Inc. but more on that later. I will be posting more frequently again, we look forward for all the comments. I hope you enjoy reading this blog and talk to you all soon!

Best Regards,

Ron Valente

Tip of the Day: Setting the Email Address for FreeBSD's Daily/Weekly/Monthly Reports

2008-05-14T11:14:00Z

FreeBSD by default runs three sets of periodic scripts that outputs a volume of information about your system's current state. The output of these scripts are sent to the root account's mailbox. If you are like me and have a number of FreeBSD servers, its a pain to go check this mailbox on each machine. Well here is an easy fix to send the output of the scripts to any email address.

Edit /etc/periodic.conf and add:

daily_output="ben@domain.com"
daily_status_security_output="ben@domain.com"
weekly_output="ben@domain.com"
monthly_output="ben@domain.com"

To test that this is working run: periodic daily as root. The security run output should arrive in your mailbox.

Tip of the Day: Set Git Author and Email [Updated]

2008-05-13T23:38:00Z

Quick tip, especially if you use GitHub with Gravatar so a little profile picture will show up on GitHub you likely need to set your Author and Email for Git. So instead of falling back to your system username and machine name for an email address (at least on the Mac), and your account's long name for author name, Git will use the correct information and your gravatar will show up in GitHub (minimally just match your email with your Gravatar account).

Run the following commands:

git config --global user.name 'Your Name'
git config --global user.email ben@domain.com

This will add entries to your ~/.gitconfig file under the [User] section.

Thats it. See me on GitHub here: http://github.com/unilogic

Thanks Tim for the correct way of doing this.
Resource: http://cheat.errtheblog.com/s/git

Sexy Errors - Passenger by Phusion

2008-05-13T12:00:00Z

Just to show what value add really means, we have a company that is dedicated to making good products. They pay attention to detail and it shows by error screens that look like this. Job well done Phusion.