顯示具有 cacti 標籤的文章。顯示所有文章

2016/12/9

http://www.blogjava.net/DLevin/archive/2015/04/30/424799.html

在上面留言之後，發現自己根本沒那個能力分析
還是來簡述一下
1.小封包的PING
2.大封包的PING
3.icmp的PING
4.路徑長短（tracert route）
5.CDN的認識
6.ICMP、TCP、UDP的優先權
缺少各地PING的資料

不知道何時才能完成此份文章....OTZ

2019/1/30更新：
當時想到的，是在你國裡面，連線的資料一定會被污染
從DNS污染、憑證污染、連線內容污染......等，都是被監控的對象
所以用ICMP來測試速度，並不能代表實際效果
另外，如果是對外服務，要追求使用者回應速度，就要考慮CDN，加快客戶端取用資料的速度
對內，就內部VPN直接對聯就好

2015/10/21

cacti with SELinux

From：
http://docs.cacti.net/manual:087:1_installation.1_install_unix.8_selinux

SELinux Settings

SELinux setting greatly depend on which exact setup you are running. E.g. when installing Cacti into /var/www/html/cacti (which is the default installation location), the web server httpd usually has the required permissions to execute as required. But when e.g. installing into a private directory, e.g. ~/mycacti, you will have to provide specific SELinux settings.

Global SELinux Settings

This is an excerpt from my personal settings when installing into private directory. Any or all of them may be obsolete, when using the default location. Use -P option to make the change permanent

/usr/sbin/setsebool -P httpd_read_user_content=1
/usr/sbin/setsebool -P httpd_tty_comm=1
/usr/sbin/setsebool -P httpd_can_network_connect=1
/usr/sbin/setsebool -P httpd_builtin_scripting=1
/usr/sbin/setsebool -P httpd_enable_homedirs=1
/usr/sbin/setsebool -P httpd_enable_cgi=1

SELinux Settings for Plugins

BOOST

In case you are using BOOST server network setup, it was reported that

/usr/sbin/setsebool -P httpd_can_network_connect=1

 chcon -R -t httpd_sys_content_t /usr/share/cacti/

<==這句最重要

2015/5/11

推薦！國外程序員整理的系統管理員資源大全 - 博客 - 伯樂在線 http://blog.jobbole.com/83212/

自己留存被查

FROM ：推薦！國外程序員整理的系統管理員資源大全 - 博客 - 伯樂在線 http://blog.jobbole.com/83212/

資源

各種資源，比如書籍，網站和文章，用於提升技能和知識

博客

Code as Craft - Etsy的運維博客，大量的技術博客
DevOpsGuys - Devops顧問，運維博客
Rackspace Developers -具有大量Devops主題的博客

書籍

Sysadmin相關書籍

The Linux Command Line - William Shotts的書，關於Linux命令行
The Phoenix Project: A Novel about IT, DevOps, and Helping Your Business Win -DevOps技術如何修復發生在IT組織的問題
The Practice of System and Network Administration - 第一和第二版本描述系統和網絡管理的最佳實踐,獨立於特定平台或技術。
The Visible Ops Handbook: Implementing ITIL in 4 Practical and Auditable Steps -一個方法論,旨在啟動實施控制和過程改進。
UNIX and Linux System Administration Handbook - 從使用的角度走進系統管理

編輯器

開源的代碼編輯器

Atom -來自Github的文本編輯器
Brackets - 用於web設計和前端開發的開源代碼編輯器
Eclipse - 用Java編寫的IDE，具有可擴展的插件系統
Geany -GTK2文本編輯器
GNU Emacs -一個可擴展，自定義的文本編輯器
Haroopad -Markdown編輯器，具有實時預覽
ICEcoder -非常棒的代碼編輯器，內建常見的web語言
jotgit -Git支持的實時協作代碼編輯
Light Table - 下一代代碼編輯器
Lime -旨在提供一個Sublime Text的開源替代方案
TextMate -OS X下的圖形文本編輯器
Vim -一個高可配置的文本編輯器，用於高效編輯

時事通訊

Servers for Hackers - 程序員的時事通訊，發現他們需要知道的服務器相關內容。

存儲

軟件包存儲

Dotdeb - Debian下LAMP更新包的存儲
Remi - RHEL/Centos/Fedora下LAMP更新包的存儲

網站

有用的系統管理員相關的網站

Ops School - 全面的計劃,將幫助你成為一名運維工程師。
Digital Ocean Tutorials - 一個非常龐大資源，獲得基本的應用程序，工具,甚至是系統管理主題。

貢獻

請看貢獻詳情

2015/4/29

Sendmail, Spamassassin, ClamAV statistics in cacti on CentOS 6 ver 1--draft

Draft...........................................until into work
still a draft,Might finish in one day
from:http://forums.cacti.net/about38434.html

Installation:

1) compile the source using:

Code:

gcc -o maillog_watcher maillog_watcher.c -lpthread

2) move the executable and the maillog_watcher_read.sh file to /opt/maillog_watcher/

3) add the following lines to your snmpd.conf

Code:

exec .1.3.6.1.4.100.2 maillog_received /opt/maillog_watcher/maillog_watcher_read.sh received
exec .1.3.6.1.4.100.4 maillog_sent /opt/maillog_watcher/maillog_watcher_read.sh sent
exec .1.3.6.1.4.100.5 maillog_virus /opt/maillog_watcher/maillog_watcher_read.sh virus
exec .1.3.6.1.4.100.6 maillog_spam /opt/maillog_watcher/maillog_watcher_read.sh spam
exec .1.3.6.1.4.100.7 maillog_rejected /opt/maillog_watcher/maillog_watcher_read.sh rejected

change to:
exec .1.3.6.1.4.100.2.101.1 maillog_received /opt/maillog_watcher/maillog_watcher_read.sh received
exec .1.3.6.1.4.100.4.101.1 maillog_sent /opt/maillog_watcher/maillog_watcher_read.sh sent
exec .1.3.6.1.4.100.5.101.1 maillog_virus /opt/maillog_watcher/maillog_watcher_read.sh virus
exec .1.3.6.1.4.100.6.101.1 maillog_spam /opt/maillog_watcher/maillog_watcher_read.sh spam
exec .1.3.6.1.4.100.7.101.1 maillog_rejected /opt/maillog_watcher/maillog_watcher_read.sh rejected

4) for logrotate to work, modify your /etc/logrotate.d/syslog file to send a HUP signal to maillog_watcher. mine looks like this:

Code:

/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron {
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
/bin/kill -HUP `cat /var/run/rsyslogd.pid 2> /dev/null` 2> /dev/null || true
/bin/kill -HUP `cat /var/run/maillog_watcher.pid 2> /dev/null` 2> /dev/null || true
endscript
}

5) You can now start the maillog_watcher

Attachments:

File comment: maillog_watcher_read.sh file used to read the stats

maillog_watcher_read.sh [118 Bytes]
Downloaded 196 times

File comment: maillog_watcher source file

maillog_watcher.c [8.06 KiB]
Downloaded 209 times

File comment: maillog_watcher graph and data templates

cacti_graph_template_maillog_watcher.xml [41.22 KiB]
Downloaded 167 times

SNMP Get interface "End of MIB" ?

vi /etc/snmp/snmpd.conf
What I did was renaming the standard snmpd.conf to snmpd.conf.old
then creating a new one with only "rocommunity public <ip>"

another message about cacti:
http://tosian.blogspot.tw/2008/08/snmp-on-linux-server.html

Postfix status in cacti using CentOS6.6--with SElinux allow perl Script

from：
http://forums.cacti.net/viewtopic.php?f=12&t=6657
http://tosian.blogspot.tw/2008/08/snmp-on-linux-server.html
http://linux.die.net/man/8/snmpd_selinux
https://access.redhat.com/solutions/892923

=================================================================================================
洋蔥爸的工作雜記：SNMP on LINUX server 實作

1.首先找一下 com2sec notConfigUser default public 這一段，然後改成如下所示：(其中 10.16.25.25 是 SNMP server 的 IP address)

#com2sec notConfigUser default public
com2sec local localhost public
com2sec mynetwork 10.16.25.25 public
2. 再來是找 group notConfigGroup v1 notConfigUser 這一段，然後改成如下所示：

#group notConfigGroup v1 notConfigUser
#group notConfigGroup v2c notConfigUser
group MyRWGroup v1 local
group MyRWGroup v2c local
group MyROGroup v1 mynetwork
group MyROGroup v2c mynetwork
3. 接著是找 view all included .1 80 這一段，然後改成如下所示：(把前面的 # 去掉)

## incl/excl subtree mask
view all included .1 80
4. 找到 #access MyROGroup "" any noauth 0 all none none 這一段，改成如下所示：

#access MyROGroup "" any noauth 0 all none none
#access MyRWGroup "" any noauth 0 all all all
access MyROGroup "" any noauth prefix all none none
access MyRWGroup "" any noauth prefix all all all
5. 再找一下 syslocation Unknown (configure /etc/snmp/snmp.conf)這一段，改成如下所示：(其中 syslocation 用來告知你機器所在的位置)

syslocation GangShan
syscontact Root (configure /etc/snmp/snmp.local.conf)

=================================================================================================
from：Walkthrough on Postifx monitoring with Cacti

download:http://forums.cacti.net/download/file.php?id=4091
Installation:
1) Configure SNMP agent on Mail server and make sure it is set up right.
2) Unzip fetch_mail_statistics.pl script in place of your choice. (I used /usr/local/bin)
3) Check that your perl path in script points to perl executable
4) Add following line in snmpd.conf file

Code:

pass .1.3.6.1.4.1.2021.255 /usr/local/bin/fetch_mail_statistics.pl /var/log/mail.log /var/log/mailstats.db .1.3.6.1.4.1.2021.255

5) Adjust your maillog filename and path corresponding to your system. mailstats.db are used for internal script data storage, place it anywhere.
6) Import template in cacti.
==================================================================================================
in /var/log/audit/audit.log：

type=AVC msg=audit(1430250421.774:158725): avc: denied { read } for pid=22972 comm="fetch_mail_stat" name="maillog" dev=dm-0 ino=1444277 scontext=unconfined_u:system_r:snmpd_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file
type=SYSCALL msg=audit(1430250421.774:158725): arch=c000003e syscall=2 success=no exit=-13 a0=1813590 a1=0 a2=1b6 a3=7f65bb021d50 items=0 ppid=2219 pid=22972 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=21015 comm="fetch_mail_stat" exe="/usr/bin/perl" subj=unconfined_u:system_r:snmpd_t:s0 key=(null)
type=AVC msg=audit(1430250421.781:158726): avc: denied { read } for pid=22973 comm="fetch_mail_stat" name="maillog" dev=dm-0 ino=1444277 scontext=unconfined_u:system_r:snmpd_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file

HOW DO I FIX（SKIP） this security Deny?
Let's find the GOOGLE (YA!....... )

=================================================================================================
from SELinux denial when running a script from snmp.conf that needs to create files in the /var/log/ directory

The snmpd process only has access to files in /var/log labeled snmpd_log_t. The fix is to label the the file it needs to access correctly

If its a single file then change the label on the file it needs to access. If its multiple files, then put these files in the /var/log/snmpd directory
  # chcon -t snmpd_log_t /path/to/file

=================================================================================================
from:snmpd_selinux(8) - Linux man page

Process Types
SELinux defines process types (domains) for each process running on the system
You can see the context of a process using the -Z option to ps
Policy governs the access confined processes have to files. SELinux snmpd policy is very flexible allowing users to setup their snmpd processes in as secure a method as possible.
The following process types are defined for snmpd:
snmpd_t
Note: semanage permissive -a snmpd_t
can be used to make the process type snmpd_t permissive. Permissive process types are not denied access by SELinux. AVC messages will still be generated.

File Contexts
SELinux requires files to have an extended attribute to define the file type.
You can see the context of a file using the -Z option to ls
Policy governs the access confined processes have to these files. SELinux snmpd policy is very flexible allowing users to setup their snmpd processes in as secure a method as possible.
The following file types are defined for snmpd:
snmpd_exec_t
- Set files with the snmpd_exec_t type, if you want to transition an executable to the snmpd_t domain.
snmpd_initrc_exec_t
- Set files with the snmpd_initrc_exec_t type, if you want to transition an executable to the snmpd_initrc_t domain.
snmpd_log_t
- Set files with the snmpd_log_t type, if you want to treat the data as snmpd log data, usually stored under the /var/log directory.
snmpd_var_lib_t
- Set files with the snmpd_var_lib_t type, if you want to store the snmpd files under the /var/lib directory.
snmpd_var_run_t
- Set files with the snmpd_var_run_t type, if you want to store the snmpd files under the /run directory.
Note: File context can be temporarily modified with the chcon command. If you want to permanently change the file context you need to use the semanage fcontext command. This will modify the SELinux labeling database. You will need to use restorecon to apply the labels.

=================================================================================================
finally work：

[root@ECserver log]# ls -aZ mailstats.db
-rw-r--r--. root root unconfined_u:object_r:snmpd_log_t:s0 mailstats.db
[root@ECserver log]# ls -aZ /usr/local/bin/fetch_mail_statistics.pl
-rwxrwxr-x. otaku119 otaku119 unconfined_u:object_r:bin_t:s0 /usr/local/bin/fetch_mail_statistics.pl
[root@ECserver log]# chcon -R -t snmpd_exec_t /usr/local/bin/fetch_mail_statistics.pl
[root@ECserver log]# ls -aZ /usr/local/bin/fetch_mail_statistics.pl
-rwxrwxr-x. otaku119 otaku119 unconfined_u:object_r:snmpd_exec_t:s0 /usr/local/bin/fetch_mail_statistics.pl

2015/4/20

Monting SQL server 2012 Express in cacti using wmic

建立了cacti ，使用WMIC來監控SQL server 2012 Express狀態
發現一直給我

[wmi/wmic.c:212:main()] ERROR: Retrieve result data.
NTSTATUS: NT code 0x80041010 - NT code 0x80041010

一直尋找，終於在這邊找到一部份原因：

https://support.microsoft.com/en-us/kb/820847/en-us

o confirm that this problem is occurring, you can use the WbemTest.exe tool that is provided with Microsoft Windows Server 2003. To use the WbemTest.exe tool, follow these steps:

Click Start, click Run, type Wbemtest, and then click OK.
In Windows Management Instrumentation Tester, click Connect.
In the Namespace box, type root\cimv2, and the click Connect.
Click Enum Classes.
In the Enter superclass name box, type Win32_Perf, click Recursive, and then click OK.
In Query Results, you will not see results for the counters that are not transferred to WMI.

For example, the counter object for Exchange Server 2003 routing is OBJECT_SDSMTP_ROUTING_009_NAME=SMTP Routing. If this counter does not exist, you will not see the following lines in Query Results:

Win32_PerfFormattedData_SDSMTPROUTING_SMTPRouting
Win32_PerfRawData_SDSMTPROUTING_SMTPRouting

歸納如下：
1.我升級到標準版，一樣監控不到，原因是：WMI的emun class名字沒變（意思就是：不要搞升級，重新安裝）
2.真的要監控express版本，WQL："SELECT * FROM Win32_PerfRawData_MSSQLSQLEXPRESS_MSSQLSQLEXPRESSTransactions"，
正式版本的
WQL："SELECT * FROM Win32_PerfFormattedData_MSSQLSERVER_SQLServerDatabases"

所以：自己努力改CACTI的template吧

2015/4/16

Configuring Windows for Remote Monitoring with WMI

網路上範例很多
節錄其中一個

補充：
如果LINUX上面用wmic要抓資料
還需要將使用者加入到

Performance Monitor USER

還需要將使用者加入到

Performance Monitor USER

還需要將使用者加入到

Performance Monitor USER

因為很重要所以要說三次
REMARK:
Remote Desktop Users加入這個群組之後，才能抓到2003的TS 數目

from：
https://support.software.dell.com/zh-cn/foglight-for-virtualization-enterprise-edition/kb/129359

Minimum Requirements for Windows Management Instrumentation

STEPS:
To grant DCOM permissions to a remote user:
1. On the monitored host machine, at the Windows Run prompt, type DCOMCNFG and press Enter.
2. In the Component Services dialog box that opens, navigate to Component Services > Computers > My Computer.
3. Right-click My Computer and click Properties.
4. In the My Computer Properties dialog box, click the COM Security tab.
5. In the Launch and Activation Permissions area, click Edit Limits.
6. In the Launch Permission dialog box, add the user or group name necessary for the remote user.
7. Grant the remote user all the permissions available in the Permissions for Administrators area by enabling all the check boxes in the Allow column.
8. Click OK and close the dialog boxes.
To grant minimum WMI permissions to a remote user:
1. On the monitored host machine, right-click on My Computer, and navigate to Manage > Services and Applications > WMI Control.

2. Right-click WMI Control and click Properties.

3. In the WMI Control Properties dialog box, click the Security tab.

4. Expand the Root node and select CIMV2, then click Security.

5. In the Security for ROOT\CIMV2 dialog box Security list, select the remote user.

6. Enable the following check boxes in the Allow column:

a. Execute Methods
b. Enable Account
c. Remote Enable
d. Read Security

7. Click Apply and then click OK.

2015/4/15

cacti wmic w32 terminal service (TS) session count

FROM：
http://forums.cacti.net/viewtopic.php?f=12&t=30438&start=615&hilit=wmi+cacti+centos

download：
https://drive.google.com/folderview?id=0B7Ru5iHrbSDGflJLQW1LT0xHSHVibUdYVFFUYTVRWW96X1oxbUp6cGNsYlpBSUFoS3VGcnc&usp=sharing

2014/3/12

SQL Server內存遭遇操作系統進程壓榨案例

From :http://blog.jobbole.com/62432/

原文出處： Czperfectaction的博客

場景：

最近一台DB服務器偶爾出現CPU報警，我的郵件報警閾（請讀yù）值設置的是15%，開始時沒當回事，以為是有什麼統計類的查詢，後來越來越頻繁。

探索：

我決定來查一下，究竟是什麼在作怪，我排查的順序如下：
1、首先打開Cacti監控，發現最近CPU均值在某天之後驟然上升，並且可以看到System\Processor Queue Length 和 sqlservr\%ProcessorTime 也在顯著的變化。

2、從最容易入手的低效SQL開始，考慮是不是最近業務做了什麼修改？連接到該SQL實例，打開活動監視器，展開「最近耗費大量資源的查詢」，並 CPU時間倒序，在這裡並未發現有即時的耗費資源的查詢。據個人經驗，這裡的值如果是4位數，分鐘內執行次數3位數，一般的服務器CPU大概就10%以上，如果cpu時間那裡是5位數，且分鐘內執行次數也很高，幾百次以上，那CPU一般就會不淡定了。圖片僅為演示

3、沒有耗資源的SQL，這是DBA最不願意看到的結果，因為也許，SQL Server受到了來自內部或者外部的壓力，使得自己花費了過多的時間去處理與操作系統的溝通去了。SQL Server常見的非查詢低效類的性能問題，絕大多數都來自於內存或者硬盤，而這兩者有的時候需要同時研究對比基線，才能確定誰是因，誰是果。在這裡，我們首先查看SQL Server內存使用情況，當打開性能計數器時，我和我的小夥伴們都驚呆了……安裝了64G內存的數據庫，SQL Server的TargetMemory僅有500多兆！這其中StolenPage還佔用了200多兆，數據庫DataPage僅有200多兆的內存可供使用，Oh，Shit！雖然我很不想用「去哪了」這三個字，但是「我的內存去哪了「？同時我們也注意到PageLifeExpectancy值只有 26（一個內存充足的服務器，這個值至少應該是上W的），而很早之前我們津津樂道的」Cache Hit Ration」卻仍然保持一個比較高的水準98! 這個案例告訴我們，緩存命中率這個性能計數器很多時候說明不了什麼問題。

4、OK，既然這樣，是誰佔用了本該屬於我親愛的SQL Server的內存呢？我們繼續，打開Wiindows任務管理，選定進程選項卡，點擊顯示所有用戶進程，發現svchost.exe佔用了絕大多數的60G內存！

5、那svchost.exe又是個什麼東西呢？我們下面就用到ProcessMonitor這個工具了，打開後自動加載所有Wiindows進程，按內存排序後，鼠標移至svchost.exe進程上，顯示為Remote Registry服務。

6、查到這裡，事情已經有了一定的眉目，這個多半是windows內存洩露Bug，遂google關鍵詞: windows server 2008 r2 remote registry memory leak
找到如下鏈接：http://support.microsoft.com/kb/2699780/en-us
果然：Assume that you query performance counters on a remote computer by using an application on a computer that is running Windows 7 or Windows Server 2008 R2. In this situation, the memory usage of the Remote 　　　　Registry service on the local computer increases until the available memory is exhausted.

解決方法：

1、重啟服務器，安裝hotfix
2、因為重啟服務器會影響到業務，所以我在想重啟RemoteRegistry服務，應該也能暫時解決問題，這個bug應該是在某種固定情景下發生的。
隨後，在合適的時間，我重啟了這個服務，SQL Server的TargetMemory重新恢復到60多G，CPU也正常了，目前為止該問題未再發生。

後續跟進：

DBA的工作，說難也難，說容易也容易，發現問題，解決問題還不夠，我們還要意識到自己的欠缺，在本案例中，我之前並沒有建立起SQL Server內存的監控，所以沒有在第一時間就發現病情的嚴重性，好在該服務器並未承擔重要業務，否則後果不堪設想，說不定早就崩潰過了，後怕之處在於，如果崩潰了，自然要重啟服務器，到那個時候，我們連第一現場都沒有，當leader問起來，我又該使勁撓頭了。
該事件之後，我建立起了SQL Server內存的監控，1天後，我從新的監控數據中，又發現了一台服務器出現相同的問題！我很慶幸，不是慶幸服務器沒宕機，而是慶幸我做對了。
附一張內存監控圖，可以看到服務重啟之後，SQL Server的Total Pages一直在上升，並逐漸穩定,Page life expectancy也在變得越來越大，CPU也能指示病症已消除，我很欣慰。

總結：

服務器在出現性能問題前，大部分是提前有一些徵兆的，尤其是內存洩露，因為內存是一點點被壓榨掉的，最後到達一個極限時，SQL Server就會突然Crash掉，然後只留給你一個dump，微軟就笑了。有經驗的大夫應該從日常的腰酸背痛中看出一些端倪，然後進一步分析，提前預知重大疾病的發生，這就是DBA的價值。這個案例，告訴我，重視服務器異常的細節變化，才能做到防患於未然。

2014/1/11

what's up 抓系統error log

訂閱：文章 (Atom)

2016/12/9

2015/10/21

2015/5/11

推薦！國外程序員整理的系統管理員資源大全

備份

克隆

云計算

云業務流程

云存儲

代碼審查

協作軟件

配置管理數據庫

配置管理

持續繼承和持續部署

分佈式文件系統

DNS

主機控制面板

IMAP/POP3

IT資產管理

LDAP

日誌管理

監控

度量和度量收集

網絡配置管理

時事通訊

NOSQL

打包

隊列

RDBMS

安全

服務發現

SMTP

軟件容器

SSH

統計

工單系統

故障排除

項目管理

版本控制

虛擬化

VPN

XMPP

Webmails

Web

Wikis

資源

博客

書籍

編輯器

時事通訊

存儲

網站

貢獻

關於作者： cucr

2015/4/29

Process Types

File Contexts

2015/4/20

2015/4/16

Performance Monitor USER

Performance Monitor USER

Performance Monitor USER

2015/4/15

2014/3/12

場景：

探索：

解決方法：

後續跟進：

總結：

2014/1/11