fbpx

Centos Syslog Forward to Splunk

# ### begin forwarding rule ###
# The statement between the begin … end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
$WorkDirectory /var/lib/rsyslog # where to place spool files
$ActionQueueFileName fwdRule1 # unique name prefix for spool files
$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)
$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
$ActionQueueType LinkedList # run asynchronously
$ActionResumeRetryCount -1 # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
*.* @@splunk:514

Moving WSUS Content / Databases

The following procedures will help you overcome low disk space problems:

· Using the Server Cleanup Wizard to remove unneeded content.

· Moving the content directory to another drive

· Moving the SQL Server database to another drive

To use the Server Cleanup Wizard to remove unneeded content

1. In the WSUS administration console, select Options, then Server Cleanup Wizard.

2. By default this wizard will remove unneeded content and computers that have not contacted the server for 30 days or more. Select all possible options, then click Next.

3. The wizard will begin the cleanup process, and will present a summary of its work when it is finished. Click Finish to complete the process.

To move the content directory to another drive

1. Create a new content directory on another drive.

2. Locate the WSUSUtil.exe utility in the Tools directory of your WSUS installation (typically C:Program FilesUpdate ServicesTools).

3. Open a command window, navigate to the Tools directory, and type the following:

4. wsusutil movecontentNewContentPathMoveLog

5. where NewContentPath is the new content directory, and MoveLog is the path and filename of the log for this operation.

Note

For more information on using the WSUSUtil utility, see Managing WSUS 3.0 from the Command Line in the Operation Guide

To move the SQL Server installation to another drive

1. Open a command window.

2. Type net stop wsusservice

3. Detach the SUSDB database.

4. Copy SUSDB.mdf and SUSDB_log.ldf to the new location.

5. Attach the SUSDB database from the new location.

6. Type net start wsusservice

7. When the system is working properly, delete SUSDB.mdf and SUSDB_log.ldf from the old location.

Extending an LVM volume: Physical volumes (partitions) -> Volume groups -> Logical volume -> Filesystem

Logical Volume Management (AKA LVM) is for managing storage space.
In Centos, instead of installing the root filesystem directly to a fixed size partition, we setup LVM by default, and install the root filesystem to a Logical Volume, which may later be expanded, even across multiple physical devices.

How LVM works
In LVM, there are several layers, each builds on top of the other:

PV[s] (Physical Volumes) -> VG[s] (Volume Groups) -> LV[s] (Logical Volumes) -> Filesystems.

Logical Volumes are allocated/extended within the boundaries of their underlying storage pool which is called a Volume Group in LVM terminology.

For example, in Centos the filesystem is installed by default to the /dev/vg_prd00/lv_root Logical Volume, which is allocated within the vg_prd00 Volume Group:

— Logical volume —
LV Name /dev/vg_prd00/lv_root
VG Name vg_prd00
LV UUID —-uuid—-
LV Write Access read/write
LV Status available
# open 1
LV Size 50 GiB
Current LE 12800
Segments 1
Allocation inherit
Read ahead sectors auto
– currently set to 256
Block device 253:0
Out of the box the vg_prd00 Volume Group might not have enough free space for you:

# vgdisplay
— Volume group —
VG Name vg_prd00
System ID
Format lvm2
Metadata Areas 1
Metadata Sequence No 4
VG Access read/write
VG Status resizable
MAX LV 0
Cur LV 3
Open LV 3
Max PV 0
Cur PV 1
Act PV 1
VG Size 63.51 GiB
PE Size 4.00 MiB
Total PE 16258
Alloc PE / Size 16258 / 63.51 GiB
Free PE / Size 0 /0
VG UUID —-uuid—-
We can only extend a Logical Volume within the free space of the underlying Volume Group. How much free space we currently have within the Volume Group can be seen in this part of the output:

Free PE / Size 165 / 660.00 MiB
In the above example we only have 660 MB to allocate to LVMs within the vg_prd00 Volume Group. So if we want to extend the root LV we’ll have to first extend the VG backs it up.

Volume Groups group together Physical Volumes. That’s why they’re called Volume Groups. This command will show us which Physical Volumes have been registered into LVM, and to which volume groups they have been assigned:

# pvdisplay
— Physical volume —
PV Name /dev/sda2
VG Name vg_prd00
PV Size 18.15 GiB / not usable 4.00 MiB
Allocatable yes
PE Size 4.00 MiB
Total PE 4645
Free PE 165
Allocated PE 4480
PV UUID —-uuid—-
In this example we only have one Physical Volume (the /dev/sda2 partition) in the turnkey Volume Group.

Extending a Logical Volume
Bottom line: if the underlying Volume Group doesn’t have enough free space, to extend the Logical Volumeyou’ll first have to extend the underlying Volume Group by adding another Physical Volume to it.

In VMWare you could either create a new virtual hard disk device to add to the volume group, or extend an existing virtual hard disk device, create a new partition with cfdisk, and add the new partition to the Volume Group:

# example #1: you’ve added to VMWare a new virtual hard disk called /dev/sdb
pvcreate /dev/sdb
vgextend vg_prd00 /dev/sdb

# example #2: you’ve expanded the existing sda hard disk
cfdisk /dev/sda # creating /dev/sda3 (you need to reboot before you can see this)
pvcreate /dev/sda3
vgextend vg_prd00 /dev/sda3
After you’ve extended the Volume Group, you are free to extend the underlying Logical Volume:

# lvextend -L+10G /dev/vg_prd00/root
Extending logical volume root to XXXX GiB
Logical volume root successfully resized
Finally, you’ll have to resize the filesystem within /dev/turnkey/root so it can see that the underlying block device just got 10G bigger:

# resize2fs /dev/vg_prd00/root
resize2fs 1.41.11 (14-Mar-2010)
Filesystem at /dev/vg_prd00/root is mounted on /; on-line resizing required
old desc_blocks = 2, new_desc_blocks = 2
Performing an on-line resize of /dev/vg_prd00/root to XXXX (4k) blocks.
The filesystem on /dev/vg_prd00/root is now XXXX blocks longer.

or
#xfs_growfs /dev/vg_*name*/lv_*name*

Installing VMware Tools on CentOS

Following is the steps I used to solve installing VMware Tools on CentOS
1.In Sphere Client: Guest > Install/update VMware Tools
2. On the VM console in command line, being a server I do not have a GUI installed:
3. mkdir /cdrom, or any other mount point you like
4. mount the vitural cdrom from step 1; mount /dev/cdrom /cdrom
5. cd /tmp
6. tar -xvf /cdrom/VMwareTools (tab to auto-complete)
7. cd vmware (tab to auto-complete)
8. ./vmware-install.pl; accept defaults, you might have to install perl as well
9. umount /cdrom
10. In Vsphere Client: Guest > Install/upVMware Tools > OK
11. To confirm the install; in the client > VM Summary tab and look for OK next to VMWare Tools

Port Mirroring on a Force10 S50v

I wanted to mirror the traffic received and sent on port 0/48 of the Force10 S50v switch to port 0/44 on the same switch. Notice that I do not have to add port 0/44 to any vlan in order to use it for the destination for port mirroring; however, I do have to make sure it has “no ip address” and “no shutdown” configured. Now that all the physical connections are made, I setup port mirroring on the Force10 S50v switch as shown below.

————————————————————————————————————
– enable
– config
– monitor session 0
– source gigabitethernet 0/48 destination gigabitethernet 0/44 direction both

Once I get around to setting up the lagg, I would change the monitor session 0 to

source port-channel 128 destination gigabitethernet 0/44 direction both

VMware iSCSI Configs

To install the Equallogic Multi Pathing Module

SCP the zipped vib to a location accessible by your vHost.

dell-eql-mem-esx5-1.2.0.365964.zip to vHost01

Then SSH to the vHost and run the following command, editing for your location

~ # esxcli software vib install –depot /vmfs/volumes/*****/dell-eql-mem-esx5-1.2.0.365964.zip

You’ll see the result similar to below (from an older version installed)

Installation Result
Message: Operation finished successfully.
Reboot Required: false
VIBs Installed: Dell_bootbank_dell-eql-host-connection-mgr_1.1.1-268843, Dell_bootbank_dell-eql-hostprofile_1.1.0-212190, Dell_bootbank_dell-eql-routed-psp_1.1.1-262227

Once you’re running equallogic storage multi pathing module run

esxcli equallogic param list

————— —– —– — ———————————————
TotalSessions 512 1024 64 Max number of sessions per host.
VolumeSessions 12 12 1 Max number of sessions per volume.
MemberSessions 4 4 1 Max number of sessions per member per volume.
MinAdapterSpeed 1000 10000 10 Minimum adapter speed for iSCSI multipathing.
~ # esxcli equallogic param set -n=VolumeSessions -v=12
~ # esxcli equallogic param set -n=MemberSessions -v=4

run those two esxcli statements on ssh.

your member sessions are probably 2 and the volume sessions are probably 4 or 6

then rescan the paths on ths iscsi software adapter, you should triple the paths

MPM

After updating the mpm config on my vhosts

vhost01-iscsi-network

Shadow a VMware View Desktop Session

In VMware View there is no central way shadow a desktop session such as for example in Citrix XenApp. It would be nice if in the future it is possible to shadow a desktop from for example the VMware View Connection server. This is a frequently asked question by customers where VMware View is implemented.

The following steps must be taken to shadow a PCoIP session from the vSphere Console by using a GPO:

Use VMware vSphere 5 and VMware View 5 or greater (in vSphere 4 there is a registry hack available)
For Windows 7 be sure to use Hardware Version 8. For Windows XP or Vista you can use any hardware version
Create a new Group Policy Object (GPO)
Add the “pcoip.adm” file to the Computer Configuration. The ADM file can be found on the VMware View Connection server in the “C:\Program Files\VMware\VMware View\Server\extras\GroupPolicyFiles” folder
Enable the “Enable access to PCoIP session from a vSphere console” in the Computer Configuration settings.
pcoip1

Link the GPO to the OU were the VMware View Windows 7 desktop resides
Sync Domain Controllers
Restart the VMware View desktop
After configuring this, it is possible to shadow a PCoIP session from the vSphere Console. The user doesn’t need to approve the shadow session so this could be security and privacy issue. The keyboard and mouse movements are displayed on the two screens synchronously, although, there is a bit of a delay.

Locked Out of WordPress due to Google Authenticator

Locked OuI got locked out of my WordPress Site recently due to messing about with Google Authenticator and I needed to disable the plugin.
To do this, open an FTP session to your WordPress and locate the folder below

/wp-content/plugins/google-authenticator

If you rename the ‘google-authenticator’ folder to ‘_google-authenticator’ this will disable the plugin.

Login to your WordPress as normal then open the plugins.

Now from the FTP rename the ‘_google-authenticator’ back to ‘google-authenticator’ and in your web-browser click the plugins tab again the google-authenticator plugin will now be de-activated, you can re-activate it and go into your user account to re-configure.

If you watch this video from beginning to end on Google Authenticator it does step you through setting-up another admin account while you test everything in case this happens so you do not lock yourself out. You then delete the second (non Google Authenticator active) admin account once you have everything verified working okay.

See the video guide here :- http://www.mocialsedia.com/installation-essentials-for-wordpress/ it is the last one on the page video 3 on Google Authenticator.

Disable OTP Sophos UTM 9.2 via Shell

Dang it! I also locked myself out of the webadmin on Sophos UTM 9.2 while trying out their OTP function with Google Authenticator.

Here’s how I fixed this problem:

Login to the Firewall Console Interface as root
at the / type
cc
then auth and press enter,
it will list out:
ad_sso
auto_add_to_facility@
auto_add_users$
block
cache_lifetime$
edir_sso
otp
servers@

Type otp and press enter,
it will list out:
auto_create_token$
default_timestep$
facilities@
require_all_users$
required_users@
status$

Type facilities@ and press enter,
finally listing:
0 webadmin
1 portal
2 ipsec
3 openvpn

Type -0 and press enter, where it will redisplay (in this case)
0 portal
1 ipsec
3 openvpn

Login as admin to your firewall via the webadmin!!!

How to Change Port RDP Listens On

To change the port that Remote Desktop listens on, follow these steps.
1. Start Registry Editor.
2. Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TerminalServer\WinStations\RDP-Tcp\PortNumber
3. On the Edit menu, click Modify, and then click Decimal.
4. Type the new port number, and then click OK.
5. Quit Registry Editor.
6. Restart the computer.

Note When you try to connect to this computer by using the Remote Desktop connection, you must type the new port. Maybe you have to set the firewall to allow the new port number before you connect to this computer by using the Remote Desktop connection.