TetraWiki - User contributions [en]

Extract partition data from xen image file

2014-02-22T15:20:05Z

Hemant: /* GETTING DATA FROM XEN IMAGE FILE */

THE ISSUE WAS FACED ON 192.168.1.15 where a virtual machine had boot error :

ERROR: boot loader didn't return any data!

The virtual machine was not getting up so data has to be extracted

== GETTING DATA FROM XEN IMAGE FILE ==

== using kpartx utility ==

# losetup -f
/dev/loop0

'''This shows the avialable physical loop file/device that is unused and can be used to add a loop device
'''

#losetup /dev/loop0 /HDD_500/images/javapostgresql.img

'''Associated the image file to loop file/device
'''

#kpartx -av /dev/loop0

add map loop0p1 : 0 1024000 linear /dev/loop0 2048
add map loop0p2 : 0 60413952 linear /dev/loop0 1026048

'''This command reads partition tables on specified device and create device
maps over partitions segments detected'''

#losetup -a [lists all used loop files ]

/dev/loop0: [0811]:32571394 (/HDD_500GB/images/javapostgresql.img)

#vgscan

Reading all physical volumes. This may take a while...
Found volume group "VolGroup" using metadata type lvm2

#vgchange -ay VolGroup
2 logical volume(s) in volume group "VolGroup" now active

'''activate and deactivate VolumeGroupName, or all volume groups if none is specified.'''

#lvs
LV VG Attr LSize Origin Snap% Move Log Copy% Convert
lv_root VolGroup -wi-a- 27.80G
lv_swap VolGroup -wi-a- 1.00G

#mount /dev/VolGroup/lv_root /mnt/data/

NOW you can access your root partition in image on /mnt/data folder

After data is copied unmount the partition

#umount /mnt/data/

#vgchange -an VolGroup
0 logical volume(s) in volume group "VolGroup" now active

#kpartx -d /dev/loop0

#losetup -d /dev/loop0 [delete from used]

NOTE: always remember to deactivate the logical volumes with "vgchange -an", remove the partitions with "kpartx -d", and (if appropriate) delete the loop device with "losetup -d" after you are finished. There are two reasons: first of all, the default volume group name for a install is always the same, so if you end up activating two disk images at the same time you'll end up with two separate LVM volume groups with the same name. LVM will cope as best it can, but you won't be able to distinguish between these two groups on the command line.

And secondly, if you don't deactivate it, then if the guest is started up again, you might end up with the LVM being active in both the guest and the dom0 at the same time, and this may lead to VG or filesystem corruption.

Extract partition data from xen image file

2014-02-22T15:11:31Z

Hemant: /* GETTING DATA FROM XEN IMAGE FILE */

THE ISSUE WAS FACED ON 192.168.1.15 where a virtual machine had boot error :

ERROR: boot loader didn't return any data!

The virtual machine was not getting up so data has to be extracted

== GETTING DATA FROM XEN IMAGE FILE ==

using kpartx utility

# losetup -f [find unused loop files ]
/dev/loop0

#losetup /dev/loop0 /HDD_500/images/javapostgresql.img

#kpartx -av /dev/loop0

add map loop1p1 : 0 1024000 linear /dev/loop1 2048
add map loop1p2 : 0 60413952 linear /dev/loop1 1026048

#losetup -a [lists all used loop files ]

/dev/loop0: [0811]:32571394 (/HDD_500GB/images/javapostgresql.img)
/dev/loop1: [0811]:32571394 (/HDD_500GB/images/javapostgresql.img)

#vgscan

Reading all physical volumes. This may take a while...
Found volume group "VolGroup" using metadata type lvm2

#vgchange -ay VolGroup
2 logical volume(s) in volume group "VolGroup" now active

#lvs
LV VG Attr LSize Origin Snap% Move Log Copy% Convert
lv_root VolGroup -wi-a- 27.80G
lv_swap VolGroup -wi-a- 1.00G

#mount /dev/VolGroup/lv_root /mnt/data/

NOW you can access your root partition in image on /mnt/data folder

After data is copied unmount the partition

#umount /mnt/data/

#vgchange -an VolGroup
0 logical volume(s) in volume group "VolGroup" now active

#kpartx -d /dev/loop0

#losetup -d /dev/loop0 [delete from used]

NOTE: always remember to deactivate the logical volumes with "vgchange -an", remove the partitions with "kpartx -d", and (if appropriate) delete the loop device with "losetup -d" after you are finished. There are two reasons: first of all, the default volume group name for a install is always the same, so if you end up activating two disk images at the same time you'll end up with two separate LVM volume groups with the same name. LVM will cope as best it can, but you won't be able to distinguish between these two groups on the command line.

And secondly, if you don't deactivate it, then if the guest is started up again, you might end up with the LVM being active in both the guest and the dom0 at the same time, and this may lead to VG or filesystem corruption.

Extract partition data from xen image file

2014-02-22T14:41:38Z

Hemant: /* GETTING DATA FROM XEN IMAGE FILE */

THE ISSUE WAS FACED ON 192.168.1.15 where a virtual machine had boot error :

ERROR: boot loader didn't return any data!

The virtual machine was not getting up so data has to be extracted

== GETTING DATA FROM XEN IMAGE FILE ==

using kpartx utility

# losetup -f -- find unused
/dev/loop0

#losetup /dev/loop0 /HDD_500/images/javapostgresql.img

#kpartx -av /dev/loop0
add map loop1p1 : 0 1024000 linear /dev/loop1 2048
add map loop1p2 : 0 60413952 linear /dev/loop1 1026048

#losetup -a ---lists all used
/dev/loop0: [0811]:32571394 (/HDD_500GB/images/javapostgresql.img)
/dev/loop1: [0811]:32571394 (/HDD_500GB/images/javapostgresql.img)

#vgscan

Reading all physical volumes. This may take a while...
Found volume group "VolGroup" using metadata type lvm2

#vgchange -ay VolGroup
2 logical volume(s) in volume group "VolGroup" now active

#lvs
LV VG Attr LSize Origin Snap% Move Log Copy% Convert
lv_root VolGroup -wi-a- 27.80G
lv_swap VolGroup -wi-a- 1.00G

#mount /dev/VolGroup/lv_root /mnt/data/

NOW you can access your root partition in image on /mnt/data folder

After data is copied unmount the partition

#umount /mnt/data/

#vgchange -an VolGroup
0 logical volume(s) in volume group "VolGroup" now active

#kpartx -d /dev/loop0

#losetup -d /dev/loop0 --delete from used

NOTE: always remember to deactivate the logical volumes with "vgchange -an", remove the partitions with "kpartx -d", and (if appropriate) delete the loop device with "losetup -d" after you are finished. There are two reasons: first of all, the default volume group name for a install is always the same, so if you end up activating two disk images at the same time you'll end up with two separate LVM volume groups with the same name. LVM will cope as best it can, but you won't be able to distinguish between these two groups on the command line.

And secondly, if you don't deactivate it, then if the guest is started up again, you might end up with the LVM being active in both the guest and the dom0 at the same time, and this may lead to VG or filesystem corruption.

Extract partition data from xen image file

2014-02-22T12:16:27Z

Hemant: /* GETTING DATA FROM XEN IMAGE FILE */

THE ISSUE WAS FACED ON 192.168.1.15 where a virtual machine had boot error :

ERROR: boot loader didn't return any data!

The virtual machine was not getting up so data has to be extracted

== GETTING DATA FROM XEN IMAGE FILE ==

using kpartx utility

# losetup -f -- find unused
/dev/loop0

#losetup /dev/loop0 /HDD_500/images/javapostgresql.img

#kpartx -av /dev/loop0
add map loop1p1 : 0 1024000 linear /dev/loop1 2048
add map loop1p2 : 0 60413952 linear /dev/loop1 1026048

#losetup -a ---lists all used
/dev/loop0: [0811]:32571394 (/HDD_500GB/images/javapostgresql.img)
/dev/loop1: [0811]:32571394 (/HDD_500GB/images/javapostgresql.img)

#vgscan

Reading all physical volumes. This may take a while...
Found volume group "VolGroup" using metadata type lvm2

#vgchange -ay VolGroup
2 logical volume(s) in volume group "VolGroup" now active

#lvs
LV VG Attr LSize Origin Snap% Move Log Copy% Convert
lv_root VolGroup -wi-a- 27.80G
lv_swap VolGroup -wi-a- 1.00G

#mount /dev/VolGroup/lv_root /mnt/data/

NOW you can access your root partition in image on /mnt/data folder

After data is copied unmount the partition

#umount /mnt/data/

#vgchange -an VolGroup
0 logical volume(s) in volume group "VolGroup" now active

#losetup -d /dev/loop0 --delete from used

NOTE: always remember to deactivate the logical volumes with "vgchange -an", remove the partitions with "kpartx -d", and (if appropriate) delete the loop device with "losetup -d" after you are finished. There are two reasons: first of all, the default volume group name for a install is always the same, so if you end up activating two disk images at the same time you'll end up with two separate LVM volume groups with the same name. LVM will cope as best it can, but you won't be able to distinguish between these two groups on the command line.

And secondly, if you don't deactivate it, then if the guest is started up again, you might end up with the LVM being active in both the guest and the dom0 at the same time, and this may lead to VG or filesystem corruption.

Extract partition data from xen image file

2014-02-22T11:49:17Z

Hemant: Created page with "THE ISSUE WAS FACED ON 192.168.1.15 where a virtual machine had boot error : ERROR: boot loader didn't return any data! The virtual machine was not getting up so data has to..."

Category:Heromotocorp/QMAIL QUEUE COUSTOM SCRIPT

2013-12-30T12:26:06Z

Hemant:

A script to get qmail queue status via qmHandle

<nowiki>==

#!/bin/bash
STATE_OK=0
STATE_WARNING=1
STATE_CRITICAL=2
STATE_UNKNOWN=3
STATE_DEPENDENT=4
warn=$1
crit=$2
QUEUE=`qmHandle -s | grep "Total messages"| awk 'BEGIN { FS = ":" } ; { print $2 }'`

if [[ $QUEUE -lt $warn || $QUEUE -eq $warn ]]

then echo $QUEUE "Queue OK " ; exit ${STATE_OK} ;

elif [[ $QUEUE -gt $warn && $QUEUE -lt $crit ]]

then echo "QUEUE WARNING " $QUEUE ; exit ${STATE_WARNING} ;

else

echo "QUEUE CRITICAL" $QUEUE ; exit ${STATE_CRITICAL} ;

fi

==</nowiki>

Category:Heromotocorp/QMAIL QUEUE COUSTOM SCRIPT

2013-12-30T12:25:32Z

Hemant:

A script to get qmail queue status via qmHandle

<nowiki>==

#!/bin/bash
STATE_OK=0
STATE_WARNING=1
STATE_CRITICAL=2
STATE_UNKNOWN=3
STATE_DEPENDENT=4
warn=$1
crit=$2
QUEUE=`qmHandle -s | grep "Total messages"| awk 'BEGIN { FS = ":" } ; { print $2 }'`

if " [[ $QUEUE -lt $warn || $QUEUE -eq $warn ]] " # remove ""

then echo $QUEUE "Queue OK " ; exit ${STATE_OK} ;

elif " [[ $QUEUE -gt $warn && $QUEUE -lt $crit ]] " # remove ""

then echo "QUEUE WARNING " $QUEUE ; exit ${STATE_WARNING} ;

else

echo "QUEUE CRITICAL" $QUEUE ; exit ${STATE_CRITICAL} ;

fi

==</nowiki>

Category:Heromotocorp/QMAIL QUEUE COUSTOM SCRIPT

2013-12-30T12:07:05Z

Hemant: Created page with " A script to get qmail queue status via qmHandle == #!/bin/bash STATE_OK=0 STATE_WARNING=1 STATE_CRITICAL=2 STATE_UNKNOWN=3 STATE_DEPENDENT=4 warn=$1 crit=$2 QUEU..."

A script to get qmail queue status via qmHandle

==

#!/bin/bash
STATE_OK=0
STATE_WARNING=1
STATE_CRITICAL=2
STATE_UNKNOWN=3
STATE_DEPENDENT=4
warn=$1
crit=$2
QUEUE=`qmHandle -s | grep "Total messages"| awk 'BEGIN { FS = ":" } ; { print $2 }'`
if [[ $QUEUE -lt $warn || $QUEUE -eq $warn ]]
then echo $QUEUE "Queue OK " ; exit ${STATE_OK} ;
elif [[ $QUEUE -gt $warn && $QUEUE -lt $crit ]]
then echo "QUEUE WARNING " $QUEUE ; exit ${STATE_WARNING} ;
else
echo "QUEUE CRITICAL" $QUEUE ; exit ${STATE_CRITICAL} ;
fi

==

File:Heromotocorp's Mail Architecture.png

2013-12-18T07:10:31Z

Hemant: uploaded a new version of "File:Heromotocorp's Mail Architecture.png": Reverted to version as of 09:11, 14 January 2013

File:Heromotocorp's Mail Architecture.png

2013-12-18T06:55:33Z

Hemant: uploaded a new version of "File:Heromotocorp's Mail Architecture.png": Incoming mails routed only to Delhi server Outgoing only via ggn server

Main Page/Nagios add Indirect Host and Service Checks

2013-10-30T19:58:35Z

Hemant: /* On Nagios Server : */

[[File:/root/Desktop/indirectsvccheck_converted.jpg]]
== Headline text ==
'''NAGIOS INDIRECT MAPPING OF HOSTS'''

For Environments that have multiple servers and only one server or firewall is accessible directly i.e one server is accessible and all others may be accessed through it internally . Nagios mapping may be done via Indirect Host and Service Checks using nrpe.

Indirect checks are useful for:
Monitoring "local" resources (such as disk usage, processer load, etc.) on remote hosts

Monitoring services and hosts behind firewalls

Obtaining more realistic results from checks of time-sensitive services between remote hosts (i.e. ping response times between two remote hosts)

Indirect service check Senario :

As in 2coms there is a backup server associated with the main server indirectly accessible via the mailserver

Access IP : zimbraserver.2coms.com/115.248.160.99

Mailserver Internal Ip : 192.168.1.3 ( primary server)

Backup server Ip :`192.168.1.5 (secondary server)

== Procedure Taken : ==

== on directly accessible ( primary ) server : ==

1. Access mail-server ( server already mapped as directly accesible )

2. Install check_nrpe plugin if not present

# yum install nagios-plugins-nrpe

3. now add entry in nrpe.cfg for each service you want to check on the secondary/passive server as shown below :

COMMANDS FOR MAIN SERVER

command[check_users]=/usr/local/nagios/libexec/check_users -w 5 -c 10

command[check_load]=/usr/local/nagios/libexec/check_load -w 15,10,5 -c 30,25,20

command[check_hda1]=/usr/local/nagios/libexec/check_disk -w 7% -c 5% -p /dev/sda3

command[check_zombie_procs]=/usr/local/nagios/libexec/check_procs -w 5 -c 10 -s Z

command[check_cpu]=/usr/local/nagios/libexec/check_cpu.sh -w 60 -c 70

command[check_mem]=/usr/local/nagios/libexec/check_mem_avail -w 130 -c 150

command[check_clam]=/usr/local/nagios/libexec/check_clamd -H localhost

command[check_queue]=/usr/local/nagios/libexec/check_postfix_queue -w 300 -c 500

command[check_zimbra_clam_ud]=sudo -u zimbra /usr/local/nagios/libexec/check_clamav -w 2 -c 5

command[check_zimbra_lmtp]=/usr/local/nagios/libexec/check_smtp -H localhost -p 7025 -e '220 zimbraserver.2coms.com Zimbra LMTP server ready'

'''# following commands are for backup server 192.168.1.5'''

command[check_users2]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_users

command[check_load2]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_load

command[check_hda12]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_hda1

command[check_hda22]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_hda2

command[check_hda32]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_hda3

command[check_zombie_procs2]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_zombie_procs

command[check_cpu2]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_cpu

command[check_mem2]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_mem

command[check_clam2]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_clam

command[check_queue2]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_queue

command[check_zimbra_lmtp2]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_zimbra_lmtp

== on Secondary ( Backup ) server : ==

Install nrpe and nagios plugins :

# yum install nrpe nagios-plugins-all

edit nrpe.cfg as follows :

allowed_hosts=127.0.0.1,192.168.1.3

And also add plugin definition as :

command[check_users]=/usr/lib64/nagios/plugins/check_users -w 5 -c 10

command[check_load]=/usr/lib64/nagios/plugins/check_load -w 15,10,5 -c 30,25,20

command[check_hda1]=/usr/lib64/nagios/plugins/check_disk -w 7% -c 5% -p /dev/hda3

command[check_hda2]=/usr/lib64/nagios/plugins/check_disk -w 7% -c 5% -p /dev/hda1

command[check_hda3]=/usr/lib64/nagios/plugins/check_disk -w 10% -c 5% -p /dev/sda1

command[check_zombie_procs]=/usr/lib64/nagios/plugins/check_procs -w 5 -c 10 -s Z

command[check_cpu]=/usr/lib64/nagios/plugins/check_cpu.sh -w 60 -c 70

command[check_mem]=/usr/lib64/nagios/plugins/check_mem_avail -w 130 -c 150

command[check_clam]=/usr/lib64/nagios/plugins/check_clamd -H localhost

command[check_queue]=/usr/lib64/nagios/plugins/check_postfix_queue -w 300 -c 500

Restart nrpe on this server

Restart nrpe on Primary server

== On Nagios Server : ==

Add Host entry in /usr/local/nagios/etc/objects/linux-box.cfg with Access Ip :

Entries for Primary Server :

define host{
use linux-server
host_name zimbraserver.2coms.com
alias zimbraserver.2coms.com
address 182.71.172.155
hostgroups Tetra Clients ; Host groups
}

Entries for Secondary Server :

define host{
use linux-server
host_name backupserver.2coms.com
alias backupserver.2coms.com
address 182.71.172.155
hostgroups Tetra Clients ; Host groups
}

Note : address field is same for both host

add service definition in /usr/local/nagios/etc/service/backupserver.2coms.com.cfg for all services already defined in nrpe.cfg on primary host

eg :

define service{
use generic-service
host_name backupserver.2coms.com
service_description Current Users
check_command check_nrpe!check_users2
}

check nagios configuration
/usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/nagios.cfg

Reload nagios
/etc/init.d/nagios reload

Main Page/Nagios add Indirect Host and Service Checks

2013-10-30T19:00:44Z

Hemant: /* on directly accessible ( primary ) server : */

File:Indirectsvccheck converted.jpg

2013-10-30T17:52:20Z

Hemant: uploaded a new version of "File:Indirectsvccheck converted.jpg"

This shows How mapping of indirect hosts is done

File:Indirectsvccheck converted.jpg

2013-10-30T17:49:45Z

Hemant: This shows How mapping of indirect hosts is done

This shows How mapping of indirect hosts is done

Main Page/Nagios add Indirect Host and Service Checks

2013-10-30T17:47:46Z

Hemant:

[[File:/root/Desktop/indirectsvccheck_converted.jpg]]
== Headline text ==
'''NAGIOS INDIRECT MAPPING OF HOSTS'''

For Environments that have multiple servers and only one server or firewall is accessible directly i.e one server is accessible and all others may be accessed through it internally . Nagios mapping may be done via Indirect Host and Service Checks using nrpe.

Indirect checks are useful for:
Monitoring "local" resources (such as disk usage, processer load, etc.) on remote hosts

Monitoring services and hosts behind firewalls

Obtaining more realistic results from checks of time-sensitive services between remote hosts (i.e. ping response times between two remote hosts)

Indirect service check Senario :

As in 2coms there is a backup server associated with the main server indirectly accessible via the mailserver

Access IP : zimbraserver.2coms.com/115.248.160.99

Mailserver Internal Ip : 192.168.1.3 ( primary server)

Backup server Ip :`192.168.1.5 (secondary server)

== Procedure Taken : ==

== on directly accessible ( primary ) server : ==

1. Access mail-server ( server already mapped as directly accesible )

2. Install check_nrpe plugin if not present

# yum install nagios-plugins-nrpe

3. now add entry in nrpe.cfg for each service you want to check on the secondary/passive server as shown below :

COMMANDS FOR MAIN SERVER

command[check_users]=/usr/local/nagios/libexec/check_users -w 5 -c 10

command[check_load]=/usr/local/nagios/libexec/check_load -w 15,10,5 -c 30,25,20

command[check_hda1]=/usr/local/nagios/libexec/check_disk -w 7% -c 5% -p /dev/sda3

command[check_zombie_procs]=/usr/local/nagios/libexec/check_procs -w 5 -c 10 -s Z

command[check_cpu]=/usr/local/nagios/libexec/check_cpu.sh -w 60 -c 70

command[check_mem]=/usr/local/nagios/libexec/check_mem_avail -w 130 -c 150

command[check_clam]=/usr/local/nagios/libexec/check_clamd -H localhost

command[check_queue]=/usr/local/nagios/libexec/check_postfix_queue -w 300 -c 500

command[check_zimbra_clam_ud]=sudo -u zimbra /usr/local/nagios/libexec/check_clamav -w 2 -c 5

command[check_zimbra_lmtp]=/usr/local/nagios/libexec/check_smtp -H localhost -p 7025 -e '220 zimbraserver.2coms.com Zimbra LMTP server ready'

# following commands are for backup server 192.168.1.5

command[check_users2]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_users

command[check_load2]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_load

command[check_hda12]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_hda1

command[check_hda22]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_hda2

command[check_hda32]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_hda3

command[check_zombie_procs2]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_zombie_procs

command[check_cpu2]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_cpu

command[check_mem2]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_mem

command[check_clam2]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_clam

command[check_queue2]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_queue

command[check_zimbra_lmtp2]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_zimbra_lmtp

== on Secondary ( Backup ) server : ==

Install nrpe and nagios plugins :

# yum install nrpe nagios-plugins-all

edit nrpe.cfg as follows :

allowed_hosts=127.0.0.1,192.168.1.3

And also add plugin definition as :

command[check_users]=/usr/lib64/nagios/plugins/check_users -w 5 -c 10

command[check_load]=/usr/lib64/nagios/plugins/check_load -w 15,10,5 -c 30,25,20

command[check_hda1]=/usr/lib64/nagios/plugins/check_disk -w 7% -c 5% -p /dev/hda3

command[check_hda2]=/usr/lib64/nagios/plugins/check_disk -w 7% -c 5% -p /dev/hda1

command[check_hda3]=/usr/lib64/nagios/plugins/check_disk -w 10% -c 5% -p /dev/sda1

command[check_zombie_procs]=/usr/lib64/nagios/plugins/check_procs -w 5 -c 10 -s Z

command[check_cpu]=/usr/lib64/nagios/plugins/check_cpu.sh -w 60 -c 70

command[check_mem]=/usr/lib64/nagios/plugins/check_mem_avail -w 130 -c 150

command[check_clam]=/usr/lib64/nagios/plugins/check_clamd -H localhost

command[check_queue]=/usr/lib64/nagios/plugins/check_postfix_queue -w 300 -c 500

Restart nrpe on this server

Restart nrpe on Primary server

== On Nagios Server : ==

Add Host entry in /usr/local/nagios/etc/objects/linux-box.cfg with Access Ip :

Entries for Primary Server :

define host{
use linux-server
host_name zimbraserver.2coms.com
alias zimbraserver.2coms.com
address 182.71.172.155
hostgroups Tetra Clients ; Host groups
}

Entries for Secondary Server :

define host{
use linux-server
host_name backupserver.2coms.com
alias backupserver.2coms.com
address 182.71.172.155
hostgroups Tetra Clients ; Host groups
}

Note : address field is same for both host

add service definition in /usr/local/nagios/etc/service/backupserver.2coms.com.cfg for all services already defined in nrpe.cfg on primary host

eg :

define service{
use generic-service
host_name backupserver.2coms.com
service_description Current Users
check_command check_nrpe!check_users2
}

check nagios configuration
/usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/nagios.cfg

Reload nagios configuration
/etc/init.d/nagios reload

Main Page/Nagios add Indirect Host and Service Checks

2013-10-30T17:39:52Z

Hemant: Created page with " == Headline text == '''NAGIOS INDIRECT MAPPING OF HOSTS''' For Environments that have multiple servers and only one server or firewall is accessible directly i.e one server..."

== Headline text ==
'''NAGIOS INDIRECT MAPPING OF HOSTS'''

For Environments that have multiple servers and only one server or firewall is accessible directly i.e one server is accessible and all others may be accessed through it internally . Nagios mapping may be done via Indirect Host and Service Checks using nrpe.

Indirect checks are useful for:
Monitoring "local" resources (such as disk usage, processer load, etc.) on remote hosts

Monitoring services and hosts behind firewalls

Obtaining more realistic results from checks of time-sensitive services between remote hosts (i.e. ping response times between two remote hosts)

Indirect service check Senario :

As in 2coms there is a backup server associated with the main server indirectly accessible via the mailserver

Access IP : zimbraserver.2coms.com/115.248.160.99

Mailserver Internal Ip : 192.168.1.3 ( primary server)

Backup server Ip :`192.168.1.5 (secondary server)

== Procedure Taken : ==

== on directly accessible ( primary ) server : ==

1. Access mail-server ( server already mapped as directly accesible )

2. Install check_nrpe plugin if not present

# yum install nagios-plugins-nrpe

3. now add entry in nrpe.cfg for each service you want to check on the secondary/passive server as shown below :

COMMANDS FOR MAIN SERVER

command[check_users]=/usr/local/nagios/libexec/check_users -w 5 -c 10

command[check_load]=/usr/local/nagios/libexec/check_load -w 15,10,5 -c 30,25,20

command[check_hda1]=/usr/local/nagios/libexec/check_disk -w 7% -c 5% -p /dev/sda3

command[check_zombie_procs]=/usr/local/nagios/libexec/check_procs -w 5 -c 10 -s Z

command[check_cpu]=/usr/local/nagios/libexec/check_cpu.sh -w 60 -c 70

command[check_mem]=/usr/local/nagios/libexec/check_mem_avail -w 130 -c 150

command[check_clam]=/usr/local/nagios/libexec/check_clamd -H localhost

command[check_queue]=/usr/local/nagios/libexec/check_postfix_queue -w 300 -c 500

command[check_zimbra_clam_ud]=sudo -u zimbra /usr/local/nagios/libexec/check_clamav -w 2 -c 5

command[check_zimbra_lmtp]=/usr/local/nagios/libexec/check_smtp -H localhost -p 7025 -e '220 zimbraserver.2coms.com Zimbra LMTP server ready'

# following commands are for backup server 192.168.1.5

command[check_users2]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_users

command[check_load2]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_load

command[check_hda12]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_hda1

command[check_hda22]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_hda2

command[check_hda32]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_hda3

command[check_zombie_procs2]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_zombie_procs

command[check_cpu2]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_cpu

command[check_mem2]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_mem

command[check_clam2]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_clam

command[check_queue2]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_queue

command[check_zimbra_lmtp2]=/usr/local/nagios/libexec/check_nrpe -H 192.168.1.5 -c check_zimbra_lmtp

== on Secondary ( Backup ) server : ==

Install nrpe and nagios plugins :

# yum install nrpe nagios-plugins-all

edit nrpe.cfg as follows :

allowed_hosts=127.0.0.1,192.168.1.3

And also add plugin definition as :

command[check_users]=/usr/lib64/nagios/plugins/check_users -w 5 -c 10

command[check_load]=/usr/lib64/nagios/plugins/check_load -w 15,10,5 -c 30,25,20

command[check_hda1]=/usr/lib64/nagios/plugins/check_disk -w 7% -c 5% -p /dev/hda3

command[check_hda2]=/usr/lib64/nagios/plugins/check_disk -w 7% -c 5% -p /dev/hda1

command[check_hda3]=/usr/lib64/nagios/plugins/check_disk -w 10% -c 5% -p /dev/sda1

command[check_zombie_procs]=/usr/lib64/nagios/plugins/check_procs -w 5 -c 10 -s Z

command[check_cpu]=/usr/lib64/nagios/plugins/check_cpu.sh -w 60 -c 70

command[check_mem]=/usr/lib64/nagios/plugins/check_mem_avail -w 130 -c 150

command[check_clam]=/usr/lib64/nagios/plugins/check_clamd -H localhost

command[check_queue]=/usr/lib64/nagios/plugins/check_postfix_queue -w 300 -c 500

Restart nrpe on this server

Restart nrpe on Primary server

== On Nagios Server : ==

Add Host entry in /usr/local/nagios/etc/objects/linux-box.cfg with Access Ip :

Entries for Primary Server :

define host{
use linux-server
host_name zimbraserver.2coms.com
alias zimbraserver.2coms.com
address 182.71.172.155
hostgroups Tetra Clients ; Host groups
}

Entries for Secondary Server :

define host{
use linux-server
host_name backupserver.2coms.com
alias backupserver.2coms.com
address 182.71.172.155
hostgroups Tetra Clients ; Host groups
}

Note : address field is same for both host

add service definition in /usr/local/nagios/etc/service/backupserver.2coms.com.cfg for all services already defined in nrpe.cfg on primary host

eg :

define service{
use generic-service
host_name backupserver.2coms.com
service_description Current Users
check_command check_nrpe!check_users2
}

check nagios configuration
/usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/nagios.cfg

Reload nagios configuration
/etc/init.d/nagios reload

Main Page/postfix mail statistics

2013-09-05T11:15:16Z

Hemant:

'''Postfix mail statistics via log analyzer'''

Pflogsumm is a log analyzer for Postfix. The generated report can show you patterns in email traffic so you can better determine mail server abusers or if your mail server needs to be upgraded.

Statistics can be very helpful in showing, for example, when most of your mail is sent or received or if that one mail user is sending out more than their fair share of mail.

Pflogsumm is a single perl file and its only dependancies are perl, the perl module Date::Calc (which is probably already installed on your system) and the proper location of a Postfix log file.

There are 2 ways to install pflogsumm :

== process 1 : ==

Step 1: To get started you first need to download the pflogsumm.pl perl script. from the link :

jimsun.linxnet.com/downloads/pflogsumm-1.1.0.tar.gz

Step 2: Extract the files from the tar ball and put _only_ the perl script pflogsumm.pl into /usr/sbin/ . Make sure the permissions are 700 for security.

Step 3: get statistics out of logs :
/usr/sbin/pflogsumm -u 5 -h 5 -d today /var/log/mail.log

== process 2: ==

install pflogsumm

apt-get install pflogsumm

get statistics out of logs :
/usr/sbin/pflogsumm -u 5 -h 5 -d today /var/log/mail.log

==
INSTALL A NEW CRONTAB FOR GETTING REGULAR UPDATE OF EACH DAYS MAIL STATISTICS
==

59 23 * * * /usr/sbin/pflogsumm -u 5 -h 5 -d today /var/log/mail.log | mail -s "pflogsumm report " root@localhost

Main Page/postfix mail statistics

2013-09-05T11:09:01Z

Hemant:

'''Postfix mail statistics via log analyzer'''

Pflogsumm is a log analyzer for Postfix. The generated report can show you patterns in email traffic so you can better determine mail server abusers or if your mail server needs to be upgraded.

Statistics can be very helpful in showing, for example, when most of your mail is sent or received or if that one mail user is sending out more than their fair share of mail.

Pflogsumm is a single perl file and its only dependancies are perl, the perl module Date::Calc (which is probably already installed on your system) and the proper location of a Postfix log file.

There are 2 ways to install pflogsumm :

== process 1 : ==

Step 1: To get started you first need to download the pflogsumm.pl perl script. from the link :

jimsun.linxnet.com/downloads/pflogsumm-1.1.0.tar.gz

Step 2: Extract the files from the tar ball and put _only_ the perl script pflogsumm.pl into /usr/local/bin/ . Make sure the permissions are 700 for security.

Step 3: get statistics out of logs :
/usr/local/bin/pflogsumm -u 5 -h 5 -d today /var/log/mail.log

== process 2: ==

install pflogsumm

apt-get install pflogsumm

get statistics out of logs :
/usr/local/bin/pflogsumm -u 5 -h 5 -d today /var/log/mail.log

==
INSTALL A NEW CRONTAB FOR GETTING REGULAR UPDATE OF EACH DAYS MAIL STATISTICS
==

59 23 * * * /usr/local/bin/pflogsumm -u 5 -h 5 -d today /var/log/mail.log | mail -s "pflogsumm report " root@localhost

Main Page/postfix mail statistics

2013-09-05T11:07:47Z

Hemant:

'''Postfix mail statistics via log analyzer'''

Pflogsumm is a log analyzer for Postfix. The generated report can show you patterns in email traffic so you can better determine mail server abusers or if your mail server needs to be upgraded.

Statistics can be very helpful in showing, for example, when most of your mail is sent or received or if that one mail user is sending out more than their fair share of mail.

Pflogsumm is a single perl file and its only dependancies are perl, the perl module Date::Calc (which is probably already installed on your system) and the proper location of a Postfix log file.

There are 2 ways to install pflogsumm :

== process 1 : ==

Step 1: To get started you first need to download the pflogsumm.pl perl script. from the link :

jimsun.linxnet.com/downloads/pflogsumm-1.1.0.tar.gz

Step 2: Extract the files from the tar ball and put _only_ the perl script pflogsumm.pl into /usr/local/bin/ . Make sure the permissions are 700 for security.

Step 3: get statistics out of logs :
/usr/local/bin/pflogsumm -u 5 -h 5 -d today /var/log/mail.log

== process 2: ==

install pflogsumm

get statistics out of logs :
/usr/local/bin/pflogsumm -u 5 -h 5 -d today /var/log/mail.log

==
INSTALL A NEW CRONTAB FOR GETTING REGULAR UPDATE OF EACH DAYS MAIL STATISTICS
==

59 23 * * * /usr/local/bin/pflogsumm -u 5 -h 5 -d today /var/log/mail.log | mail -s "pflogsumm report " root@localhost

Main Page/postfix mail statistics

2013-09-05T11:06:34Z

Hemant:

'''Postfix mail statistics via log analyzer'''

Pflogsumm is a log analyzer for Postfix. The generated report can show you patterns in email traffic so you can better determine mail server abusers or if your mail server needs to be upgraded.

Statistics can be very helpful in showing, for example, when most of your mail is sent or received or if that one mail user is sending out more than their fair share of mail.

Pflogsumm is a single perl file and its only dependancies are perl, the perl module Date::Calc (which is probably already installed on your system) and the proper location of a Postfix log file.

There are 2 ways to install pflogsumm :

== process 1 : ==

Step 1: To get started you first need to download the pflogsumm.pl perl script.

Download pflogsumm.pl here.

Step 2: Extract the files from the tar ball and put _only_ the perl script pflogsumm.pl into /usr/local/bin/ . Make sure the permissions are 700 for security.

Step 3: get statistics out of logs :
/usr/local/bin/pflogsumm -u 5 -h 5 -d today /var/log/mail.log

== process 2: ==

install pflogsumm

get statistics out of logs :
/usr/local/bin/pflogsumm -u 5 -h 5 -d today /var/log/mail.log

==
INSTALL A NEW CRONTAB FOR GETTING REGULAR UPDATE OF EACH DAYS MAIL STATISTICS
==

59 23 * * * /usr/local/bin/pflogsumm -u 5 -h 5 -d today /var/log/mail.log | mail -s "pflogsumm report " root@localhost

Main Page/postfix mail statistics

2013-09-05T11:05:05Z

Hemant: Created page with "'''Postfix mail statistics via log analyzer''' Pflogsumm is a log analyzer for Postfix. The generated report can show you patterns in email traffic so you can better determi..."

'''Postfix mail statistics via log analyzer'''

Pflogsumm is a log analyzer for Postfix. The generated report can show you patterns in email traffic so you can better determine bandwidth limitations, mail server abusers or if your mail server needs to be upgraded.

Statistics can be very helpful in showing, for example, when most of your mail is sent or received or if that one mail user is sending out more than their fair share of mail.

Pflogsumm is a single perl file and its only dependancies are perl, the perl module Date::Calc (which is probably already installed on your system) and the proper location of a Postfix log file.

There are 2 ways to install pflogsumm :

== process 1 : ==

Step 1: To get started you first need to download the pflogsumm.pl perl script.

Download pflogsumm.pl here.

Step 2: Extract the files from the tar ball and put _only_ the perl script pflogsumm.pl into /usr/local/bin/ . Make sure the permissions are 700 for security.

Step 3: get statistics out of logs :
/usr/local/bin/pflogsumm -u 5 -h 5 -d today /var/log/mail.log

== process 2: ==

install pflogsumm

get statistics out of logs :
/usr/local/bin/pflogsumm -u 5 -h 5 -d today /var/log/mail.log

==
INSTALL A NEW CRONTAB FOR GETTING REGULAR UPDATE OF EACH DAYS MAIL STATISTICS
==

59 23 * * * /usr/local/bin/pflogsumm -u 5 -h 5 -d today /var/log/mail.log | mail -s "pflogsumm report " root@localhost

Main Page/Add rules in spamassasin for spam tagging

2013-08-17T05:03:10Z

Hemant: /* A few short words about the behavior of the "score" command */

== To reduce spam we need to add rules in spamassassin ==

This can be achieve by tuning spamassassin and applying / adding rules for effective spam filtering.

----
For some cases only whitelisting and blacklisting of domain does not help . hence we need custom rules for such cases.
----

== where to write the rules : ==

/etc/mail/spamassassin/local.cf
----

== Writing basic rules ==

== Body rules : ==

These rules search the body of the message with a regular expression and if it matches, the corresponding score is assigned.

body EXAMPLE_RULE /test/
score EXAMPLE_RULE 0.1
describe EXAMPLE_RULE This is a simple test rule

This rule does a simple case-sensitive search of the body of the email for the string "test" and adds a 0.1 to the score of the email if it finds it
It will match "test" but also "testing" and "attest"
In regular expressions a \b can be used to indicate where a word-break (anything that isn't an alphanumeric character or underscore) must exist for a match. Our rule above can be made to not match "testing" or "attest" like so:

body EXAMPLE_RULE /\btest\b/

The rule can also be made case-insensitive by adding an i to the end, like this:

body EXAMPLE_RULE /\btest\b/i
score EXAMPLE_RULE 0.1

Now the rule will match any combination of upper or lower case that spells "test" surrounded by word breaks of some form.

== Header rules ==

Header rules let you check a message header for a string. Most commonly these rules check the Subject, From, or To, but they can be written to check any message header, including non-standard ones
fOR SUBJECT RULES :
header EXAMPLE_SUBJECT Subject =~ /\btest\b/i
score EXAMPLE_SUBJECT 0.1

The above rule will match a subject: line containing "test" or a SUBJECT: line containing "test". The first part before the =~ indicates what the name of the header you want to check

Checking the From: line, or any other header, works much the same:

header EXAMPLE_FROM From =~ /test\.com/i
score EXAMPLE_FROM 0.1

== THERE WAS A CASE WHERE SPAM USED TO COME FROM DIFFRENT DOMAINS OF SIMILAR NAME ( MYJAMANA 1 , MYJAMAN2, MYJAMANA3, MYJAMANA4 ETC.) FOR THIS THE FROM RULE IS APPLICABLE ==

There's also an option to look at all the headers and match if any of them contain the specified regex:

header LOCAL_DEMONSTRATION_ALL ALL =~ /test\.com/i
score LOCAL_DEMONSTRATION_ALL 0.1

Not very commonly used, but this feature can also be used to do a case-sensitive check on a header name (it will look at the whole lines, not just the parts after the colon)

header LOCAL_DEMONSTRATION_WEIRD_FROM ALL =~ /^FrOM\:/

== A few short words about the behavior of the "score" command ==
rules with a score set to 0 are not evaluated at all.
rules with no score statement will be scored at 1.0, unless 3 or 4 is true
rules starting with a double __ are evaluated with no score, and are intended for use in meta rules where you don't want the sub-rules to have a score.
although intended for the sa development effort, any rule starting with T_ will be treated as a "test" rule and will be run with a score of 0.01 (nearly 0). This can be handy when testing rules so you don't have to create score lines for them if you think you're not going to keep them.

Main Page/Add rules in spamassasin for spam tagging

2013-08-16T06:25:29Z

Hemant: Created page with " == To reduce spam we need to add rules in spamassasin == . This can be achieve by tuning spamassasin and applying / adding rules for effective spam filtering. ---- For som..."

== To reduce spam we need to add rules in spamassasin ==
.
This can be achieve by tuning spamassasin and applying / adding rules for effective spam filtering.

----
For some cases only whitelisting and blacklisting of domain does not help . hence we need coustom rules for such cases.
----

== where to write the rules : ==

/etc/mail/spamassassin/local.cf
----

== Writing basic rules ==

== Body rules : ==

These rules search the body of the message with a regular expression and if it matches, the corresponding score is assigned.

body EXAMPLE_RULE /test/
score EXAMPLE_RULE 0.1
describe EXAMPLE_RULE This is a simple test rule

This rule does a simple case-sensitive search of the body of the email for the string "test" and adds a 0.1 to the score of the email if it finds it
It will match "test" but also "testing" and "attest"
In regular expressions a \b can be used to indicate where a word-break (anything that isn't an alphanumeric character or underscore) must exist for a match. Our rule above can be made to not match "testing" or "attest" like so:

body EXAMPLE_RULE /\btest\b/

The rule can also be made case-insensitive by adding an i to the end, like this:

body EXAMPLE_RULE /\btest\b/i
score EXAMPLE_RULE 0.1

Now the rule will match any combination of upper or lower case that spells "test" surrounded by word breaks of some form.

== Header rules ==

Header rules let you check a message header for a string. Most commonly these rules check the Subject, From, or To, but they can be written to check any message header, including non-standard ones
fOR SUBJECT RULES :
header EXAMPLE_SUBJECT Subject =~ /\btest\b/i
score EXAMPLE_SUBJECT 0.1

The above rule will match a subject: line containing "test" or a SUBJECT: line containing "test". The first part before the =~ indicates what the name of the header you want to check

Checking the From: line, or any other header, works much the same:

header EXAMPLE_FROM From =~ /test\.com/i
score EXAMPLE_FROM 0.1

== THERE WAS A CASE WHERE SPAM USED TO COME FROM DIFFRENT DOMAINS OF SIMILAR NAME ( MYJAMANA 1 , MYJAMAN2, MYJAMANA3, MYJAMANA4 ETC.) FOR THIS THE FROM RULE IS APPLICABLE ==

There's also an option to look at all the headers and match if any of them contain the specified regex:

header LOCAL_DEMONSTRATION_ALL ALL =~ /test\.com/i
score LOCAL_DEMONSTRATION_ALL 0.1

Not very commonly used, but this feature can also be used to do a case-sensitive check on a header name (it will look at the whole lines, not just the parts after the colon)

header LOCAL_DEMONSTRATION_WEIRD_FROM ALL =~ /^FrOM\:/

== A few short words about the behavior of the "score" command ==
rules with a score set to 0 are not evaluated at all.
rules with no score statement will be scored at 1.0, unless 3 or 4 is true
rules starting with a double __ are evaluated with no score, and are intended for use in meta rules where you don't want the sub-rules to have a score.
although intended for the sa development effort, any rule starting with T_ will be treated as a "test" rule and will be run with a score of 0.01 (nearly 0). This can be handy when testing rules so you don't have to create score lines for them if you think you're not going to keep them.

rules with a score set to 0 are not evaluated at all.
rules with no score statement will be scored at 1.0, unless 3 or 4 is true
rules starting with a double __ are evaluated with no score, and are intended for use in meta rules where you don't want the sub-rules to have a score.
although intended for the sa development effort, any rule starting with T_ will be treated as a "test" rule and will be run with a score of 0.01 (nearly 0). This can be handy when testing rules so you don't have to create score lines for them if you think you're not going to keep them.