James Whitt's Blog

Well, I’ve managed to upgrade wordpress and gallery again. It’s been a while, so the versions were pretty far behind. One nice benefit of this upgrade is that the photo gallery is now working again. Enjoy.

I had the problem of taking an external syslog feed (through UDP or TCP) that came from multiple devices and then separating them into folders that identified the feeds by customers / device type / host. The one thing I had on my side was that the hostname of the devices were broken up into three parts to help me get this information.

In the old Syslog-ng (1.6.x), there was not a way to regex out this information and then use it in the destination section. Each time we had a new combination, it required writing additional lines with additional regexs. Started to really feel it on performance. With the new branch of syslog-ng (2.0.x), this feature is now available.

You can use up to 256 different $NNN ($1 … $256) macros, but you can only use one regexp expression. This will be done using a filter.

Here’s a full example of what I had done then. What I wanted to do is put the line in a specific file based on part of the hostname. For example:

Hostname: subdomain.domain.tld
Save the log files for that device at:
/logs/$TLD/$DOMAIN/$SUBDOMAIN/$R_YEAR-$R_MONTH-$R_DAY.log

WHERE $TLD is the tld of the hostname, $DOMAIN is the domain from the hostname, and $SUBDOMAIN is the subdomain from the hostname.

I would like to be able to regex this information out of the hostname to use in the destination.

To accomplish this, I was able to use this configuration:

filter f_filter { host("^([0-9a-zA-Z\-]+)\.([0-9a-zA-Z\-]+)\.([0-9a-zA-Z\-]+)$"); };
destination f_logs { file("/logs/$3/$2/$1/$YEAR-$MONTH-$DAY.log"); };
log {
     source(external);
     filter(f_filter);
     destination(f_logs);
     flags(final);
};

I had a disk fail while rebooting a solaris 8 machine. I had a RAID 1 setup with two disks using Disk Suite. The first drive in the boot order was the drive that failed. Since it failed during the reboot, when Solaris started back up, it started in single user mode. It gave the error:
Insufficient metadvice database replicas located

Here is some of the information that I found out:

root@server / # metastat
d0: Mirror
    Submirror 0: d10
      State: Needs maintenance
    Submirror 1: d20
      State: Okay
    Pass: 1
    Read option: roundrobin (default)
    Write option: parallel (default)
    Size: 33002848 blocks

d10: Submirror of d0
    State: Needs maintenance
    Invoke: metareplace d0 c0t0d0s0 <new device>
    Size: 33002848 blocks
    Stripe 0:
        Device              Start Block  Dbase State        Hot Spare
        c0t0d0s0                   0     No    Maintenance  

d20: Submirror of d0
    State: Okay
    Size: 33002848 blocks
    Stripe 0:
        Device              Start Block  Dbase State        Hot Spare
        c0t1d0s0                   0     No    Okay         

d1: Mirror
    Submirror 0: d11
      State: Needs maintenance
    Submirror 1: d21
      State: Okay
    Pass: 1
    Read option: roundrobin (default)
    Write option: parallel (default)
    Size: 2101552 blocks

d11: Submirror of d1
    State: Needs maintenance
    Invoke: metareplace d1 c0t0d0s1 </new><new device>
    Size: 2101552 blocks
    Stripe 0:
        Device              Start Block  Dbase State        Hot Spare
        c0t0d0s1                   0     No    Maintenance  

d21: Submirror of d1
    State: Okay
    Size: 2101552 blocks
    Stripe 0:
        Device              Start Block  Dbase State        Hot Spare
        c0t1d0s1                   0     No    Okay         

root@server / # metastat -p
d0 -m d10 d20 1
d10 1 1 c0t0d0s0
d20 1 1 c0t1d0s0
d1 -m d11 d21 1
d11 1 1 c0t0d0s1
d21 1 1 c0t1d0s1
root@server / # metadb -i
        flags           first blk       block count
    M     p             unknown         unknown         /dev/dsk/c0t0d0s3
    M     p             unknown         unknown         /dev/dsk/c0t0d0s3
    M     p             unknown         unknown         /dev/dsk/c0t0d0s4
    M     p             unknown         unknown         /dev/dsk/c0t0d0s4
     a m  p  lu         16              1034            /dev/dsk/c0t1d0s3
     a    p  l          1050            1034            /dev/dsk/c0t1d0s3
     a    p  l          16              1034            /dev/dsk/c0t1d0s4
     a    p  l          1050            1034            /dev/dsk/c0t1d0s4
</new>

To fix this, do the following:

1. When you are booted into single user mode, delete any metadevice state database replicas that were on the ‘bad’ disk. This disk does not even have to been in to do this, but it needs to be done. So I had to do the following for my system:

# metadb -d /dev/dsk/c0t0d0s3
# metadb -d /dev/dsk/c0t0d0s4

2. Make sure that the metadevices have been deleted.

# metadb -i

3. Pull the ‘bad’ disk out and leave the bay empty. Reboot the machine.

4. At this point, you should be in normal boot sequence and get you into a running system, with only one disk in the RAID.

5. Put the replacement disk in the bay.

6. Partition the new disk. Easiest way to do this is to copy the partition table from the working disk.

# dd if=/dev/rdsk/c0t1d0s2 of=/dev/rdsk/c0t0d0s2 count=16

7. Recreate the metadevice state database replicas on the new disk. I had to do the following:

# metadb -a -f -c /dev/dsk/c0t0d0s3
# metadb -a -f -c /dev/dsk/c0t0d0s4

8. Setup the disks so that they are back in the submirrors:

# metareplace –e d0 c0t0d0s0
# metareplace –e d1 c0t0d0s1

At that point, you should have everything up and running. You can use ‘metastat’ to watch the disks sync up.

I’ve been doing installs of Solaris 10 and then needing to set them up with SNMP. The first thing I noticed is that the system is running snmpd and not snmpdx. There is still an init.d file for snmpdx, init.snmpdx, and configuration files, so at first this confused me. After looking around the web, I found that Solaris 10 is moving to using snmpd (Net-SNMP) instead of the solstice version.

Finding that information out, I was able to determine that the configuration files for snmpd are located in /etc/sma/snmp/. To setup snmpd information, just modify the snmpd.conf and everything will work.

You can start and stop it form /etc/init.d/init.sma and it is started from /etc/rc3.d/S82initsma.

Hopefully nobody has noticed, but I have upgraded the blog software to the latest and greatest version from wordpress. It was only about 9 or 10 version behind and 2 years old. If you have tried to go to the photo gallery, you have noticed that it currently isn’t working right now. I’m trying to find time to get that working again. I need to upgrade the gallery software and then upgrade the connection plugin to work with it. Hopefully I’ll have it done by next week. Summer is always the time when I have the least amount of time; Trying to finish the basement, clean the garage, get the yard respectable still, and jet skiing. I’m also working on getting my Solaris Systems certification, which I would like to have done before next year.