Tuesday, 5 March 2013

investigating RAM, CPU or disk space alerts on linux servers

First establish what is alerting, RAM CPU or disk usage and connect to the server.


If the alert is for RAM usage
Connect to the server and run the "top" command (type "top" and press enter)
Top is similar to taskmgr on windows.

Press Shift and M to sort the processes by highest mem usage

The command "free -m" can also be useful for seeing how much memory is used/free.

You can see which process is using up all the memory. What user is running the process. You may need to contact the customer, application or DB team to find out if this is expected and what the next step should be.

If the alert is for CPU usage

Connect to the server and run the "top" command (like taskmgr on windows)
Press Shift and P to sort the processes by highest CPU usage

You can see which process is using up all the CPU. What user is running the process. You may need to contact the customer, application or DB team to find out if this is expected and what the next step should be.



If the alert is for disk space usage
Connect to the server and run the "df -h" command.

This will show you the percent usage on each partition/mount
To get further infromation on reads/writes to that partition run
"vmstat -p /mount/point" for example "vmstat -p /dev/sda2"

If we run the "df -h" command and we discover that /home is at 95% usage. We can see what is using up all the space by using the du command. First "cd /home". You can use the following du command:
"du -sm * | sort -nr | head -10" this will give the results in MB, sort them with the largest at the top and only show the top 10 results.

You can contact the owners of large files and ask them if they are required. You may find that log files grow to a large size or backup files are building up. Best practice is to set up a script to remove old files.
Before assigning to N&S you should complete the steps above. With the information provided you should be able to resolve the tag. If not take screen shots of your output and attach them to the tag.

More on using the top command
press shift P - sorts processes by highest CPU usage
press shift M - sort processes by highest Mem usage
press u type a username and press enter - shows only processes for that username (press u and enter to bring them all back)
press r and enter the PID to re-nice a process - sets a process to a higher or lower priority (be careful)
press shift R - this will sort by PID (shift R again to change it back)
press c - shows full command that was used to launch the process
press k and enter the PID - will kill the selected process (be careful)
press q - will quit the top application


Script to list largest directory or files
Just copy the script below onto the server you want to check
It will give you the top 10 directories and then the top files in those directories
You may need to make it executable

#!/bin/bash
# This will give the user back a listing of the largest files/dirs on the system

# make some tempfiles
mktemp1="/tmp/mktemp1"

# get overall 10 largest dirs
du -sm /* |sort -nr |head > $mktemp1

echo "Directory size listings for " $(hostname -s)
echo "Run date: "$(date)
echo "All sizes on left are in MB"
echo " "
echo "/ dir size list"
cat $mktemp1
echo " "

# for the largest 5 of the above get the sizes in them
top5=$(head -5 $mktemp1 |awk -F " " '{print $2}')

for dir in $top5
do
        echo $dir dir size list
        du -sm $dir/* |sort -nr |head
        echo " "
done

rm $mktemp1
exit 0



Tuesday, 26 February 2013

finding the time to live TTL on a DNS record in windows

If you need to find the time to live on a DNS record in windows you can click
start -> administrative tools -> DNS
Click View -> Advanced
Now right click on your record and click properties
The TTL will be displayed

Alternatively
nslookup -q=a -debug www.mydomain.com

nslookup -q=mx -debug email.mydomain.com

nslookup -q=ns -debug ns.mydomain.com

In linux you can use the dig command


Monday, 25 February 2013

investigating public IP addresses with ripe.net

If you come across a public IP address but your not sure what it is you can use tools such as ripe.net to investigate. In this example, I'm going to attempt to look up yahoo.com (98.138.253.109).

Go to http://www.ripe.net/
In the RIPE database section enter the IP address you want to investigate and click search.
If the details are held by RIPE they will be displayed
Sometimes the IP details are held by another provider
In that case the provider will be listed
In my case it was http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xml
I went to iana.org. My IP starts with 98 the page tells me this is held by http://whois.arin.net
I went to http://whois.arin.net/ui entered the IP address into the search bar and click search
This brought up the details of who owns that IP address which of course was Yahoo inc.

There are plenty of other web applications that help you get this information I've found that  http://network-tools.com to be useful.

Thursday, 14 February 2013

Error 113 (net::ERR_SSL_VERSION_OR_CIPHER_MISMATCH): Unknown error in google chrome when connecting to Cisco ASDM


Looks like the default ssl encryption is set to des-sha1. 

Run the following to see what yours is set to:
#sh run | i ssl encryption. 

I was connecting my laptops ethernet port to the management port on the ASA.
My IP address settings were set to obtain. The ASA gave me an IP address. I connected to the ASA with the console cable to run the commands.


des has been broken for ages now. Looks like chrome won't connect unless you use a good encryption. I did the following to resolve:

#conf t
#ssl encryption aes128-sha1  (you can use higer if you want)
#wr mem

Now open chrome and go to https://192.168.1.1/admin

Wednesday, 23 January 2013

object-groups on cisco ASA

object-groups can be used with your ACLs to keep them clean and easy to manage.

object-group
  • network (host IPs or subnets)
  • service (tcp / udp ports)
  • icmp
  • protocol
object-group network Internet_Access_Hosts
network-object host 10.10.10.1
network-object host 10.10.10.2
network-object host 10.10.10.3
network-object host 10.10.10.4

object-group service Standard_Internet_Ports
port-object eq 80 (user service-object 80 in later code)
port-object eq 443
port-object eq 53
port-object eq 25
port-object eq 110

access-list INSIDE_ACL permit tcp object-group Internet_Access_Hosts any object-group
Standard_Internet_Ports

access-list INSIDE_ACL permit udp object-group Internet_Access_Hosts any object-group Standard_Internet_Ports

sh access-list INSIDE_ACL

============================================================
an example from 8.2 code

object-group service DMZ_PORTS_ALLOWED_OUT
 service-object tcp eq 80
 service-object tcp eq 443
 service-object tcp eq 22
 service-object tcp eq 53

object-group network DMZ_HOSTS_ALLOWED_OUT
network-object network 10.10.10.1 255.255.255.255
network-object network 10.10.10.2 255.255.255.255

access-list DMZ_OUT permit object-group DMZ_PORTS_ALLOWED_OUT object-group DMZ_HOSTS_ALLOWED_OUT any

============================================================
an example from later code version (8.6)

object-group service DMZ_PORTS_ALLOWED_OUT tcp-udp
 port-object eq www
 port-object eq 443
 port-object eq 22
 port-object eq domain

object-group network DMZ_HOSTS_ALLOWED_OUT
 network-object host 10.10.10.1
 network-object host 10.10.10.2

access-list DMZ_OUT extended permit tcp object-group DMZ_HOSTS_ALLOWED_OUT any object-group DMZ_PORTS_ALLOWED_OUT

access-list DMZ_OUT extended permit udp object-group DMZ_HOSTS_ALLOWED_OUT any object-group DMZ_PORTS_ALLOWED_OUT





Tuesday, 22 January 2013

How to check if a juniper ssg is in a cluster

This SSG is in a cluster

MYSSG-> get nsrp
nsrp version: 2.0
cluster info:
cluster id: 1, name: SSG_CLUSTER
local unit id: xxxxxxxx
active units discovered:
index: 0, unit id:   xxxxxxx, ctrl mac: xxxxxxxxxxxx , data mac: xxxxxxxxxxxx
index: 1, unit id:    xxxxxxx, ctrl mac: yyyyyyyyyyy , data mac: yyyyyyyyy

total number of units: 2

This SSG is not

OtherSSG-> get nsrp
nsrp version: 2.0
cluster info:
 cluster id not set: nsrp is inactive



Using Bash(shell) history effectively

Using Bash(shell) history effectively

The majority of these tricks utilize the ‘history’ command in some way, so let’s cover that one first. Just type:

history

To execute a specific command from your history, you can just type an exclamation point followed by the number of the command as listed by history. Here, I’ll re-execute command number 510.

!510
By the way, an exclamation point is referred to as a “bang.”

You can also refer to a command by how long ago it was run. Next, let’s execute whatever we typed three commands ago.

!-3

Quick Substitutions

Let’s say you want to rerun your previous command. Just type two exclamation points. This is perfect for when you run a command that needs super-user privileges and you forgot to do that. Just give it the old “sudo bang bang” treatment:

sudo !!

Let’s say you want to run a command with the last argument you used. Typing it out is too tedious. Just use a “bang dollar” to substitute your last argument automatically.

cd !$


What if you ran a command with two arguments and you want to run the first one? “Bang caret” This works well when you make a backup of a config file and then want to edit it.

nano !^


Next, let’s search for a specific command from your history. Ctrl+R will search backwards for whatever you type. It will autocomplete as you type, and you can scroll back up through the history if you hit Ctrl+R again to find the specific instance you’re looking for.



If you know the last command you ran with a specific keyword, you can skip the search process and pare down your key presses by at least one.

!keyword


Now, for the power substitution: you can substitute an argument for your last specific command using something similar to the previous method. Just add a colon and the number of the argument.

ls !ln:2

Here, I substituted the second argument from my last ‘ln’ command.



As you can see, I used a Ctrl+R lookup to help illustrate where that argument came from.

Once you’ve found the command you have several options:

  1. Run it verbatim – just press Enter
  2. Edit it before running – you can use arrow keys or different key bindings to navigate to the point you want to edit
  3. Cycle through other commands that match the letters you’ve typed – press Ctrl-R successively
  4. Quit the search and back to the command line empty-handed – press Ctrl-G