Ubuntu, Cron, Logrotate, and Squid

So you have that nice new Ubuntu server running. You get Squid up and configured, and have it using an effective user and group of squid. But each day at the same time, the squid server just stops. The logs show that it can't write to access.log. You take a look at /var/log/squid/access.log and find out that the file is owned by root:root. So it's an ACL issue.

You modify logrotate for squid adding chown and get squid back up. But the next day it fails. What gives?

Ubuntu 6.0.6 runs a cron job daily /etc/cron.daily/sysklogd. This archives your log files to save disk space and rotates them, independent of logrotate. If you look at this, you'll see it does a chown root:adm. Ooops.

So modify sysklogd to have this at the end;

touch /var/log/squid/access.log
chown --silent squid:squid /var/log/squid/access.log
chown --silent -R squid:squid /var/log/squid/access*
test ! -e /var/run/squid.pid || /usr/sbin/squid -k rotate

Of course, if you use a different user:group than squid:squid, replace with what you use. The last line gets squid to start logging into the new access.log, versus access.log.0.

Enjoy.

Forcing a PC to reboot through task scheduler

So you want to schedule a PC to reboot through the task scheduler. It works sometimes, but not every time. Microsoft has created multiple shutdown commands. Below is a batch file which seems to work 100% of the time in my environment. We use the built in XP shutdown command first, then the old NT4 resource kit shutdown command, then again try the XP.

It seems that sometimes during shutdown, a program will hang the process. These additional shutdown commands seem to get it past that.

rem Reboots this PC

shutdown -r -t 90 -f -c "Nightly reboot occuring in 90 seconds to apply patches"
shutdown2 /L /R /T:160 /Y /C "Nightly reboot occuring in 90 seconds to apply patches"
shutdown -r -t 60 -f -c "Nightly reboot occuring in 90 seconds to apply patches"
sleep 100


Sometimes I stick sleep commands between the shutdowns. I don't fully understand this issue, but the above batch file works for me.

Fixing WSUS for all the various reasons.

So you cloned a PC and it has the same WSUS GUID. Sysprep didn't help.
Or you put a volume license onto an OEM, and now WSUS fails.

Whatever the reason, here is the batch file to fix it.


net stop wuauserv
rem Transflo depends on BITS and must be stopped first
net stop "TRANSFLO Client Agent Service"
@rem one known dependent service. Add others you know of.
net stop "Background Intelligent Transfer Service"

@rem Make sure the proper GPOs are applied
gpupdate

@rem re register services that may be broken

REGSVR32 /s WUAUENG.DLL
REGSVR32 /s WUAUENG1.DLL
REGSVR32 /s ATL.DLL
REGSVR32 /s WUCLTUI.DLL
REGSVR32 /s WUPS.DLL
REGSVR32 /s WUPS2.DLL
REGSVR32 /s WUWEB.DLL

REGSVR32 /s ATL.DLL

rem Remove the temp directories.

rd %windir%\SoftwareDistribution\DataStore\logs /s /q
rd %windir%\SoftwareDistribution\DataStore /s /q
rd %windir%\SoftwareDistribution\Download /s /q
rd %windir%\SoftwareDistribution\EventCache /s /q


rem Some machines will fail to re-install MSI 3.1 after
rem all of this. About 1%. The fix is below.
rem It is up to you to determine if you want to download
rem and install these fixes. Remmed out.

rem call WindowsXP-KB927891-v3-x86-ENU.exe" /quiet /norestart
rem call Windows2000-KB927891-x86-ENU.EXE" /quiet /norestart

regedit /s resetGUID.reg

net start wuauserv

wuauclt /resetauthorization /detectnow



---------------------------------------------------------------
Here is the resetGUID.reg file
---------------------------------------------------------------
REGEDIT4

// Registry file generated by the Application Launcher.

[HKEY_LOCAL_MACHINE\SOFTWARE]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate]
"AccountDomainSid"=-
"PingID"=-
"SusClientId"=-







I've ran this on hundreds of machines with no problem. This is provided as-is. I provide no warranty.

Example code in VB to set color of subitems

Here is code that rips through a file to set the color of a listview item color and subitem color.

This is VB6. I found a lot of people asking how to do this, but no real solutions. It's not that hard after you know what the syntax is;


Do Until EOF(fnum1)
Line Input #fnum1, Linein
aRRy = Split(Linein, ",")
If UBound(aRRy) = 10 Then
SSN = Trim$(Replace(aRRy(8), Chr$(34), vbNullString))
Doctype = UCase(Replace(aRRy(9), Chr$(34), vbNullString))
TIFfile = UCase(Replace(aRRy(7), Chr$(34), vbNullString))
BatchID = Trim$(Replace(aRRy(10), Chr$(34), vbNullString))

ListView.ListItems.Add , , SSN
ListView.ListItems.Item(ListView.ListItems.Count).SubItems(1) = Doctype
Debug.Print TIFfile

ListView.ListItems.Item(ListView.ListItems.Count).SubItems(2) = TIFfile
If Len(SSN) <> 9 Then
ListView.ListItems.Item(ListView.ListItems.Count).ForeColor = vbRed
Else
ListView.ListItems.Item(ListView.ListItems.Count).ForeColor = vbBlack
End If
If EXIST(TIFfile) Then
ListView.ListItems.Item(ListView.ListItems.Count).ListSubItems.Item(2).ForeColor = vbBlack
Else
ListView.ListItems.Item(ListView.ListItems.Count).ListSubItems.Item(2).ForeColor = vbRed
End If

End If
Loop
Close #fnum1

Further work - FW1 R65 on Dell 2950

So far this install is flaky as can be. The FW.SYS (Firewall kernel level driver) BSOD's the machine once a week and quits routing daily. We've upgraded to HFA2, we have the latest Dell drivers, and have all services off except for those required.

SmartDefense isn't the problem, that's been eliminated. The problem with the BSOD is always processing NDIS. Sometimes when routing stops, the fw ctl zdebug drop shows that inbound packet queue is full. This is getting ridiculous. I think R65 just isn't stable at this point in time. I have had open tickets for many weeks now.

Firewall-1

FW1 NGX R65 install onto Windows 2003R2 on a Dell 2950 with Broadcom NICs and an Intel E1000 add on NIC.

Thing's I have learned;

1) fw ctl zdebug drop will show drops not logged in the normal log viewer
2) They have previously had issues with Broadcom NICs, though R65 should have that fix. They recommend N1000 type cards from Intel.
3) Make sure your IP addresses are setup right.

4) Make sure Duplex is right. Double check.

5) NDISWAN must not be installed. That is your 0.0.0.0 in topology. Windows 2003 uses this for remote access and routing. FW1 isn't compatible with this.
a) Go into device manager and look at your Network adapters.
Select VIEW / SHOW HIDDEN DEVICES. Disable all the WAN MINIPORT items, including the VPN-1/Fireall miniport.
Disable the service Routing and Remote access. With the WAN MINIPORT items disabled, Routing and Remote access service will fail upon boot.
b) Go into the registry and go into HKLM\system\currentcontrolset\services\tcpip\parameters and make IPEnableRouter set to 1.
This will enable routing without the Routing and Remote access service. This is what FW1 wants. Reboot to get all these changes in place... You might also add to this registry location MaxUserPort and set it to 65534. Default in Windows 2003 is 5000 ports. So you can only have 5000 connections at a given moment. 65534 is the maximum possible, so set it to that in decimal. It's 0X0000FFFd in Hex. Google search this fact and you'll find it numerous places.

c) In this same place in the registry as b, go into Interfaces and for each interface configure DontAddDefaultGatewayDefault as a dword set to 0. This prevents the interface from ever having a 169.254.x.x address.


d) Instead of typing in every route table entry again, if you are moving firewalls, simply take the PersistentRoute portion of this registry and export it as a .reg and import it to your new firewall & then reboot. It's also a good idea to export this for backups every now and again.

Office 2003 SP2 removes TIF and TIFF association

In Microsoft's infinite wisdom, they have removed program association to .TIF and .TIFF files as well as .MDI.

So now hundreds of people are calling me asking why they can't view imaging. Thanks, Bill, for making my life easier.

Anyway, this is documented in http://support.microsoft.com/kb/938813 and the fix is these registry changes;

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif]
"Progid"="MSPaper.Document"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithProgids]
"MSPaper.Document"=hex(0):

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff]
"Progid"="MSPaper.Document"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithProgids]
"MSPaper.Document"=hex(0):



So it's per user, meaning you have to run this in Zen per user, or login script over and over.

Surround sound enabled in Media Player DVD playback

So I have nVidia dolby surround sound, 8 channels. Got speakers. When I tell media player to switch to surround sound mode (other than the old 2.1 version) It automatically switches back to Stereo mode.

Go into nVidia mixer and setup your sound to the appropriate surround sound mode. (5.1, 7.1, etc)

Download media player classic.

Play a DVD with surround sound but one that isn't copy protected.

Right click on the video and select FILTERS/AC3 audio decoder. Switch the Decode to speakers from STERO to the appropriate Dobly settings. In my case, AC3 is set to 2 front, 2 rear and DTS is set to 2 front + 2 rear. I have PCM set to 32bit, default was 16. I have AAC set to downmix to stereo turned off, SPDIF off -- leave on if that's what you use. LFE off. Dynamic Range Control OFF.

Now I'm getting Dolby 5.1. Woo hoo.

Acronis True Image home 10

I have had nothing but problems with Ghost here lately. I've been using it for years, but suddenly the images we create either can not span to a 2TB drive because it's out of space for some odd reason. We have plenty of room. Or if I go to an older Ghost, it creates the image but then says it is corrupt when I try to restore it.

We have many licenses of Ghost, but this is wasting too much time for my personal PC. So I install it.

Issue#1) It creates a shell add on called "Backup" which allows me to backup a file or folder by right clicking on it. Well, this is fine for a home PC but when trying to right click across the WAN, it is a killer. Just like Winzip, one must remove the shell entry. Unlike Winzip, there is not a menu option to do this.

So locate {C539A15A-3AF9-4c92-B771-50CB78F5C751} under hklm/software/classes/clsid and go into InProcServer32. Modify the string "(Default)" and make it an empty string, deleting the Acronis DLL. No more Backup shortcut, and no more slow downs.

Issue #2) This software installs upper filters on the DVD/CDROM drive. These conflict with existing filters. So locate the upperfilter in registry and remove the new entry for Acronis. I didn't write it down, but it is rather apparent. If it's not apparent to you, then you should not be making these changes as they can cause a system to not boot if done wrong.

This is pretty good software. I'd like to have a stripped down version that doesn't have all the integration though. This software installs services, schedulers, many new tasks, and modifies a huge chunk of the registry/system. It also installs device drivers.

I have successfully moved two computers with this software. XP with 1 CPU to XP with 2 CPU's and more memory worked well. XP autodetected the additional CPU, PnPed, and rebooted. The machine that went from a P733 Dell to a P1.8 SuperMicro didn't fare as well. System just keep rebooting. But, as usually, you just do an in place re-install of XP and we're back in business. Of couse, the Dell had an OEM license of XP so this causes me to have to purchase & install a new license of XP and toss the old one. It's always something, eh?

The ultimate l33t g33k gift.

This is too cool. A USB powered & controlled missile launcher with PC control. Call me a cynic, but I bet that you manually position and aim these and the PC only control's launching them. But it's still too cool.

http://www.geeks.com/details.asp?invtid=USB-782&cat=GDT

XP can't keep files from corrupting.

This has occurred on a work PC after uninstalling Symantec PCAnywhere, and on a Windows 2000 server for an unknown reason. Now, after uninstalling Weather Channel weather app, my wife's XP HOME SP2 can not boot due to corrupt \windows\system32\config\system file. This is the system portion of the registry.

Of course, the only manufacture option is to nuke the hard drive, loose all data, and be back to oem. I have Mozy, sure, but after a month only 1GB of the 1.6GB of data has uploaded.

So I use BART PE to get into the NTFS file system and restore an old SYSTEM file to replace the corrupt one. This is the original SYSTEM file, so it's back to the initial install of XP HOME. But at least I keep my data.

After an hour, bootup ends up going into a resolution that the Laptop's LCD doesn't support. Boot into VGA mode and re-install the drivers. Set the resolution to a proper one. Reboot.

Ok, so re-install the antivirus and reboot is the next step.

Then activation. But what is this? Activation tries to launch IE via an HTA, and fails. This is because the re-install of XP replaced part of IE with 6.0, even though I have 7.0 installed. IE is fried. So I went into the firefox directory and launched it. God, I love programs that don't require the registry. From firefox, I re-downloaded firefox and properly installed it. The I downloaded IE7 from Google (Microsoft wouldn't let me from Mozilla) and tried to launch it. But it fails because it gets confused about having some IE6 files and some IE7 files & patches.

So, Remove IE7 and reboot. C:\WINDOWS\ie7\spuninst\spuninst.exe uninstalls IE7. I am in the process of downloading SP2, which will take hours, so I won't know if IE6 works or not until the morning. But I was able to activate now. And apparently that is the problem with the IE7 reinstall, as it will get past the initial error. Though I don't plan on re-installing until I reboot.

Automatic Updates service is no longer listed. I did the re-register to get it to appear, but it will not function because it's still not installed right. I guess that's because I have the 1.0 version from the reinstall mixed in with the 3.0 version released not long ago.

Thanks, Microsoft, for a fun evening. Why can't a system restore point create alternate system.sav files and if system is corrupt, give me the option to use a previous system file?

OpenSUSE 10.2 day 5

The video lockups in SUSE at the startup are normal. It's not really locked up. It is just so slow that it stays on that screen for a while.

I ended up booting up into failsafe, running YAST, and then installing the 1.2GB of updates it desired. I installed 5 optional add ons.

After this, the video lock up still occurs, but I do get logged in and KDE is so much faster. At least for the moment. No lockups ever few seconds like with 10.0.

Now that the OS is usable, it is time to play around with server type services. BIND and DHCP are next.

Fighting the Linux upgrades. Suse 10.0 to OpenSuse 10.2

Today I set out to upgrade SUSE 10.0 to OpenSuse 10.2. I began the DVD download from the WIKI link, and then proceeded to update 10.0 with the latest patches. It always seems an upgrade works best if one is fully patched.

The DVD downloaded rather quickly for a *nix ISO. I left the computer on over night and it was downloaded the next day as I returned to the computer. Mandriva 2007 spring took a week VIA bitorrent, for comparison.

So I began by creating a VMware snapshot of 10.0, mounted the DVD ISO as a CDRom in VMware, and rebooted. The DVD didn't boot, so I rebooted and set the BIOS to boot to CDROM. Another reboot, and the DVD ISO booted off the virtual CDROM.

The upgrade was horribly slow. After many hours, X locked up and the PC had to be rebooted. I believe it was auto detecting my video card. Much to my surprise, the install picked up where it had left off. Many hours later, and the upgrade was complete. It asked me to subscribe to some sort of Zen service, but wouldn't let me. So I canceled out of that.

After rebooting, Grub launched. Then it tried to start X. Lockup & odd graphics. The day was over so I turned off the VM.

A few days later I booted this back up and went into failsafe. Logged in as root and mounted the VMware tools. cd /tmp then mount /dev/cdrom /mnt (it wouldn't mount into /mnt/cdrom for some odd reason.) Then I did an rpm -Uhv /mnt/VMwareTools-5.5.4-44386.i386.rpm. That took a while & then came back with an error about waiting for the database to unlock. Another run at this told me the RPM was already isntalled. Reboot.

This time KDE started right up and I was able to log in. YaST was nice enough to tell me that after never running any updates, I was fully patched. Typical. So many distro's tell me that I am fully patched when I have absolutely no patches at all. Why can't they get this straight? I right clicked on the YaST updater and did "refresh" and added myself as a privileged user.

Anyway, OpenSUSE is running in VMware workstation 5.5 with VMware tools. It doesn't lock up every 5 seconds for 1/2 a second like it was doing in 10.0. It is still the slowest of all distro's that I've installed onto VMware. FreeBSD being the fastest and Mandriva being in the middle. But it is the nicest build I've worked on. I love YaST. Everything in one place. I don't have to go to console nearly as much as with other distro's.

Now to install Webmin, DHCPD, and NAMED and have a test at this handling some basic server services.