/srv/irclogs.ubuntu.com/2017/04/04/#ubuntu-server.txt

MeadI am reading through this guide to set up pass throughs for guest OS's : https://wiki.archlinux.org/index.php/PCI_passthrough_via_OVMF#Isolating_the_GPU ,  when it says "You can then add those vendor-device ID pairs to the default parameters passed to vfio-pci whenever it is inserted into the kernel."  is this implying create a file or add it to the grub kernal config?01:01
MeadI am using ubuntu-server, that just happens to be a recomended guide01:02
Logos01Howdy, folks. I'm hoping someone might be able to point me in the right direction for this. I have an Ubuntu 16.04 machine that I just upgraded from 14.04.  It is a KVM/libvirt hypervisor, serving a manually configured (outside of libvirt, that is) routed network to its VMs. This much is fine; my VMs get address, and successfully are able to reach and be reached from the internet.01:27
Logos01The challenge is that the VMs can no longer initiate any traffic to my intranet machines.01:27
Logos01This means that while my router and hypervisor can successfully communicate bidirectionally on port 22/80/443/etc., none of my other physical systems can.  My workstation/laptop (this is my home network) can successfully determine via netcat that ports are open on the VMs, but it cannot receive traffic from those ports.01:31
Logos01( examples: http://lpaste.net/8120205894421053440 )    ... any suggestions on where I might look to determine what has become misconfigured as a result of the upgrade on the hypervisor would be appreciated.01:31
Logos01This is confusing to me because the VMs can all reach one another; and they can reach the router. It's just everything *ELSE* on the physical network they can't reach.01:37
drabLogos01: are you using a firewall or doing something else with that bridge?01:39
drabLogos01: also have these been rebooted etc after the upgrade and got on a new kernel?01:41
Logos01drab: Well, I *do* have an haproxy instance acting as a loadbalancer for ports 80/443 from the outside world to my machines for the openconnect daemon and webserver stack; but I also have an independent VM that's running a Katello instance to act as management for the machines.  Mostly it's a lab for me to practice/sandbox/experiment my sysadmin-skills on my own recognizance.01:41
Logos01drab: Yes. This started on Friday and I've rebooted a couple of times.01:41
Logos01I updated on Friday, it's persisted over the weekend. Granted I didn't really investigate it on Saturday.01:41
Logos01I've pretty much narrowed it down to the VMs not getting routing information from the VM-net gateway onwards (mtr is a lovely thing)01:42
drabok, if you get on the hypervisor and tcpdump, do you ee the netcat traffic from the www-node1 going to the laptop?01:42
drabok01:42
drabare the vms on a diff subnet/network than the physical stuff on your lan?01:43
drabbut it sounds like yuo got it already :)01:43
Logos01Yeah, the VMs are all on 192.168.121.0/24 ; the physical systems are all on 192.168.1.0/2401:44
drabok01:45
Logos01My router (192.168.1.1) has a routing table entry to the hypervisor -- 192.168.1.3.01:45
Logos01http://lpaste.net/354253  <-- mtr output example01:46
drabyou mean an entry to direct .121/24 to the HV?01:46
sarnoldLogos01: I suggest trying 'ip route get ....' commands on all the different computers (real and virtual) with IPs from all the real and virtual computers..01:47
drabwhat's ip route ls on the VMs?01:47
drabyeah, or that, try the get01:47
Logos01sarnold: That all looks correct.01:48
Logos01http://lpaste.net/35425401:48
Logos01drab: And yes, the router has a static routing table entry using 192.168.1.3 (the hypervisor's physical address) as the gateway for 192.168.121.0/2401:49
drabLogos01: if you tcpdump traffic on the bridge, do you see the replies on the br interface?01:50
drabI'm guessing they are getting lost on the HV and not going back to destination01:51
drabmaybe something funny with asymmetric routing, maybe they are taking a diff path on the way back and getting dropped01:51
drabI assume you tcpdumnp'ed on your laptop, yes?01:51
draband don't see that traffic coming back at all01:51
drabI'm wondering if the laptypo is sending traffic to the router, but it gets it back directly from the VM01:52
drabdoesn't recognize it and drops it01:52
Logos01http://lpaste.net/354255  <-- not necessarily useful but01:53
Logos01Hrm... interesting ... laptop1 is in fact showing icmp from katello01:54
* Logos01 tries adding the routing table entry on the laptop locally01:54
drab:)01:54
* Logos01 facepalms01:55
Logos01Why did I not need to do this before, I wonder ...01:55
Logos01You know what? I may have had to and it's just been so long I don't remember it.01:55
drabmaybe you did and forgot? :)01:55
drabyeah, I do that all the time, that's why I use ansible now :P01:55
drabor whatevert, just don't do changes by hand01:55
drabbeen bitten by it far too many times01:55
Logos01drab: ... my ansible setup is on my laptop and was what was inspiring me to work on this.01:56
Logos01<_<01:56
drabeven if it doesn't work after an upgrade I see stuff failing and I know I have to change something01:56
Logos01Because I couldn't ssh to the VMs.01:56
drablol :D01:56
drabgood inspiration01:56
Logos01I mean it's only 17.04 and I'm finally migrating my physicals from 14.04 to 16.04. You can tell I am suuuper on it about latest-and-greatest.01:56
Logos01Anyhow, I appreciate it.01:57
drablatest and greatet is overrated :)01:57
drabLogos01: btw, maybe there was a point in this all... :) any chance you can share libvirt setup? I'm trying to get started on KVM01:58
drabLogos01: I have my own bridge and stuff, so I want none of the automagic01:59
drabat least until I understand where the magic comes from01:59
Logos01drab: Oh. I ripped out the libvirt networking component and am instead running my own manually initialized dnsmasq instance (it's not starting anymore but my VMs are all statically configured now anyhow)02:00
Logos01Also, the upgrade to 16.04 overwrote my /etc/iptables/rules.v4 file so it's a mess until I rewrite it.02:00
Logos01But...02:00
drabk, care to share how to rip that out? I have a centralized dnsmasq, don't want any additional dnsmasq or bridge set up02:00
drabjust use the bridge I tell it to02:01
Logos01You just set the default network it defines to not autostart02:01
Logos01(And then never start it)02:01
sarnolddrab: depending ujpon how little magic you want you may prefer a different tool entirely; libvirt afterall is just a wrapper around qemu and iptables and so on glued together with an xml parser02:01
drabsarnold: I'd love that, but I couldn't find much of a documentation on that and I'm already quite behind to figure it all out02:02
drabso trying to find a compromise between magic and starting from scratch02:02
Logos01sarnold: Lots of things work with libvirt as the backend for their hypervisor management though02:03
Logos01Like in my case I was actually using Katello to spin-up / spin-down VMs02:03
Logos01http://lpaste.net/354256  <-- current state of my hypervisor's iptables. (I'm not thrilled with this.)02:03
sarnoldLogos01: that's very true.02:03
Logos01It's fugly and I know it.02:03
drabbut before I need to get a container setup for kvm02:03
Logos01Used to be a loooot prettier.02:04
drabso I can experiment without trashing the host02:04
drabLogos01: also you don't happen to have tried libvirt with lxc, do you?02:04
Logos01I was playing around with the notion a while back.02:05
Logos01But I never went anywhere with it.02:05
Logos01Honestly I'm starting to look at rkt right now -- especially with the asshattery that Docker is pulling now.02:05
Logos01(Monthly releases with each new monthly release marking the end-of-life of the previous month.)02:05
Logos01Of the docker engine itself, that is.  (Oh, they'll have LTS too. Quarterly instead of monthly.)02:05
Logos01drab: But yeah, once you *HAVE* a bridge device manually created and configured to allow traffic in/out via iptables forwarding rules, you can just define libvirt domains (VMs) to use that bridge-device for their networking.02:07
sarnolddrab: a few similar things are listed here http://www.linux-kvm.org/page/Management_Tools02:09
Logos01I just added mine to /etc/network/config02:09
drabsarnold: iirc you have a zfs nas, don't you? do you happen to have looked into sanoid/znapsend for backups?02:09
Logos01ZFS ... :D02:09
sarnolddrab: I've only got the one zfs system so far, so I haven't looked at sending snapshots anywhere yet02:10
drabk02:10
Logos01http://lpaste.net/35425702:10
drabI've narrowed it down to those two solutions, need to test them and figure out hwo to work with ZVOL since I'll need those for KVM02:10
Logos01drab: I've never actually heard of either. I should really start doing zfs send/recv for my snapshots02:11
drabwhoa, r00t? crazy man :)02:11
Logos01sole filesystem02:11
Logos01Was that way back in 12.04 too02:11
drabO_O02:11
Logos01Yeah, the latop's made a few migrations with me.  I even once used zfs send/recv to migrate the OS from one laptop to another.02:12
drabso how did you put / on zfs?02:12
Logos01zfs-native PPA02:12
Logos01And, at the time, zfs-grub PPA02:12
drabu blogged about it? or any links?02:13
sarnoldheh those days it felt even hairier than today02:13
Logos01drab: I basically followed the howto/walkthroughs for this from the zfs-native ppa peeps02:13
drabk02:13
drabwill google that out, thank you02:13
Logos01https://github.com/zfsonlinux/pkg-zfs/wiki/HOWTO-install-Ubuntu-16.04-to-a-Whole-Disk-Native-ZFS-Root-Filesystem-using-Ubiquity-GUI-installer02:14
drabI ended up putting two drives in mdadm for root02:14
sarnolddrab: stick to rlaager's guide for today's stuff02:14
draband the rest on zfs02:14
Logos01sarnold: Heheh, hard to find now though02:14
Logos01sarnold: He's actually merged it into the page I linekd to02:15
Logos01Well. https://github.com/zfsonlinux/zfs/wiki/Ubuntu-16.04-Root-on-ZFS02:15
drabyeah then we're looking at the same thing02:15
drabnot for me then, seen that before02:16
Logos01... I have to figure out how to get zfSnap to honor the com.son:auto-snapshot flag02:16
Logos01drab: I have historically had a habit of moving from one company to the next once every year to year-and-a-half. I pretty much always wind up using zfs as sole filesystem on my personal linux machines when doing so02:17
Logos01So ... I've done that process a few times.02:18
Logos01Sadly, on my *current* work laptop, they gave me an encrypted disk drive so I can't reinstall the OS. :-(02:18
=== xlogik_ is now known as xlogik
=== lfrlucas_ is now known as lfrlucas
=== skarface is now known as antix
=== fr0st| is now known as fr0st
=== Raboo_ is now known as Raboo
=== thebwt_ is now known as thebwt
=== eshlox_ is now known as eshlox
faekjarzHey there! I'm running 16.04 server. I'd like to run several commands on shutdown/reboot. I'm looking for something like rc.local, but for the shutdown process. In which file would i put those commands?05:26
lynorianfaekjarz, do you know about @reboot in cron05:27
lynorianoops I do not think I read your question properly05:27
lynorianso you want when you shutdown run these commands05:27
faekjarzaye05:27
faekjarzi think i'll see what i can do with this → https://www.freedesktop.org/software/systemd/man/systemd-halt.service.html05:37
Logos01faekjarz: Best I can think of in your case would be to start up a dummy service that has a series of ExecPost steps05:38
Logos01And never directly interact with the service otherwise; shutting down the host would cause it to shut down that dummy service and thus execute those commands as part of the shutdown process.05:39
Logos01Err, they'd be ExecStopPost commands05:40
Logos01Just have the actual startup command be something tiny and silly like a simple script with a "while true ; do sleep 10 ; done" command inside it.05:40
faekjarzLogos01: interesting, thanks05:43
Logos01You'd want to make them part of the sysinit.target.wants, I *think*05:44
Logos01Or actually hey -- there's a shutdown.target.wants05:45
Logos01haha -- forgot all about this.05:45
Logos01https://unix.stackexchange.com/questions/39226/how-to-run-a-script-with-systemd-right-before-shutdown/39604#3960405:47
Logos01There ya go05:47
faekjarzyea, looks about right, thanks Logos01! Once again, i can avoid actually understanding systemd ;D05:49
faekjarz(oh, there's a #systemd channel …of course)05:57
cpaelzerjamespage: did the tempest run return good results on bug 1672367 to mark it v-done?05:58
ubottubug 1672367 in libvirt (Ubuntu) "libvirt uses password-secret on old style drive_add syntax" [Undecided,New] https://launchpad.net/bugs/167236705:58
Logos01faekjarz: I approve of that sentiment.06:03
=== Isla_de_Muerte is now known as NwS
jamespagecpaelzer: lemme check07:28
jamespagecpaelzer: I swear I triggered the test run but apparently not - have done so now07:34
=== smb` is now known as smb
=== smb is now known as Guest44125
=== wyre_ is now known as wyre
FilipNortic_I'm getting an error while trying to restart sshd. (Tried /etc/init.d/ssh restart and the systemd version)08:27
FilipNortic_ssh.service failed because the control process exited with error code. See "systemctl status ssh.service" and "journalctl -xe" for details.08:27
blackflowFilipNortic_: and did you do as instructed?08:28
FilipNortic_yes08:29
FilipNortic_was no real info in either case08:30
FilipNortic_well status says: failed to start. UNIT enterd failed state08:31
blackflowFilipNortic_: then we can't help you :)   but just in case, please do pastebin the logs08:31
blackflowFilipNortic_: in the status, there's excerpt from the log below, anything in there?08:32
FilipNortic_blackflow: http://lpaste.net/35426408:34
blackflowFilipNortic_: there should be more, please check with journalctl -xe, or journalctl -p err or journalctl -u ssh.service -n 4008:36
FilipNortic_ok i'll try to extract the relevant parts08:39
FilipNortic_error: Bind to port 22 on 0.0.0.0 failed: Address already in use. and fatal: safely_chroot: stat("/home/ftpuser"): No such file or directory08:41
blackflowthere you go :)  So first, is there an ssh daemon already running? Is this in a container bound to host's IP?08:42
FilipNortic_can there be multiple ssh daemons08:44
blackflowyes, but each bound to its own port08:44
blackflow(though not with default set up in Ubuntu, you'd have to run additional ssh daemons either in a container, or manually / with a custom unit file)08:44
FilipNortic_root     23097     1  0 Apr03 ?        00:00:01 /usr/sbin/sshd08:46
FilipNortic_this is the only shhd process i find08:46
blackflowFilipNortic_: ss -4lp | grep ssh08:49
blackflowthis will give you port used and pid of the process named ssh08:49
blackflowif you have that, then you can't run additional daemons on the same port08:49
blackflowbut.... sounds to me like you're doing something wrong here. What exactly do you wish to achieve?08:49
FilipNortic_tcp    LISTEN     0      128     *:ssh                   *:*                     users:(("sshd",pid=23097,fd=3))08:50
FilipNortic_we were trying to configure sftp08:50
blackflowright, so configure it within the existing ssh daemon, you don't need to run an additional (and how do you even run it btw)08:51
FilipNortic_there wasn't suppose to be an additional one the fist time we restarted sshd it worked fine and ftp worked then we tried to give access to the group instead and upon that restat we got the bind error08:53
FilipNortic_is it trying to start itself twice or something like that?08:53
blackflowFilipNortic_: can you pastebin your sshd_config file?08:59
FilipNortic_http://lpaste.net/554317343604762214408:59
FilipNortic_can't see anything wired in it09:05
blackflowFilipNortic_: yeah, looks okay, except I dont think you need any options for internal-sftp.09:06
blackflowFilipNortic_: also, this setup is very unsafe, you allow password auth and use default port 22. Just a matter of time until a bot breaks in.09:07
FilipNortic_yeah I know that much. so far they all try as root but i will change it just need 2 resolve this first09:09
FilipNortic_I still have no clue what is wrong09:10
blackflowFilipNortic_: you can't log in as root, you have PermitRootLogin no09:15
FilipNortic_yeah but i still se boots trying09:16
FilipNortic_was kind of my point (though a sort of mute one)09:16
blackflowah you mean the bots try as root.... yeah.... sorry, my mind was in the context of your sftp group users09:19
FilipNortic_but what i really which to know is why i can't restart sshd, if there's another process blocking why can't I see it09:25
lordievaderTo enable sftp on my host I needed to add 'Subsystem sftp /usr/lib64/misc/sftp-server'.09:26
lordievaderThat path might be a bit different on Ubuntu.09:26
blackflowinternal-sftp is needed with that group match stanza to chroot sftp users, otherwise they could roam freely on the system09:29
blackflowand forcing the command it blocks regular ssh log in, allows only sftp09:30
blackflowas for why it's behaving like FilipNortic_ says, I don't know. it's not normal behavior for ssh09:30
FilipNortic_any idee how to get back too a normal stat... should i try and kill the sshd process09:33
blackflowFilipNortic_: first, when you "systemctl restart ssh.service", does it log an error about binding to port 22 again?09:44
FilipNortic_ error: Bind to port 22 on 0.0.0.0 failed: Address already in use.09:46
FilipNortic_sshd[30276]: error: Bind to port 22 on :: failed: Address already in use.09:46
FilipNortic_yeah09:46
blackflowweird.09:51
=== rizonz_ is now known as rizonz
jamespagezul: urllib3 and requests are still wedged in zesty-proposed - something you have time for?10:03
jamespagecpaelzer_: testing OK - marked bug 1672367 as requested10:08
ubottubug 1672367 in libvirt (Ubuntu) "libvirt uses password-secret on old style drive_add syntax" [Undecided,New] https://launchpad.net/bugs/167236710:08
cpaelzer_thank you so much jamespage!10:11
cpaelzer_the next bunch of SRUs are waiting, so this should help to clear the queue10:11
jamespagecpaelzer_: yw10:11
cpaelzer_well waiting is too muhc, I need to code them up first :-/10:12
jamespageah yes the relentless queue of SRU's10:12
cpaelzer_if you are not having them you either own "hello" or your package isn't used a lot :-)10:12
=== thib_ is now known as thib
cpaelzer_rbasak: given my frequent typos, could I ask you to re-release uvt as uvtoool10:46
cpaelzer_it would be nicer and auto-supports triple-o that way right :-)10:46
rbasak:-)11:02
FilipNortic_when I run: netstat -tapn | grep ssh11:16
FilipNortic_i get: tcp6       0      0 :::22                   :::*                    LISTEN      23097/sshd and tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      23097/sshd11:16
FilipNortic_this is one for ipv4 and on for ipv6 ?11:17
hateballit's the same pid as you can see11:17
FilipNortic_ahh right11:18
hateballalso I think 'ss' is prefered to netstat these days11:19
FilipNortic_yeah i ran that first11:20
hateball"ss -tap" is nice11:20
lordievaderhateball: It is.11:20
FilipNortic_kind of hoped it missed something11:20
hateballneeds sudo to show which pid uses ports <1024 iirc11:20
lordievaderJust like the ipconfig -> ip11:20
lordievaderifconfig*11:20
FilipNortic_is ip the new one?11:22
lordievaderFilipNortic_: Yes.11:25
lordievaderFilipNortic_: Do you still have the problem of starting ssh? If you are not connected via ssh you could kill that remaining process and start the service again.11:26
FilipNortic_well ssh is my only method of connection right now11:28
FilipNortic_but does killing the sshd service stop the established connections11:29
FilipNortic_any other recomendations ? change port and se if i can start anther daemon there?11:39
=== tsimonq2alt is now known as tsimonq2
lordievaderYou could do that as a detour to restart ssh on the original port.11:56
lordievaderThough, I am not sure how ssh behaves with running multiple daemons.11:57
ronatornot sure if this suits but "sshd has had support for multiple ListenAddress directives for a good while"11:59
FilipNortic_so it might still try and restart the old one12:05
lordievaderFilipNortic_: There is no way of access of another kind?12:17
FilipNortic_there should be a vnc point set up by the server provider but it comes up blank when i try it12:18
FilipNortic_guess i have to call thier support12:19
lordievaderOr you run the commands in a screen/tmux and hope for the best :P (bad advice, I know)12:26
=== cpaelzer_ is now known as cpaelzer
ronatoris it save to remove package "landscape-common" if I don't plan to use landscape?12:44
lordievaderCheck the reverse dependencies.12:45
zulfnordahl: probably start doing SRU processing again later this week12:45
lordievaderronator: If nothing (important) requires it, I'd say it is save to remove.12:45
zuljamespage: sure...12:46
ronatorlordievader: thats exactly where my question was aiming at :)12:46
fnordahlzul: that would be great. just a update of the package to be based on horizon-9.1.2. would suffice as the necessary patches have been upstreamed12:47
lordievaderronator: apt-cache can tell you the reverse dependencies.12:48
ronatorthx lemme check that12:48
ronatorlordievader: like so?  $ apt-cache rdepends landscape-common12:49
ronatorshows only landscape-common and -client so should be fine thx12:49
lordievaderronator: Indeed, apt will also show you if it has to remove more due to a dependecy.12:50
ronatorlordievader: yes I know. We tested landscape for a short period of time, I removed it and now I was unsure if landscape-common was always there. removing didn't raise any dependencies, but you never know, so I asked and learned something new :)12:52
zuljamespage: my old nemesis dogtag-pki12:55
Aisonhello15:17
AisonI have 4 network devices15:17
Aisonenp5s0, enp6s0, rename4, rename515:17
Aisonwhy the hell are two of them called rename*15:17
rbasakSounds like they got stuck halfway through the rename, possibly due to a conflict.15:21
=== JanC is now known as Guest85044
=== JanC_ is now known as JanC
rbasakDo you have four NICs in reality? And can you reproduce this eg. on a live USB boot?15:21
rbasakAlso, which release?15:21
Aisonrbasak, no, there is a dual 82571EB and a dual 82574L controller15:22
Aisonone is onboard, one is pcie15:22
nacciirc, dmesg should have some indication of what is going on (or syslog)15:22
rbasakPerhaps it's trying to rename each of the two NICs on each controller to the same enpXs0 name?15:23
Aisonthis is my dmesg: http://paste.ubuntu.com/24313876/15:24
AisonI try to find something :)15:24
nacc[    4.009571] e1000e 0000:02:00.0 rename4: renamed from eth215:26
nacc[    4.022635] e1000e 0000:02:00.1 rename5: renamed from eth315:26
rbasakWhich release?15:27
nacclooks to be 16.04 with 16.04.1 kernel15:27
Aisonyes15:27
naccthat rename is happening much earlier than the other15:28
naccyou of course, if not concerned with hotplug could use net.ifnames=0 (iirc)15:29
rbasakI wonder if this is a bug. If so, it'd be nice to fix it properly.15:30
nacci think it would require some systemd bugging -- may be worth filing regardless15:31
Aisonbtw: the pcie LAN card is the new device15:34
Aisonbefore I just used the on board15:34
Aisonbut the same card was used in another 16.04 server before without any problems15:35
Hensterevening ,, i have like 10 drives lying around and heard of  zsf , silly question i need to fist format them all on to the same system frmat ? they are mostly ntfs17:17
naccHenster: you mean zfs?17:17
Hensteryes sorry17:18
drabHenster: nah, it wont' care, zfs utils will just take care of that17:24
naccHenster: aiui, what drab said17:24
naccHenster: you just need to tell zfs what disks to use17:24
Hensterwow ok cool17:25
Hensterand is it reasy just to add extra dives ?17:25
drabyes and no17:25
drabyes as in it's easy, no as in it probably doesn't work as you think it does17:25
Hensterdo all the drives have to be the same size ?17:26
drabHenster: please read through this at thev ery least: https://pthree.org/2012/04/17/install-zfs-on-debian-gnulinux/17:26
drabzfs is great, but also not particularly forgiving17:26
naccheh17:26
drabit's closer to what linux used to be: friendly but chooses its friends wisely17:27
Hensterok cool thanks was lookign for more content ..17:27
Hensteris there a newer or better version than zfs now ?17:27
drabhttps://wiki.ubuntu.com/ZFS17:28
drabfollow that to get going17:28
drabread the other thing past the first chapter about edbian to understand more about the concepts17:28
drabit's still the best walkthrough around17:28
drabalong with the other one I'm about to paste... sec17:28
drabthis is the best resource on zfs I've found, explaining the concepts in enough detrails that you won't shoot yourself in the foot while not being voerwhelming (and avoid cargo culting some of the many misunderstandings spread on the internet):17:29
Henstercool17:29
drabhttps://forums.freenas.org/index.php?threads/slideshow-explaining-vdev-zpool-zil-and-l2arc-for-noobs.7775/17:29
Hensterthank you so much , new toys for my server :)17:32
drabthere's a few more good docs I bookmarked, but don't want to voerwhelm you, that should keep you busy for a while :)17:32
drabas you proabbly heard for raid, raidz is not a backup, so backup your stuff!17:33
tewardanyone know of a clamav/clamd *alternative* that works fine with amavisd-new?  ClamAV eats over 780MB RAM in running on even an idle mail server, so it causes some... problems.17:41
sarnoldre "raid is no backup" https://twitter.com/leyrer/status/84781616255768985718:07
drablol, and the prize goes to the https://twitter.com/nuintari/status/84824959260920217918:08
drabbut I 'spose only for MP fans :D18:08
sarnoldhehehe18:12
dasjoeAncient machines18:14
tewardsarnold: ohai18:15
sarnoldgutenabend dasjoe :)18:15
sarnoldhallo teward :)18:15
dasjoeHi sarnold :)18:15
tewardsarnold: what do you know about clamav being a memory-consuming resource whore on servers and if there's any solution for it?  Or should I be bothering the server team to add a warning to the server guide about ClamAV taking up massive resource usage and have minimum reqs. of 2GB RAM or more to use it on the server18:16
tewardsince you've got some security team insights :P18:16
teward(clamav for mailservers == resource hog)18:16
patdk-wkheh? clamav doesn't consume a lot of memory18:17
sarnoldteward: heh, 2gigs feels smallish today..18:18
tewardpatdk-wk: well, running clamav ate 750MB of RAM on a VPS where i'm setting up a test mailserver with amavis+clamav18:20
tewardand it actually swapped so much I had to force-restart the VPS18:20
tewardso............18:20
patdk-wkclamav did? your your av libs for clamav did?18:20
tewardi'll let you restate your question (E: Unclear what's being asked)18:20
patdk-wkmy clamav with a LOT of 3rd party libs added to it, is using 710megs of ram18:20
patdk-wkis clamav using all that memory? or is your clamav-virus-definitions using it all18:21
tewardpatdk-wk: stock ClamAV from the repos.  650MB RAM + the rest was swap.18:21
tewardpatdk-wk: looked to be the clamav process on htop18:21
patdk-wkwhat clamav process? clamavd?18:21
tewardi'd have to relaunch it to check.  I'mi currently away from my SSH console, but will get back to you :)18:22
patdk-wkodd though18:22
patdk-wkmine is using 710megs exactly, no swap18:22
tewardunless it's a leaky version in Xenial18:22
patdk-wkusing clamav libs, securite, bofhland, foxhole, ...18:22
patdk-wkbut then the stock clamav libs are 250megs18:23
tewardwell, i have a trial of Avast's solution for antivirus, giving that a test go, otherwise Postfix + DoveCot + Amavis + SPF + DKIM + DMARC all works heh18:23
patdk-wkI use bitdefender also, but that is slow, cause it won't run in daemon mode and uses lots of ram also18:23
patdk-wkbut then, my mailservers have 30gigs of ram18:24
patdk-wkclamav uses only alittle ram, spamassassin uses a lot more18:24
SineDeviancehi all. i want to add a xubuntu environment to my server for use over NX. i am running 16.04 amd6419:48
SineDevianceis xubuntu-desktop still the correct metapackage?19:48
patdk-wkif that is what you want to use19:56
patdk-wkyou should probably ask xubuntu though19:56
SineDevianceit is19:57
SineDevianceboth what i want to use, and the correct package :D19:58
tewardpatdk-wk: spamassassin eats most of my RAM currently, on the box, next big user is Amavis but the problem is on a small email server (1GB RAM is low, yes), clamav's RAM usage is actually an issue.  Avast's solution seems to behave better in terms of resource usage21:22
blackflowteward: clamd (note the d) eating up a lot of RAM?21:45
queeqHas anyone got any problems with recent qemu update? My VMs on top of Xen are not starting anymore.21:55
queeqlibvirtd gives this error: invalid argument: could not find capabilities for arch=x86_6421:55
nacccpaelzer: --^21:56
tewardblackflow: yep.21:56
queeqIs anyone here running VMs on Xen and have restarted a server after applying upgrades today?22:03
sarnoldqueeq: please file a bug report against whatever it is that actually does your vms, whether that's qemu, libvirt, or xen. Of the three the most recently changed was five days ago, so it'd be best to be more specific than "today's updates" -- dpkg -l output of the affected packages, etc., would be helpful22:29
queeqThanks sarnold. I'm not sure it's a bug. I now tried downgrading qemu and it didn't help. Neither libvirt nor xen were upgraded recently22:30
queeqUpgrade that I suspected caused the issue included the following...22:31
queeqUpgrade: landscape-common:amd64 (16.03-0ubuntu2, 16.03-0ubuntu2.16.04.1), grub-common:amd64 (2.02~beta2-36ubuntu3.8, 2.02~beta2-36ubuntu3.9), makedev:amd64 (2.3.1-93ubuntu1, 2.3.1-                  93ubuntu2~ubuntu16.04.1), grub-xen-bin:amd64 (2.02~beta2-36ubuntu3.8, 2.02~beta2-36ubuntu3.9), qemu-system-x86:amd64 (1:2.5+dfsg-5ubuntu10.9, 1:2.5+dfsg-5ubuntu10.10), grub2-common:amd64 (2.        02~beta2-36ubuntu3.8, 2.02~beta2-36ubuntu3.9),22:32
queeqgrub-pc:amd64 (2.02~beta2-36ubuntu3.8, 2.02~beta2-36ubuntu3.9), libapparmor1:amd64 (2.10.95-0ubuntu2.5, 2.10.95-0ubuntu2.6), grub-pc-bin:amd64 (2.     02~beta2-36ubuntu3.8, 2.02~beta2-36ubuntu3.9), libapparmor-perl:amd64 (2.10.95-0ubuntu2.5, 2.10.95-0ubuntu2.6), qemu-utils:amd64 (1:2.5+dfsg-5ubuntu10.9, 1:2.5+dfsg-5ubuntu10.10), apparmor:amd64 (2.10.95-0ubuntu2.5, 2.10.95-0ubuntu2.6), wget:amd64 (1.17.1-1ubuntu1.1, 1.17.1-1ubuntu1.2),22:32
queeqgrub-xen-host:amd64 (2.02~beta2-36ubuntu3.8, 2.02~beta2-36ubuntu3.9), qemu-block-extra:amd64 (1:2.5+dfsg-   5ubuntu10.9, 1:2.5+dfsg-5ubuntu10.10), qemu-system-common:amd64 (1:2.5+dfsg-5ubuntu10.9, 1:2.5+dfsg-5ubuntu10.10)22:32
queeqI don't think it could be caused by grub. I'm now trying to downgrade apparmor, but not sure it could have caused this either22:34
queeqNah, apparmor downgrade haven't helped22:38
sarnoldpfew ;)22:39
sarnoldnot a surprise22:39
sarnoldbut still22:39
queeqDon't know what else to try... Something went wrong. And I haven't found recent information on this error. There were some bugs with qemu capabilities caching back in 2015, but that's it...22:41
tyhickspfew times two22:41
queeqlibvirtd verbose logging doesn't give any additional clues either22:41
queeqThe only error is this: error : virCapabilitiesDomainDataLookupInternal:699 : invalid argument: could not find capabilities for arch=x86_6422:44
sarnoldqueeq: skim this mail and see if it rings any bells https://lists.ubuntu.com/archives/ubuntu-devel/2016-September/039492.html22:46
queeqThanks, will do22:47
tyhicksqueeq: I'm guessing that `virsh cpu-models x86_64` returns an error?22:48
queeqtyhicks: "this function is not supported by the connection driver: virConnectGetCPUModelNames"22:49
tyhicksqueeq: is a libvirtd process even running?22:49
queeqYes it is22:50
tyhicksodd22:50
tyhicksI'm no help here22:50
queeqthanks anyway :)22:50
tyhicksoh22:50
tyhicksI guess virConnectGetCPUModelNames could be a qemu/kvm thing22:50
queeqMaybe, but there's xen as a hypervisor, no kvm22:51
queeqThat's why I suspected qemu upgrade to be the cause22:52
queeqsarnold: That mail hasn't rang any bells. It's mostly migration-related between major versions.22:56
queeqIn my case this was very minor upgrade without any migration. This setup has been working fine for a long time. Until today, lol :D22:57
compdocqueeq, I have vms running on kvm, and installed the recent qemu updates, but havent rebooted yet. how do you manage the vms? I'm guessing its not virt-manager22:59
queeqIt is virt-manager usually23:00
queeqBut bridging is manual23:00
compdocwhy do you mention bridging?23:01
compdocIm rebooting my host. lets see what happens23:01
queeqBecause this is part of VM management :)23:01
compdocI define bridges in /etc/network/interfaces23:01
queeqMe too, I turned off libvirt's networking because it conflicts with another bridge I have on the host23:02
compdocone of the guests in Windows Server 2008, which provides dns, dhcp, and is the domain controller. so until it finishes booting, I cant browse23:03
queeqYou seem to have more complex setup. I've only Linux guests23:04
compdocboth guests are running. the other guest is ubuntu server running bacula23:04
queeqSo you had no problems23:04
compdocyou should save teh xml file for the guests, and search for refernece to x86_64, or whatever the error is23:05
compdocreference23:05
queeqThere is a reference for it, but I think it's very standard file23:05
compdocIve had to cut out sections in the past, that were supported on centos kvm, for example, but not in ubuntu's kvm23:06
compdocthen just save and import the xml file23:07
queeqOh, I thought you're talking about qemu capabilities cache23:07
compdocI mean using virsh to save the xml definition, edit it, then import it back23:08
queeqI think they're stored in xml anyway, /etc/libvirt/libxl/vmname.xml23:09
queeqAlso accessible via virsh edit vmname23:11
queeqHaha, when I tried to edit it, it gives me the same error again23:14
queeqcompdoc: what arch do you have set in those xml files?23:14
compdoc<type arch="x86_64" machine="pc-i440fx-trusty">hvm</type>23:15
BoulevardHey everyone. I Asked in the Ubuntu channel but I figure this is worth a shot too. I have four disks in my PC. Two are raid0 array for Windows,, and the other two are just standard use for data and whatnot. I'd like to dualboot Windows 10 and Ubuntu(or others) safely, but I don't know how to properly install along the raid or install to one of the23:15
Boulevardother disks and where to put the bootloader for the latter idea. I was urged to try asking here, but I'm looking for desktop use. anyone have suggestions? Thanks.23:15
compdocnot sure how recent that is23:16
queeqStraaaange, same arch as I have23:16
queeqCould you show dpkg -l | grep qemu?23:16
compdocsorry, thats an old backup file. this is what I sue now, for more modern chipset features:   <type arch='x86_64' machine='pc-q35-2.5'>hvm</type>23:18
compdoc*use23:18
queeqBoulevard: your BIOS would try to read MBR from single disk first, anyway, so the way to do it would be to install grub on the one you are booting from23:18
queeqcompdoc: arch is the same....23:19
queeqI have <type arch='x86_64' machine='xenfv'>hvm</type>23:19
compdochttps://pastebin.com/uN01w5nD23:19
BoulevardSo I could safely drop linux into the 300gb or so I cleaned up on one of my other disks and then drop the loader on my raid?23:20
BoulevardI apologize, I haven't cut my teeth on these hardcore installs before23:20
compdocqueeq, so youre booting a xen kernel? is it a standard ubuntu package?23:21
compdocthe host, I mean23:22
queeqThanks compdoc, looks similar to mine, but I don't have qemu for archs like ppc or sparc. I use custom kernel.23:24
queeqBoulevard: you can drop the loader on any disk, `update-grub` utility should be able to find both windows and linux installations23:26
queeqYou would then just need to point BIOS to the disk where grub is installed23:27
queeqBy the disk I mean physical drive23:27
BoulevardSo it'd see windows from the raid and linux from my other non raid23:28
queeqOh, sorry, I missed there's RAID. What kind of RAID is that?23:29
BoulevardYes, sorry.23:29
BoulevardRaid0. Bios controlled, not hardware23:29
BoulevardThe CPU is a bit old, so I'm using raid to squeeze some speed out of the whole thing.23:30
queeqcompdoc: what emulator do you have set in the xml?23:30
naccBoulevard: fyi, bios raid is fakeraid and usually does not actually help23:30
BoulevardEh? :o23:31
BoulevardMust be placebo effect then. I thought it helped a bit at least23:31
queeqBoulevard: not sure if it would work in this case. I remember long time ago I was trying to set up something like this with no success. Ended up using Linux mdraid or zfs23:31
naccBoulevard: it might help a bit, but it's not real raid and isn't really accelerated23:31
queeqNeither mdraid nor zfs raids are cpu intensive23:32
naccright23:32
BoulevardI suppose I'll just get a couple new hard disks soon and dedicate an os to either of them then. I just reinstalled windows this weekend so I don't really feel like fiddling around with too much so soon23:33
naccBoulevard: so the issue is just deciding where to put the bootloader? where is it now?23:33
BoulevardHell they're 50 bucks on egg right now for 7.2 1TB's. (I'll take two dozen on the double :P)23:33
BoulevardThe Linux bootloader? Nowhere. I'm running a live usb session right now23:34
sarnoldBoulevard: some suggested reading before you build your 24-disk storage machine https://pthree.org/2012/12/04/zfs-administration-part-i-vdevs/23:35
sarnoldthe whole blog series is wonderful23:35
BoulevardNah I don't need that much XD. Jut being cheeky :P23:35
queeqSeems that I've lost hardware virtualization on my host23:36
BoulevardI see a 1TB volume under dev/mapper/ and then sda and sdb, which are my two 500GB raid disk members23:36
queeqTried creating new VM and it only has an arch option of xen (paravirt)23:37
BoulevardSDC is my 1tb media drive, which would be a candidate for install if it would work smoothly. sdd is the linux usb and sde is my external23:37
queeqwtf really, how's it possible?23:38
BoulevardWell. Whatever. I'll just order a couple disks and set it up like a normie. Thanks for the help guys.23:38
BoulevardHave a good afternoon :)23:38
naccqueeq: do you see the flag in /proc/cpuinfo?23:39
queeqWhich one should it be?23:40
drabvmx23:40
queeqoh well23:40
queeqI know23:40
naccor you can run `kvm-ok`23:40
queeqI had a power outage today and there were some issues with BIOS setup. I guess I lost vmx option there23:41
queeqIt seemed to have reset to default. As long as this is remote machine I wasn't able to check thoroughly23:41
naccstrange23:41
queeqThanks everyone!23:41
queeqThe clue is solved :)23:42
drabnacc: you don't happened to have tried to run kvm/libvirtd in a container, have you?23:42
draband when I say tried I mean succeeded :)23:42
queeqThis is a home server and there were some nasty outages lately. Everything started with it being unable to boot.23:42
naccdrab: no, i haven't tried that23:43
naccdrab: i assume it would only work in a privileged container, bu teven then ... maybe not :023:43
drabnacc: yeah, doesn't look like it...23:44
queeqWhen a screen was attached, it was residing on a BIOS warning about faulty set up. I instructed remote person to enter BIOS, and upon entering the Linux started to boot and I thought it's all fine23:44
queeqShite, killed half of the night trying to troubleshoot this23:44
naccqueeq: sorry :/23:44
queeqnp :) Without your help I would kill another couple of hours23:45
queeqThanks all, good night23:45
drabnn23:45
drabis it ok to rant about xml in here? I don23:47
drabt want to offer anybody :)23:47
draboffend*23:47
compdocits too late for that :/23:47
compdocjk23:47
drabheh23:47
compdocqueeq, if I remember right, the bit I had to cut out of the xml file was at the bottom23:48
queeqcompdoc: thanks, the issue is resolved now. 99.9% probability is that my BIOS settings got screwed after power outage23:49
compdocah, cool23:50
queeqI have dual-bios Gigabyte MB there which seems to have rewritten main BIOS with backup settings, and virtualization was turned off there.23:50
sarnoldqueeq: so you just had to turn on hardware accelerated vms in the bios?23:50
queeqThere's no vmx flag in /proc/cpuinfo23:50
queeqsarnold: I dunno yet, will ask a person who has physical access to the computer to do it tomorrow23:51
sarnoldugh23:51
queeqBut considering everything I've seen today I'm pretty sure this is the issue23:51
drabis anybody aware of any nefarious consequence if I take out the 127.0.1.1 hostname entry from /etc/hosts ?23:52
drabit's getting in the way quite a bit, and the reason it was added seems some old bug23:52
sarnoldI've never once heard of it getting in the way23:52
drabsarnold: ok, let me tell you about it then you will have had :)23:53
compdoc127.0.0.1 is still there?23:53
drabyes23:53
drabwith localhost23:53
compdocsome systems have it, some dont. <shrug>23:54
drabbut 127.0.1.1 with the hostname is added at install time23:54
compdocyup23:54
drabsarnold: what happens is that people, me included, use "localhost" to refer, to, well, local host23:54
drabthey otherwise use "hostname" to refer to the ip/interface that hostname should resolve to23:54
drabhowever because of the 127.0.0.1, using hostname still refers to localhost23:54
drabwhen configuring certain daemons, if you use hostname meaning the certain public ip/interface (could be lan), you get screwed becasue the daemon starts to listen on localhost23:55
naccsounds like bugs in those daemons23:55
drabif I want tomsething to listen on localhost I will say, you guessed it, localhost23:55
naccbecause a hostname does not define an interface23:55
naccif you want to listen on a public ip, use the public ip?23:56
naccor specify the interface to use23:56
drabthe daemons are doing the right thing, theya re calling gethostbyname23:56
naccwhat happens when hostname resolves to multiple IPs?23:56
drabwhich depending on how nss is configured will likely go hosts, dns23:56
sarnolddrab: thanks for the explanation. I've never seen anyone use hostnames quite like that before :) normally people either want wildcard binds or they want to bind to specific IPs or interfaces.23:58
drabnacc: each ip would likely have its own hostname (plus a cname to all of those), or if it doesn't specifying the ip itself makes sense then23:58
drabnacc: I'm not saying it's a general situation where specifying the hostname is always the right thing to do23:59
nacci don't think a 'hostname' uniquely identifies an interface23:59
drabI'm pointing to what seems a logical assumption: localhost means localhost, hostname means "something else". if the ip it points to resolves to the local machine, that's fine23:59
drabnacc: sure, I'm not saying ti should be23:59
naccand it seems like the daemons you are using make that assumption23:59

Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!