Dudeville

DisplayLink and x2x brings back Zaphod mode

2012-05-04T13:31:28+00:00

Ever since work issued me a Lenovo T61 and I installed Fedora on it, I have lamented the loss of something that X afficionados referred to as “Zaphod mode”. By gluing together a few different software and hardware components I managed to get close to the old Zaphod mode days — but first some background…

Usually when you set up a multi-monitor installation you get a single desktop that spans all the screens. This is great when you have a single desktop, but on Linux multiple desktops are the norm. When I started using multiple screens in Linux, I loved the extra screen real estate but the fact that switching virtual desktops caused *all* the windows on all the screens to switch really bugged me. I wanted the ability to have something — like an email program, or a web browser — to stay on one screen while I switched between desktop views on the other screen. Or better still, the ability for both screens to have virtual desktops that were independent of each other.

Enter “Zaphod mode”, named for Zaphod Beeblebrox from the Hitchhikers Guide to the Galaxy by Douglas Adams. Beeblebrox, who was President of the Galaxy before he stole the Starship Heart Of Gold, had two heads that were independent of each other. In X server terms, multiple display devices are often referred to as “heads”. So you can probably deduce that “Zaphod mode” refers to an operating mode of the X server where the multiple “heads” or display devices function as different displays.

Go back far enough and you get to a point where that was the standard mode of operation of X. The X extension “Xinerama” was developed to provide the merging of different X displays into a single screen. NVidia also had a hardware/firmware based equivalent called TwinView, where multiple heads on an NVidia card (and even sometimes heads on different cards) could be joined. These extensions came not without their problems however: it was common for windows and dialog boxes to get confused about what display to appear on. You would almost always see dialog boxes that are meant to display in the middle of the screen being split across the two physical displays. Also, there was the multiple desktop “inconvenience” of not being able to switch the desktops independently.

Zaphod mode fixed these problems. Because the screens were separate, windows and dialog boxes always appeared in the centre of the physical screen. You could leave a web browser on one screen while you switched between an e-mail client, an IRC client, and an SSH session in the other. It wasn’t all beer-and-skittles though, since in Zaphod mode it was not possible to move an application from one screen to the other. Plus, some applications like Firefox could not have windows running on both screens (the second one to start could not access the user profile).

Zaphod mode largely “went away” during the transition from XFree to Xorg. The servers dropped support for multiple separate displays in the one server, and only gradually added it back in (with the Intel driver being one of the last to do so, and probably still has not). Since laptops were the only place I still used multiple screens, and the laptops I used all had Intel integrated graphics, I had to do without Zaphod mode.

Today, I hardly use dual monitors at all. I used to have a desktop system with a 21″ CRT flanked by 17″ LCDs on either side, but that all got replaced by a single 24″ LCD. At work we don’t have assigned desks, so setting up a screen to plug the laptop into isn’t going to happen. I guess I learned to live without Zaphod mode by just going back to a single screen. I still remember my Zaphod-powered dual-screen days fondly though, and with almost every update to Xorg I would scan the feature list looking for something like “Support for configuration of multiple independent displays (Zaphod mode)”.

A while back I bought a DisplayLink USB to DVI adapter. I didn’t really know what to do with it at the time, but recently I dug it out and tried setting it up. Googling for “DisplayLink Fedora” sent me to a couple of very helpful pages and it didn’t take long to get the “green screen of life” that indicates that the DisplayLink driver was active. It was when I was looking at how to make it work as an actual desktop — part of the process involves setting up a real xorg.conf (that’s right, something about the DisplayLink X server means it can’t be configured by the Xorg auto configuration magic) — that I realised I could do something wonderful. Instead of making a config file that contained both my standard display and the DisplayLink device (and probably cause havoc for the 90% of times I boot without an additional screen) I would create a config file with *just* the DisplayLink device and start it as a second server. Run a different window manager in there, and I would have two independent desktops — Zaphod mode!

I did a couple of little experiments just starting an xterm in the second X, and it worked fine (the more alert of you will realise that I’m taking a bit of artistic license with the word “fine” here, and know that three little letters in the title of this post are a clue to what wasn’t yet working…) with the desktop and the xterm appearing in the second monitor. I installed XFCE, and configured it to start as the window manager of the second X server, which also worked well.

Something was missing though: there was no mouse input to the second screen. In Zaphod mode, even though the two screens were separate X displays they were managed by the same server. This meant that the input devices were shared between the two displays. In this configuration, I was careful to exclude any mouse and keyboard devices from my second display config to avoid any conflicts. So how was I to get input device data into the second server? A second display is not much good if you can’t click and type on the applications that run on it…

I remembered about an old program called x2x that could transfer the mouse and keyboard events to a different X server when you moved the mouse to the edge of your display (and, inexplicably, I forgot all about a much younger program called Synergy that can do the same thing). Since x2x isn’t built for Fedora I found the source and built it and started it up… and it worked first time! When I moved the mouse to the edge of the screen, it appeared on the other screen! I could start apps and type into them exactly as I wanted.

It wasn’t perfect, however. I found that when I returned the mouse to the primary screen, the second screen was still getting keyboard events. I figured this would be particularly inconvenient when, for example, I was entering user and password details into an app on the primary screen while an editor or terminal program had focus on the second screen… I checked the Xorg.1.log file, and found that even though I had not specified a “keyboard” input device Xorg was automatically defining one for me. I turned off the udev options, but it still happened. My initial enthusiasm was starting to fade.

What fixed it was to manually define a “dummy” keyboard device. There must be some logic in Xorg that it refuses to allow a configuration with no configured keyboard (which makes sense), so in this rather unusual case where I don’t want a keyboard I have to define one but give it a dummy device definition. Defining the dummy keyboard stopped Xorg from defining its automatic one, and everything worked as expected! Even screensavers work more-or-less as designed (although I haven’t actually spent much time in front of the setup yet so haven’t had to unlock the screen that often).

I’m away from the computer in question right now, otherwise I would post configs and command lines (and even a pic of the end result). I’ll update this post with the details — leave a comment if you think I need to hurry up! :)

Pipe dream: format shifting books for free

2012-03-23T11:41:00+00:00

I have, of late, been embarking on a huge program of minimalism. I have too much stuff. For the past twelve months, I have been getting rid of a lot of it, although probably not as ruthlessly as I'd like. Everything from old PC hardware, clothes, to computer and electronics magazines have been dumped in recycling bins. I do rather hope that the broken Mac SE/30 which I left out the front of my house, and then disappeared before the hard-waste collection came around, was turned into a fish bowl.

It's amazing just how much useless paraphanalia is accumulated just from attending conferences. All my LCA t-shirts are going into a Brotherhood bin; I don't wear them. It would be nice if, in future, LCA registration had a discount option without these. I realise that it probably wouldn't come to more than about $5 saving, but it's the principle of the matter - I don't want resources wasted creating a t-shirt that I'm never going to wear. The same goes for the bags, although these tend to be of much higher quality, and I've really liked most of them, but it's got to the stage where I have enough laptop bags and backpacks to last me a couple of lifetimes, and I just do not need any more.

I lived for fourteen months just travelling, with nothing more than a netbook and a backpack with a week's worth of clothes. I'd like to get to the point where if I decide to disappear overseas again, I can rent the house out in a furnished state, and have just a small amount of personal possessions that can be left with family. I believe the economic rationalist side of politics would call this "labor mobility", although I have no desire to pull up stumps and work in Western Australian mines, as they seem to expect everyone else to do, regardless of where their family and support network live.

One of the issues that I haven't yet tackled is books. Last year, I bought a Kindle, and Amazon DRM annoyances aside (which can be easily worked around), I love it. I do not ever want to buy a hard-copy book again. I do, however, have a library of books that I would like to keep, but not in a form that takes up several cubic metres of space. Given that I've already paid for the books, it seems unreasonable to have to pay again for a digital version. Obviously, I could probably find digital versions of most of the books on torrent sites, but then if I were to ever be audited (and given that ACTA has provisions for searching laptops at borders, we can never be sure that such powers won't be extended into homes) how can I prove that I actually owned the books, after I throw them out?

It's a shame that Amazon (or someone) doesn't provide a service where they take back second-hand books, provide a replacement digital copy and then resell the book to someone who does actually want a hard-copy, with a royalty to the author. Probably not cost-effective, I guess. But if there were some way to make it economically feasible, everyone would be a winner; I get to keep the content I paid for, the author gets another sale and a good book doesn't get pulped.

O'Reilly have an interesting $5 ebook upgrade scheme, but it doesn't cover all books, and I still bristle at the idea of paying more for an electronic copy of something that I already own.

The same goes for music. I have a CD collection, probably small by most standards, that nonetheless takes up space. It annoys me, because I haven't played a CD in years, have no interest in the cover art or reading the acknowledgements on the inserts. My two dedicated CD players - one, a 15 year-old portable, and the other, a two-decade old hifi-style component, are both scheduled to be given to my nearest charity shop, if they even want them. Unlike books, the CDs can easily be format-shifted, legally, but if I were to then throw out the physical media, I have no way of proving that I ever actually legitimately acquired them. The only thing I can think to do is sell them, at the heavily marked down prices that second-hand music goes for, and then buy all the albums again from iTunes, which will likely cost more than the CDs sold for.

I do envy future generations. The idea of building up a physical pile of stuff that weighs you down is going to be totally unknown to them, at least from the point of view of books, music, movies and other media that is going completely digital. They'll never have to waste time going through what I'm doing right now...

Hi, I’m Vic… and I have depression

2012-03-04T03:19:04+00:00

This is perhaps the hardest thing I’ve ever had to write. There is a lot of emotion behind the words I write here, and I’m trying to keep that out. If you were expecting the latest snippet of technical insight from me, I’m sorry. Maybe next time. This post is about me.

In the first six months of 2004 I changed employer, my first child was born, and I suffered a mild heart attack. For some time I’ve believed that this set of major events occurring over such a short period was responsible for the way I feel. If I’m honest though, there’s every likelihood that it was there long before, and 2004 just pushed me off the top of the slippery slope.

People’s reactions to near-death experiences vary almost as widely as the events that bring them to near-death. To me, how someone recovers from such an experience will depend very much on how they can rationalise who is at fault for the experience. Experiences like being a victim of armed robbery or a car accident are fundamentally different from health-related near-death because when it’s health-related there’s no-one to blame but yourself — you ate the wrong food, you didn’t exercise enough, you got bad genes, etc. You can try to blame someone or something else (blame the fast-food chains for your diet, blame the TV programs or the computer games for your lack of exercise, blame your parents for your genes) but deep down you know it’s all on you. The effect this can have on self-esteem and self-worth are immeasurable.

I say this all in my context of course — for me it was too tempting to blame that heart attack for feeling bad. I’m sure others have felt the same: despite all the other things in their life that might be causes of concern — stressful or unrewarding job, young children, difficult relationships, money problems — the health problem that nearly killed them becomes what they use to define themselves. This was definitely the case for me: I was 34 years old, I had been overseas for a week for work and was supposed to be at home helping to look after my 3-month old son, what the f**k was I doing in a cardiac hospital after suffering a myocardial infarction? I was broken, a product of a gene pool that produced 11 out of 13 immediate blood relatives with cardiac issues. People would tell me this was my “wake-up call”, my “second chance”, but nothing could break my resignation that the deck was stacked against me.

I saw a psychologist for a while in 2005-06, and was on antidepressants for a while around the same time. I thought I was feeling good about life again. My last visit with the psychologist was just before I went on an overseas business trip with a colleague in March 2006. I got a script for more meds before I went overseas (the doctor actually joked with me about how having a psychotic break while going through US airport security wouldn’t be a good thing), but when that script ran out I didn’t bother getting a new one. Looking back, I was in Zoloft-fuelled denial of my real mental and emotional state. I actually thought I was better, so I didn’t need the drugs any more.

The denial of my mental state has continued until almost the present day — except that it was no longer fuelled by antidepressants. Over the last six months or so, denial came from a self-fulfilling belief that there was nothing worth doing. When I thought I was feeling good about life, I failed to see that what I was really feeling good about were things in my life; in times when things to feel good about became fewer and farther between, so too would my moods get darker and darker. I’d have good days and bad days, but even on good days I’d be a hair’s breadth from falling into a dark black mood in which even just moving seemed like too much effort. I have been denying my state of mind — except when it suited me to say “I don’t feel like it” to get out of doing something. I’ve told myself that my poor diet and lack of exercise led to my heart problems, which in turn made me depressed, causing me to want to withdraw further from family and social situations.

Recently though, I’ve realised that the opposite is true: that all the things that I thought have derived from the heart attack have actually come from a different — but no less real — condition: clinical depression, or “a major depressive illness”. I’m actually on the border of bipolar disorder, but I’m told my “highs” aren’t quite manic enough to fit that profile.

Some of you reading this will unfortunately think that now that I know what my problem is I can just get over it. While knowing what my problem is allows me to find proper treatment, it’s a long way from getting over it. Let me ask you: if someone has a broken leg, does being told that they have a broken leg make the leg any less broken? ”Okay,” someone might reply, “so you just pop some pills to feel better.” Again: if someone has a broken leg and they take medication for the pain, is the leg any less broken? “Well, go and talk to a shrink then.” If you’ve got a broken leg and you talk to someone about the experience of having a broken leg, is the leg any less broken?

Our protagonist with the broken leg starts the road to recovery when the break is set and the leg is cast. Pain killers might be needed, along with crutches or a wheelchair for mobility, perhaps even a ruler to scratch the skin irritated by the cast. Physiotherapy to rebuild muscle and supporting tissue might be needed as well, once the bone is sufficiently restored. Our protagonist might walk with a limp for a while, but will eventually return to full health.

I have started to get help, but I have no idea what my road to recovery will look like. I saw my GP a few weeks ago and he referred me to a psychiatrist, with whom I’ve had my first session. Medication will be involved, but I’ve already felt the effects of the other actions I’ve taken: exercise, eating well, and treating my after-hours as my own time instead of an extension of the work day. I’ve started to lose weight as well (2-3kg so far) — something that I’d always wanted to do but felt was beyond my mood-locked abilities. I still have dark times though.

Now the really hard part. Some of you might be wondering if there was a catalyst to all this self-realisation and affirmative action. I’m not ready to talk about that, except to say one thing: this illness I have is like a cancer — ruthless, vicious, absolutely silent, and often detected way too late. Unlike cancer though, many people don’t take it seriously. Don’t take anything for granted. Depression will take things away from you that you don’t know you’ve lost until they’re gone, and what you lose might be the very things you’ve always needed to make it through to the end of each day.

Don’t wait until RU OK? Day… if you’re depressed, talk to someone; if you know someone who might be depressed, talk to them. Please.

Online resources in Australia for depression and bipolar disorder (not an exhaustive list, nor a list of endorsements):

Black Dog Institute – www.blackdoginstitute.org.au
beyondblue – The National Depression Initiative – www.beyondblue.org.au
DepNet – www.depnet.com.au
RU OK? Day – www.ruokday.com.au

geoffoc

2012-02-26T00:27:22+00:00

I had a W2K8 vm where I was adding / removing NICs like they were going out of fashion. As a result by the end of it I had a mess of non-present devices.

So how do you fix that mess?

I found (or more accurately was advised) that I can start a command prompt and

SET DEVMGR_SHOW_NONPRESENT_DEVICES=1
devmgmt.msc

Click on the ‘view’ / ‘Show Hidden devices’

Hey presto, there the were.

Then it’s just a case of right-click on the devices you no longer want and select uninstall.

End result is nice and neat.

centos6-kernelopts

2012-02-25T23:23:12+00:00

I was in need of creating a minimal Centos6 system, here’s how I did it in case anyone else is interested.

kickstart for minimal Centos 6 install. Hit tab at the boot screen

In this case as my environment doesn’t have a dhcp server I pass the ip of the new machine as a kernel option such that the request for the kickstart file will work,

Here is the kickstart file that I used.

install

text

lang en_US

keyboard us

bootloader –location=mbr –append=”crashkernel=auto rhgb vga=791 quiet”

zerombr yes

clearpart –all –initlabel –drives=vda

ignoredisk –only-use=vda

part /boot –fstype ext3 –size=512 –ondisk=vda

part pv.6 –size=8000 –grow –ondisk=vda

volgroup vgsys0 –pesize=32768 pv.6

logvol / –fstype ext3 –name=root –vgname=vgsys0 –size=1000

logvol /usr –fstype ext4 –name=lvusr –vgname=vgsys0 –size=2000

logvol /var –fstype ext4 –name=lvvar –vgname=vgsys0 –size=1000

logvol /opt –fstype ext4 –name=lvopt –vgname=vgsys0 –size=500

logvol /home –fstype ext4 –name=lvhome –vgname=vgsys0 –size=100

logvol /srv –fstype ext4 –name=lvsrv –vgname=vgsys0 –size=1000

logvol swap –fstype swap –name=lvswap –vgname=vgsys0 –size=1000

timezone Australia/Melbourne

authconfig –enableshadow –passalgo=sha512

selinux –permissive

firewall –service=ssh –service=smtp –port=143:tcp,80:tcp,443:tcp

rootpw –iscrypted $1$ZV4gC5MB@IvTI#j5jK2BFt/j1cnZiP0

network –bootproto static –ip 10.100.0.252 –netmask 255.255.255.0 –gateway 10.100.0.1 –nameserver 10.100.0.1 –hostname pxe.example.com

reboot –eject

%packages –nobase

@core

@server-policy

wget

%end

%post –log=/root/ks.log

cd /root

wget http://10.100.0.01/postks.sh

bash postks.sh

Only 204 packages installed

Another year over…

2011-12-31T13:29:24+00:00

As I type this, 2011 draws to a close (in this timezone at least) — in fact if I keep going long enough it’ll be my first post to span two years.

I would like to have blogged a bit more in 2011. It’s not like I had any shortage of things to write about, in fact that’s probably the crux of the matter: not enough time to write due to many things going on. No promises about writing more next year though — I can’t imagine I’ll magically have more time for writing next year!

Wherever you are, best wishes for the coming year. Here’s hoping that 2012 brings health and fortune to you and your family.

Happy New Year!

Its a Girl!

2011-11-22T13:39:23+00:00

One of the greatest things in my life happened on the 18th of November 2011, at 0738.. my daughter Ashley Rose was born! 3.6kg (8lb) & 51cm long.

It’s really quite amazing how such an event can change your life. I normally scoffed silently at those who told me “it will change your life” leading up to her birth it because I thought I knew what to expect and what would happen afterwards. I did not however expect my feelings and perspective on life to change so significantly as it has in the last week, and now I whole heartily expect it to change further as time progresses and I get to experience and watch her grow.

Exciting times ahead!

strobist – Incense smoke

2011-11-13T07:58:49+00:00

Incense smoke, originally uploaded by antonw.

This was really my first attempt of doing off camera flash work. Spent a couple of hours figuring out how to manually set up the shots.

I’ve only ever really relied on the TTF metering and having the flash on camera so the body would sort this all out for me so it was a bit of a crash course.

When I figured it out it was like one of those lightbulb moments where everything made sense and it really is quite easy to prep the shots! heh, see what I did there? lightbulb moment… flash…? *groan*

The only post processing done is to darken a small section in the bottom right corner , which was just from a black tshirt on the floor that was slightly exposed by the flash.

time flies

2011-11-11T14:15:19+00:00

So I’ve been in a new job for the last 6 months yet it feels like a year. So much learned, so much done and there is (yet again) a distinct gap in blog updates. I suspect these may be related… *shock horror*

Have been doing a *lot* of performance tuning in the last few months. I thought I did a lot of perf tuning at my previous job but that is really nothing in comparison. High performance, high volume, extremely low latency, that’s where I’m at at the moment and its rather cool

Something I didn’t mention since my last update is that my wife Sara and I are expecting, in under a week now actually! Really exciting times ahead, and totally looking forward to it!

In light of the above I’ve also fast tracked a few photography .. err.. acquisitions.. which has proven to be absolutely awesome in the limited week I’ve had them. I upgraded to a Canon 5d Mk2 (yeah yeah , I couldn’t wait for that fabled 5dmk3 ;P ) a 24-70 f/2.8 USM, and a 70-200 f/4 IS USM, some strobist umbrellas, speedlight mounts and other equipment. For those following my flickr, you can see some of these but some of my cool ideas have yet to eventuate, and I attribute that to my current lack of available time.. I’m still trying out new things, and am still producing a lot of amateur stuff, but those that do (in my opinion) shine through are really cool. I really can’t believe I haven’t updated to a full frame sensor sooner, this kit is freakin’ awesome!!

TEDx Canberra

2011-09-24T13:16:35+00:00

Attended TEDx Canberra today at the National Library. A great day - an informative and electric range of topics.

9 months on a data only mobile phone plan

2011-09-19T05:08:42+00:00

In January 2011 I downgraded my $30 mobile phone bill to $10 a month. Previous to paying $30 a month, I paid $50 a month. No longer was I able to make a “$270″ of phone calls on other networks over the GSM network. No longer was I going to pay $0.35 for each SMS. And no longer was I going to pay $0.89 to retrieve a voicemail message.

Thats right, I decided to stop paying the outrageous, overly exuberant prices Telecommunication companies in Australia wanted me to pay to use their network and services.

All I needed was a connection to a network that provided me with data. For $10 a month, I could get 500MB of data over a 3G or GPRS connection. Thats all I needed.

So for the last 9 months, my phone plan and habits are summarised as;

My monthly bill is now only $10 for 500MB of data.
Every 6 months I have to pay $30 to keep my mobile number to allow for incoming GSM calls. I also get $30 of credit for this.
I communicate with friends and family over IP. There are a plethora of applications on the iPhone that provide an infinitely better experience to communication than a SMS or even a phone call.
I use Acrobits Softphone as a VoIP client on my iPhone. It hooks into the contacts list on the iPhone, supports push notifications and I think is by far the best iOS SIP client. The app itself cost $7.49 and by forking out another $12 I was able to purchase the G.729 codec which provides better call quality over a 3G connection.
I pay a once off $20 fee to have an incoming DID. Included in this I also get $20 worth of VoIP calls. By using asterisk, I have full control over time and destination based routing and reroute incoming calls to my DIDs to either voicemail or my SIP client depending on time of day.

The way I make outbound calls had to change. When I have any packet loss over a 3G connection or latency due to a poor wifi connection, the quality of the call drops dramatically. This is usually followed by me asking the other person to call me back on my mobile number. If its a company I’m dealing with, the person I’m speaking to has no hesitation in doing this. If its a friend or family member, there is a bit of confusion and I quickly suggest I move this conversation over to IM or email.

From this how much have I saved?

For 2010, my monthly mobile phone plan cost $50. In 2011 its $10. So far I have saved $420 if I was to compare with this time last year. This brings a total yearly savings of $600 if I continue to stick with this for the next 3 months.

image by ryan_tir

Just Add Water

2011-09-17T06:48:28+00:00

Went to a great chemistry lecture at ANU this afternoon with Dave. 'Just Add Water' with Dr Peter Wothers from Cambridge. Lots of explosions!!! Science presented in an understandable and fun way. This being of course part of my ongoing goal to get Dave excited and interested in science and learning from an early age - lots of fun for me too!

Etherwaker - GPL wake on lan client for Android

2011-09-15T22:31:00+00:00

I've been playing around with Android application development quite a bit, over the last few months. The one thing I've built that's actually quite usable has been the wake-on-lan client Etherwaker (because the world really needed another one of these, didn't it?)

I've just put the Mercurial repository for it up on Bitbucket and released it under the GPL-3, for people to peruse or fork at their leisure.

Five second guide to fetching the source: hg clone ssh://hg@bitbucket.org/pdwerryhouse/etherwaker

If you can't be bothered with all this, and just want to wake up your mythtv box from your bed, then it can be downloaded from the Android market.

Building a redundant mailstore with DRBD and GFS

2011-09-14T03:47:00+00:00

I've recently been asked to build a redundant mailstore, using two server-class machines that are running Ubuntu. The caveat, however, is that no additional hardware will be purchased, so this rules out using any external filestorage, such as a SAN. I've been investigating the use of DRBD in a primary/primary configuration, to mirror a block device between the two servers, and then put GFS2 over the top of it, so that the filesystem can be mounted on both servers at once.

While a set-up like this is more complex and fragile than using ext4 and DRBD in primary/secondary mode and clustering scripts to ensure that the filesystem is only ever mounted on one server at a time, it's likely that there will be a requirement for GFS on the same two servers for another purpose, in the near future, so it makes sense to use the same method of clustering for both.

The following guide details how to get this going on Ubuntu 10.04 LTS (lucid). It won't work on any version older than this - the servers that this is destined for were originally running 9.04 (Jaunty), however, I've tested DRBD+GFS on that release, and there's a problem that prevents it from working. As far as I'm concerned, production servers should not be run on non-LTS Ubuntu releases, anyway, because the support lifecycle is far too short. This guide should also work fine for Debian 6.0 (squeeze), although I haven't tested it, yet.

One thing to keep in mind - the Ubuntu package for gfs2-tools claims that "The GFS2 kernel modules themselves are highly experimental and MUST NOT be used in a production environment yet". There's a problem with this, however - the gfs2 module is available in the kernel, in Ubuntu 10.04, but the original gfs isn't there (it wasn't ever there) and the redhat-cluster-source package which provides it, doesn't build. I'm inclined to say that the "experimental" warning is incorrect.

Firstly, install DRBD:

apt-get install drbd8-utils drbd8-source

We have to install the drbd8-source package in order to get the drbd kernel module. When drbd is started, it should automatically run dkms to build and install the module.

Now, the servers I'm using have their entire RAID already allocated to an LVM volume group named vg01, so I'm going to create a 60Gb logical volume within this volume group, to be used as the backing store for the DRBD block device on each. Obviously, this step isn't compulsory and the DRBD block devices, can be put on a plain disk partition instead.

lvcreate -L 60G -n mailmirror vg01

After this, configure /etc/drbd.conf on both servers:

global {
  usage-count yes;
}

common {
  protocol C;
}
resource r0 {
  net {
    allow-two-primaries;
    after-sb-0pri discard-zero-changes;
    after-sb-1pri discard-secondary;
    after-sb-2pri disconnect;
  }
  syncer {
    verify-alg sha1;
  }
  startup {
    become-primary-on both;
  }
  on mail01 {
    device    /dev/drbd0;
    disk      /dev/vg01/mailmirror;
    address   10.50.0.11:7789;
    meta-disk internal;
  }
  on mail02 {
    device    /dev/drbd0;
    disk      /dev/vg01/mailmirror;
    address   10.50.0.12:7789;
    meta-disk internal;
  }
}

With this done, we can now set up the DRBD mirror, by running these commands on each server:

drbdadm create-md r0 modprobe drbd drbdadm attach r0 drbdadm syncer r0 drbdadm connect r0

...and to start the replication between the two block devices, run the following on only one server:

drbdadm -- --overwrite-data-of-peer primary r0

By looking at /proc/drbd, we'll be able to see the servers syncing. It's likely that this will take a long time to complete, but the drbd device can still be used, while that's happening. One last thing we need to do is move it from primary/secondary mode, into primary/primary mode, by running this on the other server:

drbdadm primary r0

So, now we want to create a GFS2 filesystem. There's a catch here, however: GFS2 cannot sit directly on a DRBD block device. Instead, we need to put an LVM physical volume on the DRBD device, and then create a volume group and logical volume within that. Furthermore, because this is going on a cluster, we need to use clustered LVM and associated clustering software:

apt-get install cman clvm gfs2-tools

And then configure the cluster manager on each server. Put the following in /etc/cluster/cluster.conf:

<?xml version="1.0" ?>
<cluster alias="mailcluster" config_version="6" name="mailcluster">
        <fence_daemon post_fail_delay="0" post_join_delay="3"/>
        <totem consensus="6000" token="3000"/>
        <clusternodes>
                <clusternode name="mail01" nodeid="1" votes="1">
                        <fence>
                                <method name="1">
                                        <device name="clusterfence" nodename="mail01"/>
                                </method>
                        </fence>
                </clusternode>
                <clusternode name="mail02" nodeid="2" votes="1">
                        <fence>
                                <method name="1">
                                        <device name="clusterfence" nodename="mail02"/>
                                </method>
                        </fence>
                </clusternode>
        </clusternodes>
        <cman expected_votes="1" two_node="1"/>
        <fencedevices>
                <fencedevice agent="fence_manual" name="clusterfence"/>
        </fencedevices>
        <rm>
                <failoverdomains/>
                <resources/>
        </rm>
</cluster>

In the above, I'm using manual fencing, because at the moment, I don't have any other method for fencing available to me. This should not be done in production; it needs a real fencing device, such as an out-of-band management card (eg, Dell DRAC, HP iLO) to kill power to the opposite node, if something is amiss. All that manual fencing does is write messages to syslog, saying that fencing is needed.

Without fencing, it's possible to encounter a situation where the DRBD device might have stopped mirroring, yet the mail spool is still mounted on each server, with the mail daemon on each one writing to its GFS filesystem independently, and that would be a very difficult mess to clean up.

One other thing: there's an Ubuntu-specific catch here - Ubuntu's installer has this irritating habit of putting a host entry in /etc/hosts for the hostname with an IP address of 127.0.1.1. This will break the clustering, so remove the entry from both servers, and either make sure your DNS is set up correctly for the name that you're using in your cluster interfaces, or add the correct addresses to the hosts file.

You can now start up clustering on both hosts:

/etc/init.d/cman start

Run cman_tool nodes, and if all is well, you'll see:

Node  Sts   Inc   Joined               Name
   1   M    120   2011-09-14 10:53:32  mail01
   2   M    120   2011-09-14 10:53:32  mail02

We'll need to make a couple of modifications to /etc/lvm/lvm.conf on both servers. Firstly, to make LVM use its built-in clustered locking:

locking_type = 3

...and secondly, to make it look for LVM signatures on the drbd device (in addition to local disks):

filter = ["a|sd.*|", "a|drbd.*|", "r|.*|"]

Now start up clvm:

/etc/init.d/clvm start

At this point, we can create the LVM physical volume on the drbd device. Because we now have a mirror running between the two servers, we only need to do this on one server:

pvcreate /dev/drbd0

Run pvscan on the other server, and we'll be able to see that we have a new PV there.

Now, again, on only one server, create the volume group:

vgcreate mailmirror /dev/drbd0

Run vgscan on the other server, to see that the VG also appears there.

Next, we'll create a logical volume for the GFS filesystem (I'm leaving 10Gb of space spare for a second GFS filesystem in the future):

lvcreate -L 50Gb -n spool mailmirror

And then lvscan on the other server should show the new LV.

The final step is to create the GFS2 filesystem:

mkfs.gfs2 -t mailcluster:mailspool -p lock_dlm -j 2 /dev/mailmirror/spool

mailcluster is the name of the cluster, as defined in /etc/cluster/cluster.conf, while mailspool is a unique name for this filesystem.

We can now to mount this filesystem on both servers, with:

mount -t gfs2 /dev/mailmirror/spool /var/mail

That's it! We now have have a redundant mailstore. Before starting your mail daemon, however, I'd suggest changing its configuration to use maildir instead of mbox format, because having multiple servers writing to an mbox file is bound to cause corruption at some point.

Other recommended changes would be to alter the servers' init scripts so that drbd is started before cman and clvm.

Paul Dwerryhouse is a freelance Open Source IT systems and software consultant, based in Australia. Follow him on twitter at http://twitter.com/pdwerryhouse/.

Science week

2011-09-10T06:04:10+00:00

It was Science Week last week. There were so many excellent (and free) events on in Canberra. CSIRO Discovery Centre open day (complete with dinosaurs) on the Saturday plus an open day at the Shine Dome (Australian Academy of Science) (though I've heard it called the Martian Embassy). Attended a lecture on the Monday evening at ANU "Squeezing More from Less: Harnessing New Materials at High Pressures". Then the following weekend there was a kid's science experiment show down at the lake. Dave wasn't keen on volunteering so I accidentally started pointing at him so he got noticed and had to go up to the front - he had a balloon effigy of him frozen in liquid nitrogen. Lots of fun (well it was for me and Chels). Then on the Sunday we went to the Geosciences Australia open day - chatted to the staff about open source mapping and local geology - all very interesting.

The Pinnacles

2011-09-04T07:47:18+00:00

We're in Perth at the moment. Today we drove up to the Pinnacles Desert. It's about 2.5 hours or so north of Perth. Last time I visited was around about 1985 or 1986 while we were on a school geography camp. It hasn't changed a whole lot since then - the biggest change I noticed was that there we no longer a multitude of 'mini' pinnacles scattered all over the ground - I expect they've all been picked up by tourists. A lovely place to visit on a nice winter's day but in summer I'm sure it would be unpleasant up there (for a lot of the day at least). After seeing the Pinnacles we drove up to Cervantes where we went for a nice wander along the beach (walking along the beach just a couple of days after wandering around a very cold Canberra was a bit surreal). On the way home we stopped at a Stromatolite lake (just out of Cervantes) and Guilderton (which looked nice). Photos are here (page 2 of '2011').

Mt Aggie hike

2011-09-04T07:46:25+00:00

Today Dave and I climbed Mt Aggie up in Namadgi NP. Originally we planned on just walking along the set path from the Mt Aggie car park. However the road was blocked around spot height 1415 (on the Tidbinbilla 1:25000 map). We spoke to the ranger who suggested we follow the ACT/NSW border up to Mt Aggie - an easy walk (on paper) of around 2 Kilometres or so. Having all the gear with us (maps, compasses, GPS, SPOT, PLB, food, water, suitable clothing and survival gear) we decided that an off track bush bash was quite do-able. Within only a few hundred metres of the start point we ran into huge swathes of regrowth (evil shrubbery) which we had to negotiate our way through. After a while we managed to get to a clear spot and made a climb for the summit. On reaching the top I checked the map (something didn't add up - it seemed too quick a walk). I was right - we'd reached an adjacent summit, we had to climb down into a saddle and then climb up the 'real' Mt Aggie. That was fine until we again wandered into a big area of regrowth - it was bad enough for me (imagine trying to get through extremely dense hedges above head height) but it was really trying for Dave. I'm amazed he got through it without any problems - he's a tough kid - I'm very proud of him. We summited the real Mt Aggie and took in the beautiful views across the Bimberi Wilderness down to the Snowy Mountains. By this stage it was around 15:30 and it would be getting cold and dark before too long. We could have retraced our steps but that would have meant a repeat of the bush bashing - not much fun. We could have followed the Mt Aggie track back to the car park, but that would have added around 3 or 4 kilometres of extra (unnecessary) walking to our trip. So instead we climbed off the summit, walked down about 200 metres towards the car park then peeled off pretty much due East - hiking down through not too densely wooded terrain, after about 10 minutes popping out above Mt Franklin road. From there we walked back up the road to Shirley (with Dave jumping in/on frozen puddles along the way). All in all a nice little hike. Photos (second page of '2011') are here.

Oracle Database 11gR2 on Linux on System z

2011-08-31T13:57:14+00:00

Earlier this year (30 March, to be precise) Oracle announced that Oracle Database 11gR2 was available as a fully-supported product for Linux on IBM System z. A while before that they had announced E-Business Suite as available for Linux on System z, but at the time the database behind it had to be 10g. Shortly after 30 March, they followed up the 11gR2 announcement with a statement of support for the Oracle 11gR2 database on Linux on System z as a backend for E-Business Suite — the complete, up-to-date Oracle stack was now available on Linux on System z!

In April this year I attended the zSeries Special Interest Group miniconf[1], part of the greater Independent Oracle Users Group (IOUG) event COLLABORATE 11. I was amazed to discover that there are actually Oracle employees whose job it is to work on IBM technologies — just like there are IBM employees dedicated to selling and supporting the Oracle stack. Never have I seen (close-up) a better example of the term “coopetition”.

On my return from the zSeries SIG and IOUG, I’ve become the local Oracle expert. However, I’ve had no more training than the two days of workshops run at the conference! The workshops were excellent (held at the Epcot Center at Walt Disney World, no less!) but they could not an expert make. So I’ve been trying to build some systems and teach myself more about running Oracle. I thought I’d gotten off to a good start too — I’d installed a standalone system, then went on to build a two-node RAC. I communicated my success to one of my sales colleagues:

“I’ve got a two-node RAC setup running on the z9 in Brisbane!”

“Great! Good work,” he said. ”So the two nodes are running in different LPARs, so we can demonstrate high-availability?”

” . . . ”

In my haste I’d built both virtual machines in the same LPAR. Whoops. (I’ve fixed that now, by the way. The two RAC nodes are in different LPARs and seem to be performing better for it.)

Over the coming weeks, I’ll write up some of the things that have caught me out. I still don’t really know how all this stuff works, but I’m getting better!

Links:

IBM System z: www.ibm.com/systems/z or www.ibm.com/systems/au/z

Linux on System z: www.ibm.com/systems/z/os/linux/index.html

Oracle zSeries SIG: www.zseriesoraclesig.org

Oracle Database: www.oracle.com/us/products/database/index.html

[1] Miniconf is a term I picked up from linux.conf.au — the zSeries SIG didn’t advertise its event as a miniconf, but as a convenient name for a “conference-in-a-conference” I’m using the term here.

What a difference a working resolver makes

2011-08-07T13:45:19+00:00

The next phase in tidying up my user authentication environment in the lab was to enable SSL/TLS on the z/VM LDAP server I use for my Linux authentication (I’ll discuss the process on the DeveloperWorks blog, and put a link here). Apart from being the right way to do things, LDAP authentication appears to require SSL or TLS in Fedora 15.

After I got the Fedora system working, I thought it would be a good idea to have other systems in the complex using SSL/TLS also. The process was moderately painless on a SLES 10 system, but on the first SLES 11 system I went to YaST froze while saving the changes. I (foolishly) rebooted the image, and it hung during boot. Not fun.

After a couple of attempts to fix up what I thought were the obvious problems (each attempt involving logging off the guest, connecting its disk to another guest, mounting the filesystem, making a change, unmounting and disconnecting, and re-IPLing) with no success, I went into /etc/nsswitch.conf and turned off LDAP for everything I could find. This finally allowed the guest to complete its boot — but I had no LDAP now. I did a test using ldapsearch, which reported it couldn’t reach the LDAP server. I tried to ping the LDAP server by address, which worked. I tried to lookup the hostname of the LDAP server, and name resolution failed with the traditional “no servers could be reached” message. This was odd, as I knew I’d changed it since it was pointing to the wrong DNS server before… I could ping the DNS by address, and another system resolved fine.

I thought it might have been a configuration problem — I had earlier had trouble with systems not being able to do recursive DNS lookups through my DNS server. I went to YaST to configure the DNS Server, and it told me that I had to install the package “bind”. WHAT?!?!? How did the BIND package get uninstalled from the system…

Unless… It’s the wrong system…

I checked /etc/resolv.conf on a working system and sure enough I had the IP address wrong. I was pointing at a server that was NOT my DNS server. Presumably the inability to resolve the name of the LDAP server I was trying to reach is what made the first attempt to enable TLS for LDAP fail in YaST, and whatever preload magic SLES uses to enable LDAP authentication got broken by the failure. Setting the right DNS and re-running the LDAP Client module in YaST not only got LDAP authentication working but got me a bootable system again.

A simple fix in the end, but I’d forgotten the power of the resolver to cause untold and unpredictable havoc. Now, pardon me while I lie in wait for the YaST-haters who will no doubt come out and sledge me… :-)

RACF Native Authentication with z/VM

2011-07-20T02:49:33+00:00

In 2009 I was part of the team that produced the Redbook "Security for Linux on System z" (find it at http://www.redbooks.ibm.com/abstracts/sg247728.html). Part of my contribution was a discussion about using the z/VM LDAP Server to provide Linux guests with a secure password authentication capability. I probably went a little overboard with screenshots of phpLDAPadmin, but overall I think it was useful.

I’ve come back to implement some of what I’d put together then, and unfortunately found… not errors as such, but things I perhaps could have discussed in a little more detail. I’ve been using the z/VM LDAP Server on a couple of systems in my lab but had not enabled RACF. I realised I need to "eat my own cooking" though, so decided to implement RACF and enable the SDBM backend as well as switch to using Native Authentication in the LDBM backend.

Native Authentication provides a way for security administrators to present a standard RFC 2307 (or equivalent) directory structure to clients while at the same time taking advantage of RACF as a password or pass phrase store. Have a look in our Redbook for more detail, but basically the usual schema is loaded into LDAP and records are created using the usual object classes like inetOrgPerson, but the records do not contain the userPassword attribute. Instead of comparing a presented password against the field contained in LDAP, the z/VM LDAP Server (when Native Authentication is enabled) issues a RACROUTE call to RACF to have it check the password.

In my existing LDAP database, I had user records that were working quite successfully to authenticate logons to Linux. My plan was simply to enable RACF, creating users in RACF with the same userid as the uid field in LDAP (I have access to a userid convention that fits RACF’s 8-character restriction, so no need to change it). After going through the steps in the RACF program directory, and various follow-up tasks to make sure that various service machines would work correctly, I did the LDAP reconfiguration to get Native Authentication.

At this point I probably need to clarify my userid plan. The documentation for Native Authentication in the TCP/IP Planning and Administration manual says that the LDAP server needs to be able to work out which RACF userid corresponds to the user record in LDAP to be able to validate the password. It does this by either having the RACF userid explicitly specified using the ibm-nativeId attribute (the object class ibm-NativeAuthentication has to be added to the user object), or by matching the existing uid attribute with RACF. This is what I hoped to be able to do; by using the same ID in RACF as I was already using in LDAP, I planned to not require the extra object class and attribute. In the Redbook, because my RACF ID was different from the LDAP one I went straight to using the ibm-nativeId attribute and didn’t go back and test the uid method.

So, I gave it a try. I had to disable SSH public-key authentication so that my password would actually get used, and once I did that I found that I couldn’t log on. It didn’t matter whether I tried with my password or pass phrase, neither was successful. I read and re-read all the LDAP setup tasks and checked the setup, but it all looked fine. In one of those "let’s just see" moments, I decided to see if it worked with the ibm-nativeId attribute specified in uppercase… and it did!

Okay, so it appeared that the testing of uid against a RACF id was case-sensitive. I decided to try creating a different ID, with an uppercase uid, in LDAP to double-check. Since phpLDAPadmin wouldn’t let me create an uppercase version of my own userid (since that would be non-unique), I created a different LDAP id to test:

[viccross@laptop ~]$ ssh MAINT@zlinux1
Password:
Could not chdir to home directory /home/MAINT: No such file or directory
/usr/X11R6/bin/xauth: error in locking authority file /home/MAINT/.Xauthority
MAINT@zlinux1:/>

My MAINT user in LDAP has no ibm-nativeId attribute, so the only operational difference is the uppercase uid (the error messages are caused by the LDAP userid not having a home directory; I use a NFS shared home directory had I hadn’t bothered setting up the homedir for a test userid).

The final test was to change the contents of the ibm-nativeId attribute in my LDAP user record to lower-case — and it broke my login. So that would seem to indicate that the user check against RACF is case sensitive wherever LDAP gets the userid from. I’m going to have a look through documentation to see if there’s something I need to change, but this looks like something to be aware of when using Native Authentication.

I also noticed that I didn’t describe the LDAP Server SSL/TLS support in the Redbook, but that’s a post for another day…

My first 6 months on the slow carb diet

2011-07-15T11:41:01+00:00

Tim Ferris’ latest book, The 4 Hour Body, describes the ‘Slow Carb Diet’. I wont go over the details in depth but if you’re unaware of what they check are out the details here and here.

In summary, there are 5 general rules to the diet.

AVOID ‘WHITE’ CARBS
EAT THE SAME FEW MEALS OVER AND OVER AGAIN
DON’T DRINK CALORIES
DON’T EAT FRUIT
TAKE ONE DAY OFF PER WEEK

3 months prior to starting the ‘Slow Carb Diet’ I quit the gym, ate alot of beans and legumes. I also started doing 5km runs 3 times a week. I weighed 105kgs back then. I now weigh 80kgs. I’m 30.

Here are some of the things I’ve learnt from being on the ‘Slow Carb Diet’ which has certainly changed the way I live and eat.

Cheat days can be expensive

Sunday is my cheat day. I can eat what ever I want and I do, eat, what ever, the fuck, I want. Shopping for my cheat day is like letting a 4 year child lose in lolly shop. A point made by Tim in the book is that you should only buy portions for your cheat day that will last just for your cheat day and no more. You dont want that half tub of French Vanilla Icecream sitting in the fridge during the week potentially triggering a mid week ‘cheat night’ which is against the diet.

I buy my food vices on special and on the cheap. Biscuits, Icecream, Chocolate are the usual suspects. I find that if If I don’t shop around and buy the treats on special, I could easily spend $25 just for a single days worth of junk food which is bit too much money I’d like to part with just to pig out and make myself feel sick.

Your partner will eat and cheat with you

I cook dinner every night and eat with my girlfriend. This means she too will also have to consume legumes, eggs and spinach.

After a couple of weeks this took its toll and she needed her nightly portion of carbs in the form of pasta, rice or a baked potato. I now cook these items for a single serving which she has, whilst I stick to foods that are inline with the diet.

The diet is a winner for busy people

I have not done any real cardio exercise besides playing basketball 2 hours a week since being on the diet. The diet is excellent for people who don’t have time to exercise alot though have the discipline to stick to the right foods. Don’t get me wrong, I still exercise but I’ve reduced my exercise regime down to 3 to 4 nights doing free weights and ab exercises on the ground and on a decline bench at home.

Feeling hungry is now a different feeling

Sure I get hungry, but the feeling is alot different to when I wasnt eating so many legumes, greens and no white carbs. These days, when hunger strikes I chomp on a single carrot, stick of celery or a couple of almonds and the hunger disappears. Previously, I would hunt for dry biscuits, fruit, cereal or just anything that would provide my stomach and brain with a quick fix. My way of thinking when it comes to food and nutrition has certainly changed because of the Slow Carb Diet.

Grocery shopping becomes more systematic

The onset of the diet forced myself to think differently when it came to purchasing food. Because of the first 4 rules of the diet, I would think long and hard about what I’d eat. Grocery shopping trips would be more strategic and reading labels and nutritional information on the food products I bought would now be part of my shopping routine.

I know exactly what my meals will consist of for the next week. Legumes, greens, beans, eggs, mushrooms with pork, lamb, beef or chicken. The shopping trips for these meals becomes more systematic, less time consuming and cheaper.

Get used to beans and legumes

Borlotti beans, mushrooms, spinach and 2 eggs is breakfast. Beans, lentils, spinach and a carrot is lunch. For dinner I will have a mix of more borlotti beans and white beans with a handful of almonds for something to munch on during the night.

To get the most protein out of your meals, beans and legumes are the way to go.

My body composition certainly has changed over the last 9 months and people I havent seen for a couple of months do notice it but this is not the most important part of this diet. Changing the way I think, eat and value food has been the most rewarding part for me. I feel I can continue with the diet for another 6 months at least but will carry the life changing knowledge, experiences and habits I’ve gained till I die.

geoffoc

2011-07-15T07:17:11+00:00

Ok, so it’s not the most clever thing you can do, but in a lab situation you may not simply have the machines or licences to go around.

vmware tends to agree – the vCenter server itself wont normally install on a system where AD is running.

This product can only be installed on the following 64-bit operating systems:
Windows XP SP2 or above
Windows 2003
Windows 2008

The secret is to get vCenter to use different ports for its ADAM instance.

As I prefer scripting to clickity-click you can put in a default vCenter server build (with different LDAP ports) using

start-process -wait -filepath z:\vpx\VMware-vcserver.exe -argumentlist '/q /s /w /L1033 /v" /qr DB_SERVER_TYPE=Bundled FORMAT_DB=1 VCS_ADAM_LDAP_PORT=3899 VCS_ADAM_SSL_PORT=6369"'

You should install vCenter Server before promoting to AD. Once it’s done you can run dcpromo.exe to set up the AD.

Note: You wont be able to re-install the vCenter server though so the usefulness to you may vary. That’s right, this is not a recommended production deployment

If you know what everything above is doing – great. If you don’t, then assume it will eat your children.

Probing the Warped Side of the Universe with Gravitational Waves

2011-07-06T08:49:01+00:00

We went out to see Kip Thorne give a public lecture at ANU on "Probing the Warped Side of the Universe with Gravitational Waves". Great stuff - wish I'd known about things like this when I was a kid. Hopefully our children will grow up to become Astrophysicists rather than corporate slaves. Oh and what the heck is that ripply thing? It's meant to represent ripples in spacetime generated by fast orbiting stars (neutron stars, white dwarfs or black holes). There you go.

geoffoc

2011-07-05T04:34:55+00:00

This is more a reminder to me

Get-HardDisk -vm vm | Where {$_.Name -eq "Hard disk 1"} | % {Set-HardDisk -HardDisk $_ -Datastore "" -Confirm:$false}
But the summary is that it svMotions 1 hard disk out of a VM onto a different datastore – useful is you have multiple tiers and want say OS disk on one tier and low access data volumes on other storage tiers.

Ice Skating

2011-07-05T01:20:47+00:00

We (well, everyone except me the chicken) (someone had to hold the shoes!) went Ice Skating in Civic today. Dave just launched out by himself which was great to watch. He's got good balance so he was alright most of the time - though he still managed to get thoroughly soggy by the end of it. Chels enjoyed it but her legs got tired after a while so she came out and sat with me. I would have had a go but realistically the rink was too small and there were too many people on it for me to really show off my moves (I'm being ironic in case you couldn't tell). Here are some photos (we're now on to the second page of 2011).

Split Rock hike

2011-07-05T01:04:12+00:00

Went for a hike today out to Split Rock. Starting out from the car park at the old Orroral tracking station it was pretty cold. I got there around 7am and it was definitely at least a few degrees below zero with lots of frost of the ground. The Kangaroos looked cold. Sunrise was officially around 07:15 so the first part of the walk was fairly brisk (in terms of speed and temperature). After a while (an hour, maybe an hour and a half) you leave the fire trail and start along the Australian Alps Walking Track - heading up to Cotter Gap. The growth through here is pretty dense in places - in fact unless people keep walking through here it will be overgrown within a few years I'd expect. The climb up from Sawpit creek to Cotter Gap was fairly tiring - I stopped now and then to catch my breath - of course lugging a 15KG pack full of gear doesn't help - but you need to be prepared when walking alone. After reaching the top of the climb you are almost immediately confronted by Split Rock - a giant granite tor that is sitting on top of a steep hill. After stopping for enough time to realise I'd lost my sunglasses I decided to tackle Split Rock head on. Bad move. Without any trail as such the route up the beast was through shifting soft ground, dense scrub, across (sometimes huge) dead trees and around big boulders. It was quite a struggle and after getting about half way up I stopped, realising the struggle wasn't really worth the risk of a broken ankle or worse out here by myself. So - I bush-bashed back down, had a spag-bol-in-a-bag for lunch (they are horrible) sitting next to a stream and a cluster of rocks still clad in ice even though by this stage it was about 11:30am. The walk back was 'OK' to begin with - then got gradually more knackering as time wore on. In the end it took me 7 hours of elapsed time to do the 20KM walk, with about 45 minutes to 1 hour of stop time. Next time I'll try climbing up to Split Rock from the other (less steep) side of the hill - though the scrub and obstacles will be just as bad I'm sure. Here are some photos (under 2011).

Corin Dam

2011-07-01T06:50:20+00:00

Today we took the kids up to Corin Forest to have a go on the bobsled. Just as much fun now as it was when I first tried it 20 years ago. They still have their Land Rover 'Forward Control' truck rotting out the front - nice to see it. After that we went down to Corin Dam to brew up a Milo/Coffee. At that point I realised I was 'sans wallet'. A quick drive back to Corin Forest and I was reunited - that's the problem when you stick your wallet in your back pocket and you go on a bobsled. We had lunch down at the Tidbinbilla Deep Space Tracking Centre. Had a chat to a bloke about Voyager leaving the solar system (it's amazing to think that the antenna we were standing near 'talks' to the Voyagers (and a whole bunch of other space hardware). Here are some photos (under 2011).

Snow Hunt!

2011-07-01T06:31:50+00:00

It's the Queen's Birthday long weekend. Today we went on a hunt for some snow. I bought a plastic toboggan last week so the pressure was on! We drove down to Jindabyne - stopping at the NPWS centre to buy a parks pass (wow! they're expensive). We then headed to Island Bend for lunch (going to the same spot me and Dave camped in when we were down here in January 2010. Here we all rugged up into snow gear and drove up to Guthega - the aim being to drive over the top of the mountain to Smiggens. Well that's didn't work out as planned - the track was blocked off (for winter I suppose) so we had to drive the long way around to Perisher. Snow was pretty well rubbish as it's early in the season and it's been mild the past few days. With a bit of perserverence and some wet feet we found a bit of snow (freely accessible snow - I'm not paying to access the stuff!) and the kids had fun. Driving back we went via Angle Crossing - there's a ford across the river there - I'm glad we were in Shirley! Photos are under 2011 here.

Granite Tors - Mt Orroral

2011-07-01T06:18:46+00:00

Just done the Granite Tors walk on Mt Orroral. This is the same walk I did with Dave almost 3 years ago to the day. Funnily enough the weather was much the same now as it was then - sunny to start off with, then threatening rain, then raining. My aim this time was to climb up to the summit of Mt Orroral but unfortunately it was firmly up in the clouds - so doing a lot of off track bush bashing just to be enveloped in cloud didn't sound that appealing. I stopped for lunch at the Geodetic survey observatory - chicken soy 'goop' in a bag - yum! (actually given it was nice and warm and vaguely tasty it went down a treat). Same story as my Square Rock walk - lots of overgrowth on the path - made wearing waterproofs a must. Photos are here.

Square Rock hike

2011-07-01T05:45:06+00:00

Perfect weather for a hike out to Square Rock in Namadgi National Park. Parking the car at Smoker's Gap I first walked out to the Orroral Valley lookout. As you'll see from the photos the view is spectacular. Once I'd taken those photos I retraced my steps back on to the main track and headed off to Square Rock. There's been a lot of regrowth in this area and walking along the trail felt at times more of a bush bash. I've recently got a new GPS - this one has a funky little karabiner so you can hook it on to things like your backpack. Given the bush bashing I decided to protect the GPS by hooking it directly in front of me at chest height (to my backpack strap) - that way it wouldn't get dragged off me by a branch or bits of aggressive shrubbery. Sounds fine until you then take the backpack off - which I did when I reached Square Rock. The GPS now being 'free' of its attachment to me immediately obeyed the laws of gravity and went crashing to the ground - smashing the touch screen in the process. Well - that'll teach me. After some self-reproach and a bit of swearing I decided to forget about the GPS for a bit and go off and enjoy the views from Square Rock. And what views they are - I can see why this is one of the most popular walks in these parts (going on the fact that the trail book was completely full). A nice walk, only slightly marred by me being stupid and a track which is way too overgrown and needs some trimming.

Mt Gingera hike

2011-07-01T05:07:15+00:00

The seasons are turning, it's starting to get cold. Perfect weather today for a hike to Mt Gingera. Leaving Shirley at the end of the track (below Mt Ginini) I trudged along to Pryor's Hut. Going inside for a bit of a look it was amazing to think that some brave folks had saved it from the massive fires that hit the area back in 2003. I then climbed up to Mt Gingera - second highest peak in the A.C.T. at 6086 feet (1855 metres for you metric altitude folk). If looking toward the mountains from Canberra it's 'right at the back', a flat-ish mountain and more often than not the first one to get snow on it in winter. Given it is fairly flat on top the true summit is a point of debate. For me standing on top of a great big granite tor made me the highest thing around so that was good enough for me. The 360 degree views are amazing - back to the Tidbinbilla range, the Tinderries, Bimberi wilderness (which at this point you're standing in) and down into Kosciuszko National Park. Not a particularly strenuous hike, but at close to 14km the wander back up the same track you plodded in on was for me a bit boring, inducing thoughts of 'am I there yet?'. One of the best walks I've done in this part of the world - not the walk itself - but the destination - standing on top of Mt Gingera, perfect silence, awesome views - just wonderful. Here are some photos (under 2011).

Mt Franklin hike

2011-07-01T02:40:46+00:00

Apparently it's a royal wedding tonight. For the last big royal wedding (in 1981) I was in a tent in Paington (in Devon) - so I missed it. Being a traditionalist I thought it would be only right to also miss this royal wedding (and of course be in a tent). The plan was for me and Dave to jump in Shirley and head off to the hills, finding somewhere to camp for the night after a day spent bushwalking. First stop was Mt Ginini (weather station and airservices naviation gear at the summit). As we drove all the way to the top it would be cheating to say we climbed it. From the top we got a good view towards Mt Gingera and the Bimberi wilderness. Driving back down the track we stopped at the Mt Franklin car park. We went for a wander up the track, first stopping at the remains of the Mt Franklin chalet and having a look around the new building that's there in its place. I can understand why the new building was locked - but it would make a great shelter in stormy conditions so from that perspective I don't see why it was locked... surely there's got to be an intelligent compromise lurking somewhere. We climbed Mt Franklin - there's been lots of regrowth since the 2003 fires but you can still make out the ski runs that were constructed up here in the past. Beyond the summit (which is really more of a plateau) there's a path leading down to the old Austin which sits up here slowly rusting. Back in the 1960's it was apparently used in a robbery and had its roof torn off - the hulk was then dragged up this mountain and used as a ski tow.

After getting back to Shirley we decided to drive down to Flea Creek deep in the Brindabellas to camp for the night. The 4WD track down to the creek is very steep in places - in fact in wet conditions I think it would be pretty hairy if not totally impassable. As it was we drove most of it in low range - barely ever getting above 2nd gear. From the turn off on to the track down to the bottom of the hill is something like a 2000 to 2500 foot descent - over only a few kilometres. Once we got there we had the place to ourselves. A nice tranquil spot, the only thing audible being the sound of babbling water and the occasional bird call. We started to gather wood for our camp fire and I was about to put the kettle on. Next thing you know some hoon in a 4WD comes tearing in at high speed, screeching to a halt about 100 metres from where we were starting to set up camp. Two guys jump out, a stereo immediately starts thumping and within a few minutes one of them wanders off and the next thing we hear are gunshots from the bush. Brilliant. Maybe this isn't such a nice place to be after all. Luckily we hadn't set up the tent or anything like that so within a couple of minutes we were back in Shirley, chugging up the track out of there. Wimpy maybe, but you just never know - it wouldn't have been so bad if there were other folks about but we were a very long way from anywhere in a very isolated and rarely visited stretch of the mountains. Shades of 'Deliverance'. We then drove over to the small camp ground below Mt Coree. That isn't such a nice place either - being stuck under some very tall trees (widow makers) and being a pretty cold spot. So... we did what any self-respecting explorers would do - we said 'forget it' and decided to go home instead. Here are some photos (under 2011).

The Big Hole - Deua NP

2011-07-01T01:15:09+00:00

For some time I'd been aware there was some sort of 'big hole' in the ground somewhere out Braidwood way. Well today we finally went out and had a look at it. It's in the Deua National Park, about 45 minutes south of Braidwood. Starting from the Berlang camping area it wasn't long before we had to cross the Shoalhaven river. The river wasn't very deep at this point (about calf deep - as in leg, not adolescent bovine) - though the water was a bit chilly. The walk continues on for about another 30 or 40 minutes. The hole itself was formed by collapsed limestone - it's maybe 80 metres deep and about 50 metres wide. Certainly deep enough not to want to fall down it (which has apparently happened). A nice little walk and well worth seeing. Some photos are here (under 2011).

Bendora Dam

2011-06-28T06:53:18+00:00

It's the ANZAC day public holiday today and we took a drive up to Bendora Dam in the Brindabellas. We hadn't been there before, always driving past the turn off but never venturing down the hill. I'm glad we've now changed that. We had a lovely picnic - greatly improved by bringing along the Coleman gas camp cooker - we had bacon sandwiches and coffee in the middle of nowhere - luxury. The dam was pretty full (in fact they had been emptying it for weeks to assist in the build of the new Cotter Dam wall). We met the ranger (from Florida) who seemed like a nice chap. We drove back via some 4WD tracks and eventually popped back out near the 'Namadgi' sign on the Brindabella road. We took some photos which can be seen under '2011' here.

Black Mountain bushwalk

2011-06-28T06:31:59+00:00

We all went out for a bush walk today - the aim being to climb Black Mountain. Parking around near the CSIRO complex we used the track that comes in from the east/north sector. It was only a little walk in the scheme of things but it's a significant one as we think it's Chelsea's first real bushwalk. She did a very good job too - no complaining, just lots of enthusiasm. Photos here (under 2011).

Manhattan weekend

2011-06-28T06:22:41+00:00

This weekend found me in Manhattan. Usually when I'm here I wander about during the day, taking in the sights (most of which I've seen many times before). This time however I actually ventured out at night! Amazing. Well, when you're alone you tend not to want to go out to pubs, shows or dinner by yourself - well I don't anyway. This time however I was lucky enough to be in the right place at the right time. On the first night I managed to see Loudon Wainwright III perform at a small art gallery in Chelsea. What's even more amazing is I managed to sit in the front row and after the concert had a chat with him and got my photo taken (see above - no he's not a giant, I'm standing and he's sitting on the stage). That was fun - it's not often you get to meet one of your all time favourite musicians. Next night I had another piece of luck. I've been listening to 'The News from Lake Wobegon' which is a segment on 'A Prairie Home Companion' (staring Garrison Keillor) for years. They happened to be doing live radio shows on Broadway for a few weeks while I was there. So a few clicks of the mouse later and I had a ticket to the radio show. Fantastic. On the final day (plenty of time the plane doesn't leave till the early evening) I did the usual - wandered up through Central Park to 'The Met' - had a good look at the art and bought some pressies in the gift shop. Some photos are here (under 2011).

Walkway over the Hudson

2011-06-28T05:59:09+00:00

Still in Upstate New York for work. This morning being a Sunday I decided to go for an early morning walk over the Poughkeepsie-Highland Bridge. Wikipedia says: The Poughkeepsie Bridge (sometimes known as the Poughkeepsie Railroad Bridge, the Poughkeepsie-Highland Railroad Bridge, the High Bridge, or, since October 3, 2009, the Walkway Over the Hudson State Historic Park) is a steel cantilever bridge spanning the Hudson River between Poughkeepsie, New York on the east bank and Highland, New York on the west bank. Built as a double track railroad bridge, it was completed on January 1, 1889, and went out of service on May 8, 1974. It was opened to the public on October 3, 2009, as a pedestrian and cyclist bridge and New York State Park.
It was a nice walk - though a little breezy. Some photos are here (under 2011).

Climbing the Camel's Hump

2011-06-28T04:11:27+00:00

One week later and I'm back for another attempt at climbing up Camel Back, then up to Camel's Hump peak. This time the weather is absolutely perfect. A fine sunny day with barely any breeze. Getting up to the top of the Camel Back fire trail was relatively easy (probably because I did it last week and knew what I was getting into). From the 'Camel Back' orange sign you then follow a path up toward the summit. At one point I lost the path (it's not much of a path really) and I made an attempt at trying to climb up via the rocks. Well I probably climbed up about 30 or 40 feet then realised that there must be an easier path to the top. So, with cowardice being the safest approach I down climbed the rocks and wandered around the eastern side, eventually regaining the path. With maybe about 100 vertical feet to go I left behind my backpack and walking poles so I could concentrate on not taking a wrong step. Reaching the summit was a bit of an anticlimax - some stunning views being obscured by trees. There's a nice little cairn (see photos) and I dutifully added to it's size. Definitely worth the walk - will have to try it again in winter - though preferably on a sunny but still day. Photos are here (under 2011).

Barcoo's Barn

2011-06-27T00:54:23+00:00

We're heading up to Sydney - instead of taking the quickest route we've gone inland (to look at a Landy - as you do). We're staying overnight at a place called Barcoo's Barn which is at Perthville - a tiny little place outside of Bathurst. It's a lovely spot - great for the kids. The owners made us all feel most welcome - both kids wound up having a drive of a huge tractor and they took a pony for a spin around the paddock. For dinner we went to the local pub - 'The Bridge Hotel'. They've got a beer garden and an outside pool table. Definitely worth a stay if you are ever out out this way. Here are some photos (under 2011).

iTunes 10.5 beta 2 for Windows

2011-06-26T02:08:46+00:00

Apple have subtly neglected to link iTunes 10.5 beta 2 for Windows on the iOS 5 beta dev center page.

For the bleeding edge type who run iTunes on Windows, iTunes 10.5 beta 2 is found on the iCloud downloads page.

http://developer.apple.com/icloud/downloads/

geoffoc

2011-06-02T09:37:19+00:00

Recently a patch was dropped into the KVM community – adding support for the Intel SMEP cpu feature (if available on the CPU). I thought to myself, what the hell is SMEP?

According to the Intel Software Developers Manual it is “Supervisor-Mode Execution Prevention” – this sounds like a great thing as the kernel is prevented from executing ‘user data’ in kernel mode – ie. If there is an exploit that delivers a page of data and asks the kernel to execute it then this wont happen and a fault will be triggered. This sounds like a neat piece of work and as it’s all h/w based then there should be little overhead.

Like me, i’m guessing you’re wondering if your system has the SMEP cpu feature then this code will show you. Don’t be disappointed if your cpu doesn’t have it – it’s a very new feature and I can’t even find what cpu’s implement it.

Anyway, it’s a step in the right direction and that future direction will hopefully allow hypervisors to be that little bit more secure from un-trusted VM’s and provide a VM ‘shell’ environment that’s a little more secure for the VM’s. Unfortunately the way things currently stand the usefulness for KVM is unlikely to be immediately realised as intel engineers suggest enabling SMEP without a guest vm’s knowledge is likely to be ‘problematic’.

OpenSSL speed revisited

2011-05-17T06:03:05+00:00

I realised I never came back and reported the results of my OpenSSL "speed" testing after our 2096 got upgraded. For reference, here was the original chart, from when the system was sub-capacity:

… and the question was, does the CPACF run at the speed of the CP (i.e. it runs sub-capacity if the CP is sub-capacity) or does it run at full speed like an IFL, zIIP or zAAP. If the latter, the result after the upgrade should be the same as before — that would indicate the speed of crypto operations does not change with the CP capacity, and that CPACF is always full speed. If the former, we should see an improvement between pre- and post-upgrade, indicating that the speed of CPACF follows the speed of the CP.

Place your bets… Okay, no more bets… Here’s the chart:

The graph compares the results from the first chart in blue (when the machine was at capacity setting F01) with the full-speed (capacity setting Z01) results in red.

Okay, so did you get it right? If you know your z/Architecture you would have! As the name suggests, the Central Processor Assist for Cryptographic Function (or CPACF) is pretty-much an adjunct to each CP, just like any standard execution unit (like the floating point unit, say). It is not like the Crypto Express cards, which are actually an I/O device and totally separate from the CP. Because it is directly associated with each CP, for sub-capacity CPs its CPACF is bound to the speed of that CP.

If you look closer, further evidence that CPACF performance scales with capacity setting can be seen in the respective growth rates of each set of data points. To see this a little clearer (because I don’t know the right mathematical terms to describe the shape of the curve, so I’ll just show you) I drew a couple more graphs:

Looking at the left graph (which is the same as the bar graph above, just drawn in lines) you can see that in both the software and the CPACF case the lines for before and after the upgrade follow the same trend with respect to the block size. If these lines followed different trends — for example if the Z01 CPACF line was flat across the block size range instead of a gently falling slope like the F01 line — I’d suspect something else was affecting the result. Looked at a different way, the right-hand graph above shows the "times-X" improvement between software and CPACF. You can see that the performance multiplier (i.e. the relative performance improvement between software and hardware; CPACF speed is 16x software at 8192 byte blocks) was the same for each block size.

Now, just to confuse things… Although I’ve used OpenSSL on Linux as the testing platform for this experiment, most Linux customers will never see the effects I’ve demonstrated here. Why? Because Linux is usually run on IFLs, and the IFL always runs at full speed! Even if there are sub-capacity CPs installed in a machine with IFLs, the IFLs run at full speed and so to does the CPACF associated with the IFLs. I’ll say again: CPACF follows the speed of the associated CP, so if you’re running Linux on IFLs the CPACF on those IFLs will be full capacity just like the IFLs themselves. If you have sub-capacity CPs for z/OS workload on the same machine as IFLs, the CPACF on the CPs will appear slower than CPACF on the IFLs.

As far as the actual peak number is concerned, it looks like a big number! If I understand it right, 250MB/sec would be more than enough speed to have a server doing SSL/TLS traffic driving a Gigabit Ethernet at line speed (traffic over connected sessions, NOT the certificate exchange for connection establishment; the public key crypto for certificate verification takes more hardware than just CPACF, at least on the z9 anyway). And that’s just one CP! Enabling more CPs (or IFLs, of course) gives you that much more CPACF capacity again. Keep in mind that these results are using hardware that is two generations old — I would expect z10 and z196 hardware to get higher results on any of these tests. Regardless, these are not formal, official measurements and should not be treated as such — do NOT use any of these figures as input to system sizing estimates or other important business measurements! Always engage IBM to work with you for sizing or performance evaluations.

My local Borders is no more

2011-05-07T14:34:52+00:00

I had two book-related experiences today, one of which was obvious and prompted this post. The other I had almost forgotten about, but should not have. First, the one I forgot.

I went to the shopping centre today (Garden City, in Upper Mt Gravatt) with my seven-year-old son. On the way there we were discussing the various things we might do there, foremost among them was eating (he seems to be inordinately interested in food at the moment; I suspect a growth spurt). After finding somewhere to park and finding our way from the car to the shops, we resumed the where-will-we-go conversation. We decided that the main purpose of the shopping trip was to get something for Mummy for Mothers’ Day, but we did agree it was okay to do a little bit of looking at things for ourselves. I was explaining the concept of “window shopping” to him when he suddenly said “or we could go to the library.”

I managed to choke back my reflex response of “The LIBRARY?!?” and instead managed something a little more fatherly. “But Mummy has the library card, I don’t have one,” I had to say, thinking he wanted to borrow.

“That’s okay,” he said, “we can just go and look at the books and maybe read one and then we could have some lunch.”

Which is exactly what we did. My seven-year-old son took me to the library. We looked through the books, found one that he liked which he read aloud, and then left and had sushi for lunch. I was definitely proud but at the same time stunned that a visit to the library was as interesting a prospect as anything else the shopping centre had to offer — especially since the library is immediately next door to a Toys-R-Us!

So what has this to do with Borders?

I was a little disappointed, but not too surprised, when the local Borders franchise announced it had entered administration. All of the Australian Borders stores that have touched me in some way, including the Brisbane City and Mt Gravatt stores, are to be closed. The hammer is even going to fall on the Jam Factory store in South Yarra, the first Borders I ever set foot in (the novelty of visiting that store was part of what kept me entertained when I was working in Melbourne).

Shortly after we’d been to the library, had our lunch, and looked at a couple of other shops, my son and I went into the Borders — it, along with the other stores to be closed, are open while the administrators try to wring every last dollar out of them. There were people everywhere, picking over the remains of the stock. How ironic that the busiest many stores are is their last days of trade.

It was pretty depressing: many shelves were bare, even a couple of complete sections had been abandoned (and were being used as impromptu play areas by kids bored by their parents’ sudden interest in books). Because all the stock was 50% off, people seemed to be treating it as having 50% less value — books were being disdainfully rummaged through, in a similar way to how a pile of laundry gets treated when you’re looking for that one lost sock.

I looked at the remnants of the computer books area, and was quickly reminded why I haven’t bought a tech book from Borders for years. I saw an O’Reilly title, one which I wasn’t sure I had, and the price on it was almost $100. When I got home I checked and I did have it: bought via Amazon at a price, even including shipping (and an exchange rate at the time that was nowhere near as attractive as it is now), that was less than even the Borders administrators 50% discount would have yielded. Nevertheless, I did take a few books to the register — not technical books, rather some light stuff in the vein of Richard Hammond’s “As You Do”.

The final depressing twist came as we left the store. I got a partial smile from the cashier when I placed my purchases on the counter for payment, but by the time she’d handed the bag to me her look was more “enjoy your books and your discount, I’ll be jobless in a few days”.

From the safe and insular confines of a blog, it’s easy to rant about bookstores and big publishing companies that try to ignore the international market and continue pricing domestically as if the Internet doesn’t exist and it really does cost a fortune to ship books to a tiny place like Australia. It’s a different matter when that bookstore you used to love going to can’t afford to keep the lights on any more.

But then, as I was thinking of how to wrap this post, the thought occurred to me… what kind of place would be good for someone who likes looking at books but never buys them…

Sometimes when I’d go to Borders I’d get quietly mad at the people who’d sit themselves in the comfy chairs and read the books for hours and hours. What did they think Borders was… a library? It was a library — the problem was, in their kind of library you had to buy the books instead of borrowing them.

I’ve got a feeling that the initial success of Borders was driven by the same enthusiasm for libraries that my son showed me today. We all remembered this incredible place where there were thousands of books, and we could pick them up, turn their pages… and read a bit of them, then put them back. And to the eventual demise of Borders, that’s what we all did.

So to anyone thinking “now that Borders is going, I’ve got nowhere to read a good book” I say “find your local library!” And to any passing librarians I say “I hear there’s some books hitting the market cheap, might be a chance to build the collection because you never know when traffic might pick up”.

Why naming your servers properly is important to your startup

2011-04-16T04:18:57+00:00

Server hostnames are important and they should be carefully thought out before a startup builds out its infrastructure. At the very least they should be descriptive enough to allow a technical person to loosely identify the servers business purpose.

Let me describe how I setup puppet manifest with descriptive server hostnames.

Firstly, I’ll point out why its important you need to think about a server hostname standard. Later you’ll see how this pays off when it comes to Puppet, the automated system configuration tool developed by Puppetlabs.

Lets say a server with a hostname webserver.example.com hooks into example.com’s infrastructure.

The problem with using a simple and very much non-descriptive hostname such as webserver.example.com is that the hostname itself provides very little information on the server’s purpose. All we know is that its a webserver belonging to example.com.

Is it a development or production webserver?
Physically, where is this server located?
Is this the only webserver that belongs to example.com?

To resolve these issues, its important to provide descriptive hostnames to servers based on a meaningful namespace. By changing webserver.example.com to web01.prod.lon.uk.example.com we can immediately determine the following characteristics of the server and example.com’s infrastructure .

It is 1 of potentially many web servers.
It is a production web server.
The server is physically located in the United Kingdom.
More specifically it is located in London.
It can be assumed that this server has a corresponding DEV, UAT, SVP and DR server which shares a similiar name (example; web01.dev.lon.uk.example.com).

These points are important in the way we can now handle nodes within example.com’s infrastructure using puppet.

Puppet supports classes which can be included by nodes. A class contains puppet manifest which is used to describe how the server is to be configured. Nodes in puppet define which servers can connect to puppetmasterd and pull down the manifest.

Below are node definitions for 3 servers. See how easy it is to identify the function of each server when we use a structured hostname standard?

node /web01.prod.lon.uk.example.com/ {
    include node_prod
    include node_lon
}

node /web01.prod.bej.cn.example.com/  {
    include node_prod
    include node_bej
}

node /web01.dev.cn.sha.example.com/ {
    include node_dev
    include node_sha
}

By using ‘include node_prod’ web01.prod.lon.uk.example.com will include a class with a name of ‘node_prod’. Likewise for web01.prod.bej.cn.example.com. web01.dev.cn.sha.example.com will include the ‘node_dev’ class. All 3 nodes will also include the class which is named after the city they are located in.

Moving onto the root, prod and dev classes, I then begin to define system configuration that should be applied to all servers that belong to example.com and then by building an environment class such as ‘node_prod’ I can be more specific about which configuration is applied to what server based on where it sits within example.com’s infrastructure.

Below I’m defining a hosts entry for ‘prod-smtp-server’ for all servers that include the ‘node_prod’ class which sit in the production environment. For development servers which include the ‘node_dev’ class a host entry of ‘dev-smtp-server’ is applied.

class node_example_com {
    host { “example.com”: ip => ‘10.1.1.1’ }
}

class node_prod {
    include node_example_com
    host { “prod-smtp-server”: ip => ‘10.0.0.254’ }
}

class node_dev {
    include node_example_com
    host { “dev-smtp-server”: ip => ‘10.1.0.254’ }
}

I will then drill down to location starting at the country level. Below are the UK and China classes.

class node_uk {
    host { “uk-gateway”: ip => ‘10.10.10.1’ }
}

class node_cn {
    host { “cn-gateway”: ip => ‘10.20.20.20’ }
}

Once I have country level classes, I define city based location classes.

class node_lon {
    include node_uk
    host { “london-proxy”: ip => ‘10.10.10.254’ }
}

class node_bej {
    include node_cn
    host { “beijing-proxy”: ip => ‘10.20.20.254’ }
}

class node_sha {
    include node_cn
    host { “shanghai-proxy”: ip => ‘10.20.30.254’ }
}

Using the power of puppet, its classes and inheritance with a well thought out server hostname standard from the first day you roll out your startups infrastructure will provide you with much more manageable infrastructure for the future. This should be obvious to any startup who wants to achieve scale.

photography

2011-04-14T13:01:38+00:00

While I’ve had a significant interest in art since I was a kid I’ve started to focus again over the past year or so in the photography space and have started picking up various DSLR gear and trying out some really cool things.

I’ve had a lot of fun (re)learning things again and and especially enjoying macro photography at the moment.

I just tonight picked up a Canon 580EX II which I have some grand plans for. Initial tests have yielded some impressive results. I’ve still yet to get a couple of things such as diffusers, gel’s, reflectors and remote triggers before I can do what I had planned on but this is still a great start.

When I start putting together some more relatively acceptable shots I’ll be putting them up on my flickr account and probably linking some of my fav’s here.

chumby8

2011-04-14T12:39:36+00:00

Picked up one of the new Chumby 8′s the other day. I bought Sara her Chumby v1 a couple of years ago and she’s quite liked it and I’ve been pondering getting my own ever since. There’s been a few chumby‘s released in between which I haven’t really liked but the chumby8 looks pretty sexy, larger screen, more snappy interface etc. There’s a lot of seemingly cool apps, but most I found I’ll subscribe to but then remove shortly thereafter. After all, I really want it to be an alarm clock, wake me up with some music, but at the same time I can read stuff like hacker news and various social networking, flicker feeds etc.

Picnic at Tidbinbilla

2011-04-04T22:22:18+00:00

We had a picnic today at Tidbinbilla Nature Reserve. Parking at "Dalsetta" we walked up to Turkey Hill and had lunch in the shade - along with a load of Kangaroos. Afterward we went for a wander around the rocks. A nice way to spend the day. There are some photos in the '2010' gallery.

Daylight Savings will eat cron jobs

2011-04-03T13:00:34+00:00

Today at 3am Australian Eastern Daylight Time (AEDT), all my Australian servers kicked over to the Australian Eastern Standard Time (AEST) timezone.

I had a 2am cron job running on one of these servers. The result of having a cron job that is triggered at 2am on a server which sits in a timezone that supports Daylight Saving is that the cron job is ran twice when the timezone comes out of Daylight Saving.

When the server comes back into the Daylight Saving timezone the cron job would not of ran at all.

Luckily for me, this cron job isnt business critical and the fact that it ran twice had no serious impact to the operations of the business.

Lesson I learnt today. Do not schedule cron jobs at 2am.

image by pedromourapinheiro

Another IPv6 instalment (subtitled: Watch Your Tech Library Currency!)

2011-03-26T08:52:06+00:00

I made a somewhat cryptic tweet a little while ago about how I spent a crazy-long period of time researching what was, I believed, the next-big-thing in DNS resolution for IPv6 (or so my 2002 edition of “IPv6 Essentials” told me). I could not work out why I saw nothing about A6 records in any of the excellent Hurricane Electric IPv6 material or in any other documentation I came across.

The answer should have been obvious: DNS A6 records (and the corresponding DNAME records) never caught on. RFC 3363 recommended that the RFC that defined A6 and DNAME (RFC 2874) be moved back into Experimental status. If I hadn’t been using an old edition of the IPv6 book, I might never have even known the existence of A6 and not have wasted any time.

In my previous post on IPv6 I theorised that we are in the early-adoption phase of IPv6 where things aren’t quite baked, and yet now I’ve picked up a 9 year old text on the topic and acted all surprised when it got something wrong. It was a bit stupid of me; had I bought a book about IPv4 in 1976, might it have been similarly out of date in 1985?

As always though I’m richer for the experience! Or so I thought… Like many, I’m becoming increasingly time-poor. When I bought a book on IPv6 some years ago I thought I was making an investment, but it turned out that my investment actually lost for me in several ways:

The book took up physical space in my bookshelf for all that time I wasn’t using it
I didn’t actually use the information at the time I acquired it
The time I could have got value from it was wasted by it idly sitting on the shelf
Once I did try to use it, it actually cost me time rather than saved time

I came to think about the other books on my shelf. It’s pretty easy to recognise that a book that proclaims to be up-to-date because it “Now covers Red Hat 5.2!” will be anything but. Also, from the preface of a Perl programming book that says “this was written about Perl 5.8, but it should apply to 5.10 as well” I’ll be forewarned that things will be fairly applicable to 5.12 but maybe not to Perl 6 when it’s out.

Technology usually has a somewhat abbreviated lifespan, so therefore the corresponding documentation will have a lifespan correspondingly short… Here, however, is an example of a technology that will have a far greater lifespan (we hope) than much of the documentation that currently exists around it. I emphasise “currently exists”, because it won’t always be that way: IPv4 was pretty well-baked by the time I had anything to do with it, so I could have bought a book on IPv4 with next to no concern that it was going to lead me astray (indeed, I bought W. Rich Stevens’ TCP/IP programming texts during the 1990s, and still use them to this day). I keep forgetting that I’m on a completely different point of the IPv6 adoption curve, and the “experts” are learning along with me.

So, a new tech library plan then:

Reduce dependence on physical books (okay, this one is already a work-in-progress for me) — they don’t come with you on your travels as easily, and (more important in this context) they’re harder to keep up to date.
Before regarding the book on the shelf as authoritative, check its publication date. If it’s more than three years old, depending on the subject matter it might be out of date. Check if there’s a new edition available, and consider updating. If there’s no new edition, check for recent reviews (Amazon, etc). Someone who just bought it last month might have posted an opinion on its currency.
If you have to buy a paper book, don’t buy a book on any technology that is a moving target. On the same shelf as my copy of “IPv6 Essentials” there is a book entitled “Practical VoIP Using VOCAL”. I never even installed VOCAL, and I’m sure many current VoIP practitioners never heard of it. (Side note: I think it’s strange that I bought that book, and a Cisco one, but still to this day have never owned a book on Asterisk. Maybe I have some kind of inability to pick the right nascent-technology book to buy.)
Use bookmarking technology more! I have a Delicious account, and I went through a phase of bookmarking everything there. I realise now that, if I was a bit more disciplined, I could actually use it (or a system like it, depending on what Yahoo! does to it) as my own personal index to the biggest tech library in existence: the Internet.

That first point is harder than it sounds (especially for someone like me who has a couple of books on his shelf with his name on the cover). My Rich Stevens books are littered with sticky-note bookmarks for when I flick to-and-fro between different programming examples. Electronic readers are still not there when it comes to the “handy-hints-I-keep-on-my-lap-while-coding” aspect of book ownership.

I have a Sony Reader which I purchased with the intent of making it my mobile tech library. It’s just not that great for tech documents though, since it doesn’t render diagrams and illustrations well (it also isn’t ideal for PDFs, especially in A4 ratio). This may change as publishers of tech docs start releasing more titles on e-reader formats like ePub. The iPad is working much better for tech library tasks; I’m using an app called GoodReader which renders PDFs (especially RedBooks!) quite well and has good browsing and syncing capability as well.

Yet more updates/testing

2011-03-16T01:17:29+00:00

Reading back over my previous rant about the Blackberry is now amusing – both of us are now happy iPhone consumers and are deeply meshed into the whole Apple/Mac/IPhone ecosystem.

My personal machine is a three year old MacBook Pro, still working perfectly. The SO is using an airbook and refuses to go anywhere near windows ever again. Our music comes from iTunes (although I do buy from Amazon/kindle – not iBooks).

Having a smartphone makes things like public transport and odd moments waiting around both productive or not – your choice. Read a book? Between Stanza and Kindle software, I have more reading matter than I know what to do with. Podcasts? Lots and varied.

The only thing I can’t quite understand ( for my use case anyway) is an iPad. A lot of people, yes but with ok eyes and a fondness for small fonts, I have no requirement for one yet (perhaps for a long while).

Updates and such

2011-03-16T00:58:20+00:00

A long long (but perfectly normal for me) time since the last time I updated this but a lot has changed.

New house, new career, new company, new toys – you could almost call it a new life (and probably should).

This is a more of a test post to make sure the upgrades have worked and while I think of what direction I can be interested in taking this.

Toys maybe? Mac stuff? Linux stuff? Networking?

World of Warcraft?

Boboyan Trig hike

2011-03-08T03:27:04+00:00

Today David and I went for a walk up to Boboyan Trig in Namadgi National Park. It's a great walk - along what's called the Yerrabi Walking Track. You go through a small forest of peppermint trees (no, I didn't lick them). Then through a swampy grassland (this is starting to sound like a Dora the Explorer episode), then across a Mountain Gum/Snow Gum forest. Finally you pop out of the forest, climb the track for about another 5 minutes or so and you're then at the Boboyan Trig point. There are fantastic views out to the west - across to Mt Scabby, Mt Gudgenby and lots of other peaks. At the far end of the track there are some great rock formations. Just don't trip - it's a long way down. It probably took about 1 hour to 1 hour 15 mins or thereabouts to do the walk. Well worth it for the varied terrain, only a gentle climb and absolutely stunning views. Me and Dave had a great time. We'll have to do it again in Winter - I bet there will be some snow on those peaks on a good day. As usual photos are available in the gallery (under 2010).

Another round of Gentoo fun

2011-03-05T06:47:05+00:00

A little while back I did an “emerge system” on my VPS and didn’t think much more about it. First time back to the box today to emerge something else, and was greeted with this:

>>> Unpacking source…
>>> Unpacking traceroute-2.0.15.tar.gz to /var/tmp/portage/net-analyzer/traceroute-2.0.15/work
touch: setting times of `/var/tmp/portage/net-analyzer/traceroute-2.0.15/.unpacked’: No such file or directory

…and the emerge error output. Took me a little while to get the answer, but it was (of course) caused by a new version of something that came in with the system update. This bug comment had the crude hack I needed to get back working again, but longer-term I obviously need to fix the mismatch between the version of linux-headers and the kernel version my VPS is using (it’s Xen on RHEL5).

Steam Train to Bungendore

2011-03-03T03:52:36+00:00

We saw an advert in the local paper for a Steam Train ride to Bungendore (a small village about 40KM to the east of Canberra). Santa was going to be on board so naturally we were interested! Nice ride out, passing through a gorge complete with raging river - best rains this area has had in years. We had lunch at the local footie oval, then went for a wander around town (doesn't take long). The ride back was nice too - exactly the same but in reverse... the tunnel was good - amazing how black things are in a tunnel. Profound. A nice way to spend a Sunday. Photos in the gallery (under 2010).

Mount Taylor hike

2011-03-02T06:01:37+00:00

Dad and Dave went for a hike up Mount Taylor (from the Pearce side) while the girls went shopping (for food, nothing exciting). The rain held off for the climb up and down, but for the walk back to the car (we were being picked up) we got soaked! Photos here.

Climbing Mount Tennent

2011-03-02T01:46:21+00:00

The other week I climbed Mount Tennent in the A.C.T. It's been something I've been meaning to do now for almost twenty years. Why haven't I done it sooner? It was a great walk (just me) - starting out from the Namdagi National Park visitor's centre car park (well, the outside of it - the gates were locked) around 06:30 in the morning. It was fairly cool so I wore a light jacket. That didn't last long - I was sweating like a pig in no time. The walk is about 15 km in distance. The summit of Mt Tennent is 4511 feet AMSL. I'm guessing the car park was at around 2000 feet - so that's a 2500 foot climb. I'm definitely out of shape - to start off with I wasn't sure I could make it to the top - so I just plodded along - stopping every now and then to catch my breath (I think I've got crap lung function - had no problems with the legs, just breathing - am I allowed to blame passive smoking as a child?). I finally made it to the top around 09:30 - had a snack and a wander around the summit. The fire tower was closed - pity, as it would have been a great view from the very top. Spotting someone's cigarette butt right next to the fire tower was a bit ironic. Fantastic weather, if a little hazy. Very warm down below but up on the summit it was actually a little cool - particularly after stopping. The walk back down was a little quicker. In total it took me about 5.5 hours including all those stops - so not too bad in the scheme of things - it was a bloody big hill for someone as unfit as me. I took the tiny panasonic camera with me (weight saving) - so the photos aren't really that good - but they give you an idea anyway. They can be seen under '2010' HERE.

IPv6: SSDM?

2011-02-27T14:58:31+00:00

Two of the four keynotes at LCA 2011 referenced the depletion of the IPv4 address space (and I reckon if I looked back through the other two I could find some reference in them as well). I think there’s a good chance Geoff Huston was lobbying his APNIC colleagues to lodge the “final request” (for the two /8s that triggered the final allocation of the remaining 5, officially exhausting IANA) a week earlier than they did, as it would have made the message of his LCA keynote a bit stronger. Not that it was a soft message: we went from Vint Cerf the day before, who said “I’m the guy who said that a 32-bit address would be enough, so, sorry ’bout that”, to Geoff Huston saying “Vint Cerf is a professional optimist. I’m not.”. But I digress…

I did a bit of playing with IPv6 over the years, but it was too early and too broken when I did (by “too broken” I refer to the immaturity of dual-stack implementations and the lack of anything actually reachable on the IPv6 net). However, with the bell of IPv4 exhaustion tolling, I had another go.

Freenet6, who now goes alternatively as gogonet or gogo6, was my first point-of-call. I had looked at Gogo6 most recently, and still had an account. It was just a matter of deciding whether or not I needed to make a new account (hint: I did) and reconfiguring the gw6c process on my router box. Easy-as, I had a tunnel — better still, my IPv6-capable systems on the LAN also had connectivity thanks to radvd. From Firefox (and Safari, and Chrome) on the Mac I could score both 10/10 scores on http://test-ipv6.com!

My joy was short-lived, however. gw6c was proving to be about as stable as a one-legged tripod, and not only that Gogo6 had changed the address range they allocated me. That wouldn’t be too bad, except that all my IPv6-capable systems still had the old address and were trying to use that — looks like IPv6 auto-configuration doesn’t un-configure an address that’s no longer valid (at least by default). I started to look for possible alternatives.

Like many who’ve looked at IPv6 I had come across Hurricane Electric — in the countdown to IPv4 exhaustion I used their iOS app “ByeBye v4″. They offer free v6-over-v4 tunneling, and the configuration in Gentoo is very simple. I also get a static allocation of an IPv6 address range that I can see in the web interface. The only downside I can see is that I had to nominate which of their locations I wanted to terminate my tunnel; they have no presence in Australia, the geographically-nearest location being Singapore. I went for Los Angeles, thinking that would probably be closest network-wise. The performance has been quite good, and it has been quite reliable (although I do need to set up some kind of monitoring over the link, since everything that can talk IPv6 is now doing so).

In typical style, after I’d set up a stable tunnel and got everything working, I decided to learn more about what I’d done. What is IPv6 anyways? Is there substance to the anecdotes flying around that are saying that “every blade of grass on the planet can have an IPv6 address” and similar? Well, a 128-bit address provides for an enormous range of addresses. The ZFS guys are on the same track — ZFS uses 128-bit counters for blocks and inodes, and there have been ridiculous statements made about how much data could theoretically be stored in a filesystem that uses 128-bit block counters. To quote the Hitchhiker’s Guide to the Galaxy:

Space is big. Really big. You just won’t believe how vastly, hugely, mind-bogglingly big it is. I mean, you may think it’s a long way down the road to the chemist’s, but that’s just peanuts to space.

The Guide, The Hitchhiker’s Guide To The Galaxy, Douglas Adams, Pan Books 1979

Substitute IPv6 (or ZFS) for space. To try and put into context just how big the IPv6 address range is, let’s use an example: the smallest common subnetwork.

When IPv4 was first developed, there were three address classes, named, somewhat unimaginatively, A B and C. Class A was all the networks from 1.x.x.x to 127.x.x.x, and each had about 16 million addresses. Class B was all the networks from 128.0.x.x to 191.255.x.x, each network with 65 534 usable addresses. Class C went from 192.0.0.x to 223.255.255.x, and each had 254 usable addresses. Other areas, such as 0.x.x.x and the networks after 224.x.x.x, have been reserved. So, in the early days, the smallest network of hosts you could have was a network of 254 hosts. After a while IP introduced something called Classless Inter-Domain Routing (CIDR) which meant that the fixed boundaries of the classes were eliminated and it became possible to “subnet” or “supernet” networks — divide or combine the networks to make networks that were just the right size for the number of hosts in the network (and, with careful planning, could be grown or shrunk as plans changed). With CIDR, since the size of the network was now variable, addresses had to be written with the subnet mask — a format known as “CIDR notation” came into use, where an address would have the number of bits written after the address like this: 192.168.1.42/24.

Fast-forward to today, with IPv6… IPv4′s CIDR notation is used in IPv6 (mostly because the masks are so huge). In IPv6, the smallest network that can be allocated is what is called a “/64″. This means that out of the total 128-bit address range, 64 bits represent what network the address belongs to. Let’s think about that for a second. There are 32 bits in an IPv4 address — that means that the entire IPv4 Internet would fit in an IPv6 network with a /96 mask (128-32=96). But the default smallest IPv6 subnet is /64 — the size of the existing IPv4 Internet squared!

Wait a second though, it gets better… When I got my account with Gogo6, they offered me up to a /56 mask — that’s a range that covers 256 /64s, or 256 Internet-squareds! Better still, the Hurricane Electric tunnel-broker account gave me one /64 and one /48! Sixty-five thousand networks, each the size of the IPv4 Internet squared! And how much did I pay for any of these allocations? Nothing!

I can’t help but think that folks are repeating similar mistakes from the early days of IPv4. A seemingly limitless address range (Vint said that 32 bits would be enough, right?) was given away in vast chunks. In the early days of IPv4 we had networks with two or three hosts on them using up a Class C because of the limitations of addressing — in IPv6 we have LANs of maybe no more than a hundred or so machines taking up an entire /64 because of the way we designed auto-configuration. IPv6 implementations now will be characterised not by how well their dual-stack implementations work, or how much more secure transactions have become thanks to the elimination of NAT, but by how much of the addressable range they are wasting. So, is IPv6 just Same Sh*t, Different Millennium?

Like the early days of IPv4 though, things will surely change as IPv6 matures. I guess I’m just hoping that the folks in charge are thinking about it, and not just high on the amount of space they have to play with now. Because one day all those blades of grass will want their IP addresses, and the Internet had better be ready.

Update 16 May 2011: I just listened to Episode 297 of the Security Now program… Steve Gibson relates some of his experience getting IPv6 allocation from his upstream providers (he says he got a /48). In describing how much address space that is, he made the same point (about the “wasteful” allocation of IPv6). At about 44:51, he starts talking about the current “sky is falling” attitude regarding IPv4, and states “you’d think, maybe they’d learn the lesson, and be a little more parsimonious with these IPs…”. He goes on to give the impression that the 128-bit range of IPv6 is so big that there’s just no need to worry about it. I hope you’re right, Steve!

Burnt out

2011-02-27T12:40:57+00:00

For some time I’ve been feeling moody and generally unhappy. My ability to become frustrated with things that go wrong is ever-increasing, and my tolerance fuse seems to be ever-shortening. Co-incident with those feelings was the real physical manifestation of almost constant weariness — waking up tired, never-ending back and shoulder pain, and so on. I really was starting to feel like the proverbial “cranky old man”.

The worst part of this was the fact that the feelings have worsened after I had made what I thought was positive changes in my outlook. I’ve been more focused on exercise and physical activity, and trying really hard to spend more time with the family.

On the bus on the way home from work on Friday I was looking out the window and thinking about… nothing. I closed my eyes for a moment, and the feeling of relaxation I had — for just a moment — was blissful. At that point I realised that my problem was probably little more than the fact that I am completely and utterly burnt-out.

I began to think about the times recently that I’ve been away from work. We went to the beach for a couple of days in January, but as every parent knows a family holiday (particularly with young kids) is just all the same stuff with some different scenery. Last September we went to Melbourne, but I was working. A few days here and there for trips to the beach and so on. In November 2009 I did my European trip, which is probably the closest thing to a vacation I’ve had in the last two years, but again I was working.

I realised, again like just about every parent does, that I haven’t had a proper “holiday” since before our first child arrived — for me that means 2003 (I’m guessing it was when S and I went to Rotorua while I was working in NZ, but again that was only a couple of days).

So what’s my plan? After all, a realisation is worthless unless it is acted upon. Well I do have a holiday in mind, but that won’t be until toward the end of the year (and I’ve probably given away too much already). In the meantime, I plan to keep up the physical activity (maintaining health in the long term is surely more important than giving in to a bit of moodiness) and will be doing my best to find enjoyment wherever it exists or how trivial it may seem. I think I’ll also get back into the blogging habit — I find that the time it takes to put a good post together is quite therapeutic!

Backlit Lime

2011-02-21T09:49:02+00:00

Backlit Lime, originally uploaded by antonw.

Got a Canon 60mm Macro lens today and have been stuffing around with it. I set up this shot just on the dining room table, lights off and backlit a thin slice of lime with an LED flashlight.

geoffoc

2011-02-20T07:31:35+00:00

I’m trying to keep my home lab pretty automated. One of the things i’m always (well occasionally )trying out is new vCenter installs. In order to speed things up I have the following little powershell script to remove the vCenter Server application and the vCenter Client prior to automatically re-installing them.

This script below uses defaults for the install. It’s possible to completely script the install which is useful if you have a corporate standard configuration. All the details can be found here.

Anyway, here is the script – i’ve called it the totally imaginative name of resetvc.ps1 – don’t run it in your production environment unless you know what you’re doing
(get-wmiobject -computername . -class Win32_Product -Filter "NAME='VMware vCenter Server'" ).Uninstall() (get-wmiobject -computername . -class Win32_Product -Filter "NAME='VMware vSphere Client 4.1'" ).Uninstall() start-process -wait -filepath z:\vpx\VMware-vcserver.exe -argumentlist '/q /s /w /L1033 /v" /qr DB_SERVER_TYPE=Bundled FORMAT_DB=1"' start-process -wait -filepath z:\vpx\VMware-viclient.exe -argumentlist '/q /s /w /L1033 /v" /qr INSTALL_VIUPDATE=1"'

Notes: First 2 lines uninstall the vCenter Server and the vSphere Client – just ignore the error messages if this is the first time you’ve installed the vCenter Server etc. The third line installs the vcenter server from the iso which for me is my z:. Lucky last, the vSphere Client is installed – including in this case the Host Update utility.