League of Professional System Administrators blogs

Cisco Call Manager configuration

vitroth — Mon, 01 Mar 2010 21:17:30 -0800

Anyone who has ever administered a Cisco Unified Communications Manager (AKA Call Manager, or CM) system learns very quickly that there are approximately 17 billion different configuration settings in CM. All of those configuration dials have to be maintained in the right ways to get the system to do what you want.

I've taken several Cisco training courses on CM, and I felt like the thing that was missing was a real-world case study of how you setup all the pieces to interact with each other and why. There was no real "best practices" in the classes, just a lot of "this setting does X or Y" without any explanation of why you would choose to do X vs Y.

Read on for exactly that information from documentation I've been working on for the CM environment at my job.

First thoughts on bcfg2

jlothian — Sun, 28 Feb 2010 16:26:31 -0800

In my last post I mentioned starting a quick eval of the existing config management tools. I ended up with bcfg2,so I got to spend some time Friday starting to look at it. Armed with the SAGE short topics book and the online docs, I managed to get it installed and doing some stuff. These are just my initial observations based on a couple of hours poking around.

What I like

Everything seems to get logged to syslog (or at least a large amount of stuff)

bcfg2 has some neat ideas compared to its contemporaries. For example, it looks like you can pull the version of a config file off a managed machine and into your config management repository. Still have yet to get this working though ...

Aleksey at SCALE 8x

Aleksey Tsalolikhin — Sat, 20 Feb 2010 06:58:34 -0800

Going to SCALE 8x today - I'll be in the LOPSA booth, PostgreSQL booth and doing FOSS tours. Do I know how to overcommit or what?

Slides for SCaLE 8x

stpierre — Fri, 19 Feb 2010 08:59:32 -0800

I'm teaching on LDAP at SCaLE U today, so I've uploaded my slides in advance.

Evaluating New Config Management Systems

jlothian — Wed, 17 Feb 2010 17:44:45 -0800

At $WORK, we currently use cfengine 2 to manage on the order of 300 systems. It works, it does most things we want. We use the Singlecopy Nirvana "pattern" to distribute configuration files of all types, have copious shellcommands, and even a few editfiles. In general, it does what I need, but not necessarily the way I want. The general structure of our cfengine configurations is (for the most part) unchanged since I implemented it ~4 years ago. We've done the necessary things to support new OS's, new architectures, what have you, but that's about it.

Preventing rsync from picking up rsync temp files.

Aleksey Tsalolikhin — Wed, 17 Feb 2010 14:06:53 -0800

If you have multiple vias in your rsync path (e.g. a -> b -> c) you
can use an rsync filter rule to tell rsync: don't transfer files that
have . in the beginning of the filename!

--filter '- .*'

This way you won't have rsync temp files (named something like
.filename.xxyyzz) from the a -> b transfer ending up on c.

Why we still need old-fashioned backups: A cautionary tale

trey — Wed, 03 Feb 2010 06:45:38 -0800

“Backups are becoming less and less necessary these days”, I'm told. High availability, cheap disk mirroring and snapshots, cloud storage, data syncing between services—all these factors make old-fashioned backups—the offline, offsite, multi-tier kind, probably to tape, an expensive and cumbersome luxury that is neither affordable nor needed today.

I just got bitten, hard, by the results of that sort of thinking. I think a cautionary tale is in order to remind you of why, exactly, mirroring technologies (of which syncing, cloud storage, etc.

LISA '10 Call for Participation

wnl — Fri, 15 Jan 2010 11:25:54 -0800

The Call for Participation for LISA '10 has just been published. If you have not attended a LISA conference before, then this would be a great year to start. Even if you don't plan on submitting a paper or a talk proposal, reading the Call for Participation is a great way to understand how the conference works.

There is going to be a new section this year, called "Practice and Experience". It will feature 20 minute talks where people can explain a "substantial system administration project that has been completed." It should be a great way to learn from other people's successes and failures. These talks do not require full papers, but will still be reviewed and chosen by the program committee.

Learning just isn't what it used to be

caseybea — Fri, 15 Jan 2010 06:59:51 -0800

Like probably almost anyone reading this blog, I'm a sysadmin. Specifically, I consider myself to be a pretty darned good one - years of experience, blah blah blah. One of the personality traits a "good sysadmin" has, is the drive and ability to learn new things. COMPLICATED things. No fear. Try out installing and setting up high-availability linux clusters without ever having done it before, try implementing SSL in apache, etc-- you just roll up your sleeves and go. You'll stumble, but you'll LEARN. And you become a rockin' sysadmin in the end because of it.

Lately, I have been wrestling with being able to do that any more. Specifically, the office in which I work has been reclassified as a "service center" of sorts. We have tons of campus customers, and we now charge back for our time. Which means *I* have to charge back for my time. It's a result of the current economic situation, everyone needs to do what they can to survive.

Uma Thurman

caseybea — Fri, 08 Jan 2010 14:51:19 -0800

OK, not related to work, but worthy of a blog entry at least.

The other day I dove into VOIP for the first time. I admit, I'm a bit of a holdout with regards to my home phone service. I'm also old enough to recall the days when the phone in our house plugged into the wall with that huge 4-prong plug, and Ma Bell engineer(s) needed to do ANYTHING with regards to phone jacks or phones. If you so much as clipped a wire, out came the Bell-Police :-) Getting to the point of cutting my AT&T service is emotionally difficult. I've ALWAYS had AT&T.

Anyway, I finally decided to switch to VoIP and cut my land line. I'm not there yet, as I'm currently testing out the device first. I opted for an "ooma", which is essentially a product that's "VoIP in a box". You pay for the unit (about $200 US), and that's it. Everything else is free for as long as you own the unit. No monthly charges, no fees, no regulatory charges, nothing. Free local calls, free long distance. And they support porting your land-line number to the device when you're ready ($40 fee).

Yay! My Cfengine 3 post is out on the SysAdvent Calendar.

Aleksey Tsalolikhin — Thu, 24 Dec 2009 08:40:06 -0800

http://sysadvent.blogspot.com/

Just submitted an article on Cfengine 3 to the Sys Advent Calendar blog

Aleksey Tsalolikhin — Fri, 18 Dec 2009 20:26:56 -0800

Just submitted an article on Cfengine 3 to http://sysadvent.blogspot.com/ - I guess it'll be a few days before it's posted.

When all else fails, the Hail Mary pass can sometimes actually WORK....

caseybea — Tue, 15 Dec 2009 13:43:21 -0800

Like many of you, I like to have some of the latest technology at my fingertips. Specifically, I'm talking about my workstation. No, while I don't have über-fast sexy hardware, I like to at least have the latest OS flavor(s) installed so I can play with new features.

The other day I decided it was "time" for Fedora 12. Time to play with ext4.

Before I begin, a small word about my prior setup:

disk 1: Windows XP, NTFS partition. Old, crusty, not used anymore, as I have XP in a VM now.
disk 2: Fedora 11, Linux LVM partition. No real data of value, but it does house my XP vm.

Small PF revelation

tdelporto — Tue, 15 Dec 2009 11:08:22 -0800

I use OpenBSD's packet filter, PF, and am in the middle of building a new router/firewall with a moderately complex ruleset. I generally code rulesets the same way I write shell scripts: adding small bits and testing. My basic ruleset was preventing routing, and the logs kept telling me that the routing packets were being blocked by a rule that I thought shouldn't.

PF has a feature called "antispoof" that builds a set of rules that block packets that claim to originate from interfaces they shouldn't. The rule looks something like:

@16 block drop in log on ! vlan1 inet from 192.0.2.0/24 to any [ Evaluations: 9907 Packets: 9283 Bytes: 794994 States: 0 ] [ Inserted: uid 0 pid 2131 ]

When is a directory not a directory?

caseybea — Thu, 10 Dec 2009 13:22:45 -0800

I love it. Just when I start getting a little bored..., something comes along that basically makes me go, "WTF?" - and ends up giving me a chuckle in the end. There's stuff that's broken, and then there's stuff that's REALLY broken....

Very recently, we've been tasked with helping migrate key components of an old server that belonged to another department. We're going to migrate the important stuff to a new server of ours,and retire the rest. A lot of this has been my task, but it also involves our DBA and a handful of developers taking a little time on the side to hunt and migrate.