Old computer rocks

Since my home workhorse desktop computer motherboard (FIC AU13) died after serving me well through the last 5 years, I scavenged my IT trashcan and came up with an even older setup:

CPU: Ahthlon XP 1800+ (133MHz x 11.5)
Motherboard: ECS K7S5A 1.0
Memery: Samsung 512MB DDR266 x2
Graphic: ATI Radeon 7000
Sound Card: Creative Sound Blaster Live! Digital + Creative Sound Blaster PCI (1373)
Network Card: 3Com 905T
TV Tuner Card: Leadtek TV 2000 Expert
USB Card: Via 4

So you can see my motherboard expansion slots are full. And everything works very well now. Here are the catches and the reasons I used add-on cards instead of using on-board ones.

Sound Card

My K7S5A's on-board sound card is SiS7012. There is no sound driver provided on ECS's Web site under K7S5A. I downloaded the driver under other motherboards from ECS Web site. It works, but the CPU load is so high that video playback suffers. Creative Sound Blaster Live! Digital has good audio processing unit, off load the job from CPU. I added a second sound card for Skype only with a headset plugged in all the time. SiS7012 could work for Skype if its output is not so weak, causing the voice in headphone very low.

Network Card

For some reason, the MAC address of my on-board SiS900 NIC of K7S5A is 000000000 (yes, all zeros). And I want to off-load as much as possible work from CPU, an old 3COM 905T does a great job.

USB Card

K7S5A only has 2 USB 1.1 ports. No USB 2.0 support.

Graphic Card

ATI Radeon 7000 is indeed very old. Since I am not a 3D gaming fan, it is fine for most of jobs, except high definition video. I found out the DVD decoding part of Radeon 7000 is not full-blown as Radeon 9500 and higher. It still need quite some CPU to render. For VMR7 rendering, it has limited hardware support. For VMR9 rendering, no hardware support at all. The result is VMR7 (DirectX7) look OK although CPU load is high, but for VMR9 (DirectX9), stair-shaped refreshing is noticeable and CPU load is full.

Easy way to download all your blogs here.

It is simply show all posts in one big page and download it.

http://googlesystem.blogspot.com/2007/02/how-to-backup-blogger-blog.html

MS Exchange Web site

A very helpful resource Web site on for MS Exchange administrators.

http://www.msexchange.org/

This post has nice tools for reseting local admin password on Windows

http://social.answers.microsoft.com/Forums/en-US/vistasecurity/thread/b97bf8c0-78d4-41ad-83b4-338339e7636a

Propagate Permissions in Exchange Public Folders

Setting public folder permissions in Exchange is counter-intuitive. Anyway, this is how:

http://searchexchange.techtarget.com/news/article/0,289142,sid43_gci1172543,00.html

However, I think the Add User option in the Manage Public Folder Settings Wizard is more useful because we usually simply add users instead of replace them.

Here is the original text:

In most Microsoft products, when you set permissions on a folder, child objects inherit the permissions you set on the parent object. Exchange Server public folders don't work that way though.

If you look at the permissions assigned to the Forms and Policies folders, you will see that they still have default permissions -- even though we modified permissions on the parent folder. If we were to create a new subfolder beneath the Everyone folder, it would inherit the new permissions we applied to the Everyone folder -- but existing folders do not automatically inherit permission changes to parent folders.

In our sample Exchange Server public folder structure, there are only two subfolders beneath the Everyone folder. So it isn't a big deal to manually change their permissions to match the parent public folder permissions.

But what if there were two thousand subfolders? You wouldn't want to have to manually change the permissions on all of them. Fortunately, there is a way to force the permissions of a parent public folder to propagate to child public folders.

1. To force subfolders to inherit a parent public folder's permissions, right click on the parent public folder and select the All Tasks -> Manage Settings to launch the Manage Public Folder Settings Wizard. (Prior to Exchange 2003 Service Pack 2, there was a Propagate Settings command accessible from the All Tasks menu, but Microsoft replaced it with the Manage Settings command to avoid confusion.)

2. Click Next to bypass the wizard's Welcome screen.

3. Select the Overwrite Settings option and click Next.

4. You will now see a screen that asks you which settings you want to overwrite. Choose the Folder Rights option and click Next, followed by Finish.

The permissions on the Exchange Server public folder subfolders will now be replaced.

Raw Disk Mapping of Local Storage on ESXi

ESXi does not officially support Raw Disk Mapping of local storage devices. It means if you attach a SCSI array box to ESXi host, you are not able to use it as a physical disk in VM because the Raw Disk Mapping option is greyed out. Here is the workaround.

The workaround is to create a RDM virtual disk file inside mounted vmfs. Then add this virtual disk file to a VM.

The VM's system partition should be on vmfs, use RDM disk for data storage only.

After creating the VM in the conventional way with one virtual disk on vmfs, in SSH session or console, type this command:

vmkfstools -r /vmfs/devices/disks/vmhba2:1:0:0 /vmfs/volumes/datastore1/testvm

Substitute vmhba2:1:0:0 with your actual physical disk path. You can find the path in Storage Adapters. Click on the SCSI adapter, in Details frame, SCSI Target should list all the paths. The path list here omits multiple 0, so if you see vmhba2:1:0, the actual path that the command will take is vmhba2:1:0:0.

The rdm virtual disk file should be created in vmfs folder of the VM.

Finally, the physical local disk to map must not be added as storage device. In other words, you should not see it in Storage, only present in Storage Adapters.

If this command is successful, add a new hard disk to VM, choose Existing virtual disk, then browse to the rdm1.vmdk file just created.

Select Independent Mode - Persistent when prompted.

NFS for Windows write speed fix

Windows Services for Unix provides a NFS server. The writing speed to NFS export may be slow. Set this registry key to 1 to speed it up. Otherwise, the software and hardware cache may not work well with NFS.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NfsSvr\Parameters\UseWriteCache

VMware vSphere 4.0 Quick Start

Played with VMware vSphere 4 for a couple of days. Here is briefly what I found. It could you save some time putting together a similar rig just to test out.

You need at least two physical hosts running ESXi 4 or ESX 4. I used to two Dell Optiplex 755 desktop boxes to run ESXi 4. Optiplex 755 does not run ESXi 3.5 without adding a new NIC, but works fine with ESXi 4. Just remember to switch the SATA mode to ATA in BIOS which is not by default.

The management part of vSphere is vCenter, which is a pack of applications running on top of a beefy Windows environment. VMware recommends dual core CPU with 2 to 4 GB of memory, and preferably x64. This is true because vCenter uses Tomcat and Java extensively. A VM running on a standalone ESXi will be fine however you need to provide separate high availability to this critical system since if it down, the ESXi/ESX boxes running will all be alone without any vSphere management.

You will also need a storage server to host VM files. I used an old Pentium 4 box with 1G of RAM to run Openfiler to serve as an iSCSI target. VMotion and VMware HA are only available when VM files sit on backend storage server.

With all boxes setup, you can try out VMotion and VMware HA features. Here is the catch:
• The two ESXi/ESX boxes better to have same CPU and memory for these two features to run. VMotion is more tolerant, while HA is not. However, my VMotion and HA runs with one Quad-core Q6600 plus one Dual-core E6550, but not that Q6600 plus a faster Quad-core Q9550.
• Make sure DNS servers are properly set up for HA to run.

VMotion can be done from one datastore to another on the same host, but not across hosts. If two hosts share the same backend storage, VMotion can go across hosts.

The so called storage VMotion is simply VMotion across datastores. Nothing special.

VMware HA only provided HA to VM frontend. If the backend storage NAS goes down, all is down. VMware provide vStorage API to help integrating with storage system replication/copy. So to achieve true HA, you need much more than VMware HA.

VMSafe is also kind of API thing to help third-party security appliance to monitor the virtual-switched network.

DRS is for load-balancing and redistribution. Not a very useful feature to small to medium enterprises.

Data Recovery is pretty useful if you need high level of HA, but it requires two physical sites connected by WAN to run.

Customizable Windows XP GUI Live CD

While trying to update BIOS of a Dell server with no OS, I found this nice tool.

Hiren's boot CD.

Besides tons of useful tools it already includes, it also provides scripts to let you rebuild the ISO to include your own stuff.

Backup EXEC Remote Agent Behind Firewall

When Backup EXEC Remote Agent is separated from Backup EXEC Server with firewall, check out this documentation for ports to be open:
http://seer.entsupport.symantec.com/docs/285830.htm

After that, do a Remote Agent push install from Backup EXEC Server. This will get the Agent to work.

Tomato Firmware on Dell TrueMobile router

After frustrating experience with OpenWRT and DD-WRT, I eventually flashed Tomato firmware into my Dell TrueMobile wireless router. Need a bit settings to get some lights on, but even without additional settings, it works great! Best of all, QoS worked perfect. Now I can make VoIP phone calls, Web browsing, P2P download and streaming at the same time, and everyone is happy.

Tomato firmware does not officially support Dell TrueMobile 2300, but it works well.

DNS Secondary Server using CentOS

Install DNS server Bind:

yum install bind

Create named.conf in /var/named/chroot/etc, using domain accountingshow.com on primary dns server 199.199.133.99 for example. Secondary DNS server IP is 199.199.133.97

// Red Hat BIND Configuration Tool
// Default initial "Caching Only" name server configuration

options { directory "/var/named";
  allow-notify {199.199.133.97;};
  recursion no;
};

zone "accountingshow.com" IN {
type slave;
file "slaves/mydomain.com.dns";
masters { 199.199.133.99 port 53;};
};
check-names ignore;

zone "133.246.199.in-addr.arpa" IN {
type slave;
file "slaves/133.199.199.in-addr.arpa.dns";
masters { 199.199.133.99
port 53;};
check-names ignore;
};


include "/etc/rndc.key";

Reload the configuration file:

rndc reload

The log is at /var/log/messages. Use this command to trace the
action:

tail -f /var/log/messages

Malware removal

This tool helped me removing a fake Anti-spyware malware redirect browser clicks.

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Before running the tool, rename it to an arbitrary name if the malware is capable of detecting and stopping genuine anti-spyware.

While I was searching for cure, I am surprised there are some many fake anti-spyware/malware tools are actually spyware/malware themselves. What they do is hijacking your Web browser to generate Web traffic or even still your personal info. One thing they surely do not do is scan and skill spyware/malware in your computer.

More info at:

http://www.bleepingcomputer.com/malware-removal/

Wonderful ESXi Scripting Site

This guy is really good with ESX/ESXi. His scripts for VM backup, UPS shutdown and other stuff are just fantastic.

http://engineering.ucsb.edu/~duonglt/vmware/

Cron Job Sandbox

Check out this Web site for your crob job schedule settings.

http://www.cronsandbox.com/

Although some advanced crontab setting may work in this sandbox, they may not work in some versions of Linux. The one failed to work properly in my CentOS 5.2 is:

22 7 1-7 * 2

This setting should mean the first Tuesday every month, but actually it is launched on the first day of every month.

For this type of sophisticated scheduling, I ended up using an external Windows box running plink.exe to remote the cron job.

Linux Service Check and Start Script

This script copied from somewhere checks and restarts Linux service in necessary.

======================================
#!/usr/bin/perl

# if your prgram has the string "grep" in the name or in the path
# this program won't work.

$pro2check = "service name";

open PROS, "ps -ef|grep $pro2check |";

while ($line = ){
unless ($line =~ m/grep/){
#print "it is running\n";
exit;
}
}

#print "it isn't running\n";
exec "service $pro2check start";

========================

Tomcat Reverse Proxy

There are two Apache Tomcat connectors can be used Tomcat reverse proxy: mod_jk and mod_proxy_ajp.

mod_proxy_ajp is new and easy to configure while mod_jk is just the opposite. I would not explain the details how to use them since this type of info can be easily found online. I just want to share what I found after weeks of frustration:

• Use mod_proxy_ajp when your network connection between the proxy and Tomcat is very stable, and the traffic load is low.
• Otherwise use mod_jk.
• By default, Tomcat does NOT recycle abandoned ajp connections. You need to enable that, otherwise, broken network connections between proxy and Tomcat will max out ajp thread pool on Tomcat side.

Below settings in works.properties file is helpful in mod_jk configuration:

worker.gui2.socket_timeout=10
worker.gui2.socket_keepalive=True
worker.gui2.reply_timeout=500
worker.gui2.prepost_timeout=10000
worker.gui2.connect_timeout=10000
worker.gui2.retries=5
worker.gui2.connection_pool_timeout=600

If everything fails to maintain stable connection, disable connection reuse in Apache .conf file:

JkOptions +DisableReuse

To enable Tomcat recycle abondaned ajp threads, add:

connectionTimeout="600000"

to server.xml file.

Enterprise Wiki

A good candidate for wiki in company environment is Foswiki, which is a very good fork from TWiki.

Foswiki has cooperation, commenting, fine grained access control and many other more features corporate users like right out-of-box.

The downside is, like TWiki, it is based on CGI and Perl, and need tight integration with Apache, so it is a bit more complicated to set up. The performance is not optimum as well compared to PHY/MySQL counterparts.

In enterprise environment, it is an obvious better choice then Mediawiki.

Batch script to change FTP password

Changing password for FTP users accounts requires entering FTP commands in command mode. This is usually to much for end users who need to change their FTP passwords by themselves. I wrote a batch file script to make the job easier. Save the content below in a .bat file and run it.

If it does not work again your FTP server, check the syntax of

literal SITE CHPW %old_password% %new_password%

Your FTP server may use a different syntax.

@echo off
echo This program changes password on ftp.domain.com.
echo.
SET /P username=Enter FTP Username:
SET /P old_password=Enter Old FTP Password:
SET /P new_password=Enter New FTP Password:
SET /P new_password2=Enter New FTP Password again:

If not %new_password%==%new_password2% goto bad

echo %username%> ftpcmd.txt
echo %old_password%>> ftpcmd.txt
echo literal SITE CHPW %old_password% %new_password%>> ftpcmd.txt
echo bye>> ftpcmd.txt
echo.
echo ************** System Message Begins ********************************
ftp -i -s:ftpcmd.txt ftp.domain.com
echo ************** System Message Ends **********************************
del ftpcmd.txt

echo.
echo From the System Message above, you can see whether the password has been
echo changed successfully or not. If successful, the new direct access URL is:
echo.
echo ftp://%username%:%new_password%@ftp.domain.com
echo.
echo NOTE:
echo To copy URL to clipboard: Right-click, Mark, select, enter.
echo.
echo.
echo This window will close.
pause
goto end

:bad
echo.
Echo New passwords dismatch.
echo.
echo This window will close.
pause

:end

Ensure a stable mod_proxy_ajp connection

Apache Tomcat connector mod_proxy_ajp is recommended Tomcat frontend for Tomcat backend server. It provides better flexibility, scalability and security.

When using a firewall between machine running mod_proxy_ajp and backend Tomcat, the firewall may silently drop connections between the two when the connection is idle, causing following error:

(104)Connection reset by peer: ajp_ilink_receive() can't receive header

The symptom on the user side is when opening a page, usually after a long period of inactivity, it gets a 503 Service Temporarily Unavailable Error. A simple page reload will get the page back, since a new connection is initiated.

To avoid this, add a Keepalive parameter to mod_proxy_ajp to use OS TCP/IP KeepAlive function to send keepalive patches through the firewall:

ProxyPass /path_if_any ajp://backend_tomcat_server:8009/path_if_any keepalive=on

“不折腾”的中文翻译

胡锦涛说“不折腾”，其中文译法很简单，就是：Don't make a fuss.

两者都是口语表达方式，那些所谓权威的译法都是书面的，不合适，不贴切。

Linksys ATA Dial Plan for GTA

This dial plan makes my Vbuzzer VoIP behaves like a local landline phone. I will not need to enter 1 for country code for local calls:

<416:1416>xxxxxxxS0|<647:1647>xxxxxxxS0|<905:1905>xxxxxxxS0|18xxxxxxxxxS0|1xxxxxxxxxxS0

Phone gets time from VoIP ATA

Solved a problem with my cordless phone time display. After setting up time on the phone, it was fine for some time but it would go completely wrong somehow. I had thought it was due to a defect in the phone.

It turned out to be my time setting on VoIP ATA. I did not care to set up the proper day and time in ATA when I configured it. Phones sold in North America gets its time from the line. With the second incoming ring, time data is sent, phone uses this data to update its time. When using VoIP ATA, the time data is sent by ATA, so my mis-configured ATA's wrong time setting overwrote phone's time setting every time it rang.

The feature that phone getting time from VoIP ATA is actually a cool one because I can then use a public NTP server to get the most accurate time to ATA. And my phone will always has accurate time.