Open Source Days Open Source Days were nice, especially the meating(sic) of and talking to old friends and new people. I got to discuss Mercurial with two of its developers which was very interesting indeed. It's funny how similar git and Mercurial are in some regards and how different in others. Overall, it feels a bit as if Mercurial is not quite as distributed as git. Its local, sliding revision index feels like disaster waiting to happen, to me. On the other hand, Mercurials ability to not check out large files to your local repository sounds very git-annex-ish, which is nice. Choice is good :) My talk about how to gitify your life (slides, no video) went extremely well. Within my time-slot, there were a total of six talks, and lunch(!), in parallel. About 300 people attended OSD on Sunday and of those, many were at booths, stands, eating, etc. My personal turnout was 50-70 listeners so I was well above mathematical average and from what I heard, my talk was the most-visited one during that time. Add the fact that several people asked me to put up the resource links up again after the talk so they could take pictures and I would say this talk really was a success. Ego-stroking? Yes. Vanity? Most likely. Being able to see that people can really want to learn about what you have to say? Priceless. It's a real pity that there was no video recording, but it's obviously too late to do anything about that. Joey Hess asked me to at least make an audio recording on my laptop, but that turned out to be a lot of useless white noise with faint mumbling in between. Maybe I should at least get a small microphone or recorder so I will always have an audio copy. I already did order a presentation clickie with built-in laser pointer so I won't have to rely on possibly non-existent conference infra, any more. If there's any interest, I may re-record the talk as audio, else I will just try to get another speaker slot at another conference, with video recording, and link that. Denmark Barring the airport, central station, bus, hotel, venue, and metro, I did not see anything of Copenhagen. That's a pity, but I didn't want to leave the conference early. To continue my recent tradition of dumping random observations about places I visit onto my blog, here goes:

• Torx screw adaption: No idea, I did not see any screws as I didn't enter any wooden buildings.
• Most power outlets have their own on/off switch; I would love to have the same in Germany.
• English movies, series, etc. are not dubbed, merely subbed. This is great to learn English even though it will obviously increase potential exposure to certain "news" stations.
• When exiting Copenhagen airport's first floor, there are knee-high bumpers with broad wings right in front of escalators. In a crowd, it's impossible to see them; the first information about their existence is most likely a bruised shin. If there's ever a panic, people will get seriously hurt. I am sure that Denmark has officials from the fire department and city OK their evacuation routes. No idea how those bumpers can be allowed; they probably are not.
• It's great to have a map of your target area along with the street name in the search field handy on your phone when asking people for directions. You can pre-cache the map tiles and don't need to pay horrendous roaming charges for online navigation, that way.
• As always, the best people to ask for directions are young mothers with strollers.
• The Gulf Stream never ceases to boggle my mind. It's warm in Denmark.
• The bridge between Denmark and NorwaySweden (thanks kloeri) looks very impressive from a plane. Hopefully, I will be able to drive over it at some point in my life.
• Hotels will always be able to lend you a phone charger in case you forgot yours.
• Danish coffee is horrible. This really seems to be a common theme in Scandinavia.
• If you board last, you can sit down next to the emergency exit without bothering anyone. If the seat is still free, no one will claim it any more as you are the last to enter the plane. Just sit down and enjoy the leg room.
• The one great advantage of semi-commercial/for-pay conferences is that you will get a name badge. I need to poke FOSDEM about this again; badges and lanyards are cheap if you know where to order.

I've been experimenting with a new packaging tool/workflow based on marking certain commits on my integration branch for export as quilt patches. In this post I'll walk though converting the package nauty to this workflow.

1. Add a control file for the gitpkg export hook, and enable the hook: (the package is already 3.0 (quilt))

   % echo ':debpatch: upstream..master' > debian/source/git-patches
   % git add debian/source/git-patches && git commit -m'add control file for gitpkg quilt export'
   % git config gitpkg.deb-export-hook /usr/share/gitpkg/hooks/quilt-patches-deb-export-hook
   

   This says that all commits reachable from master but not from upstream should be checked for possible export as quilt patches.
2. This package was previously maintained in the "recommend topgit style" with the patches checked in on a seperate branch, so grab a copy.

    % git archive --prefix=nauty/ build   (cd /tmp ; tar xvf -)
   

   More conventional git-buildpackage style packaging would not need this step.
3. Import the patches. If everything is perfect, you can use qit quiltimport, but I have several patches not listed in "series", and quiltimport ignores series, so I have to do things by hand.

   % git am  /tmp/nauty/debian/patches/feature/shlib.diff
   

4. Mark my imported patch for export.

   % git debpatch +export HEAD
   

5. git debpatch list outputs the following

   afb2c20 feature/shlib
   Export: true
   makefile.in    241 +++++++++++++++++++++++++++++++++--------------------------
   1 files changed, 136 insertions(+), 105 deletions(-)
   

   The first line is the subject line of the patch, followed by any notes from debpatch (in this case, just 'Export: true'), followed by a diffstat. If more patches were marked, this would be repeated for each one. In this case I notice subject line is kindof cryptic and decide to amend.

    git commit --amend
   

6. git debpatch list still shows the same thing, which highlights a fundemental aspect of git notes: they attach to commits. And I just made a new commit, so

   git debpatch -export afb2c20
   git debpatch +export HEAD
   

7. Now git debpatch list looks ok, so we try git debpatch export as a dry run. In debian/patches we have 0001-makefile.in-Support-building-a-shared-library-and-st.patch series That looks good. Now we are not going to commit this, since one of our overall goal is to avoid commiting patches. To clean up the export, rm -rf debian/patches
8. gitpkg master exports a source package, and because I enabled the appropriate hook, I have the following

    % tar tvf ../deb-packages/nauty/nauty_2.4r2-1.debian.tar.gz   grep debian/patches
    drwxr-xr-x 0/0               0 2012-03-13 23:08 debian/patches/
    -rw-r--r-- 0/0             143 2012-03-13 23:08 debian/patches/series
    -rw-r--r-- 0/0           14399 2012-03-13 23:08 debian/patches/0001-makefile.in-Support-building-a-shared-library-and-st.patch
   

   Note that these patches are exported straight from git.
9. I'm done for now so

   git push 
   git debpatch push
   

the second command is needed to push the debpatch notes metadata to the origin. There is a corresponding fetch, merge, and pull commands. More info

• Gitpkg bug
• Git Repo with git-debpatch (WIP)
• Example package: nauty
• Example package: bibutils In this package, I was already maintaining the upstream patches merged into my master branch; I retroactively added the quilt export.

During the last week, I created ghc-heap-view, a library to investigate the actual memory representation of Haskell values. It is inspired by vacuum and the GHCi debugger, but goes beyond them by allowing the user to look inside thunks and functions and see what other values they refer to. Let me demonstrate it by running the included demo: ghc-heap-view-demo Here are a four different lists, where the first three are already evaluated.
The first one, l, was defined as a top level constant as

> l = [1,2,3]

and is now found at 0x00000000006d1750/2 (where the /2 is the pointer tag information) and fully evaluated:

  ConsClosure  info = StgInfoTable  ptrs = 2, nptrs = 0, tipe = CONSTR_STATIC, srtlen = 1 , 
                 ptrArgs = [0x00000000006d16e0/1,0x00000000006d1730/2],
                 dataArgs = [], descr = "ghc-prim:GHC.Types.:" 

The second one, l2, is locally defined

> let l2 = 4:l

and now found at 0x00007fdce19fe4b0/2. See how the cons-cell references l!

  ConsClosure  info = StgInfoTable  ptrs = 2, nptrs = 0, tipe = CONSTR_2_0, srtlen = 1 ,
                 ptrArgs = [0x00000000006dca50/1,0x00000000006d1750/2],
                 dataArgs = [],
                 descr = "ghc-prim:GHC.Types.:" 

And the binding

> args <- map length  fmap  getArgs

evaluates to the one , global empty list at 0x00000000006db640/1:

  ConsClosure  info = StgInfoTable  ptrs = 0, nptrs = 0, tipe = CONSTR_NOCAF_STATIC, srtlen = 0 ,
                 ptrArgs = [],
                 dataArgs = [],
                 descr = "ghc-prim:GHC.Types.[]" 

And now we have, at 0x00007fdce19fe4c8, the concatenation of them, but unevaluated:

> let x = l ++ l2 ++ args

The thunk keeps a reference to l2 and args, but not l, as that is at a static address, unless you are running this in GHCi:

  ThunkClosure  info = StgInfoTable  ptrs = 2, nptrs = 0, tipe = THUNK_2_0, srtlen = 1 ,
                  ptrArgs = [0x00007fdce19fe4b0/2,0x00000000006db640/1],
                  dataArgs = [] 

Now to some more closure types. m and m' locally bound of type the unboxed type Int#, with values 42 resp. 23.

> let f = \x n -> take (I# m + I# x) n ++ args
  t = f m' l2

So here is (0x00007fdce1937d50/2), referencing its free variables args and 42:

  FunClosure  info = StgInfoTable  ptrs = 1, nptrs = 1, tipe = FUN_1_1, srtlen = 65553 ,
                ptrArgs = [0x00000000006db640/1],
                dataArgs = [42] 

And t is a thunk that applies f (also referenced here) to an unboxed value (23) and l2:

  ThunkClosure  info = StgInfoTable  ptrs = 2, nptrs = 1, tipe = THUNK, srtlen = 0 ,
                  ptrArgs = [0x00007fdce19fe4b0/2,0x00007fdce1937d50/2],
                  dataArgs = [23] 

Lastly, here is the standard example for self reference:

> let x = id (:) () x

This is what x (0x00007fdce1947940) looks like, at least without -O:

  ThunkClosure  info = StgInfoTable  ptrs = 0, nptrs = 0, tipe = THUNK, srtlen = 1 ,
                  ptrArgs = [],
                  dataArgs = [] 

So it is unevaluated. Let us evaluate it using seq. Now we have, still at 0x00007fdce1947940:

  IndClosure  info = StgInfoTable  ptrs = 1, nptrs = 0, tipe = BLACKHOLE, srtlen = 0 ,
                indirectee = 0x00007fdce194cc98/2 

The thunk was replaced by an indirection. If we look at the target, 0x00007fdce194cc98/2, we see that it is a newly created cons-cell referencing the original location of x:

  ConsClosure  info = StgInfoTable  ptrs = 2, nptrs = 0, tipe = CONSTR_2_0, srtlen = 1 ,
                 ptrArgs = [0x00000000006db620/1,0x00007fdce1947940],
                 dataArgs = [],
                 descr = "ghc-prim:GHC.Types.:" 

After running the garbage collector (performGC), we find that the address of x is now 0x00007fdce19f30d0/2 and that the self-reference is without indirections:

  ConsClosure  info = StgInfoTable  ptrs = 2, nptrs = 0, tipe = CONSTR_2_0, srtlen = 1 ,
                 ptrArgs = [0x00000000006db620/1,0x00007fdce19f30d0/2],
                 dataArgs = [],
                 descr = "ghc-prim:GHC.Types.:" 

Future plans The output of ghc-heap-view is not really pretty yet; even the indentation in this blog post was added manually by me, so this really needs a pretty printer providing a nicer, possibly more compact representation, including something like what vacuum provides. Maybe vacuum can be ported to use this library, and also include the thunk s and function s references in the output. Maybe also the GHCi debugger can be extended to show more information about unevaluated expressions using this. Internally, the library is not very polished yet either. It only handles those closures types that I have seen so far, and is likely to break horribly if run in a threaded or debugging enabled runtime. How it works Obviously, this is not standard Haskell 98 code, but rather deep trickery involving the GHC API and some C code. Initially I tried to use the API that vacuum and the GHCi debugger rely on, which is an operation

unpackClosure# :: a -> (# Addr#, Array# b, ByteArray# #)

which takes any Haskell value and returns the address to its info table, the pointers and the non-pointer-data in the closure. Unfortunately, it was not complete in that it was meant only for data closures and will for other closure types, e.g. thunks, return no data and no pointers (as can be seen in the code). So I implemented my own version of this operation:

foreign import prim "slurpClosurezh" slurpClosure# :: Any -> (# Addr#, ByteArray#, Array# b #)

where the returned ByteArray# contains the complete closure, including extra information fields such as the arity of a function. The Array# is again the list of pointers in the closure. At first glance, this is a duplication, as the pointers are of course also contained in the ByteArray#. But as soon as the GHC runtime reigns again, a garbage collector run can happen, the referenced values will move somewhere else, and the words that once were pointers in the ByteArray# become useless. But the corresponding entries in the Array# are updated by the garbage collector, as it knows that these are pointers, and not just words. This way, we get both a faithful copy of the closure on the heap and useful references to the contained data. Here is a demonstration of this effect:

$ ghci -XMagicHash -package ghc-heap-view
GHCi, version 7.4.1: http://www.haskell.org/ghc/  :? for help
Loading package ghc-prim ... linking ... done.
[..]
Loading package ghc-7.4.1 ... linking ... done.
Loading package ghc-heap-view-0.1 ... linking ... done.
Prelude> let  a = [1,2,3,4]; b = 5:a 
Prelude> :m + GHC.HeapView 
Prelude GHC.HeapView> rawHeapData <- getClosureRaw b
Prelude GHC.HeapView> rawHeapData 
(0x000000004080d658,[1082185320,140040739366568,140040739365928],[0x00007f5dc68626a8,0x00007f5dc6862428])
Prelude GHC.HeapView> System.Mem.performGC
Prelude GHC.HeapView> rawHeapData 
(0x000000004080d658,[1082185320,140040739366568,140040739365928],[0x00007f5dc41b3ad8,0x00007f5dc41b3b28]) 

The function rawHeapData is a thin wrapper around slurpClosure# which turns the primitive array in normal lists. Note that the second component of the triple is unchanged, but the third is updated by the garbage collector. Of course this means that the Show instance for the data type that ghc-heap-view uses to reference values is not referential transparent either. The foreign function import above is of type prim , i.e. does not call a C function but rather a Cmm function. Cmm is a reduced C that GHC uses internally to compile the Haskell code to, and most primitive operations are implemented in this language although I do quickly call regular C from my Cmm code to do the more complicated stuff, mainly figuring out what words of the closure are pointers. The knowledgeable reader might notice that I am passing a boxed value of type Any to the foreign function. This is currently not possible with foreign prim functions, and to actually use that code, you need the patch in GHC ticket #5931. But you can use ghc-heap-view without that as well (and the Cabal package will by default use that path), using the following hack to obtain the pointer to a Haskell value on the Heap as an unboxed type that can pass to the primitive operation:

foreign import prim "slurpClosurezh" slurpClosure'# :: Word#  -> (# Addr#, ByteArray#, Array# b #)
data Ptr' a = Ptr' a
aToWord# :: Any -> Word#
aToWord# a = case Ptr' a of mb@(Ptr' _) -> case unsafeCoerce# mb :: Word of W# addr -> addr
slurpClosure# :: Any -> (# Addr#, ByteArray#, Array# b #)
slurpClosure# a = slurpClosure'# (aToWord# a)

This works because a Word and a Ptr' have the same closure layout, only differing in the fact that one stores an a, and the other stores a Word#. Once we obtained the raw representation of the closure, we do the parsing in Haskell. Using the info table and the raw closure, we have enough information to tell which words have to be replaced by the appropriate pointer (which might already have been updated by the garbage collector) in the pointers list. This work was supported by a scholarship from the Deutsche Telekom Stiftung.

Flattr this post

It has been months since I last put something here, so I think that requires a quick catchup.

I have an old motherboard that requires creating a DOS boot floppy in order to upgrade its BIOS. Fortunately, it's not too hard to do this with FreeDOS and a USB stick.

The instructions below are based on an FDos wiki article.

Downloading the dependenciesThe first step is to download the required files from your motherboard manufacturer:

• the latest BIOS image
• the BIOS flashing program

and then install the tools you'll need:

apt-get install makebootfat syslinux

Preparing the "floppy" imageStart by collecting all of the files you need to install FreeDOS on the USB stick:

cd /tmp

wget http://www.ibiblio.org/pub/micro/pc-stuff/freedos/files/distributions/1.0/pkgs/commandx.zip
wget http://www.ibiblio.org/pub/micro/pc-stuff/freedos/files/distributions/1.0/pkgs/kernels.zip
wget http://www.ibiblio.org/pub/micro/pc-stuff/freedos/files/distributions/1.0/pkgs/substx.zip
wget http://www.ibiblio.org/pub/micro/pc-stuff/freedos/files/distributions/1.0/pkgs/unstablx.zip

for ZIP in *.zip; do unzip $ZIP; done

cp ./source/ukernel/boot/fat16.bin  .
cp ./source/ukernel/boot/fat12.bin .
cp ./source/ukernel/boot/fat32lba.bin .

cp /usr/lib/syslinux/mbr.bin .

and then create a directory for the files that will end up in the root directory of the "floppy":

mkdir /tmp/fs-root
cp ./bin/command.com /tmp/fs-root/
cp ./bin/kernel.sys  /tmp/fs-root/

and copy the BIOS image and update program into that same directory (/tmp/fs-root/).

Creating a bootable USB stickPlug in a FAT-formatted USB stick and look for the device it uses (/dev/sdb in the example below).

Finally, run makebootfat:

/usr/bin/makebootfat -o /dev/sdb -E 255 -1 fat12.bin -2 fat16.bin -3 fat32lba.bin -m mbr.bin /tmp/fs-root

Justin TV is a streaming service that uses the broken flash concept in order to allow you to view channels.

Unfortunately it's the only source of Arabic movies, series and shows.

I wrote a GStreamer source that retrieves the channel information and uses libRTMP to connect to the Justin streaming server. The rest is handled by GStreamer ;-)

If you want to watch http://www.justin.tv/ammartv for example, you simply do

The 2nd plugin is a Totem plugin that indirectly utilizes the GStreamer source.
Given a language code (ar or en or ...), it will download the list of channels in that language and shows them in Totem's side panel. One can then easily double click on a channel and simply watch it. I originally wanted to do the Totem plugin in python but the inability to do asynchronous callback based HTTP requests prevented me :-(

Be warned that the code is of course a bit buggy and needs a lot of cleanups, it's been years since I coded anything in Gtk and that Justin might find out and either block the source somehow or even change the protocol but let's wait until that happens ;-) read more

Recently I accidentally flooded Planet Debian with my blog feed. This was an accident caused by some of my older blog entries not having valid "Date:" headers. (I use chronicle which parses simple text files to build a blog, and if there is no Date: header present in entries it uses the CTIME of the file(s).) So why did my CTIMEs get lost? Short version I had a drive failure and a PSU failure which lead to me rebuilding a few things and cloning a fresh copy of my blog to ~/hg/blog/. My host is now once again OK, but during the pain the on-board sound started to die. Horribly crackly and sounding bad. I figure the PSU might have caused some collateral damage, but so far thats the only sign I see. I disabled the on-board sound and ordered a cheap USB sound device which now provides me with perfect sound under the Squeeze release of Debian GNU/Linux. In the past I've ranted about GNU/Linux sound. So I think it is only fair to say this time things worked perfectly - I plugged in the device, it was visible in the output of dmesg, and /proc/asound/cards and suddenly everything just worked. Playing music (mpd + sonata) worked immediately, and when I decided to try playing a movie with xine just for fun sound was mixed appropriately - such that I could hear both "song" + "movie" at the same time. Woo. (I'm not sure if I should try using pulse-audio, or similar black magic. Right now I've just got ALSA running.) Anyway as part of the re-deployment of my desktop I generated and pass-phrased a new SSH key, and then deployed that with my slaughter tool. My various websites all run under their own UID on my remote host, and a reverse-proxy redirects connections. So far example I have a Unix "s-stolen" user for the site stolen-souls.com, a s-tasteful user for the site tasteful.xxx, etc. (Right now I cannot remember why I gave each "webserver user" an "s-" prefix, but it made sense at the time!) Anyway once I'd fixed up SSH keys I went on a spree of tidying up and built a bunch of meta-packages to make it a little more straightforward to re-deploy hosts in the future. I'm quite pleased with the way those turned out to be useful. Finally I decided to do something radical. I installed the bluetile window manager, which allows you to toggle between "tiling" and "normal" modes. This is my first foray into tiling window managers, but it seems to be going well. I've got the hang of resizing via the keyboard and tweaked a couple of virtual desktops so I can work well both at home and on my work machine. (I suspect I will eventually migrate to awesome, or similar, this is very much a deliberate "ease myself into it" step.) ObQuote: "Being Swedish, the walk from the bathroom to her room didn't need to be a modest one. " - Cashback.

Around two years ago, the OECD presented a study on residential bandwitdth available per country that triggered quite a bit of debate all over the world I have seen at least criticism to it in Mexico, in the USA and in Australia. It's very easy to take a simplified view of a statistic and bitch on how sorry the state of our country is. In our case, the outcry was that Mexico was the lowest of all of the OECD countries, and I have seen this repeated on so many topics that it what surprises me is that people keep getting surprised at it! OECD does not represent the 200 countries in this world (only the top 30, and the meaning of "top" is not unambiguous). I found this graph that helps me illustrate this point: While that graphic is part of a report illustrating how sorry the USA should be for their low position, it shows the OECD member countries. And yes, the only country Mexico could be compared in general terms from those in the list is Turkey. Coherently, they are located at positions 28 and 30. But what prompted me into writing this post? That some weeks ago I was reading a viewpoint article at the Communications of the ACM magazine: What gets measured gets done: Stop focusing on irrelevant broadband metrics, by Scott Wallsten (might be behind a paywall for you If you are interested, I can share a copy with you, just ask me by email). Wallsten's article contains the following graph: I found it pretty telling that, although Mexico sits at the extreme of the graph (and the height of our bar makes it very hard to get a real value out of this particular rendering), our ISPs join a very select group of countries (Sweden, Germany, Belgium, Luxembourg and Ireland, in my very subjective measure) by delivering what they promise. In 2010, the dominant broadband offering was 1Mbps, although higher options have long existed. I always got basically the 100% of what my ISP (Telmex) has promised, even though I have always had the cheapest package available. Some months ago, I got a call announcing we were being pushed 5x into the future, and starting right then, I had a 5Mbps connection. And although I didn't really expect it to be true, I have had a clean 6Mbps (yes, 6 instead of 5) connection. So, that's it. This post contains no hidden truths, but just what grabbed my attention from a series of data points :-)

Attachment	Size
Residential Internet speed comparison per country (2010)	397.15 KB
Measured and advertised download speeds (in kbps)	252.86 KB

The next day was reserved for seeing Mostar. I could leave my luggage at the hotel, so I first went to the train station. The train station was rather large and impressive, in spite of only two trains per day and direction. However, the train station was closed at that time, so no ticket purchase yet. Into the historic city of Mostar: Visiting the Ottoman House was interesting, as well as climbing on the tower of one mosque. In the city, many houses still had effects of shelters and gun shots from the war. (At least) One of the trees in the pedestrian area had many shots as well.
river Neretva within the city of Mostar
City of Mostar from the mosque tower
Ottoman House and bird nests within Seeing Stari Most, the old (or rather: rebuilt) bridge was nice, as well as the masses of people looking there. However, the area with many tourists was quite small. Whereas Stari Most was shoot down during the war, there was a small sister bridge which survived the war damaged but still existed. However, that bridge collapsed during one high water afterwards but had also been rebuilt.
Stari Most with tourists, sister bridge of Stari Most without tourists and houses along the river Below Stari Most, there was an area that looked like a nice picknick-place to look at the bridge and old city, but it was obviously unmaintained since some time. Same at other places: Really great, but many of them unmaintained (as in "too less money", not as in "vandalized"). Soon in the afternoon, most tourists disappeared, so I had the chance to look at the city with only few tourists arround before I had to leave for the train. Walking around Mostar, I meet a few people who were in Germany before, for work, studying or school. The city was quite fascinating - in some way reminded me of 20 years ago. I saw a few more nice vegetables, like kiwis. Mostar wasn't as tourismn-oriented as I would have expected from the monuments available to see there. All people were very nice and friendly, and in the cafes around there was free wifi. A nice place, but also depressing when thinking how much better it could be.

Having monitoring for dualstack connectivity in place helps a lot. Unfortunately in most cases we are running also services we want to offer dualstacked. In the past we just monitored in those cases IPv4 only or created a separate check for the same service on IPv6. This is a bit messy and I was looking for something to check services via IPv4 and IPv6. Digging my most boring search engine doesn t help much here. So I was talking with some people more involved into the core Icinga/Nagios stuff. Seems there is actually the best solution to use check_multi. As we have the command definition for check_multi_icinga already in place, I created a check_smtp_dualstack.cmd for monitoring a dualstacked SMTP service

command[ IPv4 ] = check_smtp -4 -H $HOSTADDRESS$
command[ IPv6 ] = check_smtp -6 -H $HOSTADDRESS6$
state [ CRITICAL ] = COUNT(CRITICAL) > 1
state [ WARNING ] = COUNT(WARNING) > 0 COUNT(CRITICAL) > 0
state [ UNKNOWN ] = COUNT(UNKNOWN) > 1 A simple SMTP service definition does the trick (don t forget address6 in host definition)

define service
use generic-service ; Name of service template to use
host_name localhost
service_description SMTP
check_command check_multi_icinga! check_smtp_dualstack.cmd !'-r 1+2+4+8
Okay .. that looks nice, but only at the first view. Imagining what we are actually running as service checks, it seems we just need for every unique service check a new cmd-file for check_multi as I didn t found a way to generalize the whole stuff yet. Does anybody know a way to pass commands for check_multi via service definitions? Something like:

define service
[...]
check_command check_multi_icinga! check_general_dualstack.cmd !'check_smtp -p 666 ! -r 1+2+4+8
[...]

Since some ages we are deploying IPv6 in our network and also for some selected services. Some days ago we discovered, that anybody has enabled accidentally a router advertisement daemon in a network where this shouldn t happen. As result of this, IPv6 enabled systems got (additional) IPv6 adresses and some services where using this new learned addresses as source address when sending out replies. Maybe this doesn t sound so harmful on the first view. But some services rely on a correct source address when getting a reply for a request (for example dns resolver library). To be aware of the issue, that a service maybe available via IPv4 but not via IPv6 or vica versa, a dualstacked monitoring needs to be in place for dualstacked services. Looking into the issue, I stumbled upon Michael Friedrichs HowTo about Dualstacked monitoring with Icinga. Luckily we have the full software stack in place on Squeeze (with squeeze-backport). As icinga and nagios-plugins was in installed already, I just needed to fetch check_multi.

aptitude install -t squeeze-backports nagios-plugin-check-multi Now a new check command is needed, I created the following:

define command
command_name check_multi_icinga
command_line /usr/lib/nagios/plugins/check_multi \
-f /etc/check_multi/$ARG1$ $ARG2$ $ARG3$ $ARG4$ \
-s objects_cache=/var/cache/icinga/objects.cache \
-s status_dat=/var/cache/icinga/status.dat \
-s HOSTADDRESS=$HOSTADDRESS$ -s HOSTADDRESS6=$HOSTADDRESS6$
For monitoring connectivity I created check_host_alive_dualstack.cmd

command[ IPv4 ] = check_ping -4 -H $HOSTADDRESS$ -w 5000.0,100% -c 5000.0,100% -p 5
command[ IPv6 ] = check_ping -6 -H $HOSTADDRESS6$ -w 5000.0,100% -c 5000.0,100% -p 5
state [ CRITICAL ] = COUNT(CRITICAL) > 1
state [ WARNING ] = COUNT(WARNING) > 0 COUNT(CRITICAL) > 0
state [ UNKNOWN ] = COUNT(UNKNOWN) > 1 Now we just need to replace the check-host-alive command and add a value for address6 on the host as the following

define host
use generic-host ; Name of host template to use
host_name localhost
alias localhost
address 127.0.0.1
address6 ::1
check_command check_multi_icinga! check_host_alive_dualstack.cmd !'-r 1+2+4+8
Reloading icinga should you show something like this:
Now we have general connectivity of our dualstacked systems monitored.

Inspired by the interview series conducted by Raphael, I started a Norwegian interview series with people involved in the Debian Edu / Skolelinux community. This was so popular that I believe it is time to move to a more international audience. While Debian Edu and Skolelinux originated in France and Norway, and have most users in Europe, there are users all around the globe. One of those far away from me is Nigel Barker, a long time Debian Edu system administrator and contributor. It is thanks to him that Debian Edu is adjusted to work out of the box in Japan. I got him to answer a few questions, and am happy to share the response with you. :) Who are you, and how do you spend your days? My name is Nigel Barker, and I am British. I am married to Yumiko, and we have three lovely children, aged 15, 14 and 4(!) I am the IT Coordinator at Hiroshima International School, Japan. I am also a teacher, and in fact I spend most of my day teaching Mathematics, Science, IT, and Chemistry. I was originally a Chemistry teacher, but I have always had an interest in computers. Another teacher teaches primary school IT, but apart from that I am the only computer person, so that means I am the network manager, technician and webmaster, also, and I help people with their computer problems. I teach python to beginners in an after-school club. I am way too busy, so I really appreciate the simplicity of Skolelinux. How did you get in contact with the Skolelinux/Debian Edu project? In around 2004 or 5 I discovered the ltsp project, and set up a server in the IT lab. I wanted some way to connect it to our central samba server, which I was also quite poor at configuring. I discovered Edubuntu when it came out, but it didn't really improve my setup. I did various desperate searches for things like "school Linux server" and ended up in a document called "Drift" something or other. Reading there it became clear that Skolelinux was going to solve all my problems in one go. I was very excited, but apprehensive, because my previous attempts to install Debian had ended in failure (I used Mandrake for everything - ltsp, samba, apache, mail, ns...). I downloaded a beta version, had some problems, so subscribed to the Debian Edu list for help. I have remained subscribed ever since, and my school has run a Skolelinux network since Sarge. What do you see as the advantages of Skolelinux/Debian Edu? For me the integrated setup. This is not just the server, or the workstation, or the ltsp. Its all of them, and its all configured ready to go. I read somewhere in the early documentation that it is designed to be setup and managed by the Maths or Science teacher, who doesn't necessarily know much about computers, in a small Norwegian school. That describes me perfectly if you replace Norway with Japan. What do you see as the disadvantages of Skolelinux/Debian Edu? The desktop is fairly plain. If you compare it with Edubuntu, who have fun themes for children, or with distributions such as Mint, who make the desktop beautiful. They create a good impression on people who don't need to understand how to use any of it, but who might be important to the school. School administrators or directors, for instance, or parents. Even kids. Debian itself usually has ugly default theme settings. It was my dream a few years back that some kind of integration would allow Edubuntu to do the desktop stuff and Debian Edu the servers, but now I realise how impossible that is. A second disadvantage is that if something goes wrong, or you need to customise something, then suddenly the level of expertise required multiplies. For example, backup wasn't working properly in Lenny. It took me ages to learn how to set up my own server to do rsync backups. I am afraid of anything to do with ldap, but perhaps Gosa will help. Which free software do you use daily? Nowadays I only use Debian on my personal computers. I have one for studio work (I play guitar and write songs), running AV Linux (customised Debian) a netbook running Squeeze, and a bigger laptop still running Skolelinux Lenny workstation. I have a Tjener in my house, that's very useful for the family photos and music. At school the students only use Skolelinux. (Some teachers and the office still have windows). So that means we only use free software all day every day. Open office, The GIMP, Firefox/Iceweasel, VLC and Audacity are installed on every computer in school, irrespective of OS. We also have Koha on Debian for the library, and Apache, Moodle, b2evolution and Etomite on Debian for the www. The firewall is Untangle. Which strategy do you believe is the right one to use to get schools to use free software? Current trends are in our favour. Open source is big in industry, and ordinary people have heard of it. The spread of Android and the popularity of Apple have helped to weaken the impression that you have to have Microsoft on everything. People complain to me much less about file formats and Word than they did 5 years ago. The Edu aspect is also a selling point. This is all customised for schools. Where is the Windows-edu, or the Mac-edu? But of course the main attraction is budget.The trick is to convince people that the quality is not compromised when you stop paying and use free software instead. That is one reason why I say the desktop experience is a weakness. People are not impressed when their USB drive doesn't work, or their browser doesn't play flash, for example.

I followed Gregor s evolution within Debian because I used to be somewhat active in the Perl team. His case is exemplar because it shows that you don t need to be an IT professional to join Debian and to make a difference. His QA page is impressive with hundreds of packages maintained and hundreds of non-maintainer uploads too. While he started out slowly, I remember meeting him at Debconf 7 in Edinburgh and after that he really got more implicated. Again a case of someone joining for technical reasons but getting more involved and staying there for social reasons! Let s jump into the interview and learn more about him. Raphael: Who are you? Gregor: I m 41 years old, and I live in Innsbruck, Austria, in a shared apartment with a friend of mine. In my day job, I m working at the regional addiction prevention agency, so I m one of the few Debian guys who s not an IT student or professional. I started maintaining packages in 2006, and I am a DD since April 2008. Raphael: How did you start contributing to Debian? Gregor: After having used Debian on servers for some years, I finally switched to it on the desktop after some procrastinating. Soon afterwards I wanted to know more about the making-of , started to join mailing lists, filed bugs, and tried to learn packaging. Luckily I quickly found a permanent sponsor Tony Mancill, and we re still co-maintaining each others packages. And when I packaged my first Perl modules, Gunnar Wolf invited me to join the Debian Perl Group, an offer I accepted a few days later. And I m still there Later, the NM process, although it involved some waiting times, was also a good learning experience due to my AM Wouter Verhelst. (And in the meantime the organization of the NM process has vastly improved, from what I hear.) So my starting point for joining Debian was my curiosity but what really helped me to find my way into the project was the support of the people who invited and helped me. Raphael: What s your biggest achievement within Debian or Ubuntu? Gregor: I m not sure I can name a single big achievement but I guess I can say that my contributions to the Debian Perl Group have helped to make and keep the team a success story. Raphael: The pkg-perl team seems to work very well. As an active member, can you explain us how it is organized? How do you explain its success? In particular it seems to be a great entry point for new contributors. Gregor: The team is huge, both in numbers of members and packages (over 2200). Since last DebConf we manage our source packages in git, we have 2 mailing lists and an IRC channel, and we manage to keep an overview by using PET, the Package Entropy Tracker. It s true that we get new members on a regular basis; we try to invite people (like it happened to me 6 years ago ) but there are also quite a few new contributors who find our docs and introduce themselves on the mailing list. Maybe someone should conduct a study and ask them what motivated them to join. We hand out group membership/commit access quickly, and we try to mentor new contributors actively during their early times in the group. Some of them leave for other projects after some time, but many also stay and become DDs later. I m not sure what the reasons for the group s success are, maybe a combination of:

• a culture in the group (and also in the upstream Perl community) that s based on fun, cooperation, and respect;
• the fact that packaging Perl modules is most of the time quite easy;
• a great set of tools, and also (hopefully) useful documentation;
• a bunch of relaxed people who are open to newcomers and try to help each other.

For everyone interested in joining the Debian Perl Group, our Welcome page on the wiki is a good starting point. Raphael: What are your plans for Debian Wheezy? Gregor: Nothing overly exciting. What I should do is getting a newer JabRef into Debian (which involves packaging some new Java libraries any takers?). A solution for libdatetime-timezone-perl (which ships timezone data converted to Perl modules and tends to get outdated when the timezone data change) would be nice; let s see if #660404 leads to some results And some Perl packages will also need a bit of work for the hardening build flags release goal (cf. #657853). Raphael: What s the biggest problem of Debian? Gregor: Inertia. While I really like the fact that Debian is a volunteer project, and that every contributor works when and on what they decide to work on, I get the feeling that Debian could do better in moving forward, innovating, taking decisions. I also think that more uniformity in managing source packages would make things easier; it s quite amazing to see how many source formats, packaging helpers, patch systems, RCSs etc. are used all over the archive. I m not advocating for mono-cultures, and I consider this diversity a strength in general, but having to find out first how this particular package works when preparing a bug fix can be annoying. On the bright side, I think that the myth Debian and its mailing lists are mostly about flames can be seen as dispelled in the meantime. Sure, sometimes the tone could be a bit more civil, but in general most of the interactions I ve seen in the last years were friendly and helpful. IMO, the Debian Project consists of mostly nice and cooperative people, and that s what makes it fun for me. Raphael: You re one of the most dedicated participants to RCBW (Release Critical Bugs of the Week), an initiative to fix RC bugs every week. How much time do you spend on it? What would you advise to people who are considering to join the movement? Gregor: I got into the habit of fixing RC bugs after having been invited to my first Bug Squashing Party in Munich some years ago. During this weekend I saw that fixing RC bugs can be fun, is often not that difficult, and gives a warm fuzzy feeling I can definitely recommend attending a BSP if one happens to be organized near you. After tasting blood at this first BSP I tried to continue looking at RC bugs, and I guess I spend something around half an hour per day on it. I usually blog about it once a week, in order to motivate others to join in. And joining is easy: just take a look at the tips people like Zack, Vorlon, or me have written. You don t have to be a DD to help, many of my NMUs are based on patches that others kindly prepare and send to the BTS kudos! Another nice aspect is that the RC bug list contains problems from different fields: general packaging problems, language-specific issues, policy violations, etc. So there s something for everybody, and you don t have to be an expert in all fields to fix a specific bug. What s rewarding about fixing RC bugs is not only the feeling of accomplishment and the knowledge about having helped the next release I also received quite a few Thank you mails from maintainers who were busy at that time and appreciated the help. Raphael: Do you have wishes for Debian Wheezy? Gregor: Well, there s not so much left of the Wheezy release cycle if we manage to freeze in June Some quick thoughts for Wheezy and Wheezy+1:

• Obviously, getting multi-arch and the hardening build flags as far as possible would be good.
• What I like is the idea of the time-based freeze, and I hope it will work out in June. And then I hope that the freeze will be shorter this time than during the last 2 releases.
• Unless I m missing something, the CUT discussions have more or less died down; IMO that s a pity because there are users who run testing and would like to avoid the several month long freeze. Maybe someone can come up with new ideas for Wheezy+1
• Too late for broad adoption in Wheezy but still: What constantly annoys me is the handling of conffiles during upgrades (when I want to keep changed values but at the same time want to add new variables). Config::Model seems to be the best idea so far for configuration upgrades but it s not yet widely adopted.

Raphael: Is there someone in Debian that you admire for their contributions? Gregor: There are many people in Debian I admire, too many to name them all. The first one that comes to my mind is Russ Allbery who not only does great work from lintian to Debian policy but who also sets a great example of communicating in a perfectly polite and respectful way even in heated discussions.

---

Thank you to Gregor for the time spent answering my questions. I hope you enjoyed reading his answers as I did. Note that older interviews are indexed on wiki.debian.org/PeopleBehindDebian.

Subscribe to my newsletter to get my monthly summary of the Debian/Ubuntu news and to not miss further interviews. You can also follow along on Identi.ca, Google+, Twitter and Facebook.

2 comments Liked this article? Click here. My blog is Flattr-enabled.

I ll be at PyCon with some of the Sunlight crew, and we ll be hosting a Hackathon after the talks. I hope anyone in the area will consider hacking with us this year. If you re going to PyCon, send me an email, tweet or other digital message - the talks this year look awesome!

Just a quick note that the merry Finnish localization folks are organizing an (extended) localization weekend, starting today. As a nice step towards ease of use, they're utilizing the long developed, maybe even underused Translatewiki.net platform, or to be precise a separate instance of it. Translatewiki.net is used by MediaWiki (Wikimedia Foundation), StatusNet and other high profile projects. Co-incidentally the main developer of Translatewiki.net is Finnish as well.

Anyway enough of the platform, join the translation frenzy at http://l10n.laxstrom.name/wiki/Gnome_3.4, but do make sure to read the notes at http://muistio.tieke.fi/IYZxesy9uc.

I've promised to help in upstreaming those to git.gnome.org on Sunday. There is additionally a new report about Ubuntu 12.04 LTS translations schedule (to which these GNOME contributions will find their way as well) at the ubuntu-l10n-fin mailing list by Jiri.

Ja sama suomeksi.

As the free software and free culture movements have sat quietly by, DRM is now well on its way to becoming the norm in the electronic book publishing industry. The free culture movement has failed to communicate the reality of DRM and, as a result, millions of people are buying books that they won't be able to read when they switch to a different model of ebook reader in the future. They are buying books that will become inaccessible when the DRM system that supports them is shut down -- as we've already seen with music from companies including Wal*Mart, Yahoo, and Microsoft. They are buying books that require that readers use proprietary tools that lock them out from doing basic things that have always been the right of a book owner. Some anti-DRM advocates are, indirectly, part of this problem as they buy these books and turn to shady methods of stripping the DRM. Buying DRMed books is voting with your wallet for a system that criminalizes those that insist on living in freedom and will screw us all in the long run when DRM is the only choice we are offered and removing the DRM is difficult, unsafe, and illegal. Buying non-DRMed e-books is a more freedom-friendly alternative for those that, like me, are excited about not lugging kilograms of paper around our cities and the world. We can do this at "non-mainstream" publishers like Smashwords who explicitly reject DRM. Of course, the big ebook sellers like Amazon, and Barnes and Nobel, and Google all offer non-DRMed books. But none of the major ebook retailers explicitly reveal the DRM status of locked down books before purchase. On Amazon, there are some cryptic signs and signals that, if you understand them, suggest the absence of DRM. Google and Barnes and Nobel currently offer no way to know if a book is DRMed without buying it first and questions in their support forums go unanswered. It's hard to support non-DRM alternatives when we can't recognize them. It's hard to tell people to not buy DRM ebooks if we can't even tell them apart. Getting this message through to book buyers -- and perhaps even to ebook retailers -- seems like a critical first step.

After about week of (not so heavy) development, I can announce availability of Weblate - web based translation tool with tight Git integration. The project was started because I was not happy with existing solutions (see my blog post) as all of them was missing some features I find useful. I started with quite simple definition:

Minimalistic web based translation with direct commit to git on each translation made. There is no plan in heavy conflict resolution as these should be primarily handled on git side.

Also the project started with defined list of features:

• Easy web based translation
• Propagation of translations across sub-projects (for different branches)
• Tight git integration
• Usage of Django's admin interface
• Upload and automatic merging of po files
• Links to source files for context

Pretty much all of that is completed right now, however there will be definitely some issues which will need fixing. All important information about the project are available on it's website, the code is hosted on Github. If you are curious how it looks, you can try it out on demo server. You can login there with demo account using demo password or register your own user. Please give it some testing as I plan to deploy it on http://l10n.cihar.com/ pretty soon.

Filed under: Django English Weblate 5 comments Flattr this!

I have just finished updating the user-space SE Linux code in Debian/Unstable to the version released on 2012-02-16. There were some changes to the build system from upstream which combined with the new Debian multi-arch support involved a fair bit of work for me. While I was at it I converted more of them to the new Quilt format to make it easier to send patches upstream. In the past I have been a bit slack about sending patches upstream, my aim for the next upstream release of user-space is to have at least half of my patches included upstream this will make things easier for everyone. Recently Mika Pfl ger and Laurent Bigonville have started work on Debian SE Linux, they have done some good work converting the refpolicy source (which is used to build selinux-policy-default) to Quilt. Now it will be a lot easier to send policy patches upstream and porting them to newer versions of the upstream refpolicy. Now the next significant thing that I want to do is to get systemd working correctly with SE Linux. But first I have to get it working correctly wit cryptsetup. Related posts:

1. SE Linux Status in Debian 2011-10 Debian/Unstable Development deb http://www.coker.com.au wheezy selinux The above APT sources.list...
2. SE Linux Status in Debian 2012-01 Since my last SE Linux in Debian status report [1]...
3. Debian SE Linux Status At the moment I ve got more time to work on...

One of the best way to add SNMP support to an application is the use of AgentX protocol: an application can act as a subagent and handle requests from a master agent using AgentX protocol. The most widespread implementation for such a task is the one from Net-SNMP. TL;DR: An application asynchronously leveraging Net-SNMP AgentX implementation has many opportunities to get stuck when the master agent becomes temporarily unavailable. A mostly efficient workaround is to dedicate a master agent for AgentX and delegate MIB handling to a subagent.

Pinging the master agent Net-SNMP uses an event-based model. It also provides some synchronous functions but they are built on top of the asynchronous ones. It is shipped with its own event loop. Therefore, Net-SNMP AgentX protocol implementation seems a fine choice to add SNMP support to an event-based program, for example in Keepalived, a VRRP daemon and a monitoring daemon for LVS clusters. Unfortunately, an AgentX subagent is expected to check, at a regular interval, if the master agent is alive . This is handled automatically with Net-SNMP implementation as long as you call run_alarms() function which will call agentx_check_session():

/*
 * check a session validity for connectivity to the master agent.  If
 * not functioning, close and start attempts to reopen the session 
 */
void
agentx_check_session(unsigned int clientreg, void *clientarg)
 
    /* [...] */
    DEBUGMSGTL(("agentx/subagent", "checking status of session %p\n", ss));
    if (!agentx_send_ping(ss))  
        snmp_log(LOG_WARNING,
                 "AgentX master agent failed to respond to ping.  Attempting to re-register.\n");
        /*
         * master agent disappeared?  Try and re-register.
         * close first, just to be sure .
         */
        agentx_unregister_callbacks(ss);
        agentx_close_session(ss, AGENTX_CLOSE_TIMEOUT);
        /* [...] */
        if (main_session != NULL)  
            /* [...] */
            main_session = NULL;
            agentx_reopen_session(0, NULL);
         
        else  
            snmp_close(main_session);
            main_session = NULL;
         
      else  
        DEBUGMSGTL(("agentx/subagent", "session %p responded to ping\n",
                    ss));
     
 

This piece of code will end up calling (directly or indirectly) the following functions¹ which are using agentx_synch_response():

• agentx_send_ping()
• agentx_open_session()
• agentx_reopen_session()
• agentx_close_session()
• agentx_register()
• agentx_unregister()
• agentx_register_index()
• agentx_unregister_index()
• agentx_add_agentcaps()
• agentx_remove_agentcaps()

agentx_synch_response() will synchronously wait for an answer from the master agent. Your event-based program will just sit here doing nothing while this happens. For example, keepalived may be unable to send VRRP probes resulting in some serious havoc in your cluster. Functions prefixed by agentx_ are not part of NetSNMP API and could therefore be rewritten to do their work asynchronously. Unfortunately, talk is cheap. Moreover, there exists other deep paths that will block a subagent. For example, the low-level connection to the master agent (using TCP or a Unix socket, but not with UDP) will use a blocking connect() call. It seems quite difficult to fix this. Here are some (partial) workarounds:

• Call agentx_check_session() less often. The default interval is 15 seconds. Disabling it completely or using a very high value is not advised because this function is the only way to reestablish a connection to the master agent when it is, for example, restarted. Here is how to change the delay to 120 seconds:

  netsnmp_ds_set_int(NETSNMP_DS_APPLICATION_ID,
                     NETSNMP_DS_AGENT_AGENTX_PING_INTERVAL, 120);
  

• Don t call agentx_check_session() if we know the master agent is alive. For example, if it just sent us a new request, no need to ping it. I have written a patch implementing such a workaround. The ABI is left untouched, therefore, you only need to recompile Net-SNMP libraries.
• Use a lower timeout and no retry. By default, the timeout for synchronous requests is 1 second and a failed request will be retried 5 times. Because several synchronous functions are used in a row, you may be trapped for as long as 30 seconds with those settings. Here is how² to disable the retry mechanism and to set the timeout to a very low value:

  static int
  snmp_setup_session_cb(int majorID, int minorID,
                void *serverarg, void *clientarg)
   
      netsnmp_session *sess = serverarg;
      sess->timeout = ONE_SEC / 3;
      sess->retries = 0;
      return 0;
   
  void some_init_function()
   
      /* [...] */
      snmp_register_callback(SNMP_CALLBACK_LIBRARY,
         SNMP_CALLBACK_SESSION_INIT,
         snmp_setup_session_cb, NULL);
      /* [...] */
   
  

Unresponsive master agent Why is the master agent unresponsive? snmpd is also an event-based program and, trust me, there are a lot of places where it will become unresponsive. Here are two examples:

• When using the pass or the pass_persist directive, Net-SNMP will block until the delegated command outputs a complete line.

  /* var_extensible_pass() in agent/mibgroup/ucd-snmp/pass.c */
  /*
   * valid call.  Exec and get output 
   */
  if ((fd = get_exec_output(passthru)) != -1)  
      file = fdopen(fd, "r");
      if (fgets(buf, sizeof(buf), file) == NULL)  
          fclose(file);
          wait_on_exec(passthru);
          /* [...] */
          continue;
       
      /* [...] */
      fclose(file);
      wait_on_exec(passthru);
      /* [...] */
   
  

• DISMAN-PING-MIB implementation will just hang while pinging the remote host. If the host is down and you have requested 5 probes with a timeout of 1 second, snmpd will be unresponsive for 5 seconds. A similar problem exists with DISMAN-TRACEROUTE-MIB.

Minimal master agent More and more code is running in the main agent. You cannot expect it to not block. But we could add a minimal master agent to the mix: it will handle only a few MIB modules by itself while most MIB modules will be delagated to a complete agent running as a subagent. Your own subagent will connect to the minimal master agent. It is quite easy to turn snmpd into a subagent: just use -X flag. We should also disable unwanted MIB modules for each agent with -I flag. For the minimal master agent, we only enable some modules. All other modules³ will be served by snmpd acting as a subagent.

$ MODS="snmp_mib,sysORTable,usmConf,usmStats,usmUser,vacm_conf,vacm_context,vacm_vars"
$ snmpd -Lsd -Lf /dev/null -u snmp -g snmp \
>   -C -c /etc/snmp/snmpd.master.conf \
>   -p /var/run/snmpd.master.pid \
>   -I $MODS
$ snmpd -Lsd -Lf /dev/null -u snmp -g snmp \
>   -p /var/run/snmpd.pid -X \
>   -I -$MODS

Access control configuration should be placed in /etc/snmp/snmpd.master.conf, as well as master agentx directive. Other directives (like pass, pass_persist, load, sysname, ) in /etc/snmp/snmpd.conf. The minimal master agent is very unlikely to block and while the ground cause is still here, it is now very much mitigated. You may extend this solution by splicing snmpd into several subagents: one handling safe modules, one handling pass and pass_persist stuff and a last one for unsafe modules (like DISMAN-PING-MIB).

---

1. agentx_reopen_session() will call agentx_close_session() and agentx_open_session(). agentx_register() and the following functions will be called by those two functions.
2. NETSNMP_DS_AGENT_AGENTX_TIMEOUT and NETSNMP_DS_AGENT_AGENTX_RETRIES variables are only used by the master agent, not by a subagent.
3. Use snmpd -Dmib_init -H to get the list of modules. You may want to add smux module to the master agent.

What is it? Last month I started what I am calling the LUV Hardware Library. It s a briefcase full of computer parts that are free to LUV members which I plan to bring to all LUV meetings [1]. The issue is that there is a lot of hardware which has no great value to people and is often excess to requirements but which is still somewhat expensive or difficult to obtain and thus transferring it from the people who don t need it to people who do provides a significant benefit to the recipient but no real cost to the donor. Currently my briefcase has a range of different types of DIMM, some PCI cards, some assorted cables, a laptop SATA disk, and a bunch of other random things. Most of the stuff has been in my spare parts pile for a year or two, but some of it has been donated by other people. What we Need The next thing we need is more packaging, anti-static bags for RAM and PCI cards, sealable bags for screws, and some way of storing motherboard batteries. In terms of hardware that can be donated one thing that would be really useful is SATA disks. I m sure that there are lots of people who have upgraded the storage of their computer and kept the old drive with no real chance of using it. But there are lots of people who need such disks, for example I ve been giving away a bunch of P4 systems which lack disks and are not cabled for IDE disks a supply of SATA disks would make them a lot more usable. Also any other random electronic stuff is of interest, including non-Linux things such as mobile phones (but only if not network locked). If you have something that s big or heavy to donate then contact me via email first. Other Options Computerbank does great work in rebuilding old PCs and selling them cheaply to worthy people [2], but most of the spare hardware I get is below the minimum specs that they will accept. I m not planning to compete with Computerbank in any way, I just want to provide a useful service to LUV members who want to upgrade their PC for free. I encourage other people to do the same at other LUG meetings!

• [1] http://luv.asn.au/
• [2] http://www.computerbank.org.au/

Related posts:

1. Donating old Hardware On a recent visit to my local e-waste disposal place...
2. Giving Away Hardware For the last few years I have been actively seeking...
3. Shelf-life of Hardware Recently I ve been having some problems with hardware dying. Having...