Now that CUPS 1.3 has built in zeroconf support, it is easier than ever to provide print service to Windows machines. You don’t even need Samba anymore. Here’s a quick way to setup a CUPS print server and a Windows client: On the server side First you need to install CUPS 1.3 or higher on your print server and setup the printer (the web interface makes this task dead easy). Zeroconf isn’t enabled by default so you have to browse the CUPS admin page (http://localhost:631/admin if you’re running it on localhost) and enable the “Share published printers connected to this system” option. “Change Settings” will restart CUPS and your printer should be instantly visible to zeroconf-aware applications in the local network. If you can’t or don’t want to use the web interface (which is the easiest way though), you can edit /etc/cups/cupsd.conf and replace the line Listen localhost:631 with Port 631 and add the line BrowseAddress @LOCAL Now save the changes and restart CUPS and you’re done. On the client side Since most Linux distributions and MacOS support zeroconf out of the box, I’ll just explain how to setup the Windows client. On the Windows side you’ll need to install Bonjour for Windows which is freely available on apple.com. Bonjour for Windows will enable Multicast DNS (mDNS) and DNS based Service Discovery (DNS-SD) on your Windows machine. Once it is installed, you can start the printer helper application provided by bonjour which will guide you through the process of installing the network printer. The only problem here was that although it correctly identified my printer, it only let me chose between a generic postscript and a PCL driver. Both were not working correctly so I had to manually change the driver for this printer to HP LaserJet 4 Plus (which is my printer) after the setup via the printer properties, where all other printer drivers where available again. That’s it! Now you should be able to print on every zeroconf aware operating system connected to your network. Oh, one final warning: With this setup, everybody in the LAN will be able to print without prior authentication. This should be what you want in most cases when running a home LAN or a small business LAN anyways, but it’s certainly not so cool when strangers have access to your network. The whole setup process took like 15 minutes today. I remember me a few years ago, not being very experienced with Samba and CUPS wasting a whole weekend to achieve the same result. Thanks apple for making life a bit easier again!

One situation that you will occasionally encounter when running a Heartbeat cluster is a need to prevent a STONITH of a node. As documented in my previous post about testing STONITH the ability to STONITH nodes is very important in an operating cluster. However when the sys-admin is performing maintenance on the system or programmers are working on a development or test system it can be rather annoying. One example of where STONITH is undesired is when upgrading packages of software related to the cluster services. If during a package upgrade the data files and programs related to the OCF script are not synchronised (EG you have two programs that interact and upgrading one requires upgrading the other) at the moment that the status operation is run then an error may occur which may trigger a STONITH. Another possibility is that if using small systems for testing or development (EG running a cluster under Xen with minimal RAM assigned to each node) then a package upgrade may cause the system to thrash which might then cause a timeout of the status scripts (a problem I encounter when upgrading my Xen test instances that have 64M of RAM). If a STONITH occurs during the process of a package upgrade then you are likely to have consistency problems with the OS due to RPM and DPKG not correctly calling fsync(), this can cause the OCF scripts to always fail to run the status command which can cause an infinite loop of the cluster nodes in question being STONITHed. Incidentally the best way to test for this (given the problems of a STONITH sometimes losing log data) is to boot the node in question without Heartbeat running and then run the OCF status commands manually (I previously documented three ways of doing this). Of course the ideal (and recommended) way of solving this problem is to migrate all services from a node using the crm_resource program. But in a test or development situation you may forget to migrate all services or simply forget to run the migration before the package upgrade starts. In that case the best thing to do is to be able to remove the ability to call STONITH . For my testing I use Xen and have the nodes ssh to the Dom0 to call STONITH, so all I have to do to remove the STONITH ability is to stop the ssh daemon on the Dom0. For a more serious test network (EG using IPMI or an equivalent technology to perform a hardware STONITH as well as ssh for OS level STONITH on a private network) a viable option might be to shut down the switch port used for such operations - shutting down switch ports is not a nice thing to do, but to allow you to continue work on a development environment without hassle it’s a reasonable hack. When choosing your method of STONITH it’s probably worth considering what the possibilities are for temporarily disabling it - preferably without having to walk to the server room.

Share This

debcheckout: some new bits Some new bits about debcheckout (talk is cheap, code here):

• authenticated mode. Consider svn (similar arguments stand for other VCS). When checking out alioth repositories using the svn:// prefix, the resulting local copy can't be committed to, since it would require (assuming you have an alioth account and the needed permissions) a svn+ssh:// access. "authenticated mode" is precisely for that: when checking out well-known repositories (only alioth's ATM) you can specify an extra "-a" argument, with an optional "-u" to specify your user name, and debcheckout will rewrite the repository URL so that the resulting local copy can be committed to. ATM authenticated mode works for svn, hg, bzr, git.
• destination dir. It is now possible to specify where do you want to check out a package repository (so that we avoid ending up with tons of anonymous "trunk" directories). The syntax is the common "debcheckout PKG DESTDIR" idiom and DESTDIR, if not provided, defaults to the package name. (Thanks to JoeyH for the idea and the initial patch.)
• sorry about arch, but ATM it's almost non-functioning, and I'm not willing to lose time on it, since among all the VCSs supported by debcheckout it's the only one I've never used. If you want support for it, please provide code!

(Perl) Tip of the day: Switch.pm With "use Switch;" you will win a switch statement for your Perl programs, which can be used as follows:

switch ($repo_type)  
  case "cvs"    my $module = pop @cmd; push @cmd, ("-d", $destdir, $module);  
  case /^(bzr darcs git hg svn)$/
                push @cmd, $destdir;  
  else   die "sorry, don't know how to set the destination directory for $repo_type repositories (patches welcome!)\n";  
 

This is far better than a chain of if/elsif statements and has even a sane semantics (e.g. no need of explicit breaks, possibility to have higher-case branches, ...). Unfortunately, it is not possible (using a simple syntax) to match a scalar value against an array case branch. Therefore the only way to factorize branches is (when possible) to rely on regexp alternative branches, as it is done in the code snippet above.

The availability of IPv6 worldwide is surprisingly extensive, nowadays, but over the past years as it has slowly filtered around, people have had bad experiences with it because of poor routing. It seems that, as always, a bad rep travels about 20 times further than a good one, so an automatic response to casual problems that people see when using IPv6 is to blacklist it, without actually investigating the problem. Take today, for an example. Someone said to me "I disabled IPv6 in Firefox because it was slow for one of my favourite sites". OK, so show me this favourite site. Show me the traceroute. Give me some facts! Further investigation showed that although there is an AAAA record for www.crooksandliars.com, there is nothing listening on the other end! Looking at the AAAA record returned, we see that it is an autoconfigured IPv6 address of the form xxxx:xxxx:xxxx:xxxx:xxxx:xxFF:FExx:xxxx and can conjecture that the likely problem is that someone has done a hardware upgrade on their server, so they now have a different MAC, and consequently the autoconfigured IPv6 address has changed. Other scenarios are entirely possible, of course, but this is a likely one. This is the second case I have seen where someone was running publicly available services on IPv6 using a manual DNS record pointing at an automatic IPv6 address, but I doubt that it will be the last. Unless there is infrastructure in place to automatically update your DNS when your address is autoconfigured, you are going to get bitten by this problem at some point if people remotely connect to your system for some service.

Eurosport are broadcasting the Vuelta a Burgos at 19 east until Saturday. This can be an interesting race for seeing how well the ProTour teams are recovering from the Tour de France, ready for the Vuelta a Espa a. Barloworld's TdF revelation Juan Mauricio Soler has a 17-second lead into tomorrow's individual time trial. The 69th Volta a Portugal finished yesterday with an ~50-minute individual time trial that saw the lead change hands and Xavier Tondo of LA/MSS take the General Classification by a little under a minute. RTP's coverage was strangely subdued. It seemed like they only had cameras around the finish line, not on motorbikes following the riders. The bad weather may have caused that, though. Meanwhile, the Deutschland-Tour 2007 is broadcast to Europe until Saturday on ARD at 19 east and 13 east. Gerald Ciolek of T-Mobile won his second stage in a row today, while CSC's ever-popular Jens Voigt remains in yellow. Individual time trial there too tomorrow. ARD's coverage has been very swish so far this year. Widescreen with informative graphics, although the commentary is still a bit subdued for my taste. Overall, it's a shame there's not more airtime given to it.

In the IP protocol stack the lowest level protocol is ARP (the Address Resolution Protocol). ARP is used to request the Ethernet hardware (MAC) address of the host which owns a particular IP address. # arping 192.168.0.43
ARPING 192.168.0.43
60 bytes from 00:60:b0:3c:62:6b (192.168.0.43): index=0 time=339.031 usec
60 bytes from 00:60:b0:3c:62:6b (192.168.0.43): index=1 time=12.967 msec
60 bytes from 00:60:b0:3c:62:6b (192.168.0.43): index=2 time=168.800 usec
— 192.168.0.43 statistics —
3 packets transmitted, 3 packets received, 0% unanswered One creative use of this is the program arping which will send regular ARP request packets for an IP address and give statistics on the success of getting responses. The above is the result of an arping command which shows that the machine in question can respond in 12.9msec or less. One of the features of arping (when compared to the regular ping which uses an ICMP echo) is that it will operate when the interface has no IP address assigned or when the IP address does not match the netmask for the network in question. This means that if you have a network which lacks DHCP and you want to find a spare IP address in the range that is used then you can use arping without assigning yourself an IP address first. If you wanted to use ping in that situation then you would have to first assign an IP address in which case you may have already broken the network! Another useful utility is arpwatch. This program listens to ARP traffic and will notify the sys-admin when new machines appear. The notification message will include the Ethernet hardware address and the name of the manufacturer of the device (if it’s known). When you use arpwatch you can say “who added the device with the Intel Ethernet card to the network at lunch time?” instead of “who did something recently to the network that made it break?”. The more specific question is more likely to get an accurate answer.

Share This

In the IP protocol stack the lowest level protocol is ARP (the Address Resolution Protocol). ARP is used to request the Ethernet hardware (MAC) address of the host which owns a particular IP address. # arping 192.168.0.43
ARPING 192.168.0.43
60 bytes from 00:60:b0:3c:62:6b (192.168.0.43): index=0 time=339.031 usec
60 bytes from 00:60:b0:3c:62:6b (192.168.0.43): index=1 time=12.967 msec
60 bytes from 00:60:b0:3c:62:6b (192.168.0.43): index=2 time=168.800 usec
— 192.168.0.43 statistics —
3 packets transmitted, 3 packets received, 0% unanswered One creative use of this is the program arping which will send regular ARP request packets for an IP address and give statistics on the success of getting responses. The above is the result of an arping command which shows that the machine in question can respond in 12.9msec or less. One of the features of arping (when compared to the regular ping which uses an ICMP echo) is that it will operate when the interface has no IP address assigned or when the IP address does not match the netmask for the network in question. This means that if you have a network which lacks DHCP and you want to find a spare IP address in the range that is used then you can use arping without assigning yourself an IP address first. If you wanted to use ping in that situation then you would have to first assign an IP address in which case you may have already broken the network! Another useful utility is arpwatch. This program listens to ARP traffic and will notify the sys-admin when new machines appear. The notification message will include the Ethernet hardware address and the name of the manufacturer of the device (if it’s known). When you use arpwatch you can say “who added the device with the Intel Ethernet card to the network at lunch time?” instead of “who did something recently to the network that made it break?”. The more specific question is more likely to get an accurate answer.

Share This

Michael Hirschorn in this month’s Atlantic reduces my generation’s entire cultural zeitgeist to a single word: quirk.

Quirk, loosed from its moorings, quickly becomes exhausting. It s easy for David Cross s character on Arrested Development to cover himself in paint for a Blue Man Group audition, or for the New Zealand duo on Flight of the Conchords to make a spectacularly cheesy sci-fi video about the future while wearing low-rent robot costumes. But the pleasures are passing. Like the proliferation of meta-humor that followed David Letterman and Jerry Seinfeld in the 90s, quirk is everywhere because quirkiness is so easy to achieve: Just be odd but endearing. It becomes a kind of psychographic marker, like wearing laceless Chuck Taylors or ironic facial hair a self-satisfied pose that stands for nothing and doesn t require you to take creative responsibility. Just because you can doesn t mean you should.

Hirschorn makes a fair point which, I think, can be restated that much of the content I enjoy is really just candy. The Atlantic seems to have recently figured out its readership (or at least figured out me). Hard to Swallow (by B.R. Myers, who more typically writes about Korean issues) is a pointed moral critique of modern food lovers (chowhounds?) and food writing (including Michael Pollan’s The Omnivore’s Dilemma: A Natural History of Four Meals, much read by my contemporaries). If I weren’t already a vegetarian, I might take umbrage. “Insider baseball” pieces on Karl Rove and Michael Gerson are also excellent, and in the case of the former quite timely. To wrap up this encomium, props to the magazine for its clean new website design, which I believe premiered today, and for including an embedded Youtube video in the online version of the quirk article.

Share This

I read an interesting post on Advogato about IT recruiting agencies (along with an interesting preface about medical treatment for broken ribs). Their report closely mirrored my experience in many ways. Here are what I consider to be the main points for a job applicant dealing with recruiters:

1. Ask more than you believe that you are worth - the worst they can do is say “no” (and you will feel like a fool if the agency pays you less than half what the client pays because you didn’t ask for enough).


2. Put lots of terms in your CV that will work for grep or other searches. A human who reads your CV will know that if you describe 3 years of Linux sys-admin experience that you can do BASH shell scripting and sys-admin work on other versions of Unix. But if a search doesn’t match it then the typical recruiting agent won’t offer you the position. I have idly considered saying things like “Perl (not Pearl) experience” to catch mis-spelled grep operations.


3. Recruiting agents will frequently demand that you re-write your CV to match a position that they have open, they will say things such as “you claim 3 years of shell scripting and Perl experience but I don’t see that on your CV” and insist that you re-write it to give more emphasis to that area.


4. Most recruiting agents are compulsive liars and don’t understand computers, you have to deal with the fact that to get most of the better paying positions you need to have an incompetent liar represent you. Avoid the stupid liars though. For example I once refused to deal with an agent who told me about his plans for stealing the CV database from the agency he worked for and selling it to another agency - not because he was shifty in every possible way, but because he was so stupid as to boast about such things immediately after meeting me on a train.


5. Expect that recruiting agents won’t understand the technology. If you politely and subtly offer to assist them in writing a letter to a client recommending you then they will often accept. Why would they go to the effort of assessing your skills and writing a short letter to the client describing how good you are when you can do that for them? On one particularly amusing occasion I was applying for a position with IBM and the recruiting agent had been supplied with a short quiz of technical skills to assess all applicants - they gave me the answer sheet and asked me to self-assess (I got 100% - but it was an easy test and I would have got the same result anyway).


6. Some levels of stupidity are so great that you should avoid dealing with the agent (and possibly the agency that employs them). Being unable to view a HTML file is one criteria I have used since 1999 (every OS since about 1998 came with a web browser built in). Another example is an agent who tried to convince me that “.au” is not a valid suffix for an email address (I was applying for a sys-admin job with an ISP). Job adverts that mis-spell terms (such as Perl spelled at Pearl) are also a warning sign.


7. Gossip is important to your business! Some agencies will pay you what you earn and merely terminate your contract when things go wrong. Other agencies will refuse to pay you when things go bad, or even demand that paid money be returned and threaten legal action. Talk to other contract workers in your region and learn the goss about the bad agencies. Also track agency name changes, when a bad agency changes name don’t be fooled.

When applying for a position advertised by an agency you will ideally start by seeing an advert with a phone number and an email address. The best strategy in that case seems to be to send your CV with a brief cover letter and then about 5 minutes after your mail server sends the message to their mail server you phone them. I found that I got a significantly higher success rate (in terms of having the agent send my CV to the client) if I phoned them when my CV arrived. Sometimes a fax number is advertised, unless there is some problem that prevents sending a document via email (such as the agency having a broken mail server) then do not FAX them. A faxed document will have to be faxed on to the client and will look bad after the double-fax operation and will prevent the agent from grepping it. Rumor has it that agents will often post fake adverts for the purpose of collecting CVs (so that they can boast to clients In most situations a recruiting agent should insist on meeting you for an interview before sending your CV to a client. The only exception is if you are applying for a job in another country. Meeting an agent at a restaurant or other public place is not uncommon (often they want to meet you while travelling between other locations and sometimes their main office is not in a good location). I suspect that some agencies start with a “virtual office” and perform all their interviews in public places (this doesn’t mean that they will do a worse job than the more established agencies). If an agent is prepared to recommend you to a client without meeting you then they are not doing their job properly. It used to be that there were enough agencies pretending to do their job that you could ignore the agencies that will recommend any unseen candidate. But now an increasing number of agencies do this and if you want a contract you may have to deal with them. When an agency has a fancy office keep in mind that they paid for it by taking money from people like you! For contract work a recruiting agent is not your friend, they make their money by getting you to accept less money than the client pays them - the less they pay you the more money they make. A common claim is “we only take a fixed percentage of what the client pays”, but when you ask what that percentage is they refuse to answer - I guess that the fixed percentage is 50% or as close to it as they can manage.

Share This

I read an interesting post on Advogato about IT recruiting agencies (along with an interesting preface about medical treatment for broken ribs). Their report closely mirrored my experience in many ways. Here are what I consider to be the main points for a job applicant dealing with recruiters:

1. Ask more than you believe that you are worth - the worst they can do is say “no” (and you will feel like a fool if the agency pays you less than half what the client pays because you didn’t ask for enough).


2. Put lots of terms in your CV that will work for grep or other searches. A human who reads your CV will know that if you describe 3 years of Linux sys-admin experience that you can do BASH shell scripting and sys-admin work on other versions of Unix. But if a search doesn’t match it then the typical recruiting agent won’t offer you the position. I have idly considered saying things like “Perl (not Pearl) experience” to catch mis-spelled grep operations.


3. Recruiting agents will frequently demand that you re-write your CV to match a position that they have open, they will say things such as “you claim 3 years of shell scripting and Perl experience but I don’t see that on your CV” and insist that you re-write it to give more emphasis to that area.


4. Most recruiting agents are compulsive liars and don’t understand computers, you have to deal with the fact that to get most of the better paying positions you need to have an incompetent liar represent you. Avoid the stupid liars though. For example I once refused to deal with an agent who told me about his plans for stealing the CV database from the agency he worked for and selling it to another agency - not because he was shifty in every possible way, but because he was so stupid as to boast about such things immediately after meeting me on a train.


5. Expect that recruiting agents won’t understand the technology. If you politely and subtly offer to assist them in writing a letter to a client recommending you then they will often accept. Why would they go to the effort of assessing your skills and writing a short letter to the client describing how good you are when you can do that for them? On one particularly amusing occasion I was applying for a position with IBM and the recruiting agent had been supplied with a short quiz of technical skills to assess all applicants - they gave me the answer sheet and asked me to self-assess (I got 100% - but it was an easy test and I would have got the same result anyway).


6. Some levels of stupidity are so great that you should avoid dealing with the agent (and possibly the agency that employs them). Being unable to view a HTML file is one criteria I have used since 1999 (every OS since about 1998 came with a web browser built in). Another example is an agent who tried to convince me that “.au” is not a valid suffix for an email address (I was applying for a sys-admin job with an ISP). Job adverts that mis-spell terms (such as Perl spelled at Pearl) are also a warning sign.


7. Gossip is important to your business! Some agencies will pay you what you earn and merely terminate your contract when things go wrong. Other agencies will refuse to pay you when things go bad, or even demand that paid money be returned and threaten legal action. Talk to other contract workers in your region and learn the goss about the bad agencies. Also track agency name changes, when a bad agency changes name don’t be fooled.

When applying for a position advertised by an agency you will ideally start by seeing an advert with a phone number and an email address. The best strategy in that case seems to be to send your CV with a brief cover letter and then about 5 minutes after your mail server sends the message to their mail server you phone them. I found that I got a significantly higher success rate (in terms of having the agent send my CV to the client) if I phoned them when my CV arrived. Sometimes a fax number is advertised, unless there is some problem that prevents sending a document via email (such as the agency having a broken mail server) then do not FAX them. A faxed document will have to be faxed on to the client and will look bad after the double-fax operation and will prevent the agent from grepping it. Rumor has it that agents will often post fake adverts for the purpose of collecting CVs (so that they can boast to clients In most situations a recruiting agent should insist on meeting you for an interview before sending your CV to a client. The only exception is if you are applying for a job in another country. Meeting an agent at a restaurant or other public place is not uncommon (often they want to meet you while travelling between other locations and sometimes their main office is not in a good location). I suspect that some agencies start with a “virtual office” and perform all their interviews in public places (this doesn’t mean that they will do a worse job than the more established agencies). If an agent is prepared to recommend you to a client without meeting you then they are not doing their job properly. It used to be that there were enough agencies pretending to do their job that you could ignore the agencies that will recommend any unseen candidate. But now an increasing number of agencies do this and if you want a contract you may have to deal with them. When an agency has a fancy office keep in mind that they paid for it by taking money from people like you! For contract work a recruiting agent is not your friend, they make their money by getting you to accept less money than the client pays them - the less they pay you the more money they make. A common claim is “we only take a fixed percentage of what the client pays”, but when you ask what that percentage is they refuse to answer - I guess that the fixed percentage is 50% or as close to it as they can manage.

Share This

There was a time that a small-ish (ca. 70 office workplaces) company bought almost all of its IT products from Dell, with 3 year on-site warranty to be on the safe side. There was a time when all was well and, in the rare cases that something needed to be replaced, a gentlemen would arrive and magically fix all that needed fixing. There was also a time, a bit later, when this enterprise wishes it could get rid of all the remaining Dell devices immediately (but of course you don't buy 100-odd desktops, servers and printers just because you no longer like the vendor.) One, if I buy a 4h-reaction-time warranty contract and tell them that I have a problem and that probably a part needs replacing, I don't expect to have to play ticket ping pong for a whole week until they agree that there even is a problem. Two, if there is a problem with a range of computers (leaking condensers) and more than half of our workstations are affected, I'd expect Dell to care about this and be at least ready to discuss mass-replacing the faulty motherboards in one go instead of having to send a tech every three days for yet another case of this problem. I'd think it's cheaper for them as well.... Three, not that I really care, since it's covered under warranty so I don't pay for it, but if I have two defective computers at the same site I'd expect one tech to fix them both, not two techs to come out (missing each other by 5 min) to fix one computer each. Again, you'd think they'd do the maths on how much these techs cost. Four, wouldn't it be nice if you could buy two laser printers and the toner cartridges would even be the same? HP, for example, manages to use the same toner cartridges for a whole range of printer models. Dell apparently can't do this. (Admittedly, I've only seen it in the case of the 5100cn/5110cn printers, and sometimes there are reasons to change the toner cartridges. But then I'd expect the printer model to be significantly different. Those two printers look exactly the same from outside, and the innards also look identical at first glance, including the toner cartridges, except for some coded plastic pieces ensuring that the cartridges don't match.) Five, wouldn't it be nice if toner cartridges could be bought at your regular office supply store, where we buy every other brand of cartridges? No, of course nobody but Dell themselves sells Dell supplies. Since supplies are not dealt with by IT stuff, this is really annoying. Especially beacuse Dell has repeatedly, for unclear reasons, disabled our login to the Dell online store (and we can't just create a new login as we have special discounts, so our account needs some special handling.) Six, how long is the usual life expectancy of a Laptop battery? For the Inspiron 9300 80Wh and the 53Wh battery, it's apparently 18 months, after which the battery doesn't charge anymore or only holds power for 2 minutes. Dell customer support confirms this is normal behaviour for these batteries and this is not covered under warranty accordingly. What now? Printers: HP. Desktops, Displays and Laptops: Lenovo. Servers: IBM. Network Switches: D-Link. Not sure if these choices are ok, but so far we've had less problems than with Dell. But of course the Dell stuff is older and so more prone to failure, so probably we'll just have to re-evaluate 3 years from now.

The API for asynchronous device communication under Linux is totally on crack. The only notification for completed requests is a realtime signal (for which there seems to be no allocation method -- let's hope that everyone else in the process checks whether a signal is set to "default" before using it); however these are difficult to get synchronised into your event loop. It appears as if people are supposed to write kernel modules instead of talking to USB devices from userspace. I wonder if that is desired, since having a stable userspace API would make writing closed-source drivers easier; however I see a kernel driver as overkill in most cases -- all it ever does is copy data around. Maybe it would make sense to have a simple template driver that can be set up with a request from userspace and some udev trick.

Jonathan McDowell wonders how to take aptitude’s knowledge about auto-installed packages from one computer to the other. Well, I looked into the issue for a few minutes and I found a solution though it doesn’t look nice.

for i in
    # grep installed package names
     COLUMNS=200 dpkg -l   grep -E '^ii'  awk ' print $2 ;'  
do
    # find package in /var/lib/aptitude/pkgstates
    # check for the right state (1 seems to mean
    # auto-installed, 3 manually installed)
    if
        grep-available -s Package,State 
                       -F Package 
                       -X $i /var/lib/aptitude/pkgstates  
          grep -q 'State: 1'
    then
            echo $i
    fi
done

Results in a list of auto-installed packages AFAICT. If you change the “State: 1″ into “State: 3″, it seems you get only manually installed packages. So if you take the latter and feed it to “aptitude install”, your database should be right. If you take the former, you feed the list to “aptitude markauto”. A cleaner solution (which works even if /var/lib/aptitude/pkgstates changes formats) would involve checking “aptitude show” output, evaluating the “Automatically installed:” field. However, simply feeding “aptitude show” output to grep-dctrl (or any equivalent) resultes in the rather irritating error message “grep-dctrl: -:14: expected a colon.”, with the 14 changing to a different line in the packages description (usually a line directly following an empty line). So I’m just giving you an idea here.

Share This

I have previously blogged about Ethernet bonding on Red Hat Enterprise Linux. Now I have a need to do the same thing on Debian Etch - to have multiple Ethernet links for redundancy so that if one breaks the system keeps working. The first thing to do on Debian is to install the package ifenslave-2.6 which provides the utility to manage the bond device. Then create the file /etc/modprobe.d/aliases-bond with the following contents for a network that has 10.0.0.1 as either a reliable host or important router. Note that this will use ARP to ping the router every 2000ms, you could use a lower value for a faster failover or a higher value
alias bond0 bonding
options bond0 mode=1 arp_interval=2000 arp_ip_target=10.0.0.1 If you want to monitor link status then you can use the following options line instead, however I couldn’t test this because the MII link monitoring doesn’t seem to work correctly on my hardware (there are many Ethernet devices that don’t work well in this regard):
options bond0 mode=0 miimon=100 Then edit the file /etc/network/interfaces and inset something like the following (as a replacement for the configuration of eth0 that you might currently be using). Note that XX:XX:XX:XX:XX:XX must be replaced by the hardware address of one of the interfaces that are being bonded or by a locally administered address (see this Wikipedia page for details). If you don’t specify the Ethernet address then it will default to the address of the first interface that is enslaved. This might not sound like a problem, however if the machine boots and a hardware failure is experienced which makes the primary Ethernet device not visible to the OS (IE the PCI card is dead but not killing the machine) then the hardware address of the bond would change, this might cause problems with other parts of your network infrastructure.
auto bond0
iface bond0 inet static
pre-up modprobe bond0
hwaddress ether XX:XX:XX:XX:XX:XX
address 10.0.0.199
netmask 255.255.255.0
gateway 10.0.0.1
up ifenslave bond0 eth0 eth1
down ifenslave -d bond0 eth0 eth1 There is some special support for bonding in the Debian ifup and ifdown utilities. The following will give the same result as the above in /etc/network/interfaces:
auto bond0
iface bond0 inet static
pre-up modprobe bond0
hwaddress ether 00:02:55:E1:36:32
address 10.0.0.199
netmask 255.255.255.0
gateway 10.0.0.1
slaves eth0 eth1 The special file /proc/net/bonding/bond0 can be used to view the current configuration of the bond0 device. In theory it should be possible to use bonding on a workstation with DHCP, but in my brief attempts I have not got it working - any comments from people who have this working would be appreciated. The first pre-requisite of doing so is to use either MII monitoring or broadcast (mode 3), I experimented with using options bond0 mode=3 in /etc/modprobe.d/aliases-bond but found that it took too long to get the bond working and dhclient timed out. Thanks for the howtoforge.com article and the linuxhorizon.ro article that helped me discover some aspects of this. Update: Thanks to Guus Sliepen on the debian-devel mailing list for giving an example of the slaves directive as part of an example of bridging and bonding in response to this question.

Share This

I have previously blogged about Ethernet bonding on Red Hat Enterprise Linux. Now I have a need to do the same thing on Debian Etch - to have multiple Ethernet links for redundancy so that if one breaks the system keeps working. The first thing to do on Debian is to install the package ifenslave-2.6 which provides the utility to manage the bond device. Then create the file /etc/modprobe.d/aliases-bond with the following contents for a network that has 10.0.0.1 as either a reliable host or important router. Note that this will use ARP to ping the router every 2000ms, you could use a lower value for a faster failover or a higher value
alias bond0 bonding
options bond0 mode=1 arp_interval=2000 arp_ip_target=10.0.0.1 If you want to monitor link status then you can use the following options line instead, however I couldn’t test this because the MII link monitoring doesn’t seem to work correctly on my hardware (there are many Ethernet devices that don’t work well in this regard):
options bond0 mode=0 miimon=100 Then edit the file /etc/network/interfaces and inset something like the following (as a replacement for the configuration of eth0 that you might currently be using). Note that XX:XX:XX:XX:XX:XX must be replaced by the hardware address of one of the interfaces that are being bonded or by a locally administered address (see this Wikipedia page for details). If you don’t specify the Ethernet address then it will default to the address of the first interface that is enslaved. This might not sound like a problem, however if the machine boots and a hardware failure is experienced which makes the primary Ethernet device not visible to the OS (IE the PCI card is dead but not killing the machine) then the hardware address of the bond would change, this might cause problems with other parts of your network infrastructure.
auto bond0
iface bond0 inet static
pre-up modprobe bond0
hwaddress ether XX:XX:XX:XX:XX:XX
address 10.0.0.199
netmask 255.255.255.0
gateway 10.0.0.1
up ifenslave bond0 eth0 eth1
down ifenslave -d bond0 eth0 eth1 There is some special support for bonding in the Debian ifup and ifdown utilities. The following will give the same result as the above in /etc/network/interfaces:
auto bond0
iface bond0 inet static
pre-up modprobe bond0
hwaddress ether 00:02:55:E1:36:32
address 10.0.0.199
netmask 255.255.255.0
gateway 10.0.0.1
slaves eth0 eth1 The special file /proc/net/bonding/bond0 can be used to view the current configuration of the bond0 device. In theory it should be possible to use bonding on a workstation with DHCP, but in my brief attempts I have not got it working - any comments from people who have this working would be appreciated. The first pre-requisite of doing so is to use either MII monitoring or broadcast (mode 3), I experimented with using options bond0 mode=3 in /etc/modprobe.d/aliases-bond but found that it took too long to get the bond working and dhclient timed out. Thanks for the howtoforge.com article and the linuxhorizon.ro article that helped me discover some aspects of this. Update: Thanks to Guus Sliepen on the debian-devel mailing list for giving an example of the slaves directive as part of an example of bridging and bonding in response to this question.

Share This

I'm worried that my Debian Planet credentials are a bit weak, so have a technical post rather than one discussing the fact I'm unemployed in 3 days, or that I'm going back to NI for a week after that to try and get the new house sorted. Oh. Wait. Ooops. Anyway. While I still have easy datacentre access to my colo box (the.earth.li) I thought it might be a good time to think about upgrading it. The most limited resource has been disk space; it was a Dell 2550, so dual PIII-1GHz + 2GB RAM which is nice, but SCSI hotswap drive bays. So nice disk, but anything large is expensive. I think SATA has come along nicely, so was happy to change over to using that instead. As it turned out the old machine was over 5 years old (doesn't time fly!) so there's been a disk performance boost anyway from using new technology. I ended up buying the new machine from Sentral - their website isn't great, but they're very helpful by email and Black Cat had bought machines from them in the past with no problems. It's a Core2Duo E6600 with 4GB RAM and 2 * 750GB Seagate ES SATA II drives in hot swap bays. I pondered a quad core chip and an extra drive (there are 4 bays total), but decided I didn't really need them at present and keeping power consumption down was a good idea. Last time I upgraded the I just did a straight copy of the data over to the new disks. This time there were a couple of things that meant I didn't want to do this. Firstly, I decided to go 64 bit. The chip can do it, I have 4GB RAM, it seemed like a good idea. That meant a dpkg --get-selections on the old box followed by a dpkg --set-selections on the new one, followed by an apt-get dselect-upgrade. Is there a way I could have kept my aptitude knowledge about auto installed packages? I did have a look, but didn't see anything obvious. That gave me the same packages. I also installed ia32-libs to ease the transition for my users who had self compiled bits. Then I had to copy the rest of the data over. /home was easy enough, plus a few other filesystems that didn't have packaged data on them. I manually reviewed changes in /etc but there wasn't anything non obvious thankfully. /var was trickier. I was pleased to discover that Mailman config appears to cross archs quite happily. A pg_dumpall did the trick for PostgreSQL. Rebuilding the overview database for inn took all night. Maybe I should move away from tradspool. There were a few other things to fix up (I hate Berkeley DB), but by and large it wasn't as bad as it could have been. Oh, except that copying that much data across takes a long time. And rsync isn't that much help when the data includes lots of mail folders, some of which are over 1G big (and receiving mail, so constantly changing). I'd started out with a 100M link between the old and new machines, as I hit the e1000 Tx Unit Hang bug. Disabling the power management solved that, giving a 1G link. Still took ages. The second major change with the new box is I've decided to go Xen. That should let me hand out machine slices to users who want to do weird stuff, without me really having to support them. And allow me to throw up test machines when I need to. This was actually really easy to install. I did a basic etch install onto a 2G partition, installed xen-linux-system-2.6.18-4-xen-amd64 and then rebooted and had a dom0 up and running. I gave the main VDS (ie replacement the) a 600G partition, access to both processor cores and 2G of RAM - ie still quite a few more resources than it used to have. Then it got a bit tricky. I wanted lvm to be available within the VDS. So I did all the VG creation and a base install (using debootstrap) from the dom0, then added a filter to /etc/lvm/lvm.conf to exclude /dev/md2 (the 600G partition). And tried to boot the domU. Which was fine, until it tried to mount the root fs at which point the initramfs complained it couldn't find / and bombed out to a shell. The confusing bit was that doing vgcreate -a y found and brought up the lvm partitions fine, at which point the rest of the boot process would complete. Very odd. Much digging eventually led me to discover that the LVM initramfs script only gets run if the specified root partition has a - in it. Argh! I prefer the format /dev/<vgname>/<lvname>, but once I changed to /dev/mapper/<vgname>-<lvname> it all worked fine. The new machine has been in service for the past week and so far it all seems fine. I don't notice the fact it's a Xen instance and it still feels quite nippy. Plus the extra disk space is great as I don't have to worry so much about things getting full. Yet. I haven't noticed a change with the 64 bit side either, but I think on a server that's going to be much more the case - I haven't moved my desktop to 64 bit primarily due to the lack of Flash and Java plugins (I don't see the point of a chroot as there's not really a pressing reason to go 64 bit if it's going to be hassle). I threw up another domU instance to test out some bits and that went smoothly too (I'm using an LVM VG on the dom0 to share out to the other domUs, which will all have a less complicated setup than the main one). So all in all I'm pleased with both the hardware, and the software - I hadn't expected setting it up to be so easy. My last Xen experience was under sarge where it hadn't all been integrated in the same way as it is under etch. Oh, one other thing I did; I rebuilt the AMD64 netinst Etch CD to output to the serial console for both isolinux and the actual installer. And then did the install over the serial console, even though the machine was beside me. The CD is still in the machine which means that I have a fallback if it all falls over horribly - I can access the BIOS, tell the machine to boot from CD and then hopefully prod and see what the issue is. Or even do a complete reinstall if necessary. It was surprising easy to modify - I just had to edit isolinux/isolinux.cfg and add SERIAL 0 9600 at the start and then console=ttyS0,9600 cdrom-detect/eject=false to the append lines for kernel parameters. Definitely worth considering if you have a colo box properly serial consoled up.

Recently I've been using Remember the Milk to remind me to do stuff. In the past I had used the service briefly on my search for an online GTD tool. I discarded it because it was too hard then to add new lists, which I had planned to use for each project. I also was turned off by it because I wasn't keen on requiring the Internet to work.

A couple of events has recently made this decision change. The first thing that happened was my addition of messaging to my cell phone plan. I did it mainly to interact with Twitter while I was on the road. It's something I never saw myself using before, but now that I am, it is really nifty and I can see why people use it from their phones.

However, with their recent introduction of a Twitter bot, it is now much more useful. The bot lets me add things to my Inbox list from anywhere, unchaining me from the Internet. All I have to do is text 'd rtm whatever' to twitter and it automatically adds a item to my inbox, which is where I keep everything I need to do. I have it setup as a template in my phone, so that I can even avoid typing the 'd rtm ' part. Remember The Milk also has notification settings for phones, so at the beginning of the day it will message me with the things due that day. Having it turned on reminds me to do most things, because I check my phone quite often, even though I don't get any calls.

I've stopped trying to use the lists for separate projects. I now use the Inbox as a main list, not caring how long it gets. I also have separate lists for categories of things that I'd like to do, but I don't care what order or when they get done. For example, I have a list for the pizza places that Diana and I might go to on our pizza place tour of the cities. I also have a list of cheaper and more expensive restaurants that we haven't been to, so when we want to go out to eat somewhere but can't decide where, we can just grab one off of the list. Remember the milk is particularly decent for lists like the two described because you can associate a geographical location with any element on a list, so I can see where the restaurants are instead of having to look them up.

There is one special list that I keep which isn't of the two types above - the projects list. This is the list of projects that I have committed myself to. It has one entry for each project, with a note on each entry explaining the past-tense result of the project. It is used in my weekly review, in order to populate the list if I have for some reason marked off a part of the project and not added a task for the next action in the project. I find that it keeps me honest because I can't mark off something from here until the past-tense description has actually come true.

Generally my workflow now goes like this. I add the task to my Inbox list either from the road or from the web interface. Then it gets moved to a special list if it is of a special class like the "Eating out" or "Pizza Places" lists. If it has more than three or four steps, I will put it on the project list instead and create a new task on the Inbox list that is doable and is the logical next action for the list. When I do something, it gets crossed off the list and then I go on to the next item. I know that if I don't have anything left to do on that day in remember the milk, I can just do random stuff from farther down on the list without a due date.

I've been doing this for a couple weeks now and its working out just fine. I was happy to have everything work out together so that I could use Twitter and Remember the milk, and I am being more productive than any other system that I've tried. This may just be an example of Using What Works. I thought I would share just in case it can help someone else find their workflow to get things done.

Comments: (1) Trackbacks: (0)

Comments

1. ewtikins: Thank you for this! I will definitely look into it. I have been trying to figure out a way to use online list-making and todo-list facilities without being unable to edit when I'm away from internet for a while, and this sounds like it might just do the trick.
   #1 2007-08-13 01:19 (Reply)

Trackbacks

1. No Trackbacks

If you ever looked at ikiwiki but gave it a pass since plugins had to be written in perl, you might want to look at it again now. Today I added support to ikiwiki for plugins written in any language that supports XML RPC. Ikiwiki's external plugins are just standalone executables, that talk XML RPC on stdio. I think that works pretty well. The overhead of XML RPC doesn't matter too much in this case, since RPCs arn't done all that often. The entire ikiwiki programming interface is accessible, except for a couple functions that use perl objects. I even added the ability to inject an arbitrary procedure from the external plugin into perl, so ikiwiki can call it like a regular perl function. This can even be used to override one of ikiwiki's functions with a version written in another language. Even parts of ikiwiki that don't use a defined plugin interface, like the RCS modules, can be written in other languages using this. Now I only have to find time to learn enough haskall so I can write ikiwiki plugins using it. :-)

Inspired by Joey's similar page, I composed a list of programming languages that I know (or, in some cases: programming languages that I once knew).

One thing i love about munin is the simpleness with which you can enhance it. I got a new ADSL Modem for my internet connection a few days ago, as I will upgrade the connection soon and the old stuff wouldn’t be able to handle the new settings. And this new modem appears to have a webinterface. Totally useless with a password protection - you can’t do anything there, just look at one info screen. Well, this screen provides a summary of the connection, which is the connection speed, signal noise ratio and attenuation, splitted by up- and downlink. Getting nice munin graphs out of this is plain simple. I bet it could be done without the additional perl module usage, but I didn’t care about that, its simple enough the way it is and just works: In case you got one of those “Telekom Speedport 200” AKA “Tecom Tiny Bridge DSL Modem” too you may want to fetch the script and have fun. Just link it into the munin plugins dir as dsl_[rate snr attenuation] and restart munin-node. A few mins later graphs should appear. In case you improve it (its a quick hack only) I would love to get some patches. :)