cloud engineer
How to create a swap file.
A 2GB swap file.
dd if=/dev/zero of=/swapfile bs=1k count=2048k |
Activate.
mkswap /swapfile chmod 0600 /swapfile systemctl daemon-reload swapon /swapfile |
To make swap permanent, add to /etc/fstab.
/swapfile swap swap defaults 0 0 |
Check if swap is working.
cat /proc/swaps free -h |
How to reinstall the latest kernel and rebuild initramfs.
Find the latest kernel.
rpm -qa kernel
kernel-3.10.0-1160.6.1.el7.x86_64
kernel-3.10.0-1160.11.1.el7.x86_64 |
Remove the kernel first, then reinstall.
yum remove kernel-3.10.0-1160.6.1.el7.x86_64 yum install kernel-3.10.0-1160.6.1.el7.x86_64 |
Here are a few utilities that monitor disk I/O performance.
iostat -d 5 pidstat -dl 20 iotop --only |
The alternative is atop, which you can set to run every 10 seconds for 3 hours. The output can be viewed later.
atop -a -w logfile.atop 10 10800 & |
Use atop to read the log file.
atop -r /path/to/logfile.atop |
Here’s the script to install Jekyll on Amazon Linux 2.
#!/bin/bash sudo hostnamectl set-hostname jekyll sudo yum update -y sudo amazon-linux-extras install ruby2.4 -y sudo yum install ruby ruby-devel -y sudo yum groupinstall "Development Tools" -y sudo gem install bundler sudo gem install rdoc sudo gem update --system sudo gem install jekyll jekyll new myblog |
To start the Jekyll server.
cd mysite jekyll build jekyll serve --host 0.0.0.0 |
Open your browser and point it to the external IP of your instance on port 4000.
http://xxx.xxx.xxx.xxx:4000 |
You may to edit your security group to allow ingress 4000 from 0.0.0.0/0.
Check if package is on system.
rpm -q httpd httpd-2.4.6-97.el7.centos.x86_64 |
Check the history logs.
yum history list Loaded plugins: fastestmirror ID | Login user | Date and time | Action(s) | Altered ------------------------------------------------------------------------------- 115 | System <unset> | 2021-02-01 03:40 | Update | 1 114 | System <unset> | 2021-02-01 02:03 | I, U | 10 113 | System <unset> | 2021-01-29 19:54 | Update | 1 112 | System <unset> | 2021-01-21 14:41 | Update | 1 |
Check detail transaction id.
yum history info 114 | grep python Updated python-perf-3.10.0-1160.6.1.el7.x86_64 @updates Updated python-sss-1.16.5-10.el7_9.5.x86_64 @cah-cloud-centos7-updates Updated python-sssdconfig-1.16.5-10.el7_9.5.noarch @cah-cloud-centos7-updates |
It looks like python was updated in transaction id #114.
If a Linux user is having an access problem with a NFS share, and particularly with key expiration, then check if the RPC GSSD service is up and running. NFS clients uses the RPCSEC_GSS protocol to establish security credentials with a NFS server using Kerberos authentication.
Here’s an example of a key expire error due to a NFS client not authenticated properly.
df -h df: '/data/dir1': Key has expired df: '/data/dir2': Key has expired df: '/data/dir3': Key has expired |
Check if RPC GSSD service is healthy. Restart the service if there are credential errors.
service rpc-gssd status |
Here’s one with an authentication issue.
[root@server ~]# service rpc-gssd status Redirecting to /bin/systemctl status rpc-gssd.service ● rpc-gssd.service - RPC security service for NFS client and server Loaded: loaded (/usr/lib/systemd/system/rpc-gssd.service; static; vendor preset: disabled) Active: active (running) since Sun 2021-01-31 03:16:43 CST; 2h 14min ago Main PID: 710 (rpc.gssd) Memory: 1.6M CGroup: /system.slice/rpc-gssd.service └─710 /usr/sbin/rpc.gssd Jan 31 03:17:10 server.domain.com rpc.gssd[710]: ERROR: gssd_refresh_krb5_machine_credential: no usable keytab entry found Jan 31 03:17:10 server.domain.com rpc.gssd[710]: ERROR: No credentials found for connection to server nas.domain.com Jan 31 03:17:10 server.domain.com rpc.gssd[710]: ERROR: gssd_refresh_krb5_machine_credential: no usable keytab entry found Jan 31 03:17:10 server.domain.com rpc.gssd[710]: ERROR: No credentials found for connection to server nas.domain.com |
Restart the service.
service rpc-gssd stop service rpc-gssd start |
Here’s a service that’s healthy.
[root@server ~]# service rpc-gssd status Redirecting to /bin/systemctl status rpc-gssd.service ● rpc-gssd.service - RPC security service for NFS client and server Loaded: loaded (/usr/lib/systemd/system/rpc-gssd.service; static; vendor preset: disabled) Active: active (running) since Sun 2021-01-31 05:33:54 CST; 28min ago Process: 9809 ExecStart=/usr/sbin/rpc.gssd $GSSDARGS (code=exited, status=0/SUCCESS) Main PID: 9810 (rpc.gssd) Memory: 804.0K CGroup: /system.slice/rpc-gssd.service └─9810 /usr/sbin/rpc.gssd Jan 31 05:33:54 server.domain.com systemd[1]: Starting RPC security service for NFS client and server... Jan 31 05:33:54 server.domain.com systemd[1]: Started RPC security service for NFS client and server. |
You can register multiple domains to a single SSL certificate. This is particularly useful if you are hosting multiple domains on one server. This command adds more domains to your existing certificate.
certbot --expand -d existing.com -d newdomain1.com -d newdomain2.com |
Check if the domains were added.
certbot certificates |
Certbot certificates are valid for 90 days, but they automatically renew themselves if expiration is less than 30 days. If you need to renew manually for some odd reason, you can run this command. You can also perform a dry-run before renewing.
certbot renew
certbot renew --dry-run |
Here’s a regex using the pipe symbol as OR to allow only 6 possible values.
regex="efs-(00|04|08|12|16|20)00" |
Matches:
efs-0000 efs-0400 efs-0800 efs-1200 efs-1600 efs-2000 |
No matches:
efs-0100 efs-2200 efs-0600 efs-1400 efs-1800 efs-1110 111022 asdb023 2330asd 1200-efs 1205 abc |
$var is compared with $regex to find a match. $var is any of the variables above.
if [[ $var != $regex ]]; then echo "Not a match" else echo "It's a match" fi |
Logrotation is available in most Linux distros. If they are missing, you can easily install them. The logrotation main configuration file is located in /etc/logrotate.conf which is the default setting. The config file contains an include statement that pulls in other log configurations located in the /etc/logrotate.d/ directory. When setting up a log rotation, it’s best to add your log rotation configuration in this directory.
Here’s a simple configuration in a file called webmon.
/home/ubuntu/webmon.log { daily create 0640 ubuntu ubuntu dateext rotate 7 nocompress } |
The options above does the following:
There are more options from the logrotate man pages which can be added.
While trying to recover a directory from backup, I ran into an issue with duplicate uuids when trying to mount a recovered volume. The problem was the recovered volume had the same uuid as boot.
Here’s the original mount command I ran, but I was getting a wrong fs type error.
mkdir mount -t xfs /dev/nvme3n1p2 /recover mount: wrong fs type, bad option, bad superblock on /dev/nvme3n1p2, missing codepage or helper program, or other error |
It turned out to be a duplicated uuid. To get around this problem, I ran -o nouuid.
mount -t xfs -o nouuid /dev/nvme3n1p2 /recover |
Once the files were recovered, I unmounted volume and detached it from the instance.