Showing posts with label work. Show all posts
Showing posts with label work. Show all posts

1.29.2009

work { solaris 10 + VCS 5.0 + solaris 9 branded zone, shared configuration

I had a problem where I needed to run a Solaris 9 image for an application group that required special permissions and a compiler. Since we have budget cuts and no where else to put them, I decided to use a Solaris 9 branded zone within our Solaris 10, shared zone (i.e. the zones failover from node to node) VCS cluster.

The installation and configuration of the zone worked, up to a point.
Switchover didn't work because branded zones, when migrated have to run a
physical:virtual mapping to be optimized for running on the node. I
tried various things to no avail, preonline triggers, custom scripts,
but none worked well or reliably or were just too unwieldy to implement, especially in the short deadline I had.

So I decided to modify the VCS Zone Agent.

NOTE: This probably invalidates your support with Symantec, so use at your own risk.

This procedure has to be done on all nodes. The agent is written in perl.

Steps:

1. make a backup of /opt/VRTSvcs/bin/Zone/online
2. Add following to /opt/VRTSvcs/bin/Zone/online

to the "# Zone specific commands" section:

my $SOL9P2V = "/usr/lib/brand/solaris9/s9_p2v";



change the following:
$cmd = "$ZONEADM -z $ZoneName boot";
`$cmd`;


to

# modified for use with Branded Solaris Zones - 1/29/2009
my $BrandedZone = `$ZONECFG -z $ZoneName info | $GREP brand`;
$cmd = "$ZONEADM -z $ZoneName boot";
if ($BrandedZone =~ m/brand: solaris9/i ) {
$cmd = "$SOL9P2V $ZoneName && $ZONEADM -z $ZoneName boot";
}
`$cmd`;


All the variables except for "$BrandedZone" and "SOL9P2V" are defined elsewhere within the agent.


What this little snippet does is check to see if the zone has a 'brand' defined, if it does it adds the part to run the P2V mapping command and boot the zone, otherwise it does what it would normally do (just boot the zone).

It does lengthen the boot time of the zone a little and the output of the command will look odd as the P2V command also tries to update any patches needed to run on the node (which is handled at branded zone creation time).

Running a shared zone is fairly easy to setup. You create the zone on one node, copy the appropriate .xml files from /etc/zones/ to the other nodes, add appropriate line to /etc/zones/index, make sure your mountpoints exist, define the resources into VCS and enjoy. This setup will let you have one zone that can float to multiple nodes.

Note the assumptions are that the networking and storage is setup properly.

Other things to note, Solaris branded zones cannot use the "inherit-pkg-dir" functionality. So this means you can't inherit /opt/VRTSvcs/bin, so some functionality will be different. However this did not seem to impact the running or viability of the zone for use.

9.23.2008

musings { Quiet day at work...

...or so I thought. Five hours into the work day, which I thought was quiet and peaceful, I realize I've not checked my work email yet...

Then I wish I hadn't.

7.30.2008

musings/work { And here I go again on my own...

Well not really. I've just been kicking the idea of going free-lance, Sys Admin for hire, in the back of my mind for about 5 years now. Trying to figure out what I'd need to do. I know I'd need contacts, some way to market myself, and a good stable of initial customers. As well as a way to do contracts, make sure I get paid and such. I did my own company thing twice. Both times I couldn't make a go of it because I needed to keep my own job to cover costs, so I know I was doing something wrong.

I think I'm at a phase, much like my father had, when in his 30s he decided he wanted to become a farmer, where I want to be my own boss. Choose my own work. I have skills, I'm creative and experienced in my given profession, I think people may have a need for my talent, and I'm tired of working for 'The Man'. Ideally I'd like to have a number of clients, each of whom I'd spend 2-6 billable hours per week on. Small to mid sized for-profits, non-profits, academic places would be ideal. Some place where they only need 1-2 Sys Admins, and I could control aspects of the environment, build the systems how I see fit, shape the environments to what I think are a good meld of customer needs with best practices. Can do Linux (various flavors), Solaris, AIX, HP-UX. Well versed in security policies, architecture, backup/recovery/business continuity, networking, and heterogeneous integration. I have weaknesses, sendmail and printing sub-systems are still not my forte (but I'm a fast learner). Ideally I'd like to be able to work 3-5 days/week and a bit more free time, and only be on call if I choose or get reimbursed well for it. I'm not adverse to travel, just don't want to spend a lot of time away from home, nor can I really afford to pay my expenses upfront and get reimbursed at this point.

So this is really still in the dream stage. I'm asking for a lot and I'm not sure as a UNIX admin this fantasy could become a reality. Plus health insurance in America is expensive when you pay your own way, and with my previous 'condition', I'm uninsureable (per the insurance companies own policies) for at least 10 years, maybe longer, and then I get to pay 2x-4x times more what other people pay. Because I was unlucky enough to have cancer once...and survived.

7.29.2008

tech/work { spoofing hostids in solaris 10 native zones

So at work we have an application suite that uses a licensing tool that is bound to specific hostids. This can pose a problem as in Solaris 10, the non-global zones inherit the hostid of the global (or source) zone, meaning you could only have one copy of this software running at a time, not cool if you want to leverage zones.

With the new Solaris 8 and 9 branded zones, you can embed a string in the XML config file like this:


add attr
set name=hostid
set type=string
set value=80001234
end


and it will reassign the hostid. This was put in place so you could pick up and move Solaris 8/9 install and move them to within a zone. Good idea, useful feature...only it doesn't work for native Solaris 10 zones. I didn't read the docs fully and was dismayed as I thought this was part of Solaris 10 Update 4. It isn't. I then went on a two day search for a solution. The first day was pursuing official SUN channels. This only resulted in a response that a RFE (request for enhancement) has been made and it will appear in an update of Solaris 10 in the future. Not good for my more immediate needs.

Day two was spent with the swiss army knife for sys admins, google. I really only spent two hours researching it but in that time I found a few things. One is that this is not a new need, people have been looking to do this since 2005 when Solaris 10 was released. Secondly there are some easy ways to do it and some less than ideal ways to do it. Eventually what helped me solved my problem was this post here (http://tinyurl.com/6fa63z). I tried the compile your own newhostid.so library and it worked, but I had problems with other shared libraries not working, mostly because of the LD_PRELOAD flag needs to have all your system libraries for proper functioning. That page also had a link to someone who put together a dtrace script that let you spoof host ids on the fly. He has a dtrace script called zhostid with the source found here (http://tinyurl.com/62wjq5). This was exactly what I was looking for as it let me add more zones to the list as I built more, could be start/stopped at anytime with seemingly minimal impact on the system. And it works fine in a clustered environment, which is where these zones are running. You just need to put this script into a start script for boot time in both nodes (or as many as you have). Now this is the part I don't like. I generally don't like using nohup for scripts, but for now it was the only way I can get this script to start and background and keep running. I'm researching putting this into SMF if I can.

For now I made a

/etc/init.d/zhostid

start script that just basically called this script and backgrounded via nohup. I then linked the script old school into rc3.d until (if I can) put it into SMF.


cd /etc/rc3.d ; ln -s /etc/init.d/zhostid S99zhostid


Some caveats.

First off this script isn't supported. Its meant for demonstration purposes and the author states this clearly in his comments in the script, and its released under GPL, so make sure to credit it properly if you make changes. SUN generally doesn't support host id spoofing, I guess with the exception of in branded zones, but they also at this time do not provide functionality to easily do this.

Secondly, you are modifying the running system and modifying a system call. Dangers are inherent with procedures like this. But I feel in this instance it is fairly safe and non-destructive. You just need to be aware this could cause some oddities if you're ever troubleshooting.

But it works. And seems to work well for the needs I had.

7.08.2008

musings { Sorry the updates have been minimal...

And at that YouTube videos.

Its not that my creative juices have been low, in fact they have been flowing. Just I've been spread in a lot of different directions. A lot of my energy has been dumped into my Guild. We've picked up a lot of new, wonderful people lately. Nerdwife has also broke sixty and well into Outlands, so I've been spending time with her there.

As I've stated before, WoW is what most people have as TV time. I do this for a few hours in the evening, usually after chores (though sometimes not), and if I don't have work. I think its far more interesting and definitely more interactive than what has been on TV for the last few years. The only exception is the of course our one TV addiction. I've started a new alt for farming and possibly raiding. He's a druid. I plan for him to be feral/restoration and plan to swap as needed. Our guild has a bit of a tank shortage at the moment, as we still have a number of tanks leveling (as well as new healers). I plan to have a character that can fulfill a tank or healer role as needed in raids. But he's only level 13 so I have a while to decide. I have numerous alts that I've started for various professions; my shaman the leatherworker; my hunter the jewelcrafter; my warlock the tailor and enchanter; my druid the herbalist and skinner; my mage the pyro-maniac engineer; my warrior the blacksmith. But none of these are as much fun or have a special place in my heart that Pernox occupies. My energy in game has been spent being a liaison between IoD and another guild 'Total Recall' which is the reincarnation of the original guild I first joined when I started WoW. We've merged our resources to help us progress in 25 man end game content. So far its worked well. We're moving beyond Gruul's Lair and into Tempest Keep and Serpentshrine Caverns. We've even stuck our toes into Mount Hyjal.

So yes WoW has been a big chunk of my free and creative time. But its not all that I've been doing.

I keep two journals now. One is my day to day that I've been keeping for years now. Its up to volume 2. It contains my thoughts and feelings and interpretations on my journey through life. My other journal is a creative writing project. I'm trying to develop my skills as a writer. I've always wanted to be able to tell stories. My first project I assigned to myself is something I know well, Pernox. I'm trying to write a journal from the perspective of my character. Its written in first person and is intended to be a journal of travels and advice for future Deathstalkers (Forsaken rogues). Its pretty bland. But other writers who have either training in writing or are professional writers tell me that the first step is to start writing. Keep writing stuff until you've refined your basic technical skills and develop your own style.

The other project I've been working on is my 10+ year quest to learn the bass guitar. Its really hard for me. I have a book 'Bass Guitar for Dummies' and I've been spending time just learning the strings and getting my hands, used to a lifetime at the keyboard, to learn how to move on the strings. The bass I have is a hand me down, and it has some imperfections. I'm getting used enough to the sounds and how things should sound that I think for my birthday this year I will buy myself a new learner bass. I've also found some videos on YouTube that I've been watching.

Work has been more of a grind than WoW. I've moved beyond soul sucking. I've checked out. I have a couple of projects that are high impact and somewhat interesting. But this place has finally broke me. I don't have the energy or the will to continue to try and change things for the better. I'm just passing time and collecting a paycheck and trying not to get fired until Nerdwife and I are ready to move away from Rochester. Training budget has been frozen since 2006 so I've not been able to add anything to my skillset, which means its time to get out of here before my skills degrade anymore. I've also not felt that I can stand behind my work that I've done here. Which hurts. I've always taken pride in my work. Even if it hasn't been the greatest, I would stand by it and use my failures as learning experiences. Here it doesn't matter. It takes so much effort and energy and time to get anything changed here I'm just gonna take the path of least resistance. Do what I can. And polish my resume and tap into my network of contacts as to how the job prospects are for my profession.

Nerdwife and I haven't decided where we're gonna go yet. We have some ideas. One this is for sure. Once we leave Rochester, we will never look back, nor will we probably ever come back. I won't say the last four years of our lives have been wasted here, but it was amazing how fast four years of progress and advancement can be taken away on pure fabrication, hearsay, jealousy, and pettiness.

Last weekend we spent the 4th at a BBQ with our friends in the Cities, many of whom I've not seen for months. I miss those people. Genuine, real friends. People who weren't just pretending to be nice. People who we could let our guard down and with whom we could be ourselves. Something we don't get to do in Rochester, save in the remaining sanctuary of our home. I went to Nerdnight the following day and played a guest appearance. It felt good rolling the dice again with the Nerds. Even though I was in Rochester, I used to religiously go to Nerdnight twice a month. However I had to take a break due to the events of last April. I'm on extended leave, but it felt good to know I will have a place at the table.

Much good news with some of the Nerds. Goran, who in my opinion has had one of the most interesting life paths of anyone I know, has in the last year found his birth certificate (was lost in a fire). Picked up a passport (so he and John can travel, especially to Sweden and Finland). Found his family and extended family. And now will be able to marry John, legally in California. I wept with joy and happiness for my friends.

I've been drained a lot lately. I don't think its anything to worry about other than anxiety over how things have been unfolding the last few months. I've not slept well. I keep having feelings of helplessness and hopelessness randomly.

I think I'm still losing weight, but my eating patterns have been up and down. I still need to lose a lot of weight. I need to ride my bike more. I stopped going to the gym when the badness started since many of the people who are central to it went there at the same times we did.

I'll never forgive those people, ever. People who I called friend, shared food with, let into my house and my life. Its not my nature to wish ill on people. But with these people, I would not feel bad if I heard something tragic happened to them. These duplicitous bastards deserve whatever bad things in life happen to them for what they've done.

One day at a time. One problem at a time.

10.23.2007

my_day { Word

10.16.2007

psa { don't copy your butt

10.15.2007

tech { the coming 'Storm'

As an Information Technology professional, stories like this scare me and keep me up at night.


Storm represents the future of malware. Let's look at its behavior:

1. Storm is patient. A worm that attacks all the time is much easier to detect; a worm that attacks and then shuts off for a while hides much more easily.

2. Storm is designed like an ant colony, with separation of duties. Only a small fraction of infected hosts spread the worm. A much smaller fraction are C2: command-and-control servers. The rest stand by to receive orders. By only allowing a small number of hosts to propagate the virus and act as command-and-control servers, Storm is resilient against attack. Even if those hosts shut down, the network remains largely intact, and other hosts can take over those duties.

3. Storm doesn't cause any damage, or noticeable performance impact, to the hosts. Like a parasite, it needs its host to be intact and healthy for its own survival. This makes it harder to detect, because users and network administrators won't notice any abnormal behavior most of the time.

4. Rather than having all hosts communicate to a central server or set of servers, Storm uses a peer-to-peer network for C2. This makes the Storm botnet much harder to disable. The most common way to disable a botnet is to shut down the centralized control point. Storm doesn't have a centralized control point, and thus can't be shut down that way.

This technique has other advantages, too. Companies that monitor net activity can detect traffic anomalies with a centralized C2 point, but distributed C2 doesn't show up as a spike. Communications are much harder to detect.

One standard method of tracking root C2 servers is to put an infected host through a memory debugger and figure out where its orders are coming from. This won't work with Storm: An infected host may only know about a small fraction of infected hosts -- 25-30 at a time -- and those hosts are an unknown number of hops away from the primary C2 servers.

And even if a C2 node is taken down, the system doesn't suffer. Like a hydra with many heads, Storm's C2 structure is distributed.
5. Not only are the C2 servers distributed, but they also hide behind a constantly changing DNS technique called "fast flux." So even if a compromised host is isolated and debugged, and a C2 server identified through the cloud, by that time it may no longer be active.

6. Storm's payload -- the code it uses to spread -- morphs every 30 minutes or so, making typical AV (antivirus) and IDS techniques less effective.

7. Storm's delivery mechanism also changes regularly. Storm started out as PDF spam, then its programmers started using e-cards and YouTube invites -- anything to entice users to click on a phony link. Storm also started posting blog-comment spam, again trying to trick viewers into clicking infected links. While these sorts of things are pretty standard worm tactics, it does highlight how Storm is constantly shifting at all levels.

8. The Storm e-mail also changes all the time, leveraging social engineering techniques. There are always new subject lines and new enticing text: "A killer at 11, he's free at 21 and ...," "football tracking program" on NFL opening weekend, and major storm and hurricane warnings. Storm's programmers are very good at preying on human nature.

9. Last month, Storm began attacking anti-spam sites focused on identifying it -- spamhaus.org, 419eater and so on -- and the personal website of Joe Stewart, who published an analysis of Storm. I am reminded of a basic theory of war: Take out your enemy's reconnaissance. Or a basic theory of urban gangs and some governments: Make sure others know not to mess with you.

9.24.2007

work/musings { Of Enterprise and Workgroup - Meetings

Meetings, a necessity or waste of time? Its a hard question to answer. Modern business cannot seem to function without meetings.

Many meetings are wastes of time.

But meetings are necessary. Too often things are miscommunicated when not discussed face to face. The subtlety of body language is lost. Too much room for error via the impersonal mediums of teleconferences, conference calls, or the worst, email.

The meetings I've been in that have been wastes of time are usually because they could not stay on focus. They were ruined because the moderator, or person who called them, couldn't or didn't establish an agenda. Allowed others to dominate discussion.

In my experience most one hour meetings could be done in 30 minutes. Most 30 minute meetings only needed 15 and some five minute meetings needed 90.

The worst meetings where meeting discussion creep seems to happen are project meetings. The project manager should step up and except for the initial kick-off meeting, we should be merely going through the project milestones and giving on/off track brief status updates. But usually they devolve into discussion on technical minutiae where 95% of the people present could care less. Of course this requires good project management, a topic I will save for a later discussion.

Overall meetings are a necessary evil. Often in a five minute face to face meeting, weeks of angry email and missed deadlines can be avoided.

9.21.2007

work/musings { Of Enterprise and Workgroup


Long have I pondered the differences of the quality of those who take up the command line and delve into the depths of Systems Administration. They are a varied lot, while not exclusively male, this is the majority, and one I'm happy to see it changing, if albeit slowly. The spectrum of personality types, ability levels and discipline are included under the label.

Many are called, few should stay.

First a clarification of the term 'Systems Administration'. It is 'Systems' with an 's' at the end because the profession is, not as popular opinion seems to hold, about management of complex systems of interconnected entities. Not merely management of one technology type. I have found in my journeys that too many junior, and often many senior, Admins confuse this fact. Technologies come and go, tech companies rise and fall, but through this all, the basics of the profession remain the same.

1. Its about people as much as it is about technology. For without customers we would not have jobs.
2. Simple is better. More with less.
3. Documentation will save you.
4. You are always learning.

Really that's pretty much it. While many SAs like to view themselves as Wizards (myself included) weaving mystic incantations of digital power (which is cool imagery and I am a D&D nerd), in reality we are simply mechanics and custodians. Architects and builders. Systems Administration is not something that can truly be taught. You can go to school to get theories and basics of computer science, but like most professions, you learn the most on the job. I've met a few in my career who are incredibly smart, good with computer science, but don't have the chops to be a SA. Some of the best SAs I know never went to college. Its more than being able to code a program. Its more than being able to troubleshoot a problem. It requires attention to detail. The ability to take requirements and meet deadlines. It requires sacrifice, for you will be salaried and will be called to work long hours. There are rewards and accolade, but mostly your work will go unnoticed, which is not necessarily a bad thing, as if you do your job right things go smoothly and is transparent. However this transparency comes with a down side, the ones who control the money assume that things running smoothly means we as an institution can do more with less. That technology budgets can be cut and skimped. So in this respect a SA must be part cheerleader, promoting the environment. Providing uptime metrics, upgrade and technology refresh schedules. Budgeting quotes. You must be able to talk with others outside your group in terms that people not familiar with the field can understand. Accountants, upper management, and sometimes lawyers.

In my travels I've also realized that we can be broken down into three categories. Well four, as there is also the 'Contractor', but I will not get into the life of a digital mercenary, and really what they do is fill in one of the categories below for short-term or per project. Now within each category there are levels of experience from Junior Admin to Senior+ (I use these because the job title and ranks are different from institution to institution, there is no commonality. In some places the SA is a Systems Engineer, in others a Technical Analyst, in a few older shops they still carry the title Systems Programmer, in a few newer places Systems Administrator, I even had one that was Systems Administrator/Engineer/Architect Lvl 4).

The first category is Desktop Support Admins. These are the people interface with customers the most directly. They go desk to desk fixing workstations and installing new ones. They can manage as few as one desktop or in some of the largest places 30,000+. Their world seems strange and hectic to me as my whole career I've been primarily on the server support side, which I will break up into the last two categories.

The next category is Workgroup Support Admins. Workgroups are generally smaller units or departments within an institution, or in smaller companies could be the whole IT department. I categorize this group as a place with less than 10 servers. These Admins often spend their time spread around among a variety of tasks, providing support for almost everything from the desktops to the places backup and recover system. They are often alone or on a very small team. Often they are on call all the time and can have either a lot of time to work on the future of the environment, or they can be hopelessly behind and struggling to keep the environment running, let alone stable. Documentation is vital. I've never been a Workgroup Admin, but many of my friends and colleagues in the IT world are or have been.

The last category is the Enterprise Support Admins. This is what I've been for the last 11 years. The Enterprise I classify is really anytime you get more than 25 servers and usually have a dedicated data center, raised floor, cooling, special power setup and functionality of the mechanics of running the environment (such as the network, backup/recovery, storage, etc.) are separated out into their own team. Sometimes Admins service multiple teams for example my last job the UNIX team was also the Storage Team and the Backup Team. The economies of scale start to really be felt here. Generally effort to support systems is a logarithmic curve, not a geometric one with a plateau. Its multi-variable. The steepness of the curve depends not only on number of servers but also number of admins, quality of process, ability of support/peer services, and so on. If you have well documented processes and procedures, an orderly way to get problems into and out of the team, and an enforced change management process, four SAs can manage and support 30 times their number in systems. My old job after much toil, we created an environment where four admins on the Solaris sub-team (we broke UNIX support down by OS specialties to handle the workload) supported 150 OS instances. I've not yet worked in an environment of less than 300 OS instances (by instance I mean both an OS running on a single piece of physical hardware and one running as a virtual instance in a logical OS space). Generally you're dealing with millions of dollars in institutional assets.

At all levels you have to deal with politics. Intra-team and inter-team. Between managers and colleagues. Some managers jealously carve out their own empire and defend the borders (and budget) of it against all comers. Some place their people up on pedestals and treat them like divas. Some exert authoritarian control and micro-manage them with an iron fist. Others are ineffectual or try to be everyone's friend. Some styles work, some don't. SAs have a reputation of being as easy to manage as a 'herd of cats.' But this could almost be said of any profession. Hell the waiters at the food service job I had one summer in high school were the same way.

As everyone is different, some people do well in the Enterprise where you must work efficiently with others and have procedures that move like clockwork or else drown in a sea of work. Others prefer the often wild west one sheriff in town life of Workgroup support. And yet others like the customer focus of Desktop Support.

However my experience has been there are few good Systems Administrators. I will go on explain some of the common problems I see. I know I fall into one of them. Against nothing surprising, these types can exist in any profession.

1. Shiny Object Syndrome - this is what I call a phenomena I see where an Admin is distracted and unfocused because he/she wants to work on the latest technology, or the latest project, or the latest high profile problem, often to the detriment of their assigned project load. They are a load on their team because that project work has to be done and often management, when its reached a critical point, shifts it to another admin.

2. Negative Nelly - nothing will ever be good. No technology does everything you want it to or was designed by a 'pack of retarded apes' (I've actually heard that phrase used). These admins throw up a sphere of negativity that makes others seek out an alternative place to get their support. They are a load on their team because their sour mood is often infectious and it can sink morale.

3. Someone Else's Problem/The Teflon Admin - these Admins find ways to shift any problem and any project on to others. In some cases they shift the work, but then take credit (like some bad managers do) for the work of others.

4. The Burnout - these Admins fried themselves. Either working too much, caring too much, or letting it too personal. They have now become a load on their team because they are depressed or frozen into inaction.

5. The Know It All - really, no one likes a know it all.

6. Lost in the Past aka The Historian - these admins are stuck in the past. Everything is compared to some, usually archaic, technology that is long gone. Or they never change because 'this is how we've always done it' or 'I've done this once and it didn't work/it hurt me so we should never try again.' Paying homage to the past as a point of reference or a place to learn from mistakes is fine, but dwelling there is detrimental.

7. The Family Guy - no not the hilarious cartoon. This is the Admin that is 'family focused'. They work a set amount of hours in order to 'go pick the kids up' or 'spend time with the family'. How is this bad on the team? At my last job we had a 'Family Guy'. When he was on call, he would often redirect a support call to another Admin, who was not on call, because he was at some kind of church function, at the movies with the kids, etc. In short their work doesn't get done or gets shifted to other Admins. I've also known many Admins who have managed to balance work and family and not shift their work load to others. I used to think making a commitment to be family focused was a good thing, I didn't (and still don't) have kids and thought it was important, and first didn't mind picking up the extra work so someone could see their kids. This ended when I became a Lead, and saw the stress it put on the rest of the team. Many of whom also had families but would have to help pick up the slack.

I could go on, but as I've stated, these are personality types common in most professions. Or at least I believe so, but I'll admit, my job experience has been limited to mostly IT centric.

One last topic, the differences between Junior and Senior Admins, as I've noticed many do not seem to know the difference. Too often advanced knowledge of technology is prized over other soft skills that are needed to be a good Senior Admin. Junior Admins have the luxury of focus. They are generally given tasks or small scope projects and that is their focus to completion. They at this level need to focus on the technology, learning how it works, supporting it. Whereas Senior Admins are responsible for more complex in scope projects as well as multiple projects. Seniors need to be able to effectively project manage the projects they are working on as well as overseeing the work of JSAs. At the senior level a tipping point occurs. As a Junior >50% of your time is dealing directly with machines. As a Senior >50% of your time is spent dealing with people. You're also expected to keep up on technology, as you're a Subject Matter Expert, or you should know who to go to if you need SME input. You have to put on the tie and go before meetings either to request budgetary funds or to present an upgrades or changes to the environment that can affect the institution. Its the bigger picture.

On a closing note I will pass on some wisdom once imparted to me by a trusted and valued mentor. Over lunch one day he asked me what I wanted to do in the future. I said 'I want to do systems administration until I retire.' He nodded, then asked 'Do you want to be on call for the rest of your life?' He gave some time for that to sink in. He then asked 'What if UNIX isn't around in 10 years?' Wow, I never thought about that. I assumed it would be, but UNIX is 30 years old, it could go away. He then went on 'You won't be a junior Admin for the rest of your life. When you get promoted you'll have to do more non-technical things [ed. he's right you know] and you can only go so far as a SA.' That lunch stuck with me as you can tell from my previous comments. I'm at that point now in my career where I really don't want to be on call for the rest of my life. I've been thinking a lot lately about what to do besides UNIX. Some of it is job dissatisfaction, unlike farmers or carpernters, its hard to step back and see the fruit of my labor. I've also realized that while I've expanded my soft skills (communication, time management, etc.) I'm really narrowly focused with my hard skills. I need to expand my abilities.

Plus I think it is time for a change. To quote Duke Leto from Frank Herbert's work Dune 'Without change, something sleeps inside us...The sleeper must awaken.'

work { I walk the maze of moments but everywhere I turn to begins a new beginning and never finds a finish...

'Anywhere Is' by Enya

6.29.2007

work { Resume

I've been updating my resume for sometime now. Not necessarily meaning I'm thinking of leaving my current employment, its just a habit I picked up from my old job. I update it or at least review it every six months whether it needs it or not.

But today I received an email from my new boss (who is in FL) asking to see a copy of my resume. Its odd only in that the culture of where I work, requests like this usually are never made. There are some on the team whom I'm willing to bet have not updated their resume in 30 years.

Major re-org at work. Not necessarily bad, but we will see what the future holds. The cynics, paranoids, tinfoil hats and doom-n-gloom crowd are already saying the end of the world is nigh. I don't think so. I've seen a lot of shake ups, hell my old job at the end was doing them as much as people change underwear. I'm not feeling/reading a malicious vibe in this, I think it may be genuine that the new boss just wants to get a feel for us. But new bosses are interesting, they're blanks. You don't know their seriousness, their humor. I think some at work will be burned by this and some will probably do CLMs (Career Limiting Moves) because they haven't realized the organization is maturing and with maturity comes harsh realities. You either adapt with them or your continued employment becomes optional.

6.22.2007

work { I think I've become stupider

I haven't been able to stand being in the office for the last few weeks. They have been recarpeting the floor and something either in the carpet, the solvents or the glue makes me feel weak, short of breath and gives me massive headaches. That can't be good.

6.04.2007

work { sense in you much fear

New interns start this week at work. They're so cute when they're young. Then somewhere along the line they grow up into bitter cynics.

Time to get the soul-sucking machine ready.

3.30.2007

tech_support { Solaris 10 command to make managing HBAs easier

/usr/sbin/fcinfo hba-port


Fricking sweet! No more 'prtpicl' + 'grep' anymore. Thank you SUN.

Output looks like this:

# fcinfo hba-port
HBA Port WWN: 210000e08b1958a9
OS Device Name: /dev/cfg/c3
Manufacturer: QLogic Corp.
Model: 375-3102-xx
Firmware Version: 3.3.117
FCode/BIOS Version: ISP2300 Host Adapter Driver: 1.14.09 03/08/04
Type: N-port
State: online
Supported Speeds: 1Gb 2Gb
Current Speed: 2Gb
Node WWN: 200000e08b1958a9
HBA Port WWN: 210000e08b190fa9
OS Device Name: /dev/cfg/c2
Manufacturer: QLogic Corp.
Model: 375-3102-xx
Firmware Version: 3.3.117
FCode/BIOS Version: ISP2300 Host Adapter Driver: 1.14.09 03/08/04
Type: N-port
State: online
Supported Speeds: 1Gb 2Gb
Current Speed: 2Gb
Node WWN: 200000e08b190fa9

3.23.2007

on call { digital seance

Communing with the machine spirits of a sick machine is a lot like peeling back the lid on a tupperware you know has been sitting in the back of the fridge for a long time. You never know what you are going to get and often it stinks. You establish the connection and start sifting the data you get things like this:

Mar 23 04:58:24 2007 ^Mpanic[cpu450]/thread=2a10096bd40: BAD TRAP: type=31 rp=2a10096ba00 addr=91 mmu_fsr=0 occurred in module "unix" due to a NULL pointer dereference
Mar 23 04:58:24 2007
Mar 23 04:58:24 2007 sched: trap type = 0x31
Mar 23 04:58:24 2007 addr=0x91
Mar 23 04:58:24 2007 pid=0, pc=0x10395a0, sp=0x2a10096b2a1, tstate=0x8800001606, context=0x0
Mar 23 04:58:24 2007 g1-g7: 1048f2c, 141e000, 147d738, 3001edf2000, fffffffffffffffd, 0, 2a10096bd40
Mar 23 04:58:24 2007
Mar 23 04:58:24 2007 000002a10096b720 unix:die+80 (31, 2a10096ba00, 91, 0, 0, 0)
Mar 23 04:58:24 2007 %l0-3: 0000000000000000 0000000001423f58 000002a10096ba00 000002a10096b8f0
Mar 23 04:58:24 2007 %l4-7: 0000000000000031 000003002379b100 000003000e4553b0 0000000001038c00
Mar 23 04:58:24 2007 000002a10096b800 unix:trap+8e4 (2a10096ba00, 0, 10000, 10200, 0, fffe)
Mar 23 04:58:24 2007 %l0-3: 0000000000000001 0000000000000000 0000000001489bd8 0000000000000031
Mar 23 04:58:24 2007 %l4-7: 0000000001489ac0 0000000000000001 0000000000000000 0000000000000000
Mar 23 04:58:24 2007 000002a10096b950 unix:ktl0+48 (91, 3001edfa000, 30025798048, 1489bd8, 16, 0)
Mar 23 04:58:24 2007 %l0-3: 0000000000000007 0000000000001400 0000008800001606 000000000102ec9c
Mar 23 04:58:24 2007 %l4-7: 0000000001489800 0000030051e9a316 0000000000000000 000002a10096ba00
Mar 23 04:58:24 2007 000002a10096baa0 unix:setbackdq+29c (0, 0, 1489bd8, 1489bd8, 0, 0)
Mar 23 04:58:24 2007 %l0-3: 0000000001049ed0 0000000000000001 000003001edfa000 ffffffffffffffff
Mar 23 04:58:24 2007 %l4-7: 000003001edfa090 0000000000000003 0000000000000091 00000000014ec800
Mar 23 04:58:24 2007
Mar 23 04:58:25 2007 syncing file systems...
Mar 23 04:58:25 2007 ^Mpanic[cpu450]/thread=2a10096bd40: BAD TRAP: type=34 rp=1487830 addr=79 mmu_fsr=0
Mar 23 04:58:25 2007 dumping to /dev/md/dsk/d20, offset 8390377472, content: kernel
Mar 23 04:58:28 2007
Mar 23 04:58:28 2007 ^Mpanic[cpu450]/thread=2a10096bd40: BAD TRAP: type=34 rp=14860f0 addr=79 mmu_fsr=0
Mar 23 04:58:28 2007 dump aborted: please record the above information!
Mar 23 04:58:30 2007 rebooting...
Mar 23 04:58:33 2007 ERROR: CPU RED_State Reset has occurred.
Mar 23 04:58:33 2007 OBP->SC mailbox is busy, can't send.
Mar 23 04:58:33 2007 Failed to send Set Reboot Info mailbox command
Mar 23 04:58:33 2007 Resetting...


You then need to start stepping through the cryptic messages and start piecing together seemingly different events like a digital Sherlock Holmes. Its one of the aspects of my job I love. The mystery. The hunt for the truth. The interaction with the vendor. The sexy underwear.

3.05.2007

tech/work { T-minus 6 days, counting down

To Y2K...I mean DST. Or as I've now taken to calling it, 'Definite Suck Time'. Remember folks, get the latest patches for your Operating System (if you can) and if you use Java, make sure you are running v1.4+ and have either upgraded to 1.5.0_u11+ or have run the SUN 'tzupdater' tool.

2.28.2007

Musings { Technology and Work, part (355/113)+1

Because not all things end in tears and sadness.

Update. My work the other night has a happy ending to the story. I was able to get the system patched. While I was unable to upgrade the firmware of the HBA flashproms. I was able to time warp the patch sets 4 years forward (it was 2/02, I updated it to 6/2006).

I was able to leave it better than I found it. I installed OS disk mirroring, something it never had.

Tomorrow I patch it's siblings.

2.27.2007

Musings { Technology and Work, part (355/113)

I awoke, slowly, having not slept well again. Nerdwife was already up and showered and had gotten ready for work. I was not fully awake, trying to hold on to what little bliss of a comfortable and cozy bed remained, refusing to arise and face the day for a little longer. She kissed me goodbye, but it seemed like a dream.

I rolled over, shut off the alarm, and fell back into a fitful sleep for another hour. I was trying to sleep in because I knew tonight I would be in late, patching systems.

I finally got up and took a shower. Then descended into my still unpacked office (I put out my WH40K Battlefleet Gothic stuff this weekend and basked in the loving memory of painting the ships and the battles they fought). I was up late the night before switching VCS service groups to other nodes in the cluster so that I could patch the one that awaits me. I made the mistake of leaving my laptop open and logged into work with email open. The emails never end. Somewhere along the line, someone decided email was a real time messenger service and that important things could be conveyed, or worse that they would be read and accepted without discussion. Most people who use email do not understand that it is not 100%, even the USPS isn't 100%. Spelling and grammar have also declined, which is paradoxical since people are writing more. I'm not the best with letters or words, so when I notice, things have sunk to an all time low. I answered a few of the more urgent, to clarify mostly. The I logged off. Work would claim me soon enough. I fired up my PC at home, deciding to check on my WoW auctions. I'm saving for an epic mount, which costs ~560g. I'm level 51 now and need to start. But WoW is undergoing patching, I had forgotten that its Tuesday. Tuesdays are patch day. I instead switch to my Tau army on WH40K: Dark Crusade and progress to eliminate the Eldar, and make major inroads on the Orks and rebuff the Space Marines. But first a quick run to get cash from an ATM and a coffee and scone from Dunn Bros. As I wait in line, my mind wanders again to the Cities, and I miss the selection of coffeehouses that I used to frequent. I change the topic in my mind to something else. I dwell on the Cities too much still. It depresses me and keeps me from enjoying the now and making the best of the here. I think about Saturday. Saturday is nerding. I also need to stop by and visit my Grandparents. I received a frantic email from Grandma, here computer is doing things it shouldn't and not doing things it should. That's not good, but I miss them and I don't see them enough. When she found out when I'm coming, she said she is going to make breaded pork chops and mashed potatoes...how can I refuse? I'm not a lot of things, but I like to think I am a good grandson. Besides, no one else in the family can help, or rather she doesn't trust anyone else in the family to help. She knows I do things with computers.

The coffee and raspberry jam covered scone is delicious. I enter the world of Kronus to do battle.

The Eldar die quickly and are driven from the world. The Orks rise before me in a green tide and clash against my wall of Fire Warriors, who become awash in a sea of red. 5 to 1 kill rate, my Cadre literally kills thousands of them. The Orks are driven from the Bulwark, back to their home territory. I will finish them next turn, which will have to wait.

2:30pm comes too fast. I shutdown the game. Say goodbye to the cats, who both sit and watch me prepare to leave. They are funny like that. Always there to greet us when we get home and there to see us off when we leave.

I am unable to find a parking spot and I don't have change. So I park in a two-hour parking zone near work...I probably have a ticket. Parking has been tight since they eliminated another two parking lots at work.

I go to the hardware recycling center and pickup some components I need to craft a console patch so that I can work remotely on this system instead of sitting in the data center slowly going deaf. When did they start locking the door...

I forgot to lookup where the server was.

The server was moved since I last remember, not uncommon, I remember then that ACs had to go in where it used to be, it is now all the way across the data center and by itself. Damn. I bring a laptop over, the DC Ops Manager put various laptops on stands throughout the data center, they are great tools. I patch the laptop in to the server and head a few blocks away to my office. I remote desktop in and everything seems to work, console output is fine, but input is funny. Everything is changed to funny characters. Almost like I am typing in wing-dings.

I consult a co-worker. We get some long cables and do what you should not do, string cables over the raised floor to establish a patch connection. Much time is spent checking and re-checking and verifying the cables and connections, but to no avail. We figure the ASICs in the serial connector on the host are bad. This makes the job far more interesting, and much, much riskier. The machine is venerable. The likelihood of something going wrong when you touch it are high. Uptime is over 400 days. But the kernel level says the OS is running at a patch level off an old CD, I figure it to be Solaris 8, 02/02, but I'm too pre-occupied to look it up at the moment. It is part of a large, but dwindling cluster of systems built by the previous regime as I call them. The collection of cowboys and pseudo-admins from whom I, and the rest of the team inherited the environment. The stuff they built are land mines waiting to go off. And they frequently do, and then we have to pickup the pieces. In most cases this is actually a blessing in disguise as we can rebuild them better, and most importantly more supportable. But we pay, for everything we do, we pay. The political price is always high. The previous regime left us in a spot of 'most hated'. Not by all, we have allies and friends, but we have many enemies. Though the winds are changing and slowly we are coming to at least professional understandings. At my old job I learned the valuable ability to separate people from the work they do. In most cases you can dislike, hate the person at work, only to find away from work and the pressure and stress they are not at all bad people.

I digress. I un-encapsulated the OS disk, its not mirrored. Few of these ancient systems have mirrored OS disks. Without a console, I have to patch in multi-user mode, another 'don't try this at home' situations, but options are few. Patching from such an old kernel rev will mean it will take probably 8 hours on weary ultra-sparc II CPUs. They're tired, if you listen you can hear the wheezing of age in the system's fans. The groan of its power supply. The age of its machine spirit. I try to do what I can revive and resuscitate these old installs, but you can only bring them back from the dead so many times before you just must retire them.

So far the patching is going, but the moment of truth will be the reboot...hours from now.

2.22.2007

Work { Java DST upgrade script

The change in Daylight Savings Time caused by the Energy Policy Act of 2005 has resulted in nightmare conditions for some in Information Technology as almost every operating system required a patch of some kind in order to correctly adjust for the new DST rules. Many apps (most noteably Exchange) also require patching. Those that cannot be patched have to be upgraded or work around have to be put into place. Java is one of those Apps. More information regarding Java can be found at http://www.sun.com/dst. To make my life a little easier I wrote the script below to aid my efforts to patch/upgrade the system JRE and the Symantec/Veritas JREs on Solaris systems. Its not as clean as I would like and there are many improvements I would do as well as streamline some of the logic.

#!/bin/ksh

# java_dst.ksh ###
# author: Me
#version: 1.1
#purpose: to automatically find/update JAVA JREs on Solaris hosts
# and catalog completed and unsupported JRE instances.
###

###
# changelog:
# 20070215 me: streamlined script/debugged
# added find/update for /usr/openv/java
# 20070214 me: script debugging
# 20070211 me: script creation
#
###
# peer review:
# 20070214 co-worker1
# 20070215 co-worker2
#
###


###
# PATHS
###
PATH=/usr/bin:/usr/sbin
export PATH

###
# global variables
###
# base directory where script runs
case $0 in
"./java_dst.ksh") BASE=$(pwd) ;;
*) echo "WARNING! This script needs to be executed from the directory in which it resides, otherwise the script will not work."
exit 1 ;;
esac
export BASE

TZUPDATE=${BASE}/tzupdater2006p/tzupdater.jar
JRE15SRC=${BASE}/jre1.5.0_11
JRE15=jre1.5.0_11
SYSJRE=/usr/java

if [ -x ${SYSJRE}/bin/java ]; then
PATH=${SYSJRE}/bin:${PATH}
export PATH
else
echo "WARNING! No system JRE defined as ${SYSJRE}! Please investigate."
ls -ltard ${SYSJRE}
exit 1
fi
MASTERDIR=${BASE}/log
ISSUEHOSTSLOG=${MASTERDIR}/issue_hosts.log
UPDATEDHOSTLOG=${MASTERDIR}/updated_host_list.log
export BASE TZUPDATE JRE15SRC SYSJRE JRE15 MASTERCATALOG ISSUEHOSTSLOG UPDATEDHOSTLOG

###
# intro
###
echo "This script will scan the target host for installed JREs in /usr and /opt."
echo "This script will also update any JREs found with the '-u' option."
echo " "



###
# functions() {}
###

find_jre() {
# find installed JREs on system and catalog them

JRECATALOG=/var/tmp/$(uname -n)-jre_catalog.out
JREVEROUT=/var/tmp/$(uname -n)-jre_versions.out

OPTS=$1
# better search string, will not cross mount points or non-local file systems,
# will not also exec the version option on the java installs found, will
# elmininate sparcv9 (64-bit) entries as they are duplicitous
echo "Searching for installed JREs in /usr and /opt..."

find /usr /opt -local -xdev -type f -perm -o+x -name java -print -o -name sparcv9 -prune >${JRECATALOG}


# catalog the version of the JREs found, for documentation purposes
echo "Cataloging installed JRE locations and version..."
echo "Versions will be saved in: ${JREVEROUT}"
echo "Installed JREs found will be saved in: ${JRECATALOG}"

# initialize version output log
echo "">${JREVEROUT}

for x in $(cat ${JRECATALOG})
do
(
echo "${x}"
${x} -version 2>&1
) >>${JREVEROUT}
done
echo "done."

# update the master catalog with JREs installed on system for future
# reference
if [ "${OPTS}" = "B" ]; then
echo "Copying ${JREVEROUT} to ${MASTERDIR}..."
cp ${JREVEROUT} ${MASTERDIR}/
echo "done."

else
echo "Note: ${JREVEROUT} will not be copied to ${MASTERDIR} unless the '-u' option is specified."
fi
}

install_jre() {
# install JRE 1.5.0_11 on target host, re-link /usr/java to new JRE.
# JRE installed will be /usr/jre1.5.0_11

tar cf - ${JRE15} | (cd /usr ; tar xvf - )
mv ${SYSJRE} ${SYSJRE}.old
ln -s /usr/${JRE15} ${SYSJRE}
${SYSJRE}/bin/java -version
echo " "
echo "If version (Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0_11-b03)) appears, then JRE 1.5.0_11 was successfully installed as the system JRE."

updated_hosts_log A

}

updated_hosts_log() {
# update the ${MASTERDIR} logs
case $1 in
A) # updated
(
echo "###"
echo "# $(uname -n) system JRE updated"
echo "# $(date)"
echo "###"
${SYSJRE}/bin/java -version
)>>$UPDATEDHOSTLOG
;;
B) # issue
(
echo "###"
echo "# $(uname -n) Symantec JRE non-updatable $2"
echo "###"
)>>${ISSUEHOSTSLOG}
esac
}


update_system_jre() {
# update the JRE using tzupdater or unbundle the new JRE if needed

echo "Checking installed system JRE (${SYSJRE})..."
SYSJREVER=$(${SYSJRE}/bin/java -version 2>&1 | grep "^java" | cut -d\" -f2)

case ${SYSJREVER} in
1.4*|1.5*) echo "updateable JRE version found ${SYSJREVER}, updating..." ;${SYSJRE}/bin/java -jar ${TZUPDATE} -u ;echo "done."; updated_hosts_log A;;
*) echo "non-updateable JRE version found ${SYSJREVER}, installing ${JRE15}...";install_jre ; echo "done.";;
esac
}


update_symantec_jre() {
# update Veritas/Symantec Product JREs, will only work with JRE1.4 or greater
# only Veritas/Symantec Products v4.0 or greater are supported
# any version less than 4.0 found will not be able to be updated
echo "Checking for and updating the following packages: VRTSjre, VRTSjre15, VRTSob..."

VRTSJRE14="/opt/VRTSjre/jre1.4/bin/java"
VRTSJRE15="/opt/VRTSjre/jre1.5/bin/java"
VRTSJREOB="/opt/VRTSob/jre/bin/java"
NBUJRE="/usr/openv/java/jre/bin/java"
for x in $(echo "${NBUJRE} ${VRTSJRE14} ${VRTSJRE15} ${VRTSJREOB}")
do
SYMJREVER=$( ${x} -version 2>&1 | grep "^java" | cut -d\" -f2 )
echo ${x}
case ${SYMJREVER} in
1.4*|1.5*) ${x} -jar ${TZUPDATE} -u ; echo "Updated ${x}."
;;
"") echo "\c: not installed. ";;
*) echo "Non-updateable JRE found: ${x}"
echo "See http://seer.entsupport.symantec.com/docs/286461.htm for instructions and impact to this host."
echo "Per Symantec, JRE updates are cosmetic and only affect the GUI."
updated_hosts_log B ${x}
;;
esac
done
}

usage() {
echo " "
echo "ILLEGAL OPTION"
echo "usage: ./java_dst.ksh [-u]"
echo " -u: find/update JREs"
echo "no opts: find JREs and save output to /var/tmp"
}

###
# main()
###

if [ "$*" = "" ]; then
find_jre
else
while [ "$*" != "" ]; do
case $1 in
-u) find_jre B;update_system_jre;update_symantec_jre; shift;;
*) usage; exit 1;;
esac
done
fi