Author Archives: Daz

sntp – fixing time issues within a windows domian

Posted on by — No Comments ↓

I’ve had some problems with dcdiag failing on the advertising check, and this relates back to the DC not getting its time from the PDCE properly.

Fixing timesync is different according to the machine type…

If it’s a standard Domain Controller then behave as if its a member server (below)

If it’s a PDCEmulator then make sure you allow port 123TCP/UDP outbound on your firewall and configure the external sntp site by entering this at the command line  (note: i use pool.ntp.org instead of default microsoft sntp)

NET TIME /SETSNTP:pool.ntp.org

If it’s a member server or a standard Domain Controller:

Members of the Active Directory sync with their local DC (local as in local AD site). The DCs then sync with the PDCEmulator. (Note: if you have root domain then sntp requests are sent up the chain to that)

Diagnosis of timesync errors is difficult, but do not be tempted to use NET TIME /SETSNTP: on all machines in the domain (as suggested to many questions like this one, unless it’s a PDCE), as it specifically overrides the natural internal operation of the time service within Active Directory.

These commands are written for Windows 2003 and Windows XP. There are some equivalents for windows 2000, use W32tm /? or W32Time /? from the command line to look for alternatives on older OSs.

NET TIME /SETSNTP:
to clear any entry and return to the default settings

NET TIME /SET /YES
to synch NOW with your authenticating DC and begin the diagnosis:

Start by verifying your domain is synching AD by using REPLMON.EXE in the support tools pack on the Windows installation CD.

If this is OK then run this from the command line:
W32TM /monitor

to ensure that each member server/workstation is actually pointing to a DC.

If this is OK then run this from the command line:
W32TM /resync /rediscover

followed by:
W32TM /resync /nowait

and check the system eventlog for W32TIME errors. This process does a full reset and recheck of the time system as it relates to one member machine on your AD.

squid – your transparent proxy friend

Posted on by — No Comments ↓

Still my favourite light and fast web proxy is Squid. Its very easy to setup and get running on almost all flavours of linux. You can find it here http://www.squid-cache.org/ but will probably find it in your local package manager…

This is for more my own reference… as i don’t think too many people have the need for a transparent proxy. You only need one NIC configured on your VM / machine as its most probably on the same subnet as your dsl etc…

1. Setup squid working as a proxy first!

Set the default gateway on the NIC to your router. I also added a default route 0.0.0.0 sub 0.0.0.0 to the router also just in case the default route didn’t work. But seemed to!

Setup DNS! remember you should be able to resolve a name to an IP without issues (can cause most of the problems) Point your default DNS to your router (most have built in DNS forwarders), else you can just use your ISP’s DNS’s

2. Change the squid.config to have the necessary changes to act as a transparent proxy;

nano /etc/squid/squid.conf

http_port 3128 transparent

3. Put this into the startup script; (usually in rc.d under etc) rc.local

iptables -t nat -A PREROUTING -i eth0 -p tcp –dport 80 -j REDIRECT –to-port 3128

This redirects standard tcp requests to 3128 (squid’s port)… transparent to user

4. Ensure that IP forwarding is ENABLED;

change ip_forward from 0 to 1 (usually a txt file somewhere with 0 in it), do a search and you will find it… most probably in the ipv4 directory. This way all 443 (https and other apps) can forward to the web without issue…

echo 1 > /proc/sys/net/ipv4/ip_forward

Should be it…. else good luck!

Update: I have done an updated post about configuring open solaris as a transparent proxy here : https://sigtar.com/2009/04/22/opensolaris-configuring-squid-as-transparent-proxy/

Offine Files – Remove prompt about excluded files error

Posted on by — No Comments ↓

You may get an error such as this popup during a offline files sync…

Offline files (\\server\share on server): Unable to make ‘archive.pst’ available offline on \\server\share\folder. Files of this type cannot be made available offline.

Microsoft have said that even if the file is in the excluded list then by design offline files will still complain about it when it tries to sync.

There is a way to remove the warning prompt for specific files; (you may need to update your machine to the latest support pack in some cases)

  • Create a new “key” at HKLM/Software/Microsoft/Windows/CurrentVersion/NetCache called “ExclusionErrorSuppressionList”
  • Within this key create a new DWORD registry entry for each of the files you wish to exclude at that prompt
  • The DWORD format should be similar to “\\*\*\*\*.pst” if you which to exclude pst files on any server, share and folder.
  • You can add as many DWORD registry entries as you require within the “ExclusionErrorSuppressionList”

Done.

See the following KB for more information : http://support.microsoft.com/kb/811660

Opensolaris – Managing Boot Environments with beadm

Posted on by — No Comments ↓

To get a list of all of your boot environments within Opensolaris use beadm like so…. 

beadm list 

Assuming you know the name of the boot environment that is causing issues you can use the following command (using its name) to remove the ones you think are suss. Note: you need to boot up in the environment that you wish to keep first. 

beadm destroy opensolaris-2

If you destroy an environment that is active on boot it will be changed to another be that is available. You can use the following command to set it to a specific boot environment; 

beadm activate opensolaris-1

Remember to go into package manager and set the default repository as the preferred again. Update manager may recommend updates from the dev repository still though, remove this repository to prevent this.

Best not to delete a boot enviornment unless you have to.

Opensolaris – where has my memory gone?

Posted on by — No Comments ↓

Use this command in 2008.11 to get details on where your memory is currently being used…

echo ::memstat | pfexec mdb -k

Page Summary                Pages                MB  %Tot
————     —————-  —————-  —-
Kernel                     263992              1031   34%
ZFS File Data               91917               359   12%
Anon                       376867              1472   48%
Exec and libs               11484                44    1%
Page cache                   3387                13    0%
Free (cachelist)             9766                38    1%
Free (freelist)             24807                96    3%

Total                      782220              3055
Physical                   782219              3055

Note: ZFS should eat up the remainder of your ram after a bit of use.

“ZFS File Data” is the one to look at – if it is low then most of your ram may be eaten up in other areas of the system.

From the output above you can see that i have 3GB installed. I have a few VirtualBox VM’s running on my server which show up as “Anon”, they are consuming almost half of my ram.