Dongle Blog

Last weekend we had to shutdown everything in the building to allow some electrical work to take place. It went pretty smoothly, although a disk failed in our scratch space file server. When I looked on Sunday evening it had stopped rebuilding with an “ECC-ERROR” in one of the other disks. I managed to coax it to rebuild onto the hot spare, and a subsequent verify cleared the error. On Monday I had a play around the failed disk to see what was wrong with it. I found an article describing how to use the SMART utils to probe a disk behind a RAID card – I hadn’t realised this was possible. Here’s the SMART data:

errol:~#smartctl -a -d 3ware,4 /dev/twa0                                                                           11:12am
smartctl version 5.36 [x86_64-redhat-linux-gnu] Copyright (C) 2002-6 Bruce Allen
Home page is http://smartmontools.sourceforge.net/

=== START OF INFORMATION SECTION ===
Device Model:     ST31000340AS
Serial Number:    9QJ2BV5F
Firmware Version: SD15
User Capacity:    1,000,204,886,016 bytes
Device is:        Not in smartctl database [for details use: -P showall]
ATA Version is:   8
ATA Standard is:  Not recognized. Minor revision code: 0x29
Local Time is:    Mon Dec 21 11:12:49 2009 GMT
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

=== START OF READ SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED

General SMART Values:
Offline data collection status:  (0x82)	Offline data collection activity
					was completed without error.
					Auto Offline Data Collection: Enabled.
Self-test execution status:      ( 121)	The previous self-test completed having
					the read element of the test failed.
Total time to complete Offline
data collection: 		 ( 642) seconds.
Offline data collection
capabilities: 			 (0x7b) SMART execute Offline immediate.
					Auto Offline data collection on/off support.
					Suspend Offline collection upon new
					command.
					Offline surface scan supported.
					Self-test supported.
					Conveyance Self-test supported.
					Selective Self-test supported.
SMART capabilities:            (0x0003)	Saves SMART data before entering
					power-saving mode.
					Supports SMART auto save timer.
Error logging capability:        (0x01)	Error logging supported.
					General Purpose Logging supported.
Short self-test routine
recommended polling time: 	 (   1) minutes.
Extended self-test routine
recommended polling time: 	 ( 227) minutes.
Conveyance self-test routine
recommended polling time: 	 (   2) minutes.

SMART Attributes Data Structure revision number: 10
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME          FLAG     VALUE WORST THRESH TYPE      UPDATED  WHEN_FAILED RAW_VALUE
  1 Raw_Read_Error_Rate     0x000f   107   099   006    Pre-fail  Always       -       91159849
  3 Spin_Up_Time            0x0003   091   091   000    Pre-fail  Always       -       0
  4 Start_Stop_Count        0x0032   100   100   020    Old_age   Always       -       14
  5 Reallocated_Sector_Ct   0x0033   100   100   036    Pre-fail  Always       -       63
  7 Seek_Error_Rate         0x000f   037   037   030    Pre-fail  Always       -       29746980996976
  9 Power_On_Hours          0x0032   089   089   000    Old_age   Always       -       9910
 10 Spin_Retry_Count        0x0013   100   100   097    Pre-fail  Always       -       0
 12 Power_Cycle_Count       0x0032   100   100   020    Old_age   Always       -       14
184 Unknown_Attribute       0x0032   100   100   099    Old_age   Always       -       0
187 Unknown_Attribute       0x0032   099   099   000    Old_age   Always       -       1
188 Unknown_Attribute       0x0032   100   100   000    Old_age   Always       -       0
189 Unknown_Attribute       0x003a   100   100   000    Old_age   Always       -       0
190 Unknown_Attribute       0x0022   076   066   045    Old_age   Always       -       403505176
194 Temperature_Celsius     0x0022   024   040   000    Old_age   Always       -       24 (Lifetime Min/Max 0/13)
195 Hardware_ECC_Recovered  0x001a   022   018   000    Old_age   Always       -       91159849
197 Current_Pending_Sector  0x0012   100   100   000    Old_age   Always       -       3
198 Offline_Uncorrectable   0x0010   100   100   000    Old_age   Offline      -       3
199 UDMA_CRC_Error_Count    0x003e   200   200   000    Old_age   Always       -       0

SMART Error Log Version: 1
ATA Error Count: 1
	CR = Command Register [HEX]
	FR = Features Register [HEX]
	SC = Sector Count Register [HEX]
	SN = Sector Number Register [HEX]
	CL = Cylinder Low Register [HEX]
	CH = Cylinder High Register [HEX]
	DH = Device/Head Register [HEX]
	DC = Device Command Register [HEX]
	ER = Error register [HEX]
	ST = Status register [HEX]
Powered_Up_Time is measured from power on, and printed as
DDd+hh:mm:SS.sss where DD=days, hh=hours, mm=minutes,
SS=sec, and sss=millisec. It "wraps" after 49.710 days.

Error 1 occurred at disk power-on lifetime: 4752 hours (198 days + 0 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  40 51 00 3e 8a 78 0b

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  60 00 80 00 8a 78 4b 00  46d+05:07:41.524  [RESERVED FOR SERIAL ATA]
  60 00 28 d8 89 78 4b 00  46d+05:07:41.522  [RESERVED FOR SERIAL ATA]
  61 00 80 80 1d de 49 00  46d+05:07:41.520  [RESERVED FOR SERIAL ATA]
  61 00 80 ff ff ff 4f 00  46d+05:07:41.514  [RESERVED FOR SERIAL ATA]
  61 00 80 ff ff ff 4f 00  46d+05:07:41.514  [RESERVED FOR SERIAL ATA]

SMART Self-test log structure revision number 1
Num  Test_Description    Status                  Remaining  LifeTime(hours)  LBA_of_first_error
# 1  Short offline       Completed: read failure       90%      9910         88387051
# 2  Short offline       Completed: read failure       90%      9910         88387051
# 3  Short offline       Completed: read failure       90%      9909         88387051

SMART Selective self-test log data structure revision number 1
 SPAN  MIN_LBA  MAX_LBA  CURRENT_TEST_STATUS
    1        0        0  Not_testing
    2        0        0  Not_testing
    3        0        0  Not_testing
    4        0        0  Not_testing
    5        0        0  Not_testing
Selective self-test flags (0x0):
  After scanning selected spans, do NOT read-scan remainder of disk.
If Selective self-test is pending on power-up, resume after 0 minute delay.

This is interesting – the overall health test is described as a pass, but the short test I ran is described as a fail. It’s also interesting to note that the drive only has one error logged, on startup so I’m wondering it it was just some fluke.

It appears from the SMART utils howto bad-blocks and a discussion here that the short test failure is likely to be a bad block which will be reallocated when next written to. There is a procedure for forcing this, but I’m not sure how to do this thorough the RAID controller, and anyway, I don’t really fancy having a previously rejected disk as the hot spare so I requested a replacement from the vendor.

This got me wondering – at what stage does the controller decide that a disk is “dead”? It’s pretty rare in my experience that disks just die completely, they usually start being slow, or giving read errors on particular blocks. I assume that the bad blocks can be recalculated from the RAID parity and once rewritten they will be reallocated by the disk firmware. It would be good to hear something on this from either a disk or RAID controller manufacturer but it’s hard to get through the sales stuff. In particular is it ok to reuse my failed disk. I’ll have to try to speak to someone next time I go to one of the “storage expo” type things.

• Leave a comment... (1)

There are many books and articles on filtering unsolicited commercial email but most of these seem to be at least a couple of years old. Some of the best are closer to ten years old. The cat and mouse game between spammers and email administrators means that things are constantly evolving and I’ve long thought it would be good to see some hard figures for how effective different methods are. I will therefore try to present my current experience. This won’t be particularly scientific and applies more to smallish systems than email service providers. Hopefully it will help someone, though.

My first spam filtering used a customised procmail filter, adapted from one I found on Oxford University’s IT support site (I can’t find it anymore, unfortunately). This searched for likely words in messages and even used scoring to assess how likely a message was to be spam. This actually worked reasonably well whilst I was at university but when I started working at Claranet, and started receiving a lot of mail for postmaster, hostmaster etc I found that the amount of wanted mail was tiny compared the amount of spam I had to wade through. I’d heard good things about Spamassassin so decided to give it a try. I was impressed, and with minimal customisation this setup worked adequately for several years. About 18 months ago, however I noticed two things. Firstly I was getting a lot of spam and deleting it all was getting to be a nuisance. Secondly and perhaps more importantly, the load on my server was continually high because of all the Spamassassin processes. Clearly I needed to start stopping some of this stuff from getting through before it even got to spamassassin. This, then is my current setup.

DNSBLs

I reject around 500 messages per day based on DNS block lists. Nowdays I only use one, the Spamhaus Zen list. This combines some of the lists I used to use with Spamhaus’s policy based list (which includes things like dynamic dial up IPs). In the past I’ve also used Spamcop but found that it gave a lot of false positives. I also found SORBS effective but don’t like their de-listing policy so just use them for warnings.

Of course, many of the 500 rejected messages would probably also be picked up by other means, but I like the fact that minimal resources are used at my end and that if there is a false positive the sender gets a quick and obvious message indicating what the problem is.

Message syntax checks

The next set of messages are also aimed at stopping mail at smtp level. There’s a good introduction to doing this in Exim here. Here’s a summary of what I’m using

• Check that sender address is valid (but without callback)
• Check that the hostname used in the EHLO greeting is valid (and not something like friend)
• Check that the hostname used in the EHLO greeting isn’t the server’s name

I also tried a few other things that didn’t work so well:

• Delays in the SMTP process. I found that having a delay long enough to stop the spam also stopped some legitimate mail. This does seem to work fairly well for sites with lots of users to slow down dictionary attacks, however.
• Checking the sender address using the callback – This did stop some spam but some legitimate servers are (incorrectly) configured to reject mail with a null sender, so I stopped doing this.

Spamassassin

The remaining mail goes through spamasssassin’s scoring system. I tend to find this detects around 10 messages/day which go to a Spam folder which I manually review.

• Leave a comment... (0)

I finally got round to installing cacti last week.

I’ve used MRTG fairly extensively. It does a pretty good job but has a few limitations. Perhaps the most obvious is that it’s not particularly pleasant to configure. You have to edit text files manually specifying each snmp oid to monitor, it’s fairly hard to get started and the only way to reuse templates is via cut & paste. It’s not too hard to get some basic graphs but I found getting things looking really nice tended to take a lot of effort. Another big problem is the overhead of the poller; with a medium sized network it’s quite easy to find that the poller hasn’t finished the previous run when it gets started again.

RTG adds some interesting features; the poller is written in C and much faster, also the graphs are plotted as they are displayed making the web interface slightly slower but meaning the machine isn’t tied up producing hundreds of graphs for each cycle (which will probably never be viewed). Another advantage of this is that it is possible to configure the desired time range for the graphs as they are produced rather than just the four (daily, weekly, monthly, annual) which MRTG gives by default. This is a nice feature, but I didn’t actually find it all that useful; but it would useful for ISPs etc who need to make accurate historical measurements of bandwidth.

When I started at my current job, getting some service monitoring up and running was a priority and Nagios was the obvious choice. Getting some trend monitoring was a lower priority. I had intended to try Cricket which I’d heard good things about, but came across Cacti.

Cacti uses RTG to actually plot the data, but provides it’s own SNMP poller, written in C, making it much quicker than MRTG. More significantly it has a very nice web interface which lets you easily, for example, add a host, get a list of network interfaces and choose some of these to produce graphs.

• Leave a comment... (0)

As will be apparent not a great deal has come of my attempt to get a weblog going. I thought I’d therefore have another go, beginning with migrating from b2 to wordpress. Hopefully I’ll get things a bit more customised over the next few days.

• (0)

As of 13th August 2004 I am no longer employed by Claranet. I’ll shortly be heading off to the University of Reading to do an MSc in Mathematical and Numerical Modelling of the Atmosphere and Oceans.

• (0)

Whilst trying to find out what was happening in a Perl script I had reason to refer to the debugging perldoc page (perldoc perldebug). As this was on a FreeBSD-STABLE box it was running a fairly old version of Perl (5.003 I think) for which the debugging documentation contained a good quote which appears to have been removed from more recent versions of the documentation. I have therefore reproduced it here:

“As soon as we started programming, we found to our surprise that it
wasn’t as easy to get programs right as we had thought. Debugging had
to be discovered. I can remember the exact instant when I realized
that a large part of my life from then on was going to be spent in
finding mistakes in my own programs.”

–Maurice Wilkes, 1949

• (0)

I’ve just come back from running the gauntlet of charity people in those tunic things in Moorgate, in order to pay in a number of cheques I’ve accumulated over the last week. For some reason the cashiers are located on the first floor, which is reached via an escalator. At the top of the escalator was a lady employed to direct customers to the appropriate queue. I have to say she did a very good job of this and wished me a good weekend as I departed. I just wonder if her services might be better deployed actually serving customers behind the counter and thus reducing the queue.

• (0)

I have recently recovered from a fairly unpleasant ‘winter virus’ which I’m fairly sure I contracted as a result of my travels on the Northern City Line.

For anyone lucky enough not to be familiar with the perils of commuting into London on a regular basis, allow me to set the scene. Each morning, having driven to Stevenage, I catch a ‘fast’ train, which I leave at Finsbury Park. From Finsbury Park I take the so-called ‘Northern City Line’, a main line service which happens to run underground, via various places to Moorgate which is in the City. The problem with this is the ratio of people wanting to travel to avaliable seats is, I would guess, approximately 4:1. Thus there is frequently not even standing room on the trains, never mind a seat. When I finally board everyone is packed onto the train in an arrangement known to chemists, I believe, as ‘body centre cubic’. The conditions for disease transfer are, in short, rife.

What I therefore propose is a system similar to that used on aircraft traveling to the UK from tropical areas. Once the plane is sealed and ready to take off the hostesses spray a thick mist of raid or something similar to kill off any insects (and no doubt the odd passenger). Whilst this may be a little extreme for trains I’m sure something like TCP (the stuff you gargle, not the connection-oriented network protocol) could be introduced via the ventilation system to kill off any bacteria / viruses being coughed / sneezed up by passengers who should be in the quarantine of their home. Of course some would object to the smell but frankly I think this is a small price to pay.

• (0)

And I was rather rudely reminded of last weekend by the 3m inflatable Father Christmas outside a local garden centre. No further comment required, I think.

• (0)

Last weekend I finally managed to get myself an allotment. As the photo shows it’s in a pretty bad way. I had a stab at digging it over but the ground is as hard as concrete so I’m holding out for some rain. Instead I turned by attention to getting rid of the rotting carpet and doing something with the carrier bags of unrotted manure, which I suspect will now be of limited use for the soil. I took two sacks of weeks and two rolls of rotten carpet (which stank!) to the dump before deciding to investigate hiring a rotovator.

I hope to get the soil into a decent condition over the winter then have a stab at growing some vegetables next year. It’s something I’ve always been interested in but so far I’ve been limited to growing things in pots or odd corners of the garden so this will be a somewhat larger venture.

• (0)

Not really the ideal topic to kick off with but anyway…

A couple of weeks ago someone hit the back of my car whilst I was pulling out of a junction on the way home. This was a nuisance but bearable. A week ago the car went into a local garage to be repaired which was due to take about two weeks during which I would have the use of a courtesy ‘Ka’.

Yesterday the garage rang to say the cost of repairs would be more than the value of the car and that the car was therefore a total loss. And please could they have the courtesy car back. By this morning.

Arghh. After lots of phoning insurance companies, solicitors and the garage I have a car until Saturday morning but from then on I’m kind of stuck. And that’s the story so far

• (0)