Tuesday, July 15, 2014

Linux process management

It is always a good practice to find out/categorize processes running on a server based on their cpu and memory (RAM) usage. We can terminate/kill the unwanted processes causing high cpu load or memory consumption.

Here I use the process management application 'ps':

To view all running processes on the system we use
[root@server ~]# ps -aux

These options tell ps to show processes owned by all users (regardless of their terminal association) in a user-friendly format.

a - All processes except both session leaders and processes not associated with a terminal

u - Select by effective user ID (EUID) or name

x - also show processes not attached to a terminal

0 - User defined format

Top 10 cpu consuming processes


 [root@server ~]# ps axo stat,ruser,%cpu,comm,pid,euser | sort -nr | head -n 10


stat - status of the process

ruser - real user

%cpu - percentage of cpu utilized by process.

comm - command


Top 10 memory consuming processes

[root@server ~]# ps axo stat,ruser,%mem,comm,pid,euser | sort -nr | head -n 10

Useful Links -

http://www.cyberciti.biz/faq/show-all-running-processes-in-linux/

http://www.binarytides.com/linux-ps-command/

https://www.digitalocean.com/community/tutorials/how-to-use-ps-kill-and-nice-to-manage-processes-in-linux







Thursday, June 19, 2014

PhpMyAdmin and Memcache

I have come across this issue several times on a cpanel server.
Cannot start session without errors in phpMyAdmin

I found that we could only temporarily fixed this issue. Phpmyadmin has to work with sessions in files and it is not developed to work with memcache. So to avoid problems edit the file: libraries/session.inc.php


1. Include this line at the top of the file:

ini_set(‘session.save_path’, “/tmp/”);

2. Uncomment line (line around 74)

ini_set(‘session.save_handler’, ‘files’);

Thursday, March 27, 2014

How to block email from a specific address on a cPanel/WHM or other web server using Exim

With EXIM, you can setup filters that can perform a large number of tasks, like blocking message, or blind copying messages to other email addresses.  In this case, I’m going to create a filter to cause an email coming from a specific sender to fail (the email address I use to send the email in PHP). What you’ll want to do is find your System Filter File for EXIM.  In WHM, you can find this file listed in your EXIM Configuration Editor about half way down the page. Once you’ve located the file, log into SSH and edit the file.
pico /path/to/your/file
Then enter the following filter into the file and save it:




if first_delivery
and ( ("$h_from:" contains "emailtoblock@mydomain.com")
)
then fail
endif
If you’d like a copy of the email sent to you after the message fails so you can make sure it is correctly formatted, just add one line:
if first_delivery
and ( ("$h_from:" contains "emailtoblock@mydomain.com")
)
then
unseen deliver "youremail@yourdomain.com"
fail
endif
I suggest you read up more about EXIM filtering for more advanced functions. Where I Learned This: I found the solution the Imthiaz Blog and the Exim Documentation.



Exim Configuration Manager:basic editor

There will be a warning in Filter configuration File: /etc/cpanel_exim_system_filter
Exim filter
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#  cPanel System Filter for EXIM                                                                                #
#  VERSION = 2.0                                                                                                #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!DO NOT MODIFY THIS FILE DIRECTLY!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!      #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#   Direct modifications to the /etc/cpanel_exim_system_filter file will be lost when the configuration is      #
#   next rebuilt. To have modifications retained, please use one of the following options:                      #
#                                                                                                               #
#    1)                                                                                                         #
#      * Place each sysfilter block you wish to include in a unique file at:                                    #
#            /usr/local/cpanel/etc/exim/sysfilter/options/                                                      #
#      * Enable or disable the custom block in WHM using:                                                       #
#          Service Configuration => Exim Configuration Manager => Filters => Custom Filter: [your unique file]  #
#                                                                                                               #
#    2)                                                                                                         #
#      * Create a custom sysfilter file in /etc/                                                                #
#      * Change the location of the sysfilter file in WHM using:                                                #
#          Service Configuration => Exim Configuration Manager => Filters => System Filter File                 #
#                                                                                                               #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!DO NOT MODIFY THIS FILE DIRECTLY!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!      #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#                                                                                                               #
#  Only process once                                                                                            #
#                                                                                                               #
# # # # # # # # # # # # # # # # # # # # #

So I created this simple php file on /usr/local/cpanel/etc/exim/sysfilter/options and it was visible in the WHM filter.


Tuesday, March 11, 2014

SPI (SaaS, PaaS, IaaS) model in cloud


SaaS


Cloud application services or “Software as a Service” (SaaS) are probably the most popular form of cloud computing and are easy to use. SaaS uses the Web to deliver applications that are managed by a third-party vendor and whose interface is accessed on the clients’ side. Most SaaS applications can be run directly from a Web browser, without any downloads or installations required. SaaS eliminates the need to install and run applications on individual computers. With SaaS, it’s easy for enterprises to streamline their maintenance and support, because everything can be managed by vendors: applications, runtime, data, middleware, O/S, virtualization, servers, storage, and networking. Gmail is one famous example of an SaaS mail provider.


PaaS

The most complex of the three, cloud platform services or “Platform as a Service” (PaaS) deliver computational resources through a platform. What developers gain with PaaS is a framework they can build upon to develop or customize applications. PaaS makes the development, testing, and deployment of applications quick, simple, and cost-effective, eliminating the need to buy the underlying layers of hardware and software. One comparison between SaaS vs. PaaS has to do with what aspects must be managed by users, rather than providers: With PaaS, vendors still manage runtime, middleware, O/S, virtualization, servers, storage, and networking, but users manage applications and data.
PaaS provides the computing infrastructure, the hardware, and the platforms that are installed on top of the hardware. Similar to the way that you might create macros in Excel, PaaS allows you to create applications using software components that are controlled by a third-party vendor. PaaS is highly scalable , and users don’t have to worry about platform upgrades or having their site go down during maintenance. Users who benefit most from PaaS include companies who want to increase the effectiveness and interactivity of a large staff. For the needs of larger companies and independent software vendors, Apprenda is one provider of a private cloud PaaS for .NET and Java business-application development and deployment.


IaaS

Cloud infrastructure services, known as “Infrastructure as a Service” (IaaS), deliver computer infrastructure (such as a platform virtualization environment), storage, and networking. Instead of having to purchase software, servers, or network equipment, users can buy these as a fully outsourced service that is usually billed according to the amount of resources consumed. Basically, in exchange for a rental fee, a third party allows you to install a virtual server on their IT infrastructure. Compared to SaaS and PaaS, IaaS users are responsible for managing more: applications, data, runtime, middleware, and O/S. Vendors still manage virtualization, servers, hard drives, storage, and networking. What users gain with IaaS is infrastructure on top of which they can install any required platforms. Users are responsible for updating these if new versions are released.

See some explaining diagrams:












Classification of Cloud service providers








Wednesday, December 25, 2013

How to generate a CSR on a Linux server

This article will discuss how to create a CSR (Certificate Signing Request) for an SSL in Linux. This is necessary if you are submitting a request for an SSL with another provider.
    • SSH into the Linux server. If you are unsure of how to SSH, please see how to SSH on Windows | Mac .
    • At the command prompt, type the following and hit Return. Change the bit length (2048) to the appropriate bit length for the SSL issuer. Typically 2048 is sufficient.
openssl req -nodes -newkey rsa:2048 -keyout domain.key -out domain.csr

Updated on 18 September 2014 - use sha2 algorithm as there has been a major security breach for sha1

openssl req -new -newkey rsa:2048 -nodes -sha256 -out domain.csr -keyout domain.key


To check CSR details:

openssl req -noout -text -in domain.csr

Fill out the requested information below. For the State, use the full name not an abbreviation. The Organization Name should be a publicly verifiable name (such as is listed on bank statements, bills, taxes, etc). The common name is the domain for which the SSL is being issued. For example, if you’re ordering an SSL for domain.com, then the name would be domain.com. If you’re ordering an SSL for www.domain.com, then the name would be www.domain.com.
You may chose to leave the email address and challenge password blank by simply hitting return when prompted.
Generating a 2048 bit RSA private key
………..+++
………………………..+++
writing new private key to ‘domain.key’
—–
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [GB]:US
State or Province Name (full name) [Berkshire]:Newark
Locality Name (eg, city) [Newbury]:Delaware
Organization Name (eg, company) [My Company Ltd]:My Company Name
Organizational Unit Name (eg, section) []:Security
Common Name (eg, your name or your server’s hostname) []:www.domain.com
Email Address []:
Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
    • Once the form is filled out, two files will be created in the directory in which the command was run. The filedomain.csr has the CSR for the SSL which will need to provide to the SSL issuer. It will look similar to the following:
—–BEGIN CERTIFICATE REQUEST—–
MIICvDCCAaQCAQAwdzELMAkGA1UEBhMCVVMxDzANBgNVBAgTBk5ld2FyazERMA8G
A1UEBxMIRGVsYXdhcmUxGDAWBgNVBAoTD015IENvbXBhbnkgTmFtZTERMA8GA1UE
CxMIU2VjdXJpdHkxFzAVBgNVBAMTDnd3dy5kb21haW4uY29tMIIBIjANBgkqhkiG
9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6tL9PpRMD4JeB4jZkIXGT5k4AGpGf/FTSNfn
ENuADQFCco0E+w+HqcAYtDBHzTSuU76B6TYWURRnNLHmwX+f7GytD4tBhmDia3OQ
ffKNAZqI5uusU+Tt5qpW2qjLBeX6/jD/u5Fh75s3XIKJ5XdW5yiztOk/4LAqffx9
rR4bZac4k9nBBci6gCIK615vj+1H2wAe9t5bem/EW6bxEH1nMjenI/5siVsdtRMO
qk+6l7EqkJeGslsXcu9xsqKakAfia266xQvU24P6YCWvFvLUDr5SAvAfbO+zIGWZ
/3boR75C1NyiSopJDnXlwZ0HXNRWHBUys7ED4lEIeaQpMtTXgQIDAQABoAAwDQYJ
KoZIhvcNAQEFBQADggEBAEY/wFSLWOt1S2bTt72l68K5pt0oaBaY0HX6DgPYUeP2
OR5JX5G7Cb4eVGDBWuDtVxxN2YrzzgD6ASj9pL0mzkYuFaRy3uUo0ZedzdPXgVX2
r+5OdjrewPpIgL2i91EB/JytAdgr5fVKQpaZntFu7DJHBVpcGrEN0Kan/OGg2ZU0
08yhyoejXtY1i8YUwPpoqD126N0xczYclMg/BaSME5R3Vbcr3i5Ruz0ByjoQtKSt
1Z8CWIiZNH1WhB2fy8Z2ARCsM1g2Xh43TqjRDhIIFU/dbDqmFHhvivxv2bzB9cbi
ureFe4oU8af7K9w4EbSzKgcqBOwNwnQy7DpcmIHXB4s=
—–END CERTIFICATE REQUEST—–
    • The file domain.key has the key for the SSL which will you will need once the SSL is issued. The certificate, once issued, must match the key in order for the SSL to be installed. It will look similar to the following:
—–BEGIN RSA PRIVATE KEY—–
MIIEpQIBAAKCAQEA6tL9PpRMD4JeB4jZkIXGT5k4AGpGf/FTSNfnENuADQFCco0E
+w+HqcAYtDBHzTSuU76B6TYWURRnNLHmwX+f7GytD4tBhmDia3OQffKNAZqI5uus
U+Tt5qpW2qjLBeX6/jD/u5Fh75s3XIKJ5XdW5yiztOk/4LAqffx9rR4bZac4k9nB
Bci6gCIK615vj+1H2wAe9t5bem/EW6bxEH1nMjenI/5siVsdtRMOqk+6l7EqkJeG
slsXcu9xsqKakAfia266xQvU24P6YCWvFvLUDr5SAvAfbO+zIGWZ/3boR75C1Nyi
SopJDnXlwZ0HXNRWHBUys7ED4lEIeaQpMtTXgQIDAQABAoIBABTrAqAmebgP9uxY
5niXUhkZHwH6dZlEGBUvFmhMBVYjPJYTtdPfiEg40nqKqnq/LKBNIilyJf7HAIKT
LmkiQ06+R5RQ5V9hFgpYWxC9II56A6P+bnVyuTaJCf+kdaFq4Tbvinhc9QpxGzdk
cYA9Z0JkP83n0UbkqoRaj59yRSKC3TosSWCQ8TVTxWU8U36mTpCUIFvcgbQGIKph
irj8briWCM9xiErSESYP77WQxERvoW6brKD9jZ/BNmTMuQ+akOa8BxqP6LOx/bob
jqrmxsDkcmjzMXS8SCG3FkJk2K1Tam8aCqQHMBjbUFJByjIDnT237sue7qFmyQFJ
T2izt6ECgYEA95LBuszZS+cM3I/7mxRIPWoKb4ao881xNlYUvwboDMRAIFAlRNfV
c7Qjlt5TeVwlIvrYdL0L0d92FrXbh7lGcK2yOKFW4OrrlKySqXSto7c2LWy2DJkm
Hs9NO6ZDB/6X78UU4tVvFS5m/AA9J27Pk8lq/p4OuTki4yH3b3mLqJ0CgYEA8tEk
f2NeYk7YMm9Oc4fBlAF2CfJRwGf7GqwbT9Us04AWgv3XlohJaibGWJjVrHBCirAY
jxQsKhF2zjnxs9gWZ5k2PqvczTF2vs025tSimxbBcUOhMUNEaSr6ugTfjFkbdcTG
Wx/HyxH8cbYOYWKrbJSQknh8N+DO+N/y2yMt+zUCgYEAunZ+EwNWZiSPO0/2YMbV
4euMEJOLjJSfQB11YqsA+xyUb8HtT/x/d7WlWGv60tzj24Syorn/vQJhHpm5zm9s
7lDkemKJ3L0S0ddoXtjSLww+cdf/BV4TqADaWqLOuaa3KI93O6ElGP7p8cL8TEbZ
cKWzQDIrRLYT4J4kjoEs/sECgYEA6Qv575m7mLb7oUxbC18cV6UfWWSNOhGSW4Mb
o3+CSmwBLy/ansunSo50h8wIKDyGYP2qVIiT6rxgPoY2iNm4hy3xdi0U+oui4HWt
X9ZtSlSIzOCP8OwS2K07fxX2SImtZVa62fKimzBkDe8h1i4RQWFFcI7bCfZmL08h
k1ksZJECgYEAmQ73FoPsGv/uynBXVJWk3j7yDLNNHzbL9bIs5dQ9157RhInWRsNX
TvUdnukuB4hkaxvINz9mXn/2kJtsi/D5oWfrPKA1Gyzze9Rmr260p4ciy3q9YvBc
Issaav6wkaLRG9EtTU27ptda5ovYMLYE5OcrtDTtvaxFVaTRhzO9GWw=
—-END RSA PRIVATE KEY—-
 

Thursday, December 19, 2013

''another skype instance may exist''


You want to login to skype but you cant because you receive the following error:
"'another skype instance may exist'"
This seems to be a common problem with skype and ubuntu.

Solution:

1] Open the terminal
2] cd into the folder /home/users/username/.Skype by typing the command
#cd /home/users/username/.Skype
#ls

You may see 3 files : shared.lck, shared.xml and skype_account

3] Move the folder skype_account to skype_account1
#mv skype_account skype_account1

4] Revert it back
#cp -arv  skype_account1 skype_account

Restart the skype and login!!!!

Does this work?
Leave me a comment.


 

Friday, November 22, 2013

Apache prefork vs worker mpm

Apache===> multithreaded Vs multiprocess

Apache comes in a few different flavors. The two most common are pre-forked (multi-process) and multi-threaded (worker).

The pre-forked flavor runs several copies of itself and each copy is designed to serve one visitor at a time. The multi-threaded model runs one, sometimes a few, copies of itself but each copy has several threads and each of those threads can serve one visitor at a time.

So, if you had 20 simultaneous requests to your server, the pre-forked version would need 20 copies of itself running to serve them all. In the same situation, the multi-threaded version might have only 1 copy running with 20 internal threads to serve the same requests.
Which one better?

Let’s outline what the pros and cons of each of the two choices are and that will hopefully help determine, based on what you’ll be serving up, which is better for you.

The multi-threaded version often faster and takes less memory. However, any additional modules running inside Apache must fully support a multi-threaded environment. Modules that are not 100% thread-safe can cause Apache to crash or behave strangely.

The pre-forked version takes more memory. However, the pre-forked version also alleviates the need for modules to be fully thread-safe.

One of the most common add-on modules, PHP, has some thread-safely problems. To be fair, the core of PHP is supposed to be fine in a multi-threaded Apache. However, some of the third-party libraries used by PHP are not thread-safe. This has the downside of needing to use the pre-forked version of Apache if you plan to use PHP running from inside Apache as a module (using mod_php, which is by far the most common way of running PHP).

In general, I recommend using the multi-threaded version of Apache only if you are confident that all of the rest of your software stack will support it. If it won’t, or you’re just unsure, then you should run the pre-forked version. Using more memory is definitely better than having things crash or be otherwise unstable.

When running PHP via mod_php, choose pre-forked. When running only static files (html, jpg, etc), choose multi-threaded. If passing on to a backend application server like Mongrel (for Ruby on Rails), the multi-threaded version works fine.

If you’re mixing and matching uses and even one use, in one virtual host, requires the pre-forked version, then pre-forked will need tobe your choice.
Installing each version

On Debian or Ubuntu, the pre-forked version can be installed like this:

sudo apt-get install apache2-mpm-prefork

For the multi-threaded version, install this package instead:

sudo apt-get install apache2-mpm-worker
Optimizing Apache to fit your server

Apache’s default settings for number of processes to run and maximum simultaneous clients to serve are a bit too high. Unless you have one of the biggest Servers, you’ll want to change them. Even for bigger servers it probably makes sense to review these and change them to fit your workload.
Pre-forked version

Again, on Debian and Ubuntu:

sudo nano /etc/apache2/apache2.conf

Find the section labeled “prefork”. There are 5 settings here:

StartServers 5
MinSpareServers 5
MaxSpareServers 10
MaxClients 150
MaxRequestsPerChild 0

By default, this tells Apache, when you start, create 5 copies of yourself, keep at least 5 around, don’t keep more than 10 idle servers, you may have up to 150 copies of yourself (1 to serve each client), and each child copy may live indefinitely (no maximum requests per child).

150 copies is too many for a small server. So let’s adjust these a bit:

StartServers 2
MinSpareServers 2
MaxSpareServers 6
MaxClients 20
MaxRequestsPerChild 0

The most important setting here is MaxClients. This is the maximum number of copies of Apache that will run at once. The rest are generally just somewhat proportional to this one number.

These are fairly conservative and have high odds of working for smaller environments. It is possible, if running enough RAM-hungry stuff, that even these are too high. If you’re running a medium-to-large sized server, these may be too small.

Go ahead and save the file and exit.
Multi-threaded version

As noted above, Apache’s default will use a lot of memory. Apache itself will use less here than in the pre-forked version, but it can still easily be too much.

sudo nano /etc/apache2/apache2.conf

Find the section labeled “worker”. There are 6 settings here:

StartServers 2
MaxClients 150
MinSpareThreads 25
MaxSpareThreads 75
ThreadsPerChild 25
MaxRequestsPerChild 0

In this case, Apache reads this as start 2 copies of yourself to begin with, each capable of serving 25 clients, cap the number of clients at 150 (which would be 6 copies of Apache at 25 clients each), and keep spare capacity between 25 and 75 threads, again with no limit on the lifespan of a child copy of Apache.

Let’s adjust these downward a bit:

StartServers 2
MaxClients 30
MinSpareThreads 7
MaxSpareThreads 15
ThreadsPerChild 15
MaxRequestsPerChild 0

MaxClients and ThreadsPerChild are the most important here as they will determine how many copies of Apache are running at once.

These are designed to work, in most cases, with even smaller servers. They are likely too conservative for larger servers in higher-traffic environments.

Save the file and exit.
Finishing up

After the above changes have been made, be sure to do a full restart on Apache:

sudo service apache2 restart
- See more at: http://blog.hemantthorat.com/apache-prefork-vs-worker-mpm/#sthash.KAsNCEBj.dpuf