The Problem The user is unable to run X applications through SSH on a CentOS/RHEL system. The following message is displayed: # xclock Error: Can't open display: The Solution 1. X11 forwarding is disabled on SSH login unless "-X" option is specified: # ssh -X user@address 2. It may have been disabled in "/etc/ssh/sshd_config" with the below setting: # vi /etc/ssh/sshd_config ... X11Forwarding no ... 3. Please make sure X11 forwarding is enabled in "/etc/ssh/sshd_config": # vi … [Read more...] about Unable to Run X Applications Through SSH in Linux
How to convert a linear logical volume to a mirror volume and vice versa in CentOS/RHEL
The Basics To convert a linear volume to a mirrored one use lvconvert with the "-m" option. The "-m" option takes a number as an argument that represents the numbers of copies of the data that you want to have. The other options are the name of the LV that you want to convert followed by a list of all the physical volumes (PV) that will be used for the mirror and its log disk. The log disk contains information on which section of the mirror needs to be synced, it speeds up operations at boot … [Read more...] about How to convert a linear logical volume to a mirror volume and vice versa in CentOS/RHEL
How to capture network packets and save them to a file using tcpdump
The Ask The support has asked user to collect network packets to analyze a network issue. How can he capture the network packets and save them to a file using tcpdump command in CentOS/RHEL? The Answer The command that can be used to capture network packets on the network is called tcpdump which is provided in an RPM package tcpdump-[version].[arch].rpm. If tcpdump is run by itself, it will dump all network traffic to the current terminal. To capture these packets to a file, the … [Read more...] about How to capture network packets and save them to a file using tcpdump
Can you exclude specific processes when using auditd to audit syscalls?
The Ask We want to audit certain syscalls (e.g. -a always,exit -F arch=b64 -S fchown) but we also want to ignore use of these syscalls by certain applications which we are not concerned about. How can we "whitelist" specific commands to keep them from triggering on an audit rule and generating an event? The Answer In modern versions of RHEL it's possible to build syscall-auditing rules that also filter based on: target file path, where applicable process PID, PPID process user, … [Read more...] about Can you exclude specific processes when using auditd to audit syscalls?
How to exclude specific users, groups, or services with Auditd to audit syscalls
The Ask We're using standard STIG rules to audit time-changes by syscall (e.g., in the same way as what can be seen with grep ^-a.*time-change /usr/share/doc/audit-*/stig.rules) but unfortunately ntpd (or chronyd on newer servers) is constantly triggering new audit events as it makes changes to the time. How can we exclude ntpd or chronyd from triggering these audit rules? The Answer System auditing is a very important task that should be a part of every server. It allows us to audit minute … [Read more...] about How to exclude specific users, groups, or services with Auditd to audit syscalls
How to Exclude Specific User or Group with Auditd to Watch Files (CentOS/RHEL)
The Ask We want to put a filesystem watch on a directory and can do this with the simple "-w PATH -p wa" rule (for write & attribute changes) but unfortunately there's a particular user that needs to be able to make regular changes to this directory and it's files (and subdirs) and we don't want their actions to trigger audit events. How can we make a filesystem watch rule that audits all access except for access by a particular user or group? The Answer System auditing is a very important … [Read more...] about How to Exclude Specific User or Group with Auditd to Watch Files (CentOS/RHEL)
How to Find Number of CPU Sockets on a CentOS/RHEL System
In our company we have some 3rd-party products installed on CentOS/RHEL systems. The Application team needed to do some accounting on how each product was licensed using number of CPU sockets in the each system. Sadly they did not have any type of CMDB in place to help (Configuration Management Database - something very handy to have when it comes to looking at your server inventory). Here is a short note to get the number of CPU sockets on a CentOS/RHEL system. Determine number of CPU … [Read more...] about How to Find Number of CPU Sockets on a CentOS/RHEL System
How to Check Solaris Release and Default Kernel Version
How to Determine the Installed Solaris OS Release The most reliable method for determining the release of the Solaris OS installed is through the contents of the /etc/release file. This file was first introduced in Solaris 2.5.1 HW 4/97 and is included in all subsequent versions. The various tables shown below can be used to map the contents of this file to the release of the Solaris OS installed. If the /etc/release file has been deleted from a system it is also possible up to Solaris 10 to … [Read more...] about How to Check Solaris Release and Default Kernel Version
C Library – <time.h>
The Time library provides the data structures and functions required to retrieve the system time, perform time calculations, and output formatted strings that allow the time to be displayed in a variety of common formats. Time is stored as ticks since 1 Jan 1970, midnight, known as UTC. This value must be converted to be of use, either into a structure or formatted output. The time.h header file defines two macros. The first, also defined in many other header files, is NULL, representing the … [Read more...] about C Library – <time.h>
XFS error: Unable to mount filesystem With Noacl Permission in CentOS/RHEL 7
The Problem User is unable to mount xfs with noacl permission. noactl mount option for xfs file system is set in /etc/fstab file. # cat /etc/fstab /dev/sbb1 /mnt xfs inode64.noacl 0 0 But mounting failed with error below. # mount -v /mnt mount: wrong fs type, bad option, bad superblock on /dev/mapper/vg_cdm_ebsul06_N00-appl_ptch, missing codepage or helper program, or other error In some cases useful info is found in syslog - try The dmesg errors for the noacl option … [Read more...] about XFS error: Unable to mount filesystem With Noacl Permission in CentOS/RHEL 7