CentOS/RHEL 6

The Ask The need is to cleanly shutdown a service but before the network is down using the rc scripts in CentOS/RHEL 6 system. The Answer The solution is to add a "SystemV rc" script that only creates the lock file at start and stops the application at stop. 1. For this, create the file /etc/rc.d/init.d/appshutdown with the following content: #!/bin/sh # # appshutdown after network shutdown # # chkconfig: 2345 00 00 # description: This is a script to stop jboss # # processname: … [Read more...] about How to Write a “rc script” to stop a service, before the network is shut down in CentOS/RHEL 6

The Ask We've got some 3rd party service scripts that we're starting to use, but to configure them properly for our environment, we need to pass them some environment variables. How is this normally done? The Answer The traditional way to handle passing configuration to service daemons launched by /etc/init.d/[service] scripts is to set variables in the /etc/sysconfig/[service] files which are usually sourced by service scripts. For example, the network service sources the file … [Read more...] about How to Pass Environment Variables to rc Service Scripts (SysV files in /etc/init.d/)

Rsyslog is a rocket-fast system for log processing. It offers high performance, great security, and a modular design. It has developed quickly and has evolved to be considered as a Swiss Army Knife in the logging field. It has a strong enterprise focus and also scales down to smaller systems. It supports MySQL, PostgreSQL, failover log destinations, syslog/tcp transport, fine-grained output format control, high-precision timestamps, queued operations, and the ability to filter parts of any … [Read more...] about How to customize log format with rsyslog in CentOS/RHEL 5,6,7

The Ask Syslog does not support remote logging with individual logs on per host basis. How can remote logging with individual logs on a per-host basis be configured with rsyslog? How can remote logging be enabled with separate logs for each remote host (system-hostname.log) with date (system-hostname-date.log)? The Answer Follow the steps outlined below to install and configure the rsyslog server to log individual logs on a per-host basis. There are various ways that are described below … [Read more...] about How to configure rsyslog server to log messages from different hosts to different files and folders in CentOS/RHEL

The Basics To convert a linear volume to a mirrored one use lvconvert with the "-m" option. The "-m" option takes a number as an argument that represents the numbers of copies of the data that you want to have. The other options are the name of the LV that you want to convert followed by a list of all the physical volumes (PV) that will be used for the mirror and its log disk. The log disk contains information on which section of the mirror needs to be synced, it speeds up operations at boot … [Read more...] about How to convert a linear logical volume to a mirror volume and vice versa in CentOS/RHEL

The Ask We want to audit certain syscalls (e.g. -a always,exit -F arch=b64 -S fchown) but we also want to ignore use of these syscalls by certain applications which we are not concerned about. How can we "whitelist" specific commands to keep them from triggering on an audit rule and generating an event? The Answer In modern versions of RHEL it's possible to build syscall-auditing rules that also filter based on: target file path, where applicable process PID, PPID process user, … [Read more...] about Can you exclude specific processes when using auditd to audit syscalls?

The Ask We're using standard STIG rules to audit time-changes by syscall (e.g., in the same way as what can be seen with grep ^-a.*time-change /usr/share/doc/audit-*/stig.rules) but unfortunately ntpd (or chronyd on newer servers) is constantly triggering new audit events as it makes changes to the time. How can we exclude ntpd or chronyd from triggering these audit rules? The Answer System auditing is a very important task that should be a part of every server. It allows us to audit minute … [Read more...] about How to exclude specific users, groups, or services with Auditd to audit syscalls

The Ask We want to put a filesystem watch on a directory and can do this with the simple "-w PATH -p wa" rule (for write & attribute changes) but unfortunately there's a particular user that needs to be able to make regular changes to this directory and it's files (and subdirs) and we don't want their actions to trigger audit events. How can we make a filesystem watch rule that audits all access except for access by a particular user or group? The Answer System auditing is a very important … [Read more...] about How to Exclude Specific User or Group with Auditd to Watch Files (CentOS/RHEL)

What is OOM Killer? The OOM killer, a feature enabled by default, is a self-protection mechanism employed the Linux kernel when under severe memory pressure. If the kernel cannot find memory to allocate when it's needed, it puts in-use user data pages on the swap-out queue, to be swapped out. If the Virtual Memory (VM) cannot allocate memory and cannot swap out in-use memory, the Out-of-memory killer may begin killing current userspace processes. it will sacrifice one or more processes in … [Read more...] about What are the options (sysctl tunables) to customize what process OOM will kill in CentOS/RHEL

The pstack(1) command print a stack trace of a running process. Use the below steps to install it on a CentOS/RHEL system. What Package provides pstack Command For CentOS/RHEL 5 The pstack package can be installed with: # yum install pstack For CentOS/RHEL 6,7 In CentOS/RHEL 6/7, the pstack tool is provided by gdb package. To install gdb, please do : # yum install gdb The gdb package will include the gstack and pstack commands. For example: # rpm -ql gdb-7.2-92.el6.x86_64 | egrep … [Read more...] about How To Execute The Pstack Command On CentOS/RHEL