The Network Administrator

As an alternative to more costly software monitoring  solutions this is free, Nagios provides the means to monitor windows and linux servers and other equipment such as

• Monitoring Windows machines
• Monitoring Linux/Unix machines
• Monitoring Netware servers
• Monitoring routers/switches
• Monitoring network printers
• Monitoring publicly available services (HTTP, FTP, SSH, etc.)

To keeps things simple I chose to install Nagios on Open SuSE 11.2 http://software.opensuse.org/112/en. Just go through a typical install, make sure that you install apache2 or httpd (Fedora) and C/C++ development libraries. Also I like to change the default run level from 5 to 3 so that you can put the memory toward the server and not toward the GUI interface. I would also recommend enabling SSH to manager the server.  For the most part you will be modifying conf files and managing the server from http://nagios_server_IP/nagios. Once you have your monitoring server operating system built in my case I chose OpenSuSE, follow these simple steps….

As a quick note, step 1, I had an issue with these commands…..
/usr/sbin/usermod -a -G nagcmd nagios

/usr/sbin/usermod -a -G nagcmd wwwrun

so, instead I used….

/usr/sbin/usermod  -G nagcmd nagios
/usr/sbin/usermod  -G nagcmd wwwrun

 Also one more note, after two installs the status map has not worked. I am running OpenSuSE, to fix this problem I did the following.

Make sure these packages are installed.

http://nagios.sourceforge.net/docs/3_0/quickstart-opensuse.html

http://nagios.sourceforge.net/docs/3_0/quickstart-fedora.html

http://nagios.sourceforge.net/docs/3_0/quickstart-ubuntu.html

Debian/ubuntu

apt-get install

libgd

libgd-devel

libpng

libpng-devel

libjpeg

libjpeg-devel

zlib

zlib-devel

Fedora /centos/RHEL/opensuse

Use  yum install Or yast2 -i

gd

gd-devel

png

png-devel

jpeg

jpeg-devel

zlib

zlib-devel

While in the Nagios directory run the following commands. IF YOU ARE RUNNING RUNNING THESE COMMANDS ON AN EXISTING INSTALL YOU WILL LOSE DATA, SO PLEASE MAKE A COPY OF YOU CONFIG FILES.

Microsoft IT Environment Health Scanner is a  diagnostic tool that identifies common Active Directory and network related problems.

It performs more than 100 separate checks in these categories: Network Connectivity, Active Directory Subnet Configuration, Active Directory Replication, File Replication and SYSVOL Administration, DNS Verification, Network Adapter Configuration, Domain Controller Health, Network Time Protocol Configuration, Exchange Server Configuration, Network Configuration, and Event Log Entries.

http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=dd7a00df-1a5b-4fb6-a8a6-657a7968bd11

After building my new 64bit 2008 web server I never got around to enable the nic teaming. The steps for implementing this might be different depending on the manufacture of the network interface cards I have Intel nics. The first thing to do is to make sure that you have the correct driver for your nic to support the advanced functions such as teaming. Then go into the properties of one of the nics and select configure, select teaming, select new team and choose the nics that would want in the team. Now you can go to your network connections and you will see three interfaces for the Team. I like to rename the two nics that make up the virtual nic as a and b and then call the virtual nic public. You can then select the properties of public and set the correct settings such as ip, dns, gateway, etc.

The last thing to do is configure the port aggregation for each interface on the switch that the nics are connected. I have my server connected to a Cisco catalyst 2924. I will be using Fast ethernet ports 21 and 22.  This command needs to be issued on both fast ethernet interfaces  ”port group 1 distribution destination” without the quotes. For better performance I have also disabled spanning tree on each port 21 and 22, this is done by issuing the no spanning-tree command on each interface.

Available from http://www.microsoft.com/security_essentials
the program is designed to stop common threats such as viruses, spyware, rootkits and Trojans. It runs on Windows XP, Vista and 7, in both 32-bit and 64-bit editions.

Also check out..http://www.malwarebytes.org/mbam.php

Sometimes its faster and easier to just use the windows system restore and go back to sometime before the malware was installed.

So I ran into a situation today where my  exchange server suddenly had 100% CPU for hours. Restarted the information store providing temporary relief but the issue came back. After reviewing logs and the event viewer  I was ready to stop the information store and check the intregity of the information stores. Thankfully we found this article from Microsoft and it solved the issue, atleast it has been hours and the issue has not returned. Please note, if you have a blackberry server you will want to copy over certain  .dll files from the updated bin directory of the exchange server. Hope this saves someone some time.

Just an update the next day my issue returned…After opening a support ticket with Microsoft it looks like it may have been due to some issues in one of the information stores. After running the ISINTEG -s (servername) -fix -test -alltests  utility on that store ans now i have to wait and see if that solved my problem.

http://support.microsoft.com/kb/970103

http://www.msexchange.org/

http://clonezilla.org/

What is Clonezilla ?

You’re probably familiar with the popular proprietary commercial package Norton Ghost®, and its OpenSource counterpart, Partition Image. The problem with these software packages is that it takes a lot of time to massively clone systems to many computers. You’ve probably also heard of Symantec’s solution to this problem, Symantec Ghost Corporate Edition® with multicasting. Well, now there is an OpenSource clone system (OCS) solution called Clonezilla with unicasting and multicasting!

Clonezilla, based on DRBL, Partition Image, ntfsclone, partclone, and udpcast, allows you to do bare metal backup and recovery. Two types of Clonezilla are available, Clonezilla live and Clonezilla SE (server edition). Clonezilla live is suitable for single machine backup and restore. While Clonezilla SE is for massive deployment, it can clone many (40 plus!) computers simultaneously. Clonezilla saves and restores only used blocks in the harddisk. This increases the clone efficiency. At the NCHC’s Classroom C, Clonezilla SE was used to clone 41 computers simultaneously. It took only about 10 minutes to clone a 5.6 GBytes system image to all 41 computers via multicasting!

Features of Clonezilla

• Free (GPL) Software.
• Filesystem supported: ext2, ext3, ext4, reiserfs, xfs, jfs of GNU/Linux, FAT, NTFS of MS Windows, and HFS+ of Mac OS. Therefore you can clone GNU/Linux, MS windows and Intel-based Mac OS, no matter it’s 32-bit (x86) or 64-bit (x86-64) OS. For these file systems, only used blocks in partition are saved and restored. For unsupported file system, sector-to-sector copy is done by dd in Clonezilla.
• LVM2 (LVM version 1 is not) under GNU/Linux is supported.
• Multicast is supported in Clonezilla SE, which is suitable for massively clone. You can also remotely use it to save or restore a bunch of computers if PXE and Wake-on-LAN are supported in your clients.
• Based on Partimage, ntfsclone, partclone, and dd to clone partition. However, clonezilla, containing some other programs, can save and restore not only partitions, but also a whole disk.
• By using another free software drbl-winroll, which is also developed by us, the hostname, group, and SID of cloned MS windows machine can be automatically changed.

Which Clonezilla Shall I Use ?

• Clonezilla Live: Clonezilla live allows you to use CD/DVD or USB flash drive to boot and run clonezilla (Unicast only)
• Clonezilla SE: Clonezilla SE is included in DRBL, therefore a DRBL server must first be set up in order to use Clonezilla to do massively clone (unicast, broadcast and multicast are supported)

http://posters.msug.vn.ua/default.aspx

http://unixwiz.net/techtips/recovering-failed-raid.html

Follow my article on installing Windows pe 2.0.

Download snapshot.exe from http://www.drivesnapshot.de/en/down.htm, once you have the winpe.wim image mounted copy the snapshot.exe file into programs under the mount folder. With snapshot.exe not only can you back and restore images to the server you can bare metal restore a server provided that the hardware is correct.

Windows PE 2.0 is bundled in the Windows Automated Installation Kit (WAIK), and is an integral part of both the WAIK and Vista itself. Windows PE 2.0 is available from microsoft http://www.microsoft.com/downloads/details.aspx?familyid=c7d4bc6d-15f3-4284-9123-679830d629f2&displaylang=en

Once the download is complete, use winrar or 7-Zip to extract the iso file. Then select startcd, run the Windows AIK setup and choose all defaults.

From the start menu find  Windows PE Tools Command Prompt, first issue this command copype x86 c:\winpe and then  issue this command imagex /mountrw c:\winpe\winpe.wim 1 c:\winpe\mount to mount the wim file. If you wish to copy any additional programs or drivers now is the time to do so. While the image is mounted, if you go under C:\winpe, you can copy drivers her and copy any programs into programs directory. Next unmount the image file by issuing this command imagex.exe /unmount /commit c:\winpe\mount. To create the image file issue this command oscdimg -n -h -bc:\winpe\etfsboot.com c:\winpe\iso c:\winpe\winpe.iso and then burn the image file c:\winpe\winpe.iso with imageburn or other iso burning software.