[00:05] going home now, good night guys [00:14] miller7 (none@213.239.180.106) left irc: Ping timeout: 480 seconds [00:17] Bertl ? [00:17] yup? [00:17] sorry i just hung up and realized that you havent given me your email address [00:18] and the strace coammdn mentions something like "this must be run as root [00:18] just like the ping command an the vserver [00:18] on the vserver, sorry [00:18] okay email: herbert@13thfloor.at [00:19] for strace, you probably need to be a) root on the vserver, and b) give some CAPABILITIES ... [00:20] i am root on the vserver but dont know what CAPS i should give em [00:22] okay, what does 'strace true' report on the vserver as root? [00:23] a whole screen of output....sure that i should post the entire output here ? [00:23] nope, but it means that strace works ;) [00:23] good to hear ;) [00:23] you should get the same output if you replace 'true' by the ping command ... [00:24] (well similar output ;) [00:26] no its not the same...its similar only in the amount of content [00:26] it also differs in the exitcode [00:26] perfect ... [00:27] that output is the strace info I would like to have a look at ... [00:28] you said something about caps i should give the vserver before running strace again ... [00:29] or do you think otherwise now ? [00:37] click (click@gonnamakeyou.com) left irc: Ping timeout: 480 seconds [00:40] Doener_zZz (~doener@pD9E1268C.dip.t-dialin.net) joined #vserver. [00:41] click (click@gonnamakeyou.com) joined #vserver. [00:48] Doener (~doener@p5082DE34.dip.t-dialin.net) left irc: Ping timeout: 480 seconds [00:48] youam (~youam@sc-gw.scientific.de) joined #vserver. [00:50] Nick change: Doener_zZz -> Doener [01:04] Bertl: just got 1.24 + q0.12 runing. works.:) just if you need positive feedback. [01:14] can I enhance the caps of a running vserver or do I need to chance the conf and restart it ? [01:16] ah no. got the same problem: http://list.linux-vserver.org/archive/vserver/msg05883.html [01:20] Sh[a]de: just found your pbvsc snippet repository, is it ok for you if i add some ideas there when they come to my mind? or should i sent them somewhere else? [01:31] hmm...are you sure you want the strace output of 10000 pings ? this wont be finished before tomorrow morning i guess [01:33] noel- (~noel@pD9FFA6E4.dip.t-dialin.net) joined #vserver. [01:41] noel (~noel@pD9FFA8C3.dip.t-dialin.net) left irc: Ping timeout: 504 seconds [03:18] gn8 everybody ... Bertl as i foresaw your requested output wont be ready before morning [03:19] Cyrix (~root@d102-13.dsl.expressnet.de) left irc: Quit: Leaving [03:23] okay, good night everyone ... [03:24] Nick change: Bertl -> Bertl_zZz [03:33] Sh[a]de (shade@cpe109.bb101.cablesurf.de) left irc: Quit: Excursion (On IRC.BONGSTER.DE [#wwip, #german-elite and #lov]) [03:40] kestrel (athomas@dialup51.optus.net.au) left irc: Ping timeout: 501 seconds [04:13] I just ran pflogsumm.pl manualy and I got all values as Zeros. Do you guys know why ? :) [04:14] opps [04:14] worng windpws [04:33] Nick change: Doener -> doener_zzz [04:44] hmmm, so websphere is rumoured to cost $50,000 per cpu [06:33] Nick change: riel -> surriel [09:32] Nick change: noel- -> noel [10:46] _shuri (~shushushu@3ffe:bc0:8000::5bb) left irc: Ping timeout: 483 seconds [10:58] kestrel (athomas@dialup51.optus.net.au) joined #vserver. [11:05] Nick change: Bertl_zZz -> Bertl [11:05] morning ... [11:06] Hiya. :) [11:09] serving (~serving@213.186.190.24) left irc: Read error: Connection reset by peer [12:06] rmoriz (rmoriz@rmoriz.cpan.de) left irc: Ping timeout: 480 seconds [12:16] Nick change: Bertl -> Bertl_zZz [12:44] miller7 (none@213.239.180.106) joined #vserver. [12:44] morning guys [13:06] serving (~serving@213.186.190.24) joined #vserver. [13:55] hello there [13:56] pRiV (dbox3@81.92.166.46) left irc: Ping timeout: 480 seconds [15:01] arekm (misiek@ikar.t17.ds.pwr.wroc.pl) left irc: Ping timeout: 492 seconds [15:31] blab [15:32] trying to get per context quota, using these instructions: http://www.vangog.net/docs/vs-quota.simple-walkthrough.txt [15:32] yeah [15:32] kernel 2.4.24, vserver-1.24 and patch-2.4.24-vs1.24-q0.12.dif [15:32] nogo [15:33] ok [15:33] what the prob is? [15:33] perhaps I can help you [15:33] I did put all the vrsetup stuff etc in /etc/vservers/name.sh [15:33] but that doesnt seem to be executed [15:33] you try to have quota inside a vserver or in host? [15:33] inside vserver [15:33] ah, haven't yet tested the latest stable version with that [15:34] what do you use that works? [15:34] I have installed the host quota to allocate per VS [15:34] that is the cqhlim isnt it? [15:34] yeah [15:34] yeah, that works for me [15:34] cq* [15:34] ok [15:35] I will try the vserver quota sometime this week [15:35] when I do quotaon on the vserver, I get this: [15:35] Jan 26 13:28:44 cia kernel: ··· BAD INODE: add_dquot_ref(de865000[100], 1) d7b984a0[100] »null« [15:35] Jan 26 13:28:44 cia kernel: ··· BAD INODE: add_dquot_ref(de865000[100], 1) d1c26480[100] »xconsole« [15:35] Jan 26 13:28:44 cia kernel: ··· BAD INODE: add_dquot_ref(de865000[100], 1) d50839a0[100] »messages« [15:35] you have to talk to bert about it I think [15:35] guess so [15:36] do you run stable? [15:36] yes [15:36] I am testing the stable versions at the moment [15:38] where do you enable the vroot do the cqhadd? [15:38] in the kernel -> file systems I think [15:39] yeah, that is for compiling the kernel, but I mean where do you run the commands to enable the device? [15:39] init.d? [15:39] yeah [15:41] how do you calculate the current amount of inodes / blocks when you run cqdlim? [15:44] du and find [15:44] before starting a vserver I guess [15:45] guess thats the only way [15:45] not really elegant :/ [15:45] yep [15:45] it works [15:45] perhaps you can just save the du -s into a file when shutting down a vserver [15:46] depends on your situation [15:47] then this: I get the idea that the pre/post-start/stop lines in my /etc/vserver/name.sh script arent executed [15:47] any way to debug that? [15:48] no, never used them [15:48] they are useless to me [15:48] you can always set a batch script that can imitate that [15:48] like: [15:48] vserver something start [15:49] vserver something exec something [15:49] etc [15:49] so you can have pre-post [15:49] true [15:50] ah! [15:50] test -x /etc/vservers/$1.sh [15:51] it has to be executable [15:51] :) [16:00] cool, find/du works fine actually [16:00] yep [16:01] what do you use to create new vservers? [16:05] well, I don't use anything at the moment :) [16:05] I have my own versions of RH 7.3 and 8 [16:05] but I have to create new ones now [16:23] _shuri (~shushushu@3ffe:bc0:8000::5bb) joined #vserver. [16:44] Nick change: doener_zzz -> Doener [17:49] arekm (misiek@ikar.t17.ds.pwr.wroc.pl) joined #vserver. [18:00] lp (~lpressl@interner.SerNet.DE) left irc: Ping timeout: 501 seconds [19:07] silence has struck us :) [19:07] let's talk then :) [19:08] feature request [19:09] a very _great_ feature would be a port offset! [19:09] I mean I often install tests programs in vservers [19:09] and many want to use port 80 [19:09] or e.g. 1001 [19:10] a port offset would be such great! [19:10] e.g. define a offset by 1000 for my vserver [19:10] would do 1080 [19:10] and 2001 [19:11] ? [19:11] PORT offset? [19:11] yes [19:11] what for? [19:11] doesn't sounds like a feature that could be implemented in mainstream :D [19:11] you can use port 80 on an ip [19:11] the program inside the vserver wants port 80 [19:11] yeeeah? [19:11] and so? [19:11] the vserver would give him 1080 thouh [19:11] though [19:11] for instance so it doesnt conflict with the vservers [19:11] ah iptables available in the vserver you mean? [19:12] yeah [19:12] that's what I was about to say :P [19:12] iptables? [19:12] I wont help me [19:12] s/I/that/ [19:12] iptables allows you to redirect ports [19:12] it won't ? why not? [19:12] I have an apache on the main vserver [19:12] port 80 [19:12] yeeeeah? [19:13] the apache in a vserver wants also port 80 [19:13] and I cant use diff IPs [19:13] I dont have that many [19:13] eh. [19:13] meebey: put private IPs [19:13] I try now to hack the software [19:13] use a localnet ip, and forward it [19:13] then you can choose whatever port you want on the vserver as well [19:14] and just forward it using iptables/ipchains to whatever vserver you want [19:14] piece of cake [19:14] thats not KISS [19:14] DNAT/SNAT is always tricky [19:14] vserver is not KISS [19:14] eh no-. [19:14] true. true :) [19:14] it's dead simple [19:14] dnat / snat is dead simple [19:15] two lines for iptables actually [19:15] nah it makes networking much more complex [19:15] and it fails very fast [19:15] fails very fast? [19:15] i've been running vs'es in background here and with dnat for over a year [19:15] firewall setups get more complex [19:15] and I still haven't had a single failure [19:15] heh no. [19:16] the 2 lines are not the problem, but all other checks get dirty [19:16] it's just an additional rule that supercedes the ones already set [19:16] pft [19:16] write your fw properly [19:16] a good hint: arnos iptables firewall script [19:16] it is [19:16] I use: meebeys iptables firewall script [19:16] already contains DNAT/SNAT and a darned good fw setup [19:17] well, then you're no good at writing scripts, even my own script does S/DNAT [19:17] I dont see where netfilter could help me [19:17] vserver-ip = 192.168.0.99 [19:17] or whatever [19:17] my script do DNAT, that has nothing todo with writing good or bad scripts, the firewall is a complex thing here [19:17] then add a S/DNAT-ruleset for defined ports [19:18] whats so special about YOUR setup then... explain that to me. [19:18] privates ips, that made my firewall script fucking shit complex before, using virtual IPs [19:18] again, whats so special about your setup? [19:19] ok: [19:19] public/29 --> firewall --> DMZ /28 [19:19] i've got 3 nat'ed nets here, one is a dmz, the second is NAT'ed out, and the third is local only, all going through the same box for forwarding [19:19] the server is in the DMZ [19:19] no private nets there [19:20] internert --> Pre-DMZ /29 --> firewall --> DMZ /28 [19:20] thats more the right setup [19:20] before I had the DMZ full virtual IPs [19:20] means all servers had 10.0.0.0 ips [19:20] the firewall made full S/DNAT [19:21] for the DMZ to the public IPs [19:21] that made testing/searching for problems damn difficult [19:21] finally I switched it back ;) [19:21] to real public IPs [19:22] I still don't see your point why YOUR net is so exclusively 'special'. [19:22] It's a totally std. NAT/DMZ/fw-setup [19:22] I dont wanna put a private LAN into the DMZ the network total is much more complex :) [19:22] lemme check if I find a screenshot ;) [19:23] use more commas please, I can hardly read your english. [19:23] my english sux, I know [19:23] but there are no comma rules in english, so I dont have to set them ;) [19:24] erm.. [19:25] there is, actually [19:25] here is a little picture of it [19:25] http://www.meebey.net/temp/gsd-net.gif [19:26] the VPN between server-7 and galilei7 you dont see though, to simplify the graph [19:27] as you can see creating a new private LAN into the DMZ is a big change for the whole network [19:27] which one is the server INET goes through then... [19:28] server-4 has the vserver [19:28] server-0 is the firewall [19:28] gsd-dsl-router has the internet in our side of the network [19:28] I am in the gsd-server network [19:30] mhm, and I still can't see why setting up iptables to do a simple portforward is so extremely hard, as you don't need to change a single thing on the net itself. [19:30] and neither to the rules you already have, all you do is match a certain port to be allocated to another ip/port (or just port if you want that) [19:31] e.g. you mean redirect port server-4:80 to server-4:81 (which is in vserver) [19:31] or server-4_vserver_IP:80 to server-4:81 [19:33] yup [19:33] or 1080: to vserver 80 [19:33] does exactly the same thing as what you want [19:34] hhmmm [19:35] problem is though I have to change the programs inside the vserver [19:35] which I try to avoid [19:35] because sometimes its closed source [19:35] nope [19:35] yeah give the vserver an own IP [19:35] let's say I've got program A, closed source [19:35] on the vserver [19:35] k [19:35] using port 9000 to connect [19:35] which binds to 9000 [19:35] yup [19:36] on the vservers IP! [19:36] what kinds of IP? [19:36] public/private? [19:36] priv, as the vservers transport goes via the root-server anyway [19:36] let me draw this. [19:36] k [19:36] -------- [19:37] 1 2 and 3 [19:37] ok?= [19:37] all traffic to the rootserver, port 1080 you want to be bound to the vservers port 9000 [19:38] the vserver should respond to whatever port it wants, as that's proper tcp/ip allocation blabla [19:38] k [19:38] so I do the DNAT on the rootserver [19:39] you do the dnat for the vserver on the root-server, and only there [19:39] I thought you mean on the firewall :) which is a diff host [19:39] and creating a own private network for that [19:39] no, not at all [19:39] thats why I was so against it :) [19:39] now I understand, and that solution sounds ok! [19:39] might be my explanation that gave you that impression [19:39] thanks anyhow :) [19:39] well, you got the idea now? [19:40] jep [19:40] and that solution is clean [19:40] make a private ip on the vserver [19:40] and DNAT on the rootserver which holds that vserver [19:40] a private ip which is ONLY used for the vserver, nowhere else [19:40] yup [19:40] allright :) thanks again [19:40] np [19:40] btw,... [19:41] one thing you should be aware of is that if you have a process on the rootserver that allocates to 0.0.0.0 you might have a small prob [19:41] jep, I agree [19:41] binding to IP * or 0.0.0.0 is dangerous for that [19:41] at least from the rootserver [19:42] yup, it eats even the 'private' ip bindings [19:42] i had a lot of problems with identd running on the root-server on one of my projects, and allowing shellusers to irc on the vservers [19:43] all the implementations I've seen of identd binds to 0.0.0.0 or a single ip [19:43] thus I couldn't use proper identd's on the vservers, as their ip's were already eaten. [19:44] hhmm shit :) [19:44] and the identd on the rootserver doesnt have the proc info of the vservers [19:45] exactly, and neither the vserver userlists ; ] [19:45] jep [19:45] thus it can't respond properly [19:45] HEY! bertl! [19:45] oidentd? [19:45] oidentd yeah [19:45] that one seems to be a good one [19:45] pidentd, midentd etc does the same [19:45] crap [19:45] hack da source! [19:45] use the source luke [19:45] already thought of it. [19:45] Nick change: Bertl_zZz -> Bertl [19:45] :) [19:45] bertl: there's an idea! [19:46] hiya Bertl [19:46] heya all! [19:46] bertl: allow certain procs to see vs'es proc and userlists, to allow external auths, if bound to 0.0.0.0 [19:46] I felt somebody speaking about _the_ source .... 8-) [19:46] bertl: you're a true jedi ;] [19:46] Bertl: hehehehe [19:46] or perhaps you are a dark one! [19:47] ph34r! [19:47] :D [19:47] evil sith lord? [19:47] brrrrr [19:47] haha star warsd is on tv tonite! [19:47] -d [19:47] no wonder we're talking about the force! [19:47] :D [19:47] source! [19:48] okay click, what was that about vs proc and userlist?! [19:48] we were talkign about oidentd and the implementations there [19:49] running identd on a root-server, allowing it to see vserverprocs and userlists for authentication reasons against irc etc [19:49] hmm, what about running it in the 'WATCH' context (xid=1) ? [19:50] never tried that [19:50] if you manage to synchronize or index the passwd on that ... [19:52] mids:,miller7: still around? [19:52] lp (~lpressl@interner.SerNet.DE) joined #vserver. [19:53] Action: miller7 is here [19:53] ad calculatthe disk space every time, there is a smarter solution ... [19:53] oops, brb, got to deliver a couple of dvd's [19:53] what's that bert/ [19:54] df inside the vserver before shutting down/ [19:54] ? [19:54] at a controlled shutdown, you can save the current values somewhere (for example /var/run/vserver ;) and on controlled restart, you use just those values ... [19:54] that's what I suggested too :) [19:55] ah okay, obviously overlooked that one ... [19:55] in an ideal situation only once you should do a du -s on a vserver [19:55] when starting it for the first time [19:56] or when/if it crashes [19:56] basically it should be treated the same way an fsck is done ... [19:56] Action: mids is [19:57] true [19:57] miller7 did indeed suggest that, watch him; he is smart [19:58] okay, sorry guys for the noise then ;) [19:58] got any idea about the BAD INODE: add_dquot_ref(ddb64000[101], 1) d50eb800[101] null [19:59] hmm, sounds interesting ... [19:59] I did see on the list that a few days ago someone also had quota problems [19:59] mids: where in .nl you are? [19:59] the fix was to use chctx to change the contextid for the /dev/null [19:59] miller7: enschede (close to the german border) [20:00] which kernel/vserver/quota patches? [20:00] ok [20:00] kernel: 2.4.24 [20:00] vserver: 1.24 [20:00] hellekin (~hellekin@menilmontant-2-81-57-191-62.fbx.proxad.net) joined #vserver. [20:00] quota patch: patch-2.4.24-vs1.24-q0.12 [20:00] hi hellekin! [20:00] hello [20:01] the bad inode happens when I run quotaon [20:02] (I got all the context things installed properly, or so I think) [20:02] bertl: the q0.12 part allows setting quotas based on diskspace, or do I have to allocate a new partition for it? [20:03] shit, dinnertime [20:03] sorry [20:03] (haven't checked it out yet) [20:04] I'm wondering how you assign a vserver to a tty, so that you can directly access the machine from the console ? [20:04] Action: click trods off delivering a few dvd's that's been rented. BRB! [20:04] :) [20:04] hellekin: it's a little tricky, but doable [20:05] Bertl if you have a pointer I'd be happy to get into trouble ;o) [20:05] you copy the apropriate /dev/vc/* or whatever it is named, to the vserver and label it /dev/vd/0 there ... [20:05] /dev/vc/0 I mean [20:05] or /dev/vc/1 if you prefer ... [20:06] then you setup inittab to use that device as console ... [20:06] (inside each vserver) [20:06] that should do the trick ... [20:06] ok... That doesn't sound too dirty =8) [20:07] does this incur security problems? [20:07] I want to keep the first two consoles for my host, and assign the next few to vservers, so that, for example, I can have my "client setup" in a virtual context [20:08] hmm, well, a local console user usually is able to run things like keymap/font loading and console switching ... [20:08] if you 'just' want to have access to a vserver on console 2,3,4 ... [20:08] so, if you're on a vserver and switch console, you should get out of the security context ? [20:09] you could use a small script, which does 'vserver exec login' ;) [20:09] and restarts it on the specified console (via inittab) that would not require any changes in the vservers ... [20:09] oh oh... Sounds nicer than messing around with devices [20:10] yeah, but it's not what you actually asked for ;) [20:11] well, i didn't see the problem the way you just described it =8) [20:11] another one happy customer [20:11] hellekin: if you find one of those solutions useful, please add a note to linux-vserver.org/Documentation ... [20:18] ensc (~ircensc@ultra.csn.tu-chemnitz.de) joined #vserver. [20:18] hi [20:18] hi ensc [20:18] hi Enrico! [20:19] bert: should we tell enrico about what you noticed the other day in my test box? [20:19] sure ... [20:20] enrico, in a gentoo system we had issues configuring the tools [20:20] ok Bertl... I'm installing at the moment... I messed things up with my partitions, so I have to reinstall the vservers =8) [20:20] the ext2fs support had problems [20:20] so bert did some magic, deleted some C progs and it compiled [20:21] ensc: I removed all c++ progs ... [20:23] I hope, the ext2fs problems are solved finally with 0.28 [20:26] Bertl: yes, the C++ programs are not used in alpha branch or are broken there [20:26] enrico: you have released 0.28 version? [20:26] miller7: not yet, just a rc [20:26] ok [20:27] the alternative would have been surprising [20:27] ensc: well, funny thing was, I tried alpha and beta, both with my ext2 headers too, both failed ... [20:30] and we could not see the statements you mentioned on the rh bug report ... [20:32] mids: hmm, when does the BAD INODE message happen? [20:32] I think mids is not around [20:33] he said on quotaon [20:33] hmm, probably was part of a netsplit again ... [20:42] did anybody try jfs recently? [20:46] re re [20:46] had a look at the code, the BAD INODE message, when does it happen? [20:46] quoteon [20:46] quotaon even [20:47] shortly after a quotaoff on the same context? [20:47] maybe even a dqhrem/dqhadd sequence? [20:47] no [20:47]