标签：#sysadmin

Le maillon le plus faible de ta sécurité a un pouls. Ce n'est pas ton pare-feu, ni ton chiffrement, ni ton dernier correctif. C'est une personne — et les attaquants le savent bien mieux que la plupart des équipes. Pourquoi forcer une porte blindée quand on peut simplement demander la clé ? La majorité des intrusions sérieuses ne commencent pas par un exploit technique génial. Elles commencent par un e-mail qui a l'air juste assez vrai, un appel qui semble venir du service informatique, une pièce jointe qu'une personne pressée ouvre sans réfléchir. La technologie tient. C'est l'humain qu'on contourne. Cela dérange, parce que c'est plus difficile à corriger qu'une faille logicielle. On ne corrige pas les gens. Mais on peut les préparer. La formation ne consiste pas à traiter les employés d'imprudents ; elle consiste à leur montrer à quoi ressemble vraiment une attaque, pour qu'ils la reconnaissent dans un moment de fatigue. Et il faut concevoir en supposant que quelqu'un se fera avoir un jour. Parce que quelqu'un se fera avoir. L'authentification à plusieurs facteurs, le moindre privilège, la limitation de ce qu'un compte compromis peut atteindre : tout cela existe précisément parce qu'un humain finira par cliquer sur le mauvais lien. La question n'est pas si, mais quand — et ce qui reste debout après. Alors ne consacre pas tout ton budget aux murs et rien aux personnes qui gardent les portes. Le maillon le plus faible a un pouls, un mauvais jour, et une boîte de réception pleine. Protège-le comme le reste de ton infrastructure, parce que c'en est la partie la plus exposée. – Serguey Shinder

On ne gère pas ce qu'on ne mesure pas. C'est l'une des premières leçons de l'exploitation, et pourtant je l'ai apprise à l'envers, en pilotant à l'aveugle bien trop longtemps. Sans mesure, tu ne sais pas si un système va bien. Tu le supposes. Il tourne, personne ne se plaint, donc tout va bien — jusqu'au jour où quelque chose se dégrade lentement, sous le radar, et où tu ne l'apprends que lorsque c'est déjà une panne. La lente fuite de mémoire, le disque qui se remplit, la latence qui grimpe d'une milliseconde par semaine : rien de tout cela ne crie. Ça glisse. La mesure transforme les suppositions en faits. Un tableau de bord, quelques alertes bien choisies, et soudain tu vois le problème arriver au lieu de le subir. Tu n'attends plus que l'utilisateur t'apprenne que ton système est cassé ; tu le sais avant lui. Mais il y a un piège que j'ai appris à éviter : mesurer trop. Cent métriques que personne ne regarde ne valent pas mieux que zéro. Le bruit noie le signal, et les alertes qui se déclenchent sans raison finissent par être ignorées — jusqu'à celle qui comptait vraiment. Bien mesurer, ce n'est pas tout mesurer. C'est choisir les quelques signaux qui prédisent réellement un problème. Alors, avant de bâtir la prochaine chose, demande-toi comment tu sauras si elle va mal. Si la réponse est « quelqu'un finira par le remarquer », tu ne la gères pas encore. Tu espères. Et l'espoir n'est pas une stratégie d'exploitation. – Serguey Shinder

post 8: You run a container. It starts successfully. The application works. So… is it production-ready? Not necessarily. The real test of a production container isn't what happens when everything works. It's what happens when something goes wrong. What happens when the application consumes all available memory? What happens when the process crashes? What happens when the application is running, but isn't actually healthy? Where do the logs go? How do you know something is wrong before users tell you? And when the container fails, how do you find the actual cause? Running Docker in production isn't just about starting containers. It's about making them reliable, observable, manageable, and recoverable. 1. Production Starts With Boundaries A container that works perfectly on a developer's laptop can behave very differently under production load. Development often prioritizes: Speed Convenience Easy debugging Frequent changes Production prioritizes: Reliability Predictability Security Observability Recovery One of the first production questions is: What happens if this container consumes more resources than expected? That's where resource limits come in. 2. Resource Limits – Don't Let One Container Consume Everything Without appropriate resource limits, a container can consume more host resources than intended. For example: docker run \ --memory = 512m \ --cpus = 1.0 \ nginx This limits the container to: 512 MB memory 1 CPU Why does this matter? Imagine one application suddenly starts consuming several gigabytes of memory. Without appropriate limits, it could affect other workloads running on the same host. Resource limits create boundaries between workloads. But remember: A resource limit doesn't fix a memory leak. It only limits how much damage that container can cause to the host. So now we have another question: What if the container is running, but the application inside it is broken? 3. Health Checks – Running Doesn't Mean Healthy One of the most important produc

The blunt tool is still in a lot of GRUB files: GRUB_CMDLINE_LINUX_DEFAULT = "isolcpus=0,1" Then update-grub (or grub2-mkconfig ) and reboot. Userspace tasks stop landing on CPU0/1. That is all most people verify — they fire a few busy loops and top looks empty on those cores. IRQs do not care. isolcpus is a scheduler isolation hint. Hardware interrupts can still fire on the "isolated" CPUs. I watched seven tight loops leave 0/1 idle for processes while /proc/interrupts still ticked on those cores. If you wanted a CPU for DPDK, a user-space NIC, or a cycle-accurate loop, scheduler isolation is necessary and not sufficient . Lab notes (English original is short; this write-up is the missing IRQ half): https://sunshout.tistory.com/1620 How to see what you actually isolated After reboot: cat /proc/cmdline # isolcpus=0,1 must be there grep PREEMPT /boot/config- $( uname -r ) || true taskset -cp 1 # pick a known userspace pid; it should not be 0,1 watch -n1 'grep "^ *[0-9]" /proc/interrupts | head' If IRQs still increment on CPU0/1, isolation is incomplete. That is expected with classic isolcpus= . On newer kernels the story split: isolcpus=domain / cpusets / cgroup cpuset — userspace isolcpus=managed_irq or manual irqaffinity / /proc/irq/*/smp_affinity — interrupts nohz_full= — tick reduction, another knob, not a substitute isolcpus is also marked deprecated in some trees in favor of cpusets. The IRQ caveat did not go away when the docs changed the preferred interface. Moving IRQs by hand Find the noisy ones ( eth0 , NVMe, GPU): grep -E 'eth|nvme|enp' /proc/interrupts # smp_affinity is a hex CPU mask. CPU2 only → 4 echo 4 > /proc/irq/IRQNUM/smp_affinity Or set the default affinity so new IRQs skip 0/1: irqaffinity=2-7 in the same GRUB line (adjust to your CPU count). Some devices ignore this (managed IRQs, VFIO). Then you isolate at the driver: bind the NIC to vfio-pci and poll from a pinned thread. When this shows up next to SR-IOV Passing a VF into KVM does not pin ho

Nobody opens a ticket for an SPF record. There is no alert, no dashboard turning red, no user calling to say that an IP address from a provider the company stopped paying two years ago is still authorized to send email on its behalf. That is exactly what makes it dangerous. I audited the SPF record of a mid-sized manufacturing company in Brazil and found authorized senders that had not been part of the environment for years. Nothing was broken. Email was flowing normally. And that is the point — a bloated SPF record does not fail loudly. It fails quietly, on the day someone decides to use it. The problem The company had migrated its email to Microsoft 365. The migration itself went fine — mailboxes moved, mail flow worked, users were happy, project closed. What nobody revisited was DNS. The SPF record still authorized the IP ranges of the previous email security provider, alongside the current include:spf.protection.outlook.com. Those ranges had been left in place when the provider was decommissioned, and nothing in the environment depended on them anymore. The record said, in effect: these servers are allowed to send email as us. And they were no longer under our control. Two concrete risks come out of that: Spoofing surface. An SPF record is an authorization list. If infrastructure you no longer control is still on it, and that infrastructure is ever repurposed, resold, or compromised, mail from it passes SPF authentication as your domain. Receiving servers will trust it, because you told them to. The 10-lookup limit. SPF allows a maximum of 10 DNS lookups when evaluating a record. Mechanisms like include, a, mx, ptr and redirect each consume from that budget, and nested includes count too. Cross the limit and the evaluation returns permerror — which many receivers treat as a failed check. Legacy entries do not just sit there harmlessly; they consume a budget you may need the next time a business team adopts a new platform. The constraints This is the part that sh

The deadline nobody missed Every expiry story we've written here has the same shape. A certificate lapses, nobody was watching, something breaks, and everyone is surprised. A Splunk license at a federal agency. Microsoft's own network connectivity tool. Same plot, different logo. This one is the opposite, and that's what makes it worth reading. On October 19, 2026, roughly ten weeks from this writing, the Microsoft Windows Production PCA 2011 certificate expires. It sits under the trust chain for the Windows boot process on essentially every PC shipped in the last fifteen years. Nobody forgot it. The expiry date has been printed inside the certificate since 2011. Microsoft has been publishing guidance for over two years, shipping replacement certificates through Windows Update since 2024, running OEM briefings, and pushing an automatic rollout that requires most users to do nothing at all. It is August. It still isn't done. What's actually expiring Three certificates, four replacements, three dates, all in 2026: Certificate Expires Replaced by Microsoft Corporation KEK CA 2011 June 24, 2026 Microsoft Corporation KEK 2K CA 2023 Microsoft Corporation UEFI CA 2011 June 27, 2026 Microsoft UEFI CA 2023 Microsoft Corporation UEFI CA 2011 June 27, 2026 Microsoft Option ROM UEFI CA 2023 Microsoft Windows Production PCA 2011 October 19, 2026 Windows UEFI CA 2023 Both June dates have already passed. October is the one that matters most, because that's the certificate used to sign the Windows Boot Manager itself. Devices that don't pick up the 2023 certificates keep booting and keep taking normal Windows updates. What they lose is the ability to receive new protections for the early boot path: updates to Boot Manager, Secure Boot database changes, revocation lists, and mitigations for bootkit vulnerabilities discovered from here on. In other words, the machine doesn't fail. It just quietly stops being patchable in the one layer that sits below your antivirus, your EDR agent, a

A zero-dependency, single-file Go pastebin built for terminals — burn-after-read by default, two independent encryption layers, and a curl one-liner instead of a login form. I keep ending up in situations where I need to move a small piece of text — a log snippet, a password, a container's stdout — from one machine to another, and the clipboard just isn't there. SSH session on a remote box. A locked-down corporate laptop that won't let me touch the OS clipboard at all. A container with no shared volume and no browser. Slack is right there, but pasting a database password into a channel that's archived forever is a special kind of bad idea. So I built CPYNET — a paste-sharing tool with exactly one interface that matters: curl . echo "hello world" | curl --data-binary @- https://cpynet.com/ # https://cpynet.com/482913 curl https://cpynet.com/482913 # hello world That's the whole thing. No account, no API key, no clicking around. Two curl calls and you've moved text between two machines that have nothing in common except a network path. Burn-after-read, actually The paste above is gone the instant that second curl runs. Not "gone in 24 hours" — gone the moment it's read , whether that's one second later or one minute later. Read it twice (even from the same machine) and the second request gets a plain 404 . It also auto-expires on a timer (2 minutes by default) even if nobody ever reads it, so an unread secret doesn't just sit there. None of this lives on disk. It's a Go map behind a mutex, in memory, for the lifetime of one process. Restart the server and every paste that hasn't been read yet is just... gone. That's not a limitation I'm working around — it's the actual point. A "burn after read" tool that persists to disk somewhere you're not thinking about isn't really burning anything. The shell functions, if you don't want to remember the curl flags curl -s https://cpynet.com/install.sh -o install.sh && bash -n install.sh && . install.sh That wires up two functions

Most Linux problems aren't actually difficult. They're difficult because they're often debugged in the wrong order. Many beginners immediately: Restart services randomly Run commands without a plan Change configurations before understanding the problem Guess instead of observing Experienced engineers do something different. They follow a structured troubleshooting process. This article isn't about learning new Linux commands. It's about knowing when and why to use the commands you've already learned throughout this Linux Beginner Series. Think of it as putting everything together into one practical troubleshooting workflow that's used in real Linux and DevOps environments. Quick Troubleshooting Workflow Observe ↓ Check System Health ↓ Identify Problem Type ↓ Read Logs ↓ Verify Service ↓ Check Network ↓ Check Disk ↓ Recent Changes ↓ Find the Root Cause ↓ Apply the Fix Keep this workflow in mind as you read through the guide. Step 0: Observe Before You Change Anything Before running a single command, pause for a moment. Ask yourself: What exactly is broken? When did the issue start? Is everyone affected or only some users? Is the problem constant or intermittent? What changed recently? Many troubleshooting sessions become longer because people try to fix the problem before they understand it. Good troubleshooting begins with observation, not commands. Step 1: Check Overall System Health Your first goal is to understand the overall health of the system—not to fix anything yet. Useful commands: uptime free -h top Look for: High load average High CPU usage Low available memory Signs that the server is under heavy load At this stage, you're only gathering evidence. A quick system health check often tells you where to investigate next. Step 2: Identify the Type of Problem Before diving deeper, classify the issue. Problem Type Common Symptoms First Commands to Check CPU Slow system, high CPU usage top , htop Memory Applications crashing, OOM kills free -h Disk "No space lef

A spreadsheet containing laptop serial numbers is not proof that every endpoint is managed. It proves only that someone created a spreadsheet. For an audit, customer security review, onboarding check, or incident investigation, the evidence needs to connect four facts: The organisation expects the device to exist. The device is assigned to an accountable owner or lifecycle state. A management or monitoring control is actively reporting from it. The reported evidence is recent enough to support the decision being made. A device can appear in an asset register while being absent from the management platform. It can also appear in the management platform while belonging to a former employee or reporting data that is months old. Control objective: Maintain a current, reconciled inventory of expected endpoints, managed endpoints, owners, security state, and unresolved exceptions. 1. Define what "managed" means before counting devices Teams often use the word managed without an operational definition. That creates false confidence. An endpoint should not count as managed merely because an agent was installed once. For a company-owned laptop, a practical definition normally requires all of the following. Criterion Minimum evidence Identity Hostname, serial number, hardware identifier, operating system, and management record can be tied to one device Ownership Named user, department, custodian, stock status, repair status, or retirement state Control Expected MDM, RMM, EDR, or other endpoint control is enrolled and associated with the correct organisation Freshness Last check-in and evidence timestamps fall within a documented threshold Posture Update, encryption, firewall, antimalware, restart, and other required states are known Accountability Deviations have a reason, owner, approval, target date, and review history A device that fails one criterion should not disappear from the report. It should remain visible as an exception. 2. Reconcile three sources of truth No sing

Most enterprise teams know the CISA Known Exploited Vulnerabilities catalog the same way they know the weather: a headline scrolls past ("CISA adds three vulnerabilities to KEV catalog"), someone forwards it, and everyone nods. That is a waste of the single most operationally useful list in vulnerability management. The KEV is small, machine-readable, updated near-daily, and every entry on it has one property your scanner output cannot give you: a real attacker has already used it against a real network. This is a guide to the catalog itself: what it promises, what it doesn't, how the feeds are structured, how to map entries to your own estate without fooling yourself, and how to combine it with EPSS and vendor advisories into a defensible patch-ordering rule. Everything here is verified against the live feed and CISA's own pages as of late July 2026. What the KEV is, and what it is not CISA describes the KEV as the authoritative source of vulnerabilities that have been exploited in the wild . Entry is gated by three criteria , all of which must hold: The vulnerability has an assigned CVE ID. There is reliable evidence of active exploitation in the wild. There is a clear remediation action, such as a vendor-provided update. Read those criteria as exclusions and the catalog's real shape appears. No CVE assigned yet? Not in the KEV, even if exploitation is rampant. Exploitation reported but CISA's evidence bar not met? Not in the KEV. Actively exploited but no fix or mitigation exists? Not in the KEV. The catalog is a curated floor, not a census. As of the 2026.07.29 release the feed contains 1,656 entries, against an ecosystem publishing tens of thousands of CVEs per year. Absence from the KEV is not evidence of safety; presence is close to proof of danger. That asymmetry is the whole point, and it is why the correct reading of the list is "everything on here is urgent" rather than "everything urgent is on here." The distribution is also worth knowing before you buil

Working with files in Linux isn't just about creating and editing them. Sometimes you need to: Archive multiple files into one Compress files to save disk space Share files with others Create backups Linux provides several tools for this, each with a different purpose. Let's simplify them. What is File Compression? File compression reduces the size of a file. Benefits: Saves disk space Faster file transfers Easier backups Reduces bandwidth usage Example: A 100 MB log file might become a much smaller compressed file, depending on its contents. Archive vs Compression Many beginners think they're the same. They are not. Archive Combines multiple files into a single file. Example: photos/ docs/ notes.txt ↓ backup.tar Compression Reduces the size of a file. Example: backup.tar ↓ backup.tar.gz 👉 tar archives files. gzip compresses them. 1. Create an Archive with tar tar -cvf backup.tar Documents/ #Create an archive tar -tvf backup.tar #View archive contents tar -xvf backup.tar #Extract an archive Options: c → Create v → Verbose (show progress) f → File name x → Extract Best for: Backups Bundling multiple files Moving folders 2. Compress with gzip Compress a file: gzip file.txt # Creates file.txt.gz # Result file.txt.gz gunzip file.txt.gz # decompress gzip -k file.txt # Keep original file Best for: Log files Large text files Saving disk space 3. Archive and Compress Together Most common command: # Create compressed archive tar -czvf backup.tar.gz Documents/ # Extract tar -xzvf backup.tar.gz Options: z → Use gzip compression 👉 This is one of the most common backup commands in Linux. 4. Working with ZIP Files # Create ZIP zip -r project.zip project/ # Extract unzip project.zip # List contents unzip -l project.zip Best for: Sharing files with Windows users Cross-platform compatibility 5. Compare the Tools Tool Purpose Best For tar Archive files Backups gzip Compress files Saving space tar + gzip Archive and compress Linux backups zip Archive and compress Sharing files across

By default, whenever you request a machine learning model, the underlying architecture saves gigabytes of tensor data into a hidden directory located directly inside your home folder ( ~/.cache/huggingface ). Because standard bare metal and virtual cloud configurations typically isolate the root operating system on a smaller, highly optimized boot drive, pouring 140GB+ of raw weights into the home folder guarantees absolute storage exhaustion. Here is the engineering blueprint to fix it cleanly on Linux. The Cache Location Trajectory When attempting to solve this problem, avoid outdated tutorials recommending deprecated parameters like TRANSFORMERS_CACHE . Environment Route Support Status Architecture Impact HF_HOME Active Master Route Safely redirects all models, datasets, and core assets globally. TRANSFORMERS_CACHE Deprecated Warning Fails to capture datasets and will be removed in version 5.0. HUGGINGFACE_HUB_CACHE Deprecated Warning Legacy routing path that creates unnecessary diagnostic warnings. 🛑 The Symlink Security Risk Creating symbolic links (symlinks) to trick the OS into routing files elsewhere is a common anti-pattern. Mapping these links improperly or running your workflow with elevated rights introduces privilege escalation vulnerabilities, compromising container and host security. Step 1: The Permanent Environment Override To change your Hugging Face cache directory on Linux permanently, target an expansive secondary storage array instead by appending a direct master route into your user profile configuration: # Create a dedicated folder inside your secondary storage array sudo mkdir -p /mnt/massive_drive/ai_model_cache sudo chown -R $USER : $USER /mnt/massive_drive/ai_model_cache # Append the master environment variable to your bash profile echo 'export HF_HOME="/mnt/massive_drive/ai_model_cache"' >> ~/.bashrc source ~/.bashrc Step 2: The Python Import Order Mandate If you declare your custom storage location programmatically inside an application

Quick Note In my previous article, I mentioned that Linux Troubleshooting Flow for Beginners would be the final post in this series. While preparing it, I realized there were a few practical Linux skills every beginner should learn first. These topics will make the troubleshooting guide much easier to understand and follow. Before we wrap up the series, we'll cover: Package Management Finding Files & Text Viewing Files Efficiently File Compression Then we'll bring everything together in the final Linux Troubleshooting Flow for Beginners. Introduction Installing software on Linux is very different from Windows. On Windows, you usually download an .exe installer. On Linux, software is typically installed and managed using package managers . This is one of the most practical skills every Linux beginner should learn early. What is a Package? A package is a ready-to-install bundle that contains: The main program Required libraries Configuration files Documentation Examples: nginx , git , docker , curl , vim Think of a package as a ready-to-install software box. What is a Package Manager? A package manager is a tool that installs, updates, removes, and manages software packages. Instead of downloading software manually, you simply run a command. Example: sudo apt install git The package manager automatically: Downloads packages from trusted repositories Install required dependencies automatically Upgrade installed software Removes them cleanly Instead of manual downloading, you just run one command. Why Use a Package Manager? Without package managers, you would have to: Search for software manually Download files from websites Install dependencies yourself Update each application separately Package managers automate all of this. What is a Repository? Package managers download software from repositories. A repository is a trusted online collection of software packages maintained by your Linux distribution. Instead of downloading software from random websites, Linux install

Originally published on bckinfo.com How to Install VMware ESXi: Step-by-Step Bare-Metal Setup Guide Table of Contents ESXi vs. VMware Workstation: Which One Do You Need Hardware Compatibility Check Downloading the ESXi Installer Creating a Bootable USB Installer BIOS/UEFI Preparation Installing ESXi: Step by Step Configuring the Management Network Accessing the vSphere Host Client Creating Your First Virtual Machine Post-Installation Checklist Common Issues and Quick Fixes Closing Notes If you've read our complete guide to VMware virtualization , you already know ESXi is the bare-metal hypervisor underneath vSphere. This guide is the hands-on counterpart — installing ESXi directly on physical server hardware, from hardware compatibility checks through booting your first virtual machine. ESXi vs. VMware Workstation: Which One Do You Need Before starting, it's worth confirming you actually want ESXi and not VMware Workstation. They solve different problems: VMware Workstation is a Type-2 hypervisor — it installs on top of an existing OS (Windows, Linux, macOS via Fusion). Good for running a VM or two on a laptop or desktop you also use for everything else. If that's your case, our guide on installing VMware Workstation on CentOS Stream 10 is the right starting point instead. ESXi is a Type-1, bare-metal hypervisor — it installs directly on the hardware with no host OS underneath it. This is the right choice for a dedicated server running multiple VMs, a home lab, or anything that needs to scale beyond "a VM running alongside my desktop." The rest of this guide assumes you're installing on dedicated hardware that won't run anything else. Hardware Compatibility Check This is the step most worth not skipping. ESXi has a defined Hardware Compatibility List (HCL), and installing on unlisted hardware is the single biggest source of installation failures and post-install driver issues. Check your exact server model and component list (NIC, storage controller) against VMware'

The homelab started flat. One /24, everything on it. My workstation, the NAS, the Proxmox host, and — over time — a growing list of workloads sharing the same broadcast domain because that was the path of least resistance. For a while, that was fine. A homelab running one workload doesn't need segmentation any more than a house needs an office door. Then I stood up an Akash provider. An Akash provider is, in shape, a Kubernetes cluster that accepts inbound tenant workloads from the internet — real deployments, paying for compute, containers I didn't write landing in namespaces on my hardware. The provider itself is documented at github.com/jjozzietech/akash-provider-ops-public — this piece is about the network underneath it. The containerisation posture itself is fine. I trust the isolation model. But trust isn't a network design. And the network at that moment had the tenant workload cluster sitting on the same subnet as my workstation, my NAS, and my Proxmox management interface. That was the moment I stopped thinking of the rack as a home network with extra boxes, and started thinking of it as a small data centre. This piece is the network design that came out of that shift. I'll cover the layout, the rules that hold it together, and the Nexus and Proxmox configs that anchor it — with the specifics of my own deployment sanitised. It's not a step-by-step replication guide. It's the design pattern, with enough of the shape to be useful and enough restraint to not double as a recon document for my own rack. // the original design The flat layout looked like this: home lan — 192.168.1.0/24 opnsense (perimeter) cisco nexus (dumb L2 switching) proxmox host workload VMs (all on the same subnet) What it got right: zero routing complexity, everything reachable from everywhere, fast to stand up. If you're running one project on a homelab, this is the correct design. Don't over-engineer it. What stopped working, as soon as the second project landed on the rack, was that the

When something breaks in Linux, experienced engineers don’t guess. They check the logs. 👉 Logs are the “black box recorder” of a Linux system. They tell you: what happened when it happened why it failed If you can read logs properly, you can debug almost anything. What Are Logs? Logs are records of system and application activity. Linux constantly records: System events Errors User activity Application behavior Linux constantly records: Where are Logs Stored? Most Linux logs are stored inside: /var/log Check logs directory: cd /var/log ls This is the first place DevOps engineers check during system issues. Important Log Files Log File Purpose Command to View /var/log/syslog General system messages tail /var/log/syslog /var/log/auth.log Login attempts & authentication tail /var/log/auth.log /var/log/kern.log Kernel & hardware messages dmesg or tail /var/log/kern.log /var/log/nginx/error.log Web server errors (Nginx) tail /var/log/nginx/error.log /var/log/dmesg Boot and hardware logs dmesg /var/log/apache2/ -> Apache logs These logs help you identify system, security, and application-level issues. View Logs Using cat cat /var/log/syslog Good for small files. Using less less /var/log/syslog Useful keys:: Space → Next page b → Previous page q → Quit 👉 Best for large log files. Using tail tail /var/log/syslog Show last 10 lines. Real-Time Monitoring (tail -f) tail -f /var/log/syslog 👉 -f = follow live updates This is one of the most-used debugging commands in production servers. Stop with: Ctrl + C Searching Logs with grep grep error /var/log/syslog Case-insensitive: grep -i failed /var/log/auth.log Show latest matching errors: grep error /var/log/syslog | tail -n 50 👉 Essential for filtering huge logs quickly. Boot & Hardware Logs (dmesg) dmesg Shows: Boot messages Hardware detection Kernel events Useful for startup and hardware troubleshooting. Modern Log System: journalctl Modern Linux systems use systemd logs . journalctl Recent errors: journalctl -xe Specific servic

A */1 rsync took our staging box to a load average of 41 one afternoon, and it took me longer than I want to admit to work out why. The sync normally finished in about twenty seconds. That day the backup target's NFS mount went sluggish, the sync started taking ninety seconds, and cron — which does not know or care whether the last run is still going — launched a fresh copy every single minute on top of it. Inside ten minutes there were a half-dozen rsyncs all reading the same tree off the same slow disk, each one making the disk slower, each new minute adding another. The box wasn't under attack. It was attacking itself, one polite copy at a time. The thing that stung was that nothing was broken — every individual rsync was correct, the disk eventually recovered on its own, and the only reason it became an outage is that cron has no concept of "the last one is still running." That's the trap with scheduled jobs: a command that's perfectly fine when you run it by hand can take down a server the first time it runs longer than its interval with nobody watching. The fix everyone reaches for first is the wrong one The instinct is a PID file: write $$ to /var/run/job.pid on start, check whether that file exists on the next run, bail if it does. It almost works. Then one run gets kill -9 'd, or the box reboots mid-job, and the PID file is left behind pointing at a process that died on Tuesday. Now every future run sees a "lock" owned by a PID that no longer exists, and the job never runs again — the opposite failure, just as silent. There's also a race between the check and the write, and the times you most need the lock to be clean are exactly the times cleanup didn't happen, because the process died before it could clean up. flock has none of that. The lock isn't a file you create and delete — it's a lock the kernel holds on an open file descriptor , and the kernel releases it automatically the instant that descriptor closes. The process exiting closes it. So does crash

When a RAID array fails, the worst thing you can do is panic and start poking at it immediately. I've seen too many cases where an impatient rebuild attempt overwrote the only good copy of data. This walkthrough covers how to safely approach a degraded or failed RAID — with ddrescue as your best friend. Step 0: Stop. Don't touch the array yet. Before running mdadm --assemble , before doing anything, clone your physical disks . A RAID 5 with one failed drive can lose everything the moment a second drive throws a read error during rebuild. This isn't hypothetical — it's how most total RAID losses happen. The golden rule: image first, recover second . Step 1: Assess the damage # Check current RAID state cat /proc/mdstat # More detail mdadm --detail /dev/md0 Look for: [UUU_] — one drive failed (underscore = missing) [UU__] — two drives failed (catastrophic for RAID 5) State: degraded , recovering , or failed Do NOT run mdadm --manage /dev/md0 --add /dev/sdX yet. Stop the array instead: mdadm --stop /dev/md0 Step 2: Clone each disk with ddrescue ddrescue is the right tool because it handles read errors gracefully: it maps bad sectors, retries them, and lets you resume interrupted sessions. Never use dd for a failing disk. Install it: # Debian/Ubuntu sudo apt install gddrescue # RHEL/CentOS sudo dnf install ddrescue Clone each RAID member to a separate image file (you need enough storage — same total size as all disks combined): # First pass: copy everything readable, skip bad sectors fast sudo ddrescue -d -r0 /dev/sda /mnt/backup/sda.img /mnt/backup/sda.log # Second pass: retry bad sectors up to 3 times sudo ddrescue -d -r3 /dev/sda /mnt/backup/sda.img /mnt/backup/sda.log Key flags: -d — direct disk access (bypass kernel cache) -r0 / -r3 — retry bad sectors 0 or 3 times The .log mapfile is critical: it lets you resume if the clone is interrupted Repeat for every disk in the array ( sdb , sdc , etc.). Step 3: Work from the images Once you have image files, assemble a soft

I’m a PAM engineer and recently had to handle a few cross‑tenant migrations in Delinea Secret Server. As many of you know, there’s no built‑in way to migrate secrets, folders, roles, or permissions between tenants (cloud ↔ cloud, on‑prem ↔ on‑prem, hybrid, etc.). To avoid doing everything manually, I built an unofficial PowerShell‑based tool to automate the process. Not a vendor, not selling anything — just sharing something I built because it solved a real problem for me. What it does: Full Windows GUI Export → validate → import → reconcile Folder/role/permission mapping Integrity checks Supports cloud, on‑prem, and hybrid Auto‑update logic for long‑term use If anyone else here works with Secret Server and has had to deal with tenant splits, mergers, rebuilds, or cloud migrations, this might save you some time. Github Link: https://github.com/vijayamohanreddy/delinea-secrets-server-migration-tool-unofficial Linkedin Article: https://www.linkedin.com/pulse/introducing-delinea-secret-server-crosstenant-tool-vijaya-reddy-vj--wy47c/?trackingId=vJ3%2F9%2Fw3RLSKlm%2F1kXig1Q%3D%3D Affiliation disclosure: I built this myself for my own work. Not affiliated with Delinea, not a vendor, not selling anything. Happy to answer questions or hear suggestions from others who’ve had to do Secret Server migrations.

Not every old business web app needs a full Internet Explorer environment. That sounds obvious, but it is easy to miss when a legacy intranet, ERP, OA, or ASP.NET WebForms page fails in Chrome or Microsoft Edge. The first instinct is often to put the whole system into IE mode. Sometimes that is absolutely correct. Other times, the page mostly works in Chromium and only breaks on older JavaScript or DOM assumptions. The useful first step is to separate those two cases. Case 1: the page needs a real IE engine Use Microsoft Edge IE mode, a Windows virtual machine, remote desktop, or another managed legacy-browser path if the page depends on: ActiveX controls COM integration VBScript Trident or MSHTML rendering behavior Browser Helper Objects Java applets strict IE7 or IE8 document modes A Chrome extension or JavaScript compatibility layer should not be presented as a replacement for those requirements. If the workflow depends on the IE engine, the browser engine is part of the application runtime. Case 2: the page mostly works, but old browser assumptions fail There is another common category. The page loads in Chrome or Edge, authentication works, and the main UI appears, but a small set of old behaviors fails. Examples include: empty frameset entry pages loading pages that do not finish redirecting attachEvent window.event event.srcElement showModalDialog -style picker flows document.frames older WebForms date fields that call a calendar function on focus For maintained source code, the best answer is still to fix the application. Replace old event APIs, remove synchronous dialog assumptions, and modernize generated WebForms scripts where possible. But in many real organizations, the legacy page is owned by a vendor, frozen department system, or migration backlog. In that situation, a scoped compatibility layer can be worth testing before moving the whole workflow into IE mode. A low-risk triage sequence I use this sequence: Pick one legacy hostname. Pick one failing