Usage:

# zonetype.sh -g or –global
Return 0: The machine is a global zone with 1 or more local zones
Return 1: The machine is not a global zone

# zonetype.sh -l or –local
Return 0: The machine is a local zone
Return 1: The machine is not a not a local zone

# zonetype.sh -v or –vmware
Return 0: The machine is running on a VMware hypervisor
Return 1: The machine is not running in VMware

#! /bin/bash
#
# When issued with the -g or --global flag, this script will return:
# 0 if the machine is a global zone and has one or more local zones.
# Otherwise, it will return 1
#
# When issued with the -l or --local flag, this script will return:
# 0 if if is a local zone and 1 if it is not
#
# When issued with the -v or --vmware flag, this script will return:
# 0 if it is a vmware host and 1 if not.
#

list=( `/usr/sbin/zoneadm list -civ | awk '{ print $1 }'`)

  case "$1" in
    -g|--global)
        # If the third element in our array is null, set it to 0
        if [ "${list[2]}" == ""  ]; then
        list[2]=0
        fi
        # This is a global zone only if it has one or more local zones.
        if [ ${list[1]} -eq 0 ] && [ ${list[2]} -ge 1 ]; then
        # 1 is returned if we have a global and local zone,
        # otherwise, we return 0
                exit 0
            else
                exit 1
        fi
              ;;
    -l|--local)
        # If the second element in our array is = or > 1, it is a local zone.
        if [ ${list[1]} -ge 1 ]; then
        # Return 1 if this is a local zone, otherwise return 0.
                exit 0
            else
                exit 1
        fi

              ;;
   -v|--vmware)
        # Don't run our check on local zones... Prtdiag can't run there
        if [ ${list[1]} != 0 ]; then
                exit 1
           else
                vmhost=( `/usr/sbin/prtdiag | grep System | awk '{ print $5 }'`)
                if [ $vmhost == VMware ]; then
                        #If the host is running on the vmware cluster return 0,
                        # otherwise, return 1
                        exit 0
                else
                        exit 1
                fi
        fi
              ;;
        *)
        echo "Usage: /local/adm/zonetype.sh {-l | --local | -g | --global | -v | --vmware}"
        exit 1
  esac

Uncommnet the following lines in /opt/coolstack/php5/lib/php.ini.

extension=iconv.so
extension=mbstring.so
extension=ctype.so


Finally, restart apache:

svcadm restart apache22-csk


I’m pretty new to this kind of thing, so I’ve been using web tutorials to work my way up from the most basic blinking LED to something that actually monitors oxygen sensors and populates an LCD with information. Some of the more valuable resources I have used are as follows:

• A really good five-part tutorial to get started
• A tutorial to get started with analog input
• Guide to using serial LCD’s from Spark Fun Electronics
• A solution to some common problems with interupts
• Some good examples of code using an LCD menu with three buttons

A few banana slug facts:

• They are native to the Northwest
• The are HUGE! Some have reached 10 inches in length, and weights of a quarter of a pound.
• They were almost the official mollusk of California. Yes, the legislature actually voted in the noble slug, but the Governor vetoed it.
• They are the official mascot of UC Santa Cruz.

Banana Slug

It is generally a good idea to firewall off your MySQL port (3306) unless you are on a secure network. The downside to this is that it prevents you from using GUI tools like Navicat to connect to your database server. No problem, just use this command to SSH tunnel a connection. After doing this, you can connect to your database on localhost port 8888:

ssh -fNg -L 8888:127.0.0.1:3306 login@mysql-server


Once you have installed a new instance of MySQL, you have to change the root password:

# mysql -u root
mysql> SET PASSWORD FOR 'root'@'localhost' = PASSWORD('newpwd');
mysql> SET PASSWORD FOR 'root'@'yourhostname' = PASSWORD('newpwd');
mysql> exit


Depending on the way you handle your MySQL installation, you will most likely have to run the mysql_upgrade script after upgrades to use all the new features:

mysql_upgrade -u root –password=yourpassword


Do a thorough check to see if your tables are corrupted:

mysqlcheck -u root -p --check --extended --all-databases


Repair any corruption if it exists:

mysqlcheck -u root -p --repair --all-databases


Look at all your tables and optomize them if necessary:

mysqlcheck -u root -p --optimize --all-databases


Santa Cruz lady at city council meeting:

Santa Cruz Lady Vs. Sarah Palin:

The whole Santa Cruz City Council Mashup:

• Return 0 if the machine is a global zone with 1 or more local zones
• Return 1 if the machine is either a local zone or a global zone with 0 local zones

#! /bin/bash
#
# When issued with the -g or --global flag, this script will return:
# 0 if the machine is a global zone and has one or more local zones.
# Otherwise, it will return 1
#
# Wen issued with the -l or --local flag, this script will return:
# 0 if if is a local zone and 1 if it is not
#

list=( `/usr/sbin/zoneadm list -civ | awk '{ print $1 }'`)
  case "$1" in
    -g|--global)
        # If the third element in our array is null, set it to 0
        if [ "${list[2]}" == ""  ]; then
        list[2]=0
        fi
        # This is a global zone only if it has one or more local zones.
        if [ ${list[1]} -eq 0 ] && [ ${list[2]} -ge 1 ]; then
        # 1 is returned if we have a global and local zone, otherwise, we return 0
                exit 0
            else
                exit 1
        fi
              ;;
    -l|--local)
        # If the second element in our array is = or > 1, it is a local zone.
        if [ ${list[1]} -ge 1 ]; then
        # Return 1 if this is a local zone, otherwise return 0.
                exit 0
            else
                exit 1
        fi
              ;;
        *)
        echo "Usage: /local/adm/zonetype.sh {-l | --local | -g | --global}"
        exit 1
  esac

Many modern RAID arrays just require you to take out the bad drive and plug in the new one, while everything else is taken care of automatically. It’s not quite that easy on a Sun server, but it’s really just a few simple steps. I just had to do this, so I thought I would write down the procedure here.

Basically, the process boils down to the following steps:

• Detach the failed meta devices from the failed drive
• Delete the meta devices from the failed drive
• Delete the meta databases from the failed drive
• Unconfigure the failed drive
• Remove and replace the failed drive
• Configure the new drive
• Copy the remaining drive’s partition table to the new drive
• Re-create the meta databases on the new drive
• Install the bootblocks on the new drive
• Recreate the meta devices
• Attach the meta devices

Let’s look at each step individually. In my case, c0t1d0 has failed, so, I detach all meta devices on that disk and then delete them:


# metadetach -f d0 d2
# metadetach -f d10 d12
# metadetach -f d40 d42
# metaclear d2
# metaclear d12
# metaclear d42


Next I take a look at the status of my meta databases. Below we can see the the replicas on that disk have write errors:

# metadb -i
        flags           first blk       block count
     a m  p  luo        16               8192            /dev/dsk/c0t0d0s3
     a    p  luo        8208             8192            /dev/dsk/c0t0d0s3
     W    p  luo        16                8192            /dev/dsk/c0t1d0s3
     W    p  luo        8208            8192            /dev/dsk/c0t1d0s3
 r - replica does not have device relocation information
 o - replica active prior to last mddb configuration change
 u - replica is up to date
 l - locator for this replica was read successfully
 c - replica's location was in /etc/lvm/mddb.cf
 p - replica's location was patched in kernel
 m - replica is master, this is replica selected as input
 W - replica has device write errors
 a - replica is active, commits are occurring to this replica
 M - replica had problem with master blocks
 D - replica had problem with data blocks
 F - replica had format problems
 S - replica is too small to hold current data base
 R - replica had device read errors

The replicas on c0t1d0s3 are dead to us, so let’s wipe them out!


# metadb -d c0t1d0s3
# metadb -i


        flags           first blk       block count
     a m  p  luo        16               8192            /dev/dsk/c0t0d0s3
     a    p  luo        8208             8192            /dev/dsk/c0t0d0s3

The only replicas we have left are on c0t0d0s3, so I’m all clear to unconfigure the device. I run cfgadm to get the c0 path:


# cfgadm -al


Ap_Id                          Type         Receptacle   Occupant     Condition
c0                             scsi-bus     connected    configured   unknown
c0::dsk/c0t0d0                 disk         connected    configured   unknown
c0::dsk/c0t1d0                 disk         connected    configured   unknown
c0::dsk/c0t2d0                 disk         connected    configured   unknown
c0::dsk/c0t3d0                 disk         connected    configured   unknown
c1                             scsi-bus     connected    configured   unknown
c1::dsk/c1t0d0                 CD-ROM       connected    configured   unknown
usb0/1                         unknown      empty        unconfigured ok
usb0/2                         unknown      empty        unconfigured ok
usb1/1.1                       unknown      empty        unconfigured ok
usb1/1.2                       unknown      empty        unconfigured ok
usb1/1.3                       unknown      empty        unconfigured ok
usb1/1.4                       unknown      empty        unconfigured ok
usb1/2                         unknown      empty        unconfigured ok

I run the following command to unconfigure the failed drive:


# cfgadm -c unconfigure c0::dsk/c0t1d0


The drive light turns blue
Pull the failed drive out
Insert the new drive

Configure the new drive:


# cfgadm -c configure c0::dsk/c0t1d0


Now that the drive is configured and visible from within the format command, we can copy the partition table from the remaining mirror member:


# prtvtoc /dev/rdsk/c0t0d0s2 | fmthard -s - /dev/rdsk/c0t1d0s2


Next, I install the bootblocks onto the new drive:


# installboot /usr/platform/`uname -i`/lib/fs/ufs/bootblk /dev/rdsk/c0t1d0s2


Create the state replicas:


metadb -a -c 2 c0t1d0s3


Recreate the meta devices:

metainit -f d2 1 1 c0t1d0s0
metainit -f d12 1 1 c0t1d0s1
metainit -f d42 1 1 c0t1d0s4


And finally, reattach the metadevices which will sync them up with the mirror.


metattach d0 d2
metattach d10 d12
metattach d40 d42


So what the heck is this UNIX time anyhow? Well, simply put, it’s actually the exact number of seconds since the the Unix epoch. This was 00:00:00 UTC on January 1, 1970.

From Wikipedia:

It is not a linear representation of time nor a true representation of UTC (though it is frequently mistaken for both) as the times it represents are UTC but it has no way of representing UTC leap seconds (e.g. 1998-12-31 23:59:60).

I used to create a special rule for MySQL that only allowed connections from my own network, but lately I have been omitting this rule and tunneling the connection through ssh instead. That is why it is commented out in the script below.


### SCRIPT ###
#!/bin/sh
# Drop all incoming traffic
/sbin/iptables -P INPUT DROP
# Drop all forwarded traffic
/sbin/iptables -P FORWARD DROP
# Allow all outgoing traffic
/sbin/iptables -P OUTPUT ACCEPT
# Allow returning packets
/sbin/iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Allow incoming traffic on port 80 for web server
/sbin/iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
# Allow MySQL only from a certain network
/sbin/iptables -A INPUT -p tcp -m tcp -s XXX.XXX.XXX.0/24 --dport 3306 -j ACCEPT
# Allow local traffic
/sbin/iptables -A INPUT -i lo -j ACCEPT
# Allow incoming SSH on port 22
#/sbin/iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
# Allow ping
/sbin/iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
/sbin/iptables-save > /etc/sysconfig/iptables
chmod go-r /etc/sysconfig/iptables
/sbin/sudo service iptables restart
### /SCRIPT ###


Here is what /etc/sysconfig/iptables looks like after running this script:


# Generated by iptables-save v1.3.5 on Wed Dec 31 13:47:40 2008
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [12:8972]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
COMMIT
# Completed on Wed Dec 31 13:47:40 2008


After you are done, make sure you have iptables setup to start when the system boots.


# /sbin/chkconfig --list | grep iptables

iptables       	0:off	1:off	2:on	3:on	4:on	5:on	6:off

If it’s not on, just run:

/sbin/chkconfig iptables on


First, create and edit “/var/sadm/install/admin/custom”, adding a line similar to this:
basedir=/var/applications/$PKGINST

Next, issue the pkgadd command with the “-a” flag to call you alternative admin file:

pkgadd -d device -a custom PackageName

This really comes in handy when your customers want to retain control over their packages, but you don’t want to give them access to write packages into the system area. More detailed instructions can be found here.

This is exactly what happened when I saw this article about the Pionen datacenter, owned by Bahnhof in Sweden. Located nearly 100 feet beneath the city of Stockholm, this epic datacenter has been compared (fairly I might add) to the secret layer of a James Bond villian. It’s got backup power provided by twin submarine engines, triple-redundant internet backbone connections, and can reportedly stand up to a Hydrogen bomb. We spend so much time and effort trying to make our servers comfortable when designing datacenters, we often forget about the Human element. Even though these guys are literally working in a cave, it’s nice to see that Bahnhof is trying to make its people comfortable as well.

I applied for a UNIX Systems Engineer position at the University of California Santa Cruz, and was offered the job back in July. After some serious soul searching, I decided to accept, and we started the process of relocating a full 3,000 miles from home, which I can assure you is no simple task! I’ve been here just under two weeks, but Courtney is still tidying up our affairs in Vermont before she starts the long journey out here in our car. Yep… That’s car, not cars. The public transportation system is so good out here that we can finally be a single car family. For my part, I’ve managed to move clear across this country twice and not driven it a single time. This is fine with me, however, since I have very little interest in seeing middle America.

Casey and I managed to find Paula’s Breakfast Shack while he was out for WordCamp 08. Home of the $1.99 Basic Breakfast, this place is so good, that I simply can’t imagine going anywhere else for eggs and home fries! I’ve tried a number of taquerias, but the jury is still out on which one is best. Once I find it I’ll have to freeze some tacos and burritos and send them out to Matt, who has strongly indicated that he hates me for having such easy access to good Mexican Food.

To do this, I started by installing a minimal copy of RHEL 4, making sure to lay the filesystems out in exactly the same way as they were on the old server. I then went through several experiments, leaving just the bare minimum files and directories required for the hardware and booting, but formatting all other filesystems and restoring the data from our old server. In the end, the below process resulted in system that worked perfectly, and very closely mirrored the original server.

• I conducted a minimal OS install on the new server, replicating the filesystem layout on the old server.
• I booted the new server from DVD in rescue mode, allowing it to mount the filesystems in /mnt/sysimage
• I removed EVERYTHING in every filesystem and directory EXCEPT the following:

• Everything in /sys
• Everything in /dev
• Everything in /proc
• Everything in /boot
• /lib/modules
• /etc/grub.conf
• /etc/sysconficg/grub
• /etc/modules.conf
• /etc/fstab

Next, I went to my backups and restored the entire system to /mnt/sysimage, making sure not to overwrite existing files. We use NetBackup, which defaults to not overwrite, but other systems are not so careful. If you accidentally overwrite the files we excluded from deletion above, your restored system will not boot.

Once the restore was complete, I rebooted the system and it came up pretty much as a carbon copy of the old server. Once it was up and on the network, I ran “up2date -uf” to install the latest version of the kernel and I was done.

UPDATE: Casey actually has some instructions that provide a more elegant method of installing APC on CentOS or RHEL. Both methods will work, but Casey’s instructions will get you around the package management problems.

Vfstab entry on a Solaria 8 box:
nfsserver.domain.com:/path/to/remote/mountpoint /local-mountpoint nfs 0 yes rw,bg,intr,hard,timeo=600,wsize=32768,rsize=32768
Manual mount on a Solaris 8 box:
mount -o rw,bg,intr,hard,timeo=600,wsize=32768,rsize=32768 nfsserver.domain.com:/path/to/remote/mountpoint /local-mountpoint

According to the docs, the options on a Linux box are pretty much the same, except you would add the following:
nfsver=3,tcp

To get around this, you have to align the partition in such a way that it will start writing data on a sector that will mesh up nicely with the stripe element size. In this case, 128. Below is an example of how I create partitions on our CLARiiON for Linux systems. Check out the EMC Best Practices for Fibre Chanel storage white paper for more detail.

/sbin/fdisk /dev/emcpowera
Device contains neither a valid DOS partition table, nor Sun, SGI or OSF disklabel
Building a new DOS disklabel. Changes will remain in memory only,
until you decide to write them. After that, of course, the previous
content won't be recoverable.

The number of cylinders for this disk is set to 39162.
There is nothing wrong with that, but this is larger than 1024,
and could in certain setups cause problems with:
1) software that runs at boot time (e.g., old versions of LILO)
2) booting and partitioning software from other OSs
   (e.g., DOS FDISK, OS/2 FDISK)
Warning: invalid flag 0x0000 of partition table 4 will be corrected by w(rite)

Command (m for help): n
Command action
   e   extended
   p   primary partition (1-4)
p
Partition number (1-4): 1
First cylinder (1-39162, default 1):
Using default value 1
Last cylinder or +size or +sizeM or +sizeK (1-39162, default 39162):
Using default value 39162

Command (m for help): x

Expert command (m for help): b
Partition number (1-4): 1
New beginning of data (63-629137529, default 63): 128

Expert command (m for help): w
The partition table has been altered!

Calling ioctl() to re-read partition table.
Syncing disks.

Jun 3 09:40:24 servername sshd[26432]: [ID 800057 auth.error] error: Failed to allocate internet-domain X11 display socket.

To fix this, you can either install Sun’s latest socfs patch for your version of the OS, or simply force sshd into IPv4 mode by doing the following:

Edit you sshd_config file, adding the following:

# IPv4 only
ListenAddress 0.0.0.0


Edit your sshd startup script to issue a “-4″ to sshd on start:

case "$1" in
'start')
echo 'starting ssh daemon'
/usr/local/sbin/sshd -4
;;


Restart sshd, and that should pretty much do it… Enjoy.

• Q1. How old do ducks have to be before they will fly
• Q2. How can I keep my ducks safe from predators?
• Q3. What should I feed my ducklings / ducks?
• Q4. Will my ducks fly away for the winter?
• Q5. I want to raise baby ducks and release them when they are adults. Is this possible?
• Q6. I rescued a baby duck that was all by itself. What do I do now?
• Q7. How can I tell if my duckling is a male or a female?

Answer: How old do ducks have to be before they will fly

If you have true flying mallards, they should start flying between five and six weeks of age. In most cases, however, you will have domestic Mallards which have been selectively bred over the years to be larger. These birds will never fly as you expect from a duck, but will instead stay close to the ground, avoiding any dramatic flight. They can fly a little, but generally just in a straight line and close to the ground.

How can I keep my ducks safe from predators?

Most people who keep ducks have some form of duck yard that is fenced in with chicken wire on the sides and top. Mine is about 8 feet X 20 feet. The wire is dug into the ground so animals can’t dig under it, and it is entirely closed in on the top. Inside that, I have a duckhouse which is a 4X8 plywood box lined with hay and secured with a door that is closed at night. Even if an animal could get into the duckyard, there is absolutely no way it could invade the duckhouse.

You need to defend against the predators in your area. If you have mink or weasels, you need to keep things very tight since they can get through holes as small as one inch. If your biggest worry is coyotes, chicken wire protected by heavy gating is preferable. I prefer to keep my ducks close to home, so I only let them out of the duckyard when I am going to be home for extended periods. Other people simply let them run free and try to get them in at night. Below is a picture of my duckyard. Multiple coyotes and raccoons have tried without success to get in. This is because of the heavy gating combined with chicken wire.

Duck Coup

What should I feed my ducklings / ducks?

When your ducklings first hatch or arrive, the first thing you should do is get them drinking. Make sure they all know where the water is, and where to find it. This will help prevent choking once they start eating. Once you are certain that everyone knows how to drink, start them off on a high quality, unmedicated game bird starter crumble. Mash will also work, but is less desierable because it tends to clog up their bills. The most important thing is that the food is unmedicated. Ducks eat a lot more than chickens, and will overdose on medicated food. Supplementing their food with fresh greens and vegetables is always appreciated, especially if given to them directly in their water.

Once your ducks are three to four weeks old, you will want get them started on an unmedicated game bird pellet. Game bird maintainer feed is best, but regular poultry feed will also work provided it is not medicated. This will be their staple for life, with the exception of Spring. When hens start laying eggs, you will want to feed them layer pellets so provide them with the calcium they need to produce eggs. This will not harm the drakes, but you don’t want it to be a permanent feed. Get them back on the maintainer pellets once the laying season is over.

You will find your local farm and garden store to be an excellent source of high quality feeds. Feel free to take their advice as well, but do NOT let them talk you into medicated food for ducks.

Will my ducks fly away for the winter?

Generally, no. In the same way that your domestic dog does not behave like a coyote of wolf, your ducks are domesticated, and will not behave like a wild duck. The look to you for food and safety, and will not know how to migrate unless they have been able to join in with a flock of wild ducks during the summer months. They can tolerate very cold temperatures provided they are given shelter from the wind, liquid water to drink and plenty of high quality food. Even though Mallard ducks are typically a wild bird, those raised by humans are tame, and not able to migrate or care for themselves in the wild.

I want to raise baby ducks and release them when they are adults. Is this possible?

See Q4. Ducklings are cute, but they grow into large, messy birds. I can’t stress this enough… Do not raise ducklings and expect them to fly away or live in the wild when they are adults. If you raise ducklings be prepared to care for them for their five to eight year lifespan. Even though Mallard ducks are typically a wild bird, those raised by humans are tame, and not able to care for themselves in the wild. If you abandon them and expect them to fend for themselves, they are likely to die a very slow and horrible death. There are methods of getting ducks to integrate into the wild, but this requires the special skills and training of a wild bird rehabilitator.

I rescued a baby duck that was all by itself. What do I do now?

You probably heard the duckling cheeping. This noies was the duckling calling its mother. Most likely she was hidden, but close by. For future reference, you have to be very careful about rescuing baby ducks in this way. Most states have laws against taking animals from the wild, so you could get yourself into a lot of trouble. The only time “rescuing” them is appropriate is if they are very obviously not going to survive unless you do. An example of this might be a situation in which you saw the mother get hit by a car and all her ducklings are wondering around in the middle of the road.

That said, your heart was most certainly in the right place. You now have a baby duck, and need help with it. Let me see what I can do. The first thing I would do is search all the local bodies of water to find the mother and other ducklings. If you can, try to reunite them. If not, the absolute best thing to do would be to call a wild bird rehabilitator. They have the skills and training to raise ducklings in such a way that they can be integrated into the wild when they are adults.

Answer: How can I tell if my duckling is a male or a female?

Everyone wants to know the gender of their ducklings before they get their voice. Unfortunately, the only way to know for sure is through a procedure called “vent sexing” whereby you stretch open the vent and look inside to find the duckling’s sex organs. This procedure is not only very traumatic for the duckling, but potentially dangerous as well. Without having someone who is experienced to train you, you can very easily hurt or even kill the duckling.

The best way for you to tell the gender of your ducklings is to wait until they are four or five weeks old when they get their voice. Drakes will develop a soft “whrack” sound, while hens will produce a loud “QWACK”. Check out the recordings below:

Mallard Hen
Mallard Drake

Many people make the mistake of thinking they have only hens because they all look like hens. It is important to remember that Mallard drakes don’t get their nuptial plumage (green heads, red chest, etc) until they are one year old. All juvenile Mallards look more or less like hens for their entire first year.

# /usr/sbin/ntpdate -u time.nist.gov
9 Apr 03:47:53 ntpdate[20245]: sendto(192.43.244.18): Operation not permitted
9 Apr 03:47:54 ntpdate[20245]: sendto(192.43.244.18): Operation not permitted
9 Apr 03:47:55 ntpdate[20245]: sendto(192.43.244.18): Operation not permitted
9 Apr 03:47:56 ntpdate[20245]: sendto(192.43.244.18): Operation not permitted
9 Apr 03:47:57 ntpdate[20245]: no server suitable for synchronization found

Normally I would just add a rule to the “/etc/sysconfig/iptables” file to allow traffic out on this port, but Vmware ESX server does not use iptables… It uses its own firewall, so I had to figure out how to change it. Happily, it turns out that there is a handy “esxcfg-firewall” command built just for such things.

Running this:
/usr/sbin/esxcfg-firewall -q | grep 123

12300 1803K valid-tcp-flags  tcp  --  *   *     0.0.0.0/0        0.0.0.0/0

Confirmed that UDP port 123 outbound was disallowed.

Running this opened it up:
/usr/sbin/esxcfg-firewall -e ntpClient

Grep out “123″ again just to be sure:
/usr/sbin/esxcfg-firewall -q | grep 123

1  76 ACCEPT  udp  --  *    *    0.0.0.0/0      0.0.0.0/0     udp dpt:123

And you can now run ntpdate to sync up the time:
/usr/sbin/ntpdate -u time.nist.gov

9 Apr 09:52:54 ntpdate[20319]: step time server 192.43.244.18 offset 21689.039217 sec

First, check the following kernel parameters using the commands below:

/sbin/sysctl -a | grep kernel.shmall
/sbin/sysctl -a | grep kernel.shmmax
/sbin/sysctl -a | grep kernel.shmmni
/sbin/sysctl -a | grep kernel.sem
/sbin/sysctl -a | grep fs.file-max
/sbin/sysctl -a | grep net.ipv4.ip_local_port_range
/sbin/sysctl -a | grep net.core.rmem_default
/sbin/sysctl -a | grep net.core.rmem_max
/sbin/sysctl -a | grep net.core.wmem_default
/sbin/sysctl -a | grep net.core.wmem_max

If any parameters are lower than the examples below, you will have to increase them by editing “/etc/sysctl.conf” file, adding the appropriate lines as expressed below. If the current value is higher, leave it as is.

kernel.shmall = 2097152
kernel.shmmax = 2147483648
kernel.shmmni = 4096
kernel.sem = 250 32000 100 128
fs.file-max = 65536
net.ipv4.ip_local_port_range = 1024 65000
net.core.rmem_default = 262144
net.core.rmem_max = 262144
net.core.wmem_default = 262144
net.core.wmem_max = 262144

Next, edit your “/etc/security/limits.conf” file, adding the following lines:

oracle          soft    nproc           2047
oracle          hard    nproc           16384
oracle          soft    nofile          1024
oracle          hard    nofile          65536

If your current “/etc/pam.d/login” file does not already contain the following line, add it:

session    required     pam_limits.so

#Tweaks for Oracle
if [ $USER = "oracle" ]; then
    if [ $SHELL = "/bin/ksh" ]; then
    ulimit -p 16384
    ulimit -n 65536
    else
    ulimit -u 16384 -n 65536
    fi
fi

These are just the basic steps I take. See the “Oracle Database Installation Guide” for more complete instructions.

I started thinking that perhaps the Mac was doing NETBIOS name lookups and that nmbd might be knocking on the firewall. Turns out this was the problem. Opening up the following ports on the Windows File Server did the trick:

SMB uses ports:
UDP 137 (NETBIOS Name Service)
UDP 138 (NETBIOS Datagram Service)
TCP/UDP 139 (NETBIOS Session Service)

WARNING: Only open these ports to your trusted networks. Statistical data indicates that UDP ports 135 – 139 and TCP port 137 – 139 are amongst the most commonly scanned ports on remote computers.