 |
Clear ARP / Neighbour cache on Linux |
I am trying to diagnose why out-of-scope ARP requests are being sent (ARP requests for addresses that should be on the default gateway). I thought I had figured it out, but my ARP table was still full of 100’s of incomplete entries. “arp -d” just marks an entry as incomplete, so does “ip neigh del“. I wanted to flush the entire cache.
What finally worked was to flip ARP on/off.
|
1 |
ip link set arp off dev eth0; ip link set arp on dev eth0 |
|
Modifying an initrd |
Extract
|
1 2 3 |
mkdir /tmp/initrd cd /tmp/initrd gunzip -c /boot/initrd.gz | cpio -id |
Recreate
|
1 2 |
cd /tmp/initrd find . | cpio --create --format='newc' | gzip > /boot/initrd_new.gz |
|
XoloMiner Linux Install Script |
I’ve written an install script for Xolo’s PrimeCoin Pool Miner XoloMiner on my new favourite coin, PrimeCoin (XPM).
This makes the miner ready to use at beeeeer.org, or any other pool that supports XoloMiner.
This is still a work in progress, but the install script itself is complete. So far it has been created only for Debian Wheezy as this is the distro I have been using.
$ ./xolominer
Usage: ./xolominer {start|stop|restart|force-reload|status|install|uninstall}
This script will do the following:
I made this as I have access to a few Debian machines and wanted to be able to quickly and easily install the miner without having to perform it all manually. I also needed a reason to code some more bash 🙂
I actually have similar scripts for installing cpuminer, cgminer and bfgminer but this script has been tested the most and is worthy of public attention, enjoy 🙂
Updated 2014-05-12
Updated build method
Renamed to XoloMiner
Note: When updating, uninstall old version and copy /etc/primeminer/primeminer.conf to /etc/xolominer/xolominer.conf
Download
xolominer.sh (13.3 KiB, 1,889 hits)
Download (old version)
primeminer.sh (12.3 KiB, 2,101 hits)
Happy mining!
How to use:
wget -q https://nooblet.org/blog/download/xolominer.sh;
chmod +x xolominer.sh;
sudo ./xolominer.sh install;
Installer output:
Uninstaller output:
I was trying to get the Python Owncloud CLI package to work on Wheezy. It requires libocsync0 which is available in unstable but it has many depends that would push the box further into unstable than I would of liked (samba and sftp plugins require unstable versions of samba, ssh, libc6, etc.).
To get libocsync working on wheezy, I did the following:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 |
# Add unstable repository to APT cat << EOF > /etc/apt/sources.list.d/unstable.list deb http://ftp.uk.debian.org/debian/ unstable main contrib non-free deb-src http://ftp.uk.debian.org/debian/ unstable main contrib non-free EOF # Pin unstable low so it isn't default cat << EOF > /etc/apt/preferences.d/unstable.pref Package: * Pin: release a=unstable Pin-Priority: 400 EOF # Download source files to /usr/src cd /usr/src && apt-get update && apt-get source ocsync # Get build depends # (If you note down what packages are installed NEW here, you can manually remove them afterwards) apt-get build-dep ocsync # Remove unstable repository rm -f /etc/apt/sources.list.d/unstable.list /etc/apt/preferences.d/unstable.pref && apt-get update # Change to the new ocsync source directory, in my case it was cd /usr/src/ocsync-0.90.4 # run through compile (instructions at http://www.debian.org/doc/manuals/maint-guide/build.en.html ) debian/rules clean dpkg-source -b ./ debian/rules build fakeroot debian/rules binary # .deb files are now in /usr/src ls -la /usr/src # install required package dpkg -i libocsync0_0.90.4-1_amd64.deb |
As mentioned earlier, I have a few of these logcheck filters I have created over the past few years. I use Debian and CentOS so other distros may not perfectly match.
These work in conjunction with the default filters, hence their naming scheme of local_<service>.
Dovecot
login, logout, mysql connections, lda delivery, ssl regen
|
1 2 3 4 5 6 |
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap)-login: Login: user=<[-_.@[:alnum:]]+>, method=[[:alnum:]-]+, rip=[.:[:alnum:]\s]+, lip=[.:[:alnum:]\s]+(, mpid=[[:digit:]]+)?(, (TLS( handshake)?|secured))?$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap)(-login)?(\([-_.@[:alnum:]]+\))?: (Connection closed|Disconnected( for inactivity|: (Logged out|Disconnected in IDLE))) bytes=[[:digit:]]+\/[[:digit:]]+$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ (dovecot: )?((deliver|lda)\([-_.@[:alnum:]]+\)|lda\([-_.@\w]+\)): sieve: msgid=<?[^\(]*>?( \(((added by )?[^[:space:]]+|sfid-[_[:xdigit:]]+)\)?)?[[:space:]]*: (stored mail into mailbox '.*'|marked message to be discarded if not explicitly delivered \(discard action\)|(forwarded to|sent vacation response to|discarding vacation response for message implicitly delivered to|not sending vacation response to system address|discarding vacation response to mailinglist recipient|discarded vacation reply to|discarding vacation response to (auto-submitted|precedence=bulk) message from|discarded duplicate (vacation response|forward) to) <[^[:space:]]*>)$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap)-login: Disconnected \(no auth attempts\): rip=[.[:digit:]]+, lip=[.[:digit:]]+(, (TLS|SSL|secured))?.*$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: auth: mysql: Connected to [._[:alnum:]-]+ \(postfix\)$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: ssl-params: (Generating )?SSL parameters( regeneration completed)?$ |
local_dovecot (1.5 KiB, 2,037 hits)
Managesieve (part of Dovecot)
login, logout
|
1 2 |
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ managesieve-login: Login: user=<[_@\.[:alnum:]-]+>, method=[[:alnum:]]+, rip=[[:digit:]\.]+, lip=[[:digit:]\.]+(, mpid=[[:digit:]\.]+)?(, TLS)?$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ managesieve\([_@\.[:alnum:]-]+\): Disconnected: Logged out bytes=[[:digit:]]+\/[[:digit:]]+$ |
local_managesieve (320 bytes, 1,995 hits)
OpenVPN
login related
|
1 2 3 |
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ (openvpn|ovpn-[._[:alnum:]-]+)\[[[:digit:]]+\]: TCP connection established with (\[AF_INET\])?[.[:digit:]]{7,15}:[[:digit:]]{2,5}$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ (openvpn|ovpn-[._[:alnum:]-]+)\[[[:digit:]]+\]: (Local|Expected Remote) Options String: '[., _[:alnum:]-]+'$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ (openvpn|ovpn-[._[:alnum:]-]+)\[[[:digit:]]+\]: TCPv4_SERVER link (local \(bound\)|remote): (\[AF_INET\])?[.[:digit:]]{7,15}:[[:digit:]]{2,5}$ |
local_openvpn (506 bytes, 1,987 hits)
PostFWD
statistic log lines: dnsbl, rules, stats, cache, rate
|
1 |
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ postfwd\[[[:digit:]]+\]: \[(DNSBL|RULES|STATS|CACHE|RATE)\].*$ |
local_postfwd (104 bytes, 1,974 hits)
ProFTPd mod_ban (optional module)
obtained, detached, removed, showing ban list
|
1 2 |
^\w{3} [ :[:digit:]]{11} mod_ban\/[[:digit:]\.]+\[[[:digit:]]+\]: (obtained|detached|removed) shmid [[:digit:]]+ for BanTable '[/[:alpha:]\.]+'$ ^\w{3} [ :[:digit:]]{11} mod_ban\/[[:digit:]\.]+\[[[:digit:]]+\]: showing ban lists$ |
local_proftpd-banlog (230 bytes, 1,804 hits)
rSYSlog
start, exit, reload/hup, mark
|
1 2 3 4 5 6 7 8 |
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: imklog [0-9.]+, log source = /proc/kmsg started.$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: Kernel logging \(proc\) stopped.$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyslogd: -- MARK --$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ cronmark: -- MARK --$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyslogd: \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[0-9]+" x-info="http://www.rsyslog.com"\] start$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyslogd: \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[0-9]+" x-info="http://www.rsyslog.com"\] exiting on signal [0-9]+.$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyslogd: \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[0-9]+" x-info="http://www.rsyslog.com"\] rsyslogd was HUPed$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ rsyslogd: \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[0-9]+" x-info="http://www.rsyslog.com"\] rsyslogd was HUPed(, type 'lightweight'.)?$ |
local_rsyslog (954 bytes, 1,952 hits)
OpenSSH
closed user request, closed preauth 127.0.0.1
|
1 2 |
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Received disconnect from [[:digit:]\.]+: [[:digit:]]+: Closed due to user request\.$ ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Connection closed by 127.0.0.1 \[preauth\]$ |
local_ssh (255 bytes, 2,023 hits)
swapspace
allocating, retiring, adding (kernel)
|
1 2 3 |
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ /usr/sbin/swapspace: Allocating swapfile '[0-9]+' ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ /usr/sbin/swapspace: Retiring swapfile '[0-9]+' ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[[0-9\.]+\] Adding [0-9]+k swap on [0-9]+. Priority:-[0-9]+ extents:[0-9]+ across:[0-9]+k SS |
local_swapspace (324 bytes, 1,967 hits)