Archive for June, 2009

Moving a VM from local storage to the SAN

Friday, June 26th, 2009

This is a way to move the VMDKs for a VM from local storage to the SAN.

First you need to get your SAN hooked in, once you do this, SSH onto the box, under your vmfs directory you’ll find the directories (links) to the LUNs presented from your SAN.

To move from /vmfs/volumes/storage1 to /vmfs/volumes/storage2

1) Create a folder in the new datastore eg:

mkdir /vmfs/volumes/storage2/vm_name

2) Copy across the hard drives, repeat for each vmdk (Not the -flat files)

vmkfstools -i /vmfs/volumes/storage1/vm_name/diskname.vmdk /vmfs/volumes/storage2/vm_name/diskname.vmdk

(It’s important to use vmkfstools here and not cp in order to avoid fragmentation, also its a lot quicker)

3) Copy across the .vmx file

cp /vmfs/volumes/storage1/vm_name/vmname.vmx /vmfs/volumes/storage2/vm_name/vmname.vmx

4) In the VI Client browse the new datastore, right click on the transferred .vmx file and select “Add to Inventory”

5) Start up new VM and once happy with it, delete the old copy.

Best seen with an example:

vmkfstools -i /vmfs/volumes/datastore1/SERVER01/SERVER01.vmdk /vmfs/volumes/datastore2/SERVER01/SERVER01.vmdk

cp /vmfs/volumes/datastore1/SERVER01/SERVER01.vmx /vmfs/volumes/datastore2/SERVER01/SERVER01.vmx

Mail Delivery Problem to Another Internal Exchange Server

Sunday, June 21st, 2009

Setting up a second exchange server in the same routing group, all installed fine, however, after moving a mailbox to the new server and then sending an email to the mailbox, the mail got stuck in the queue on the first server.

Checked the common things like DNS, firewall ports etc. all looked fine. But still the mail would not go, also tried to send a mail from the new mailbox to a mailbox on the old server. Still no joy.

The two servers where on separate networks, with a Cisco 857 ADSL router at each site and a IPSec site to site VPN between them. Full all open IP access allowed from each server to each other. Couldn’t see the problem.

Then I found this from Microsoft: http://support.microsoft.com/kb/919091

Cause 5 – The IP inspect rule, on each of the routers I had one for SMTP. This appeared to be blocking an SMTP verb or something and causing the connection to stall with this strange error in the queue viewer on each server: the semaphore timeout period has expired.

Solution: I removed the IP Inspect rule from each router, (you will still probably need a tcp inspect to allow outbound smtp to the net. Rebooted the routers, and restarted smtp on each exchange server (just to be sure) and hey presto. Mails started to flow.

Now i can see about setting up a routing group connector!

Falling off the Internet

Saturday, June 20th, 2009

Hmm, the web server has used up all its memory and then gone to 100% CPU usage. Not totally sure what caused it but it points to MySQL using all the available memory. Not sure why the CPU spiked though (swapping maybe?) anyway a swift reboot fixed it, i’ll need to investigate this one further. The joys of running, Apache, PHP, MySQL on 360MB of RAM!

100cpu

Configuring and Troubleshooting Active Directory

Saturday, June 20th, 2009

While setting up my new domain controllers, came across this site, looks to offer some good tips about AD. See: http://www.tech-faq.com/configuring-and-troubleshooting-active-directory-replication.shtml

Installing PureMessage 3.0.2

Saturday, June 20th, 2009

When trying to install Puremessage, you need to upgrade the instance of MSDE you are using to a specific verson MSDE 2000 SP4. More details at this page on the Sophos support site. http://www.sophos.com/support/knowledgebase/article/46290.html

If when trying to upgrade MSDE you get an error saying you need to change the SA password, you are not applying the update to the correct instance. Run this command to apply to the correct instance:

setup /upgradesp sqlrun INSTANCENAME=SOPHOS /L*v c:\msdelog.txt

.sqm Files, shed loads of them!

Friday, June 19th, 2009

I found that my hard disk was getting lots of *.sqm files. They are file from the Microsoft Software Quality monitoring software which is in MSN (Live) Mesenger for example. See this link for more details: http://dotwhat.net/sqm/8672/

They are fine to delete (backup first just to be sure) you can also stop them from appearing by turning off the option in the Live Messenger software.

Changing the timezone in Linux

Thursday, June 18th, 2009
  1. Logged in as root, check which timezone your machine is currently using by executing `date`. You’ll see something like Tue 10 Jun 2009 11:56:11 AM BST, BST in this case is the current timezone.
  2. Change to the directory /usr/share/zoneinfo here you will find a list of time zone regions. Choose the most appropriate region, if you live in Europe look for the “Europe” directory.
  3. Backup the previous timezone configuration by copying it to a different location. Such as
    mv /etc/localtime  /etc/localtime-old
  4. And then you need to create a symbolic link from the appropiate timezone to /etc/localtime. Example:
    ln -sf /usr/share/zoneinfo/Europe/London /etc/localtime
  5. Using NTPDATE update the latest time: # ntpdate pool.ntp.org
  6. Set the ZONE entry in the file /etc/sysconfig/clock file (e.g. “Europe/London”)
  7. Set the hardware clock by executing:
    /sbin/hwclock --systohc

Fun with NTPDATE on Ubuntu

Thursday, June 18th, 2009

Had a weird one, when building my Linux server (that hosts this site) was getting the ntp settings done, and had a problem as follows:

ntpdate [<number>]: no server suitable for synchronization found

It turned out when running: # ntpdate pool.ntp.org it could not contact, the servers. why… ah yes i installed a firewall, UDP NTP traffic is bi-drectional, i.e. you need the ports open each way for it to work, and my firewall drops all inbound unless allowed so i added this rule to my firewall config (using Lokkit):

# /etc/default/lokkit

iptables -A RH-Lokkit-0-50-INPUT -p udp -m udp –sport 123 -d 0/0 -j ACCEPT

Then tried the command again and it worked fine!

Exmerge Permissions Ramble (and solution!)

Thursday, June 18th, 2009

This is not quite a how to, more a ramble of what I did one morning to try to resolve the problem with attempting to exmerge some psts in to an exchange server.

http://support.microsoft.com/?id=292509
http://support.microsoft.com/default.aspx?scid=kb;en-us;322312

First set the permissions then started to get this error:
Error configuring message service (MSPST MS) (MAPI_E_EXTENDED_ERROR) (CMapiSession::CreateEMSPSTProfile)

It appears to be a problem with the opening of the pst.
Then checked if there were any read only permissions on the pst file, nope added everyone full access to the file just to make sure.

Still getting the same error message.

Apparenltly the new outlook 2003 format for psts is incompatible with exmerge, to resolve this you need to
Create a new .pst file that is compatible with Outlook 97-2002.

On the File menu, point to New, and then click Outlook Data File.
To create a Microsoft Outlook Personal Folders File (.pst) that is compatible with Outlook 97-2002, click Outlook 97-2002 Personal Folders File (.pst), and
then click OK.
In the File name box, type a name for the file, and then click OK.
In the Name box, type a display name for the .pst folder.
Select any other options you want, and then click OK.
The name of the folder associated with the data file appears in the Folder List (Folder List: Displays the folders available in your mailbox. To view
subfolders, click the plus sign (+) next to the folder. If the Folder List is not visible, on the Go menu, click Folder List.). To view the Folder List, on
the Go menu, click Folder List. By default, the folder is called Personal Folders.

In theory the version of psts that are made by exmerge should be correct, this only looks like a problem with a import directly from outlook.

This looks like it will work now, however im getting this error now, (which I have seen before and at least know something about.)

Error opening message store (MSEMS). Verify that the Microsoft Exchange Information Store service is running and that you have the correct permissions to log
on. (0×8004011d)

This can be resolved by just adding the “send as” and “recieve as” permissions on the everyone group to the mailstore, but this is the nasty bodge way.

http://support.microsoft.com/kb/322312/
This says to delegate Exchange Full Administrator to the exmerge group and then restart the IIS Admin Service.

Also make sure that the emerge group has all the allow permission boxes checked, probably not necessary but its worth doing just to get the thing to work.

This doesnt work though.

The problem is the permissions are set for the exmerge group as having both “send as” & “recieve as” allow but also deny too. The deny will always get
prefference. I need to stop the inheriting permissions somehow.

To do this I did this to add the security tab:
Security Tab Not Available on All Objects in System Manager
View products that this article applies to.
Article ID : 259221
Last Review : April 25, 2005
Revision : 1.3
This article was previously published under Q259221
SUMMARY
In Exchange System Manager, the Security tab is displayed in an object’s properties. However by default, the Security tab is displayed only on the following
objects:
• Address Lists
• Global Address Lists
• Databases (Mailbox stores and Public Folder stores)
• Top Level Public Folder Hierarchy

MORE INFORMATION
To display the Security tab on all objects, you must add the following registry key.
WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot
guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.
1. Start Registry Editor (Regedt32.exe).
2. Locate the following key in the registry:
HKEY_CURRENT_USER\Software\Microsoft\Exchange\ExAdmin
3. On the Edit menu, click Add Value, and then add the following registry value:
Value Name: ShowSecurityPage
Data Type: REG_DWORD
Value: 1
4. Quit Registry Editor.

This change takes effect immediately; you do not need to restart Exchange System Manager. This change only affects the currently logged on user. If the
ShowSecurityPage value is not present or is set to 0, the Security tab is available only on the objects listed in the “Summary” section.

Now you can set the permissions at the root of the exchange organisation and remove those pesky “send as” & “receive as” permissions from the exmerge group.
Restarted the IIS admin and the Microsoft SA, to restart all the other settings and refresh the permissions.

Didn’t work.

The administrator user (that I am using for exmerge) also had the deny permissions set so I removed those and then restarted the iis admin service and the
microsoft sa too.

Didn’t work.

The domain admins and enterprise admins which is the account is also a group of also had the deny permissions set so I removed those and then restarted the
iis admin service and the microsoft sa too.

Did this and now the exmerge worked perfectly. However it is not the best way to have done it as anybody with admin privilages can do whatever they like to
the exchange system

So I readded the permissions for deny on “Send as” and “recieve as” for the administrator, domain admins and enterprise admins. Bounced IIS admin and also
the sa.

It looks like you need to make the exmerge group a universal group, this cannot be done when you are running in windows 2000 mixed mode, you need to raise
the functional level of your domain to Windows 2000 Native or windows 2003 only.

Once this is done, you can create a universal security group, or change your current exmerge group to use universal.
None of the settings microsoft suggest work, i’ve checked the other server and can’t see how it can possibly work.

removed the delgate permissions for exmerge group off the root.

Then readded them on the server directly.

This also did not work.

here’s how I fixed it.

Removed all that I had done up till now.

Added the exmerge group onto the mailbox store directly.

Set the permissions how I needed them.

IMPORTANT: logged off and on again. This updates stuff.

Now I could exmerge fine, a very long winded and strange one I must say.

Logical disk manager could not update the boot file for any boot partitions on the target disk.

Thursday, June 18th, 2009

While building my new server, i was creating the software raid 1 and using the graphical disk manager ended up with this error: “Logical disk manager could not update the boot file for any boot partitions on the target disk. Verify your arcpath listings in file boot.ini or through the bootcfg.exe utility”. Makes sense its trying to write a file to a disk that doesn’t exist yet. I.e. its trying to write to the boot.ini on the secondary drive.

The boot.ini is needed when the machine boots it tells the boot loader where to find the OS to load. In the event of the first disk failing you can boot from the second as it too has a copy of what it needs to boot the server.

In my situation i had two 500GB sata disks, and one partition that i wanted mirroring therefore i needed to add the “Secondary plex” line to the boot.ini. You can find the complete file below:

[boot loader]

timeout=30

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=”Windows Server 2003, Standard” /noexecute=optout /fastdetect

multi(0)disk(0)rdisk(1)partition(1)\WINDOWS=”Boot Mirror C: – secondary plex”

 

NOTE: Your file may need to be different if you have a different drive/partition configuration.

Now thats done, waited for the synching to finish and then rebooted the server and we are in business. Ideally you should pull a disk out reboot etc. etc. to test fully that you have functioning server even if one of the disks goes.

Some handy links here: http://support.microsoft.com/kb/102873 and http://www.netadmintools.com/art439.html