October 2001 - WLUG - wlug.mailman3.com

more on event correlation...

by Mike Peckar

Nice meeting you tonight, Chuck, and THANKS for the redhat cd's... sec was the freeware event correlation tool I spoke of tonight: It is a straightforward perl script and doesn't implement a full state machine, but it nevertheless provides some inklings of what more complciated event correlators do. Check it at http://kodu.neti.ee/~risto/sec/ The best commercial event corellation tools IMHO are Nervecenter, Taave, Smarts, and Netcool. Each has its niche where it's best in class, and there are others, like HP's ECS, Logec, G2, etc. My friend Doug Stevenson is a specialist in event correlation and wrote the Maji spec: the open source event correlation engine being developed under the umbrella of OpenNMS (yeah, so, it'll be java - but it will also be very feature rich). He masterfully defines some of the layers of granularity that one might see amongst the different offerings in the Event Correlation space. Types we talked about tonight include event correlation (reducing traps) and device correlation (mapping switch states to events). His definitions are listed below... Mike <snipped message> OK... Here goes... § Event Correlation § Alarm Correlation § Device Correlation § System Correlation § Service Correlation § Performance Correlation § Security Correlation Event Correlation - This is a correlation where multiple events are filtered and processed, thereby reducing the number of events presented. This is primarily done with event tally counts and trap problem verification. Alarm Correlation - This is a correlation of alarms and alerts depicting true problems or root causes and their current status. Side effect alarms or alarms occurring as a result of a root cause alarm are suppressed or become subordinate to the root cause alarm. Device Correlation - This is a correlation of devices, their specific internal components (both hardware and software), and the device's behavior with other devices. Additionally, device correlation lends itself toward configuration management as it is a dynamic inventory of devices, subsystems, components, and behaviors. System Correlation - This is a correlation of devices and managed objects as they pertain to an overall system. This level of correlation enables one to manage and classify a conglomeration of managed objects as a manageable entity. Service Correlation - This correlation is used to determine the devices and systems that make up an IT service. In essence, this is the correlation of managed objects and systems to business rules; similar to a translation of terms from computers and systems to business services. The Service Correlation can be extended to customer impact analysis, business profitability impact analysis, etc. Performance Correlation - This correlation is used to determine the effects performance has with regards to a fault. It is unique in that performance correlation can be applied to enhance the correlation of all of the other categories. Security Correlation - This correlation is used to determine the degree of threats caused by security incidents. It is unique in that security correlation is embedded among all the other six categories described above. HTH, Doug...

Oct. 12, 2001

Re: [Wlug] REMINDER: WLUG Meeting Thursday October 11th

by Aljerin L. Butler, Jr.

Andy Stewart wrote: > HI everybody, > > This is a reminder about the upcoming WLUG meeting to be held in Kinnicutt > Hall at WPI on Thursday, October 11th at 7:00 PM. > > On the agenda: > > 1) A discussion of whether or not WLUG should join the Boston User Groups > organization. Check out http://www.bostonusergroups.com for more > information. These folks have legally incorporated as an organization to > act as an umbrella group for all sorts of computer user groups in / around > Boston, southern NH, northern RI, and as far west as Worcester. We have > been invited to join, and I recommend that we do so. The initial cost to > the group would be $50, which we can easily afford. More on this at the > meeting...... > > 2) Outcome of the most recently held install fest at WPI last week > > 3) Technical Q/A > > 4) I'll have 6 or 8 copies of StarOffice 6.0 beta available on CD > > 5) The last of the giveaways! (I'll get more at the Annual Linux Showcase > in Oakland next month). > > 6) Other topics of interest? If you have a burning desire to address the > group, let me know. > > 7) Update on Lancaster and plan our next trip to that site. > > FYI: As many of you know, I have been contributing to an open source > project called gimp-print. My contribution is as the writer of the users > guide. Well, the users guide has been officially released for the first > time! Check out http://sourceforge.net/projects/gimp-print for a really > great set of printer drivers (my stuff is in version 4.1.99-b3). Feel > free to fire documentation barbs my way. :-) > > Afterwards, I'm sure we'll take our monthly pilgrimage to the Boynton > Restaurant for pizza and beers. All are invited! > > -- > Andy Stewart > Founder > Worcester Linux Users' Group > Worcester, MA, USA > http://www.wlug.org > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug Andy, I won't be able to make the meeting, but you got my vote on joining with Boston. Save a StarOffice CD for me. Al Butler

Oct. 11, 2001

Re: [Wlug] apache question

by Theo Van Dinter

On Thu, Oct 11, 2001 at 12:09:40PM -0400, Brad Noyes wrote: > "GET /phpnuke/ HTTP/1.1" 200 19586 "-" "Mozilla/5.0 (compatible; Konqueror/2.2.1-0.rh71.1.cups)" > Here's an unsessful attempt > "GET /phpnuke/ HTTP/1.1" 200 5 "-" "Mozilla/5.0 (compatible; Konqueror/2.2.1-0.rh71.1.cups)" > > Anyone have any idea why this might i might be only getting > such a small object returned to the client, resulting in a > blank page? This isn't going to help you, but the problem is with phpnuke -- Apache just reports what the PHP generates, so if it sends 5 bytes, that's why it's a blank page. (ie: there's nothing from this log file that would help pinpoint your problem beyond "it's phpnuke" ...) I'd look around for bugs with the version of phpnuke that you're running. Does it have any logs that you can go through, or a debug mode or something? -- Randomly Generated Tagline: "We all know Linux is great...it does infinite loops in 5 seconds." (Linus Torvalds about the superiority of Linux on the Amterdam Linux Symposium)

Oct. 11, 2001

apache question

by Brad Noyes

Hi all, i have a question about apache. I've loaded a php program called phpnuke (simaler to slashcode). But sometimes when i try to load the main page i get a blank page. I looked though the logs, and the php code. The only thing that i could find that was of interest was the access_log file. Here's a successful attempt "GET /phpnuke/ HTTP/1.1" 200 19586 "-" "Mozilla/5.0 (compatible; Konqueror/2.2.1-0.rh71.1.cups)" Here's an unsessful attempt "GET /phpnuke/ HTTP/1.1" 200 5 "-" "Mozilla/5.0 (compatible; Konqueror/2.2.1-0.rh71.1.cups)" The difference is the field following '200'. I looked on the net and i found that the numbers '19586' and '5' are the size of the object being returned to the client. Anyone have any idea why this might i might be only getting such a small object returned to the client, resulting in a blank page? Thanks, --Brad

Oct. 11, 2001

Re: [Wlug] next week's installfest

by doug waud

Mike Peckar wrote: > > Hey Andy, > > I read with interest about your installfest on the listserve (I pile up > emails and pour through infrequently) and I'm sorry I missed it - I find > myself in need of an upgrade on one of my boxes. Hi I was at the installfest but, since we had an excess of installers, I decided to sit next to Chuck and suck up expertise by osmosis. The bottom line is that, back home the next morning, I was able to do a full network install of Red Hat 7.1 --- not bad for an amateur/newbie. The bottom line is that, if you have broadband access (I have a cable connection with the town cable company in Shrewsbury) you can suck the whole works off Chuck's mirror at WPI. You can get more details tomorrow night at the WLUG meeting or, if you are in a hurry, first ftp to 130.215.24.5 and move to /pub/mirrors/redhat/linux/7.1/os/i386/images and do a directory listing. You will see a file bootnet.img; download it. Then copy it to a good floppy. Specifically, dd if=/home/bootnet.img of=/dev/fd0 bs=1440 (but, if you, like I, do not trust floppies, precede this with /sbin/badblocks -v /dev/fd0 1440 to make sure floppy disk is ok) At this point you boot from that floppy and a Red Hat install screen comes up and you just follow the instructions for an upgrade. Just press enter at the initial boot prompt to get the option at the top of that first screen -- install/upgrade. When asked for installation method pick FTP. If your box normally uses DHCP pick that on the next screen, otherwise (my case) enter its IP dotted quad etc. When asked for the source, again use 130.215.24.5 and use /pub/mirrors/redhat/linux/7.1/os/i386 for the directory. (do not check use non-anonymous FTP) The Red Hat process will take over from there. You will see lots of activity on the ethernet card lights as the ramdisk stuff is downloaded. This tells you that you got things right up to this point! :-) A couple of screens later you get to pick the class of install. You would want Upgrade. The rest is downhill and pretty obvious, even to me. doug -- Douglas R Waud, Professor Emeritus -- Pharmacology University of Massachusetts Medical School Mailing address: 17 Lantern Lane, Shrewsbury, MA 01545-2006

Oct. 10, 2001

REMINDER: WLUG Meeting Thursday October 11th

by Andy Stewart

HI everybody, This is a reminder about the upcoming WLUG meeting to be held in Kinnicutt Hall at WPI on Thursday, October 11th at 7:00 PM. On the agenda: 1) A discussion of whether or not WLUG should join the Boston User Groups organization. Check out http://www.bostonusergroups.com for more information. These folks have legally incorporated as an organization to act as an umbrella group for all sorts of computer user groups in / around Boston, southern NH, northern RI, and as far west as Worcester. We have been invited to join, and I recommend that we do so. The initial cost to the group would be $50, which we can easily afford. More on this at the meeting...... 2) Outcome of the most recently held install fest at WPI last week 3) Technical Q/A 4) I'll have 6 or 8 copies of StarOffice 6.0 beta available on CD 5) The last of the giveaways! (I'll get more at the Annual Linux Showcase in Oakland next month). 6) Other topics of interest? If you have a burning desire to address the group, let me know. 7) Update on Lancaster and plan our next trip to that site. FYI: As many of you know, I have been contributing to an open source project called gimp-print. My contribution is as the writer of the users guide. Well, the users guide has been officially released for the first time! Check out http://sourceforge.net/projects/gimp-print for a really great set of printer drivers (my stuff is in version 4.1.99-b3). Feel free to fire documentation barbs my way. :-) Afterwards, I'm sure we'll take our monthly pilgrimage to the Boynton Restaurant for pizza and beers. All are invited! -- Andy Stewart Founder Worcester Linux Users' Group Worcester, MA, USA http://www.wlug.org

Oct. 10, 2001

Re: [Wlug] ATAPI (internal) ZIP drive

by Keith Wright

> From: Skip Gaede <sgaede(a)mediaone.net> > > I still haven't gotten the disk formatted with ext2. I suspect it has to do > with the fact that mke2fs wants to see a partition table. I don't have the > support compiled for formatting a umsdos filesystem. Iomegaware has a smal > program "iw" that's supposed to allow you to make an ext2 fs on the disk, but man fdisk -- -- Keith Wright <kwright(a)free-comp-shop.com> Programmer in Chief, Free Computer Shop <http://www.free-comp-shop.com> --- Food, Shelter, Source code. ---

Oct. 10, 2001

Re: [Wlug] next week's installfest

by Andy Stewart

Hi Mike, I don't personally have RedHat 7.1 in my possession (I'm a SuSE kinda guy) but I'm sure there are folks in the group who have copies. I suspect that people will bring these to the next meeting, so if you make it, you could probably grab a copy that way. Andy On Tuesday 09 October 2001 10:12 pm, you wrote: > Hey Andy, > > I read with interest about your installfest on the listserve (I pile up > emails and pour through infrequently) and I'm sorry I missed it - I find > myself in need of an upgrade on one of my boxes. > > I saw you have many copies of several recent distributions - I am > looking to get a copy of redhat 7.1 - got any left over from last week? > I'd love get a set... > > TIA, and one of these days I'd love to actually catch a meeting.. > > Mike > ----- Original Message ----- > From: Andy Stewart <andystewart(a)mediaone.net> > To: <wlug(a)mail.wlug.org> > Sent: Monday, October 01, 2001 6:45 PM > Subject: Re: [Wlug] next week's installfest > > > HI Tim, > > > > This sounds really great - thanks! If you can get the KDE 2.2.1 rpms, > > that might be something to put onthe "others" CD. > > > > Andy > > > > On Monday 01 October 2001 08:39 am, you wrote: > > > This is what I plan on bringing. > > > > > > 1. 5 sets of Redhat 7.1 > > > 2. 5 sets of Debian 2.2rev3 > > > 3. 10 cd's with the following.. > > > a. latest kernel/modtools (2.4.10) > > > b. StarOffice > > > c. latest mozilla benchmark (0.9.4) > > > > > > If anybody has some input on what else I should put on the "others" > > > cd, let me know. > > > > > > Tim. > > > > > > -----Original Message----- > > > From: David Lee Ludwig [mailto:davidl@WPI.EDU] > > > Sent: Saturday, September 29, 2001 1:05 AM > > > To: 'wlug(a)mail.wlug.org' > > > Subject: RE: [Wlug] next week's installfest > > > > > > On Fri, 28 Sep 2001, Keller, Tim wrote: > > > > What you might want todo is just grab everything; debs, rpms and > > > > tarballs. > > > > > > > > That way, not matter what distribution we load, we'd be able to > > > > install. > > > > > > I was planning on grabbing as much as I can, however each > > > version of each distribution has a different set of Ximian Gnome > > > packages that run around 225MB a piece. > > > > > > What CDs do people plan on bringing? > > > > -- > > Andy Stewart > > Founder > > Worcester Linux Users' Group > > Worcester, MA, USA > > http://www.wlug.org > > > > _______________________________________________ > > Wlug mailing list > > Wlug(a)mail.wlug.org > > http://mail.wlug.org/mailman/listinfo/wlug > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug -- Andy Stewart Founder Worcester Linux Users' Group Worcester, MA, USA http://www.wlug.org

Oct. 10, 2001

Re: [Wlug] next week's installfest

by Mike Peckar

Hey Andy, I read with interest about your installfest on the listserve (I pile up emails and pour through infrequently) and I'm sorry I missed it - I find myself in need of an upgrade on one of my boxes. I saw you have many copies of several recent distributions - I am looking to get a copy of redhat 7.1 - got any left over from last week? I'd love get a set... TIA, and one of these days I'd love to actually catch a meeting.. Mike ----- Original Message ----- From: Andy Stewart <andystewart(a)mediaone.net> To: <wlug(a)mail.wlug.org> Sent: Monday, October 01, 2001 6:45 PM Subject: Re: [Wlug] next week's installfest > > HI Tim, > > This sounds really great - thanks! If you can get the KDE 2.2.1 rpms, > that might be something to put onthe "others" CD. > > Andy > > > On Monday 01 October 2001 08:39 am, you wrote: > > This is what I plan on bringing. > > > > 1. 5 sets of Redhat 7.1 > > 2. 5 sets of Debian 2.2rev3 > > 3. 10 cd's with the following.. > > a. latest kernel/modtools (2.4.10) > > b. StarOffice > > c. latest mozilla benchmark (0.9.4) > > > > If anybody has some input on what else I should put on the "others" cd, > > let me know. > > > > Tim. > > > > -----Original Message----- > > From: David Lee Ludwig [mailto:davidl@WPI.EDU] > > Sent: Saturday, September 29, 2001 1:05 AM > > To: 'wlug(a)mail.wlug.org' > > Subject: RE: [Wlug] next week's installfest > > > > On Fri, 28 Sep 2001, Keller, Tim wrote: > > > What you might want todo is just grab everything; debs, rpms and > > > tarballs. > > > > > > That way, not matter what distribution we load, we'd be able to > > > install. > > > > I was planning on grabbing as much as I can, however each > > version of each distribution has a different set of Ximian Gnome > > packages that run around 225MB a piece. > > > > What CDs do people plan on bringing? > > -- > Andy Stewart > Founder > Worcester Linux Users' Group > Worcester, MA, USA > http://www.wlug.org > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

Oct. 10, 2001

Re: [Wlug] ATAPI (internal) ZIP drive

by Skip Gaede

On Monday 08 October 2001 10:51 am, skip gaede wrote: > I need help! I've made some progress, actually. The biggest help was actuall a pointer to the following web page: http://www.win.tue.nl/~aeb/linux/zip/zip-1.html In there, I learned that Windows wants to see the drive as a big floppy, with no partition table. To do that, there are multiple ways to hide the first track on the drive: there is a jumper on the back of the drive, and my bios actually allows one to select whether the first track is hidden or not. I have compiled the ide-scsi and ide-floppy drivers as modules, and depending on what I put on the command line as boot options (hdc=scsi or hdc=ide-floppy), the drive will be handled accordingly. As a floppy, the drive is dealt with as hdc or sdc depending on which way it's setup. I'm able to read a zip disk created under windows. It's a big floppy, and has the umsdos filesystem. I still haven't gotten the disk formatted with ext2. I suspect it has to do with the fact that mke2fs wants to see a partition table. I don't have the support compiled for formatting a umsdos filesystem. Iomegaware has a smal program "iw" that's supposed to allow you to make an ext2 fs on the disk, but that isn't working either. Progress, however, is being made! --Skip

Oct. 9, 2001