- WLUG - wlug.mailman3.com

Re: Firewalld/iptables/nftables question

by soup

Haven't used either of those. syslog over tcp will ensure delivery but if volume precludes that use I would use nginx for forwarding UDP if you need something quickly and dirty, but fluentd is kind of made for this. It can do parsing and transforms but it's all modularized with a fairly simple DSL, you can just do forwards. There's a gelf for graylog if that's where you're sending but it'll do s3, stdout, http, etc. https://docs.fluentd.org/how-to-guides/graylog2 There's a mess of how-tos for the popular use cases. good hunting, soup On Tue, Feb 6, 2024 at 1:18 PM Patrick McEvilly via WLUG < wlug(a)lists.wlug.org> wrote: > All > > > > First off, I’m in way over my head. $dayjob we have a redhat 8 box. We > are looking to take in syslog messages and sent them out to one/two > different IP addresses. We tried using > https://github.com/sleinen/samplicator and while it works perfectly and a > one banana job to setup, we seem to be dropping a significant amount of > traffic on the box. At least 10% of the logs are missing and we have not > loaded up the system yet. We tuned out the network buffers and added 25MB > of memory without any improvement. > > > > https://github.com/sleinen/samplicator/issues/72 > > > > Seems at a high rate of logs (which I think we would fall under) there > seems to be some issues. > > > > We looked at this option - > > https://zapier.com/engineering/iptables-replication/ > > > > Redhat 8 seems to be using firewalld and backended with nfttables so we > can’t directly use this method so we tried this. > > > > > > firewall-cmd --permanent --direct --add-rule ipv4 mangle PREROUTING 0 -i > ens192 -p udp --dport 514 -j TEE --gateway 127.0.0.1 > > firewall-cmd --permanent --direct --add-rule ipv4 nat PREROUTING 1 -i > ens192 -p udp --dport 514 -j DNAT --to-destination 10.137.241.79:514 > > firewall-cmd –reload > > > > With no luck, packets are not getting sent to 10.137.241.79. > > > > When it works with samplicator this is what we get. > > > > 11:53:04.382233 IP 10.240.136.4.24277 > 10.240.1.1.syslog: SYSLOG > local7.notice, length: 670 > > 11:53:04.382408 IP 10.240.136.4.24277 > 10.137.241.79.syslog: SYSLOG > local7.notice, length: 697 > > > > sysctl net.ipv4.ip_forward > > net.ipv4.ip_forward = 1 > > > > IP Forwarding is enabled. > > > > I’m not at all familiar with any of this and cutting and pasting from the > internet and chatgpt has come up empty. > > > > Anyone have any suggestions on what we are doing wrong? > > > > Patrick > > > > > > > > > > > > > > > _______________________________________________ > WLUG mailing list -- wlug(a)lists.wlug.org > To unsubscribe send an email to wlug-leave(a)lists.wlug.org > Create Account: https://wlug.mailman3.com/accounts/signup/ > Change Settings: > https://wlug.mailman3.com/postorius/lists/wlug.lists.wlug.org/ > Web Forum/Archive: > https://wlug.mailman3.com/hyperkitty/list/wlug@lists.wlug.org/message/M2BHG… >

Feb. 6, 2024

Firewalld/iptables/nftables question

by Patrick McEvilly

All First off, I’m in way over my head. $dayjob we have a redhat 8 box. We are looking to take in syslog messages and sent them out to one/two different IP addresses. We tried using https://github.com/sleinen/samplicator and while it works perfectly and a one banana job to setup, we seem to be dropping a significant amount of traffic on the box. At least 10% of the logs are missing and we have not loaded up the system yet. We tuned out the network buffers and added 25MB of memory without any improvement. https://github.com/sleinen/samplicator/issues/72 Seems at a high rate of logs (which I think we would fall under) there seems to be some issues. We looked at this option - https://zapier.com/engineering/iptables-replication/ Redhat 8 seems to be using firewalld and backended with nfttables so we can’t directly use this method so we tried this. firewall-cmd --permanent --direct --add-rule ipv4 mangle PREROUTING 0 -i ens192 -p udp --dport 514 -j TEE --gateway 127.0.0.1 firewall-cmd --permanent --direct --add-rule ipv4 nat PREROUTING 1 -i ens192 -p udp --dport 514 -j DNAT --to-destination 10.137.241.79:514 firewall-cmd –reload With no luck, packets are not getting sent to 10.137.241.79. When it works with samplicator this is what we get. 11:53:04.382233 IP 10.240.136.4.24277 > 10.240.1.1.syslog: SYSLOG local7.notice, length: 670 11:53:04.382408 IP 10.240.136.4.24277 > 10.137.241.79.syslog: SYSLOG local7.notice, length: 697 sysctl net.ipv4.ip_forward net.ipv4.ip_forward = 1 IP Forwarding is enabled. I’m not at all familiar with any of this and cutting and pasting from the internet and chatgpt has come up empty. Anyone have any suggestions on what we are doing wrong? Patrick

Feb. 6, 2024

Re: Hey Everybody! WLUG Meeting this week!

by Tim Keller

Currently we're having issues getting the Turing Pi 2 to boot, so doing a show off of Proxmox I could definitely do as well. I've got a three node setup as well as a backup node running at work, but I don't have anything on it that I couldn't show the world. Tim. On Tue, Feb 6, 2024 at 10:00 AM John Stoffel <john(a)stoffel.org> wrote: > >>>>> "Tim" == Tim Keller via WLUG <wlug(a)lists.wlug.org> writes: > > > We've got a WLUG meeting on the 8th! I know weirdly early in the > > month because the 1st landed on a Thursday! > > > If things go well, I *might* have a Pi cluster using compute cards > > in it! I'll keep you all posted! > > That would be awesome to see. I've finally got ProxMox 8.1.3 up and > running at work. It's an interesting beast with some funky > limitations. And alot of flexibility. But the setup can be tough if > you have VLANs on your trunks/bonds feeding the servers. Lots of by > hand networking setup. > > -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

Feb. 6, 2024

Re: Hey Everybody! WLUG Meeting this week!

by John Stoffel

>>>>> "Tim" == Tim Keller via WLUG <wlug(a)lists.wlug.org> writes: > We've got a WLUG meeting on the 8th! I know weirdly early in the > month because the 1st landed on a Thursday! > If things go well, I *might* have a Pi cluster using compute cards > in it! I'll keep you all posted! That would be awesome to see. I've finally got ProxMox 8.1.3 up and running at work. It's an interesting beast with some funky limitations. And alot of flexibility. But the setup can be tough if you have VLANs on your trunks/bonds feeding the servers. Lots of by hand networking setup.

Feb. 6, 2024

Hey Everybody! WLUG Meeting this week!

by Tim Keller

Hey Everybody! We've got a WLUG meeting on the 8th! I know weirdly early in the month because the 1st landed on a Thursday! If things go well, I *might* have a Pi cluster using compute cards in it! I'll keep you all posted! As for the meeting details: Time: 7pm Date: 2/8/2024 Location: Techncopia Thanks, Tim. -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

Feb. 5, 2024

Re: Proxmox!

by Mike Peckar

I am very interested in this topic and also have a conflict most Thursday evenings. I'm curious if folks are using cockpit for virtual management and their impressions. I looked at it a year or two ago and a deal killer in our environment was that it required a browser plug in for that use case on the client side. Mike

Jan. 26, 2024

Re: Proxmox!

by Gregory Boyce

On Fri, Jan 26, 2024 at 4:45 PM John Stoffel <john(a)stoffel.org> wrote: > >>>>> "Gregory" == Gregory Boyce via WLUG <wlug(a)lists.wlug.org> writes: > > > On Thu, Jan 25, 2024, 5:03 PM John Stoffel <john(a)stoffel.org> wrote: > >>>>>> "Gregory" == Gregory Boyce via WLUG <wlug(a)lists.wlug.org> writes: > > >> Coincidentally, I just recently started in a support role at Scale > >> Computing, which provides virtualization leveraging qemu/kvm, with > >> their own proprietary clustered filesystem. > > > Can we convince you to come and give us a talk? This looks really > > interesting! > > > I'm open to giving a talk, but I don't tend to be free on Thursday > > evenings. > > I think we could schedule something if it works better for you. Is > there a particular night that works better? Ideally I'd like to have > you do it in person, if only so I can pick your brain better. > I'm typically free on Mondays and Wednesday evenings, as well as every other Friday. > And does Scale offer support for datastores (not sure the term) on NFS > storage? Since that would make our transistion simpler. > No. We have a proprietary file system that distributes blocks across the cluster. In addition to redundancy of blocks across servers and disks, it also offers tiered storage where the bulk of content will exist on SAS HDDs, with more commonly used blocks moving to SSD or NVME storage. There's some good information here in the linked PDF: https://www.scalecomputing.com/resources/sc-hypercore-scribe-theory-of-oper… The VMs themselves would still be free to make use of any networked filesystems. -- Greg

Jan. 26, 2024

Re: Proxmox!

by John Stoffel

>>>>> "Cara" == Cara Salter via WLUG <wlug(a)lists.wlug.org> writes: > On 1/25/24 17:44, Tim Keller via WLUG wrote: >> Proxmox is it's own linux distro with a customized kernel that focuses >> on kvm. So installing it on a box takes it over. >> I've also setup a proxmox backup server and I'm doing backups of all my >> VMs in 30 minute intervals. >> >> It *feels* a bit like vsphere. The interface is *miles* better than >> OpenStack's interface. > Personally, I'm a fan of XCP-NGs interface over proxmox's. I manage > two clusters (one at home, one in a lab) and one thing that's stuck > out to me is how clunky its authentication is. Manually syncing LDAP > gets kind of old. Could we convinse you to come down to Technocopia and do a presentation too? Dueling presentations! And ideally on the strenths and weaknesses of migrating from VMware. ESX is still the 900lb gorilla, but broadcom certainly seems to be sawing away at the branches underneath it.

Jan. 26, 2024

Re: Proxmox!

by John Stoffel

>>>>> "Gregory" == Gregory Boyce via WLUG <wlug(a)lists.wlug.org> writes: > On Thu, Jan 25, 2024, 5:03 PM John Stoffel <john(a)stoffel.org> wrote: >>>>>> "Gregory" == Gregory Boyce via WLUG <wlug(a)lists.wlug.org> writes: >> Coincidentally, I just recently started in a support role at Scale >> Computing, which provides virtualization leveraging qemu/kvm, with >> their own proprietary clustered filesystem. > Can we convince you to come and give us a talk? This looks really > interesting! > I'm open to giving a talk, but I don't tend to be free on Thursday > evenings. I think we could schedule something if it works better for you. Is there a particular night that works better? Ideally I'd like to have you do it in person, if only so I can pick your brain better. And does Scale offer support for datastores (not sure the term) on NFS storage? Since that would make our transistion simpler.

Jan. 26, 2024

Re: Proxmox!

by William Grenache

Understood - Thank you for that. Bill On Friday, January 26, 2024 at 08:22:54 AM EST, Gregory Boyce via WLUG <wlug(a)lists.wlug.org> wrote: On Fri, Jan 26, 2024 at 7:10 AM William Grenache <grenache7994(a)verizon.net> wrote: Gregory, Looks like Scale Computing competes directly with VxRail (VMware w/ Dell/EMC product) and other HCI appliances - Nutanix AHV comes to mind as well... Although, first glance - looks like you don't need and or can't use the VMware hypervisor in any way. Can I assume Scale has a VM converter? v2v like tools? That's correct. We use the Linux KVM hypervisor rather than working with something like VMWare. You can directly upload vmdk, qcow2, img, vhd and vhdx, and the system will automatically convert them before use if needed. We're natively using qcow2 internally. We also have a partnership with Carbonite for p2v migrations. -- Greg_______________________________________________ WLUG mailing list -- wlug(a)lists.wlug.org To unsubscribe send an email to wlug-leave(a)lists.wlug.org Create Account: https://wlug.mailman3.com/accounts/signup/ Change Settings: https://wlug.mailman3.com/postorius/lists/wlug.lists.wlug.org/ Web Forum/Archive: https://wlug.mailman3.com/hyperkitty/list/wlug@lists.wlug.org/message/FFIM4…

Jan. 26, 2024