Showing posts with label 10. Show all posts

Tuesday, December 2, 2008

Predicting Solaris 10 TCP Sequence Numbers Part 1: Initial Discovery

Hey there,

Note: All examples today were produced using Solaris 10. As such, commands like snoop may need to be replaced with ethereal or tcpdump, etc, depending on your OS and/or preference.

Today, we're going to look at a subject that gets plenty of attention (but, maybe not as much publicity) in the world of Unix and Linux network computing: TCP packet sequence number prediction, how it's used to protect network transmissions and whether or not, with the advent of packet checksumming, etc, it's even a factor in basic network security anymore. See here, or at the very bottom of the post, for something potentially interesting about the latest Solaris' network protocol enhancements including SDP.

Not all that long ago (which might mean a long time ago to you, since I'm growin' old ;) TCP number sequencing was pretty simple to predict. In essence, the sequence numbering of TCP packets is required since TCP does its own error-correction and will attempt to resend packets that it doesn't "know" reached their specified endpoint. Numbering, at the most basic level, was/is a great way to ensure that all packets sent actually get received. And, believe it or not, at one point in time that numbering was simply incremental. That means that, given a point-to-point TCP transaction, a simple transmission (from the sender's point-of-view, for instance) might consist of 15 packets. If the first packet was numbered 1 (a gross oversimplification, to be sure, but not too far from being exact ;), the next would be numbered 2, then 3 and so forth until the 15th packet (numbered 15) was successfully sent.

Given the above scenario, and with the aid of hindsight, TCP connection hijacking and other spoofing-based attacks were made quite a bit simpler than they might have been. Of course, once all this "bad" activity began happening, the specifications for TCP packet sequence numbering began to change and become more complicated. Many proprietary OS manufacturer's also began to implement their own proprietary sequence numbering algorithms (in accordance with standards so they could communicate with "unlike" systems). Unfortunately, most of these next-gen specifications were based on simplistic rules like (another gross oversimplification) simple mathematic derivations which didn't use any sort of "outside influence" to affect (or make more unpredictable) the sequence numbering. If you could figure out the equation, you could easily guess what packet number would be next, given one or two sequential packets, and then the whole mess would start all over again. Wikipedia actually has a very nice page on TCP with links to all the relevant RFC's.

This is actually still true today, although OS manufacturers, the Open Source community and white/black-hat hackers are stepping up their games to greater degrees and at a much more condensed pace (by which I mean things now, generally, change more often within a shorter period of time - another gross oversimplification ;)

So, now that it's the present, let's take a look at Solaris 10 and check out what they're doing with regard to this matter (From release 10/08 - the most recent to this date, as far as I know). Assuming we have a connection established with a Solaris 10 server (simple SSH), we can use snoop to gather the information we need to even begin attempting to figure out the TCP packet sequence numbering algorithm they're using (assuming - thinking positive thoughts :) that we can. A simple chunk of output is shown below:

host # snoop -r -d eri0 from 10.99.99.99 to 10.98.98.98
Using device /dev/eri (promiscuous mode)
 10.99.99.99 -> 10.98.98.98  TCP D=2782 S=22 Push Ack=2865625835 Seq=673983919 Len=52 Win=50400
 10.99.99.99 -> 10.98.98.98  TCP D=2782 S=22 Push Ack=2865625887 Seq=673983971 Len=52 Win=50400
 10.99.99.99 -> 10.98.98.98  TCP D=2782 S=22 Push Ack=2865625939 Seq=673984023 Len=52 Win=50400
 10.99.99.99 -> 10.98.98.98  TCP D=2782 S=22 Push Ack=2865625939 Seq=673984075 Len=340 Win=50400
 10.99.99.99 -> 10.98.98.98  TCP D=2782 S=22 Push Ack=2865625939 Seq=673984415 Len=148 Win=50400
 10.99.99.99 -> 10.98.98.98  TCP D=2782 S=22 Push Ack=2865625939 Seq=673984563 Len=148 Win=50400
 10.99.99.99 -> 10.98.98.98  TCP D=2782 S=22 Push Ack=2865625939 Seq=673984711 Len=148 Win=50400
 10.99.99.99 -> 10.98.98.98  TCP D=2782 S=22 Push Ack=2865625939 Seq=673984859 Len=148 Win=50400
 10.99.99.99 -> 10.98.98.98  TCP D=2782 S=22 Push Ack=2865625939 Seq=673985007 Len=148 Win=50400
 10.99.99.99 -> 10.98.98.98  TCP D=2782 S=22 Push Ack=2865625939 Seq=673985155 Len=148 Win=50400

Of course, the column we're most interested in (at first, anyway) is the 9th column from the left (assuming spaces and tabs as the default field separator). The column beginning with "Seq=" is what we'll look at first. For the sake of this exercise, we've saved all the packets in a file called "packets." We didn't use -o on the command line, but this is a pretty simple cut-and-paste ;). To isolate those sequence numbers, we could just do the following:

host # awk '{print $9}' packets|sed 's/Seq=//'
673983919
673983971
673984023
673984075
673984415
673984563
673984711
673984859
673985007
673985155

And, here's where it becomes difficult. The first test of a reasonably stable (by which I mean, unpredictable) sequence numbering algorithm is to subject it two basic tests. That is to say, is it really secure or is it just a simple numeric or mathematic progression in sheep's clothing?

As we bring part 1 of this endeavour to an end, we'll do the quick and dirty testing (If Solaris fails these, then I may have made a big mistake when I named this post before I finished writing it ;)

1. Are the numbers in simple sequence (e.g. +1 or +2) over and over again?
Answer: No. The numeric difference between the packet pairs (1-2, 2-3, etc) are not infinitely exact.
Proof: The 9 differences in order:
673983971-673983919 = 52
673984023-673983971 = 52
673984075-673984023 = 52
673984415-673984075 = 340
673984563-673984415 = 148
673984711-673984563 = 148
673984859-673984711 = 148
673985007-673984859 = 148
673985155-673985007 = 148

2. Is there any direct correlation between the differences between packet sequence numbers and any other property of the packets?
Answer: Yes. If we scroll up the page and look at the basic snoop output, we can see that the difference in sequence numbers correlates exactly with the length of the packet.
Proof: The packet lengths in order:
host # awk '{print $10}' packets|sed 's/Len=//'
52
52
52
340
148
148
148
148
148
148

It seems as though we have something going here, but it must be harder than this to guess the sequence numbers. It's possible, also, that additional measures are being used that obviate the somewhat-flimsy dependence on convoluted number sequences to safeguard a transmission from "packet injection" or hijacking. For instance, Solaris 10 now makes use of SDP as part of its data transmission security (see, also, the Sockets Direct Protocol Manpage). It may also be that Devil is in the details and we only looked at a surface scan of our packets. We'll look at all of these possibilities in a near-future post. This isn't over yet :)

Cheers,

, Mike

Please note that this blog accepts comments via email only. See our Mission And Policy Statement for further details.

Wednesday, October 22, 2008

Modifying Existing Local Zone File Systems On Solaris 10 Unix

Hey There,

Today's post is a follow-up to yesterday's post on creating new file systems in a local zone on Solaris 10. Today, we're moving on to a simple how-to on modifying existing local zones. As some of you may have noticed, with yesterday's post, I managed to blithely bypass the creation of the local zone we were working on. It's generally required that you create (or make) a local zone before you can add a filesystem to it ;) Although this topic is covered within our previous post on setting up Branded Linux zones in Solaris 10, we'll attack zone creation and initial setup at the end of this short series of posts, just so it has its own place and isn't presented in a, possibly, unfamiliar context.

Today's bit of work is a nifty trick because, although it seems that there should be some "special way" to modify an existing filesystem in a Solaris 10 zone, it's really about as simple, or as difficult, as you make it ( For this example, we'll be consistent with yesterday's post and have the "DING" local zone's "DONG" filesystem be of the type VxFS ).

NOTE: This caveat carries over from our previous post, as well. When modifying existing filesystems on a Solaris 10 local zone, all changes must be made to the filesystem from the global zone!

1. Log into your global zone again. This is generally just the "host" or what we used to think of (before zones or containers) as "the box" or "the computer." Then, check out the filesystem you want to modify, with "df -k|grep DONG" (or something similar), like so:

host # df -h|grep DONG
/dev/vx/dsk/DINGdg/DONGvol 6547824 24356 6523468 1% /DONG

2. Now, you can simply resize (shrink, grow, etc -- this part is heavily dependent on your filesystem and its capabilities) as you would normally. We've attacked the following procedure in much more depth in our previous post on adding and managing storage with Veritas Volume Manager, so we'll leave this example boiled down to the essentials. For our example, we want to add 10 Gb of space to the "DONG" filesystem. And, we can do so, just as simply as if we were modifying any other VxFS filesystem, like this:

host # vxresize -g DINGdg DONGvol +10g

3. And that's it! Now all we have to do is verify that the filesystem actually grew, by issuing the exact same command we did in step 1. It should be noted that we used "vxresize" specifically (rather than "vxassist -growby") so that we wouldn't have to run two commands to increase the capacity of the volume and grow the filesystem on it. Depending on your situation, you may need to do both separately, but you'll still be following standard protocol for whatever disk management tool you prefer to use, rather than modifying your method to suit Solaris:

host # df -h|grep DONG
/dev/vx/dsk/DINGdg/DONGvol 17033584 24356 17009228 1% /DONG

And, there you go. Simple as pie, and the work week is just about half over :)

Cheers,

, Mike

Please note that this blog accepts comments via email only. See our Mission And Policy Statement for further details.

Tuesday, October 21, 2008

Creating New File Systems In Local Zones On Solaris 10

Hey There,

A while ago (back in May, 2008, I believe), we took a look at working with storage pools using ZFS on Solaris 10. As we know, ZFS stands for the Zettabyte File System and not the Zone File System (which some folks think it does. Not criticizing. It makes more sense than a lot of other things you might get from those initials ;). The point being, we never stopped to take a look at zones and lay down some simple procedures for working with them. Since this blog attempts to serve as some sort of a reference (hopefully folks come here and find some help or usable information/advice), today I thought we'd start taking a look at Solaris zones. Today, we'll start looking at Solaris 10 zones by looking at "local zones." There are many important distinctions to be made between local and global zones in Solaris, but, for now, let's just leave the meaning as vague as possible. Global = All Zones. Local = Specific Zones. Perhaps I could make it simpler to understand than that. Suggestions are, of course, always welcome. But, enough dwelling on that...

Here's one of (I'm sure) many ways to add a new filesystem to a Solaris 10 local zone. Note that all of this work needs to be done "from" the global zone.

1. Once you've logged onto your global zone (usually just the main host name, like you would log in to any other zone-less version of Solaris), create the volume and filesystem "on the global zone" using standard filesystem creation commands. For this instance, we'll assume VxFS (the Veritas File System), but you could use any filesystem Solaris supports. If you are using VxFS, Solaris Volume Manager or however you prefer to do your disk partitioning and management, it's always a good idea to try to include the name of your local zone in the disk group, etc. This way, in the future, you'll never have to wonder what belongs to which when you have 15 zones on the same box!

2. Add an entry for your new local zone in /etc/vfstab file on the global zone. You should use best practice and make the mount point under /zones/MyNewZone/root. So if you wanted to add a filesystem name "DONG" to the "DING" local zone, your mount point would be:

/zones/DING/root/DONG

3. Now, still on the global zone, modify the "DING" local zone:

host # zonecfg –z DING
zonecfg:DING> add fs
zonecfg:DING:fs> set dir=/DONG
zonecfg:DING:fs> set special=/dev/vx/dsk/DINGdg/DONGvol
zonecfg:DING:fs> set raw=/dev/vx/rdsk/DINGdg/DONGvol
zonecfg:DING:fs> set type=vxfs
zonecfg:DING:fs> end
zonecfg:DING:fs> commit
zonecfg:DING:fs> quit

4. Next, mount your new "DONG" filesystem while still in the global zone:

host # mount /zones/DING/root/DONG

5. Now, hop on out of the global zone (or log out, whichever works for you ;). Then, login to the "DING" local zone and you should be able to see your new filesystem:

/dev/vx/dsk/DINGdg/DONGvol 6547824 24356 6523468 1% /DONG

NOTE: The only exceptions to the "create your local zones in the global zone ONLY" rule, have to do with NFS, and the like, filesystems. When you are adding a filesystem of this type to your local zone, you need to add it while "in" the local zone.

Tomorrow, we'll take a look at maintaining/modifying your new "DING" local zone. Until then, enjoy the peace and quiet :)

Cheers,

, Mike

Please note that this blog accepts comments via email only. See our Mission And Policy Statement for further details.

Thursday, October 16, 2008

Solaris 10 - 5/08 Release: ZFS-Rooted Zones Getting Better!

Hey There,

Before anyone starts phoning in, I do realize this is not "brand new" :) It's just brand new to me and the place I work. Now that we're starting to pull in some of those Mx000 Series Boxes, we're finally up to date on Solaris 10! Plus, I'm sure it's patched to the gills ;)

Today's post is going to be almost like a press release, because the folks at Sun have released so much more information than I can process in a day that I felt it was best to let them figuratively speak for themselves ;) As you can tell by the headline today, Solaris 10 is finally starting to move in a few directions I've been hoping it would for a long long time!

Although there are a number of significant improvements in the OS, I think the home run on this release (5/08) is the ability to, at last, create zones that support zfs root filesystems without as many hassles and limitations as their previous releases! (For more whining about the headaches you may have become accustomed to already, and how to get around some of them, check out our older post on dealing with ZFS rooted zones on Solaris 10 ;) Strangely enough it's one of the things they tout the least. Another very interesting thing (for me, anyway ;) is that they've included the freeware 7-Zip utility that has long been a favorite of mine. It's, also, the last thing on the page. I'm starting to get the feeling Sun doesn't take me all that seriously...

Without further ado, check out the latest and greatest list of augmentations to Solaris 10. You can access the Official Sun 5/08 Release Notes Page if want to have easier access to past release notes and other relevant information.

Enjoy! I'm going to play around with this release a bit and see if I haven't been deluding myself ;)

Cheers,

Chapter 1 What's
New in the Solaris 10 5/08 Release

For a summary of features that were introduced in the Solaris 9, Solaris
8, or Solaris 7 releases, see What's New in the Solaris 9 Operating
Environment at http://docs.sun.com.

System Administration Enhancements

The following system administration features and enhancements have been
added to the Solaris 10 5/08 release.

Solaris Trusted Extensions Administrator Procedures

Starting with this release, the Solaris^TM Trusted
Extensions packages are installed when the Solaris OS is installed. The ExtraValue directory is no longer present. This directory previously
included the Solaris Trusted Extensions packages. The Solaris Trusted Extensions
functionality is managed by the service management facility (SMF) as the svc:/system/labeld:default service. This service must be enabled.
After the service is in the online state, reboot the system to activate Solaris
Trusted Extensions. Additional configuration is required after the reboot.
For more information, see Solaris
Trusted Extensions Configuration Guide.

The Solaris 10 5/08 release also includes the following features:

The domain of interpretation (DOI) is configurable. For more
information, see Network Security Attributes in Trusted Extensions in Solaris Trusted Extensions Administrator’s Procedures.

The NFSv3 protocol supports multilevel mounts. For more information,
see Trusted Extensions Software and NFS Protocol Versions in Solaris Trusted Extensions Administrator’s Procedures.

The name service cache daemon, nscd, can
be separately configured per labeled zone. This configuration supports environments
where each zone is connected to a subnetwork that runs at the label of the
zone, and the subnetwork has its own name server for that label.

For more information about Solaris Trusted Extensions, see Solaris Trusted Extensions
Administrator’s Procedures.

Flash Update Tool

fwflash(1M) is a new Solaris command for the manipulation
of firmware for PCI-X, and PCI-Express HBA and HCA cards. Currently, the command
enables listing, reading, and writing the firmware for the InfiniBand HCA
cards.

For more information about this command, see the fwflash(1M) man page.

PPD File Management Utility

The PostScript^TM Printer Description (PPD) file
management utility, /usr/sbin/ppdmgr, manages PPD files
that are used with the Solaris print subsystem.

By using the ppdmgr utility, you can perform the
following tasks:

Add a PPD file to a PPD file repository on a system

Supply a label to group PPD files within a PPD file repository

Update the cache of the PPD file information that is used
by the Solaris Print Manager (printmgr) GUI to display
supported printer information

You can add a new PPD file by using the ppdmgr utility
or by using the lpadmin -n command. When
you add a new PPD file, you automatically update the cache of the PPD file
information that the printmgr GUI uses to display supported
printer information.

Note –

The delivery location of PPD files in the Solaris OS has changed.
During a software upgrade, any print servers with print queues that were defined
by using PPD files from the previous PPD file delivery location are automatically
updated to reflect the new PPD file delivery location.

In addition, a new SMF service, print/ppd-cache-update, has been introduced.
The print/ppd-cache-update service is enabled by default. This service runs
one time during system reboot to update the printer cache information with
changes from all the PPD file repositories on the system. The service might
take longer to transition to an online state during a system reboot after
a software installation or upgrade. Also, if any changes were made to the
PPD file repositories since the last PPD cache update, during system reboot,
the service might take longer to come online. Changes made to the PPD file
repositories on a system are not reflected in the PPD cache used by Solaris
Print Manager until the print/ppd-cache-update service is online.

For more information, see the following:

ppdmgr(1M) man
page

Chapter
9, Administering Printers by Using the PPD File
Management Utility (Tasks), in System
Administration Guide: Solaris Printing

Internet Printing Protocol Client-Side Support

Client-side support for the Internet Printing Protocol (IPP) enables
Solaris client systems to communicate with IPP-based print services, such
as those on the Linux and Mac OS X operating systems, as well as other platforms.

Small improvements are also featured in the server-side support for
the IPP listening service. These improvements promote better interoperability,
including some minor changes that result in a more standard representation
of printer and job attribute data.

The IPP server and client implementation in the Solaris OS is one of
several OpenSolaris^TM printing projects that are currently
under development. OpenSolaris printing provides a set of specifications and
implementations of software that enables you to create standardized, scalable
printing components for the Solaris and Linux software, or any operating system
that contains a set of POSIX interfaces.

For more information, see the System Administration Guide: Solaris Printing.

For more information about OpenSolaris Printing, see http://opensolaris.org/os/community/printing/.

Selectable Use of `localhost` for
Solaris Print Server Database Hostname

This printing feature enables the Solaris print system to recognize
and use localhost as the local host in the print system
databases. In prior releases, /bin/hostname was used
solely to generate the print hostname. The print system depended on this name
remaining constant. The ability to use localhost as the
name of the current system enables print servers to maintain the same print
hostname, independent of the system's host name.

Note –

The modification applies to the setup of local print queues exclusively.

To support this feature, the following modifications are effective for
the lpadmin command and the Solaris Print Manager graphical
user interface (GUI):

The lpadmin command uses the -s option
when creating a local print queue.

To use localhost as
the host name that is specified within the print server, set the print hostname
to localhost, as shown:
# lpadmin -p <new-print-queue> -s localhost -v <device>
For example:
# lpadmin -p foo -s localhost -v /dev/term/a
Note –
The default behavior of the lpadmin command
has not changed.

Solaris Print Manager now includes an added tool attribute
check box, Use localhost for Printer Server. The localhost attribute is selected by default. To deselect the localhost attribute,
uncheck the box. Unchecking the box selects the previously chosen behavior
for this attribute.

For more information, see the following:

printmgr(1M) man
page

lpadmin(1M) man
page

System
Administration Guide: Solaris Printing

Fault Management for T5140/T5240 Platforms

The Solaris predictive self-healing technology is available on Sun SPARC
Enterprise T5140 and T5240 platforms. Predictive self-healing features include
the following:

Automated error handling

Automated diagnosis

Automated recovery for CPU, memory and I/O subsystems

Clear and concise error messages

For more information, see http://www.sun.com/software/solaris/ds/self_healing.jsp and http://opensolaris.org/os/community/fm.

SunVTS 7.0

SunVTS^TM is a comprehensive system validation and
test suite designed to support Sun hardware platforms and peripherals. SunVTS
7.0 is the next generation of SunVTS 6.0 and its compatible versions.

SunVTS 7.0 includes the following features:

Introduction of the concept of purpose-based testing

Improved diagnostics effectiveness

Web-based user interface

Simplified usage

New architecture framework

Enterprise View

SunVTS 7.0 follows a conventional three-tier architecture model. This
model is composed of a browser-based user interface, a Java based middle server,
and a diagnostic agent.

System Resource Enhancements

The following system resource features and enhancements have been added
to the Solaris 10 5/08 release.

CPU Caps

CPU caps provide absolute fine-grained limits on the amount of CPU resources
that can be consumed by a project or a zone. CPU caps are provided as a zonecfg resource, and as project and zone-wide resource controls.

The zonecfg capped-cpu resource provides
an absolute limit on the amount of CPU that can be consumed by a project or
a zone.

The following resource controls are available:

zone.cpu-cap

Absolute limit on the amount of CPU resources that can be
consumed by a non-global zone.

project.cpu-cap

Absolute limit on the amount of CPU resources that can be
consumed by a project.

For more information, see the following:

zonecfg(1M) man
page

zones(5) man
page

System
Administration Guide: Solaris Containers-Resource Management and Solaris Zones

`projmod`(1M) Option

Use the projmod command with the -A option
to apply the resource control values defined in the project database to the
active project. Existing values that do not match the values defined in the
project file, such as values set manually by prctl(1),
are removed.

Device Management Enhancements

The following device management features and enhancements have been
added to the Solaris 10 5/08 release.

Tape Self-Identification

The tape self-identification feature configures the tape automatically,
with the parameters provided by the tape drive. Previously, the configuration
data for a tape drive was statically supplied through user-editable configuration
files, built-in configuration tables, or default values. The tape-self identification
feature uses a few SCSI commands to directly query the required parameters
from the tape drive. When the st driver gets the parameters,
the tape drive uses them on the Solaris OS.

The advantages of tape-self identification over the traditional file-based
configuration are:

Simple and no user intervention is needed

Faster support for new tape drives

Easy to use, standard-based interface

x86: Enhanced Speedstep CPU Power Management

Starting with this release, Intel's Enhanced Speedstep^TM technology
is supported on the Solaris OS. Enhanced Speedstep support enables Solaris
platform users to manage the power consumption of their Intel processors by
lowering the processor frequency during idle periods.

For more information about how to enable Solaris CPU power management,
see the power.conf(4) man
page.

x86: PowerNow! CPU Performance Management

Starting with this release, AMD's PowerNow! technology is supported
on the Solaris OS. PowerNow! support enables Solaris platform users to manage
the power consumption of their Opteron 10h family of processors by adjusting
the processor operating frequency and voltage according to the task being
performed.

For more information about how to enable Solaris CPU power management,
see the power.conf(4) man
page.

iSNS Support in the Solaris iSCSI Target

This Solaris release provides support for the Internet Storage Name
Service (iSNS) protocol in the Solaris iSCSI target software.
The iSNS protocol enables automated discovery, management, and configuration
of iSCSI devices on a TCP/IP network.

The Solaris iSCSI target software does not include native iSNS server
support. However, in this Solaris 10 release, you can add access to an existing
iSNS server to automatically discover the iSCSI devices in your network.

The iscsitadm command is used to configure the Solaris
iSCSI target to discover the iSNS server and enable or disable the iSNS discovery.
Use the hostname or the IP address to specify the iSNS server.

For more information, see the iscsitadm(1M) man page and Chapter 14, Configuring
Solaris iSCSI Targets and Initiators (Tasks), in System Administration Guide: Devices and File Systems.

Security Enhancements

The following security features and enhancements have been added to
the Solaris 10 5/08 release.

Solaris Trusted Extensions Supports Mounting Labeled
File Systems With the NFSv3 Protocol

Starting with this release, the Solaris Trusted Extensions software
can mount labeled file systems by using NFS Version 3 (NFSv3) in addition
to NFS Version 4 (NFSv4). Solaris Trusted Extensions has no restrictions on
using TCP as an underlying transport protocol for NFS. However, users cannot
choose User Datagram Protocol (UDP) as the underlying protocol for read-down
NFS access for NFSv3. The use of UDP for the initial mount operation is supported,
but UDP is not supported for subsequent multilevel NFSv3 operations.

SPARC: Hardware -Accelerated Elliptical Curve
Cryptography (ECC) Support

The UltraSPARC T2 (Niagara 2) based platforms support hardware acceleration
of Elliptical Curve Cryptography (ECC) algorithms. The Solaris OS now supports
high performance ECDSA and ECDH on these platforms. These new ECC algorithms
are accessible to all users of the Solaris Cryptographic Framework including
Java technology and OpenSSL users.

Networking Enhancements

The following networking features and enhancements have been added to
the Solaris 10 5/08 release.

Sockets Direct Protocol

The Sockets Direct Protocol (SDP) is a transport protocol layered over
the Infiniband Transport Framework (IBTF). SDP is a standard implementation
based on Annex 4 of the Infiniband Architecture Specification Vol1. SDP provides
reliable byte-stream, flow controlled two-way data transmission that is very
similar to TCP.

For more information see sdp(7D) man
page.

`inetd` Backlog Queue Size

Starting with this release, a tunable to set the backlog queue size
of the inetd managed services is introduced. This feature
adds an SMF property to inetd called connection_backlog that enables the queue size to be modified. The default value of
the connection_backlog queue size is 10. You can modify
the connection_backlog property by using the inetadm command.
For example:

To list the properties, type:
#inetadm -l fmri/pattern

To change the value for a specific service, type:

#inetadm -m fmri/pattern conection_backlog=new value

To change the value globally, type:
#inetadm -M connection_backlog=newvalue

For more information, see the inetadm(1M) man page.

X11 Windowing Enhancements

The following X11 windowing features and enhancements have been added
to the Solaris 10 5/08 release.

Xvnc Server and Vncviewer Client

VNC provides a remote desktop session over the Remote Frame Buffer (RFB)
protocol. RFB clients, better known as VNC viewers, are available for most
platforms, in both open-source and commercial releases.

The Solaris 10 5/08 release now includes Xvnc. Xvnc is an X server that
is based on the open-source releases from the RealVNC project and X.Org Foundation.
Xvnc is displayed to an RFB protocol client over the network without requiring
an existing X server session display on the local video hardware. This release
also includes RealVNC's vncviewer RFB client to connect to remote VNC servers,
and several associated programs for managing these servers.

For more information, see System Administration
Guide: Virtualization Using the Solaris Operating System. See
also the Xvnc(1) and vncviewer(1) man
pages.

Desktop Tools Enhancements

The following desktop tools features and enhancements have been added
to the Solaris 10 5/08 release.

StarOffice 8

Starting with this release, StarOffice has been enhanced to the latest
version, StarOffice 8.

For more information about StarOffice, see http://www.sun.com/software/star/staroffice/whats_new.jsp.

Flash Player 9

Stating with this release, the Solaris OS includes the Adobe Flash Player
9. For more information about this Flash Player, see http://www.adobe.com/products/flashplayer/productinfo/features/.

Pidgin 2.0

Pidgin is a popular open-source instant messaging client. Pidgin 2.0
includes the following features:

Many improvements to the UI modules including status system,
Buddy List, Conversation, and the chat window

New Yahoo features including Stealth Settings, Doodle, and
the /list command

Improved AIM and ICQ file transfers

Improved Log Viewer module

Support for the new version of ICQ file transfer

New IRC features including SSL support, and the new commands /whowas, /nickserv, /memoserv, /chanserv, and /operserv

Jabber features including support for SRV lookups, buddy icons,
and Jabber User Directory searching

PAPI Print Commands

The Free Standards Group (FSG) Open Printing API (PAPI) commands replace
several commonly used print commands, which include the following:

cancel(1)

disable(1)

enable(1)

lp(1)

lpstat(1)

lpc(1B)

lpq(1B)

lpr(1B)

lprm(1B)

accept(1M)

lpmove(1M)

reject(1M)

The implementations of the Open Printing API commands are layered on
top of the Free Standards Group Open Printing API in the Solaris OS. This
implementation enables the commands to run on top of multiple protocols or
services.

Some advantages of the new print command implementations include the
following:

Improved consistency between desktop applications and command-line
interfaces

Multiple print protocols and service support from the command
line

Internet Print Protocol (IPP) client-side support for improved
interoperability with Linux, Mac OS X, and other IPP-based print services

Enhanced remote capability and data when using IPP between
print client and server

The capability to disable network services and retain access
to local printers

For more information about the PAPI print commands, see the following:

PAPI Implementation in the Solaris OS (Reference) in System Administration Guide: Solaris Printing

OpenSolaris Printing Community web pages at http://opensolaris.org/os/community/printing/projects/papi_client_commands/

System Performance Enhancements

The following system performance features and enhancements have been
added to the Solaris 10 5/08 release.

64-bit SPARC: Memory Placement Optimization
Support for sun4v Platforms

Memory Placement Optimization (MPO) enables operating systems to allocate
memory local to the core where the threads or processes are being executed.
The sun4v architecture runs on virtualized hardware environment. The MPO for
sun4v platforms feature provides the required standard accessors in the sun4v
layer to provide locality information for the generic MPO framework. This
feature is effective on platforms that have multiple sockets with differences
in memory access latency. The MPO feature enhances the performance of various
applications by enabling the OS to allocate memory local to the nodes.

SPARC: Shared Contexts Support

The context mechanism, which is used by the Memory Management Unit (MMU)
hardware to distinguish between the use of the same virtual address in different
process address spaces, introduces some inefficiencies when shared memory
is used. The inefficiencies in shared memory are because the data at a particular
shared memory and the address in different processes might really be identical,
but the context number associated with each process is different. Therefore,
the MMU hardware cannot recognize a match. This inability to recognize a match
results in mappings being unnecessarily evicted from the MMU translation cache
and the Translation Lookaside Buffer (TLB), only to be replaced by identical
mappings with a different context number.

The Niagara 2 system has an additional shared context, which is a hardware
feature that can be used to prevent the inefficiency in handling shared memory.
Searching the TLB for mapping a match on either the private or the shared
context results in a TLB hit. The current software support for shared context
activates the feature for processes that use the Dynamic Intimate Shared Memory
(DISM). In this case, the process text segment and DISM segments mapped at
the same virtual address with the same permissions for each process use the
shared context.

x86: CPUID-Based Cache Hierarchy Awareness

Modern Intel processors provide an interface for discovering information
about the cache hierarchy of the processor through the CPUID instruction.

Language Support Enhancements

The following language support features and enhancements have been added
to the Solaris 10 5/08 release.

Locale Creator

Locale Creator is a command line and graphical user interface tool that
enables users to create and install Solaris locales. Using locale creator
users can create installable Solaris packages containing customized locale
data of a specific locale. After the created package has been installed, the
user has a fully working locale on the system.

For more information, see the following:

The command /usr/bin/localectr -h

localectr man page

http://developers.sun.com/global/products_platforms/solaris/reference/techart/locale-creator.html

libchewing 0.3.0

Chewing input method (IM) is based on libchewing, which is an open-source
library for Traditional Chinese input. libchewing has been upgraded to the
libchewing 0.3.0 version. Some of the features of the new version include
the following:

Incompatibility with API/ABI.

UTF-8 based language engine core for common Unicode environment.

Includes the libchewing-data subproject.

Zuin fixes and symbol improvements.

New binary form of user hash data to speed up loading and
solving hash data corruption.

Improved calculation of internal tree and phone constants.

Revised tsi.src for richer phrases and avoiding crashes.

Merge phone and phrase from CNS11643.

Improved Han-Yu PinYin to use table-lookup implementation.

Experimental frequency evaluation that re-computes chewing
lifetime.

Implementation of the choice mechanism for symbol pairs.

Experimental, memory mapping-based, binary data handling to
speed up data loading.

For further information, see the International
Language Environments Guide.

File Encoding Examiner

The File Encoding Examiner (fsexam) enables you to convert the name
of a file, or the contents of a plain-text file, from a legacy character encoding
to UTF-8 encoding. New features in the fsexam utility include the following:

Encoding list customization

Encoding auto-detection

Support for dry runs, logs, batch conversion, file filtering,
symbolic files, command line, and special file types like compress file

For more information, see the fsexam(1) and fsexam(4) man pages.

Kernel Functions Enhancements

The following kernel functions features and enhancements have been added
to theSolaris 10 5/08 release.

x86: MONITOR and MWAIT CPU Idle Loop

The Solaris OS uses the SSE3 MONITOR and MWAIT instructions in the x86
processor idle loop. Using the SSE3 instructions in the processor idle loop
eliminates the overhead of sending and receiving an interrupt to wake up a
halted processor. MONITOR is used to specify a memory range to monitor the
idle loop. MWAIT halts the processor until the address previously specified
with MONITOR is accessed. With the new idle loop, a processor has to write
to memory only to wake up a halted processor.

Driver Enhancements

The following driver features and enhancements have been added to the
Solaris 10 5/08 release.

x86: Support Sun Fire X4540 Disk Status Indicators

Starting with this release, the Sun Fire X4540 disk status indicators
are supported. The amber Fault status LED and blue Ready to Remove status
LEDs are enabled by this feature.

For more information, see the Sun Fire X4540
Server Diagnostics Guide.

MPxIO Extension for Serial Attached SCSI Devices
on `mpt`(7D)

The mpt driver has been enhanced to support MPxIO
with supported storage devices. When MPxIO is enabled for Serial Attached
SCSI (SAS) and SATA devices, they are enumerated under scsi_vhci(7D)
just like fibre channel devices under fp(7D).

Starting with this release, stmsboot(1M) has also
been enhanced to support multipathed SAS devices. stmsboot(1D)
operates on all attached and multipath-capable controllers by default.

If you wish to only enable multipathing on fp or mpt controllers then you can use the new flag which has been added
to restrict operations. The command, /usr/sbin/stmsboot -D mpt -e, will enable MPxIO only on attached mpt controllers.
Replacing mpt with fp in this command
will make stmsboot enable MPxIO only on attached fp controllers.

x86: SATA ATAPI Support in AHCI Driver

The AHCI driver supports SATA ATAPI CD or DVD devices. Users can use
the SATA CD or DVD in AHCI mode instead of the compatible mode. The AHCI mode
has better error handling and hot-pluggable capabilities.

For more information, see the ahci(7D) man page.

x86: AMD–8111

The AMD-8111 HyperTransport I/O hub includes a 10/100 Mbps Ethernet
LAN controller. The driver is used by the Andretti platform.

SATA NCQ Support in AHCI Driver

The AHCI driver supports the SATA NCQ feature. NCQ support improves
performance of the driver.

For more information, see the ahci(7D) man page.

x86: `bnx` II Ethernet Driver

Starting with this release, support is provided for the Broadcom NetXtreme
(bnx) II Ethernet chipset, which includes BRCM5706C, BRCM5706S, BRCM5708C,
and BRCM5708S.

For more information, see the bnx(7D) man page.

USB-to-Serial Driver for Keyspan Adapters

Starting with this release, a new driver is provided for Keyspan USB-to-serial
adapters. This driver supports the USA-19HS model. This feature enables you
to choose between Edgeport adapters and Keyspan adapters.

For further information, see the usbsksp(7D) man page.

Freeware Enhancements

The following freeware features and enhancements have been added to
the Solaris 10 5/08 release.

32-bit: pgAdmin III

pgAdmin III is a popular and feature-rich, open-source administration
and development platform for PostgreSQL. The graphical interface supports
all PostgreSQL features and makes administration easy. This tool enables users
to write simple SQL queries and also to develop complex databases.

For more information, see http://www.pgadmin.org/.

p7zip

Starting with this release, the Solaris OS includes p7zip port. p7zip
is similar to the Windows compression and archiving utility, 7zip.

For more information, see http://p7zip.sourceforge.net/.

, Mike

Please note that this blog accepts comments via email only. See our Mission And Policy Statement for further details.

Friday, September 26, 2008

Making Solaris 10 Zones Recognize Veritas Raw Devices

Hey there,

Here's something I learned today that I never knew before! ...Actually, when you think about it, everything you ever learn is something you never knew before. Otherwise, you'd already know it, so there'd be no learning involved... Where am I? ;)

Today's short-post is a little trick concerning Solaris 10 and the Veritas File System/Volume Manager. I've been using Veritas with Solaris 10 for quite a while, so this was pretty interesting to find out. In the usual case, I could always set up Solaris zones and hand them Veritas File System partitions with no incident. Usually, something like this:

host # zonecfg -z myNewZone
... <-- Here we skip past the create and "set zonepath" type stuff.  We have more information on dealing with Solaris zones in this old post
zonecfg:myNewZone> add fs
zonecfg:myNewZone:fs> set dir=/my/directory
zonecfg:myNewZone:fs> set special=/myNewZone/my/directory
zonecfg:myNewZone:fs> set type=lofs
zonecfg:myNewZone:fs> end
zonecfg:myNewZone> commit
zonecfg:myNewZone> exit

and life was beautiful ;)

Out of sheer luck (or horrible misfortune), I've always ended up at places that (while they may make heavy use of Veritas Volume Manager, File System, Cluster Server, etc) either went with some combination of SunCluster, Sun Solaris, HP and Oracle or Informix. Now, there's nothing wrong with any of the possible combinations you could end up with here. In fact, there's - more exactly - nothing wrong, since all of them (well, not HP-UX) can work with Solaris 10 zones using raw devices.

If you're not familiar with basic disk access concepts in Unix, at a very basic level, disk in Unix is generally accessible via two standard gateways: Block devices or Raw/Character devices. Most of the time, you probably deal with the block device interface, as this allows buffered sector reads of the device (generally a hard drive/disk) and is generally faster for most operations. To demonstrate what I mean, if you wanted to read a few bytes from HardDrive1, you could read those few bytes from your block device (almost to the byte) , but you'd have to read the entire device in order to get those few bytes when accessing the information via the raw device interface.

Raw devices do have their benefits, of course, or they probably wouldn't be around any more. Like their name suggests, they allow direct (raw) access to the disk. This can make it possible for you to recover information if your disk becomes corrupted (for instance) but is mostly used by software that likes to manage disk on its own and not have to rely on the Operating System. Most database software uses disk in this manner. Oracle, for instance, creates its own "file system" and (although it will work on UFS or any other filesystem) they say it works a lot more efficiently when it can be allocated raw disk and allowed to manage it on its own. It's probably true to some degree. Does anyone really know? ;)

Anyway (back from that two-paragraph aside ;), what I learned today is that Solaris 10 Zones can't (or won't) deal with raw Veritas devices (WT_?) I also found out that there's a way to get around that issue (hence, the post - I still owe you that one that goes on and on forever and leads nowhere ;).

You can get around this deficiency by doing the following (assuming you've already taken care of the basics of setting up your Veritas Volumes and Filesystem) and have created your zone with a base filesystem, like above, and want to add a raw device.

1. Check out your raw device file in the appropriate directory:

host # ls -l /dev/vx/rdsk/myRawDisk
crw------- 1 root root 289, 45000 Aug 24 11:13 myRawDisk

and make note of the Major and Minor numbers of the device (289 and 45000 respectively, above). You'll need these to feed the mknod command you're going to hammer out next (we'll assume you set your zonepath equal to /myNewZone - oh, yeah, and it's also important that you're not in your "Zone" when you do this):

host # cd /myNewZone/dev
host # mknod myRawDisk c 289 45000

2. And (it seems too simple!!! ;) then you just need to (well... you should ;) log into your zone and check it out, with a simple "dd" test or something:

host # zlogin -l root myNewZone
...
zone # ls -l /dev/myRawDisk
crw------- 1 root root 289, 45000 Aug 24 11:13 /dev/myRawDisk
zone # dd if=/dev/myRawDisk of=/dev/null
4096+0 records in
4096+0 records out

And, there you go. That problem you never knew you had is solved! ;)

Cheers,

, Mike

Please note that this blog accepts comments via email only. See our Mission And Policy Statement for further details.

Friday, May 9, 2008

Destroying Storage Pools And File Systems On Solaris 10 Unix ZFS

Hey once more,

Today we're finally ready to wrap up our series of posts on using ZFS and storage pools on Solaris 10 Unix. We started out with a post on ZFS and storage pool creation commands, followed that up with a two-parter on maintenance and usage commands and even more helpful usage commands, and have finally arrived here, today.

This post marks the end in this little series, and, befittingly, it has to deal with destroying ZFS file systems and storage pools. It's wonderful how that worked out so appropriately ;)

I hope this series has been as much a help to you as it has been in crippling my fingers ;) Seriously, here's hoping we all got something out of it :)

Let the end begin:

1. If you decide you want to get rid of your storage pool (none of my business... ;), you can do so like this:

host # zpool destroy zvdevs
host # zpool list zvdevs
cannot open 'zvdevs': no such pool

2. You can also easily remove mirrors from storage pools by doing the following:

host # zpool detach zvdevs /vdev3
host # zpool status -v zvdevs
  pool: zvdevs
 state: ONLINE
 scrub: none requested
config:

        NAME        STATE     READ WRITE CKSUM
        zvdevs      ONLINE       0     0     0
          mirror    ONLINE       0     0     0
            /vdev1  ONLINE       0     0     0
            /vdev2  ONLINE       0     0     0

errors: No known data errors

3. In a Solaris 10 storage pool, you can't remove any active disks using "zpool remove." If you attempt to, it's not a big deal, because you'll just get an error, like this:

host # zpool remove zvdevs /vdev3
cannot remove /vdev3: only inactive hot spares can be removed

But, you can still remove active disks (as long as doing so isn't detrimental...) with the -f flag to force it. To do it the polite way, you just need to "detach" the virtual device in the exact same way you'd detach a mirror from a storage pool, like so:

host # zpool detach zvdevs /vdev3
host # zpool status -v zvdevs
pool: zvdevs
state: ONLINE
scrub: resilver completed with 0 errors on Mon May 5 10:05:33 2008
config:

NAME STATE READ WRITE CKSUM
zvdevs ONLINE 0 0 0
mirror ONLINE 0 0 0
/vdev1 ONLINE 0 0 0
/vdev2 ONLINE 0 0 0

errors: No known data errors

4. Of course, you can easily remove vdevs from a storage pool if they're "hot spares" and they're "inactive." Here, we'll add a spare and then remove it:

host # zpool add zvdevs spare /vdev3
host # zpool status -v zvdevs
pool: zvdevs
state: ONLINE
scrub: resilver completed with 0 errors on Mon May 5 10:05:33 2008
config:

NAME STATE READ WRITE CKSUM
zvdevs ONLINE 0 0 0
mirror ONLINE 0 0 0
/vdev1 ONLINE 0 0 0
/vdev2 ONLINE 0 0 0
spares
/vdev3 AVAIL

errors: No known data errors
host # zpool remove zvdevs /vdev3
host # zpool status -v zvdevs
pool: zvdevs
state: ONLINE
scrub: resilver completed with 0 errors on Mon May 5 10:05:33 2008
config:

NAME STATE READ WRITE CKSUM
zvdevs ONLINE 0 0 0
mirror ONLINE 0 0 0
/vdev1 ONLINE 0 0 0
/vdev2 ONLINE 0 0 0

errors: No known data errors

5. If you want to remove ZFS file systems, just use the "destroy" option, shown below:

host # zfs destroy zvdevs/vusers4
host # zfs list|grep zvdevs
zvdevs 200M 784M 28.5K /zvdevs
zvdevs/vusers 24.5K 200M 24.5K /zvdevs/vusers
zvdevs/vusers@backup 0 - 24.5K -
zvdevs/vusers2 24.5K 100M 24.5K /zvdevs/vusers2
zvdevs/vusers3 24.5K 100M 24.5K /zvdevs/vusers3

6. Of course, there's a catch to destroying ZFS file systems. It won't work straight off if the file system has "children" (Unix has always been a family-oriented OS ;)

host # zfs destroy zvdevs/vusers
cannot destroy 'zvdevs/vusers': filesystem has children
use '-r' to destroy the following datasets:
zvdevs/vusers@backup

In this instance, we either need to recursively delete the file system ( with the -r flag ), like so:

host # zfs destroy -r zvdevs/vusers
host # zfs list|grep zvdevs
zvdevs 100M 884M 27.5K /zvdevs
zvdevs/vusers2 24.5K 100M 24.5K /zvdevs/vusers2
zvdevs/vusers3 24.5K 100M 24.5K /zvdevs/vusers3

or promote the filesystem so that it's no longer a clone and no longer dependant on its origin snapshot, at which point we can destroy it like this (If you recall, many moons ago - this gets confusing - we took a snapshot of zvdevs/vusers. Then we cloned the snapshot to a new file system, zvdevs/vusers4, in order to do a rollback... That's why we have to promote zvdevs/vusers4 to remove zvdev/vusers):

host # zfs promote zvdevs/vusers4
host # zfs list|grep zvdevs
zvdevs 100M 884M 29.5K /zvdevs
zvdevs/vusers 0 884M 24.5K /zvdevs/vusers
zvdevs/vusers2 24.5K 100M 24.5K /zvdevs/vusers2
zvdevs/vusers3 24.5K 100M 24.5K /zvdevs/vusers3
zvdevs/vusers4 24.5K 884M 24.5K /zvdevs/vusers4
zvdevs/vusers4@backup 0 - 24.5K -
host # zfs promote zvdevs/vusers4
host # zfs destroy zvdevs/vusers
host # zfs list|grep zvdevs
zvdevs 100M 884M 28.5K /zvdevs
zvdevs/vusers2 24.5K 100M 24.5K /zvdevs/vusers2
zvdevs/vusers3 24.5K 100M 24.5K /zvdevs/vusers3
zvdevs/vusers4 24.5K 884M 24.5K /zvdevs/vusers4
zvdevs/vusers4@backup 0 - 24.5K -

7. If you've had enough and you want to destroy your storage pool, that's your call. Just remember the hierarchical nature of ZFS and don't get discouraged ;)

host # zpool destroy zvdevs

The only time this won't work is if your pool is not empty (which means containing data, rather than containing file systems) or if it has mounted file systems. Simple variations on regular UFS commands can fix the mounting/unmounting issue for you. Destroying individual ZFS filesystems in your pool will take care of the other issue (So will the "-f" flag, if you just want to use force and be done with it):

host # zpool destroy zvdevs
cannot destroy 'zvdevs': pool is not empty
use '-f' to force destruction anyway
Can’t destroy a pool with active filesystems.
host # zfs mount myzfs/zvdevs
host # zfs unmount myzfs/zvdevs

Note that you may have to unmount filesystems overlay-mounted on top of the main file system. No problem. Again, you can use "-f" to save you the hassle.

And that's all she wrote about this subject... for now...

Have a great weekend :)

, Mike

linux unix internet technology

Thursday, May 8, 2008

More Helpful Usage Commands For Solaris 10 Unix ZFS

Hey there,

Today we're here with part three of our four-part mini-series on ZFS and storage pool commands and tips. We started out with ZFS and storage pool creation commands, and followed that up with yesterday's post on maintenance and usage commands. Today's post is actually a continuation of yesterday's post, which was originally going to be part two of three. The inmates must be running the asylum ;)

For any notes pertaining to this entire four-post series, please refer to the first ZFS and storage pool post. I'm getting tired of hearing my own voice in my head ;)

Today, we'll keep on going with usage and maintenance tips. Enjoy and don't be afraid to come back for seconds :)

1. You can run statistics specifically against your ZFS storage pools (which can help in identifying a bottleneck on a system with a lot of virtual devices, zones and pools). These stats aren't too exciting since I just created the pool for this little cheat-sheet:

host # zpool iostat zvdevs 1 5
               capacity     operations    bandwidth
pool         used  avail   read  write   read  write
----------  -----  -----  -----  -----  -----  -----
zvdevs        92K  1016M      0      0     83    633

<--- As with regular iostat, this is a summary line
zvdevs 92K 1016M 0 0 0 0
zvdevs 92K 1016M 0 0 0 0
zvdevs 92K 1016M 0 0 0 0
zvdevs 92K 1016M 0 0 0 0

2. If you ever need to list out your ZFS file systems, just use the "list" option, like this:

host # zfs list |grep zvdevs
zvdevs 120K 984M 26.5K /zvdevs
zvdevs/vusers 24.5K 984M 24.5K /zvdevs/vusers

3. One problem you might note with new ZFS files systems and listing them out, is that they all have access to the entire storage pool. So, theoretically, any of them could fill up the entire storage pool space and leave the other two out of disk space. This can be fixed by setting "reservations" to ensure that each VFS file system gets to keep a certain amount of space for itself no matter what (here, vusers gets at least 100 Megabytes, and vusers2 and 3 will get at least 50 Megabytes each):

host # zfs set reservation=100m zvdevs/vusers
host # zfs set reservation=50m zvdevs/vusers2
host # zfs set reservation=50m zvdevs/vusers3
host # zfs list -o name,reservation|grep zvdevs
zvdevs none
zvdevs/vusers 100M
zvdevs/vusers2 50M
zvdevs/vusers3 50M

4. On the other hand, you may want to restrict space-hogs from taking up too much space. You can do this with quota's, almost just like on older versions of Solaris Unix:

host # zfs set quota=200m zvdevs/vusers
host # zfs set quota=100m zvdevs/vusers2
host # zfs set quota=100m zvdevs/vusers3
host # zfs list -o name,quota|grep zvdevs
zvdevs none
zvdevs/vusers 200M
zvdevs/vusers2 100M
zvdevs/vusers3 100M

5. You can also set up file systems to use compression, selectively, like so (Whether or not this is worthwhile is debatable):

host # zfs set compression=on zvdevs/vusers2
host # zfs list -o name,compression|grep zvdevs
zvdevs off
zvdevs/vusers off
zvdevs/vusers2 on
zvdevs/vusers3 off

6. ZFS also has built-in snapshot capabilities, so you can prep yourself (like, before you're about to try something crazy ;) and be able to rollback to an earlier point in time (We'll call our snapshot "backup"), like this:

host # zfs snapshot zvdevs/vusers@backup
host # zfs list|grep zvdevs
zvdevs 200M 784M 28.5K /zvdevs
zvdevs/vusers 24.5K 200M 24.5K /zvdevs/vusers
zvdevs/vusers@backup 0 - 24.5K -
zvdevs/vusers2 24.5K 100M 24.5K /zvdevs/vusers2
zvdevs/vusers3 24.5K 100M 24.5K /zvdevs/vusers3

7. Now, assuming that you screwed everything up so badly that you need to back out your changes (but not so bad that you can't access Solaris ;), you can use ZFS's built-in rollback capability. Here we'll do a rollback, based on our snapshot, and clone that to a separate ZFS file system, so we can move back whatever files we need to their original locations (Unfortunately, the extra cloning steps are necessary, as snapshots are not directly accessible and you also can't clone to an existing vdev! ):

host # zfs rollback zvdevs/vusers@backup
host # zfs clone zvdevs/vusers@backup zvdevs/vusers
cannot create 'zvdevs/vusers': dataset already exists <--- Didn't I just remind myself that I can't do this ;)
host # zfs clone zvdevs/vusers@backup zvdevs/vusers4
host # zfs list|grep zvdevs
zvdevs 200M 784M 29.5K /zvdevs
zvdevs/vusers 24.5K 200M 24.5K /zvdevs/vusers
zvdevs/vusers@backup 0 - 24.5K -
zvdevs/vusers2 24.5K 100M 24.5K /zvdevs/vusers2
zvdevs/vusers3 24.5K 100M 24.5K /zvdevs/vusers3
zvdevs/vusers4 0 784M 24.5K /zvdevs/vusers4

8. Another cool thing you can do is to rename your file systems, like this (note that any attached snapshots will be renamed as well):

host # zfs rename zvdevs/vusers4 zvdevs/garbage
host # zfs list|grep zvdevs
zvdevs 100M 884M 28.5K /zvdevs
zvdevs/garbage 24.5K 884M 24.5K /zvdevs/garbage
zvdevs/garbage@backup 0 - 24.5K -
zvdevs/vusers2 24.5K 100M 24.5K /zvdevs/vusers2
zvdevs/vusers3 24.5K 100M 24.5K /zvdevs/vusers3

9. You can also rename snapshots, if you don't want anybody (including yourself in a few months ;) to be able to easily tell what file system is a backup of what other file system, like this:

host # zfs rename zvdevs/garbage@backup zvdevs/garbage@rollbacksys
host # zfs list|grep zvdevs
zvdevs 100M 884M 28.5K /zvdevs
zvdevs/garbage 24.5K 884M 24.5K /zvdevs/garbage
zvdevs/garbage@rollbacksys 0 - 24.5K -
zvdevs/vusers2 24.5K 100M 24.5K /zvdevs/vusers2
zvdevs/vusers3 24.5K 100M 24.5K /zvdevs/vusers3

10. And, just in case you need to have all the information you could ever want about your ZFS file systems, you can "get" it "all" :

host # zfs get all zvdevs
NAME PROPERTY VALUE SOURCE
zvdevs type filesystem -
zvdevs creation Mon May 5 10:00 2008 -
zvdevs used 100M -
zvdevs available 884M -
zvdevs referenced 28.5K -
zvdevs compressratio 1.00x -
zvdevs mounted yes -
zvdevs quota none default
zvdevs reservation none default
zvdevs recordsize 128K default
zvdevs mountpoint /zvdevs default
zvdevs sharenfs off default
zvdevs checksum on default
zvdevs compression off default
zvdevs atime on default
zvdevs devices on default
zvdevs exec on default
zvdevs setuid on default
zvdevs readonly off default
zvdevs zoned off default
zvdevs snapdir hidden default
zvdevs aclmode groupmask default
zvdevs aclinherit secure default
zvdevs canmount on default
zvdevs shareiscsi off default
zvdevs xattr on default

11. It's better to send than to receive :) Maybe not... In any event, you can use the ZFS send and receive commands to send snapshots to other filesystems locally or remotely (much in the same way you can use the system subshell to move content using tar), like so:

host # zfs send zvdevs/vusers@garbage | ssh localhost zfs receive zvdev/newbackup
host # zfs list
host # zfs list|grep zvdevs
zvdevs 100M 884M 28.5K /zvdevs
zvdevs/garbage 24.5K 884M 24.5K /zvdevs/garbage
zvdevs/vusers@backup 0 - 24.5K -
zvdevs/vusers2 24.5K 100M 24.5K /zvdevs/vusers2
zvdevs/vusers3 24.5K 100M 24.5K /zvdevs/vusers3
zvdevs/newbackups 24.5K 100M 24.5K /zvdevs/newbackup

12. If you get nostalgic from time to time, or you need to figure out why something bad happened, you can use the ZFS filesystem history command, like so (Note that no history will be available after you destroy a pool -- I did that already, to zvdevs, so this output is for another storage pool on the same system):

# zpool history
History for 'datadg':
2008-02-27.20:25:32 zpool create -f -m legacy datadg c0t1d0
2008-02-27.20:27:57 zfs set mountpoint=legacy datadg
2008-02-27.20:27:58 zfs create -o mountpoint -o quota=5m datadg/data
2008-02-27.20:27:59 zfs create -V 20gb datadg/swap
2008-02-27.20:31:47 zfs create -o mountpoint -o quota=200m datadg/oracleclient

Cheers,

, Mike

linux unix internet technology

Wednesday, May 7, 2008

Maintenance And Usage Commands For ZFS On Solaris 10 Unix

Hey again,

Today, we're back with part two of what was going to be a three part series on working with ZFS and storage pools. Actually, this was originally going to be one post, but (luckily ?) it's grown into four gigantic ones ;) This one, and tomorrow's, are going to be the "big daddies" of the bunch.

Yesterday we looked at ZFS storage pool and file system creation and today we're going to move on to commands that we can use to manipulate those storage pools and file systems that we've made.

Please note, again, that for all commands where I specifically name a virtual device or storage pool, you can get a full listing of all available devices by simply not specifying any storage pool at all.

And, without a moment to spare, here come those maintenance/usage commands (please enjoy responsibly ;)

1. If you need to know as much as possible about your storage pools, you can use this command:

host # zpool status -v zvdevs
  pool: zvdevs
 state: ONLINE
 scrub: none requested
config:

        NAME        STATE     READ WRITE CKSUM
        zvdevs      ONLINE       0     0     0
          /vdev1    ONLINE       0     0     0
          /vdev2    ONLINE       0     0     0
          /vdev3    ONLINE       0     0     0

errors: No known data errors

2. In Solaris 10 storage pool management, you can also "online" and "offline" virtual devices. You might need to do this from time to time if you need to replace an "actual" device that may be faulty. Here's an example of offlining and then onlining a vdev. Note that, if you use the "-t" flag when offlining, the device will only be temporarily disabled. Normal offlining is persistent and the storage pool will maintain the vdev in an offline state even after a reboot:

host # zpool offline zvdevs /vdev2
Bringing device /vdev2 offline
host # zpool status -v zvdevs
pool: zvdevs
state: DEGRADED
status: One or more devices has been taken offline by the administrator.
Sufficient replicas exist for the pool to continue functioning in a
degraded state.
action: Online the device using 'zpool online' or replace the device with
'zpool replace'.
scrub: resilver completed with 0 errors on Mon May 5 10:05:33 2008
config:

NAME STATE READ WRITE CKSUM
zvdevs DEGRADED 0 0 0
mirror DEGRADED 0 0 0
/vdev1 ONLINE 0 0 0
/vdev2 OFFLINE 0 0 0

errors: No known data errors
host # zpool online zvdevs /vdev2
Bringing device /vdev2 online
host # zpool status -v zvdevs
pool: zvdevs
state: ONLINE
scrub: resilver completed with 0 errors on Mon May 5 10:18:34 2008
config:

NAME STATE READ WRITE CKSUM
zvdevs ONLINE 0 0 0
mirror ONLINE 0 0 0
/vdev1 ONLINE 0 0 0
/vdev2 ONLINE 0 0 0

errors: No known data errors

3. If you want to attach another disk to your storage pool mirror, it's just as simple. This process will create a simple mirror if you only have one device in your pool (???) or create a triplicate, quadruplicate, etc, mirror if you already have a simple mirror set up:

host # zpool attach zvdevs /vdev1 /vdev3 <--- Note that we're specifically saying we want to mirror /vdev1 and not /vdev2. It doesn't really matter, since they're both mirrors of each other, but you can't just attach a device without naming a device to mirror!
host # zpool status -v zvdevs
pool: zvdevs
state: ONLINE
scrub: resilver completed with 0 errors on Mon May 5 10:05:33 2008
config:

NAME STATE READ WRITE CKSUM
zvdevs ONLINE 0 0 0
mirror ONLINE 0 0 0
/vdev1 ONLINE 0 0 0
/vdev2 ONLINE 0 0 0
/vdev3 ONLINE 0 0 0

errors: No known data errors

5. For a little shell-game, if you ever need to replace a vdev in your storage pool (say, with a hot spare), you can do it easily, like this:

host # zpool add zvdevs spare /vdev3 <--- This may not be necessary, but I removed the spare and am re-adding it.
host # zpool replace zvdevs /vdev1 /vdev3
host # zpool status -v zvdevs
pool: zvdevs
state: ONLINE
scrub: resilver completed with 0 errors on Mon May 5 10:20:58 2008
config:

NAME STATE READ WRITE CKSUM
zvdevs ONLINE 0 0 0
mirror ONLINE 0 0 0
spare ONLINE 0 0 0
/vdev1 ONLINE 0 0 0
/vdev3 ONLINE 0 0 0
/vdev2 ONLINE 0 0 0
spares
/vdev3 INUSE currently in use

errors: No known data errors

6. If you suspect file system damage, you can "scrub" your storage pool. zpool will verify that everything is okay (if it is ;) and will auto-repair any problems on mirror or raid pools :)

host # zpool scrub zvdevs <--- Depending on how much disk you have and how full it is, this can take a while and chew up I/O cycles like nuts.

7. If you want to share storage pools between systems (real or virtual), you can "export" your storage pool like so (Note that this will make the storage pool not show up as being "owned" by your system anymore, although you can reimport it):

host # zpool list
NAME SIZE USED AVAIL CAP HEALTH ALTROOT
datadg 33.8G 191M 33.6G 0% ONLINE -
rootdg 9.75G 5.11G 4.64G 52% ONLINE -
zvdevs 1016M 127K 1016M 0% ONLINE -
host # zpool export zvdevs
host # zpool list
NAME SIZE USED AVAIL CAP HEALTH ALTROOT
datadg 33.8G 191M 33.6G 0% ONLINE -
rootdg 9.75G 5.11G 4.64G 52% ONLINE -

8. In order to "import" an exported filesystem, you just need to have the system permission to do so (being root in the global zone is the perfect place to be when you try this. Just be careful ;)

host # zpool list
NAME SIZE USED AVAIL CAP HEALTH ALTROOT
datadg 33.8G 191M 33.6G 0% ONLINE -
rootdg 9.75G 5.11G 4.64G 52% ONLINE -
host # zpool import -d / zvdevs
host # zpool list
NAME SIZE USED AVAIL CAP HEALTH ALTROOT
datadg 33.8G 191M 33.6G 0% ONLINE -
rootdg 9.75G 5.11G 4.64G 52% ONLINE -
zvdevs 1016M 92K 1016M 0% ONLINE -

You can run this command without -d (to specify the base directory of the storage pool) and zpool will search /dev/dsk for a place to import. In our case it won't find it, like this:

host # zpool import zvdevs
cannot import 'zvdevs': no such pool available

9. If you need to know what version of ZFS your system is using, you can use zpool's "upgrade" option. Don't worry. Without the proper flags, it just lets you know what version is running and some other information, like this:

host # zpool upgrade
This system is currently running ZFS version 4.

All pools are formatted using this version.

10. If you want to see what features your version of ZFS has, you can use the "upgrade" option with the -v flag. Everything is retro, so (in our case), since we're running version 4, we have all the capabilities of versions 3, 2 and 1 but not of versions 5 and higher (At the time of this post, ZFS is up to version 10):

host # zpool upgrade -v
This system is currently running ZFS version 4.

The following versions are supported:

VER DESCRIPTION
--- --------------------------------------------------------
1 Initial ZFS version
2 Ditto blocks (replicated metadata)
3 Hot spares and double parity RAID-Z
4 zpool history
...

Now, go and have fun with those commands :)

Until we meet again,

, Mike

linux unix internet technology

Tuesday, December 2, 2008

Wednesday, October 22, 2008

Tuesday, October 21, 2008

Thursday, October 16, 2008

Chapter 1 What'sNew in the Solaris 10 5/08 Release

System Administration Enhancements

Solaris Trusted Extensions Administrator Procedures

Flash Update Tool

PPD File Management Utility

Internet Printing Protocol Client-Side Support

Selectable Use of localhost forSolaris Print Server Database Hostname

Fault Management for T5140/T5240 Platforms

SunVTS 7.0

System Resource Enhancements

CPU Caps

projmod(1M) Option

Device Management Enhancements

Tape Self-Identification

x86: Enhanced Speedstep CPU Power Management

x86: PowerNow! CPU Performance Management

iSNS Support in the Solaris iSCSI Target

Security Enhancements

Solaris Trusted Extensions Supports Mounting LabeledFile Systems With the NFSv3 Protocol

SPARC: Hardware -Accelerated Elliptical CurveCryptography (ECC) Support

Networking Enhancements

Sockets Direct Protocol

inetd Backlog Queue Size

X11 Windowing Enhancements

Xvnc Server and Vncviewer Client

Desktop Tools Enhancements

StarOffice 8

Flash Player 9

Pidgin 2.0

PAPI Print Commands

System Performance Enhancements

64-bit SPARC: Memory Placement OptimizationSupport for sun4v Platforms

SPARC: Shared Contexts Support

x86: CPUID-Based Cache Hierarchy Awareness

Language Support Enhancements

Locale Creator

libchewing 0.3.0

File Encoding Examiner

Kernel Functions Enhancements

x86: MONITOR and MWAIT CPU Idle Loop

Driver Enhancements

x86: Support Sun Fire X4540 Disk Status Indicators

MPxIO Extension for Serial Attached SCSI Deviceson mpt(7D)

x86: SATA ATAPI Support in AHCI Driver

x86: AMD–8111

SATA NCQ Support in AHCI Driver

x86: bnx II Ethernet Driver

USB-to-Serial Driver for Keyspan Adapters

Freeware Enhancements

32-bit: pgAdmin III

p7zip

Friday, September 26, 2008

Friday, May 9, 2008

Thursday, May 8, 2008

Wednesday, May 7, 2008

Bookmark Us!

LXer - Linux News Feed

Linux And Unix Resources

Blog Archive

Top Post-Label Index

Chapter 1 What's
New in the Solaris 10 5/08 Release

Selectable Use of `localhost` for
Solaris Print Server Database Hostname

`projmod`(1M) Option

Solaris Trusted Extensions Supports Mounting Labeled
File Systems With the NFSv3 Protocol

SPARC: Hardware -Accelerated Elliptical Curve
Cryptography (ECC) Support

`inetd` Backlog Queue Size

64-bit SPARC: Memory Placement Optimization
Support for sun4v Platforms

MPxIO Extension for Serial Attached SCSI Devices
on `mpt`(7D)

x86: `bnx` II Ethernet Driver