2023/12/08
2023/12/02
2023/11/22
2023/11/19
proxmox 8 安裝後修正apt source 並更新
#!/bin/bash
sed -i '1s/^/#/' /etc/apt/sources.list.d/ceph.list
sed -i '1s/^/#/' /etc/apt/sources.list.d/pve-enterprise.list
echo "deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription" >> /etc/apt/sources.list
echo "export http_proxy=http://10.1.1.1:3128" > /root/update
echo "apt-get update" >> /root/update
echo "apt-get upgrade -y" >> /root/update
echo "apt-get autoremove -y --purge" >> /root/update
chmod +x /root/update
/root/update
2023/11/01
2023/10/14
最近nas因為更新發生nfs不能使用的問題
因此暫時把graylog搬到其他台還沒更新的nas上
搬完後發現ES變成red
下指令看一下是那些shards
curl -XGET localhost:9200/_cat/shards|grep UNASSIGNED
index.action 0 r UNASSIGNED
index.do 0 r UNASSIGNED
index.aspx 0 r UNASSIGNED
graylog_159 2 p UNASSIGNED
index.htm 0 r UNASSIGNED
index.py 0 r UNASSIGNED
index.php 0 r UNASSIGNED
index.cgi 0 r UNASSIGNED
index.html 0 r UNASSIGNED
index.cfm 0 r UNASSIGNED
index.pl 0 r UNASSIGNED
index.jsp 0 r UNASSIGNED
index.asp 0 r UNASSIGNED
2023/08/14
2023/08/05
2023/07/06
2023/07/05
2023/07/04
2023/06/12
2023/06/05
2023/05/24
2023/05/05
一直以來都會定時去 graylog 撈 資料
會使用到多個 OR 的下法
accept AND ( 192.168.33.238 OR 192.168.34.215 OR 192.168.33.43 OR 192.168.34.142 OR 192.168.54.247 OR 192.168.7.253 OR 192.168.26.237 OR 192.168.26.228 OR 192.168.25.211 OR 192.168.25.206 OR 192.168.25.117 OR 192.168.26.104 OR 192.168.25.183 OR 192.168.31.241 OR 192.168.30.112 OR 192.168.30.80 OR 192.168.29.6 OR 192.168.29.3 OR 192.168.30.60 OR 192.168.30.58 OR 192.168.29.143 OR 192.168.30.57 OR 192.168.29.223 OR 192.168.29.164 OR 192.168.29.84 OR 192.168.30.200 OR 192.168.30.32 OR 192.168.29.29 OR 192.168.29.199 OR 192.168.29.205 OR 192.168.29.210 OR 192.168.29.200 OR 192.168.29.234 OR 192.168.30.220 OR 192.168.30.194 OR 192.168.29.83 OR 192.168.29.4 OR 192.168.30.108 OR 192.168.29.177 OR 192.168.29.107 OR 192.168.29.32 OR 192.168.30.33 OR 192.168.30.173 OR 192.168.30.247 OR 192.168.30.122 OR 192.168.30.55 OR 192.168.29.19 OR 192.168.29.10 OR 192.168.30.123 OR 192.168.30.201 OR 192.168.29.253 OR 192.168.30.85 OR 192.168.29.48 OR 192.168.30.37 OR 192.168.30.66 OR 192.168.9.100 OR 192.168.30.163 OR 192.168.30.114 OR 192.168.30.59 OR 192.168.30.199 OR 192.168.30.227 OR 192.168.30.41 OR 192.168.29.246 OR 192.168.29.161 OR 192.168.74.248 OR 192.168.74.12 OR 192.168.10.111 OR 192.168.10.104 OR 192.168.50.154 OR 192.168.52.1 OR 192.168.52.3 OR 192.168.50.243 OR 192.168.50.220 OR 192.168.50.179 OR 192.168.50.99 OR 192.168.50.138 OR 192.168.50.98 OR 192.168.50.182 OR 192.168.50.206 OR 192.168.50.234 )
但今天使用同樣的語法
While retrieving data for this widget, the following error(s) occurred:
OpenSearch exception [type=too_many_nested_clauses, reason=Query contains too many nested clauses; maxClauseCount is set to 1024].
問了bing
要修改 /etc/opensearch/opensearch.yml
加上
indices.query.bool.max_clause_count: 10240
2023/05/03
2023/04/21
2023/04/20
2023/04/14
為了因應centos 7 EOS
今天在轉移程式到 almalinux 9 時 mutt 一直無法寄信
mail server 的log如下
Apr 14 10:09:09 mail postfix/smtpd[523701]: connect from unknown[10.0.0.1]
Apr 14 10:09:09 mail postfix/smtpd[523701]: lost connection after STARTTLS from unknown[10.0.0.1]
看來almalinux 9的mutt 預設會使用 STARTTLS
在 .muttrc 加上以下這行
set ssl_force_tls = no
目前寄信正常了
2023/04/09
2023/03/02
使用curl 撈取 loki 資料的語法
依需求需要更改之處
job="abc"
查詢的關鍵字 192.168.1.2
查詢的區間
curl -G -s "http://10.0.0.1:3100/loki/api/v1/query_range" --data-urlencode 'query={job="abc"} |~ "192.168.1.2"' --data-urlencode "start=$(date -u +'%Y-%m-%dT%H:%M:%SZ' -d '-8 hour')" --data-urlencode "end=$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
curl -G -s "http://10.0.0.1:3100/loki/api/v1/query_range" --data-urlencode 'query={job="abc"} |~ "192.168.1.2"' --data-urlencode "start=$(date -u +'%Y-%m-%dT%H:%M:%SZ' -d '-7 day')" --data-urlencode "end=$(date -u +'%Y-%m-%dT%H:%M:%SZ')"|jq
2023/02/28
今天早上三點多開始收到ntopng的告警
進主几看了一下 process不見了
重開也沒用
看了一下log
ntopng果然有更新
更新後起不來
接下來看ntopng的log
發現本次更新後必須使用到 libbpf.so.0
Feb 28 08:09:17 W-ntopng-ubuntu-2004 ntopng[3247]: /usr/bin/ntopng: error while loading shared libraries: libbpf.so.0: cannot open shared object file: No such file or directory
Feb 28 08:09:22 W-ntopng-ubuntu-2004 ntopng[3272]: /usr/bin/ntopng: error while loading shared libraries: libbpf.so.0: cannot open shared object file: No such file or directory
Feb 28 08:09:28 W-ntopng-ubuntu-2004 ntopng[3294]: /usr/bin/ntopng: error while loading shared libraries: libbpf.so.0: cannot open shared object file: No such file or directory
apt install libbpf0
目前正常了 再觀察看看
2023/02/22
2023/02/13
今天早上要進ntop管理介面的時候
打完帳號密碼登不進去
進os看了一下HD滿了
然後再看log
出現一堆如下的訊息 把HD塞爆了
Feb 13 08:14:29 W-ntopng ntopng[286]: 13/Feb/2023 08:14:29 [SQLiteAlertStore.cpp:151] ERROR: SQL Error: database disk image is malformed
Feb 13 08:14:29 W-ntopng ntopng[286]: INSERT INTO flow_alerts (alert_id, interface_id, tstamp, tstamp_end, severity, ip_version, cli_ip, srv_ip, cli_port, srv_port, vlan_id, is_cli_attacker, is_cli_victim, is_srv_attacker, is_srv_victim, proto, l7_proto, l7_master_proto, l7_cat, cli_name, srv_name, cli_country, srv_country, cli_blacklisted, srv_blacklisted, cli_location, srv_location, cli2srv_bytes, srv2cli_bytes, cli2srv_pkts, srv2cli_pkts, first_seen, community_id, score, flow_risk_bitmap, alerts_map, cli_host_pool_id, srv_host_pool_id, cli_network, srv_network, probe_ip, input_snmp, output_snmp, json, info) VALUES (26, 3, 1676247257, 1676247266, 3, 4, '192.168.40.66', '192.168.0.65', 44983, 80, 0, 0, 0, 0, 0, 6, 7, 0, 5, '', '', '', '', 0, 0, 0, 0, 126, 120, 2, 2, 1676247257, '1:rj5vzKw7WQX8TONTQ++bh3BkBh8=', 10, 70368744177664, X'04000000', 0, 0, 65535, 65535, '0.0.0.0', 0, 0, '{"ntopng.key":12345678,"hash_entry_id":23456789,"alert_generation": {"script_key":"ndpi_unidirectional_traffic","subdir":"flow","flow_risk_info":"{\"46\":\"No client to server traffic\"}"},"proto": {"http": {},"confidence":0}}', '');
google了一下是 sqllite 因為斷電導致有問題
果然
斷一次電事情一堆
看是有recovery sqlite的方法
算了
直接倒回事發前一天晚上的備分好了
倒回後目前正常
再觀察看看
https://blog.csdn.net/wolfking0608/article/details/71076588
2023/02/11
2023/02/08
2023/02/07
2023/02/04
2023/02/03
2023/01/10
前一陣子發生了一件很OX的事
試了很久 現在做個記錄
因為有幫別的部門架了一台proxmox
而且那個部門也有一台nas
因此我就在那台nas上開了nfs然後用pbs備份
他老兄在某一天竟然進到nas把我備分用的那個nfs裡的資料砍了
然後第二天就出現了如下的error
ProxmoxBackup Server 2.3-2
2022-12-29T00:00:00+08:00: starting garbage collection on store nfs418
2022-12-29T00:00:00+08:00: task triggered by schedule 'daily'
2022-12-29T00:00:00+08:00: Start GC phase1 (mark used chunks)
2022-12-29T00:01:03+08:00: marked 5% (1 of 17 index files)
2022-12-29T00:04:14+08:00: marked 11% (2 of 17 index files)
2022-12-29T00:04:14+08:00: WARN: warning: unable to access non-existent chunk c3fe251560dcd2cc5aef7cfbd6669d0dd9ca7491c455f537efc6d319b09892ec, required by "/mnt/nfs418/vm/108/2022-12-27T15:45:38Z/drive-virtio0.img.fidx"
2022-12-29T00:04:14+08:00: WARN: warning: unable to access non-existent chunk 6dc29793341c20c7c80910a73893501b034a0e29c14a444d214d835ccffc0d16, required by "/mnt/nfs418/vm/108/2022-12-27T15:45:38Z/drive-virtio0.img.fidx"
2022-12-29T00:04:14+08:00: WARN: warning: unable to access non-existent chunk 1f81c244f9b7816ab37d3ef7ffdcd10443eb1bddb3fa44e036186b73f1fee33a, required by "/mnt/nfs418/vm/108/2022-12-27T15:45:38Z/drive-virtio0.img.fidx"
2022-12-29T00:04:14+08:00: WARN: warning: unable to access non-existent chunk 95c7e6747d43b5b516e1768a1f258f352aeb47b23fd46575440dc3d820d1b253, required by "/mnt/nfs418/vm/108/2022-12-27T15:45:38Z/drive-virtio0.img.fidx"
2022-12-29T00:04:14+08:00: WARN: warning: unable to access non-existent chunk 9513a7e5c650245d3344115115b21285cc8f426e5284fa04159ea96e49856535, required by "/mnt/nfs418/vm/108/2022-12-27T15:45:38Z/drive-virtio0.img.fidx"
2022-12-29T00:04:14+08:00: WARN: warning: unable to access non-existent chunk 68b2b40dd3bacba9e649c67862011934bc7f048d8ea2d35fbd95c39f9d5cf7c4, required by "/mnt/nfs418/vm/108/2022-12-27T15:45:38Z/drive-virtio0.img.fidx"
2022-12-29T00:04:14+08:00: WARN: warning: unable to access non-existent chunk 494608d49f57039fd7a8378e1a2a2cf6bb0688773a525addc2f54507a94cd11d, required by "/mnt/nfs418/vm/108/2022-12-27T15:45:38Z/drive-virtio0.img.fidx"
2022-12-29T00:04:14+08:00: WARN: warning: unable to access non-existent chunk 09eab384d5f3cbf657db1c0750ef52be2f1dbdf134f977a24dc095382b6e25ed, required by "/mnt/nfs418/vm/108/2022-12-27T15:45:38Z/drive-virtio0.img.fidx"
2022-12-29T00:04:14+08:00: WARN: warning: unable to access non-existent chunk 9c1208d43242276c75a4f65f41054e4bc0e7e1144a61c951902bb8df94f055c9, required by "/mnt/nfs418/vm/108/2022-12-27T15:45:38Z/drive-virtio0.img.fidx"
..........................................
後面還一大堆
本來是想說把pbs上的datastore砍了重建應該可以解決問題
forum上也是醬說的
結果不是
我砍了datastore重建
甚至在nas上再開另一個nfs後再重建datastore
過沒几天又會出現如上的錯誤
最後的解決方法是直接重裝一台新的pbs
問題才解決
無言中