Brian's Blog

Click the image for the full size view.

Well, I've finally finished my huge, and largely annoying, "MCSA/MCSE Self-Paced Training Kit (Exams 70-292 and 70-296): Upgrading Your Certification to Microsoft Windows Server 2003" book. I've posted multiple times on my dislike for it so I won't go into it again. I'm just hoping that it gave me some good info that I can possibly recall during an exam. I believe it presented all the pertinent data, it just was very light on the review questions and even lighter on answer explanations. In other words, I need some reinforcement to bring up my confidence before I pay money to take a test. For this I'm falling back on the Exam Cram 2 series, which I had used as review material in the past. The nice thing about these books is there are about 10 questions at the end of each chapter with an answer key that gives the right answer along with an explanation on why the answer is correct. Additionally, it explains why the other answers are wrong. And the two 50 question practice exams in the back are very useful for figuring out what your weaknesses are.

Hopefully I'll be seeing the light at the end of the tunnel soon as get these exams out of my way. I'll only take them when I feel I'm ready and not a day sooner. No sense in giving my money to Microsoft for nothing.

Everyone who knows me knows I'm studying to upgrade my MCSE Cert for work. I've been slowly chugging along in getting ready for my two exams and have ranted several times over various things that are just plane stupid in this book. All of my previous rants can be pretty much blamed on the author(s) and the editor(s). However, I've just come up with one that is squarely a Microsoft issue.

The problem is that I've hit the section regarding the Manage software update infrastructure objective in the 70-292 exam in which it talkes in the book about Microsoft's Software Update Services (SUS). Well, SUS has since been replaced with Windows Software Update Services (WSUS) and in fact all support for SUS will stop at the end of the year. It will literally stop working forcing everyone to use WSUS. That's not a big deal, but What the hell am I supposed to study for?!

I've checked the Microsoft Press section for the book I'm using for an errata which doesn't seem to exist so it seems they haven't updated their text. Or perhaps they just don't care to update it? I've searched on various forums only to get the impression that they are still testing for SUS, but that's just an impression and nothing I could take as a solid answer. So, at this point, assuming they are going to test me on something that won't work in a few months I went to download the older version of SUS only to be redirected to a download for WSUS.

At this point I have no solid answers on what I am going to be tested for. And if it is still SUS then I have no way of actually using it before the exam forcing me to simply read, look at screen shots, and hope I don't get to many questions on it. Or, if the test is on WSUS then I have no official study material to prep for this thing. Which means I'll just have to grab a white paper, install it, and hope I accidentally teach myself the specific bits they are going to test me on.

I find this utterly ridiculous. If they want to test me on old unsupported technology then that's their stupid decision. I'd much rather spend my time learning something I'll actually use at work. Ultimately, I really don't care one way or another what they test me on so long as I know what the hell I need to learn. I just want to get the exams over with so I can get back to learning more stimulating things (aka something not Microsoft).

Yippie! Another drive just failed! So much for having a weekend...

I wonder if they will deliver the drive correctly this time or if I'l have to wait 13 hours for my 4 hour drive delivery again?

I know it's been ages since I've posted. But I have to bitch a bit about this one. At work we have a nice big RAID5 make up of 11 + 1 Hot-spare 250GB SATA drives. Since my return to IQE roughly 3 months ago we have had 5 of these drives fail. Usually it's no big deal because we have a 4 hour response time 24/7 contract for service. Well, one of the drives failed last night and it fell over to the hot-spare as it should do. So, when I came in this morning I got on the phone with HP and they shipped out a replacement drive. This was about 10AM or so once everything was set. So, come around 3:30PM I noticed I still didn't have a drive. I got back on the horn with HP wondering where my drive is and while talking to them a 2nd drive fails! Now I have an array operating in a degraded state. If just one more drive fails then the array is lost.

Anyway, it turned out that HP (or whoever they had deliver the drive) delivered it to "someplace" and they really didn't know where that was exactly. But the did have a signature from some person with the last name of "Lersh". No one of that name works here, or in the building next to us. Great.

Now HP is sending two more drives along with an engineer to make sure they get here. The crappy thing is I need to stick around until they come. I could probably leave and have him call my mobile but I don't want to take a chance at missing him.

All around it's been a bad week. But this just annoys me. If someone hadn't messed up I'd have an array with just one failed drive which is a heck of a lot better than the state it is currently in.

I know this isn't the most interesting post ever but other geeks who read this will understand I'm sure.

Anyway, time to wait for my drives and hope drive number 3 doesn't fail before the new ones get here. At the rate they've been dieing I'm a bit nervous.

I just finished out my first two days back at IQE. It's been a pleasant start back at the old place with many familiar faces along with many new ones. It has been impossible to walk down the hall without a handshake and a "Welcome back Brian!" comment or two. On Friday their was a company picnic for the holiday weekend which was a nice chance to play catch up with everyone. It's amazing how much things stay the same even after nearly 3.5 years away. Still, for as much that has stayed the same much as also changed seemingly for the better.

Next week I'll be the only IT guy in the house though which should be interesting since I'm still getting caught up on the systems. It shouldn't be to bad though.

On an unrelated note I just got notice that my repaired iAudio has shipped! I should see it hopefully next week.

As far as Christmas celebrations go this year was typical for us. Two fun and exhausting days where the kids get overloaded with excitement and my wife and I get less sleep that we would have on a typical day during the work week. All in all it was a good time with family and the presents were mostly practical for the adults which is what I wanted anyway.

My extra fun was on Dec 23rd just before the holiday weekend. I was thinking it was going to be a nice easy day. I was scheduled to install a new PC for someone around 10AM but instead was redirected to one of our largest customers, a multi-branch local bank. There really isn't much to the story to be told really but keep in mind that even though it's short it was highly stress inducing.

The problem specifically was that every branch was cut off from the main branch. Meaning they could not access any of their files located on the server there. Nor could their database function without the links being up 100%. The odd thing though was that I could access the Internet, ping all the servers across the VPN for all the other branches, and even PCAnywhere to them. What I couldn't do was access a SMB share or see anything other than local LAN systems in the browse list. It would have made 100% perfect sense if I couldn't ping, PCAnywhere, etc but this seemed to target just SMB related things. We had a case open with Microsoft support recently for an issue that was close enough that I could get help without started a new case so I called them up and we checked out the server. It turned out that, for some odd reason, ports 135, 139, and 445 were being blocked and it appeared that Windows wasn't the culprit this time. More detective work showed me that this was the case at all branches that used Choice One as their managed VPN provider but thing were perfectly fine at branches that didn't use Choice One. The next step was clear, and that was to call Choice One up and see what the heck was going on.

Once I slogged through the menus and got an actual person (located in the USA no less!) he didn't see anything wrong, no open tickets, no troubles reported, and no notes related to recent security related changes. Still, I had already proven that I couldn't telnet to any of the SMB related ports, and Windows looked OK so I asked him to check the ports instead of trusting the account notes. Besides, if the OS was the problem we would likely have had local problems as well and been only limited to effected servers. He opened up the ports and in a flash things were working as before.

It turns out that over the past few months Choice One had been closing off the SMB related ports for their clients on externally accessible addresses to combat the spread of viruses. It seems someone took it upon him/herself to close off these ports on the banks VPN stopping it on the internal side and then didn't make any notes in the case related to it. And in doing so managed in a few moments to bring every branch to a halt.

Really, it was such a simple problem at the root of it all, but it took on the order of 5 hours to pin point he problem, get it fixed and then tested. All the while having the manager freaking out and thinking it was some how our fault. Anyway, at least it worked out. The bank was up by the end of the day and it wasn't caused by anything we or anyone at the bank did wrong. Even so, thanks goes to Choice One for poor documentation, lack of procedure, and inducing a mountain of stress just prior to a holiday due to some individuals incompetence.

One of the things that I've gotten used to in Windows is the nice Hibernate feature. I like to just close my laptop and have it suspend to disk then quickly resume. I'll do this several times a day during my work. I figured, if Windows can do it, then Linux should be able to do it better right?

Well, it wasn't exactly easy but it built on what I learned messing with ACPI as I talk about in my last post. First of all, there really isn't any specific documentation for Slackware when it comes to suspend to disk that I could find. But, I found some info on Gentoo, Debian, and Fedora which was useful. Now it turns out that in the 2.6.13 kernel (and possible older ones I don't know) that there is already a suspend to disk feature right under power management in your menuconfig. I gave that a shot and lets just say it doesn't play well with my Thinkpad. Basically I can suspend it but it never comes back. It tries to resume but then locks.

Some more research pointed me to a project called Software Suspend 2 for Linux that actually works. Basically it consists of a kernel patch for the vanilla 2.6.13 kernel and a hibernate script. Both the patch and the support scripts are super easy to install. The documentation and the FAQ are really nice on their site. Once you compile the kernel with suspend2 enabled you can either suspend to a file or to swap space. To resume you just add an option to your lilo.conf or your grub menu.lst file to tell the kernel where you expect a suspend file or partition. Then all you have to do it type hibernate and it will suspend to disk. They even have a tip on how to setup sudo so you can hibernate without being root which lets you use it in something like Klaptop to hibernate the system when the batter gets critically low.

This is all well and good but I want to set this up so that it will hibernate when i close the lid of the laptop regardless of if I'm in KDE or at the console. Oh, and make sure not to use the hibernate function of Klaptop with suspend2. It corrupted my drive so bad I had to reinstall. I'm thinking it may have been something I did wrong in the hibernate.conf file but since I'm not planning on using klaptop to take care of the lid I didn't look into it.

Anyway, I figured acpid would be the way to go to catch the lid button event and have it run hibernate for me. Watching /var/log/acpid gave me a event called "button/lid LID 00000080 00000001" but I found out the hard way that it actually counts up such that the last bit of it changes. Pressing the button counts as an event as well as releasing it. So I couldn't just check for the entire thing. Also, I needed to make it only suspend on every other event. Otherwise it would suspend on the lid button press and would then suspend again right after the resume when it would get the lid button release. The suspend2 FAQ had the answer. Here is what worked for me:

event=button[/]lid LID.*[13579bdf]$
action=/usr/local/sbin/hibernate

I just stuck that in a file in the /etc/acpid/events directory along with my other events and issued a /etc/rc.d/rc.acpid restart and now the laptop suspends to disk perfectly every time I close the lid. As a point of interest I initially made the event expression to be event=button[/]lid LID.*[02468ace]$ which had the odd effect of only suspending the system when opened the lid.

One word of advice, if you try to set this up manually like I did rather than relying on your distro to set it up for you then do it on a test system. It seems that once you get it tweaked and working it works fine, but one mess up while learning it can irreversibly corrupt your file system. On, and one other thing of to note, read the section of the How to Avoid Data Loss section of the HOWTO if you mount a Windows partition to avoid killing your fat vfat or msdos partitions.

The other thing I did that was much easier than figuring out all this ACPI and suspend to disk stuff was figure out how to hot swap my drive bay so I can switch between my floppy and my CD-ROM without having to reboot. The utility to use is called Khotswap that sits in your system tray in KDE. The author also has a Gnome applet for it and it has a command line only version of itself just called hotswap and an X generic one called xhotswap.

So, at this point I'm well on my way to getting the foundation of the laptop done in Slackware enough to start thinking of setting up the rest to use for day to day work. I know, I could have used another distro and had much of this stuff work right out of the box. I hear Ubuntu is very good at this. But if I did that where would the challenge be and what would I learn in the process?

Well, I've decided to go with Slackware for the laptop mostly because it's what I know. So, Slackware being what it is I had to take matters into my own hands and configure some of the more ugly things that may be done for you in other distributions. In this case it was ACPI and CPU Frequency Throttling (Speedstep). I don't know for sure if this stuff just works on another distro as I didn't try. What can I say, it's hard to break the Slack habit. ;)

The laptop in question is an IBM Thinkpad T30 and according to Google it is well supported in Linux (mostly). I went and installed Slackware 10.2 and most everything worked right out of the box like sound, wireless LAN, and APM. APM worked fine except that I didn't see any support for the Thinkpad buttons and saw that the kernel had a module just for Thinkpads in ACPI. Rather than figure out just what modules I needed to modprobe in I just compiled the things right into the kernel since I can't think of any time I'd not want them there. That worked well, the sleep button worked and when I closed the laptop lid the system went to sleep.

I did notice though that when I was on batter i was only getting about 40 minutes of run time when I was getting about 1.5 hours in Windows. So then it was onto learning how to throttle the CPU speed. Now, this was a pain in the rump. I had the modules I needed loaded and no matter what I did Klaptop wouldn't change the CPU speed when going from between battery and AC. I even compiled all the modules directly into the kernel to see if it helped. No go. I could change the speed manually but not automatically.

It turns out that after some research I learned that this model only supports two speeds of CPU. One at 1.8GHz and the other at 1.2GHz. Klaptop wanted to throttle based on percentage. For some odd reason I could set the percentage manually and it seemed to make a difference in performance but it just wouldn't do it automatically.

So, as far as CPU frequency throttling it can be by a userspace program or by the kernel itself. Klaptop is a userspace program and since that wasn't working I decided to try out letting the kernel do it. I compiled in speedstep-ich and the ondemand governor. The idea is that the ondemand Governor will watch your current CPU needs and adjust the speed accordingly. To get this working all you have to do is make sure the ondemend module and the speedstep module is loaded (or compiled into the kernel) and then echo -n ondemand > /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor and supposedly it will "just work". For some reason when I echo ondemand into scaling_governor it doesn't take and just stays as userspace. I haven't put much effort into figuring out the why since I'm a bit tired of playing with this. I did figure out that I could manually echo either 1200000 or 1800000 into /sys/devices/system/cpu/cpu0/cpufreq/scaling_setspeed and it would work. But how to make it do this automatically?

All I did was kept and eye on /var/log/acpid with tail -f and unplugged the AC adapter and plugged it back in a few times. In my case every time I plugged in the adapter it generated an ACPI event called "ac_adapter AC 00000080 00000001" and when I unplugged it a "ac_adapter AC 00000080 00000000" event was generated. All I had to do was create two scripts in /etc/acpi. One of the scripts I called on_battery.sh and it contains:

# Sets the CPU to 1.2 GHz when on battery
#
echo -n 1200000 > /sys/devices/system/cpu/cpu0/cpufreq/scaling_setspeed
#
# Set Hard Drive sleep to 5 minutes
hdparm -S 60 /dev/hda

And the other one called ac_cpu.sh contains:

# Sets the CPU to 1.8 GHz when on wall AC
#
echo -n 1800000 > /sys/devices/system/cpu/cpu0/cpufreq/scaling_setspeed
#
# Set hard drive sleep time to 20 minutes
hdparm -S 240 /dev/hda

I made them executable then went into /etc/acpi/events and created two new files to catch and then run the script to make the CPU frequency change. The two files can be called pretty much anything as far as I can tell as long as they aren't hidden files. I called one ac_cpu and the other onbattery_cpu. ac_cpu contains:

event=ac_adapter AC 00000080 00000001
action=/etc/acpi/ac_cpu.sh

and onbattery_cpu contains:

event=ac_adapter AC 00000080 00000000
action=/etc/acpi/onbattery_cpu.sh

Finally I had to restart acpid with /etc/rc.d/rc.acpid restart and it worked! Now I can get about 1.5 hours out of a full charge instead of 30-45 minutes. And I can put other commands into the scripts to do other things when the state changes. You can see I already have hdparm to tweak my sleep times.

Today the 60GB hard drive for my laptop arrived at work. I've been wanting to dual boot with Linux on it for some time but the 15GB drive wasn't enough to give either Windows or Linux enough space and still be able to hold my work files. So I was faced with a choice of going cold turkey to Linux which I didn't want to do since I need to actually get work done on it. With the extra space I can make the change gradually like I did at home giving me time to work out any oddness that may crop up. I'm thinking it will go much more smoothly this time since I've already been using Linux for a couple of years but I'm a little nervous since I've never setup any Linux distro on a laptop.

This brings up one big question though. What distro to try first?

In a nice change from the norm at work I've actually had a few fun, and not mundane projects to work on. As I've blogged about before the typical day consists of cleaning up after hapless Windows users who just can't seem to learn to not click on every attachment they get from people who they don't know. Or that still insist on using IE, even though it still has old unpatched vulnerabilities that allow for Drive-By-Downloads of spyware and hijacks. Or my personal favorite, "What do you mean I have to update my anti-virus!?"

A couple of weeks ago I managed an upgrade of a small domain from Windows 2000 Server to Windows Server 2003 and also setup Exchange 2003 for them. Plus there were about 10 of the users who got new Palms. All around it was a nice departure from the norm. Today's fun was to get a small network into a much larger one. As in, a smaller company was purchased by a much larger one. And they didn't want to setup a trust so we got to rip down the entire old domain and then then dcpromo the server into the new one.

Anyway, I hope we keep getting projects like this stuff. Cleaning up messed up computers all the time gets boring fast.

<rant>

I can sure feel for this fellow. This is exactly what I go through I'd say at least twice a month at work.

At the least the guy he worked with seems to have known what files to backup. The majority of the people who bring us computers have no clue where the hell they just saved their files. Usually I ask them about My Documents and they ask me what that is. It's an icon on the freakin' desktop! How can they miss it! The best fun with this is the files could be anywhere. I've seen systems where some files were saved in C:\Program Files\Microsoft Office, some On the desktop, and any of other places, usually not in My Documents where they are supposed to go. And, incidental, M$ Office is supposed to default to for it's save location.

Another favorite:

Brian: So, before I wipe your system, can you tell me what files you'd like backed up?

1user: What do you mean what files?

Yes, I've actually been asked that. Then they say I can't lose any files or their lives will be over.

If they were so darn important you'd think they'd know what they are, and where they are located. Oh, and maybe do something original and actually back the things up. *sigh*

</rant>

Sorry, just had to rant that out of my system. I feel much better now.

Well, we've been in the new office building for a few weeks now and I thought I'd share a picture. This one is out the back of the office, which is on the second floor. Makes me want to bust out the fishing pole and say the hell with computers for a while! I only took 3 others since I was supposed to be working and they are, of course, in the photo gallery.

Today's project was to setup a PC at Lafayette College in Easton PA to access a remote database via Terminal Services. I was figuring I'd be setting it up on a PC but ended up in a room full of Mac systems running OS X which caused me to learn one useful thing. Microsoft actually has a version of the Remote Desktop Connection for Macintosh which was super easy to install and worked perfectly (which is odd for a Microsoft product on any platform). Not surprisingly I was doing the exact same configuration on a PC later and it took 2 hours to get working what took 30 minutes on the Mac.

Anyway, while I was there I was instructed by the person I was meeting about this on where to go and where to park my car. It is a college campus after all and I always find them confusing to get around in. The parking lot I entered didn't have any signs warning against parking that I noticed. And besides, I'd think the administrative person I was meeting would know where I can and can't park.

So, I get out to my car and find a parking ticket from "The Office of Public Safety" telling me that I owe the college $245 for parking where I was told to park. $245 for a freakin' parking ticket?! I would have been better off finding a metered parking area and letting the time run out. But I guess this poor, under-payed, college has to make up the money somehow from the ultra low tuition they charge.

While I was standing there messing myself over the ticket cost I decided to read the back which is entitled "Visitors", which says:

Lafayette's faculty, staff and students must register their vehicles, display registration stickers and park in assigned areas. The Public Safety staff cannon distinguish between a visitor's vehicle and an unregistered vehicle without a sticker.

If you are a visitor to Lafayette, please return your ticket in person or by mail to the Office of Public Safety, Marguis Hall, Lafayette College, Easton, PA 18042-1768 within seven (7) day in order that the ticket stub be cleared. An explanation of the nature of your visit should be noted below. (If there is no response in seven (7) day, a check on the vehicle registration may be made.)

So, rather than warning you and directing you to something like a visitor's parking lot they just ticket everything the see and figure they'll work it out later. Why not have a time limit? As in, you can park here for two hours like they did at the University of Scranton where my wife went to school? They had signs all over the place letting you know where you can and can't park and for how long.

I wonder how many signs Lafayette could have bought with the salary of the fellow that patrols the parking lots all day tagging vehicles that are there on legitimate business?

The past couple of weeks have been "interesting". Interesting in that I've spent so much time shaking my head in disbelief. I've mentioned that I think my work has been reduced to cleaning Viruses and Spyware from Windows PC's. I think that's true to some degree but these idiots who keep bringing in their PC's without any Antivirus software on it for me to fix are driving me insane. I mean, if you choose to run that giant petri dish that Microsoft passes off for an OS and not run Antivirus you are just asking for it. To me its kind of like spending a week at a brothel without a box of condoms, then wondering why it burns when you pee. Really, there is no excuse. Especially when you can grab Norton Antivirus 2005 for something like $50 or download AVG from Grisoft which is free for home use. Today was a particularly bad one. I had to disinfect a PC and found 6318 instances of just Netsky. Then, I was asked, "Is it bad to not have Antivirus"? Then there was spyware on top of that too. Sometimes I wonder why people don't show more interest in Linux or Mac.

I made an attempt to learn something about udev last night. I'm running Slackware Linux 10.1 which doesn't have udev by default yet. My 2.6.10 kernel is home grown and should be setup correctly so I grabbed the udev slackpack with swaret. I didn't even get as far as learning the rules or setting custom permissions because, for some reason, it just decided to not see my DVD/CD-RW which is on hdc. There was also other very odd weirdness that I can't explain, such as su stopped working, and I couldn't open an xterm or aterm. I'm guessing it's because the tty devices weren't setup right. Which tells me I'm missing something in my home grown kernel. Perhaps I'll just use the stock 2.6.10 kernel which should hopefully work. I can't say I really need udev since things work 100% on my system now, but I'd like to at least know something about it.

Not that I need any more computer books, but I decided to order up a copy of Knoppix Hacks which looks like a good book and has gotten killer reviews on Amazon. I took a look at the table of contents at Borders this weekend and it looks chock full of ways to use Knoppix to bail out Windows. Which is my primary use of Knoppix anyway. Maybe one of these days I'll actually read a novel or something instead of a technical manual.