How to test pacemaker to create a Virtual IP for LB purpose for 3 nodes

sometimes, you need have more than one LBs for HA purpose.  and we always want to have one floatip virual IP cross all LB nodes. and we can use pacepaker/corosyncd to do this very easily.  for the testing purpose, I will use Vagrant to create 3 nodes (node1, node2, node3). once booted up , all 3 machine are well figured for hostname.

nodeone= 'node1'
nodetwo= 'node2'
nodethree= 'node3'

Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
####  node 1###########
                 config.vm.define :"node1" do |node1|
                        node1.vm.box = BOX
                        node1.vm.box_url = BOX_URL
                        node1.vm.network :private_network, ip: "192.168.2.101"
                        node1.vm.hostname = nodeone
                        node1.vm.synced_folder ".", "/vagrant", disabled: true
               node1.ssh.shell = "bash -c 'BASH_ENV=/etc/profile exec bash'"
                        node1.vm.provision "shell", path: "post-deploy.sh" ,run: "always"
                        node1.vm.provider "virtualbox" do |v|
                                v.customize ["modifyvm", :id, "--memory", "1300"]
                                v.name = nodeone
                    v.gui = true
                        end
                end

and post-deploy.sh
#!/bin/bash
value=$( grep -ic "entry" /etc/hosts )
if [ $value -eq 0 ]
then
echo "
################ hosts entry ############
192.168.2.101 node1
192.168.2.102 node2
192.168.2.103 node3
######################################################
" >> /etc/hosts
fi

once done, you can call vagrant up node1 node2 node3 to have 3 VMs ready.

now vagran ssh all nodes  to install the dependencies.

yum install -y pcsd pacemaker corosync

after done, enable all daemon to start automatically.
systemctl enable pcsd
systemctl enable pacemaker
systemctl enable corosync
//disable firewalld
systemctl disable firewalld

Now time to configure the corosync for nodes topology.

you can just copy the /etc/corosync/corosync.conf.example to /etc/corosync/corosync.conf
just change your ip and quorum settings (by dfault it use mcast to maintain the cluster membership)

then create a user named haclusteruser among 3 nodes

echo you_special_compliceted_password|passwd --stdin haclusteruser

once done, you can call pcs cluster auth to authorize eacy host using the shared credential
pcs cluster auth node1

after this. start the corosync and pacemaker on all nodes.

run crm_mon to see all the nodes

now we can create a floating vip to HA purpose.
pcs  resource create VIP2 IPaddr2 ip=192.168.2.100 cidr_netmask=32 nic=enp0s8 op monitor interval=30s

after that, you might see the status is always stopped. we need to disable the stonith
pcs  property set stonith-enabled=false

try the check again for the status, the VIP is bound to one node (node1 here)

to test the HA, shutdown node1. and run crm_mon again, the VIP was assigned on node2

How to locate Magento credit card leakge

Just got a chance to help locate the leaking issues of a customer who got complaints from customer about credit card leak after made purchase.

and it turns out to be a very smart hacker. here is the steps I try to locate the issue.

I use tcpdump to capture all traffic for a couple hours and do a quick analysis to see whether there are some special.  like sending out credit card using SMTP with the port 25, or just use stand http post, if it https. you can sort the TLS certificate to see any special certificate which represents some evil 3rd party hosts.

Nothing found special for me. most just traffic to this site and some 3rd party API call like shipping rate calculation, Fedex integration.

then do a analysis about the request log to see any url which has huge hit from the same IP.
you can use some handy linux command to do the aggregation.

awk '{print $8$2}' requestlog|sort|uniq -c|sort -r -n|more

nothing special, most hits are from crawlers ip with Google.

feel a little big frustrated now, this must be a smart hacker.  then I watch for file change  within 5 minutes. if they hacker intercept the request and store somewhere, I will definitly find out where did he/she store the file.

go the root directly of the magento, I spect all files change within 5 mintues (I placed a order using a dummy credit card"

 find . -mmin -5 -ls

there we go, one file called db-tab-footer_bg.gif was changed minutes ago. there should not be any chagne for gif files. this turns out to be a complicated image file. since it's all stored with encrypted data ( it must be credit card there),

if I check the access log, not a lot request to this file, only once a week coming from the hacker's IP.

now, time to locate how can they capture the data and dump to this file.
just search all php files containing db-tab-footer_bg.gif.

 it's in the global config file, here is the content. essentially they intercept all post request and encrypt using his/her RSA public key and put to the gif file. nobody can decrypt it.

now time to get ride of the backdoor and do the housekeeping to locate how did they inject the backdoor on the server

Group All established connections by target IP

here is a very common case that you want to check whether you have even connection for a distributed system on the server side. or whether the client send the requests cross all server endpoints.

Basic idea. netstat -an|grep 'EST' will show you all the established connection.

so the 4th column is the client endpoints, and 5th column is the target one.

if we want to see how many connection for each Target as a IP. you can do the following command.
netstat -an -p tcp|grep "EST"|awk '{print $5}'|awk -F "." '{print $1"."$2"."$3"."$4 }'|sort |uniq -c |sort -n -r

and if we only want to see the top 5.  we can put rows index for the awk hint. 

netstat -an -p tcp|grep "EST"|awk '{print $5}'|awk -F "." 'FNR<6 {print $1"."$2"."$3"."$4 }'|sort |uniq -c |sort -n -r

Spark window function, failure: ``union'' expected but `(' found

this a very weird error when I try to run a simple window ranking, all looks good from the syntax perspective.

team=[("Lakers","WEST",29 ),("Golden State","WEST",89 ),
      ("MIA HEAT","EAST",79 ),("SAS","WEST",9 ),
      ("RAPTORS","EAST",29 ) ]

sql.createDataFrame(
    sc.parallelize(
        team).map(lambda x: Row(Team=x[0],Division=x[1], Score=x[2])))\
    .registerAsTable("team")

print sql.sql("SELECT team, division, score, rank() OVER (PARTITION BY division ORDER BY score desc)"              "  as rank FROM team").take(10)

And I got this errors complaining the syntax

4j.protocol.Py4JJavaError: An error occurred while calling o36.sql.
: java.lang.RuntimeException: [1.43] failure: ``union'' expected but `(' found

SELECT team, division, score, rank() OVER (PARTITION BY division ORDER BY score desc)  as rank FROM team
                                          ^
 at scala.sys.package$.error(package.scala:27)
 at org.apache.spark.sql.catalyst.AbstractSparkSQLParser.parse(AbstractSparkSQLParser.scala:36)
 at org.apache.spark.sql.catalyst.DefaultParserDialect.parse(ParserDialect.scala:67)
 at org.apache.spark.sql.SQLContext$$anonfun$2.apply(SQLContext.scala:211)
 at org.apache.spark.sql.SQLContext$$anonfun$2.apply(SQLContext.scala:211)

To Fix this, please make sure you are using HiveContext instead of SqlContext

How to Run Spark testing application in your fav Python IDE

Here is a quick step to run and test your spark application using python IDE, essentially, we need load the dependency module. setup the environment and load the context.

1. copy and grab pyspark folder under the standard spark distribution to your project folder

2. setup some bootstrap to take care the environments using the following code , I use 1.6.1 as an example. and you may create this as a module.

class  Setup(object):


    def setupSpark(self):
        os.environ["SPARK_HOME"] = "/Users/and/Development/spark/spark-1.6.1-bin-hadoop2.6/"        os.environ["PYSPARK_SUBMIT_ARGS"]="--master local[2]";
     
        spark_home = os.environ.get("SPARK_HOME")

    
        spark_release_file = spark_home + "/RELEASE"        if os.path.exists(spark_release_file) and "Spark 1.6.1" in open(spark_release_file).read():
            pyspark_submit_args = os.environ.get("PYSPARK_SUBMIT_ARGS", "")
            if not "pyspark-shell" in pyspark_submit_args: pyspark_submit_args += " pyspark-shell"            os.environ["PYSPARK_SUBMIT_ARGS"] = pyspark_submit_args

     
        sys.path.insert(0, spark_home + "/python")

     
        sys.path.insert(0, os.path.join(spark_home, "python/lib/py4j-0.9-src.zip"))

        return pyspark.SparkContext()

3. you are good to go

from lib.setup import Setup

sc=Setup().setupSpark()

print sc.parallelize(range(1,10)).count()

How to: test ElasticSearch geoLocation support

Here is a quick tutorial to setup ES 2.1 and index some earthquake data by using the REST api. and then do by query by assign the POI within couple miles and return those earthquakes count aggregated by Range.
the query looks like this.  basically query all the earthquake happened near San Diego within 300KMs.

and the results showing the individual earthquakes and the buckets aggregated.

you can grad the data source from USGS , I closed the CSV file here
to do the Indexing, first we define the mapping , I used Postman to do the REST call. My mapping looks like this,

once we have the mapping and Index, we can feed the data to ES using the Sense tool. I put a small script to parse the CSV data to JSON following the Bulk format. 

like this

And I found Sense is the best client when you do the Bulk indexing, all other REST plugin in Chome give me the encoding error.
then copy and paste the data we convered, basically tell the importer we want to create a new document called eq, then the doc itself

Http 1.1 Chunked transfer.

If you inspect the http response with some zipped resources, you may find 2 things. I assure we are on HTTP 1.1. there is no content-length header ins the response, also the transfer-encoding is chunked.

and Http 1.1 have a full spec about the chunked encoding, check it here. http://www.w3.org/Protocols/rfc2616/rfc2616-sec3.html#sec3.6

if you use node.js , we can write a simple test to try out the chunked transfer. here is the source code

and try pull the response using wget. you will notice the 3 seconds delay between Okay3 and 4.

and inspect the traffic in between, you can see the wirelevel bits

1st response returns Okay1

then the 2nd returns2 and 3

after 3 seconds delay

we get okay4

once we call the end , you can see the end trailer.

wireshark are smart enough, to tell you 4 frames invloved in this http req/res

Power-shell , Filter and Projection

To getstart with any command in PS, run help.

To filter it, use the where-object or use ? directly.

get running service

Or just using ? instead.

Using Select to run a projection, select name, status only

also, you can skip and tail the results

sellect last 5 only

convert the result to a Html page? using the convert*

to show it in a gridview

What's new in asp.net 5

updates for asp.net 4.6, web forms mvc5

roslyn support. .net compiler

roslen c# languae fature
var name="ss"
var messgage=$"this is a amessag  {name}"

Features

totally modular
>old days, all features on. now , you can turn on off , faster
>cloud support
>faster dev cycle. 2 seconds to compiler
>cross platform. run on mac, linux, windows
>faster. less memory



docs.asp.net
powerd by readthedocs, markdown syntax

readmedocs.org
1. turn on featues on and off, moduleer. can run on IoT

//like the nodejs
public void configure(IapplicationBuild app)
{

app.run(async (context)=>
{
await context.Response.WriteAsync("Hello World")
})
}


//add dependency .microsfot.aspnet.diagnostis

app.userErrorPage();

dnx . web //start the app

//not static handler by default. need add dependency
//add dependency
microsoft.aspnet.staticfiles

app.useStatiffiles (); // extension methods

2. roslyn engine
instead of compile cs to dll, then load it.
now load it in memory

DNX (Dontne Execution Environment)
4.5.1
5.0 core

old file have the csproj, inclue all files. cause merge issues.
now all fiels in the project

commands in package.json
like alias in npm

dnx . web  //run web command in the folder.

target framework
frameworks:{
dnx451:{}
dnxcore50:{}
}

bower support
>>>nuget not versioned

gulp support
task runner support (show gupp task)

>before build
>after build


publish the app to a disk and can run it directly. by run the web.command


3.Environment

<Environment names="Dev">

<link rel="stylesheet" href="cdnlink" asp-fall-back-ref="otherlinks">
</Environment>

model injection.
more html
<input asp-for="email" class="form-control"/>

used to be html.Textbox(m->m.Email, new {"classs=formcontrol"})

4. configuration.

new Configuration().addInifile() or addjson()



app.addUserSecretcs(), no connectionstring in web.config.
also for hosted on cloud, IT ops will asign those value

user-script //
user-script set AppSettings:SiteTitle "sec title"

5. controller

new ScrottController () , no need for base calss

public xxxController()
{

public string Index()
{
return "hello, index"
}
}

6.dotnet version manager
dnvm list
c:\users\currentuser\.dnx

7. mac

yo asp.net
dnu restore

dnx run kestrol
Mcirosfot.aspnet.serverhosting -server kestrol


8. run on rsp pi
kestrel

What's new in C# 6

Roslyn open source

  IDE Features (CTL+.)
  . lightball to remove unused namespace
    .. fix the scope , remove all unused cross the project / solutions
  . refactor
    rename, introduce local variable, show conflict
    add this automaticaly if their is conflict that could be resolved by IDE
  . Array vs ImmutableArray

  var c=new ImmutableArray(); call c.length will trigger null exception.
  //you can build code analyzer
  //tell the ide you shoudl you  ImmutableArray<int>.empty

language new features
  instead of big change, little things added.

  1.using static System.Console. //simar typescript import {WriteLine} from systemcnosole

    then you can call WriteLine methods.
  2.Immutable, auto property.
    public class Point
    {
      public int x {get;}
      public int y {get;}=default10;
    }
  3 lambda for methods
    public void string ToString()=>String.format("tostring {0}", x);

  4 $String,
    public void String toString()=>$({X}{Y})
  5. nameof(variable)
    Log.d(nameof(variable))
  6.?.
    if p!=null && p.name=="xxx"
    will be if p?.name=="xx"
    if json!=null && json['x']!=null && json['x']=="mon"
    will be
    if(json?['x']?=="mon")
  7.initlize elements
    public JObject tojson()=>return new jsonobject(){['x']=x, ['Y']=y }
  8. awit in catch block

    try
    {
    var result=await repo.DosomethingAsync();
    }
    catch(Excepton ex)
    {
      await repo.LogException(ex) //doable now
    }

  9.catch(Exception ex) when (ex.Occurences>3)


Debugging features
  1. you can edit code, even add new class , and do initialization code when debugging the app
    run linq query

    also in watch window
    people.find(p=>p.age>20)

  C# extensions toolkit in the extnsion gallery
  2. C# interactive window

      #r "System"
      #r "System.Core"
      using System.Diagnostics;
      using System.linq;
      var memoryPigs =from p in Process.getProcesses() where p.workset64 >64*1024*1024 select new
      {p.ProcessName, p.WorkingSet}
      foreach(var r in memopigs)
      {
      Console.writeline(r)7y
      }

wse 2 run windows server 2008 R2

For some legacy issues, you app stack might use WSE to do the message level authentication. and if you have to run wse 2 in your asmx hosted on windows server 2008 R2. here could be some issues and solutions.

1. If you bind multi Binary kerberos token to the request and send to the server, you might be rejected even both of them are valid. like you put host to abc and abs.fullqualifiedname.com

solution: manually downgrade the wse 2 from 2.0.3 to 2.0.1. I found since 2.0.3, the request filter does not allow 1+ tokens

2. unable to extract username from the binary token passed from client.

solution: config the application pool to run on 32 bit mode. twick the code a little bit, to remove the session key extraction.

if always shows me the memroy access exception when it try to do the session key marshaling.

check the code in Microsoft.Web.Services2.Security.Tokens.Kerberos.LsaServerContext.LogonUser(byte[] inToken), you might just decompile the code ,chagne it and sign it back using your own key. and update the reference to your version of wse.dll

JWT token, signed in C#, and Decode in JS

JWT is a widly used token system that we can share token info between APIs or between Apps.

i.e we can sign the token by using a shared key in C#, then verify the token in javascript by using the same sharedkey.

in C#, you can search nuget for the jwt , there are several libraries.

let’s I want to sign a simple clamin using the simple password.

we get token eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJuYW1lIjoiUGV0ZXIiLCJSb2xlIjoiQWRtaW5zLFJlYWRlciJ9.Qh2J93epa7ls0y6DAn_8YvIRoRHq28hLT9N-93fStcajCd90nLzLG6Vit-Qdfl1TsPtL56qh4jiKDOzpfs1OyA

then follow the library for different languages from jwt.io to do the decoding

Past the token into the validation box, and enter pass in the shared key, you will see token get decoded and verified

C# TPL some basic code

Fast win pattern, you might query several urls for the same info, which one return first , that one will be the winner.


Send in parallel and join together.

long running and cancellable task, if get canceld, try compensate it

“mapreduce”

Vagrant, Proxy issue, centos local repo and ad-hoc testing

Vagrant is a good VM automation tool for both developers and devops, here are some basic tips that I found useful

Proxy
   if you are stand behind a proxy, you can install one vagran proxy module. the module will setup the proxy on guest machines, like yum.conf, http_proxy variable etc.
here is the plugin https://github.com/tmatilai/vagrant-proxyconf

 

when you boot up the vm, you can see the proxy setting applied depends on your OS type

Yum Repo.
   you might have one local repo in the company, you can either build all boxes internally which already assign the repo url to local. or just copy one repo to override the system one by using the provisioning scripts.

and in your local file, change the ip to internal one

Provision scripts to check whether package installed or not. using rpm to query package or use command to determine whether a command exists

Opencart fix, show the shipping method in orders admin page and filter by shippingmethod

it turns that this should be a common feature for opencart admins, basically the operation team would like to see orders with priority shipping method and process those orders first. on 1.5, no way you can see this at once. basically the orders page looks like this by default

they actually want to see the UI like this, with shipping method on the overview

even more, they want a filter to see all orders with priority shipping selected.

To fix this, pretty straight forward. change the orders module/controller/template file, to include shippingmethod in the data query back. and add a filter logic to narrow down records.

I have a patch file, email me if you are interested. click about me on the page to get my email