Ever need to create a more detailed log for Windows 2008 failover clustering? Well, it became much easier for you. Just run the following command and then go into the directory C:\Windows\Cluster\Reports to get the cluster.log file:

cluster log /g /level:5

For more information, please read the link below:
http://blogs.msdn.com/b/clustering/archive/2008/09/24/8962934.aspx

his applies to all the version of tomcat and this feature enabled for NimsoftSD and helped a lot to improve their application performance.

What is GZIP?

It is a compression format created by Jean-Loup Gailly and Mark Adler. Version 0.1 was first publicly released on October 31, 1992.

GZIP is based on the DEFLATE algorithm, which is a combination of LZ77 and Huffman coding. DEFLATE was intended as a replacement for LZW and other patent-encumbered data compression algorithms which, at the time, limited the usability of compress and other popular archives.

How does it helps in improving performance of my web page?

Modern browser like Internet Explorer, Firefox, Opera etc supports gzip compressed content. These browsers are capable of uncompressing gzip data into plain text. Servers like Apache, Tomcat, JBoss etc supports gzip compression too. Hence if gzip is enabled in such servers, the response if first compressed and then send to client. Hence this increase performance by many folds.

How to enable GZIP in my tomcat server?

Here is how to enable GZIP compression on Tomcat: edit file /conf/server.xml and add to the HTTP Connector configuration something like this:

compression="on"

compressionMinSize="2048"

noCompressionUserAgents="gozilla, traviata"

compressableMimeType="text/html,text/xml"

An example of a HTTP Connector configuration with compression enabled could be:

<Connector port="8080" maxHttpHeaderSize="8192"

maxThreads="150" minSpareThreads="25" maxSpareThreads="75"

enableLookups="false" redirectPort="8443" acceptCount="100"

connectionTimeout="20000" disableUploadTimeout="true"

compression="on"

compressionMinSize="2048"

noCompressionUserAgents="gozilla, traviata"

compressableMimeType="text/html,text/xml"/>

The short answer is "yes" however its not recommended nor supported. If you choose to perform this option, you have to go in and just like any standalone Windows box first unjoin it and then rejoin the cluster nodes to the Active Directory domain you are looking for.

The following settings can be used for a general cluster configuration. Do note that you want to be EXTREMELY careful in setting high values here so as to not cause a non-detection event where the cluster does not failover as expected: Likewise, turning up the sensitivity may cause false failover events to happen when not needed:

1. If any nodes are currently paused, unpause them all using the failover cluster MMC
   
2. Set the following cluster properties on the passive node(s) from the command line:
   

   cluster /prop SameSubnetDelay=1000
   cluster /prop SameSubnetThreshold=10
   cluster res ClusterName /priv HostRecordTTL=300
   cluster res AnyOtherClusterName /priv HostRecordTTL=300

3. Also set the following cluster properties for the individual node via the command line:
   

   cluster /priv HeartBeatLostInterfaceTicks=10:DWORD
   cluster /priv HeartBeatLostNodeTicks=10:DWORD

4. Stop and start the cluster service on each node to confirm the settings have taken effect

Do note that the general settings and how to set these are found at the following link below:
What has changed for Windows 2008 and the heartbeat network?

Speacial Note: Dynamic DNS and Windows 2008 Failover Clusters

If you are seeing random issues here where DDNS is failing even after the changes are made above you can try going the alternate route and performing the following changes:

• Change the cluster DNS registration TTL's to to reflect a (1) day expiration:

  cluster res ClusterName /priv HostRecordTTL=86400
  cluster res AnyOtherClusterName /priv HostRecordTTL=86400

• Uncheck the "Register this connection's addresses in DNS" in the advanced DNS properties tab on all NIC's for all nodes of a cluster
  
• Choose the "Disable NetBIOS over TCP/IP" option in the advanced WINS properties tab on all NIC's for all nodes of a cluster

NOTE - This change is basically making the DNS registration of the cluster's network name valid for the prescribed time frame. If the IP Address is changed manually on purpose, you may need to restart the cluster and/or clear out the DNS cache to ensure this gets updated to the latest IP Address. Also, proper testing should be performed to ensure this option is valid in any particular customer's environment.

Fixing 'too many open files' error

Once in a while we stumble upon 'too many open files' error in log files especially for java application servers. What this means is that you have hit a limit on number of open file descriptors (fd)/file handles assigned for the process or user the application server is running as.

Let's use tomcat for our example.

So to get the number of fd's used by tomcat we run

$ pgrep tomcat

12345

$ sudo ls /proc/12345/fd | wc -l

2040

Don't use `lsof | wc -l` to get the number of fd's. `lsof` lists much more than the number of fd's in use. If you look at the FD column you'll see memory mapped files, current working directory, root directoy, the text segment of the running process etc listed which don't utilize file descriptors.

To see the fd limit run `ulimit` as the application user

$ sudo -u tomcat sh -c 'ulimit -n'

2048

One can also check for soft limit(-S) and hard limit(-H)

$ sudo -u tomcat sh -c 'ulimit -Hn'

2048

To see the system wide fd limit

$ cat /proc/sys/fs/file-max

148922

Or

$ sysctl fs.file-max

fs.file-max = 148922

To find the current system wide fd usage

$ cat /proc/sys/fs/file-nr

1184 0 148922

Or

$ sysctl fs.file-nr

fs.file-nr = 1184 0 148922

The first field shows the number of allocated fd's, second field gives the number of allocated but unused fd's and the last field shows the maximum number of fd's. So in the above example 1184 fd's are allocated and all are in use.

So once you hit a limit the next step, obviously, is to increase it a bit. So let's do that.

For example to change the limit for tomcat user append the below lines to /etc/security/limits.conf

tomcat      soft    nofile  1024

tomcat  hard    nofile  3072

We can also put

ulimit -n 3072

in the shell script (startup wrapper script or rc script) that invokes the application server to change the limit for that process as all processes spawned from the shell will inherit the limit.

To increase the system wide limit we have to change the kernel runtime parameter fs.file-max and save it in /etc/sysctl.conf

# echo 'fs.file-max = 200000' >> /etc/sysctl.conf

# sysctl -p

# sysctl fs.file-max

fs.file-max = 200000

Steps to create a new user:

1. Login into the target server that has access to modify Active Directory
   
   1. Shared AD Environment => Login into the appropriate admin station
      
   2. Dedicated AD Environment => Login into the customers domain controller
2. Click on the start button and navigate to Programs | Administrative Tools and click on Active Directory Users and Computers
3. In the left-hand pane of the console tree, right-click the folder in which you want to add a user account.  Navigate to New and then click User
4. In First name, type the user's first name
   
5. In Last name, type the user's last name
   
6. In Full name, type in the first initial of the first name and the full last name
   
7. In User login name, retype the full name used above
   
8. Click on Next
9. Type in a suitable password using a password generator where possible
   
10. Do not check the User must change password at next login check box
    
11. Click on Next and then Finish
12. Right-click the newly created user, navigate to and click on Properties
13. Click on the Members of tab
    
14. Click on Add
15. Add any security groups that are needed  by typing in the security group into the space provided and clicking on Check Names
16. Click OK and OK to exit out

** *Note - The user creation process does not allow UNIX attributes to be edited unless you are in the Domain Admins security group.  If this is the case you MUST use the command line script on the admin stations in IAD03 OR open a ticket with Operations Engineering.  Otherwise, if the account will be a service account or if no UID is required, then you are done.  If this is for a dedicated domain, please use the MMC as mentioned above in creating a new user.

The firewall ports that are used by an installation of Active directory can be found below:

RHEL5 rhcs cluster nodes will try to fence each other if they lose multicast cluster communications between nodes.

In these types of problems the culprit is almost always a failure or configuration issue with multicast at the network switch.
Environment
Red Hat Cluster Suite
Diagnosing the problem
1. On all cluster nodes enable recognition of icmp broadcasts:
echo 0 >/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

2. On all cluster nodes run "cman_tool status" and note:

A. Number of cluster nodes.
B. The cluster multicast address:

[root@node5 ~]# cman_tool status
Version: 6.1.0
Config Version: 8
Cluster Name: rhel_cluster
Cluster Id: 31412
Cluster Member: Yes
Cluster Generation: 180
Membership state: Cluster-Member
Nodes: 2
Expected votes: 1
Total votes: 2
Quorum: 1
Active subsystems: 9
Flags: 2node Dirty
Ports Bound: 0 11 177
Node name: node5
Node ID: 5
Multicast addresses: 239.192.122.47
Node addresses: 9.47.65.165

3. Do a 2-count multicast ping:

ping -c 2 -I bond0 -b -L 239.192.122.47

4. If there are no problems then you should see multicast responses from all other cluster nodes:

PING 239.192.122.47 (239.192.122.47) from 9.47.65.165 bond0: 56(84) bytes of data.
64 bytes from 9.47.65.166: icmp_seq=1 ttl=64 time=1.23 ms
64 bytes from 9.47.65.166: icmp_seq=2 ttl=64 time=2.28 ms

-- 239.192.122.47 ping statistics --
2 packets transmitted, 2 received, 0% packet loss, time 1000ms
rtt min/avg/max/mdev = 1.230/1.755/2.281/0.527 ms

5. If you don't get the proper responses, then:

A. Make sure that you previously ran the following on ALL the cluster nodes:

echo 0 >/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

B. If you confirmed that Step 5A was done, then the either a node or network
switch is misconfigured or there are hardware problems such as bad
network cables.

6. On all cluster nodes disable recognition of icmp broadcasts:

echo 1 >/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

Alternative Method

'omping' can be started on both nodes, taking the the ip of the remote node and the own ip as parameters.

Reference : How do I test multicast?

Ensure you run the same command on both nodes at the same time as mentioned in the above reference URL to properly check multicasting between the nodes.

A tale of two servers

The Apache httpd web server and the Apache Tomcat server are two very popular products in use for delivering web content.

About the Apache httpd server

The Apache httpd web server grew out of the NCSA web server. At its core, httpd implements the HTTP protocol specification. It was primarily designed to serve static files to browsers. Over the years, many features have been added and the core web server can be extended through the use of modules. Some popular modules include:

• mod_rewrite : this module provides a powerful mechanism for the administrator to rewrite URL requests that come in or get sent out of httpd
• mod_cache : this module provides a top-level module framework for caching web content
  
• mod_ssl : this module adds strong encryption to httpd using the OpenSSL toolkit
• mod_dbd : this module adds a database connectivity layer to httpd
• mod_mime : this module allows the administrator to control actions within the server based on MIME types and file extensions, it allows for the defining of handlers and filters for output

The Apache httpd web server ships with over 70 modules and there is a repository of 3rd party modules to extend it even further (currently with 490 modules.)

About the Apache Tomcat server

The Apache Tomcat server is a project that started at Sun Microsystems as the reference implementation of the Java Servlet and Java Server Pages Specifications. The Tomcat code base was donated by Sun to the Apache Software Foundation in 1999. As the Java Servlet and JSP specifications develop and mature, Tomcat's versatility grows and expands. As implied, the Tomcat server is run in a Java virtual machine and requires, at least, a JRE (Java Runtime Environment) to run although it is more commonly run using a JDK (Java Development Kit.) Tomcat should run anywhere a JDK is available (Linux, Windows, UNIX, etc.).

Tomcat also implements the HTTP protocol and can be extended to execute non-Java scripts, such as Python, PHP and Ruby.

For the remainder of the article, the Apache httpd web server will be referred to as "Apache" and the Apache Tomcat server will be referred to as "Tomcat."

The relationship between Apache and Tomcat

Both Apache and Tomcat implement the HTTP protocol for serving files to browsers. Both can be extended to serve dynamic content using many popular scripting languages. So what are the differences? Why would you choose one over the other? To answer that, let's look at the strengths.

• There is no module to allow Apache to directly execute Java code. Since Tomcat is a Java application executing in a Java virtual machine, Java becomes the native language of the web applications it serves.
  
• It can be argued that the integration of scripting languages like PHP and Python is better with Apache than with Tomcat but this isn't easily proven or refuted.
  
• Apache generally has a smaller memory footprint than Tomcat and serves static content faster using fewer resources.
  
• Virtual hosting, aliasing and URL rewriting are, generally, easier to configure in Apache.

Because of these points, people usually use Apache for supporting scripting languages and serving static content and use Tomcat for Java applications. Where they merge together is in the use of an Apache module, mod_jk for the 1.3.x and 2.0.x versions of Apache and mod_proxy_ajp for the 2.2.x version of Apache. The module allows Apache to proxy requests between the browser and a Tomcat server seamlessly through the use of a binary protocol, with persistent connections, to streamline communications, making it the preferred mechanism for connecting the two servers.

Another way to connect Apache and Tomcat is to use the mod_proxy_http module in Apache 2.2.x. This is a generic HTTP proxy and does not provide the benefits of the mod_jk/mod_proxy_ajp modules.

The combination of Apache and Tomcat provides for a powerful and scalable web server architecture

CNF objects are objects that occur in an Active Directory forest where there is a "collision" of a particular name where two different domain controllers have the same object. To ensure all objects are "unique" one of the objects gets appended with CNF followed by a GUID. In general, one of these objects should be deleted preferably the one with the older date or CNF in its name. But, either object can be valid. For more information, you an refer to the link below:

• http://www.windowsitpro.com/article/john-savills-windows-faqs/i-have-objects-in-my-active-directory-ad-domain-that-have-cnf-in-their-name-followed-by-a-globally-unique-identifier-guid-what-are-these-objects-
• http://technet.microsoft.com/en-us/library/bb727059.aspx