@black3dynamite said in Firewall rules for outgoing traffic:

Block all DNS servers except for the one you provide via DHCP?

Not necessarily via DHCP, but whatever ones you have approved. 1.1.1.1, 8.8.8.8, for example.

@pete-s said in Do I have a power supply problem?:

@dbeato said in Do I have a power supply problem?:

Seeing the dates, is there a pattern? Like does it keep on going up to this year, 2018?

No, these were the only dates.
But I will update the bios/ipmi just in case it is a software problem as @momurda suggested.

Come to think of it, I'm not even sure the -12V in the power supply is even used anymore.

It is more like CMOS battery or other component.

@travisdh1 said in Web app authenticate against customer AD?:

@dbeato said in Web app authenticate against customer AD?:

@travisdh1 said in Web app authenticate against customer AD?:

@dbeato said in Web app authenticate against customer AD?:

@travisdh1 said in Web app authenticate against customer AD?:

@dbeato said in Web app authenticate against customer AD?:

@travisdh1 said in Web app authenticate against customer AD?:

@dbeato said in Web app authenticate against customer AD?:

@pete-s said in Web app authenticate against customer AD?:

that an enterprise would expose ldap to the inter

Very unlikely, there must be a VPN or a LDAP open externally only allowed from certain IP addresses from said Cloud vendor.

LDAP can be secured the same way HTTP traffic can be. In fact, it's the default in Active Directory.

What do you mean LDAP secured? you mean LDAPS?

Yes.

LDAPS still not the default as far as I know in AD .

Really? That's just bad. I thought they had Kerberos by default.

https://support.microsoft.com/en-us/help/321051/how-to-enable-ldap-over-ssl-with-a-third-party-certification-authority

Wow, just, wow. Haven't they figured this out by now?
0_1533942863184_93df6151-c505-4067-a50a-06974023c370-image.png

It would be nice if it was on by default.

Not really, glances is better. I also dont use XO at all. Tried it a few times, but I have Unitrends so no reason to really use it.

Alright, I have some updates now that I have two identical machines but with different CPU configurations.

Machine 1: 2 x E5-2630v2, 6 cores each = 12 cores @ 2.60 GHz, 64GB RAM
Geekbench: ~29000
Idle power: ~60 Watt

Machine 2: 1 x E5-2670v2, 10 cores @ 2.50 GHz, 64GB RAM
Geekbench: ~27000
Idle power: ~30 Watt

The dual CPU machine is slightly faster but results are within 10% and there are some variation in the test when repeated.

The big difference however is in power consumption. Dual CPUs requires about twice the power when idling.

The machines both have the same dual socket motherboard, but the single CPU has fewer memory sockets but bigger (4x16GB) versus the dual CPU machine (8x8GB). But that is the reality as well - you need to populate more sockets with two CPUs.

@pete-s They can.

In Windows Server:
In Elevated CMD:
wmic.exe computersystem where name="SERVERNAME" set AutomaticManagedPagefile=False
wmic.exe pagefileset where name="c:\\pagefile.sys" set InitialSize=8192,MaximumSize=8192
shutdown -r -t 0

Then in an elevated PowerShell:

Set-ItemProperty –Path HKLM:\System\CurrentControlSet\Control\CrashControl –Name CrashDumpEnabled –value 1
Get-ItemProperty –Path HKLM:\System\CurrentControlSet\Control\CrashControl –Name CrashDumpEnabled
Set-ItemProperty –Path HKLM:\System\CurrentControlSet\Control\CrashControl –Name FilterPages –value 1
Get-ItemProperty –Path HKLM:\System\CurrentControlSet\Control\CrashControl –Name FilterPages

From https://blogs.msdn.microsoft.com/clustering/2015/05/18/windows-server-2016-failover-cluster-troubleshooting-enhancements-active-dump/

We do the above on all servers we deploy since they all have a 128GB or 256GB at the most host OS drive and it's not uncommon to be deploying over a Terabyte of RAM.

Couple thoughts...

It's spelled EPYC...

There were some weird NUMA considerations when trying to saturate 100Gbps Ethernet NIC's. I saw some firmware improvement/workarounds (basically stick TCP to a core so it wouldn't span NUMA nodes). 99% of people are not going to care about this, and the work around seems to be holding from what I've seen.

For Single socket it's really the best bang for buck out there. I've seen some impressive vSAN numbers on it if anyone's wondering. It doesn't lock out 1/2 the PCI-E or Memory lanes like Intel in a single socket config.

I've got a RYZEN at home, and quite happy with it.

I'm hearing Intel made some optimizations for multi-threaded and cloud native workloads in Skylake that cause issues for .NET and single threaded apps. I haven't done any bake offs but I'm curious if AMD went down the same pass (especially with spin locks). If you have older .NET code with lots of spin locks you want to get it updated or get ready for potential (heavy) regressions on performance vs. Broadwell. We are entering a weird situation where CPU vendors are starting to NOT optimize for enterprise applications but for the mega clouds.

While I think ARM is awesome, there also is a LOOOOOOOT of optimization to be done with compilers before it gets taken seriously outside of edge cases, or homogenous workloads where people will invest the time like CloudFlare.

It requires a outage to migrate between Intel and AMD at a virtualization layer. Intel also has QuickAssit and some other interesting offload, as well as Apache Pass technology.

@scottalanmiller said in Easy to manage KVM host setup:

@pete-s said in Easy to manage KVM host setup:

Fedora Server was a no go on the old HP server I had. It would hang during install.
I tried xcp-ng (= xenserver ~ centos) on it and it installed fine. Debian 9 also installs fine.

I'll try CentOS next.

That's surprising. What server is it?

I had to go check what it was and it's a HP DL360 G5.
It's too old and slow anyway so not a big deal, but still surprising.

I have two Dell R710 laying around as well that I could use instead. They're a little less ancient I think (xeon 5500 series). It just for testing so as long as it works performance doesn't matter much. Just need to have enough RAM.

Even if you are LANless and you want pure hostnames and no FQDN, you just set your search settings and that handles that regardless of LAN or LANless design.

@pete-s said in Advantages of CentOS or Fedora over Debian?:

Looking at CentOS / RHEL they seem they use a very old kernel 3.10, even in the latest release, which itself was released recently.

How does that work with hardware support? Do Red Hat backport all new hardware support from the newer kernels to 3.10? If you for instance are setting up a new server with AMD Epyc CPUs, you'll need support for this in the kernel.

There point releases normally include new hardware support.

@scottalanmiller Yeah both of my webservers use mariadb for example

That's more in line with the size that I always thought that it was. 300 seemed super low.