Feb 23 2006

MySQL migration: MyISAM to InnoDB

Tag:tepezcuintle @ 22:08

MySQL migration: MyISAM to InnoDB
Monday July 18, 2005 (07:00 PM GMT)
By: Keith Winston

The MySQL database is unique in that it offers multiple storage engines. The SQL parser and front end interfaces are separate from the storage engines, so you can choose among nine low-level table formats the one that suits your application best. I recently needed to convert a production application from the default indexed sequential format, MyISAM, to InnoDB. Here’s my no-hassle guide to performing the conversion.

Why would you want to convert an existing MySQL database from MyISAM to InnoDB? While the MyISAM format has low overhead and generally the fastest performance among MySQL storage engines, it does not have advanced features like transactions, rollbacks, and row-level locking. InnoDB has these features and is also fully ACID-compliant (atomicity, consistency, isolation, and durability). ACID compliance is one of the touchstones of high-end database systems. I needed these features to solve my problem.

One of the applications I inherited is a course registration system using the ubiquitous LAMP architecture (Linux, Apache, MySQL, PHP) and the default MyISAM table format. During peak usage (about 100 simultaneous users) some of the records added to the system were incorrectly linked with other records in related tables. The problem was that no locking was done on the database, leading to some SQL insert commands being executed out of order. While the MyISAM engine provides table locking to simulate transactions, that wasn’t good enough for such a heavily used application. I needed the row-level locking and ACID transaction support of InnoDB. Here are the steps I took to convert a MySQL database from MyISAM to InnoDB:

Dump the database with mysqldump

The first step is to dump the existing database using the mysqldump utility. The dump provides a complete backup of the database in case something goes wrong, and is also used to restore it later in the InnoDB format. Make sure the application is not in use while performing the conversion.

Here is syntax I use:

mysqldump –user=user –password=password –add-drop-table –databases db1 > db1.sql

Change the user and password as needed for your database. The –add-drop-table option generates the SQL instructions to create all the tables. Change the name db1 to the name of your database. The output of the dump is an ASCII file with SQL commands to rebuild the database from scratch. The output is redirected and stored in file db1.sql.

Change TYPE=ISAM to TYPE=INNODB

The second step is to edit the db1.sql dump file with a text editor and change the table type to InnoDB. Make of copy of the dump file before you edit it in case you need to restore it later. Here is a sample table definition:

CREATE TABLE audience_def (
AUDIENCE_NO int(10) unsigned NOT NULL auto_increment,
DESCRIPTION varchar(150) default NULL,
STATUS varchar(10) default NULL,
PRIMARY KEY (AUDIENCE_NO)
) TYPE=ISAM;
For each table definition in the dump file, change the TYPE=ISAM to TYPE=INNODB. If your database is very large, the dump file may be too large to fit in your text editor. If so, you can use a batch editor like sed to make the changes.

To vastly increase the speed of the reload, add the SQL command SET AUTOCOMMIT = 0; to the beginning of the dump file, and add the COMMIT; command to the end. By default, autocommit is on, meaning that each and every insert command in the dump file will be treated as a separate transaction and written to disk before the next one is started. If you don’t add these commands, reloading a large database into InnoDB can take many hours.

Add entries to /etc/my.cnf and restart MySQL

If MySQL is already configured to support InnoDB on your system, skip this step. Some distributions come with MySQL packages that are not configured to use the InnoDB storage engine, and some may require an extra package to be installed to support InnoDB. Check the documentation of your distribution to be sure.

A few extra entries are needed in the MySQL configuration file, /etc/my.cnf, to support InnoDB. For a basic configuration, add these settings under the [mysqld] group of settings in /etc/my.cnf:

[mysqld]
# InnoDB settings
innodb_data_home_dir = /var/lib/mysql/
innodb_data_file_path = ibdata1:100M:autoextend
set-variable = innodb_buffer_pool_size=100M
set-variable = innodb_additional_mem_pool_size=10M
innodb_flush_log_at_trx_commit=1

The innodb_data_home_dir setting defines the location where InnoDB should create data files. The innodb_data_file_path setting defines the name of the data files. In this case, it will create a 100MB data file called ibdata1 and will extend the size as needed. A data file in InnoDB parlance is a tablespace.

Next, restart the MySQL service. To see all the startup messages, you may want to start it from the command line instead of using the normal startup script. The first time you start MySQL with InnoDB support, it will take a lot longer to start, because it has to create the InnoDB data files (tablespaces) and transaction log files and initialize everything. After the first successful start, future restarts happen quickly.

After a successful start, you should see files with names like these in your /var/lib/mysql directory:

admin@linux01 [/var/lib/mysql]$ ls -l
-rw-rw—- 1 mysql mysql 104857600 Jul 4 11:13 ibdata1
-rw-rw—- 1 mysql mysql 5242880 Jul 4 11:13 ib_logfile0
-rw-rw—- 1 mysql mysql 5242880 Jul 4 11:13 ib_logfile1

The data file is ibdata1. The transaction log files are ib_logfile0 and ib_logfile1.

Load the database with mysql

The final step is to drop the old database and reload it using the dump file. I prefer to log in to the database and issue a drop db1; command to delete it. To reload it in InnoDB format, simply feed the dump file back into MySQL with the command mysql –user=user –password=password.

Once that command completes, you should have a fully functional InnoDB database. Your application should not require any changes to work with InnoDB because the storage engine is isolated from the application code.

SQL wrap up

Now that your database is converted to InnoDB, you can take advantage of advanced features in your application. There were two places in my PHP application where the SQL insert statements needed to be executed atomically to ensure the data remained consistent. In those two places, I wrapped the SQL statements with the commands to start and stop a transaction. I added the SQL command BEGIN; where I wanted the transaction to start, and COMMIT; where I wanted the transaction to end. All the complicated details of the transaction are handled by InnoDB.

Continua”MySQL migration: MyISAM to InnoDB”


Feb 21 2006

How to block IP addresses with IPTABLES

Tag:tepezcuintle @ 16:47

I am still getting blank emails from a verizon dsl customer. I found the IP address after viewing the source. 71.247.113.185

here is the command to use to block this ip address.

iptables -I INPUT -s 71.247.113.185 -j DROP

This command will simply drop any packet coming from the address 71.247.113.185 To list the chains:

iptables -L -n
.
.
[root@kpenguin root]# iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
DROP all — 71.247.113.185 0.0.0.0/0
acct_int all — 0.0.0.0/0 0.0.0.0/0
acct_ext all — 0.0.0.0/0 0.0.0.0/0

Chain FORWARD (policy ACCEPT)
target prot opt source destination
acct_int all — 0.0.0.0/0 0.0.0.0/0
acct_int all — 0.0.0.0/0 0.0.0.0/0
acct_ext all — 0.0.0.0/0 0.0.0.0/0
acct_ext all — 0.0.0.0/0 0.0.0.0/0

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
acct_int all — 0.0.0.0/0 0.0.0.0/0
acct_ext all — 0.0.0.0/0 0.0.0.0/0

Chain acct_ext (4 references)
target prot opt source destination

Chain acct_int (4 references)
target prot opt source destination
.
.
.

The -n sticks with just IP addresses, rather than resolving the name. This is useful if you have a lot of IP addresses. It can take a lot of time to resolve all of the addresses, particularly since they are probably funky. After all, you have blocked them for some reason. If you need to investigate with names, just use the command with out -n:

iptables -L
.
.
.
DROP all — 55.55.55.25.i.portscan.com anywhere
DROP all — 55.56.55.202.many.fetch.api.request.com anywhere
.
.
.

If you later decide that you don’t want to drop packets from a particular host, use the -D option instead of -I:

iptables -D INPUT -s 71.247.113.185 -j DROP

The annoying emails stopped after I added that rule to the firewall. This is annoying and not a good solution, but this emails are coming from a dynamic IP and there is no way to contact the user behind this ip address.


Feb 17 2006

How to do a Ping Scan using nmap

Tag:tepezcuintle @ 19:49

Let’s say you have a network 192.168.1.1-255
and you wanted to know which hosts are replying to pings.

enter this command

[ratkiller@centos ratkiller]$ nmap -sP 192.168.1.2-254

Starting nmap V. 3.00 ( www.insecure.org/nmap/ )
Host (192.168.1.50) appears to be up.
Host (192.168.1.99) appears to be up.
Host (192.168.1.101) appears to be up.
Host (192.168.1.130) appears to be up.
Host centos.localdomain (192.168.1.135) appears to be up.
Nmap run completed — 253 IP addresses (5 hosts up) scanned in 36 seconds

nmap will let you know which hosts are responding to ping.


Feb 17 2006

How to block an IP address without IPTables

Tag:tepezcuintle @ 18:50

At work I have been having problems with getting email from a customer that is infected by a worm that
keeps sending email to our s erver. This worm is sending blank emails and a few people have noticed it.

I don’t want to get any more emails from this ip address and I tried to edit SpamAssassin local.cf to block that
ip but you can only block by email address or domain name.

I will try to block the ip address to block it from sending us email .

using this dirty trick.

Continua”How to block an IP address without IPTables”


Feb 17 2006

Tomcat and Virtual Hosts

Tag:tepezcuintle @ 18:43

[code lang="html"]

TOMCAT AND MULTIPLE VIRTUAL HOSTS
We had Tomcat working on a single web server. Then we added some virtual hosts and the tomcat didn’t work on the virtual web servers. “Not a problem” we thought, we can get this working without any problems.

Four days later and its finally working. What I expected to be simple turned out to be a nightmare of hacking things. The documentation was hazy at best, so this is the brief recap on what we did. Part of the problem I’m sure was because multiple people had set up the server, so things were in different places with multiple instances and configuration files installed.

First step was to get the latest and greatest install of Tomcat.

Mistake one - don’t get the RPM. The RPM over-writes various configuration files. Although it does make a backup, the first time it ran it failed halfway through, so I ran it again and the original backup files were overwritten with the first backup from the RPM. Luckily I had made backups of all the files except for one which I didn’t know about.
We used the binary version of tomcat (Tomcat-4.1.24). You uncompress it, then copy it to the desired destination.

I like things on the local machine being in /usr/local/ So I put it in /usr/local/tomcat-4.1.24 and created a symbolic link /usr/local/tomcat pointing to that directory.

Of course, the old install had been in /var/tomcat, so putting the new one in /usr/local broke things, so there was an enjoyable half a day fixing things and getting it back to the same state it was in before hand.

I won’t put in here how to configure a basic install of tomcat, that is relatively straight forward and there is decent documentation on the web about that.

Lets also assume that your web server is setup with virtual hosts. Somewhere in your Apache configuration you should have something that looks like this:


ServerAdmin webmaster@somewhere.com
DocumentRoot /var/www/virtual/public_html
ServerName virtual.domainname.com
ErrorLog /var/www/virtual/weblogs/error_log
CustomLog /var/www/virtual/weblogs/access_log common

Options ExecCGI
SetHandler cgi-script

First thing you want to do it put in the handler entries for the Tomcat stuff so the Apache server knows not to try and interpret the .jsp pages and instead send it to the Tomcat system.

JkMount /servlet/* connect_id
JkMount /*.jsp connect_id
So you end up with something like this:

ServerAdmin webmaster@somewhere.com
DocumentRoot /var/www/virtual/public_html
ServerName virtual.domainname.com
ErrorLog /var/www/virtual/weblogs/error_log
CustomLog /var/www/virtual/weblogs/access_log common

Options ExecCGI
SetHandler cgi-script

JkMount /servlet/* connect_id
JkMount /*.jsp connect_id

First file you should edit is the server.xml file. You should find it in the config directory of your tomcat install. You need to create a connector for tomcat to run on. The default port is 8109, so don’t use that, I just moved things up to port 8112

port="8112" minProcessors="3" maxProcessors="10"
acceptCount="10" debug="0"/>

This will run a virtual machine on port 8112. The other parameters to be aware of are the min and max numbers of processors to run. We don’t envsinge a lot of work or connections, so we throttled the min processors back to 3 and a max of 10. We may have to change this later, but with 21 virtual hosts, it does save a fair amount of CPU load.
Further down in server you need to add the entry for the virtual host. Ensure that you add this below the descriptor for the default (localhost?) host.



directory="logs" prefix="virtual_log." suffix=".txt" timestamp="true"/>

directory="logs" prefix="virtual_log." suffix=".txt"
pattern="common"/>

Hostname is the name of the virtual host. There is some logging info. Something to take note of is the Context path. Notice the empty quotes. Don’t put in “/” it doesn’t work. Also set the docBase to the same as DocumentRoot in the virtual hosts entry.

Other file that needs editing is workers.properties First thing. Add the connection name to the worker.list
worker.list=ajp12, ajp13, connect_id
Next add that connection to the worker
worker.connect_id.port=8112
worker.connect_id.host=virtual.domainname.com
worker.connect_id.type=ajp13

Within the document root directory, ensure there is a WEB-INF directory. I discovered that it doesn’t work without one. Or you could probably redirect that using a directory alias within the virtual hosts directive.

Restart Tomcat.
Restart Apache.
Test.
If it doens’t work, start running things in debug mode and looking at logs, hopefully its just a simple thing.
TROUBLESHOOTING

Problems that I had:

Permissions not set for the Tomcat user. If you test things as root, then try to get the user that tomcat runs under to run them, it will most likely fail. You need to do a chown for the tomcat working area.
Permissions not set correctly for the web areas.
Tomcat being braindead when it came to setting the environment variables. This was fixed by starting the tomcat process as a daemon rather than as a su’ing to the tomcat user.

[/code]


Feb 16 2006

Configure Apache for Maximun Performance

Tag:tepezcuintle @ 22:37

Apache is an open-source HTTP server implementation. It is the most popular web server on the Internet. The December 2005 Web Server Survey conducted by Netcraft [1] shows that about 70% of the web sites on Internet are using Apache.

Continua”Configure Apache for Maximun Performance”


Feb 16 2006

How to troubleshoot Unix server problems

Tag:tepezcuintle @ 22:32

Yes, troubleshooting is an art!. The key points to mastering this art is knowing the system in and out, using the right tools and, of course, googling. Troubleshooting a problem is not something that can be spoon fed or taught with precise steps. It has to evolve from logical thinking and thorough knowledge of the system.

Continua”How to troubleshoot Unix server problems”


Feb 14 2006

How to safely edit your crontab

Tag:tepezcuintle @ 21:55

Time to break my habit of using crontab -e. As we all know this opens our default EDITOR and allows us to quickly edit and save our cron jobs. This is a huge risk. If, for example, you find yourself logged in on a strange system and EDITOR is set to something you don’t know, you’re much more at risk to accidentally erase your crontab.

Continua”How to safely edit your crontab”


Feb 14 2006

How To Look Like A UNIX Guru

Tag:tepezcuintle @ 21:53

How To Look Like A UNIX Guru
Terence Parr

Last updated: September 7, 2005

UNIX is an extremely popular platform for deploying server software partly because of its security and stability, but also because it has a rich set of command line and scripting tools. Programmers use these tools for manipulating the file system, processing log files, and generally automating as much as possible.

If you want to be a serious server developer, you will need to have a certain facility with a number of UNIX tools; about 15. You will start to see similarities among them, particularly regular expressions, and soon you will feel very comfortable. Combining the simple commands, you can build very powerful tools very quickly–much faster than you could build the equivalent functionality in C or Java, for example.

Continua”How To Look Like A UNIX Guru”


Feb 10 2006

Detecting Root Kits with Rootcheck

Tag:tepezcuintle @ 20:57

Here we go again with another article about rootkits.

How do you know if you server has been hacked or not?

you can find out with the help fo root kit scanners. :)

Rootkit scanners help you to find rootkits or detect their presence. Probably you are familiar
with chkrootkit and rkhunter, they are good tools to scan your Linux system for rootkit activity.

If you are not aware of those tools google them or search for them on this blog.

Browsing the web I came across another toolcalled rootcheck and I found it on this site.

http://www.webhostgear.com/164.html

So after reading the above guide I am going to show you how to scan your server using rootcheck to
scan your computer for signs of tampering.

Let’s try to do it on one of our servers here at work.

Continua”Detecting Root Kits with Rootcheck”


Next Page »