DWIKI - User contributions [en]

Zabbix tags

2026-06-12T14:48:54Z

Tony: /* component: */

=Links=
*[ https://www.zabbix.com/documentation/current/en/manual/config/tagging Tagging]
=Items=
*[https://www.zabbix.com/documentation/guidelines/en/thosts/configuration/template_items#tags Item tags]

==component:==
{| class="wikitable"
|+ Component tags
! Value !! Description !! Example
|-
| application || app
|-
| business || internal information || number of company branches
|-
| cpu || cpu
|-
| device || A device || Disk, ether port, fan?
|-
| environment || ??
|-
| health || health || alive?
|-
| interface || Network interface
|-
| memory || memory
|-
| network || xx
|-
| power || W
|-
| process || like proc.num ||
|-
| storage || sto
|-
| os || os
|-
| system || low-level and system metrics not related to OS, unless a more specific component is defined || serial number, uptime, proc.num
|-
| raw || technical metric || master item
|-
| kpi || internal information || monthly returned customers
|-
| sensor || internal information || pressure in a column still
|}

===Custom tags===
{| class="wikitable"
|+ Other useful item tags
|-
! Name !! Description !! Example
|-
| interface || network interface || speed, traffic, mac address
|-
| Example || Example || Example
|-
| Example || Example || Example
|}

=Triggers=
* [https://www.zabbix.com/documentation/guidelines/en/thosts/configuration/template_triggers#trigger-tags Trigger tags]

=Templates=
* [https://www.zabbix.com/documentation/guidelines/en/thosts/configuration/templates#tags Template tags]

[[Category:Zabbix]]

Zabbix tags

2026-06-12T14:45:42Z

Tony: /* component: */

=Links=
*[ https://www.zabbix.com/documentation/current/en/manual/config/tagging Tagging]
=Items=
*[https://www.zabbix.com/documentation/guidelines/en/thosts/configuration/template_items#tags Item tags]

==component:==
{| class="wikitable"
|+ Component tags
! Value !! Description !! Example
|-
| application || app
|-
| business || internal information || number of company branches
|-
| cpu || cpu
|-
| device || A device || Disk, ether port, fan?
|-
| environment || ??
|-
| health || health || alive?
|-
| interface || Network interface
|-
| memory || memory
|-
| network || xx
|-
| power || W
|-
| storage || sto
|-
| os || os
|-
| system || low-level and system metrics not related to OS, unless a more specific component is defined || serial number, uptime, proc.num
|-
| raw || technical metric || master item
|-
| kpi || internal information || monthly returned customers
|-
| sensor || internal information || pressure in a column still
|}

===Custom tags===
{| class="wikitable"
|+ Other useful item tags
|-
! Name !! Description !! Example
|-
| interface || network interface || speed, traffic, mac address
|-
| Example || Example || Example
|-
| Example || Example || Example
|}

=Triggers=
* [https://www.zabbix.com/documentation/guidelines/en/thosts/configuration/template_triggers#trigger-tags Trigger tags]

=Templates=
* [https://www.zabbix.com/documentation/guidelines/en/thosts/configuration/templates#tags Template tags]

[[Category:Zabbix]]

Zabbix

2026-06-12T13:39:18Z

Tony:

= Links =

*[http://www.zabbix.org/ Homepage]
*[https://zabbix.org/wiki/Docs/DB_schema/4.0 zabbix 4 database schema]
*[https://www.zabbix.com/documentation/current/en/manual/appendix/compatibility Zabbix compatibility matrix]
*[https://www.digitalocean.com/community/tutorials/introduction-to-queries-mysql https://www.digitalocean.com/community/tutorials/introduction-to-queries-mysql]
*[http://zabbix.org/wiki/Compilation_instructions compilation instructions]
*[http://www.zabbix.com/documentation Documentation]
*[https://dev.mysql.com/doc/mysql-tutorial-excerpt/8.0/en/examples.html Examples of Common Queries]
*[http://zabbixzone.com/zabbix/easy-update-on-custom-scripts/ Custom scripts]
*[https://github.com/q1x/zabbix-gnomes Various scripts to automate tasks in Zabbix]
*[https://www.percona.com/blog/2014/11/14/optimizing-mysql-zabbix/ Tuning mysql for zabbix]
*[https://huyabbix.com https://huyabbix.com]
*[http://techblog.procurios.nl/k/n618/news/view/56429/14863/how-to-migrate-mysql-databases-without-downtime.html Migrating zabbix database with minimal downtime]
*[https://support.zabbix.com/browse/ZBX/ Zabbix Bug tracker]
*[http://www.michaelfoster82.co.uk/zabbix-database-cleanup-delete-old-data/ Clean up database]
*[https://linux.die.net/man/8/zabbix_selinux Zabbix and selinux]
*[https://github.com/a-schild/zabbix-ssl Apache/SSL checks]
*[[Zabbix_on_RHEL/Centos|Zabbix on RHEL/Centos]]
*[[Grafana|Grafana]]
*[https://blog.zabbix.com/zabbix-ha-cluster-setups/8264/ https://blog.zabbix.com/zabbix-ha-cluster-setups/8264/] Zabbix HA cluster]
*[https://blog.zabbix.com/zabbix-agent-active-vs-passive/9207/ Active vs Passive]
*[https://blog.zabbix.com/fighting-notification-floods-and-misleading-alerts-in-distributed-zabbix-deployments/11600/ Fighting zabbix alert floods]
*[https://github.com/unioslo/zabbix-cli zabbix-cli]

=Documentation=
==Triggers==
*[https://www.zabbix.com/documentation/current/en/manual/appendix/functions Trigger functions]
Function str() searches for substrings

==AND OR case==
not, and and or operators are case-sensitive and must be in lowercase. They also must be surrounded by spaces or parentheses.

==Installing zabbix==
*[https://www.zabbix.com/download Download and install zabbix]
*[https://repo.zabbix.com/ Zabbix repositories]
*[https://wiki.gentoo.org/wiki/User:MalakymR/Zabbix Zabbix on Gentoo]

== Installing Zabbix from git ==

git clone [https://github.com/zabbix/zabbix.git https://github.com/zabbix/zabbix.git]
cd zabbix
./bootstrap.sh
./configure --help
autoreconf -fvi

If you don't have a Makefile, try
./config.status Makefile
and then
./configure
again

== Zabbix API ==

*[https://www.zabbix.com/documentation/current/manual/api The Zabbix API]
*[https://www.zabbix.com/integrations/python API and python]

===FAQ===
====Error: Zabbix API library must be installed.====
It wants the OTHER zabbix API, so
pip install zabbix-api

==Zabbix agent paths==
===Ubuntu===
/etc/zabbix/zabbix_agentd.conf.d/
/etc/zabbix/zabbix_agentd.conf

===Ubuntu 24.04===
/etc/zabbix/zabbix_agentd.d

==Simple check==
*[https://www.zabbix.com/documentation/6.4/en/manual/config/items/itemtypes/simple_checks Simple checks]

==Zabbix and SNMP==
===Links===
*[https://www.zabbix.com/integrations/snmp#interfaces_snmp Interfaces by SNMP]
*[https://www.zabbix.com/documentation/5.0/en/manual/discovery/low_level_discovery/snmp_oids Discovery of SNMP OIDs]

On proxy/server:
apt install snmp-mibs-downloader
download-mibs

*[https://bestmonitoringtools.com/tutorial-snmp-traps-on-zabbix/ Zabbix SNMP Traps: A Step-by-Step Guide]

==External check==
*[https://www.zabbix.com/documentation/current/en/manual/config/items/itemtypes/external External checks]
Scripts usually in '''/usr/lib/zabbix/externalscripts/'''

==Tagging==
* [https://www.zabbix.com/documentation/guidelines/en/thosts/configuration/template_items#tags Item tags]
* [https://www.zabbix.com/documentation/guidelines/en/thosts/configuration/templates#tag-name-and-value-format Template tags]

==Web monitoring==
* https://www.zabbix.com/documentation/current/en/manual/web_monitoring

= Tools =
==zabbix_get==

= Zabbix error codes =

== Z3005 ==

Database issue

= Zabbix Items =
[https://www.zabbix.com/documentation/6.0/en/manual/config/items/itemtypes/zabbix_agent Agent item keys]
==Item dialog==
*[https://www.zabbix.com/documentation/5.4/en/manual/config/items/item Item documentation]
*[https://www.zabbix.com/documentation/5.4/en/manual/config/items/itemtypes/zabbix_agent Zabbix agent items]
===Type of information===
====Numeric(unsigned)====
====Character====
character (string) data limited to 255 bytes
====Text====
Text of any size

===Units===

*B
*uptime
*unixtime
*s

== proc.mem ==
*[https://www.zabbix.com/documentation/current/en/manual/config/items/itemtypes/zabbix_agent#proc.mem zabbix agent proc.mem]

proc.mem[<name>,<user>,<mode>,<cmdline>,<memtype>]

=== name ===
process name

=== cmdline ===

regex like php-fpm:

===memtype===
On linux default is vsize (VmSize)
*[https://www.zabbix.com/documentation/5.0/en/manual/appendix/items/proc_mem_notes Notes on proc.mem memtypes]

==proc.num==
*[https://www.zabbix.com/documentation/current/en/manual/config/items/itemtypes/zabbix_agent#proc.num proc.num]
===Get proc.num of java process===
proc.num[java,,,mongodb]

==Item preprocessing==
===Preprocessing regular expressions===
See [https://www.zabbix.com/documentation/current/en/manual/regular_expressions#example Regular expressions: example]

===XML/xpath preprocessing===
https://blog.zabbix.com/zabbix-xpath-preprocessing/7936/

NOTE xq -x does not want the number() bit

===Incorrect value for field "Prev. time": a relative time is expected.===
Prev. Time should be something like
now-30s

===Monitoring incremental/counters===
Preprocessing -> Change per second

==Windows performance counters==
https://www.zabbix.com/documentation/current/en/manual/config/items/perfcounters

= Templates =
*[https://www.zabbix.com/integrations?cat=official_templates Zabbix Offical Templates]
*[https://github.com/zabbix/community-templates/ Community templates]

==Template App MySQL==
https://github.com/tiramiseb/zabbix-templates/blob/master/Template%20App%20MySQL.txt
TODO shouldn't this be user zabbix?

mysql user account:
create user 'monitor'@'localhost' identified by auth_socket;
grant PROCESS,SHOW DATABASES,SHOW VIEW on *.* to 'monitor'@'localhost';
flush privileges;

==Monitoring sensors==
Template https://github.com/blind-oracle/zabbix-sensors for sensors discovery.
See also https://www.zabbix.com/documentation/current/en/manual/appendix/items/sensor

= Configuration =

== Zabbix agent active ==

=== On client ===
Have port 10051 open and:
ActiveServer zabbix.ser.ver

=== On server ===

Set Agent IP to 0.0.0.0

 
=Zabbix and SQL=
==Find hosts with hostmacro defined==
select h.host, m.macro, m.value from hosts h, hostmacro m where macro like '%FOO%' and h.hostid = m.hostid;

==most frequent items in history_uint==
select itemid,count(itemid) as freq from history_uint group by itemid order by freq desc limit 5;

and then
select name from items where itemid = whateveryoufind;

= HOWTO =
==Mysql command line==
===Use custom variables===
set @foo=12;
select * from items where id < @foo;

==Useful queries==
===Find most items filling up history===
SELECT itemid, count(*) AS cnt FROM history GROUP BY itemid ORDER BY cnt DESC limit 30;

===Find host and item by itemid===
select h.name,i.hostid,i.name from hosts h,items i where i.itemid = 212624 and i.hostid = h.hostid;

==Define discovery filters==

== LLD with JSON ==
*[https://blog.zabbix.com/low-level-discovery-with-dependent-items/13634/ LLD with JSON and dependent items]
*https://www.zabbix.com/forum/zabbix-help/383827-json-and-lld-understanding
*https://www.zabbix.com/forum/zabbix-troubleshooting-and-problems/456663-lld-macros-with-json

if you want multiple keys, use jsonpath like
$[?(@.share=='{#FSTYPE}' && @.name=='{#NAME}')].size.first()
===testing jsonpath preprocessing===
In Value paste valid json, then name {#NAME} value somevalue

== Test trapper ==

==Reset admin password==
Mysql prompt:
select * from user where username='Admin';
bcrypt your new password:
htpasswd -nbBC 10 USER YOURPASSWORD|awk -F ':' '{ print $2 }'
Mysql prompt:
update user set passwd = 'your bcrypted pass' where userid = 1

==Zabbix and PSK==
See:
*[https://www.zabbix.com/documentation/5.2/en/manual/encryption/using_pre_shared_keys Using pre-shared keys]

==Updating multiple triggers/alerts==
Select them via '''Monitoring->Problems'''

==Testing javascript==
zabbix_js

==Zabbix maps==
* [https://www.zabbix.com/documentation/8.0/en/manual/config/visualization/maps/map maps]
===Add link===
"Two map elements should be selected"
Select one, hold control and select the other

= FAQ =
==macro naming convention==
{$SOME.NAME} is better than {$SOME_NAME}

==cannot convert value to numeric type==
Some javascript :)

==Failed: cannot calculate delta (speed per second) for value of type "none"==
In preprocessing use Javascript to
if ( "" == value ) { return 0; } else { return value; }

==Handling division by zero==
In preprocessing find "Check for not supported", "error matches" and add "division by zero"

==zabbix[proxy_buffer,state,current] not supported==
Zabbix proxy must be monitored by itself, not by server

==What is this "$1" in item name?==
In older versions of zabbix this was first parameter of key, use the macros like {#SNMPVALUE}, {#FSNAME}, or {#IFNAME} now

==Locations of Userparameters==
===Ubuntu===
/etc/zabbix/agentd.d/

==What takes most space in the database?==
*[https://blog.zabbix.com/what-takes-disk-space/13349/ What takes disk space]

==forced reloading of the snmp cache==
looks like nothing to worry about

==Where is last userid stored?==
ids:
table_name: users
field_name: userid
nextid: the next id

== SERVER ==
==Which items using most data in database?==
*[https://serverfault.com/questions/749397/zabbix-determine-what-item-checks-are-responsible-for-storing-the-most-data determine what item checks are responsible for storing the most data]

SELECT itemid, count(*) AS cnt FROM history GROUP BY itemid ORDER BY cnt DESC LIMIT 20;
or maybe
SELECT h.itemid, i.name, count(*) AS cnt FROM history h, items i where h.itemid = i.itemid GROUP BY itemid ORDER BY cnt DESC limit 20;
=== Adjust loglevel ===

zabbix_server --runtime-control log_level_increase=trapper

 

=== Reload zabbix server configuration ===

You can't, but you might want

zabbix_server -c /etc/zabbix/zabbix_server.conf -R config_cache_reload

 

=== No media defined for user ===

=== The frontend does not match Zabbix database. ===

Probably version conflict between frontend and server

 

=== value cache working in low memory mode ===

Increase ValueCacheSize

=== Message from 1.2.3.4 is missing header. Message ignored. ===
 

 

== PROXY ==

[[ Zabbix Proxy ]]

===cannot send proxy data to server===
empty string received

===failed to update local proxy configuration copy: unexpected field "host_inventory.type"===

== Front end ==

===Round numbers===
Preprocessing javascript
2 decimals:
return Math.round(value* 100) / 100
0 decimals:
return Math.round(value)

=== Visable name vs hostname ===

Visible name: {HOST.NAME}

Hostname: {HOST.HOST}

Host IP: (as defined in Interface->IP/DNS) {HOST.CONN}

=== Acknowledge multiple items ===

Monitor->Problems apply filters, select all, mass update

=== No permissions to referred object or it does not exist! ===

Graph no longer exists. Probably items no longer discovered

Maybe you've been editing a template file, remember to replace template name everywhere

=== Cannot add host ===

??
===match for value of type "none": pattern does not match===
Agent returning empty string?

== Monitoring SNMP ==
===Cannot find module (IF-MIB): At line 1 in (none)===
apt install snmp-mibs-downloader
and restart zabbix-proxy

=== Cannot find host interface on "xxxhost" for item key foo ===

Might mean you're trying to import an SNMP template before configuring SNMP for the host

 

 

=== No SNMP data ===

=== snmp_parse_oid(): cannot parse OID "IF-MIB::ifSpeed.3 ===

===Timeout while connecting===
Could be wrong community string, remember delay when using proxy.

== Agent side ping check ==

UserParameter=pingtime[*],fping -e $1|sed 's/^.*($[0-9].*$ ms).*$/\1/g'
UserParameter=pingalive[*],fping $1|grep -q alive;echo $?

 

 

==LLD/Discovery==
=== Discover: value must be a JSON object ===

Could mean you need to escape slashes, check output with zabbix_get

===Cannot create item: item with the same key already exists===
make sure the key contains "{#SOMENAME}"

== Discovery data example ==

Output of a discovery script should look like:

{"data":[
{"{#VAR1}":"value11","#{VAR2":"value12"},
{"{#VAR1}":"value21","#{VAR2":"value22"}
]}

== IPMI ==

=== IPMI Monitoring account for zabbix ===

[https://www.thomas-krenn.com/en/wiki/Configuring_IPMI_under_Linux_using_ipmitool https://www.thomas-krenn.com/en/wiki/Configuring_IPMI_under_Linux_using_ipmitool]

ipmitool user set name 3 monitor
ipmitool user set password 3
ipmitool channel setaccess 1 3 link=on ipmi=on callin=on privilege=2
ipmitool user enable 3

To test these:
ipmitool -I lanplus -H <host> -L USER -U monitor sdr elist full

===Zabbix credentials===
====Privilege Level====
User

====Authentication algorithm====
Default
but what is that?

=== cannot connect to IPMI host: [22] Operation canceled ===

Usually temporary because of broken ipmi lib, ignore it

 

=== cannot connect to IPMI host: [16777411] Unknown error 16777411 ===

classic, probably authentication problem

=== cannot connect to IPMI host: [22] Invalid argument ===
wrong password/credentials?

===IPMI pollers are disabled in configuration===
Check
StartIPMIPollers
in server/proxy configuration

=== Cannot connect to IPMI host: [2] No such file or directory===
??

== zabbix_sender ==

=== processed: 0; failed: 1 ===

Possible causes:

*incorrect hostname
*incorrect item key
*item not in the server configuration cache yet
*Allowed hosts in trapper item
*phase of moon
*aliens

 

=== Testing zabbix_sender ===

zabbix_sender stuff

== Filters ==

The regular expressions referred to in discovery are found under Administration->General, and then "Regular expressions" in the dropdown at top right of the page

=== cannot connect to IPMI host: [125] Operation canceled ===

possibly authentication method issue

 
== Calculated items ==
See [https://blog.zabbix.com/zabbix-monitoring-with-calculated-items-explained/9950/ Calculated items explained]
=== Cannot create item: Invalid first parameter ===
For calculated items use last("youritemkey")

=== Cannot create item, error in formula ===
Problably a calculated item, try doublequoting the item key:

last("foo[bar]")

===Invalid parameter "/1/params"===
Maybe forgot to use last()?
You might need to doublequote your items, or prepend with double slashes

== Reset trigger/alert ==
For example when you changed the settings
Just disable, wait a bit and enable again.
== Install recent zabbix on CentOS/RHEL ==

rpm -ivh [https://repo.zabbix.com/zabbix/3.4/rhel/7/x86_64/zabbix-release-3.4-2.el7.noarch.rpm https://repo.zabbix.com/zabbix/3.4/rhel/7/x86_64/zabbix-release-3.4-2.el7.noarch.rpm]
yum install zabbix-agent

== Backing up tables ==

[https://www.zabbix.org/wiki/Docs/howto/mysql_backup_script https://www.zabbix.org/wiki/Docs/howto/mysql_backup_script]

 

== cannot send list of active checks ==
Verify hostname:
/usr/sbin/zabbix_agentd -t 'agent.hostname'

If in agent log: most likely ServerActive is defined in agent config, while not used at all

It is also possible agent is sending some active check to server while host is monitored via proxy.

In proxy/server log:
most likely '''Hostname''' in agent config does not match hostname used on server.

==cannot send list of active checks to "127.0.0.1": host [Zabbix server] not found==
??

== active check configuration update started to fail ==

??

== Latest 20 issues ==

DEFAULT_LATEST_ISSUES_CNT in/usr/share/zabbix/include/defines.inc.php

 

== Zabbix unreachable poller processes more than 75% busy ==

Increase '''StartPollersUnreachable'''

 

== Zabbix poller processes more than 75% busy ==

Maybe StartPollersUnreachable?

== More than 100 items having missing data for more than 10 minutes ==

Could be high load. Also check Administration->Queue

== Zabbix escalator processes more than 75% busy ==

probably high system load overall

== Check agent ==

zabbix_get -s my.host.com -k agent.version

== ZBX_NOTSUPPORTED ==

Could be anything, enable logging on agent. It could be version mismatch. Check

zabbix_get -s yourhost -k agent.version

If that works, you're calling for an undefined or unsupported key.

== Incorrect trigger expression. Host "xx" does not exist or you have no access to this host. ==

Means there's no related item.

== zabbix_get returns nothing ==

best look at log on agent side

== run playbook on single host ==

ansible_playbook -l somehost somplay.yml

[[:Category:Monitoring]]

 

== Zabbix server is not running: the information displayed may not be current ==

Might be selinux: [http://sysads.co.uk/2013/11/zabbix-server-running-alert/ http://sysads.co.uk/2013/11/zabbix-server-running-alert/]

 

 

 

== Monitoring vmware ==

=== vmware.hv.cpu.usage[{$URL},{HOST.HOST}]" became not supported: Couldn't resolve host name ===

Set macro {$URL} to [https://your.ip/sdk/ https://your.ip/sdk/] (shouldn't discovery figure that out from {$HOST} ?

=== Couldn't resolve host name ===

Sometimes it's a matter of waiting a few hours

 

=== vmware events collector returned empty result ===

???

=== No "vmware collector" processes started. ===

Check StartVMwareCollectors on server or proxy

 

== unsupported item key ==

This might mean it's expecting a value from the script you're calling.

echo 1
remember: not supported is not disabled, server/proxy will try again after interval

=== became not supported: Not supported by Zabbix Agent ===

probably output by userparameter/script

== ansible or API not showing host groups ==

Permissions!! See Administration->User Groups

 

== failed to update local proxy configuration copy: invalid field name "items.lastlogsize" ==

check everything :)

== Received value [11] is not suitable for value type [Numeric (unsigned)] and data type [Decimal] ==

This probably means the agent returned 1\n1

 

== database is down: retrying in 10 seconds ==

try upping max_connections

== [Incorrect key file for table 'items'; try to repair it ==

Could be something /tmp related

 

 

== another network error, wait for 8 seconds ==

'''UnreachableDelay'''=8

 

== failed: first network error, wait for XY seconds ==

Waits for UnreachableDelay seconds before trying again

Loglevel LOG_LEVEL_WARNING

== no active checks on server ==
*Hostname in agent config (-kagent.hostname) must match name on server
*simple no connection possible? firewall?
*maybe the host was configured to be monitored by (another) proxy?

== show cpu utilization ==

Monitoring->host->graphs

===fuzzytime on command line===
TS=lotsofseconds
#output in hours
echo $(( ($(date +%s) - $TS) / 3600 ))

==duplicate entry adding user/group==
Check table 'ids'

==Troubleshooting==
===zabbix_get: no route to host===
Check the firewall

=Error messages=
==Error: Zabbix API library must be installed==
pip install zabbix_utils
OR
pip install zabbix-api

==Get value from agent failed: cannot connect to [[xx]:10050]: [4] Interrupted system call==
Check firewall?

==connection error (POLLERR,POLLHUP)==
probably firewall

==Agent error messages==
===unspecified certificate verification error: TLS handshake set result code to 5:===
Try restarting agent.

==zabbix : problem with defaults entries ==
Could be sudo/resolving problem

[[Category:Monitoring]]
[[Category:Zabbix]]

Zabbix

2026-06-12T13:27:37Z

Tony: /* proc.num */

= Links =

*[http://www.zabbix.org/ Homepage]
*[https://zabbix.org/wiki/Docs/DB_schema/4.0 zabbix 4 database schema]
*[https://www.zabbix.com/documentation/current/en/manual/appendix/compatibility Zabbix compatibility matrix]
*[https://www.digitalocean.com/community/tutorials/introduction-to-queries-mysql https://www.digitalocean.com/community/tutorials/introduction-to-queries-mysql]
*[http://zabbix.org/wiki/Compilation_instructions compilation instructions]
*[http://www.zabbix.com/documentation Documentation]
*[https://dev.mysql.com/doc/mysql-tutorial-excerpt/8.0/en/examples.html Examples of Common Queries]
*[http://zabbixzone.com/zabbix/easy-update-on-custom-scripts/ Custom scripts]
*[https://github.com/q1x/zabbix-gnomes Various scripts to automate tasks in Zabbix]
*[https://www.percona.com/blog/2014/11/14/optimizing-mysql-zabbix/ Tuning mysql for zabbix]
*[https://huyabbix.com https://huyabbix.com]
*[http://techblog.procurios.nl/k/n618/news/view/56429/14863/how-to-migrate-mysql-databases-without-downtime.html Migrating zabbix database with minimal downtime]
*[https://support.zabbix.com/browse/ZBX/ Zabbix Bug tracker]
*[http://www.michaelfoster82.co.uk/zabbix-database-cleanup-delete-old-data/ Clean up database]
*[https://linux.die.net/man/8/zabbix_selinux Zabbix and selinux]
*[https://github.com/a-schild/zabbix-ssl Apache/SSL checks]
*[[Zabbix_on_RHEL/Centos|Zabbix on RHEL/Centos]]
*[[Grafana|Grafana]]
*[https://blog.zabbix.com/zabbix-ha-cluster-setups/8264/ https://blog.zabbix.com/zabbix-ha-cluster-setups/8264/] Zabbix HA cluster]
*[https://blog.zabbix.com/zabbix-agent-active-vs-passive/9207/ Active vs Passive]
*[https://blog.zabbix.com/fighting-notification-floods-and-misleading-alerts-in-distributed-zabbix-deployments/11600/ Fighting zabbix alert floods]
*[https://github.com/unioslo/zabbix-cli zabbix-cli]

=Documentation=
==Triggers==
*[https://www.zabbix.com/documentation/current/en/manual/appendix/functions Trigger functions]
Function str() searches for substrings

==AND OR case==
not, and and or operators are case-sensitive and must be in lowercase. They also must be surrounded by spaces or parentheses.

==Installing zabbix==
*[https://www.zabbix.com/download Download and install zabbix]
*[https://repo.zabbix.com/ Zabbix repositories]
*[https://wiki.gentoo.org/wiki/User:MalakymR/Zabbix Zabbix on Gentoo]

== Installing Zabbix from git ==

git clone [https://github.com/zabbix/zabbix.git https://github.com/zabbix/zabbix.git]
cd zabbix
./bootstrap.sh
./configure --help
autoreconf -fvi

If you don't have a Makefile, try
./config.status Makefile
and then
./configure
again

== Zabbix API ==

*[https://www.zabbix.com/documentation/current/manual/api The Zabbix API]
*[https://www.zabbix.com/integrations/python API and python]

===FAQ===
====Error: Zabbix API library must be installed.====
It wants the OTHER zabbix API, so
pip install zabbix-api

==Zabbix agent paths==
===Ubuntu===
/etc/zabbix/zabbix_agentd.conf.d/
/etc/zabbix/zabbix_agentd.conf

===Ubuntu 24.04===
/etc/zabbix/zabbix_agentd.d

==Simple check==
*[https://www.zabbix.com/documentation/6.4/en/manual/config/items/itemtypes/simple_checks Simple checks]

==Zabbix and SNMP==
===Links===
*[https://www.zabbix.com/integrations/snmp#interfaces_snmp Interfaces by SNMP]
*[https://www.zabbix.com/documentation/5.0/en/manual/discovery/low_level_discovery/snmp_oids Discovery of SNMP OIDs]

On proxy/server:
apt install snmp-mibs-downloader
download-mibs

*[https://bestmonitoringtools.com/tutorial-snmp-traps-on-zabbix/ Zabbix SNMP Traps: A Step-by-Step Guide]

==External check==
*[https://www.zabbix.com/documentation/current/en/manual/config/items/itemtypes/external External checks]
Scripts usually in '''/usr/lib/zabbix/externalscripts/'''

==Tagging==
* [https://www.zabbix.com/documentation/guidelines/en/thosts/configuration/template_items#tags Item tags]
* [https://www.zabbix.com/documentation/guidelines/en/thosts/configuration/templates#tag-name-and-value-format Template tags]

==Web monitoring==
* https://www.zabbix.com/documentation/current/en/manual/web_monitoring

= Zabbix error codes =

== Z3005 ==

Database issue

= Zabbix Items =
[https://www.zabbix.com/documentation/6.0/en/manual/config/items/itemtypes/zabbix_agent Agent item keys]
==Item dialog==
*[https://www.zabbix.com/documentation/5.4/en/manual/config/items/item Item documentation]
*[https://www.zabbix.com/documentation/5.4/en/manual/config/items/itemtypes/zabbix_agent Zabbix agent items]
===Type of information===
====Numeric(unsigned)====
====Character====
character (string) data limited to 255 bytes
====Text====
Text of any size

===Units===

*B
*uptime
*unixtime
*s

== proc.mem ==
*[https://www.zabbix.com/documentation/current/en/manual/config/items/itemtypes/zabbix_agent#proc.mem zabbix agent proc.mem]

proc.mem[<name>,<user>,<mode>,<cmdline>,<memtype>]

=== name ===
process name

=== cmdline ===

regex like php-fpm:

===memtype===
On linux default is vsize (VmSize)
*[https://www.zabbix.com/documentation/5.0/en/manual/appendix/items/proc_mem_notes Notes on proc.mem memtypes]

==proc.num==
*[https://www.zabbix.com/documentation/current/en/manual/config/items/itemtypes/zabbix_agent#proc.num proc.num]
===Get proc.num of java process===
proc.num[java,,,mongodb]

==Item preprocessing==
===Preprocessing regular expressions===
See [https://www.zabbix.com/documentation/current/en/manual/regular_expressions#example Regular expressions: example]

===XML/xpath preprocessing===
https://blog.zabbix.com/zabbix-xpath-preprocessing/7936/

NOTE xq -x does not want the number() bit

===Incorrect value for field "Prev. time": a relative time is expected.===
Prev. Time should be something like
now-30s

===Monitoring incremental/counters===
Preprocessing -> Change per second

==Windows performance counters==
https://www.zabbix.com/documentation/current/en/manual/config/items/perfcounters

= Templates =
*[https://www.zabbix.com/integrations?cat=official_templates Zabbix Offical Templates]
*[https://github.com/zabbix/community-templates/ Community templates]

==Template App MySQL==
https://github.com/tiramiseb/zabbix-templates/blob/master/Template%20App%20MySQL.txt
TODO shouldn't this be user zabbix?

mysql user account:
create user 'monitor'@'localhost' identified by auth_socket;
grant PROCESS,SHOW DATABASES,SHOW VIEW on *.* to 'monitor'@'localhost';
flush privileges;

==Monitoring sensors==
Template https://github.com/blind-oracle/zabbix-sensors for sensors discovery.
See also https://www.zabbix.com/documentation/current/en/manual/appendix/items/sensor

= Configuration =

== Zabbix agent active ==

=== On client ===
Have port 10051 open and:
ActiveServer zabbix.ser.ver

=== On server ===

Set Agent IP to 0.0.0.0

 
=Zabbix and SQL=
==Find hosts with hostmacro defined==
select h.host, m.macro, m.value from hosts h, hostmacro m where macro like '%FOO%' and h.hostid = m.hostid;

==most frequent items in history_uint==
select itemid,count(itemid) as freq from history_uint group by itemid order by freq desc limit 5;

and then
select name from items where itemid = whateveryoufind;

= HOWTO =
==Mysql command line==
===Use custom variables===
set @foo=12;
select * from items where id < @foo;

==Useful queries==
===Find most items filling up history===
SELECT itemid, count(*) AS cnt FROM history GROUP BY itemid ORDER BY cnt DESC limit 30;

===Find host and item by itemid===
select h.name,i.hostid,i.name from hosts h,items i where i.itemid = 212624 and i.hostid = h.hostid;

==Define discovery filters==

== LLD with JSON ==
*[https://blog.zabbix.com/low-level-discovery-with-dependent-items/13634/ LLD with JSON and dependent items]
*https://www.zabbix.com/forum/zabbix-help/383827-json-and-lld-understanding
*https://www.zabbix.com/forum/zabbix-troubleshooting-and-problems/456663-lld-macros-with-json

if you want multiple keys, use jsonpath like
$[?(@.share=='{#FSTYPE}' && @.name=='{#NAME}')].size.first()
===testing jsonpath preprocessing===
In Value paste valid json, then name {#NAME} value somevalue

== Test trapper ==

==Reset admin password==
Mysql prompt:
select * from user where username='Admin';
bcrypt your new password:
htpasswd -nbBC 10 USER YOURPASSWORD|awk -F ':' '{ print $2 }'
Mysql prompt:
update user set passwd = 'your bcrypted pass' where userid = 1

==Zabbix and PSK==
See:
*[https://www.zabbix.com/documentation/5.2/en/manual/encryption/using_pre_shared_keys Using pre-shared keys]

==Updating multiple triggers/alerts==
Select them via '''Monitoring->Problems'''

==Testing javascript==
zabbix_js

==Zabbix maps==
* [https://www.zabbix.com/documentation/8.0/en/manual/config/visualization/maps/map maps]
===Add link===
"Two map elements should be selected"
Select one, hold control and select the other

= FAQ =
==macro naming convention==
{$SOME.NAME} is better than {$SOME_NAME}

==cannot convert value to numeric type==
Some javascript :)

==Failed: cannot calculate delta (speed per second) for value of type "none"==
In preprocessing use Javascript to
if ( "" == value ) { return 0; } else { return value; }

==Handling division by zero==
In preprocessing find "Check for not supported", "error matches" and add "division by zero"

==zabbix[proxy_buffer,state,current] not supported==
Zabbix proxy must be monitored by itself, not by server

==What is this "$1" in item name?==
In older versions of zabbix this was first parameter of key, use the macros like {#SNMPVALUE}, {#FSNAME}, or {#IFNAME} now

==Locations of Userparameters==
===Ubuntu===
/etc/zabbix/agentd.d/

==What takes most space in the database?==
*[https://blog.zabbix.com/what-takes-disk-space/13349/ What takes disk space]

==forced reloading of the snmp cache==
looks like nothing to worry about

==Where is last userid stored?==
ids:
table_name: users
field_name: userid
nextid: the next id

== SERVER ==
==Which items using most data in database?==
*[https://serverfault.com/questions/749397/zabbix-determine-what-item-checks-are-responsible-for-storing-the-most-data determine what item checks are responsible for storing the most data]

SELECT itemid, count(*) AS cnt FROM history GROUP BY itemid ORDER BY cnt DESC LIMIT 20;
or maybe
SELECT h.itemid, i.name, count(*) AS cnt FROM history h, items i where h.itemid = i.itemid GROUP BY itemid ORDER BY cnt DESC limit 20;
=== Adjust loglevel ===

zabbix_server --runtime-control log_level_increase=trapper

 

=== Reload zabbix server configuration ===

You can't, but you might want

zabbix_server -c /etc/zabbix/zabbix_server.conf -R config_cache_reload

 

=== No media defined for user ===

=== The frontend does not match Zabbix database. ===

Probably version conflict between frontend and server

 

=== value cache working in low memory mode ===

Increase ValueCacheSize

=== Message from 1.2.3.4 is missing header. Message ignored. ===
 

 

== PROXY ==

[[ Zabbix Proxy ]]

===cannot send proxy data to server===
empty string received

===failed to update local proxy configuration copy: unexpected field "host_inventory.type"===

== Front end ==

===Round numbers===
Preprocessing javascript
2 decimals:
return Math.round(value* 100) / 100
0 decimals:
return Math.round(value)

=== Visable name vs hostname ===

Visible name: {HOST.NAME}

Hostname: {HOST.HOST}

Host IP: (as defined in Interface->IP/DNS) {HOST.CONN}

=== Acknowledge multiple items ===

Monitor->Problems apply filters, select all, mass update

=== No permissions to referred object or it does not exist! ===

Graph no longer exists. Probably items no longer discovered

Maybe you've been editing a template file, remember to replace template name everywhere

=== Cannot add host ===

??
===match for value of type "none": pattern does not match===
Agent returning empty string?

== Monitoring SNMP ==
===Cannot find module (IF-MIB): At line 1 in (none)===
apt install snmp-mibs-downloader
and restart zabbix-proxy

=== Cannot find host interface on "xxxhost" for item key foo ===

Might mean you're trying to import an SNMP template before configuring SNMP for the host

 

 

=== No SNMP data ===

=== snmp_parse_oid(): cannot parse OID "IF-MIB::ifSpeed.3 ===

===Timeout while connecting===
Could be wrong community string, remember delay when using proxy.

== Agent side ping check ==

UserParameter=pingtime[*],fping -e $1|sed 's/^.*($[0-9].*$ ms).*$/\1/g'
UserParameter=pingalive[*],fping $1|grep -q alive;echo $?

 

 

==LLD/Discovery==
=== Discover: value must be a JSON object ===

Could mean you need to escape slashes, check output with zabbix_get

===Cannot create item: item with the same key already exists===
make sure the key contains "{#SOMENAME}"

== Discovery data example ==

Output of a discovery script should look like:

{"data":[
{"{#VAR1}":"value11","#{VAR2":"value12"},
{"{#VAR1}":"value21","#{VAR2":"value22"}
]}

== IPMI ==

=== IPMI Monitoring account for zabbix ===

[https://www.thomas-krenn.com/en/wiki/Configuring_IPMI_under_Linux_using_ipmitool https://www.thomas-krenn.com/en/wiki/Configuring_IPMI_under_Linux_using_ipmitool]

ipmitool user set name 3 monitor
ipmitool user set password 3
ipmitool channel setaccess 1 3 link=on ipmi=on callin=on privilege=2
ipmitool user enable 3

To test these:
ipmitool -I lanplus -H <host> -L USER -U monitor sdr elist full

===Zabbix credentials===
====Privilege Level====
User

====Authentication algorithm====
Default
but what is that?

=== cannot connect to IPMI host: [22] Operation canceled ===

Usually temporary because of broken ipmi lib, ignore it

 

=== cannot connect to IPMI host: [16777411] Unknown error 16777411 ===

classic, probably authentication problem

=== cannot connect to IPMI host: [22] Invalid argument ===
wrong password/credentials?

===IPMI pollers are disabled in configuration===
Check
StartIPMIPollers
in server/proxy configuration

=== Cannot connect to IPMI host: [2] No such file or directory===
??

== zabbix_sender ==

=== processed: 0; failed: 1 ===

Possible causes:

*incorrect hostname
*incorrect item key
*item not in the server configuration cache yet
*Allowed hosts in trapper item
*phase of moon
*aliens

 

=== Testing zabbix_sender ===

zabbix_sender stuff

== Filters ==

The regular expressions referred to in discovery are found under Administration->General, and then "Regular expressions" in the dropdown at top right of the page

=== cannot connect to IPMI host: [125] Operation canceled ===

possibly authentication method issue

 
== Calculated items ==
See [https://blog.zabbix.com/zabbix-monitoring-with-calculated-items-explained/9950/ Calculated items explained]
=== Cannot create item: Invalid first parameter ===
For calculated items use last("youritemkey")

=== Cannot create item, error in formula ===
Problably a calculated item, try doublequoting the item key:

last("foo[bar]")

===Invalid parameter "/1/params"===
Maybe forgot to use last()?
You might need to doublequote your items, or prepend with double slashes

== Reset trigger/alert ==
For example when you changed the settings
Just disable, wait a bit and enable again.
== Install recent zabbix on CentOS/RHEL ==

rpm -ivh [https://repo.zabbix.com/zabbix/3.4/rhel/7/x86_64/zabbix-release-3.4-2.el7.noarch.rpm https://repo.zabbix.com/zabbix/3.4/rhel/7/x86_64/zabbix-release-3.4-2.el7.noarch.rpm]
yum install zabbix-agent

== Backing up tables ==

[https://www.zabbix.org/wiki/Docs/howto/mysql_backup_script https://www.zabbix.org/wiki/Docs/howto/mysql_backup_script]

 

== cannot send list of active checks ==
Verify hostname:
/usr/sbin/zabbix_agentd -t 'agent.hostname'

If in agent log: most likely ServerActive is defined in agent config, while not used at all

It is also possible agent is sending some active check to server while host is monitored via proxy.

In proxy/server log:
most likely '''Hostname''' in agent config does not match hostname used on server.

==cannot send list of active checks to "127.0.0.1": host [Zabbix server] not found==
??

== active check configuration update started to fail ==

??

== Latest 20 issues ==

DEFAULT_LATEST_ISSUES_CNT in/usr/share/zabbix/include/defines.inc.php

 

== Zabbix unreachable poller processes more than 75% busy ==

Increase '''StartPollersUnreachable'''

 

== Zabbix poller processes more than 75% busy ==

Maybe StartPollersUnreachable?

== More than 100 items having missing data for more than 10 minutes ==

Could be high load. Also check Administration->Queue

== Zabbix escalator processes more than 75% busy ==

probably high system load overall

== Check agent ==

zabbix_get -s my.host.com -k agent.version

== ZBX_NOTSUPPORTED ==

Could be anything, enable logging on agent. It could be version mismatch. Check

zabbix_get -s yourhost -k agent.version

If that works, you're calling for an undefined or unsupported key.

== Incorrect trigger expression. Host "xx" does not exist or you have no access to this host. ==

Means there's no related item.

== zabbix_get returns nothing ==

best look at log on agent side

== run playbook on single host ==

ansible_playbook -l somehost somplay.yml

[[:Category:Monitoring]]

 

== Zabbix server is not running: the information displayed may not be current ==

Might be selinux: [http://sysads.co.uk/2013/11/zabbix-server-running-alert/ http://sysads.co.uk/2013/11/zabbix-server-running-alert/]

 

 

 

== Monitoring vmware ==

=== vmware.hv.cpu.usage[{$URL},{HOST.HOST}]" became not supported: Couldn't resolve host name ===

Set macro {$URL} to [https://your.ip/sdk/ https://your.ip/sdk/] (shouldn't discovery figure that out from {$HOST} ?

=== Couldn't resolve host name ===

Sometimes it's a matter of waiting a few hours

 

=== vmware events collector returned empty result ===

???

=== No "vmware collector" processes started. ===

Check StartVMwareCollectors on server or proxy

 

== unsupported item key ==

This might mean it's expecting a value from the script you're calling.

echo 1
remember: not supported is not disabled, server/proxy will try again after interval

=== became not supported: Not supported by Zabbix Agent ===

probably output by userparameter/script

== ansible or API not showing host groups ==

Permissions!! See Administration->User Groups

 

== failed to update local proxy configuration copy: invalid field name "items.lastlogsize" ==

check everything :)

== Received value [11] is not suitable for value type [Numeric (unsigned)] and data type [Decimal] ==

This probably means the agent returned 1\n1

 

== database is down: retrying in 10 seconds ==

try upping max_connections

== [Incorrect key file for table 'items'; try to repair it ==

Could be something /tmp related

 

 

== another network error, wait for 8 seconds ==

'''UnreachableDelay'''=8

 

== failed: first network error, wait for XY seconds ==

Waits for UnreachableDelay seconds before trying again

Loglevel LOG_LEVEL_WARNING

== no active checks on server ==
*Hostname in agent config (-kagent.hostname) must match name on server
*simple no connection possible? firewall?
*maybe the host was configured to be monitored by (another) proxy?

== show cpu utilization ==

Monitoring->host->graphs

===fuzzytime on command line===
TS=lotsofseconds
#output in hours
echo $(( ($(date +%s) - $TS) / 3600 ))

==duplicate entry adding user/group==
Check table 'ids'

==Troubleshooting==
===zabbix_get: no route to host===
Check the firewall

=Error messages=
==Error: Zabbix API library must be installed==
pip install zabbix_utils
OR
pip install zabbix-api

==Get value from agent failed: cannot connect to [[xx]:10050]: [4] Interrupted system call==
Check firewall?

==connection error (POLLERR,POLLHUP)==
probably firewall

==Agent error messages==
===unspecified certificate verification error: TLS handshake set result code to 5:===
Try restarting agent.

==zabbix : problem with defaults entries ==
Could be sudo/resolving problem

[[Category:Monitoring]]
[[Category:Zabbix]]

Matomo

2026-06-12T09:02:20Z

Tony:

=Links=
*[https://matomo.org/ Matomo Homepage]

=Documentation=
==On Premise==
*[https://matomo.org/faq/on-premise/matomo-core-and-plugin-configuration-files/ Matomo Core and Plugin Configuration files]

=FAQ=
==Error messages==
===Error when connecting to Matomo===
?

Matomo

2026-06-12T07:22:34Z

Tony:

=Links=
*[https://matomo.org/ Matomo Homepage]

=FAQ=
==Error messages==
===Error when connecting to Matomo===
?

WKD

2026-06-11T12:49:56Z

Tony: /* Links */

'''W'''eb '''K'''ey '''D'''irectory

=Links=
*[https://www.webkeydirectory.com/set-up-wkd Set up WKD]

=FAQ=

==The Access-Control-Allow-Origin: * header is needed to allow OpenPGP==

WKD

2026-06-11T12:45:02Z

Tony: Created page with "'''W'''eb '''K'''ey '''D'''irectory =Links= *[https://www.webkeydirectory.com/set-up-wkd Set up WKD] *[ =FAQ= ==The Access-Control-Allow-Origin: * header is needed to allow OpenPGP=="

'''W'''eb '''K'''ey '''D'''irectory

=Links=
*[https://www.webkeydirectory.com/set-up-wkd Set up WKD]
*[

=FAQ=

==The Access-Control-Allow-Origin: * header is needed to allow OpenPGP==

Matomo

2026-06-11T07:58:10Z

Tony: Created page with "=FAQ= ==Error messages== ===Error when connecting to Matomo=== ?"

=FAQ=
==Error messages==
===Error when connecting to Matomo===
?

Bash

2026-06-10T11:49:28Z

Tony: /* Links */

=Links=
*[http://www.gnu.org/software/bash/bash.html Homepage]

*[http://www.linuxdoc.org/HOWTO/Bash-Prog-Intro-HOWTO.html http://www.linuxdoc.org/HOWTO/Bash-Prog-Intro-HOWTO.html]
*[http://en.tldp.org/HOWTO/Bash-Prog-Intro-HOWTO.html Bash Guide for Beginners]
*[http://www.ling.helsinki.fi/users/reriksso/unix/shell.html http://www.ling.helsinki.fi/users/reriksso/unix/shell.html]
*[http://en.tldp.org/LDP/abs/html/ Advanced Bash Scripting Guide]
*[http://www.freeos.com/guides/lsst/ Linux Shell Scripting Tutorial]
*[http://subsignal.org/doc/AliensBashTutorial.html Aliens Bash Tutorial]

*[https://www.cyberciti.biz/faq/bash-shell-change-the-color-of-my-shell-prompt-under-linux-or-unix/ Change colour of bash prompt]

==Keyboard shortcuts==
*[http://teohm.com/blog/shortcuts-to-move-faster-in-bash-command-line/ Shortcuts to move faster in Bash command line]
*[http://www.skorks.com/2009/09/bash-shortcuts-for-maximum-productivity/ http://www.skorks.com/2009/09/bash-shortcuts-for-maximum-productivity/]
*[https://ss64.com/bash/syntax-keyboard.html Bash Keyboard Shortcuts]
*[https://gist.github.com/memphys/2225770 Command Editing Shortcuts]

=HOWTO=
==alias==

= Tips and tricks =

==Check if script is running as root==
if [ $EUID -eq 0 ];then

==Globbing==
===Globbing except strings===
GLOBIGNORE="*.error.log"
===List only dot files===
To show only files or directories with names starting with '.':
ls .?*

== String manipulation ==

=== Remove character from string ===

VERSION='2.3.3'
echo "${VERSION//.}"

=== Replace all characters in a string===
Replace all x,y,z with _:
"${var//+([xyz])/_}"
requires extended pattern matching
shopt -s extglob

=== check if var contains substring ===

if [[ "$foo" =~ ".*sub.*" ]]

=== get first character of a string ===

FIRST=${STRING:0:1}

===Split string to words===
read -ra words <<< "$string"
echo ${words[2]}

== Date manipulation ==
===Age of a file ===
stat -C %Y $FILE

== read without while loop ==

The problem is scope, try

echo foo bar | { read a b;echo $b; }

== check if variable is integer ==

if [[$foo =~ ^[0-9]+$]]

 

 

== move cursor ==

^b move back 1 char
^f move forward 1 char
alt-b move back 1 word
alf-f move forward 1 word

== loops ==

=== loop through range of numbers ===

for i in {0..10};do echo $i;done
or with variable
M=10
for i in $(seq 0 $M);do echo $i;done

=== exit while loop ===

break

 

=== skip one in loop ===

continue

== bash history timestamp ==

HISTTIMEFORMAT="%y/%m/%d %T "

== screen and bash history ==

To make sure all screens write to same history (at least on CentOS and RHEL):

echo "history -a;history -r" > /etc/sysconfig/bash-prompt-screen
chmod +x /etc/sysconfig/bash-prompt-screen

In general:

export PROMPT_COMMAND='history -n'

or

export PROMPT_COMMAND="history -a; history -c; history -r; ${PROMPT_COMMAND}"

== add extensions to filenames ==

find . -type f |while read i;do if [[!_$i_=~_.*.txt|! $i =~ .*.txt]];then mv -v $i $i.txt;fi;done

 

== bash functions ==

function foo() {
echo "one: $1 two: $2"
}
foo "first param" 2

=== convert units ===

function convertunits() {

C="$1"
U="$2"
debug "converting $C $U"
case $U in
"KiB") O=$((C*1000)) ;;
"MiB") O=$((C*1000*1000)) ;;
"GiB") O=$((C*1000*1000*1000)) ;;
"TiB") O=$((C*1000*1000*1000*1000)) ;;
*) O="convert error in $U" ;;
esac
if [ -z "$O" ];then O="convert_error for unit $U";fi
echo "$O"

}

== Check if disk is mounted ==

mountpoint /mnt/foo
== Get local IP address ==
ip route get 1 | awk '{print $NF;exit}'

== Find depth of a directory ==
find /foo -type d | awk -F"/" 'NF > max {max = NF} END {print max}'

==List only directories==
ls -d */

==Small random number==
echo $((RANDOM/100+1))

= FAQ =
==Login shell vs interactive shell==

== unary operator expected ==

try qouting your vars
[[Category:Scripting]] [[Category:Programming]] [[Category:Shell]]

== failing I-search backward ==
When stuck at that, try
^g
==bash: printf: 60.29: invalid number==
Check $LC_NUMERIC

==Variable scope in while loop==
N=0
shopt -s lastpipe
foo | while read i
do
N=$((N+1))
etc
done
echo $N

Docker

2026-06-10T09:14:01Z

Tony: /* HOWTO */

=Links=
*[https://www.docker.com/ Homepage]

=Docs=
*[https://docs.docker.com/manuals/ The Docker Manuals]
*[https://docs.docker.com/compose Docker-compose]
*https://www.digitalocean.com/community/tutorials/how-to-install-and-use-docker-on-centos-7
*[https://www.digitalocean.com/community/tutorials/how-to-remove-docker-images-containers-and-volumes Removing images, containers and volumes]
*[https://training.play-with-docker.com/beginner-linux/ Docker for beginners]
*[https://runnable.com/docker/basic-docker-networking Docker networking]
*[https://docs.docker.com/config/pruning/ Docker pruning]
*[https://www.virtualizationhowto.com/2023/11/docker-overlay2-cleanup-5-ways-to-reclaim-disk-space/ Docker Overlay2 Cleanup: 5 Ways to Reclaim Disk Space]

=HOWTO=
==Run container==
docker run <IMAGE ID>
==List running containers==
docker ps

==List containers==
docker ps -a

==Start container==
docker start <name>
name as found with docker ps -a
==Add parameter to existing container==
docker update --my-param 1234 mycontainer

==Show log==
docker logs <container>
or to follow:
docker logs -f <container>
==Show disk usage==
*https://niklasmtj.de/blog/understand-docker-storage/

docker system df

outputs:
TYPE TOTAL ACTIVE SIZE RECLAIMABLE
Images 27 10 11.35GB 5.72GB (50%)
Containers 12 12 123.6MB 0B (0%)
Local Volumes 0 0 0B 0B
Build Cache 0 0 0B 0B
===RECLAIMABLE===
Is what you get back when running
docker system prune -a

==List images==
docker images

==Remove image==
===docker rm===
removes container
docker ps -a
and then
docker rm <container id>

===docker rmi===
alias for '''docker image rm'''
docker image ls
and then
docker rmi <ID>

==Export image==
docker save <image name> > imagename.tar

==Update image==
docker pull imagename

==Get shell in running container==
To get image name
docker ps
then
docker exec -it <image-id> bash

==Network==
docker network ls
docker network inspect

==image has dependent child images==
docker inspect --format='{{.Id}} {{.Parent}}' $(docker images --filter since=<image_id> -q)
or get [https://github.com/justone/dockviz dockviz] and run
dockviz images --tree -l

==Dangling images==
===list dangling images===
docker images -f dangling=true

===Remove dangling image===
docker rmi image-id
====Errors/warnings====
=====Error response from daemon: conflict: unable to delete 9e82ccb228df (must be forced) - image is being used by stopped container a14fb2b549f1=====
Find the culprit with
docker ps -a
and then
docker rm <id you find>

===Remove all dangling images===
docker rmi $(docker images -f dangling=true -q)

==image is being used by stopped container xyz==
docker rm xyz
and try again

==Backups==
*https://linuxconfig.org/docker-container-backup-and-recovery
*[https://bobcares.com/blog/docker-backup/ Docker - Easy backup & restore]

=FAQ=
==Error messages==
===The container name "/mycontainer" is already in use by container===
It already exists, so use
docker start <container id>
instead of
docker run

OR find the culprit
docker ps -a
and then
docker rm container/name
etc

===ERROR: failed to solve: failed to read dockerfile: open Dockerfile: no such file or directory===
It really wants a file called '''Dockerfile'''

===docker.service: Start request repeated too quickly===
Try
dockerd --debug

===dial unix /var/run/docker.sock: connect: permission denied===
You're not in group '''docker'''

===docker rmi===
Error response from daemon: reference does not exist
See https://www.baeldung.com/linux/docker-image-deletion-problem-fix

===Address already in use===
First try
lsof -i:8080

==Compose==
===unknown shorthand flag: 'd' in -d===
docker-compose is probably a script/wrapper.
Install the https://docs.docker.com/engine/install/debian/

===docker: 'compose' is not a docker command.===
Check https://docs.docker.com/engine/install/debian/

===unknown flag: --detach===
apt install docker-compose-v2

=== image is being used by stopped container===
use the force

==Docker rmi not freeing space==
Correct, you need
docker image prune

Apt

2026-06-09T14:30:33Z

Tony: /* Extract files from .deb */

Debian/Ubuntu package manager

=Documentation=
==Phased Packages==
* [https://documentation.ubuntu.com/server/explanation/software/about-apt-upgrade-and-phased-updates/index.html About apt upgrade and phased updates]

=Unattended upgrades=
==Links==
*https://help.ubuntu.com/community/AutomaticSecurityUpdates
*[https://pimylifeup.com/unattended-upgrades-debian-ubuntu/ Using Unattended-Upgrades on Debian and Ubuntu]
*https://wiki.debian.org/UnattendedUpgrades
*https://linuxblog.io/how-to-enable-unattended-upgrades-on-ubuntu-debian/
*[https://gist.github.com/CodingKoopa/3b30afe8c91e3950f6b124cd2abe3b6b the apt manpage you were looking for]

==Enabling/disabling unattended upgrades==
Maybe install it first
apt install unattended-upgrades
that will most likely also enable unattended upgrades
then
dpkg-reconfigure unattended-upgrades
The dialog will show which option is selected now.

==The relevant systemd service==
apt-daily-upgrade.service

==Disable unattended upgrades==
In /etc/apt/apt.conf.d/20auto-upgrades
APT::Periodic::Unattended-Upgrade "0";
==The logs==
/var/log/unattended-upgrades/*.log

==FAQ==
===Unattended-upgrade is not upgrading all packages===
That's normal, it defaults to upgrading only security updates.

===Unattended-Upgrade::DevRelease "auto";===
Only works on "dev releases", which is any not .04

==What is this Allowed-Origins about?==
Check output of
apt -s upgrade

you might see something like

Conf cloud-init (25.1.2-0ubuntu0~22.04.2 '''Ubuntu:22.04/jammy-updates'''

which will match
${distro_id}:${distro_codename}-updates

==No packages found that can be upgraded unattended==
By default '''"${distro_id}:${distro_codename}-updates";''' is commented out in '''/etc/apt/apt.conf.d/50unattended-upgrades''', so to get those updated as well, uncomment that line.

=HOWTO=
==Extract files from .deb==
dpkg -x foo.deb ~/foo
also
mkdir tmp
dpkg-deb -R original.deb tmp

==Pin a version==
*[https://help.ubuntu.com/community/PinningHowto Pinning Howto]

==List installed packages==
apt list --installed

==Upgrade just one package==
apt-get install --only-upgrade <packagename>

==exclude package from upgrade==
apt-mark hold somepackage
and to undo
apt-mark unhold somepackage

==Disable source in deb822 source file==
add
Enabled: no

= FAQ =
==What is new style sources files called?==
deb822

== the following packages have been kept back: ==

Time to apt-get dist-upgrade ( but check [https://askubuntu.com/questions/194651/why-use-apt-get-upgrade-instead-of-apt-get-dist-upgrade/226213#226213 ]first But it could be different things.
See https://askubuntu.com/questions/601/the-following-packages-have-been-kept-back-why-and-how-do-i-solve-it
Perhaps:
apt-get upgrade package-that-is-kept-back
or try
apt install package-that-is-kept-back

==What version of a package is going to be installed?==
apt-cache policy <package>
==What package does a file belong to?==
dpkg -S /path/to/file

==Error messages==

===InRelease doesn't support architecture 'i386'===
set ''arch=amd64''' in sources old style or '''Architectures: amd64'' new style

===E: Could not get lock /var/lib/apt/lists/lock. It is held by process 1538337 (apt-get)===

Try
systemctl restart packagekit
and check
fuser /var/lib/apt/lists/lock
again

===Repository changed its 'Version' value===
Try
apt-get --allow-releaseinfo-change update

===The repository 'http://security.debian.org buster/updates Release' no longer has a Release file===
time to upgrade entire system

==Unable to correct problems, you have held broken packages.==
Try
dpkg --get-selections | grep hold

==What packages depend on package==
apt-cache rdepends --installed libc6-dev

=== Clear cache ===

apt-get clean

==Could not handshake: The TLS connection was non-properly terminated.==
try http instead of https

==Depends: but it is not going to be installed==
First try
apt-get update && apt-get upgrade

==E: Unable to correct problems, you have held broken packages.==

==Which services should be restarted?==
That's from '''needrestart'''

==Prevent restarting all services when installing a package==
NEEDRESTART_MODE=i apt install somepackage

==What repository provides package==
apt policy <packagename>

==Error messages==
===Key is stored in legacy trusted.gpg keyring===
Check [https://itsfoss.com/apt-key-deprecated/ apt-key is deprecated]

===Certificate verification failed: The certificate is NOT trusted.===
try
deb [trusted=yes] ...
in sources.list, but things might be worse than that, in case of launchpad change to
https://ppa.launchpadcontent.net/

===apt-key is deprecated. Manage keyring files in trusted.gpg.d instead===
See [https://itsfoss.com/apt-key-deprecated/ apt-key is deprecated]

==The following upgrades have been deferred due to phasing==
apt install <whatever package it lists>

==needrestart==
===Show which services need restarting===
needrestart -rl
===Service restarts being deferred===
Probably services like '''networkd-dispatcher.service'''.
Check '''/etc/needrestart/needrestart.conf''' for '''$nrconf{override_rc}'''

[[Category:Debian]]

Apt

2026-06-09T12:43:05Z

Tony: /* Extract files from .deb */

Debian/Ubuntu package manager

=Documentation=
==Phased Packages==
* [https://documentation.ubuntu.com/server/explanation/software/about-apt-upgrade-and-phased-updates/index.html About apt upgrade and phased updates]

=Unattended upgrades=
==Links==
*https://help.ubuntu.com/community/AutomaticSecurityUpdates
*[https://pimylifeup.com/unattended-upgrades-debian-ubuntu/ Using Unattended-Upgrades on Debian and Ubuntu]
*https://wiki.debian.org/UnattendedUpgrades
*https://linuxblog.io/how-to-enable-unattended-upgrades-on-ubuntu-debian/
*[https://gist.github.com/CodingKoopa/3b30afe8c91e3950f6b124cd2abe3b6b the apt manpage you were looking for]

==Enabling/disabling unattended upgrades==
Maybe install it first
apt install unattended-upgrades
that will most likely also enable unattended upgrades
then
dpkg-reconfigure unattended-upgrades
The dialog will show which option is selected now.

==The relevant systemd service==
apt-daily-upgrade.service

==Disable unattended upgrades==
In /etc/apt/apt.conf.d/20auto-upgrades
APT::Periodic::Unattended-Upgrade "0";
==The logs==
/var/log/unattended-upgrades/*.log

==FAQ==
===Unattended-upgrade is not upgrading all packages===
That's normal, it defaults to upgrading only security updates.

===Unattended-Upgrade::DevRelease "auto";===
Only works on "dev releases", which is any not .04

==What is this Allowed-Origins about?==
Check output of
apt -s upgrade

you might see something like

Conf cloud-init (25.1.2-0ubuntu0~22.04.2 '''Ubuntu:22.04/jammy-updates'''

which will match
${distro_id}:${distro_codename}-updates

==No packages found that can be upgraded unattended==
By default '''"${distro_id}:${distro_codename}-updates";''' is commented out in '''/etc/apt/apt.conf.d/50unattended-upgrades''', so to get those updated as well, uncomment that line.

=HOWTO=
==Extract files from .deb==
dpkg -x foo.deb ~/foo

==Pin a version==
*[https://help.ubuntu.com/community/PinningHowto Pinning Howto]

==List installed packages==
apt list --installed

==Upgrade just one package==
apt-get install --only-upgrade <packagename>

==exclude package from upgrade==
apt-mark hold somepackage
and to undo
apt-mark unhold somepackage

==Disable source in deb822 source file==
add
Enabled: no

= FAQ =
==What is new style sources files called?==
deb822

== the following packages have been kept back: ==

Time to apt-get dist-upgrade ( but check [https://askubuntu.com/questions/194651/why-use-apt-get-upgrade-instead-of-apt-get-dist-upgrade/226213#226213 ]first But it could be different things.
See https://askubuntu.com/questions/601/the-following-packages-have-been-kept-back-why-and-how-do-i-solve-it
Perhaps:
apt-get upgrade package-that-is-kept-back
or try
apt install package-that-is-kept-back

==What version of a package is going to be installed?==
apt-cache policy <package>
==What package does a file belong to?==
dpkg -S /path/to/file

==Error messages==

===InRelease doesn't support architecture 'i386'===
set ''arch=amd64''' in sources old style or '''Architectures: amd64'' new style

===E: Could not get lock /var/lib/apt/lists/lock. It is held by process 1538337 (apt-get)===

Try
systemctl restart packagekit
and check
fuser /var/lib/apt/lists/lock
again

===Repository changed its 'Version' value===
Try
apt-get --allow-releaseinfo-change update

===The repository 'http://security.debian.org buster/updates Release' no longer has a Release file===
time to upgrade entire system

==Unable to correct problems, you have held broken packages.==
Try
dpkg --get-selections | grep hold

==What packages depend on package==
apt-cache rdepends --installed libc6-dev

=== Clear cache ===

apt-get clean

==Could not handshake: The TLS connection was non-properly terminated.==
try http instead of https

==Depends: but it is not going to be installed==
First try
apt-get update && apt-get upgrade

==E: Unable to correct problems, you have held broken packages.==

==Which services should be restarted?==
That's from '''needrestart'''

==Prevent restarting all services when installing a package==
NEEDRESTART_MODE=i apt install somepackage

==What repository provides package==
apt policy <packagename>

==Error messages==
===Key is stored in legacy trusted.gpg keyring===
Check [https://itsfoss.com/apt-key-deprecated/ apt-key is deprecated]

===Certificate verification failed: The certificate is NOT trusted.===
try
deb [trusted=yes] ...
in sources.list, but things might be worse than that, in case of launchpad change to
https://ppa.launchpadcontent.net/

===apt-key is deprecated. Manage keyring files in trusted.gpg.d instead===
See [https://itsfoss.com/apt-key-deprecated/ apt-key is deprecated]

==The following upgrades have been deferred due to phasing==
apt install <whatever package it lists>

==needrestart==
===Show which services need restarting===
needrestart -rl
===Service restarts being deferred===
Probably services like '''networkd-dispatcher.service'''.
Check '''/etc/needrestart/needrestart.conf''' for '''$nrconf{override_rc}'''

[[Category:Debian]]

Proxmox Backup Server

2026-06-09T12:29:41Z

Tony: /* Garbage collection */

=Links=
*[https://www.proxmox.com/en/proxmox-backup-server/overview PBS Homepage]
*[https://pypi.org/project/pbs-monitoring-tools/ PBS monitoring tools]

= Documentation =
*[https://pbs.proxmox.com/docs/ PBS documentation]
*[https://pbs.proxmox.com/docs/technical-overview.html PBS Technical overview]
*[https://pbs.proxmox.com/docs/managing-remotes.html Managing PBS remotes & sync]

==Installation==
*[https://pbs.proxmox.com/docs/installation.html Installing PBS]

==Upgrading PBS==
*[https://pbs.proxmox.com/wiki/index.php/Upgrade_from_2_to_3 Upgrading PBS 2 to 3]

=Processes=
==Service daemons==
See [https://pbs.proxmox.com/docs/sysadmin.html#service-daemons Service Daemons]

==Command line tools==
See [https://pbs.proxmox.com/docs/sysadmin.html#command-line-tools Command-line Tools]

==Under the hood==
Structure of datastore:
/mnt/datastore/yourDS
contains:
===.chunks===
The actual data
===.lock===
===vm===
Metadata per vm:
client.log.blob drive-scsi0.img.fidx index.json.blob qemu-server.conf.blob
===.gc-status===

=Configuration files=
==/etc/proxmox/remote.cfg==
In WebUI under Configuration->Remotes

==Notifications==
===Notification system===
====/etc/backup-server/notifications.cfg====
Contains the default settings, managed via Configuration->Notifications
=HOWTO=

==Move datastore==
*Make sure there is no activity on that datastore, i suggest using rsync. As i can tell it should be safe to use rsync option '''--ignore-existing''' when updating a copy.
*Edit '/etc/proxmox-backup/datastore.cfg' to change path to datastore.
*Reload configuration ('''this will interrupt running garbage collectors''') :
systemctl reload proxmox-backup-proxy

==Upgrade proxmox 6 to 7==
https://pve.proxmox.com/wiki/Upgrade_from_6.x_to_7.0

===WARN: 'noout' flag not set - recommended to prevent rebalancing during cluster-wide upgrades===
https://docs.ceph.com/en/quincy/rados/troubleshooting/troubleshooting-osd/
ceph osd set noout

==Restore disk from PBS==
Use [[pbs-restore]]

==What's so busy?==
proxmox-backup-manager list
and then
proxmox-backup-manager task log <everying from and including "UPID:">

==Show some logs==
proxmox-backup-manager task list --all

or perhaps
proxmox-backup-debug api get /nodes/{node}/tasks --typefilter=backup
where {node} can be found with
proxmox-backup-debug api get /nodes/
OR
proxmox-backup-debug api get /nodes/localhost/tasks --typefilter=backup --start=0 --limit=500 --output-format json-pretty

==List the vms in a datastore==
proxmox-backup-client list

==Show cluster status==
pvecm status

=PBS Backups=

==Create new backup repository==
===On PBS server:===
====Create account====

Configuration->Access Control->User Management->Add

====Create datastore====
Create space, normally something like
zfs create pbspool/mystore

Datastore->Add Datastore
New subdirectory will be created

Backup path must be full path to storage + datastore name
Configuration->Access Control->Permissions
Datastore->yournewstore->Permissions
to give the user access, Role is usually DatastoreBackup

===On PBS guest:===
Datacenter->Storage->Add->Proxmox backup server
For "Datastore" enter the name as used on the PBS.
For fingerprint (on pbs server):
proxmox-backup-manager cert info | grep Fingerprint

Then:
Backup->Add storage: your-pbs

==Remove PBS datastore==
proxmox-backup-manager datastore remove yourdatastore
this does not delete the data!

===Move a PBS datastore===
rsync -auv /mnt/datastore/old /mnt/datastore/new
systemctl stop proxmox-backup-proxy
rsync -auv /mnt/datastore/old /mnt/datastore/new
vi /etc/proxmox-backup/datastore.cfg
systemctl start proxmox-backup-proxy
and after checking everything you can
rm -vf /mnt/datastore/old

==Move vm data to another datastore==
=== Create local sync user ===
localsync@pbs
Permissions: datastorereader on source, datastorebackup on target

== PBS API ==
*[https://pbs.proxmox.com/docs/user-management.html?highlight=token#api-tokens API Tokens]
*[https://pbs.proxmox.com/docs/api-viewer/ PBS API viewer]

PBS equivalent for '''pvesh''':
proxmox-backup-debug

example:
proxmox-backup-debug api get /status/datastore-usage

proxmox-backup-debug api get /nodes/localhost/tasks

===Create cookie===
PBS=your.pbs.server
curl --silent --insecure --data "username=zabbix@pbs&password=n0tmyp4ss" https://$PBS:8007/api2/json/access/ticket | jq --raw-output '.data.ticket' | sed 's/^/PBSAuthCookie=/' > cookie

Test cookie
curl -XGET --silent -k -b $(cat cookie ) https://$PBS:8007/api2/json/

== Recovering files from backup ==

export PBS_REPOSITORY=mypbs:mydatastore
proxmox-backup-client snapshot list

Output like: '''vm/109/2022-01-25T20:18:02Z │ 200.00 GiB │ client.log drive-ide0.img index.json qemu-server.conf'''

# proxmox-backup-client map vm/109/2022-01-25T20:18:02Z drive-ide0.img

Image 'data2:vm/109/2022-01-25T20:18:02Z/drive-ide0.img' mapped on /dev/loop0

# lsblk

NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
loop0 7:0 0 200G 1 loop
├─loop0p1 259:0 0 251M 1 part
├─loop0p2 259:1 0 3.9G 1 part
└─loop0p3 259:2 0 195.9G 1 part

 

mount /dev/loop0p3 /mnt/loop/

mount: /mnt/loop: cannot mount /dev/loop0p3 read-only.

mount -o loop,ro,norecovery /dev/loop0p3 /mnt/loop/

and that should be it. After you're done:

umount /mnt/loop
proxmox-backup-client unmap /dev/loop0

 

TBD: explain how t o use kpartx and friends to acces LVM volumes

 

= FAQ =
==Error messages==
===user account disabled or expired===

===error fetching datastores - 401 Unauthorized (500)===
Check username/password :)

===datastore path not empty===
When trying to create a datastore.
https://forum.proxmox.com/threads/bug-when-adding-new-storage-task-error-datastore-path-is-not-empty.157629/

===TASK ERROR: sync failed with some errors===
??

===remove the file '/run/proxmox-backup/old-locking', and reload all PBS daemons===
When no jobs running:
rm /run/proxmox-backup/old-locking
for me worked:
systemctl restart proxmox-backup.service
systemctl restart proxmox-backup-proxy.service

===The devices are not in fstab, where are they configured?===
See [https://www.man7.org/linux//man-pages/man5/systemd.mount.5.html systemd.mount(5)] and [https://www.man7.org/linux//man-pages/man1/systemd-mount.1.html systemd-mount(5)].

==Limit bandwidth==
===On cluster node===
In /etc/vzdump.conf
# In KB/s
bwlimit: 1500

==Garbage collection==
===What does the '''Prune all''' button do?===
It will give you a dialog with the usual 'Keep xxx' options.

=== TASK ERROR: update atime failed, disk full ===
Try pruning some
Check if some sync is running

===unable to access non-existent chunk===
check if this returns?
===What is this "pending data"?===

=== Pending removals ===

proxmox-backup-manager garbage-collection status mystore

== error pruning backups - check log (500) ==

Possibly a permissions thing, which is good. Leave pruning to the backup server

==command error: http upgrade request timed out==
??

==Connection error - server offline?==
This can also happen when you can actually connect to server:8007
Check
systemctl status proxmox-backup

==Connection error 401: No ticket==
Browser issues, try clearing cache/cookies(?) or another browser.

==Noout flag(s) set==
ceph osd unset noout

==qmp command 'query-backup' failed - got wrong command id==
maybe bwlimit?

==create storage failed: mypbs: error fetching datastores - 500 Can't connect to mypbs:8007 (Connection timed out) (500)==

==Garbage collection failed: unlinking chunk ... ENOENT: No such file or directory==
Ignore?

==Sync errror: owner check failed==
Check in datastore/yourrepository/vm/*/owner

There's command
proxmox-backup-client change-owner

==Sync remote==

==tcp connect error: deadline has elapsed==
Probably connection timeout.
===proxmox-backup-manager remote list not showing remote===
Try
proxmox-backup-manager remote show
Check
/etc/proxmox-backup/remote.cfg

===Retrieve PBS password===
On a pve node check '''/etc/pve/priv/storage/'''

===group lock failed: Permission denied===
Probably a mismatch between path in /etc/proxmox-backup/datastore.cfg and actual location.
You also need to restart proxmox-backup-proxy.service after changing either of those.

==Where are the devices behind the datastores listed/configured?==
systemctl list-units | grep mount

[[Category:Backup]]

Openssl

2026-06-08T08:00:05Z

Tony: /* Generate a signing request (CSR) */

=Links=
*[https://scotthelme.co.uk/are-ev-certificates-worth-the-paper-theyre-written-on/ Why you don't want EV certificate]
*[https://mozilla.github.io/server-side-tls/ssl-config-generator/ SSL confg generator]
*[http://www.openssl.org/ openssl homepage]
*[http://gagravarr.org/writing/openssl-certs/index.shtml http://gagravarr.org/writing/openssl-certs/index.shtml]
*[https://whatsmychaincert.com/ What's My Chain Cert?]

= Tools =
*openssl
*sslscan
*sclient
*[[gnutls-cli]]

= Documentation and HOWTOs =
*[https://docs.openssl.org/1.1.1/man1/pkcs12/ pkcs12]
*[http://sial.org/howto/openssl/ca/ OpenSSL Certificate Authority Setup]
*[http://www.herongyang.com/Cryptography/OpenSSL-Certificate-Path-Validation-Tests.html Validating a Certificate Path with OpenSSL]
*[http://www.techradar.com/news/software/how-ssl-and-tls-works-1047412 How SSL and TLS work]
*[https://jamielinux.com/docs/openssl-certificate-authority/index.html OpenSSL Certificate Authority]
*[http://dataslinger.com/index.php?/archives/5-Configuring-SSL-certificates-for-Apache,-Dovecot,-Sendmail,-and-IIS.html http://dataslinger.com/index.php?/archives/5-Configuring-SSL-certificates-for-Apache,-Dovecot,-Sendmail,-and-IIS.html]
*[http://www.eclectica.ca/howto/ssl-cert-howto.php ssl cert HOWTO]
*[http://www.madboa.com/geek/openssl/ OpenSSL Command-Line HOWTO]
*[http://wiki.cacert.org/wiki/VhostTaskForce#head-f7f4c7599aef8b22de373b0922b39f4e75e95db4 1. Way: SubjectAltName Only]
*[http://www.madboa.com/geek/openssl/ OpenSSL Command-Line HOWTO]
*[http://www.digicert.com/ssl-support/pem-ssl-creation.htm How to Create a .PEM file for SSL Certificate Installation]
*[http://www.tc.umn.edu/~brams006/selfsign.html http://www.tc.umn.edu/~brams006/selfsign.html]
*[https://medium.com/@superseb/get-your-certificate-chain-right-4b117a9c0fce Getting your certificate chain right]
*[https://stackoverflow.com/questions/25482199/verify-a-certificate-chain-using-openssl-verify Verify certificate chain]
*[https://whatsmychaincert.com What is my certificate chain?]
*[https://langui.sh/2009/03/14/checking-a-remote-certificate-chain-with-openssl/ Checking A Remote Certificate Chain With OpenSSL]

*[https://www.howtouselinux.com/post/certificate-chain Check SSL Certificate Chain with OpenSSL Examples]
=== Dovecot and ssl ===

Networksolutions certs: After creating myserver.key and myserver.csr and obtaining certs: (don't forget to insert newlines between the blocks!)

cat OV_NetworkSolutionsOVServerCA2.crt OV_USERTrustRSACertificationAuthority.crt AddTrustExternalCARoot.crt > intermediate.pem

In dovecot.conf:

ssl_cert_file = /usr/local/etc/IMAP.EXAMPLE.COM.crt
ssl_key_file = /usr/local/etc/myserver.key
#optional, only if you want to require client to provide cert
#ssl_ca_file = /usr/local/etc/intermediate.pem

== Courier-imap and ssl ==

*[http://linsec.ca/Using_Courier-IMAP_and_SSL http://linsec.ca/Using_Courier-IMAP_and_SSL]
*[http://linux.seindal.dk/2005/12/04/making-a-courier-imap-ssl-sertificate/ http://linux.seindal.dk/2005/12/04/making-a-courier-imap-ssl-sertificate/]

Networksolutions certs: After creating myserver.key and myserver.csr and obtaining certs: (don't forget to insert newlines between the blocks!)

cat AddTrustExternalCARoot.crt NetworkSolutions_CA.crt > intermediate.pem
cat myserver.key >> IMAP.EXAMPLE.COM.crt

In imapd-ssl:

TLS_CERTFILE=/usr/local/etc/courier-certs/IMAP.EXAMPLE.COM.crt
TLS_TRUSTCERTS=/usr/local/etc/courier-certs/intermediate.pem

== Network Solutions certificates bundle ==

See [http://blog.irontechsolutions.com/2008/12/10/ssl-chained-certificates-explained/ http://blog.irontechsolutions.com/2008/12/10/ssl-chained-certificates-explained/]

cat OV_NetworkSolutionsOVServerCA2.crt OV_USERTrustRSACertificationAuthority.crt AddTrustExternalCARoot.crt > intermediate.txt

=== Comodo bundle order ===

COMODORSAOrganizationValidationSecureServerCA. + COMODO rsa add trust ca ( + addtrustexternalcaroot )

=== Generate a signing request (CSR)===
N=my.domain
openssl req -nodes -newkey rsa:2048 -keyout $N.key -out $N.csr

openssl req -utf8 -nodes -sha256 -newkey rsa:2048 -keyout server.key -out server.csr
The resulting csr is the signing request, my.domain.key is the private key you save not readable for anyone but root!

= HOWTO =
==Add custom Root CA to your system==
===On Ubuntu===
Copy to /usr/local/share/ca-certificates
update-ca-certificates --fresh

==Generate PSK ==
openssl rand -hex 32

==Converting certificates==
https://stackoverflow.com/questions/13732826/convert-pem-to-crt-and-key

=== Create private key (using config file) ===

openssl req (-config /etc/pki/tls/www.example.com.cnf) -newkey rsa:2048 -nodes -keyout domain.key

== Create CSR using config file ==

openssl req -config /etc/pki/tls/www.example.com.cnf -new -newkey rsa:2048 -noenc -keyout example.com.key -out www.example.com.csr

==Create .p12==
openssl pkcs12 -export -out keyStore.p12 -inkey myKey.pem -in myCert.cer

== Convert der to pem ==

openssl x509 -inform der -in certificate.cer -out certificate.pem

== Creating CSR for multiple hosts ==

For example [http://blog.endpoint.com/2014/10/openssl-csr-with-alternative-names-one.html http://blog.endpoint.com/2014/10/openssl-csr-with-alternative-names-one.html]

=== Remove password from private key ===

[https://wiki.apache.org/httpd/RemoveSSLCertPassPhrase https://wiki.apache.org/httpd/RemoveSSLCertPassPhrase]

== Examining certificates ==

*[http://www.madboa.com/geek/openssl/#verify-standard http://www.madboa.com/geek/openssl/#verify-standard]

openssl verify cert.pem

openssl x509 -in cacert.pem -noout -text
openssl x509 -in foo.pem -inform pem -noout -text

openssl rsa -noout -text -in server.key
===Read contents of crt===
openssl x509 -noout -text -in ca.crt
===Read contents of csr===
openssl req -noout -text -in server.csr

openssl rsa -noout -text -in ca.key

with expiration date:

openssl x509 -noout -text -enddate -in ca.crt

#to check CN

openssl x509 -in server.crt -noout -subject

openssl pkcs12 -info -in keyStore.p12
openssl pkcs12 -info -in keyStore.pfx

== Checking a service ==

#Note -CApath should point to your local collection of public CA certs

openssl s_client -connect -CApath /etc/ssl/certs host:pop3 -starttls pop3
openssl s_client -port 443 -CApath /etc/ssl/certs -host webmail.example.com -prexit
openssl s_client -connect imap.example.com:143 -starttls imap
openssl s_client -connect web.server:443 -showcerts
openssl s_client -connect webmail.example.com:443 -servername vhost.example.com

Just check expiration date:

openssl s_client -connect imap.example.com:143 -starttls imap 2>/dev/null | openssl x509 -noout -dates

 

== Check your site ==

*[https://www.ssllabs.com/ssltest https://www.ssllabs.com/ssltest]
*[https://www.sslcheck.nl/ https://www.sslcheck.nl/]
*[https://internet.nl Internet.nl]

==gnutls-cli ==
echo quit | gnutls-cli --starttls-proto smtp --port 25 servac.skk | grep Status
echo quit | gnutls-cli --port 465 servac.skk | grep Status

== check if certs match ==

TODO: -clr_check too

openssl pkey -in privateKey.key -pubout -outform pem | sha256sum
openssl x509 -in certificate.crt -pubkey -noout -outform pem | sha256sum
openssl req -in CSR.csr -pubkey -noout -outform pem | sha256sum

These values show match Also:

openssl verify -CAfile ca-bundle foo_bar.crt

A script to do these checks: [[https://www.tuxick.net/sslcheck sslcheck]]

== Creating your own CA and signing with it==
(based on http://www.eclectica.ca/howto/ssl-cert-howto.php#rootc)

cd /etc/ssl
mkdir newcerts
(perform secret rituals)

== Check which ciphers and tls versions your openssl supports==
openssl ciphers -v

==Check if site supports TLS v1.2==
openssl s_client -connect google.com:443 -servername google.com -tls1_2

==Create client key for authentication==
* https://docs.devolutions.net/workspace/kb/general-knowledge/secure-self-signed-certificates/

Create key
openssl -genkey -noout -out my.key

Create cert
openssl req -new -x509 -sha256 -days 180 -key my.key -out my.crt

Convert to p12

==Get issuer==
openssl s_client -showcerts -connect <YOURHOST>:443 < /dev/null 2>/dev/null |grep -i issuer
or better:
openssl s_client -showcerts -connect YOURHOST:443 -servername YOURHOST -showcerts </dev/null | openssl x509 -nouout -issuer
and even
openssl s_client -servername $H -host $H -port 443 -showcerts </dev/null 2>/dev/null| openssl x509 -noout -issuer | sed 's/.* O = $.*$, CN.*/\1/'

= FAQ =
==Should i include the Root CA?==
Only if server software demands it.

==Error messages==
=== SSL CTX certificate file error: error:0906D06C:PEM routines:PEM_read_bio:no start line ===
??

=== 139814102202256:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:707:Expecting: TRUSTED CERTIFICATE ===

i've seen this happen when someone deleted the BEGIN/END CERTIFICATE lines

or a file is in DER format

=== error 20 at 0 depth lookup: unable to get local issuer certificate ===

you probably need to provide the right -CAfile maybe self signed?

===self-signed certificate in certificate chain===

===OpenSSL: error:0A000102:SSL routines::unsupported protocol===
This could becaure you're trying to an older version of TLS, check '''openssl.cnf''' for
CipherString = DEFAULT:@SECLEVEL=2
which means it enforces minimum of TLSv1.2

You might now get
===OpenSSL: error:0A000152:SSL routines::unsafe legacy renegotiation disabled===
which means add below the CipherString line:
Options = UnsafeLegacyRenegotiation

===SSL: error:13800076:OCSP routines::signer certificate not found===
?

== Order of certificates in bundle==
Root CA comes last

== using s_client ==

=== no client certificate sent ===

try adding -cert

 

=== Secure Renegotiation IS NOT supported ===

Probably using wrong TLS version

=== Can't use SSL_get_servername ===

Try using hostname instead of IP address

=== write:errno=104 ===

server reset the connection

===no peer certificate available===
Could be trying to talk tls to ssl, also check tls version used/enforced.

===socket: Bad file descriptor===
Most likely you just can't connect

== unable to load client certificate private key file ==

== Verification error: unable to verify the first certificate ==

problem missing CA cert

 

== Verify return code: 21 (unable to verify the first certificate) ==

Probably requires bundle ''including the first cert'''

== Bad certificate (code 42) ==

Means the server demands you authenticate with a certificate, and you did not do so, and that caused the handshake failure.

== How to check certificate chain? ==

openssl s_client -connect www.example.com:443 -showcerts

=== Some of the output ===

Certificate chain

0 s:CN = foo.local
i:CN = foo.local-CA

0: first in chain

s: subject  ( openssl x509 -noout -in foo.crt -subject )

i: issuer ( openssl x509 -noout -in foo.crt -issuer )

OR
openssl s_client -showcerts -verify 5 -connect ldap.example.com:636 < /dev/null | awk '/BEGIN/,/END/{ if(/BEGIN/) {a++}; out="bluePage-cert"a".pem"; print >out}'
or
openssl s_client -showcerts -verify 5 -connect ldap.example.com:389 starttls ldap < /dev/null | awk '/BEGIN/,/END/{ if(/BEGIN/) {a++}; out="bluePage-cert"a".pem"; print >out}'

== check expiration date ==

echo | openssl s_client -servername NAME -connect HOST:PORT 2>/dev/null | openssl x509 -noout -dates

openssl x509 -enddate -noout -in file.pem

== check if webserver supports old tls ==

openssl s_client -connect www.example.com:443 -tls1
openssl s_client -connect www.example.com:443 -tls1_1

or when vhost:

openssl s_client -servername vhost.example.com -connect www.example.com:443 -tls1_1

 

== ERROR: Certificate verification: Not trusted ==

seems to be an lftp issue

== unsupported certificate purpose ==

??

 

== ssllabs checks ==

=== Chain issues: Incorrect order, Contains anchor ===

Could be the topmost cert in the bundle provided, try removing it

 

=== Chain issues: Contains anchor ===

Seems to mean there's a root ca in the bundle

== check smtp submission ==

echo -n "username" | base64
echo -n "password" | base64

openssl s_client -connect mail.host.com:587 -starttls smtp -crlf

EHLO foo.bar
AUTH LOGIN

base64username

base64password

OR

echo -ne '\0username\0password'| base64
AUTH LOGIN output_of_that_echo

===Peer's Certificate issuer is not recognized.===

=p12 / pkcs12=
* https://fileinfo.com/extension/p12
* [https://www.ssl.com/how-to/export-certificates-private-key-from-pkcs12-file-with-openssl/ Export Certificates and Private Key from a PKCS#12 File with OpenSSL]

== Show info about p12 file==
openssl pkcs12 -info -in INFILE.p12 -nodes

== Extract keys from p12 ==
=== Extract private key ===
openssl pkcs12 -in yourP12File.pfx -nocerts -out privateKey.pem
=== Extract client certificate ===
openssl pkcs12 -in yourP12File.pfx -clcerts -nokeys -out publicCert.pem

===server certificate does NOT include an ID which matches the server name===
todo

Git

2026-06-08T07:37:07Z

Tony: /* Error messages */

=Links=
*[http://git-scm.com/ Homepage]

==Documentation==
*[https://git-scm.com/book/en/v1/Getting-Started-First-Time-Git-Setup Getting Started in the Pro Git Book]
*[https://www.inmotionhosting.com/support/website/git/setting-up-your-remote-repository-with-git/ Setting Up Your Remote Repository With Git]
*[https://git-scm.com/book/uz/v2/Customizing-Git-Git-Attributes Dealing with binary files]
*http://gitref.org/basic/
*http://git-scm.com/book/en
*http://thelucid.com/2008/12/02/git-setting-up-a-remote-repository-and-doing-an-initial-
*[https://git-scm.com/book/en/v2/Git-Basics-Recording-Changes-to-the-Repository Recording Changes to the Repository]
*[https://raymii.org/s/tutorials/Shared_Git_repository_via_ssh_for_multiple_users.html Shared Git repository over ssh for multiple users]

===Git Tutorials===
*[https://try.github.io Online git tutorial]
*[https://www.atlassian.com/git/tutorials Git tutorial at atlassian]
*[https://docs.gitlab.com/tutorials/learn_git/ Git tutorial at Gitlab]

=Cheat sheet=
==Show changes in a file==
git log --follow -p your.file

==Remove file from repository but not from filesystem==
git rm --cached filetokeep
and add it to .gitignore

==Create repository on server==
mkdir -p git/myproject
cd git/project
git init --bare

==Get git config==
git config --list

==browse local repository==
git ls-tree --full-tree -r HEAD

==push as different user==
check .git/config and replace username

==Switch to particular branch==
git branch -a
git checkout remote/releases/6.4
and to get back
git checkout master
or was it
git checkout

==Git move==
git mv file.txt newfile.txt

= FAQ =
==git pull==
===You are not currently on a branch.===

==Restore single file==
Move the file away and
git restore yourfile

==Error messages==
===warning: remote HEAD refers to nonexistent ref, unable to checkout===
You probably need to
git check master
of
git checkout main

===error: You have not concluded your merge (MERGE_HEAD exists).===

===error: unknown switch `b'===
Try '''--bare''' instead of '''-b'''

===git checkout errors===
====error: pathspec 'master' did not match any file(s) known to git====
then you get that from
git checkout master
try
git checkout -

===Automatic merge failed; fix conflicts and then commit the result.===

Try
git mergetool

=== error: src refspec master does not match any. ===

ye well, screw you. you did something wrong!

=== Updates were rejected because the remote contains work that you do not have locally.===
??

== error: Merging is not possible because you have unmerged files. ==

This is not a joke!

For now check https://stackoverflow.com/questions/36086202/git-merge-is-not-possible-because-i-have-unmerged-files

== fatal: cannot do a partial commit during a merge. ==

git commit -i

== error: Pull is not possible because you have unmerged files ==

== error: Your local changes to the following files would be overwritten by merge:==
git stash
git pull
git stash pop

== list untracked files ==

git status

== Changes not staged for commit: ==

File has to be added again

 

== error: gpg failed to sign the data ==

try

GIT_TRACE=1 commit ...

and run the command it suggests

but your problably forgot to

 git config --global user.signingkey  XXXXX

==Git error messages==
===You have divergent branches and need to specify how to reconcile them.===
First try:
git merge

===fatal: detected dubious ownership in repository ===

===Merge with strategy ort failed===
ORT stands for “Ostensibly Recursive Three-way”

Proxmox Backup Server

2026-06-06T09:40:18Z

Tony: /* FAQ */

=Links=
*[https://www.proxmox.com/en/proxmox-backup-server/overview PBS Homepage]
*[https://pypi.org/project/pbs-monitoring-tools/ PBS monitoring tools]

= Documentation =
*[https://pbs.proxmox.com/docs/ PBS documentation]
*[https://pbs.proxmox.com/docs/technical-overview.html PBS Technical overview]
*[https://pbs.proxmox.com/docs/managing-remotes.html Managing PBS remotes & sync]

==Installation==
*[https://pbs.proxmox.com/docs/installation.html Installing PBS]

==Upgrading PBS==
*[https://pbs.proxmox.com/wiki/index.php/Upgrade_from_2_to_3 Upgrading PBS 2 to 3]

=Processes=
==Service daemons==
See [https://pbs.proxmox.com/docs/sysadmin.html#service-daemons Service Daemons]

==Command line tools==
See [https://pbs.proxmox.com/docs/sysadmin.html#command-line-tools Command-line Tools]

==Under the hood==
Structure of datastore:
/mnt/datastore/yourDS
contains:
===.chunks===
The actual data
===.lock===
===vm===
Metadata per vm:
client.log.blob drive-scsi0.img.fidx index.json.blob qemu-server.conf.blob
===.gc-status===

=Configuration files=
==/etc/proxmox/remote.cfg==
In WebUI under Configuration->Remotes

==Notifications==
===Notification system===
====/etc/backup-server/notifications.cfg====
Contains the default settings, managed via Configuration->Notifications
=HOWTO=

==Move datastore==
*Make sure there is no activity on that datastore, i suggest using rsync. As i can tell it should be safe to use rsync option '''--ignore-existing''' when updating a copy.
*Edit '/etc/proxmox-backup/datastore.cfg' to change path to datastore.
*Reload configuration ('''this will interrupt running garbage collectors''') :
systemctl reload proxmox-backup-proxy

==Upgrade proxmox 6 to 7==
https://pve.proxmox.com/wiki/Upgrade_from_6.x_to_7.0

===WARN: 'noout' flag not set - recommended to prevent rebalancing during cluster-wide upgrades===
https://docs.ceph.com/en/quincy/rados/troubleshooting/troubleshooting-osd/
ceph osd set noout

==Restore disk from PBS==
Use [[pbs-restore]]

==What's so busy?==
proxmox-backup-manager list
and then
proxmox-backup-manager task log <everying from and including "UPID:">

==Show some logs==
proxmox-backup-manager task list --all

or perhaps
proxmox-backup-debug api get /nodes/{node}/tasks --typefilter=backup
where {node} can be found with
proxmox-backup-debug api get /nodes/
OR
proxmox-backup-debug api get /nodes/localhost/tasks --typefilter=backup --start=0 --limit=500 --output-format json-pretty

==List the vms in a datastore==
proxmox-backup-client list

==Show cluster status==
pvecm status

=PBS Backups=

==Create new backup repository==
===On PBS server:===
====Create account====

Configuration->Access Control->User Management->Add

====Create datastore====
Create space, normally something like
zfs create pbspool/mystore

Datastore->Add Datastore
New subdirectory will be created

Backup path must be full path to storage + datastore name
Configuration->Access Control->Permissions
Datastore->yournewstore->Permissions
to give the user access, Role is usually DatastoreBackup

===On PBS guest:===
Datacenter->Storage->Add->Proxmox backup server
For "Datastore" enter the name as used on the PBS.
For fingerprint (on pbs server):
proxmox-backup-manager cert info | grep Fingerprint

Then:
Backup->Add storage: your-pbs

==Remove PBS datastore==
proxmox-backup-manager datastore remove yourdatastore
this does not delete the data!

===Move a PBS datastore===
rsync -auv /mnt/datastore/old /mnt/datastore/new
systemctl stop proxmox-backup-proxy
rsync -auv /mnt/datastore/old /mnt/datastore/new
vi /etc/proxmox-backup/datastore.cfg
systemctl start proxmox-backup-proxy
and after checking everything you can
rm -vf /mnt/datastore/old

==Move vm data to another datastore==
=== Create local sync user ===
localsync@pbs
Permissions: datastorereader on source, datastorebackup on target

== PBS API ==
*[https://pbs.proxmox.com/docs/user-management.html?highlight=token#api-tokens API Tokens]
*[https://pbs.proxmox.com/docs/api-viewer/ PBS API viewer]

PBS equivalent for '''pvesh''':
proxmox-backup-debug

example:
proxmox-backup-debug api get /status/datastore-usage

proxmox-backup-debug api get /nodes/localhost/tasks

===Create cookie===
PBS=your.pbs.server
curl --silent --insecure --data "username=zabbix@pbs&password=n0tmyp4ss" https://$PBS:8007/api2/json/access/ticket | jq --raw-output '.data.ticket' | sed 's/^/PBSAuthCookie=/' > cookie

Test cookie
curl -XGET --silent -k -b $(cat cookie ) https://$PBS:8007/api2/json/

== Recovering files from backup ==

export PBS_REPOSITORY=mypbs:mydatastore
proxmox-backup-client snapshot list

Output like: '''vm/109/2022-01-25T20:18:02Z │ 200.00 GiB │ client.log drive-ide0.img index.json qemu-server.conf'''

# proxmox-backup-client map vm/109/2022-01-25T20:18:02Z drive-ide0.img

Image 'data2:vm/109/2022-01-25T20:18:02Z/drive-ide0.img' mapped on /dev/loop0

# lsblk

NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
loop0 7:0 0 200G 1 loop
├─loop0p1 259:0 0 251M 1 part
├─loop0p2 259:1 0 3.9G 1 part
└─loop0p3 259:2 0 195.9G 1 part

 

mount /dev/loop0p3 /mnt/loop/

mount: /mnt/loop: cannot mount /dev/loop0p3 read-only.

mount -o loop,ro,norecovery /dev/loop0p3 /mnt/loop/

and that should be it. After you're done:

umount /mnt/loop
proxmox-backup-client unmap /dev/loop0

 

TBD: explain how t o use kpartx and friends to acces LVM volumes

 

= FAQ =
==Error messages==
===user account disabled or expired===

===error fetching datastores - 401 Unauthorized (500)===
Check username/password :)

===datastore path not empty===
When trying to create a datastore.
https://forum.proxmox.com/threads/bug-when-adding-new-storage-task-error-datastore-path-is-not-empty.157629/

===TASK ERROR: sync failed with some errors===
??

===remove the file '/run/proxmox-backup/old-locking', and reload all PBS daemons===
When no jobs running:
rm /run/proxmox-backup/old-locking
for me worked:
systemctl restart proxmox-backup.service
systemctl restart proxmox-backup-proxy.service

===The devices are not in fstab, where are they configured?===
See [https://www.man7.org/linux//man-pages/man5/systemd.mount.5.html systemd.mount(5)] and [https://www.man7.org/linux//man-pages/man1/systemd-mount.1.html systemd-mount(5)].

==Limit bandwidth==
===On cluster node===
In /etc/vzdump.conf
# In KB/s
bwlimit: 1500

==Garbage collection==
===What does the '''Prune all''' button do?===
It will give you a dialog with the usual 'Keep xxx' options.

=== TASK ERROR: update atime failed, disk full ===
Try pruning some
Check if some sync is running

===unable to access non-existent chunk===
check if this returns?

=== Pending removals ===

proxmox-backup-manager garbage-collection status mystore

== error pruning backups - check log (500) ==

Possibly a permissions thing, which is good. Leave pruning to the backup server

==command error: http upgrade request timed out==
??

==Connection error - server offline?==
This can also happen when you can actually connect to server:8007
Check
systemctl status proxmox-backup

==Connection error 401: No ticket==
Browser issues, try clearing cache/cookies(?) or another browser.

==Noout flag(s) set==
ceph osd unset noout

==qmp command 'query-backup' failed - got wrong command id==
maybe bwlimit?

==create storage failed: mypbs: error fetching datastores - 500 Can't connect to mypbs:8007 (Connection timed out) (500)==

==Garbage collection failed: unlinking chunk ... ENOENT: No such file or directory==
Ignore?

==Sync errror: owner check failed==
Check in datastore/yourrepository/vm/*/owner

There's command
proxmox-backup-client change-owner

==Sync remote==

==tcp connect error: deadline has elapsed==
Probably connection timeout.
===proxmox-backup-manager remote list not showing remote===
Try
proxmox-backup-manager remote show
Check
/etc/proxmox-backup/remote.cfg

===Retrieve PBS password===
On a pve node check '''/etc/pve/priv/storage/'''

===group lock failed: Permission denied===
Probably a mismatch between path in /etc/proxmox-backup/datastore.cfg and actual location.
You also need to restart proxmox-backup-proxy.service after changing either of those.

==Where are the devices behind the datastores listed/configured?==
systemctl list-units | grep mount

[[Category:Backup]]

ZFS

2026-06-05T14:48:10Z

Tony: /* Add log/cache */

= Links =
*[http://open-zfs.org http://open-zfs.org]
*[http://www.edplese.com/samba-with-zfs.html http://www.edplese.com/samba-with-zfs.html]
*[http://wintelguy.com/zfs-calc.pl ZFS calculator]
*[https://www.raidz-calculator.com/default.aspx another zfs calculator]
*[https://bm-stor.com/index.php/blog/Linux-cluster-with-ZFS-on-Cluster-in-a-Box/ ZFS clustering]
*[https://jrs-s.net/2015/02/03/will-zfs-and-non-ecc-ram-kill-your-data/ https://jrs-s.net/2015/02/03/will-zfs-and-non-ecc-ram-kill-your-data/] ZFS and ECC]
*[https://docs.joyent.com/private-cloud/troubleshooting/disk-replacement ZFS troubleshooting/disk replacement]
*[https://www.high-availability.com/docs/Quickstart-ZFS-Cluster/ Creating a ZFS HA Cluster using shared or shared-nothing storage]
*[https://arstechnica.com/information-technology/2020/05/zfs-101-understanding-zfs-storage-and-performance/ ZFS 101]
*[https://arstechnica.com/gadgets/2021/06/raidz-expansion-code-lands-in-openzfs-master/ Raidz expansion]
*[https://somedudesays.com/2021/08/the-basic-guide-to-working-with-zfs/ Basic guide to working with zfs]
*[https://wiki.archlinux.org/title/ZFS Archlinux page on ZFS]
*[https://openzfs.github.io/openzfs-docs/Basic%20Concepts/RAIDZ.html Raidz basic concepts]

*[https://github.com/openzfs/zfs/commit/a8d83e2a24de6419dc58d2a7b8f38904985726cb#diff-04f1093cc6ee1ece5d6dc700498a8ce9617346e3d2c252f270760103e6ebf399L585 arcstats: p replaced with pm and pd]

=Documentation=

*[https://openzfs.github.io/openzfs-docs/man/4/zfs.4.html zfs manpage]
*[http://zfsonlinux.org/ ZFS on Linux]
*[https://openzfs.org/wiki/ openzfs wiki]
*[https://wiki.gentoo.org/wiki/ZFS https://wiki.gentoo.org/wiki/ZFS]
*[https://blog.programster.org/zfs-cheatsheet ZFS cheatsheet]
*[http://wiki.freebsd.org/ZFSQuickStartGuide http://wiki.freebsd.org/ZFSQuickStartGuide]
*[http://www.opensolaris.org/os/community/zfs/intro/ Opensolaris ZFS intro]
*[http://www.raidz-calculator.com/raidz-types-reference.aspx raidz types reference]
*[https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSZpoolFragmentationMeaning ZFS fragmentation]
*[https://openzfs.github.io/openzfs-docs/Basic%20Concepts/RAIDZ.html raidz]

==ARC/Caching==
*[https://klarasystems.com/articles/applying-the-arc-algorithm-to-the-arc/ Applying the ARC Algorithm to the ARC]
*[https://linuxhint.com/configure-zfs-cache-high-speed-io/ Configuring ZFS Cache for High-Speed IO]
*[https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSARCItsVariousSizes ZFS Arc various sizes]
*[http://dtrace.org/blogs/brendan/2012/01/09/activity-of-the-zfs-arc/ Activity of the ZFS ARC]
*[https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSUnderstandingARCHits Understanding ARC hits]
*[https://www.45drives.com/community/articles/zfs-caching/ ZFS Caching]
*[https://zfs-discuss.opensolaris.narkive.com/D7v2YmjF/raidz-what-is-stored-in-parity What is stored in parity]

===L2ARC===
*[https://www.brendangregg.com/blog/2008-07-22/zfs-l2arc.html ZFS L2ARC]
*[https://klarasystems.com/articles/openzfs-all-about-l2arc/ OpenZFS: All about the cache vdev or L2ARC]

sysctl kstat.zfs.misc.arcstats | egrep 'l2_(hits|misses)'
and
egrep 'l2_(hits|misses)' /proc/spl/kstat/zfs/arcstats

==ZIL==
*[https://utcc.utoronto.ca/~cks/space/blog/linux/ZFSGlobalZILInformation What ZIL metrics are exposed by (Open)ZFS on Linux]
*[http://nex7.blogspot.com/2013/04/zfs-intent-log.html ZFS Intent Log ]
===Adding ZIL/SLOG===
zpool add -f tank log sda3 sdb3
====adding devices with different physical sector sizes is not allowed====
'''zpool add -f'''

==Tuning ZFS==
*[https://openzfs.github.io/openzfs-docs/Performance%20and%20Tuning/index.html ZFS Performance and Tuning]
*[https://linuxhint.com/configure-zfs-cache-high-speed-io/ Configuring ZFS Cache for High-Speed IO]
*[https://www.high-availability.com/docs/ZFS-Tuning-Guide/ ZFS Tuning and Optimisation]
([https://forums.oracle.com/ords/apexds/post/part-10-monitoring-and-tuning-zfs-performance-4977 Monitoring and Tuning ZFS Performance]

==ARC statistics==
*[https://openzfs.github.io/openzfs-docs/Performance%20and%20Tuning/Module%20Parameters.html Tuning module parameters]
*[https://openzfs.github.io/openzfs-docs/man/master/4/zfs.4.html ZFS]

===ZFS module parameters===
ls /sys/module/zfs/parameters/
cat /proc/spl/kstat/zfs/arcstats

===data_size===
size of cached user data

===dnode_size===

===hdr_size===
size of L2ARC headers stored in main ARC

===metadata_size===
size of cached metadata

=Tools=
*[https://github.com/asomers/ztop ztop]
*[https://github.com/jimsalterjrs/ioztat ioztat]
*[https://cuddletech.com/2008/10/explore-your-zfs-adaptive-replacement-cache-arc/ arc_summary]
*[https://github.com/richardelling/zfs-linux-tools zfs-linux-tools] kstat-analyzer is rather helpful

==kstat-analyzer==

===prefetch hit rate is low, consider tuning prefetcher===
Check:

Supposed to leave that at 0:
cat /sys/module/zfs/parameters/zfs_vdev_cache_size

Code:
if (float(kstats['hits']) / accesses) < PREFETCH_RATIO_OK

Relevant links:
*https://www.truenas.com/community/threads/notes-on-zfs-prefetch.1076/

*https://www.phoronix.com/news/OpenZFS-Uncached-Prefetch
*https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSARCStatsAndPrefetch

===error: arcstats value "p" not found===
'p' seems to be missing on some systems
See [https://github.com/openzfs/zfs/commit/a8d83e2a24de6419dc58d2a7b8f38904985726cb#diff-04f1093cc6ee1ece5d6dc700498a8ce9617346e3d2c252f270760103e6ebf399L585 More adaptive ARC eviction]

==Benchmarking zfs==
*[https://github.com/richardelling/zfs-linux-tools/tree/master/fio fio]

=Processes=
==arc_evict==
Evict buffers from list until we've removed the specified number of
bytes. Move the removed buffers to the appropriate evict state.
If the recycle flag is set, then attempt to "recycle" a buffer:
- look for a buffer to evict that is `bytes' long.
- return the data block from this buffer rather than freeing it.
This flag is used by callers that are trying to make space for a
new buffer in a full arc cache.

This function makes a "best effort". It skips over any buffers
it can't get a hash_lock on, and so may not catch all candidates.
It may also return without evicting as much space as requested.

==arc_prune==

=Commands=
==Get IO statistics==
===zapool-iostat===
*[https://klarasystems.com/articles/openzfs-using-zpool-iostat-to-monitor-pool-perfomance-and-health/ OpenZFS: Using zpool iostat to monitor pool performance and health]

==Getting arc statistics==
arcstat

arc_summary
Tip, for details use
arc_summary -d
There is also
cat /proc/spl/kstat/zfs/arcstats

and
zfetchstat + kstat-analyzer from zfs-linux-tools

===zil/slog statistics===
arc_summary -s zil
or
cat /proc/spl/kstat/zfs/zil
or
zilstat
or
zpool iostat -v

===l2arc statistics===
arc_summary -s l2arc

==Getting IO statistics==
Also man zpool-iostat
zpool iostat -v 300

=Terms and acronyms=
==vdev==
'''V'''irtual '''Dev'''ice.

*[https://wiki.archlinux.org/title/ZFS/Virtual_disks ZFS Virtual disks]
==ARC==
'''A'''daptive '''R'''eplacement '''C'''ache

Portion of RAM used to cache data to speed up read performance

==L2ARC==
'''L'''evel '''2''' '''A'''daptive Replacement '''C'''ache'''

"L2ARC is usually considered if hit rate for the ARC is below 90% while having 64+ GB of RAM"

SSD cache

==DMU==
Data Management Unit

==MFU==
Most Frequently Used

==MRU==
Most Recently Used

==zvol==
kind of block device whose space is allocated from the pool, useful for iscsi targets

==Scrubbing==
Checking disks/data integrity
zpool status <poolname> | grep scrub

and
zpool scrub <poolname>
probably taken care of by cron.

==SLOG==
See [ZIL]

==ZIL==
'''ZFS Intent Log'''

[https://constantin.glez.de/2010/07/20/solaris-zfs-synchronous-writes-and-zil-explained/ ZIL explained]

the space synchronous writes are logged before the confirmation is sent back to the client

==prefetch==
See /proc/spl/kstat/zfs/zfetchstats

*[https://cuddletech.com/2009/05/understanding-zfs-prefetch/ Understanding ZFS prefetch]
*[https://svennd.be/tuning-of-zfs-module/ Tuning of the ZFS module]
*[https://cuddletech.com/2009/05/understanding-zfs-prefetch/ Understanding ZFS prefetch]
*[https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSARCStatsAndPrefetch Some basic ZFS ARC statistics and prefetching]
*[https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSPrefetchStatsNotes Some notes on ZFS prefetch related stats]
*[http://dtrace.org/blogs/brendan/2012/01/09/activity-of-the-zfs-arc/ Activity of the ZFS ARC]

= HOWTO =
== Get zfs version ==
cat /sys/module/zfs/version

==Get quota sizes/reservations==
zfs get quota,reservation tank/vol1
or just
zfs get quota

==Set maximum size of dataset==
zfs set quota=200G tank/myset

==Caching==
===Add log/cache===
For l2arc cache mirrors make little sense, just add disks
zpool add rpool cache sdf
or maybe better
zpool add rpool cache /dev/disk/by-id/ata-SAMSUNG_MZ7LH960HAJR-00005_S45NNA0N47394
or simply
zpool add rpool cache ata-SAMSUNG_MZ7LH960HAJR-00005_S45NNA0N47394

===Add ZIL/SLOG write cache===

zpool add rpool log mirror sdk sdl

===Remove ZIl/SLOG mirrored cache===
zpool remove mypool mirror-4 sdn1 sdo1

==Getting statistics==

===Show cache activity===
dstat --zfs-arc --zfs-l2arc --zfs-zil -d 5

===zpool===
zpool iostat
====More statistics, every 5 seconds====
zpool iostat -v 5

===Flush linux caches===
echo 3 > /proc/sys/vm/drop_caches

===arc statistics===
===l2arc statistics===

===ZIL statistics===
cat /proc/spl/kstat/zfs/zil

==Create zfs filesystem==
zfs create poolname/fsname
this also creates mountpoint

==Add vdev to pool==
zpool add mypool raidz1 sdg sdh sdi

== Replace disk in zfs ==

=== Some links ===

*[https://itectec.com/ubuntu/ubuntu-replacing-a-dead-disk-in-a-zpool/ https://itectec.com/ubuntu/ubuntu-replacing-a-dead-disk-in-a-zpool/]

Get information first:

Name of disk

zpool status

Find uid of disk to replace

take it offline

zpool offline poolname ata-WDC_WD20EFRX-68EUZN0_WD-WCC4M5RLZC6V

Get the disk guid:

zdb

guid: 15233236897831806877

Get list of disk by id:

ls -al /dev/disk/by-id

Save the id, shutdown, replace disk, boot:

Find the new disk:

ls -al /dev/disk/by-id

Run replace command. The id is the guid of the old disk, name is of the new disk

zpool replace tank /dev/disk/by-id/13450850036953119346 /dev/disk/by-id/ata-ST4000VN000-1H4168_Z302FQVZ

or just
zpool replace tank /dev/sdi

===If disk is shown as '''UNAVAIL'''===
zpool offline tank sdi

==Showing information about ZFS pools and datasets==
===Show pools with sizes===
zpool list
or
zpool list -H -o name,size

===Show reservations on datasets===
zfs list -o name,reservation

==Swap on zfs==
https://askubuntu.com/questions/228149/zfs-partition-as-swap
zfs create pool/swap -V 4G -b 4K
mkswap -f /dev/pool/swap
swapon /dev/pool/swap
and remember fstab

==vdevs==
===multiple vdevs===
Multiple vdevs in a zpool get striped.
What about balance?

===invalid vdev specification===
Probably means you need -f

===show balance between vdevs===
zpool iostat -v 'pool' [interval in seconds]
orjust
zpool iostat -vc 'pool'

== Tuning arc settings ==
See [https://openzfs.github.io/openzfs-docs/Performance%20and%20Tuning/Module%20Parameters.html Tuning ZFS modules parameters]
===zfs_arc_max===
Linux defaults to giving 50% of RAM to arc, this is when:
cat /sys/module/zfs/parameters/zfs_arc_max
0
grep c_max /proc/spl/kstat/zfs/arcstats
To change this:
echo 5368709120 > /sys/module/zfs/parameters/zfs_arc_max
and add to /etc/modprobe.d/zfs.conf
options zfs zfs_arc_max=5368709120

'''NOTE you might need to run (for example when running / on zfs)'''
update-initramfs -u -k all

and perhaps clear caches and reset counters:

echo 3 > /proc/sys/vm/drop_caches

===Tune zfs_arc_dnode_limit_percent===
See https://openzfs.github.io/openzfs-docs/man/master/4/zfs.4.html

Whenzfs_arc_dnode_limit = 0, percent will be used
echo 20 > /sys/module/zfs/parameters/zfs_arc_dnode_limit_percent

In /etc/modprobe.d/zfs.conf:

options zfs zfs_arc_dnode_limit_percent=20

===export iscsi===
* https://linuxhint.com/share-zfs-volumes-via-iscsi/

==Get all volume info==
zfs get all tank/myvol
==Get volume size==
zfs get volsize tank/myvol

==Set volume size==
zfs set volsize=200G tank/myvol

= FAQ =
==No pools available==
Try
zpool import -d /dev/disk/by-id tank

==arc_summary==
===VDEV cache disabled, skipping section===
This is normal, vdev caching is considered bad in current code

==Arc metadata size exceeds maximum==
So '''arc_meta_used''' > '''arc_meta_limit'''

==increasing feed rate==

== show status and disks ==

zpool status

===show more about disks===
zpool status -P

== show drives/pools ==

zfs list

== List disk devices in pool ==
POOL=rpool
zpool list -Pv $POOL | awk '/^ / {print $1}' | xargs ls -l | awk '{ print $11 }' | sed 's/\.\.\/\.\.\//\/dev\//g'
== check raid level ==

zfs list -a

==Estimate raidz speeds==
raidz1: N/(N-1) * IOPS
raidz2: N/(N-2) * IOPS
raidz3: N/(N-3) * IOPS

==VDEV cache disabled, skipping section==
Looks like you just don't have l2arc cache

==cannot export 'tank': pool is busy==
After checking stuff like nfs etc try:
zfs unshare -a
zfs umount -a -f
zpool export -f tank

==Error messages==
===One or more devices has experienced an unrecoverable error.===

===The ZFS modules cannot be auto-loaded.===

===modprobe: FATAL: Module zfs not found ===
Maybe try
apt install zfs-dkms

==Quota==
===size is less than current used or reserved space===
zfs get quota,reservation
for clues

Proxmox Backup Server

2026-06-05T08:44:50Z

Tony: /* FAQ */

=Links=
*[https://www.proxmox.com/en/proxmox-backup-server/overview PBS Homepage]
*[https://pypi.org/project/pbs-monitoring-tools/ PBS monitoring tools]

= Documentation =
*[https://pbs.proxmox.com/docs/ PBS documentation]
*[https://pbs.proxmox.com/docs/technical-overview.html PBS Technical overview]
*[https://pbs.proxmox.com/docs/managing-remotes.html Managing PBS remotes & sync]

==Installation==
*[https://pbs.proxmox.com/docs/installation.html Installing PBS]

==Upgrading PBS==
*[https://pbs.proxmox.com/wiki/index.php/Upgrade_from_2_to_3 Upgrading PBS 2 to 3]

=Processes=
==Service daemons==
See [https://pbs.proxmox.com/docs/sysadmin.html#service-daemons Service Daemons]

==Command line tools==
See [https://pbs.proxmox.com/docs/sysadmin.html#command-line-tools Command-line Tools]

==Under the hood==
Structure of datastore:
/mnt/datastore/yourDS
contains:
===.chunks===
The actual data
===.lock===
===vm===
Metadata per vm:
client.log.blob drive-scsi0.img.fidx index.json.blob qemu-server.conf.blob
===.gc-status===

=Configuration files=
==/etc/proxmox/remote.cfg==
In WebUI under Configuration->Remotes

==Notifications==
===Notification system===
====/etc/backup-server/notifications.cfg====
Contains the default settings, managed via Configuration->Notifications
=HOWTO=

==Move datastore==
*Make sure there is no activity on that datastore, i suggest using rsync. As i can tell it should be safe to use rsync option '''--ignore-existing''' when updating a copy.
*Edit '/etc/proxmox-backup/datastore.cfg' to change path to datastore.
*Reload configuration ('''this will interrupt running garbage collectors''') :
systemctl reload proxmox-backup-proxy

==Upgrade proxmox 6 to 7==
https://pve.proxmox.com/wiki/Upgrade_from_6.x_to_7.0

===WARN: 'noout' flag not set - recommended to prevent rebalancing during cluster-wide upgrades===
https://docs.ceph.com/en/quincy/rados/troubleshooting/troubleshooting-osd/
ceph osd set noout

==Restore disk from PBS==
Use [[pbs-restore]]

==What's so busy?==
proxmox-backup-manager list
and then
proxmox-backup-manager task log <everying from and including "UPID:">

==Show some logs==
proxmox-backup-manager task list --all

or perhaps
proxmox-backup-debug api get /nodes/{node}/tasks --typefilter=backup
where {node} can be found with
proxmox-backup-debug api get /nodes/
OR
proxmox-backup-debug api get /nodes/localhost/tasks --typefilter=backup --start=0 --limit=500 --output-format json-pretty

==List the vms in a datastore==
proxmox-backup-client list

==Show cluster status==
pvecm status

=PBS Backups=

==Create new backup repository==
===On PBS server:===
====Create account====

Configuration->Access Control->User Management->Add

====Create datastore====
Create space, normally something like
zfs create pbspool/mystore

Datastore->Add Datastore
New subdirectory will be created

Backup path must be full path to storage + datastore name
Configuration->Access Control->Permissions
Datastore->yournewstore->Permissions
to give the user access, Role is usually DatastoreBackup

===On PBS guest:===
Datacenter->Storage->Add->Proxmox backup server
For "Datastore" enter the name as used on the PBS.
For fingerprint (on pbs server):
proxmox-backup-manager cert info | grep Fingerprint

Then:
Backup->Add storage: your-pbs

==Remove PBS datastore==
proxmox-backup-manager datastore remove yourdatastore
this does not delete the data!

===Move a PBS datastore===
rsync -auv /mnt/datastore/old /mnt/datastore/new
systemctl stop proxmox-backup-proxy
rsync -auv /mnt/datastore/old /mnt/datastore/new
vi /etc/proxmox-backup/datastore.cfg
systemctl start proxmox-backup-proxy
and after checking everything you can
rm -vf /mnt/datastore/old

==Move vm data to another datastore==
=== Create local sync user ===
localsync@pbs
Permissions: datastorereader on source, datastorebackup on target

== PBS API ==
*[https://pbs.proxmox.com/docs/user-management.html?highlight=token#api-tokens API Tokens]
*[https://pbs.proxmox.com/docs/api-viewer/ PBS API viewer]

PBS equivalent for '''pvesh''':
proxmox-backup-debug

example:
proxmox-backup-debug api get /status/datastore-usage

proxmox-backup-debug api get /nodes/localhost/tasks

===Create cookie===
PBS=your.pbs.server
curl --silent --insecure --data "username=zabbix@pbs&password=n0tmyp4ss" https://$PBS:8007/api2/json/access/ticket | jq --raw-output '.data.ticket' | sed 's/^/PBSAuthCookie=/' > cookie

Test cookie
curl -XGET --silent -k -b $(cat cookie ) https://$PBS:8007/api2/json/

== Recovering files from backup ==

export PBS_REPOSITORY=mypbs:mydatastore
proxmox-backup-client snapshot list

Output like: '''vm/109/2022-01-25T20:18:02Z │ 200.00 GiB │ client.log drive-ide0.img index.json qemu-server.conf'''

# proxmox-backup-client map vm/109/2022-01-25T20:18:02Z drive-ide0.img

Image 'data2:vm/109/2022-01-25T20:18:02Z/drive-ide0.img' mapped on /dev/loop0

# lsblk

NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
loop0 7:0 0 200G 1 loop
├─loop0p1 259:0 0 251M 1 part
├─loop0p2 259:1 0 3.9G 1 part
└─loop0p3 259:2 0 195.9G 1 part

 

mount /dev/loop0p3 /mnt/loop/

mount: /mnt/loop: cannot mount /dev/loop0p3 read-only.

mount -o loop,ro,norecovery /dev/loop0p3 /mnt/loop/

and that should be it. After you're done:

umount /mnt/loop
proxmox-backup-client unmap /dev/loop0

 

TBD: explain how t o use kpartx and friends to acces LVM volumes

 

= FAQ =
==Error messages==
===user account disabled or expired===

===error fetching datastores - 401 Unauthorized (500)===
Check username/password :)

===datastore path not empty===
When trying to create a datastore.
https://forum.proxmox.com/threads/bug-when-adding-new-storage-task-error-datastore-path-is-not-empty.157629/

===TASK ERROR: sync failed with some errors===
??

===remove the file '/run/proxmox-backup/old-locking', and reload all PBS daemons===
When no jobs running:
rm /run/proxmox-backup/old-locking
for me worked:
systemctl restart proxmox-backup.service
systemctl restart proxmox-backup-proxy.service

==Limit bandwidth==
===On cluster node===
In /etc/vzdump.conf
# In KB/s
bwlimit: 1500

==Garbage collection==
===What does the '''Prune all''' button do?===
It will give you a dialog with the usual 'Keep xxx' options.

=== TASK ERROR: update atime failed, disk full ===
Try pruning some
Check if some sync is running

===unable to access non-existent chunk===
check if this returns?

=== Pending removals ===

proxmox-backup-manager garbage-collection status mystore

== error pruning backups - check log (500) ==

Possibly a permissions thing, which is good. Leave pruning to the backup server

==command error: http upgrade request timed out==
??

==Connection error - server offline?==
This can also happen when you can actually connect to server:8007
Check
systemctl status proxmox-backup

==Connection error 401: No ticket==
Browser issues, try clearing cache/cookies(?) or another browser.

==Noout flag(s) set==
ceph osd unset noout

==qmp command 'query-backup' failed - got wrong command id==
maybe bwlimit?

==create storage failed: mypbs: error fetching datastores - 500 Can't connect to mypbs:8007 (Connection timed out) (500)==

==Garbage collection failed: unlinking chunk ... ENOENT: No such file or directory==
Ignore?

==Sync errror: owner check failed==
Check in datastore/yourrepository/vm/*/owner

There's command
proxmox-backup-client change-owner

==Sync remote==

==tcp connect error: deadline has elapsed==
Probably connection timeout.
===proxmox-backup-manager remote list not showing remote===
Try
proxmox-backup-manager remote show
Check
/etc/proxmox-backup/remote.cfg

===Retrieve PBS password===
On a pve node check '''/etc/pve/priv/storage/'''

===group lock failed: Permission denied===
Probably a mismatch between path in /etc/proxmox-backup/datastore.cfg and actual location.
You also need to restart proxmox-backup-proxy.service after changing either of those.

==Where are the devices behind the datastores listed/configured?==
systemctl list-units | grep mount

[[Category:Backup]]

Apt

2026-06-05T08:04:50Z

Tony: /* FAQ */

Debian/Ubuntu package manager

=Documentation=
==Phased Packages==
* [https://documentation.ubuntu.com/server/explanation/software/about-apt-upgrade-and-phased-updates/index.html About apt upgrade and phased updates]

=Unattended upgrades=
==Links==
*https://help.ubuntu.com/community/AutomaticSecurityUpdates
*[https://pimylifeup.com/unattended-upgrades-debian-ubuntu/ Using Unattended-Upgrades on Debian and Ubuntu]
*https://wiki.debian.org/UnattendedUpgrades
*https://linuxblog.io/how-to-enable-unattended-upgrades-on-ubuntu-debian/
*[https://gist.github.com/CodingKoopa/3b30afe8c91e3950f6b124cd2abe3b6b the apt manpage you were looking for]

==Enabling/disabling unattended upgrades==
Maybe install it first
apt install unattended-upgrades
that will most likely also enable unattended upgrades
then
dpkg-reconfigure unattended-upgrades
The dialog will show which option is selected now.

==The relevant systemd service==
apt-daily-upgrade.service

==Disable unattended upgrades==
In /etc/apt/apt.conf.d/20auto-upgrades
APT::Periodic::Unattended-Upgrade "0";
==The logs==
/var/log/unattended-upgrades/*.log

==FAQ==
===Unattended-upgrade is not upgrading all packages===
That's normal, it defaults to upgrading only security updates.

===Unattended-Upgrade::DevRelease "auto";===
Only works on "dev releases", which is any not .04

==What is this Allowed-Origins about?==
Check output of
apt -s upgrade

you might see something like

Conf cloud-init (25.1.2-0ubuntu0~22.04.2 '''Ubuntu:22.04/jammy-updates'''

which will match
${distro_id}:${distro_codename}-updates

==No packages found that can be upgraded unattended==
By default '''"${distro_id}:${distro_codename}-updates";''' is commented out in '''/etc/apt/apt.conf.d/50unattended-upgrades''', so to get those updated as well, uncomment that line.

=HOWTO=
==Extract files from .deb==
dpkg-deb
or just
dpkg -e foo.deb
note: this extracts to .

==Pin a version==
*[https://help.ubuntu.com/community/PinningHowto Pinning Howto]

==List installed packages==
apt list --installed

==Upgrade just one package==
apt-get install --only-upgrade <packagename>

==exclude package from upgrade==
apt-mark hold somepackage
and to undo
apt-mark unhold somepackage

==Disable source in deb822 source file==
add
Enabled: no

= FAQ =
==What is new style sources files called?==
deb822

== the following packages have been kept back: ==

Time to apt-get dist-upgrade ( but check [https://askubuntu.com/questions/194651/why-use-apt-get-upgrade-instead-of-apt-get-dist-upgrade/226213#226213 ]first But it could be different things.
See https://askubuntu.com/questions/601/the-following-packages-have-been-kept-back-why-and-how-do-i-solve-it
Perhaps:
apt-get upgrade package-that-is-kept-back
or try
apt install package-that-is-kept-back

==What version of a package is going to be installed?==
apt-cache policy <package>
==What package does a file belong to?==
dpkg -S /path/to/file

==Error messages==

===InRelease doesn't support architecture 'i386'===
set ''arch=amd64''' in sources old style or '''Architectures: amd64'' new style

===E: Could not get lock /var/lib/apt/lists/lock. It is held by process 1538337 (apt-get)===

Try
systemctl restart packagekit
and check
fuser /var/lib/apt/lists/lock
again

===Repository changed its 'Version' value===
Try
apt-get --allow-releaseinfo-change update

===The repository 'http://security.debian.org buster/updates Release' no longer has a Release file===
time to upgrade entire system

==Unable to correct problems, you have held broken packages.==
Try
dpkg --get-selections | grep hold

==What packages depend on package==
apt-cache rdepends --installed libc6-dev

=== Clear cache ===

apt-get clean

==Could not handshake: The TLS connection was non-properly terminated.==
try http instead of https

==Depends: but it is not going to be installed==
First try
apt-get update && apt-get upgrade

==E: Unable to correct problems, you have held broken packages.==

==Which services should be restarted?==
That's from '''needrestart'''

==Prevent restarting all services when installing a package==
NEEDRESTART_MODE=i apt install somepackage

==What repository provides package==
apt policy <packagename>

==Error messages==
===Key is stored in legacy trusted.gpg keyring===
Check [https://itsfoss.com/apt-key-deprecated/ apt-key is deprecated]

===Certificate verification failed: The certificate is NOT trusted.===
try
deb [trusted=yes] ...
in sources.list, but things might be worse than that, in case of launchpad change to
https://ppa.launchpadcontent.net/

===apt-key is deprecated. Manage keyring files in trusted.gpg.d instead===
See [https://itsfoss.com/apt-key-deprecated/ apt-key is deprecated]

==The following upgrades have been deferred due to phasing==
apt install <whatever package it lists>

==needrestart==
===Show which services need restarting===
needrestart -rl
===Service restarts being deferred===
Probably services like '''networkd-dispatcher.service'''.
Check '''/etc/needrestart/needrestart.conf''' for '''$nrconf{override_rc}'''

[[Category:Debian]]

Apt

2026-06-05T08:02:27Z

Tony: /* FAQ */

Debian/Ubuntu package manager

=Documentation=
==Phased Packages==
* [https://documentation.ubuntu.com/server/explanation/software/about-apt-upgrade-and-phased-updates/index.html About apt upgrade and phased updates]

=Unattended upgrades=
==Links==
*https://help.ubuntu.com/community/AutomaticSecurityUpdates
*[https://pimylifeup.com/unattended-upgrades-debian-ubuntu/ Using Unattended-Upgrades on Debian and Ubuntu]
*https://wiki.debian.org/UnattendedUpgrades
*https://linuxblog.io/how-to-enable-unattended-upgrades-on-ubuntu-debian/
*[https://gist.github.com/CodingKoopa/3b30afe8c91e3950f6b124cd2abe3b6b the apt manpage you were looking for]

==Enabling/disabling unattended upgrades==
Maybe install it first
apt install unattended-upgrades
that will most likely also enable unattended upgrades
then
dpkg-reconfigure unattended-upgrades
The dialog will show which option is selected now.

==The relevant systemd service==
apt-daily-upgrade.service

==Disable unattended upgrades==
In /etc/apt/apt.conf.d/20auto-upgrades
APT::Periodic::Unattended-Upgrade "0";
==The logs==
/var/log/unattended-upgrades/*.log

==FAQ==
===Unattended-upgrade is not upgrading all packages===
That's normal, it defaults to upgrading only security updates.

===Unattended-Upgrade::DevRelease "auto";===
Only works on "dev releases", which is any not .04

==What is this Allowed-Origins about?==
Check output of
apt -s upgrade

you might see something like

Conf cloud-init (25.1.2-0ubuntu0~22.04.2 '''Ubuntu:22.04/jammy-updates'''

which will match
${distro_id}:${distro_codename}-updates

==No packages found that can be upgraded unattended==
By default '''"${distro_id}:${distro_codename}-updates";''' is commented out in '''/etc/apt/apt.conf.d/50unattended-upgrades''', so to get those updated as well, uncomment that line.

=HOWTO=
==Extract files from .deb==
dpkg-deb
or just
dpkg -e foo.deb
note: this extracts to .

==Pin a version==
*[https://help.ubuntu.com/community/PinningHowto Pinning Howto]

==List installed packages==
apt list --installed

==Upgrade just one package==
apt-get install --only-upgrade <packagename>

==exclude package from upgrade==
apt-mark hold somepackage
and to undo
apt-mark unhold somepackage

==Disable source in deb822 source file==
add
Enabled: no

= FAQ =
==What is new style sources files called?==
deb822

==What version of a package is going to be installed?==
apt-cache policy <package>
==What package does a file belong to?==
dpkg -S /path/to/file

==Error messages==
===E: Could not get lock /var/lib/apt/lists/lock. It is held by process 1538337 (apt-get)===

Try
systemctl restart packagekit
and check
fuser /var/lib/apt/lists/lock
again

===Repository changed its 'Version' value===
Try
apt-get --allow-releaseinfo-change update

===The repository 'http://security.debian.org buster/updates Release' no longer has a Release file===
time to upgrade entire system

==Unable to correct problems, you have held broken packages.==
Try
dpkg --get-selections | grep hold

==What packages depend on package==
apt-cache rdepends --installed libc6-dev

=== Clear cache ===

apt-get clean

==Could not handshake: The TLS connection was non-properly terminated.==
try http instead of https

==Depends: but it is not going to be installed==
First try
apt-get update && apt-get upgrade

==E: Unable to correct problems, you have held broken packages.==

==Which services should be restarted?==
That's from '''needrestart'''

==Prevent restarting all services when installing a package==
NEEDRESTART_MODE=i apt install somepackage

==What repository provides package==
apt policy <packagename>

==Error messages==
===Key is stored in legacy trusted.gpg keyring===
Check [https://itsfoss.com/apt-key-deprecated/ apt-key is deprecated]

===Certificate verification failed: The certificate is NOT trusted.===
try
deb [trusted=yes] ...
in sources.list, but things might be worse than that, in case of launchpad change to
https://ppa.launchpadcontent.net/

===apt-key is deprecated. Manage keyring files in trusted.gpg.d instead===
See [https://itsfoss.com/apt-key-deprecated/ apt-key is deprecated]

==The following upgrades have been deferred due to phasing==
apt install <whatever package it lists>

==needrestart==
===Show which services need restarting===
needrestart -rl
===Service restarts being deferred===
Probably services like '''networkd-dispatcher.service'''.
Check '''/etc/needrestart/needrestart.conf''' for '''$nrconf{override_rc}'''

[[Category:Debian]]

Debian

2026-06-05T08:01:20Z

Tony:

=Sites=
*[http://www.debian.org/ Homepage]
*[http://wiki.debian.org/ Wiki]
*[http://www.debian.org/doc/manuals/reference/index.en.html Debian Reference]
*[http://www.debian-administration.org/ debian-administration.org]
*[http://www.debianadmin.com/ http://www.debianadmin.com/]

=Security=
*http://lists.debian.org/debian-security-announce/
*debsecan
*debsum

=Links=
*[[debconf]]

=Netboot/PXE=
*https://wiki.debian.org/DebianInstaller/NetbootAssistant
*[https://wiki.debian.org/DebianInstaller/Preseed Preseed]
*[https://www.howtoforge.com/tutorial/install-debian-9-stretch-via-pxe-network-boot-server/ Install Debian 9 (Stretch) via PXE Network Boot Server]

=Documentation=

*[http://www.debian.org/releases/stable/i386/ch08s05.html.en Compiling kernels the Debian way]
*aptitude is often nicer than apt-get, but be careful
*apt-file to find package providing a certain file

==Networking on Debian==
* [https://wiki.debian.org/NetworkConfiguration Debian Network Configuration]

===Bonding===
* https://wiki.debian.org/Bonding
*[https://enterprise-support.nvidia.com/s/article/howto-create-linux-bond--lag--interface-over-infiniband-network Bonding on Infiniband]

==https==

*http://www.tuxick.net/docs/apache_ssl.html

https on debian testing is a mess, ignore:

*make-ssl-cert
*apache2-ssl-certificate in apache2.2-common only?
*http://www.debian-administration.org/articles/349

http://www.eclectica.ca/howto/ssl-cert-howto.php looks promising

==Handling packages==
*[[Compiling Debian Packages]]
===Pinning===
*[http://jaqque.sbih.org/kplug/apt-pinning.html Pinning]
*[http://www.argon.org/~roderick/apt-pinning.html Using APT with more than 2 sources]
*http://wiki.debian.org/AptPinning

=HOWTO=
==Modules==
===Set module parameters===
in '''/etc/modprobe.d/somename.conf'''
options somemodule paramname=2

= FAQ =

==Installer==
===Select a boot disk===
Depends a bit, customer installer would insist on that, but expects /boot to be a separate partition?

==Check if a reboot is required==
Check
/var/run/reboot-required.pkgs
or
needrestart -k -b

== change default editor ==

update-alternatives --config editor

== change timezone ==

dpkg-reconfigure tzdata

== Change system language==
dpkg-reconfigure locales
and
setlocale
== kernel packages ==

*kernel-image
*kernel-source

volatile

== clean cache ==

apt-get clean

== E: Unable to correct problems, you have held broken packages. ==

First try

dpkg --get-selections | grep hold

==reportbug: The following newer release(s) are available in the Debian archive:==
Ignore than and just continue ( see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900254 )

==apt-get update throwing KEYEXPIRED==
Ignore that, it updated just fine. You might run into the usual warnings when installing packaged. To Be Documented.
For example:
deb [trusted=yes]

==Missing key==
Missing key D9A7E9F52B9754A34443ED1DC9A78F8C43D8720A, which is needed to verify signature

Find the key and add it to apt keyring, like
curl -fsSL https://repo.charm.sh/apt/gpg.key | sudo gpg --dearmor -o /etc/apt/keyrings/charm.gpg

=Show more package information=
apt-cache show packagename*

==List installed packages==
apt list --installed

== W: GPG error: ==

[http://ftp2.de.debian.org http://ftp2.de.debian.org] etch/volatile Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY EC61E0B0BBE55AB3

gpg --keyserver wwwkeys.eu.pgp.net --recv-keys EC61E0B0BBE55AB3
#and that other thing

Or just:

apt-get --allow-unauthenticated install debian-archive-keyring

Or
apt-key adv --keyserver pgp.mit.edu --recv-keys 8B48AD6246925553

Or
gpg --keyserver keyserver.ubuntu.com --recv-key 03BBF595D4DFD35C
gpg -a --export 03BBF595D4DFD35C | apt-key add -

==show dependency tree==
apt-cache dotty
apt-rdepends

==show dependencies==
===What depens on package?===
apt-cache rdepends <package>

aptitude why

==What package does a file belong to?==
dpkg -S /path/to/file

Disk

2026-06-04T13:40:13Z

Tony:

=Tools=
==e2label==
===Get/set partition label===
e2label /dev/sdi1 [ LABEL ]
===Errors===
====e2label: Bad magic number in super-block ====
check if there's filesystem at all, blkid

=FAQ=
==Mount by label==
mount -L LABEL /mnt/target

Disk

2026-06-04T13:16:34Z

Tony:

=Tools=
==e2label==
===Get/set partition label===
e2label /dev/sdi1 [ LABEL ]
===Errors===
====e2label: Bad magic number in super-block ====
check if there's filesystem at all, blkid

Disk

2026-06-04T12:41:05Z

Tony: Created page with "=FAQ= ==Get/set partition label== e2label /dev/sdi1 [ LABEL ]"

=FAQ=
==Get/set partition label==
e2label /dev/sdi1 [ LABEL ]

Fdisk

2026-06-04T12:12:36Z

Tony: Created page with "=FAQ= ==What is "disk identifier"=="

=FAQ=
==What is "disk identifier"==

Ubuntu

2026-06-04T08:59:13Z

Tony: /* FAQ */

= Links =

*[http://ubuntu.com http://ubuntu.com]
*https://linuxize.com/post/how-to-add-apt-repository-in-ubuntu/
*[https://launchpad.net/ubuntu/+ppas Ubuntu PPA]
==Security==
===Check kernel vulnerabilities===
* [https://ubuntu.com/security/cves?package=linux&version=jammy Kernel on 22.04 LTS]
===Ubuntu security updates===
* https://ubuntu.com/security/notices

===Hardening Ubuntu===
*[https://bookofzeus.com/harden-ubuntu/initial-setup/system-updates/ Harden Ubuntu]

==Kernel==
* https://launchpad.net/ubuntu/+source/linux

= Installation =
*[https://ubuntu.com/download/server Ubuntu server]
*[https://ubuntu.com/server/docs/install/netboot-amd64 Ubuntu Netboot/PXE installation]
*[https://cdimage.ubuntu.com/ubuntu-mini-iso/ Uubntu mini iso for network install]

== Ubuntu 20.04 LTS ==

=== Storage configuration ===

First create a boot partition!

Remember to umount cdrom before rebooting

== Automatic install ==

*[https://ubuntu.com/server/docs/install/autoinstall https://ubuntu.com/server/docs/install/autoinstall]
*[https://tlhakhan.medium.com/ubuntu-server-20-04-autoinstall-2e5f772b655a Ubuntu Server 20.04 autoinstall]
*[https://louwrentius.com/understanding-the-ubuntu-2004-lts-server-autoinstaller.html Understanding the Ubuntu 20.04 LTS Server Autoinstaller]
*[https://discourse.ubuntu.com/t/please-test-autoinstalls-for-20-04/15250/166 Discourse - Please test autoinstalls for 20.04]
*[https://cloudinit.readthedocs.io/en/latest/topics/examples.html Cloudconfig examples]
 

=== Snags ===

=Documentation=
==Network configuration==
*[https://ubuntu.com/server/docs/configuring-networks Configuring networks]
*[[Netplan]]
*[https://ubuntu-archive-team.ubuntu.com/phased-updates.html Ubuntu Phased Updates]

==APT new style==
Is called '''deb822'''
*https://gist.github.com/Mealman1551/f75223b3cade0a218d51c06f6cb08f40

= HOWTO =
==Upgrading Ubuntu==
do-release-upgrade

== Change nameservers ==
===If using systemd-resolved===
Show nameservers
resolvectl status
Edit /etc/netplan/00-installer-config.yaml
netplan apply

==Using Ubuntu live CD for resque==
*[https://help.ubuntu.com/community/LiveCdRecovery LiveCdRecovery

==Download source code of package==
Add to /etc/apt/sources.list.d/ubuntu.sources

Types: deb-src
URIs: http://us.archive.ubuntu.com/ubuntu/
Suites: noble noble-updates noble-backports noble-proposed
Components: main restricted universe multiverse
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg

then update
apt-get update
and to get the sources
apt-get source somepackage

==Disable networking==

= FAQ =
==Installing Ubuntu==
https://ubuntu.com/server/docs/install/storage
===Select a boot disk===

==Upgrading==
===Please install all available updates for your release before upgrading.===
Double check
apt-get dist-upgrade
and you might even need to reboot

===Failed unmounting cdrom.mount===

==Set timezone==
dpkg-reconfigure tzdata

== Get ubuntu version ==

cat /etc/lsb-release

==Where are the changelogs?==
'''/usr/share/doc/*/changelog.Debian.gz'''

== disable ipv6 ==

sysctl:

net.ipv6.conf.default.disable_ipv6=1
net.ipv6.conf.all.disable_ipv6=1

== changing locale ==

/etc/default/locale

locale-gen

dpkg-reconfigure keyboard-configuration

setupcon

loadkeys us

and lots more

 

 

== mail: command not found ==

install heirloom-mailx

OR

install mailutils

REMEMBER: to fix sender domain

create /etc/mailutils.conf containing

address {
email-domain yourdom.ain;
};

and check out

mail --config-help

==The repository 'http://packages.ros.org/ros/ubuntu cosmic Release' does not have a Release file.==
Switch path to repositories to old-releases.ubuntu.com
== failed unmounting /var ==

ignore it? it's a journald issue

== multipathd[667]: sda: failed to get sgio uid: No such file or directory ==

Seems to be vmware setting: disk.EnableUUID = true

CHECK!

 

==The following signatures couldn't be verified because the public key is not available:==
gpg --keyserver keyserver.ubuntu.com --recv-keys 9D6D8F6BC857C906
Seems this doesn't (always) work, so
apt-key adv --keyserver keyserver.ubuntu.com --recv-keys <yourkey>

which will complain about deprecation, but it should work

==Upgrade to 22.04 (impish Release no longer has a Release file)==
That sucks, now what?
Check https://help.ubuntu.com/community/EOLUpgrades

When apt-get update fails, set your repositories to old-releases.ubuntu.com

==Upgrades to the development release are only available from the latest supported release==
More obscure mess. Check https://linuxconfig.org/how-to-upgrade-ubuntu-to-20-04-lts-focal-fossa

==Not all translations for this language are installed.==
Use the Install
Missing Packages button to download and install all missing packages

Instead of trying to find that mysterious button, try
check-language-support
which will list missing packages

==Release file not valid yet==
Mirror not up to date?

==Keep your own resolv.conf==
Replace the symlink /etc/resolv.conf with a file

==The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 23E7166788B63E1E==
apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 23E7166788B63E1E

==Get into grub menu during boot==
Hold shift key

==Error messages==
===The repository 'http://archive.ubuntu.com/ubuntu jammy InRelease' is no longer signed.===
Try again later?

===Could not connect to archive.ubuntu.com:443===
Doesn't support https, pick another mirror

Nginx

2026-06-04T08:30:08Z

Tony: /* HOWTO */

HTTP server, proxy, reverse proxy etc

=Links=
*[http://nginx.org/ Homepage]
*[https://deliciousbrains.com/page-caching-varnish-vs-nginx-fastcgi-cache/ Varnish vs nginx]
==Documentation==
*[https://www.nginx.com/resources/wiki/start/ Getting started]

==Nginx and php-fpm==
*[https://www.digitalocean.com/community/tutorials/how-to-host-multiple-websites-securely-with-nginx-and-php-fpm-on-ubuntu-14-04 How To Host Multiple Websites Securely With Nginx And Php-fpm On Ubuntu 14.04]
===Monitoring php-fpm under nginx===
Create /etc/nginx/site-enabled/fpmstatus
server {
listen 89;
listen [::]:89;
server_name localhost;
location = /fpm-status {
access_log off;

allow 127.0.0.1;
deny all;

fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;
include fastcgi_params;
fastcgi_pass unix:/run/php/php-fpm.sock;
# fastcgi_pass 127.0.0.1:9001;
}
location = /fpm-ping {
access_log off;

allow 127.0.0.1;
deny all;

fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;
include fastcgi_params;
fastcgi_pass unix:/run/php/php-fpm.sock;
}
}

TODO find out why monitoring via tcp socket 127.0.0.1:9001 doesn't work

=Notes=

==SSL certificates==
The host.crt goes first in the bundle

server {
listen 443;
ssl on;
ssl_certificate /etc/ssl/your_domain_name.pem; (or bundle.crt)
ssl_certificate_key /etc/ssl/your_domain_name.key;
server_name your.domain.com;
access_log /var/log/nginx/nginx.vhost.access.log;
error_log /var/log/nginx/nginx.vhost.error.log;
location / {
root /home/www/public_html/your.domain.com/public/;
index index.html;
}
}

=HOWTO=
==SSL configuration==
*[https://nginx.org/en/docs/http/configuring_https_servers.html onfiguring HTTPS servers]
*[https://wiki.mozilla.org/Security/Server_Side_TLS Security/Server Side TLS] Mozilla: Security/Server Side TLS]
*[https://ssl-config.mozilla.org/ Mozilla SSL config generator] outdated?

In case of letsencrypt check /etc/letsencrypt/options-ssl-nginx.conf
===Cipher order===
ssl_prefer_server_ciphers on;

==Set server directives globally==
Put them in '''/etc/nginx/conf.d/directives.conf'''

===CSP===
Content Security Policy

*[https://content-security-policy.com/examples/nginx/ Content Security Policy (CSP)
Examples ]

====CSP config example====
add_header Content-Security-Policy "
default-src 'self';
frame-src 'none';
script-src 'self';
frame-ancestors 'self';
img-src 'self' data:;
manifest-src 'self';
media-src 'self';
object-src 'self';
base-uri: 'self';
form-action: 'self';
worker-src 'self';" always;

==Client certificates==

===Create client certificate===
openssl pkcs12 -export -inkey ./sample.key -in ./sample.crt -out ./sample.p12

====Add client certificate to chromium====
Add the .p12 in Advanced->Manage certificates->Your certificates

==Logging==

===Log level===
Doesn't seem to be documented, defaults to log all?

===Ignore IP addresses in logs===
Create '''/etc/nginx/conf.d/logignore.conf''' or put in your vhost config:
map $remote_addr $loggable {
"1.2.3.4" 0;
# allow rest
default 1;
}

and then in your vhost configuration:
access_log /var/log/nginx/myhost.access.log combined if=$loggable;

===Regular expression on $request===
To filter out the nextcloud preview 404s:
map $request $loggable {
"~^GET \/index\.php\/core\/preview.*$" 0;
default 1;
}

==Get configuration items==
getconf PAGESIZE

==Redirecting in nginx==
https://www.liquidweb.com/kb/redirecting-urls-using-nginx/

==enable ipv6==
In server section add
listen [::]:443;

==Configure buffer sizes==
See https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffer_size

==Dump nginx configuration==
nginx -T

==Rate limiting==
*[https://www.nginx.com/blog/rate-limiting-nginx/ NGINX Rate limiting]

==Limit access==
https://docs.hypernode.com/hypernode-platform/nginx/how-to-block-allow-ip-addresses-in-nginx.html

==nginx and OCSP (stapling) ==
To make sure everything works have *all* certificates in bundle.pem

ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/pki/tls/certs/bundle.pem

ssl_certificate /etc/pki/tls/certs/bundle.pem;
ssl_certificate_key /etc/pki/tls/private/mydomain.key;

===Letsencrypt and stapling===
Will be discontinued: https://kbeezie.com/nginx-ssl_stapling-ignored-ocsp-letsencrypt/

==Exclude not found from log==
log_not_found off;

==Allow zabbix to read nginx error log==
setfacl -m g:zabbix:r /var/log/nginx/error.log
(perhaps put this in logrotate postrotate)

=FAQ=
==php not executed but downloaded==
In case of php-fpm see:
*https://oneuptime.com/blog/post/2025-12-16-nginx-php-download-instead-of-execute/view

==Security settings==
===X-Content-Type-Options===
# ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
add_header X-Content-Type-Options nosniff always;

===Content-Security-Policy (CSP)===

===security.txt===
*[https://www.rfc-editor.org/rfc/rfc9116 RFC 9116]

*https://securitytxt.org/

==nginx serving wrong page==
Forgot to tell it to listen on ipv6?
Like
listen [::]:443 ssl;l

==Conflicting server name XXX on 0.0.0.0:80==

==FastCGI sent in stderr: "Primary script unknown" ==
Usually means the php script just isn't there

==Error messages==
===ERR_HTTP2_PROTOCOL_ERROR===
Check with curl:
curl --http2 https://example.com
I got
curl: (92) : frame type: 1, stream: 1, Invalid HTTP header field was receivedname: [content-security-policy]

found out the hard way that add_header arguments have to be on single line

===nginx: [emerg] unknown log format===
Define log_format in '''http''' section before the includes.

=== upstream prematurely closed connection while reading upstream ===
Maybe trying to fetch a large file, like jpg?

=== client intended to send too large body ===
server {
# default 1m
client_max_body_size 4m;

===no live upstreams while connecting to upstream===
can't connect to whatever backend?

===upstream sent too big header while reading response header from upstream===
*[https://techglimpse.com/upstream-sent-too-big-header-while-reading-response-header-from-upstream-nginx/ Upstream sent too big header]
*[https://www.getpagespeed.com/server-setup/nginx/tuning-proxy_buffer_size-in-nginx Tuning proxy_buffer_size in NGINX]

====In case of fastcgi====
https://gist.github.com/magnetikonline/11312172#determine-fastcgi-response-sizes

Try settings like
fastcgi_buffers 32 32k;
fastcgi_buffer_size 32k;

===an upstream response is buffered to a temporary file===

===(SSL: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share) while SSL handshaking===
Usually just a bad client or a scan.

===cannot load certificate "/etc/ssl/certs/ssl-cert-snakeoil.pem===
Probably ubuntu?
apt install ssl-cert

===access forbidden by rule===
look for allow or deny lines

===a client request body is buffered to a temporary file===
PLay some with
client_body_buffer_size 10M;
client_max_body_size 10M;

TODO check, this doesn't seem to apply
If all else fails just set:
proxy_max_temp_file_size 0;
and see if you get some feedback :)

===upstream timed out===
Look for proxy_pass

===failed (104: Unknown error) while reading response header from upstream===

===[emerg] duplicate listen options for [::]:443 ===
looks like "ipv6only=on" added by letsencrypt causes that, removing it might help

===nginx: [emerg] a duplicate default server for 0.0.0.0:80===
Multiple vhosts having "default_server" in their '''listen''' lines

===nginx: [error] invalid PID number "" in "/run/nginx.pid"===
Try
systemctl restart nginx

===upstream sent no valid HTTP/1.0 ===
Check for confusion between http and https

[[Category: Proxy]]
[[Category: Web Services]]

Apc UPS

2026-06-03T13:05:31Z

Tony:

=Links=
*[https://www.zabbix.com/integrations/apc Zabbix Templates for APC UPS]
*[https://www.apcguard.com/smart-ups-runtime-chart.asp Smart-UPS runtime chart]

=Documentation=
==Outlet groups==
===Main Outlet Group===
Callled "Outlets" in manual

First to switch on, last to switch off.

===Controlled Outlet Group===

=NMC (Network Management Card)=

== Get model of NMC card==
===UPS Network Management Card 2===
go to '''General->About'''

===UPS Network Management Card 3===
'''About->Network'''

== Web interface ==
:443 only

==Default credentials==
apc / apc

==FAQ==
===Disable alarm===
Configuration->UPS->Audible alarm

[[Category:Hardware]]
[[Category:UPS]]

Exiftool

2026-06-03T12:27:02Z

Tony: /* set image title */

=FAQ=

==set image title==
exiftool stumpert.jpg -Title="Willem Stumpert" stumpert.jpg

Ansible

2026-06-03T10:46:58Z

Tony: /* Tools */

Configuration management

=Links=
*[http://www.ansible.com/home Homepage]
*[http://www.hashbangcode.com/blog/adding-iptables-rules-ansible Adding iptables Rules With Ansible]
*[http://cloudacademy.com/blog/going-deeper-into-ansible-playbooks/ Going Deeper into Ansible Playbooks]
*[https://serversforhackers.com/an-ansible-tutorial An Ansible Tutorial]
*[https://www.cyberciti.biz/faq/how-to-install-and-configure-latest-version-of-ansible-on-ubuntu-linux/ How to Install and Configure latest version of Ansible on Ubuntu Linux]
*[https://networklore.com/ansible-getting-started/ Getting started with Ansible]
*[https://ansible-tips-and-tricks.readthedocs.io/en/latest/os-dependent-tasks/variables/ Tips and tricks]
*[https://www.ansible.com/products/awx-project AWX]
*[https://galaxy.ansible.com Ansible Galaxy]
*[https://docs.ansible.com/ansible/latest/user_guide/playbooks_async.html Timeouts]
*[https://manintheit.org/ansible/ansible-sample-scripts/ Ansible sample scripts]
*[https://gist.github.com/mgedmin/5f8ac034df0c371444be module for postfix]
*[https://docs.ansible.com/ansible/latest/collections/ Ansible collections]

=Tools=
*[https://enroll.sh/ Enroll]
*[https://molecule.readthedocs.io/en/latest/ Molecule] for testing roles
*ansible-lint
*ansible-console
*ansible-inventory

=Docs=
*[https://howto.cactus.de/index.php/Ansible_Howto Ansible Howto]
*[https://docs.ansible.com/ansible/latest/collections/ansible/builtin/ Ansible builtin modules]
*[https://docs.ansible.com/ansible/latest/collections/all_plugins.html All plugins]
*[http://ansible-docs.readthedocs.io/zh/stable-2.0/rst/playbooks_conditionals.html Conditionals]
*[https://docs.ansible.com/ansible/2.5/user_guide/playbooks_async.html Parallel!]
==Ansible style guides==
*[https://docs.ansible.com/ansible/2.6/dev_guide/style_guide/index.html Style guide]
*[https://redhat-cop.github.io/automation-good-practices/ Ansible good practices]

*[https://spacelift.io/blog/ansible-variables Ansible variables]

*[https://docs.ansible.com/projects/ansible/latest/reference_appendices/config.html#the-configuration-file ansible.cfg configuration file]
==Lineinfile==
*[https://docs.ansible.com/ansible/latest/collections/ansible/builtin/lineinfile_module.html Lineinfile module]

==Popular modules==
*[https://docs.ansible.com/ansible/latest/collections/ansible/builtin/file_module.html ansible.builtin.file]
*[https://docs.ansible.com/ansible/latest/collections/ansible/builtin/apt_module.html ansible.builtin.apt]
*[https://docs.ansible.com/ansible/latest/collections/ansible/builtin/lineinfile_module.html ansible.builtin.lineinfile]

=Some terms=

=Inventories=
*[https://spacelift.io/blog/ansible-inventory]
*[http://docs.ansible.com/ansible/latest/intro_dynamic_inventory.html Dynamic Inventory]
*[https://www.jeffgeerling.com/blog/creating-custom-dynamic-inventories-ansible Creating custom dynamic inventories]
*[https://www.digitalocean.com/community/tutorials/how-to-set-up-ansible-inventories Set up ansible inventories]

=Alternatives=
*[[Puppet]]
*[[Saltstack]]

=Quickstart=
On server as root create key:
ssh-keygen
(go for defaults)
and then get content of ~/.ssh/id_rsa.pub in your copypastebuffer

On 'clients' edit /etc/ssh/sshd_config to
PermitRootLogin without-password
and restart sshd

Edit/create ~root/.ssh/authorized_keys and add:
from="ip.of.ansible.server" <paste public key here>

=Scripts/playbooks=
==Maintain useraccounts==
<pre>
---

- name: remove users
user: name=exuser state=absent force=yes groups=''
with_dict: accounts
tags:
- delusers

- name: sync group
group:
name: sync
gid: 999
state: "present"

- name: fix homedir rights
lineinfile: dest=/etc/login.defs regexp=^UMASK line="UMASK 007"

- name: useraccounts
user:
name: "{{ item.key }}"
comment: "{{ item.value.name }}"
uid: "{{ item.value.uid }}"
state: "present"
shell: "/bin/bash"
groups: sudo
with_dict: accounts
tags:
- accounts

- name: userpasswords
user:
name: "{{ item.key }}"
password: "{{ lookup('csvfile',item.key + ' file=/etc/shadow delimiter=: col=1' ) }}"
with_dict: accounts

#ssh keys
- name: userkeys
authorized_key: user={{ item.key }} key="{{ lookup('file','/home/' + item.key + '/.ssh/authorized_keys' ) }}" exclusive=yes
with_dict: accounts
tags:
- keys

- name: nofoobar
user: name=foobar state=absent remove=yes
tags:
- foobar
</pre>

== comment out a line ==
- name: remove java line from rclocal
lineinfile:
dest: /etc/rc.local
regexp: '^(java.*)$'
line: '# \1'
backrefs: yes

=HOWTO=
==Add user to group==
name: add user to bargroup
user:
name: foo
groups: bargroup
append: yes

==Run command==

==Cronjobs and ssh passphrases==
See [https://gist.github.com/Justintime50/297d0d36da40834b037a65998d2149ca Use Your SSH Agent in a Crontab ( keychain)]

= FAQ =

==Notify multiple handlers==
notify:
- Call Handler1
- Call Handler2

==Print hostname in debug msg ==
debug:
msg: "Something to report in {{ inventory_hostname }}"

==Connect to a different port==
Try
--extra-vars="ansible_port=2345"

==Error messages==
===Parse errors===
====ERROR! unexpected parameter type in action: <type 'bool'>====

====ERROR! conflicting action statements: debug, msg====
'''indentation'''

====[WARNING]: Unable to parse <some hostname> as an inventory source====
Append a comma
ansible-playbook myplay.yml -i myhostname,

===sftp transfer mechanism failed===
??

===Using a SSH password instead of a key is not possible because Host Key checking is enabled and sshpass does not support this.===
Please add this host's fingerprint to your known_hosts file to manage this host.

Try
ANSIBLE_HOST_KEY_CHECKING=False playbook ...
Or just ssh to the host and accept key

===Platform linux on host backup01 is using the discovered Python interpreter at /usr/bin/python3===
one hack is adding to ~/.ansible.cfg:
[defaults]
interpreter_python=auto_silent

Or fix on that system:
update-alternatives --install /usr/bin/python python /usr/bin/python3 1

===The error was: 'item' is undefined"===
wrong indentation for with_items

=== Failed to connect to the host via ssh: Permission denied (publickey,password) ===
To connect without public key in authorized keys try
--ask-pass

===SSH Connection timed out during banner exchange===
See:
*[https://oneuptime.com/blog/post/2026-02-21-how-to-configure-ansible-ssh-connection-keepalive/view How to Configure Ansible SSH Connection Keepalive ]
So far working for me:
[ssh_connection]
ssh_args = -o ServerAliveInterval=5
retries = 5

==ansible-lint==
===Use shell only when shell functionality is required===

== roles for multiple distributions ==

include_vars with "distro-{{ansible_distro_name}}.yml"

== Escape single quote ==

'foo ''bar'' '

==Syntax Error while loading YAML. did not find expected key==
Check indentation

== Newlines in output ==

instead of all those '\n':

In ansible.cfg:

stdout_callback = yaml

== Ad-hoc commands ==

[http://docs.ansible.com/ansible/latest/intro_adhoc.html http://docs.ansible.com/ansible/latest/intro_adhoc.html]

== check python code ==

ansible-test sanity --test pep8 mycode.py

== Command/shell output on single line ==

ANSIBLE_STDOUT_CALLBACK=oneline ansible-playbook foo.yml

== Storing passwords ==

[http://docs.ansible.com/ansible/2.4/vault.html http://docs.ansible.com/ansible/2.4/vault.html]

== Show all host variables ==

ansible -m setup <hostname>

== Show all OS/versions ==

ansible all -m setup -a "filter=ansible_distribution*"

== Syntax highlighting for ansible ==

*[https://github.com/chase/vim-ansible-yaml https://github.com/chase/vim-ansible-yaml]

Drop the files in ~/vim/bundle and in .vimrc:

call pathogen#infect()
call pathogen#helptags()

Or maybe better:

*[https://github.com/pearofducks/ansible-vim https://github.com/pearofducks/ansible-vim]

== Retry ==

--limit @/home/ansible/ssh.retry

==Error messages==
===ERROR! 'when' is not a valid attribute for a Play===

=== ERROR! this task 'import_playbook' has extra params ===

meh

 

=== /usr/bin/chattr: Clearing extent flag not supported ===

Probably trying to make a backup of a symlink

===Missing sudo password===
set NOPASSWD in sudo config

== Escape curly braces ==

{{ '{' }}

== Check file for string ==

tasks:
- name: grep line
shell: "grep -q swap /etc/fstab"
failed_when: false
register: grepped

- name: show grep
debug:
msg: "exists"
when: grepped.rc == 0

== Error messages ==

=== msg: The PyMySQL (Python 2.7 and Python 3.X) or MySQL-python (Python 2.X) module is required ===

Means you need to install for example python2-PyMySQL on that host

==Ansible-lint messages==
===Commands should not change things if nothing needs doing===
Ignore, or use
changed_when: false
===Shells that use pipes should set the pipefail option===
shell: |
set -o pipefail
some command

=Tips & tricks=
==Includes only when on host group==
- block:
- include: foo.yml
- include: bar.yml
when: "'foobar' in group_names"

== Show info/facts of a host ==

ansible somehost -m setup
ansible somehost -m ansible.builtin.setup

==Show distribution and version==
- name: show some host info
debug:
msg: Dist {{ ansible_distribution }} {{ ansible_distribution_version }}

[[Category:Configuration management]]
[[Category:Ansible]]

Hugo

2026-06-03T10:46:07Z

Tony:

=Links=

=HOWTO=
==Add a theme==
git submodule add https://github.com/alex-shpak/hugo-book themes/hugo-book

=FAQ=
==Error messages==
===Section 'docs' not found, check BookSection theme parameter===

Hugo

2026-06-03T09:49:38Z

Tony: Created page with "=Links= =HOWTO= ==Add a theme== git submodule add https://github.com/alex-shpak/hugo-book themes/hugo-book"

=Links=

=HOWTO=
==Add a theme==
git submodule add https://github.com/alex-shpak/hugo-book themes/hugo-book

Socket statistics

2026-06-02T08:40:07Z

Tony: /* HOWTO */

Known as '''ss'''

=Documentation=
*[https://www.tecmint.com/ss-command-examples-in-linux/ 12 ss Command Examples to Monitor Network Connections]
*[https://www.cyberciti.biz/tips/linux-investigate-sockets-network-connections.htmlss command: Display Linux TCP / UDP Network/Socket Information]

=HOWTO=
==List all listening tcp ports==
ss -natl

==List all connections to a port==
ss -nat '( dport = :1234 )'

==Show processes listening on ports==
ss -pl

==List all listening ports and their processes==
ss -tlnp

[[Category:Network]]

Zabbix

2026-06-02T07:47:51Z

Tony: /* Which items using most data in database? */

= Links =

*[http://www.zabbix.org/ Homepage]
*[https://zabbix.org/wiki/Docs/DB_schema/4.0 zabbix 4 database schema]
*[https://www.zabbix.com/documentation/current/en/manual/appendix/compatibility Zabbix compatibility matrix]
*[https://www.digitalocean.com/community/tutorials/introduction-to-queries-mysql https://www.digitalocean.com/community/tutorials/introduction-to-queries-mysql]
*[http://zabbix.org/wiki/Compilation_instructions compilation instructions]
*[http://www.zabbix.com/documentation Documentation]
*[https://dev.mysql.com/doc/mysql-tutorial-excerpt/8.0/en/examples.html Examples of Common Queries]
*[http://zabbixzone.com/zabbix/easy-update-on-custom-scripts/ Custom scripts]
*[https://github.com/q1x/zabbix-gnomes Various scripts to automate tasks in Zabbix]
*[https://www.percona.com/blog/2014/11/14/optimizing-mysql-zabbix/ Tuning mysql for zabbix]
*[https://huyabbix.com https://huyabbix.com]
*[http://techblog.procurios.nl/k/n618/news/view/56429/14863/how-to-migrate-mysql-databases-without-downtime.html Migrating zabbix database with minimal downtime]
*[https://support.zabbix.com/browse/ZBX/ Zabbix Bug tracker]
*[http://www.michaelfoster82.co.uk/zabbix-database-cleanup-delete-old-data/ Clean up database]
*[https://linux.die.net/man/8/zabbix_selinux Zabbix and selinux]
*[https://github.com/a-schild/zabbix-ssl Apache/SSL checks]
*[[Zabbix_on_RHEL/Centos|Zabbix on RHEL/Centos]]
*[[Grafana|Grafana]]
*[https://blog.zabbix.com/zabbix-ha-cluster-setups/8264/ https://blog.zabbix.com/zabbix-ha-cluster-setups/8264/] Zabbix HA cluster]
*[https://blog.zabbix.com/zabbix-agent-active-vs-passive/9207/ Active vs Passive]
*[https://blog.zabbix.com/fighting-notification-floods-and-misleading-alerts-in-distributed-zabbix-deployments/11600/ Fighting zabbix alert floods]
*[https://github.com/unioslo/zabbix-cli zabbix-cli]

=Documentation=
==Triggers==
*[https://www.zabbix.com/documentation/current/en/manual/appendix/functions Trigger functions]
Function str() searches for substrings

==AND OR case==
not, and and or operators are case-sensitive and must be in lowercase. They also must be surrounded by spaces or parentheses.

==Installing zabbix==
*[https://www.zabbix.com/download Download and install zabbix]
*[https://repo.zabbix.com/ Zabbix repositories]
*[https://wiki.gentoo.org/wiki/User:MalakymR/Zabbix Zabbix on Gentoo]

== Installing Zabbix from git ==

git clone [https://github.com/zabbix/zabbix.git https://github.com/zabbix/zabbix.git]
cd zabbix
./bootstrap.sh
./configure --help
autoreconf -fvi

If you don't have a Makefile, try
./config.status Makefile
and then
./configure
again

== Zabbix API ==

*[https://www.zabbix.com/documentation/current/manual/api The Zabbix API]
*[https://www.zabbix.com/integrations/python API and python]

===FAQ===
====Error: Zabbix API library must be installed.====
It wants the OTHER zabbix API, so
pip install zabbix-api

==Zabbix agent paths==
===Ubuntu===
/etc/zabbix/zabbix_agentd.conf.d/
/etc/zabbix/zabbix_agentd.conf

===Ubuntu 24.04===
/etc/zabbix/zabbix_agentd.d

==Simple check==
*[https://www.zabbix.com/documentation/6.4/en/manual/config/items/itemtypes/simple_checks Simple checks]

==Zabbix and SNMP==
===Links===
*[https://www.zabbix.com/integrations/snmp#interfaces_snmp Interfaces by SNMP]
*[https://www.zabbix.com/documentation/5.0/en/manual/discovery/low_level_discovery/snmp_oids Discovery of SNMP OIDs]

On proxy/server:
apt install snmp-mibs-downloader
download-mibs

*[https://bestmonitoringtools.com/tutorial-snmp-traps-on-zabbix/ Zabbix SNMP Traps: A Step-by-Step Guide]

==External check==
*[https://www.zabbix.com/documentation/current/en/manual/config/items/itemtypes/external External checks]
Scripts usually in '''/usr/lib/zabbix/externalscripts/'''

==Tagging==
* [https://www.zabbix.com/documentation/guidelines/en/thosts/configuration/template_items#tags Item tags]
* [https://www.zabbix.com/documentation/guidelines/en/thosts/configuration/templates#tag-name-and-value-format Template tags]

==Web monitoring==
* https://www.zabbix.com/documentation/current/en/manual/web_monitoring

= Zabbix error codes =

== Z3005 ==

Database issue

= Zabbix Items =
[https://www.zabbix.com/documentation/6.0/en/manual/config/items/itemtypes/zabbix_agent Agent item keys]
==Item dialog==
*[https://www.zabbix.com/documentation/5.4/en/manual/config/items/item Item documentation]
*[https://www.zabbix.com/documentation/5.4/en/manual/config/items/itemtypes/zabbix_agent Zabbix agent items]
===Type of information===
====Numeric(unsigned)====
====Character====
character (string) data limited to 255 bytes
====Text====
Text of any size

===Units===

*B
*uptime
*unixtime
*s

== proc.mem ==
*[https://www.zabbix.com/documentation/current/en/manual/config/items/itemtypes/zabbix_agent#proc.mem zabbix agent proc.mem]

proc.mem[<name>,<user>,<mode>,<cmdline>,<memtype>]

=== name ===
process name

=== cmdline ===

regex like php-fpm:

===memtype===
On linux default is vsize (VmSize)
*[https://www.zabbix.com/documentation/5.0/en/manual/appendix/items/proc_mem_notes Notes on proc.mem memtypes]

==proc.num==
*[https://www.zabbix.com/documentation/current/en/manual/config/items/itemtypes/zabbix_agent#proc.num proc.num]

==Item preprocessing==
===Preprocessing regular expressions===
See [https://www.zabbix.com/documentation/current/en/manual/regular_expressions#example Regular expressions: example]

===XML/xpath preprocessing===
https://blog.zabbix.com/zabbix-xpath-preprocessing/7936/

NOTE xq -x does not want the number() bit

===Incorrect value for field "Prev. time": a relative time is expected.===
Prev. Time should be something like
now-30s

===Monitoring incremental/counters===
Preprocessing -> Change per second

==Windows performance counters==
https://www.zabbix.com/documentation/current/en/manual/config/items/perfcounters

= Templates =
*[https://www.zabbix.com/integrations?cat=official_templates Zabbix Offical Templates]
*[https://github.com/zabbix/community-templates/ Community templates]

==Template App MySQL==
https://github.com/tiramiseb/zabbix-templates/blob/master/Template%20App%20MySQL.txt
TODO shouldn't this be user zabbix?

mysql user account:
create user 'monitor'@'localhost' identified by auth_socket;
grant PROCESS,SHOW DATABASES,SHOW VIEW on *.* to 'monitor'@'localhost';
flush privileges;

==Monitoring sensors==
Template https://github.com/blind-oracle/zabbix-sensors for sensors discovery.
See also https://www.zabbix.com/documentation/current/en/manual/appendix/items/sensor

= Configuration =

== Zabbix agent active ==

=== On client ===
Have port 10051 open and:
ActiveServer zabbix.ser.ver

=== On server ===

Set Agent IP to 0.0.0.0

 
=Zabbix and SQL=
==Find hosts with hostmacro defined==
select h.host, m.macro, m.value from hosts h, hostmacro m where macro like '%FOO%' and h.hostid = m.hostid;

==most frequent items in history_uint==
select itemid,count(itemid) as freq from history_uint group by itemid order by freq desc limit 5;

and then
select name from items where itemid = whateveryoufind;

= HOWTO =
==Mysql command line==
===Use custom variables===
set @foo=12;
select * from items where id < @foo;

==Useful queries==
===Find most items filling up history===
SELECT itemid, count(*) AS cnt FROM history GROUP BY itemid ORDER BY cnt DESC limit 30;

===Find host and item by itemid===
select h.name,i.hostid,i.name from hosts h,items i where i.itemid = 212624 and i.hostid = h.hostid;

==Define discovery filters==

== LLD with JSON ==
*[https://blog.zabbix.com/low-level-discovery-with-dependent-items/13634/ LLD with JSON and dependent items]
*https://www.zabbix.com/forum/zabbix-help/383827-json-and-lld-understanding
*https://www.zabbix.com/forum/zabbix-troubleshooting-and-problems/456663-lld-macros-with-json

if you want multiple keys, use jsonpath like
$[?(@.share=='{#FSTYPE}' && @.name=='{#NAME}')].size.first()
===testing jsonpath preprocessing===
In Value paste valid json, then name {#NAME} value somevalue

== Test trapper ==

==Reset admin password==
Mysql prompt:
select * from user where username='Admin';
bcrypt your new password:
htpasswd -nbBC 10 USER YOURPASSWORD|awk -F ':' '{ print $2 }'
Mysql prompt:
update user set passwd = 'your bcrypted pass' where userid = 1

==Zabbix and PSK==
See:
*[https://www.zabbix.com/documentation/5.2/en/manual/encryption/using_pre_shared_keys Using pre-shared keys]

==Updating multiple triggers/alerts==
Select them via '''Monitoring->Problems'''

==Testing javascript==
zabbix_js

==Zabbix maps==
* [https://www.zabbix.com/documentation/8.0/en/manual/config/visualization/maps/map maps]
===Add link===
"Two map elements should be selected"
Select one, hold control and select the other

= FAQ =
==macro naming convention==
{$SOME.NAME} is better than {$SOME_NAME}

==cannot convert value to numeric type==
Some javascript :)

==Failed: cannot calculate delta (speed per second) for value of type "none"==
In preprocessing use Javascript to
if ( "" == value ) { return 0; } else { return value; }

==Handling division by zero==
In preprocessing find "Check for not supported", "error matches" and add "division by zero"

==zabbix[proxy_buffer,state,current] not supported==
Zabbix proxy must be monitored by itself, not by server

==What is this "$1" in item name?==
In older versions of zabbix this was first parameter of key, use the macros like {#SNMPVALUE}, {#FSNAME}, or {#IFNAME} now

==Locations of Userparameters==
===Ubuntu===
/etc/zabbix/agentd.d/

==What takes most space in the database?==
*[https://blog.zabbix.com/what-takes-disk-space/13349/ What takes disk space]

==forced reloading of the snmp cache==
looks like nothing to worry about

==Where is last userid stored?==
ids:
table_name: users
field_name: userid
nextid: the next id

== SERVER ==
==Which items using most data in database?==
*[https://serverfault.com/questions/749397/zabbix-determine-what-item-checks-are-responsible-for-storing-the-most-data determine what item checks are responsible for storing the most data]

SELECT itemid, count(*) AS cnt FROM history GROUP BY itemid ORDER BY cnt DESC LIMIT 20;
or maybe
SELECT h.itemid, i.name, count(*) AS cnt FROM history h, items i where h.itemid = i.itemid GROUP BY itemid ORDER BY cnt DESC limit 20;
=== Adjust loglevel ===

zabbix_server --runtime-control log_level_increase=trapper

 

=== Reload zabbix server configuration ===

You can't, but you might want

zabbix_server -c /etc/zabbix/zabbix_server.conf -R config_cache_reload

 

=== No media defined for user ===

=== The frontend does not match Zabbix database. ===

Probably version conflict between frontend and server

 

=== value cache working in low memory mode ===

Increase ValueCacheSize

=== Message from 1.2.3.4 is missing header. Message ignored. ===
 

 

== PROXY ==

[[ Zabbix Proxy ]]

===cannot send proxy data to server===
empty string received

===failed to update local proxy configuration copy: unexpected field "host_inventory.type"===

== Front end ==

===Round numbers===
Preprocessing javascript
2 decimals:
return Math.round(value* 100) / 100
0 decimals:
return Math.round(value)

=== Visable name vs hostname ===

Visible name: {HOST.NAME}

Hostname: {HOST.HOST}

Host IP: (as defined in Interface->IP/DNS) {HOST.CONN}

=== Acknowledge multiple items ===

Monitor->Problems apply filters, select all, mass update

=== No permissions to referred object or it does not exist! ===

Graph no longer exists. Probably items no longer discovered

Maybe you've been editing a template file, remember to replace template name everywhere

=== Cannot add host ===

??
===match for value of type "none": pattern does not match===
Agent returning empty string?

== Monitoring SNMP ==
===Cannot find module (IF-MIB): At line 1 in (none)===
apt install snmp-mibs-downloader
and restart zabbix-proxy

=== Cannot find host interface on "xxxhost" for item key foo ===

Might mean you're trying to import an SNMP template before configuring SNMP for the host

 

 

=== No SNMP data ===

=== snmp_parse_oid(): cannot parse OID "IF-MIB::ifSpeed.3 ===

===Timeout while connecting===
Could be wrong community string, remember delay when using proxy.

== Agent side ping check ==

UserParameter=pingtime[*],fping -e $1|sed 's/^.*($[0-9].*$ ms).*$/\1/g'
UserParameter=pingalive[*],fping $1|grep -q alive;echo $?

 

 

==LLD/Discovery==
=== Discover: value must be a JSON object ===

Could mean you need to escape slashes, check output with zabbix_get

===Cannot create item: item with the same key already exists===
make sure the key contains "{#SOMENAME}"

== Discovery data example ==

Output of a discovery script should look like:

{"data":[
{"{#VAR1}":"value11","#{VAR2":"value12"},
{"{#VAR1}":"value21","#{VAR2":"value22"}
]}

== IPMI ==

=== IPMI Monitoring account for zabbix ===

[https://www.thomas-krenn.com/en/wiki/Configuring_IPMI_under_Linux_using_ipmitool https://www.thomas-krenn.com/en/wiki/Configuring_IPMI_under_Linux_using_ipmitool]

ipmitool user set name 3 monitor
ipmitool user set password 3
ipmitool channel setaccess 1 3 link=on ipmi=on callin=on privilege=2
ipmitool user enable 3

To test these:
ipmitool -I lanplus -H <host> -L USER -U monitor sdr elist full

===Zabbix credentials===
====Privilege Level====
User

====Authentication algorithm====
Default
but what is that?

=== cannot connect to IPMI host: [22] Operation canceled ===

Usually temporary because of broken ipmi lib, ignore it

 

=== cannot connect to IPMI host: [16777411] Unknown error 16777411 ===

classic, probably authentication problem

=== cannot connect to IPMI host: [22] Invalid argument ===
wrong password/credentials?

===IPMI pollers are disabled in configuration===
Check
StartIPMIPollers
in server/proxy configuration

=== Cannot connect to IPMI host: [2] No such file or directory===
??

== zabbix_sender ==

=== processed: 0; failed: 1 ===

Possible causes:

*incorrect hostname
*incorrect item key
*item not in the server configuration cache yet
*Allowed hosts in trapper item
*phase of moon
*aliens

 

=== Testing zabbix_sender ===

zabbix_sender stuff

== Filters ==

The regular expressions referred to in discovery are found under Administration->General, and then "Regular expressions" in the dropdown at top right of the page

=== cannot connect to IPMI host: [125] Operation canceled ===

possibly authentication method issue

 
== Calculated items ==
See [https://blog.zabbix.com/zabbix-monitoring-with-calculated-items-explained/9950/ Calculated items explained]
=== Cannot create item: Invalid first parameter ===
For calculated items use last("youritemkey")

=== Cannot create item, error in formula ===
Problably a calculated item, try doublequoting the item key:

last("foo[bar]")

===Invalid parameter "/1/params"===
Maybe forgot to use last()?
You might need to doublequote your items, or prepend with double slashes

== Reset trigger/alert ==
For example when you changed the settings
Just disable, wait a bit and enable again.
== Install recent zabbix on CentOS/RHEL ==

rpm -ivh [https://repo.zabbix.com/zabbix/3.4/rhel/7/x86_64/zabbix-release-3.4-2.el7.noarch.rpm https://repo.zabbix.com/zabbix/3.4/rhel/7/x86_64/zabbix-release-3.4-2.el7.noarch.rpm]
yum install zabbix-agent

== Backing up tables ==

[https://www.zabbix.org/wiki/Docs/howto/mysql_backup_script https://www.zabbix.org/wiki/Docs/howto/mysql_backup_script]

 

== cannot send list of active checks ==
Verify hostname:
/usr/sbin/zabbix_agentd -t 'agent.hostname'

If in agent log: most likely ServerActive is defined in agent config, while not used at all

It is also possible agent is sending some active check to server while host is monitored via proxy.

In proxy/server log:
most likely '''Hostname''' in agent config does not match hostname used on server.

==cannot send list of active checks to "127.0.0.1": host [Zabbix server] not found==
??

== active check configuration update started to fail ==

??

== Latest 20 issues ==

DEFAULT_LATEST_ISSUES_CNT in/usr/share/zabbix/include/defines.inc.php

 

== Zabbix unreachable poller processes more than 75% busy ==

Increase '''StartPollersUnreachable'''

 

== Zabbix poller processes more than 75% busy ==

Maybe StartPollersUnreachable?

== More than 100 items having missing data for more than 10 minutes ==

Could be high load. Also check Administration->Queue

== Zabbix escalator processes more than 75% busy ==

probably high system load overall

== Check agent ==

zabbix_get -s my.host.com -k agent.version

== ZBX_NOTSUPPORTED ==

Could be anything, enable logging on agent. It could be version mismatch. Check

zabbix_get -s yourhost -k agent.version

If that works, you're calling for an undefined or unsupported key.

== Incorrect trigger expression. Host "xx" does not exist or you have no access to this host. ==

Means there's no related item.

== zabbix_get returns nothing ==

best look at log on agent side

== run playbook on single host ==

ansible_playbook -l somehost somplay.yml

[[:Category:Monitoring]]

 

== Zabbix server is not running: the information displayed may not be current ==

Might be selinux: [http://sysads.co.uk/2013/11/zabbix-server-running-alert/ http://sysads.co.uk/2013/11/zabbix-server-running-alert/]

 

 

 

== Monitoring vmware ==

=== vmware.hv.cpu.usage[{$URL},{HOST.HOST}]" became not supported: Couldn't resolve host name ===

Set macro {$URL} to [https://your.ip/sdk/ https://your.ip/sdk/] (shouldn't discovery figure that out from {$HOST} ?

=== Couldn't resolve host name ===

Sometimes it's a matter of waiting a few hours

 

=== vmware events collector returned empty result ===

???

=== No "vmware collector" processes started. ===

Check StartVMwareCollectors on server or proxy

 

== unsupported item key ==

This might mean it's expecting a value from the script you're calling.

echo 1
remember: not supported is not disabled, server/proxy will try again after interval

=== became not supported: Not supported by Zabbix Agent ===

probably output by userparameter/script

== ansible or API not showing host groups ==

Permissions!! See Administration->User Groups

 

== failed to update local proxy configuration copy: invalid field name "items.lastlogsize" ==

check everything :)

== Received value [11] is not suitable for value type [Numeric (unsigned)] and data type [Decimal] ==

This probably means the agent returned 1\n1

 

== database is down: retrying in 10 seconds ==

try upping max_connections

== [Incorrect key file for table 'items'; try to repair it ==

Could be something /tmp related

 

 

== another network error, wait for 8 seconds ==

'''UnreachableDelay'''=8

 

== failed: first network error, wait for XY seconds ==

Waits for UnreachableDelay seconds before trying again

Loglevel LOG_LEVEL_WARNING

== no active checks on server ==
*Hostname in agent config (-kagent.hostname) must match name on server
*simple no connection possible? firewall?
*maybe the host was configured to be monitored by (another) proxy?

== show cpu utilization ==

Monitoring->host->graphs

===fuzzytime on command line===
TS=lotsofseconds
#output in hours
echo $(( ($(date +%s) - $TS) / 3600 ))

==duplicate entry adding user/group==
Check table 'ids'

==Troubleshooting==
===zabbix_get: no route to host===
Check the firewall

=Error messages=
==Error: Zabbix API library must be installed==
pip install zabbix_utils
OR
pip install zabbix-api

==Get value from agent failed: cannot connect to [[xx]:10050]: [4] Interrupted system call==
Check firewall?

==connection error (POLLERR,POLLHUP)==
probably firewall

==Agent error messages==
===unspecified certificate verification error: TLS handshake set result code to 5:===
Try restarting agent.

==zabbix : problem with defaults entries ==
Could be sudo/resolving problem

[[Category:Monitoring]]
[[Category:Zabbix]]

Ansible

2026-06-01T14:45:56Z

Tony: /* Error messages */

Configuration management

=Links=
*[http://www.ansible.com/home Homepage]
*[http://www.hashbangcode.com/blog/adding-iptables-rules-ansible Adding iptables Rules With Ansible]
*[http://cloudacademy.com/blog/going-deeper-into-ansible-playbooks/ Going Deeper into Ansible Playbooks]
*[https://serversforhackers.com/an-ansible-tutorial An Ansible Tutorial]
*[https://www.cyberciti.biz/faq/how-to-install-and-configure-latest-version-of-ansible-on-ubuntu-linux/ How to Install and Configure latest version of Ansible on Ubuntu Linux]
*[https://networklore.com/ansible-getting-started/ Getting started with Ansible]
*[https://ansible-tips-and-tricks.readthedocs.io/en/latest/os-dependent-tasks/variables/ Tips and tricks]
*[https://www.ansible.com/products/awx-project AWX]
*[https://galaxy.ansible.com Ansible Galaxy]
*[https://docs.ansible.com/ansible/latest/user_guide/playbooks_async.html Timeouts]
*[https://manintheit.org/ansible/ansible-sample-scripts/ Ansible sample scripts]
*[https://gist.github.com/mgedmin/5f8ac034df0c371444be module for postfix]
*[https://docs.ansible.com/ansible/latest/collections/ Ansible collections]

=Tools=
*[https://molecule.readthedocs.io/en/latest/ Molecule] for testing roles
*ansible-lint
*ansible-console
*ansible-inventory

=Docs=
*[https://howto.cactus.de/index.php/Ansible_Howto Ansible Howto]
*[https://docs.ansible.com/ansible/latest/collections/ansible/builtin/ Ansible builtin modules]
*[https://docs.ansible.com/ansible/latest/collections/all_plugins.html All plugins]
*[http://ansible-docs.readthedocs.io/zh/stable-2.0/rst/playbooks_conditionals.html Conditionals]
*[https://docs.ansible.com/ansible/2.5/user_guide/playbooks_async.html Parallel!]
==Ansible style guides==
*[https://docs.ansible.com/ansible/2.6/dev_guide/style_guide/index.html Style guide]
*[https://redhat-cop.github.io/automation-good-practices/ Ansible good practices]

*[https://spacelift.io/blog/ansible-variables Ansible variables]

*[https://docs.ansible.com/projects/ansible/latest/reference_appendices/config.html#the-configuration-file ansible.cfg configuration file]
==Lineinfile==
*[https://docs.ansible.com/ansible/latest/collections/ansible/builtin/lineinfile_module.html Lineinfile module]

==Popular modules==
*[https://docs.ansible.com/ansible/latest/collections/ansible/builtin/file_module.html ansible.builtin.file]
*[https://docs.ansible.com/ansible/latest/collections/ansible/builtin/apt_module.html ansible.builtin.apt]
*[https://docs.ansible.com/ansible/latest/collections/ansible/builtin/lineinfile_module.html ansible.builtin.lineinfile]

=Some terms=

=Inventories=
*[https://spacelift.io/blog/ansible-inventory]
*[http://docs.ansible.com/ansible/latest/intro_dynamic_inventory.html Dynamic Inventory]
*[https://www.jeffgeerling.com/blog/creating-custom-dynamic-inventories-ansible Creating custom dynamic inventories]
*[https://www.digitalocean.com/community/tutorials/how-to-set-up-ansible-inventories Set up ansible inventories]

=Alternatives=
*[[Puppet]]
*[[Saltstack]]

=Quickstart=
On server as root create key:
ssh-keygen
(go for defaults)
and then get content of ~/.ssh/id_rsa.pub in your copypastebuffer

On 'clients' edit /etc/ssh/sshd_config to
PermitRootLogin without-password
and restart sshd

Edit/create ~root/.ssh/authorized_keys and add:
from="ip.of.ansible.server" <paste public key here>

=Scripts/playbooks=
==Maintain useraccounts==
<pre>
---

- name: remove users
user: name=exuser state=absent force=yes groups=''
with_dict: accounts
tags:
- delusers

- name: sync group
group:
name: sync
gid: 999
state: "present"

- name: fix homedir rights
lineinfile: dest=/etc/login.defs regexp=^UMASK line="UMASK 007"

- name: useraccounts
user:
name: "{{ item.key }}"
comment: "{{ item.value.name }}"
uid: "{{ item.value.uid }}"
state: "present"
shell: "/bin/bash"
groups: sudo
with_dict: accounts
tags:
- accounts

- name: userpasswords
user:
name: "{{ item.key }}"
password: "{{ lookup('csvfile',item.key + ' file=/etc/shadow delimiter=: col=1' ) }}"
with_dict: accounts

#ssh keys
- name: userkeys
authorized_key: user={{ item.key }} key="{{ lookup('file','/home/' + item.key + '/.ssh/authorized_keys' ) }}" exclusive=yes
with_dict: accounts
tags:
- keys

- name: nofoobar
user: name=foobar state=absent remove=yes
tags:
- foobar
</pre>

== comment out a line ==
- name: remove java line from rclocal
lineinfile:
dest: /etc/rc.local
regexp: '^(java.*)$'
line: '# \1'
backrefs: yes

=HOWTO=
==Add user to group==
name: add user to bargroup
user:
name: foo
groups: bargroup
append: yes

==Run command==

==Cronjobs and ssh passphrases==
See [https://gist.github.com/Justintime50/297d0d36da40834b037a65998d2149ca Use Your SSH Agent in a Crontab ( keychain)]

= FAQ =

==Notify multiple handlers==
notify:
- Call Handler1
- Call Handler2

==Print hostname in debug msg ==
debug:
msg: "Something to report in {{ inventory_hostname }}"

==Connect to a different port==
Try
--extra-vars="ansible_port=2345"

==Error messages==
===Parse errors===
====ERROR! unexpected parameter type in action: <type 'bool'>====

====ERROR! conflicting action statements: debug, msg====
'''indentation'''

====[WARNING]: Unable to parse <some hostname> as an inventory source====
Append a comma
ansible-playbook myplay.yml -i myhostname,

===sftp transfer mechanism failed===
??

===Using a SSH password instead of a key is not possible because Host Key checking is enabled and sshpass does not support this.===
Please add this host's fingerprint to your known_hosts file to manage this host.

Try
ANSIBLE_HOST_KEY_CHECKING=False playbook ...
Or just ssh to the host and accept key

===Platform linux on host backup01 is using the discovered Python interpreter at /usr/bin/python3===
one hack is adding to ~/.ansible.cfg:
[defaults]
interpreter_python=auto_silent

Or fix on that system:
update-alternatives --install /usr/bin/python python /usr/bin/python3 1

===The error was: 'item' is undefined"===
wrong indentation for with_items

=== Failed to connect to the host via ssh: Permission denied (publickey,password) ===
To connect without public key in authorized keys try
--ask-pass

===SSH Connection timed out during banner exchange===
See:
*[https://oneuptime.com/blog/post/2026-02-21-how-to-configure-ansible-ssh-connection-keepalive/view How to Configure Ansible SSH Connection Keepalive ]
So far working for me:
[ssh_connection]
ssh_args = -o ServerAliveInterval=5
retries = 5

==ansible-lint==
===Use shell only when shell functionality is required===

== roles for multiple distributions ==

include_vars with "distro-{{ansible_distro_name}}.yml"

== Escape single quote ==

'foo ''bar'' '

==Syntax Error while loading YAML. did not find expected key==
Check indentation

== Newlines in output ==

instead of all those '\n':

In ansible.cfg:

stdout_callback = yaml

== Ad-hoc commands ==

[http://docs.ansible.com/ansible/latest/intro_adhoc.html http://docs.ansible.com/ansible/latest/intro_adhoc.html]

== check python code ==

ansible-test sanity --test pep8 mycode.py

== Command/shell output on single line ==

ANSIBLE_STDOUT_CALLBACK=oneline ansible-playbook foo.yml

== Storing passwords ==

[http://docs.ansible.com/ansible/2.4/vault.html http://docs.ansible.com/ansible/2.4/vault.html]

== Show all host variables ==

ansible -m setup <hostname>

== Show all OS/versions ==

ansible all -m setup -a "filter=ansible_distribution*"

== Syntax highlighting for ansible ==

*[https://github.com/chase/vim-ansible-yaml https://github.com/chase/vim-ansible-yaml]

Drop the files in ~/vim/bundle and in .vimrc:

call pathogen#infect()
call pathogen#helptags()

Or maybe better:

*[https://github.com/pearofducks/ansible-vim https://github.com/pearofducks/ansible-vim]

== Retry ==

--limit @/home/ansible/ssh.retry

==Error messages==
===ERROR! 'when' is not a valid attribute for a Play===

=== ERROR! this task 'import_playbook' has extra params ===

meh

 

=== /usr/bin/chattr: Clearing extent flag not supported ===

Probably trying to make a backup of a symlink

===Missing sudo password===
set NOPASSWD in sudo config

== Escape curly braces ==

{{ '{' }}

== Check file for string ==

tasks:
- name: grep line
shell: "grep -q swap /etc/fstab"
failed_when: false
register: grepped

- name: show grep
debug:
msg: "exists"
when: grepped.rc == 0

== Error messages ==

=== msg: The PyMySQL (Python 2.7 and Python 3.X) or MySQL-python (Python 2.X) module is required ===

Means you need to install for example python2-PyMySQL on that host

==Ansible-lint messages==
===Commands should not change things if nothing needs doing===
Ignore, or use
changed_when: false
===Shells that use pipes should set the pipefail option===
shell: |
set -o pipefail
some command

=Tips & tricks=
==Includes only when on host group==
- block:
- include: foo.yml
- include: bar.yml
when: "'foobar' in group_names"

== Show info/facts of a host ==

ansible somehost -m setup
ansible somehost -m ansible.builtin.setup

==Show distribution and version==
- name: show some host info
debug:
msg: Dist {{ ansible_distribution }} {{ ansible_distribution_version }}

[[Category:Configuration management]]
[[Category:Ansible]]

Meshcore

2026-06-01T13:11:56Z

Tony:

=Links=
* https://meshcore.co.uk/
* https://www.meshnet.nl/wiki/MeshCore
* https://www.lorameshdevices.com/blog/meshcore/meshtastic-vs-meshcore-key-differences-explained.html
* [https://meshmap.net/ Mesh Map]
* [https://meshcore.co.uk/map.html Meshcore Map]
* https://github.com/folkertvanheusden/lora-pipe
* https://nurdspace.nl/Meshcore#settings

==Articles==
*[https://hackaday.com/2025/12/06/lessons-learned-after-trying-meshcore-for-off-grid-text-messaging/ Lessons Learned After Trying MeshCore For Off-grid Text Messaging]

[[category:Networking]]
[[Category:Packet Radio]]

Reticulum

2026-06-01T13:11:13Z

Tony:

=Links=
*[https://reticulum.network/ Reticulum homepage]
*[https://rmap.world/ Reticulum map]

[[Category:Networking]]
[[Category:Packet Radio]]

Github

2026-06-01T10:55:49Z

Tony: /* Use ssh */

=Links=
*[https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication 2 factor authentication on github]
https://github.com/drduh/YubiKey-Guide

=HOWTO=
==Use ssh==
*[https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent Generating a new SSH key for a hardware security key]
On github.com go to '''Settings->SSH and GPG keys'''
'''Add key''': paste your public key
Make sure your ssh client uses correct key:
Host github.com
IdentityFile ~/.ssh/id_ed25519

And
git remote set-url origin git@github.com:username/your-repository.git

=FAQ=
==Error messages==
===The authenticity of host 'github.com (140.82.121.3)' can't be established. ===
??

===git@github.com: Permission denied (publickey).===
Most likely github doesn't know your public key, try
ssh -vT git@github.com
and check on your account: '''SSH and GPG keys -> SSH keys'''

==This branch has conflicts that must be resolved ==
resolve them :)

==remote: Support for password authentication was removed ==
* https://docs.github.com/en/authentication/connecting-to-github-with-ssh

==Password authentication is not supported for Git operations==
Check:
* https://docs.github.com/en/authentication/connecting-to-github-with-ssh

or use Personal Acces Token instead: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token

==Local copy contains "<<<<<<< HEAD" ==
Merge conflict, fixing it:
git mergetool

== Create pull request ==

*https://opensource.com/article/19/7/create-pull-request-github

Markdown

2026-06-01T09:21:25Z

Tony: /* Links */

Markup language

=Links=
*[https://daringfireball.net/projects/markdown/syntax Syntax]
*[https://www.markdownguide.org/basic-syntax/ Basic syntax]
*[https://www.markdownguide.org/extended-syntax/ Extended syntax]

=Tools=
==Markdown Editors==
===ghostwriter===
===Typora===
snap install typora

=Markdown cheat sheet=
==URL==
[The Title](https://examplecom)

==Converters==
===pandoc===
====docx to markdown====
pandoc -f docx -t markdown foo.docx -o foo.markdown

====Convert markdown to pdf====
pandoc -o mydoc.pdf mydoc.md

pandoc --pdf-engine=pdflatex -V 'fontfamily:sans' -V 'margin-top:10mm' -o mydoc.pdf mydoc.md

==mdpdf==
https://github.com/elliotblackburn/mdpdf

==Markdown viewers==
*[https://github.com/ttscoff/mdless mdless] not too bad
*view
*npm -g install mdr
*mdp has problems with lines
*mdless not too pretty

*[https://github.com/charmbracelet/glow/releases glow]

AI

2026-05-29T12:58:45Z

Tony: Created page with "=Links= *[https://platform.openai.com/tokenizer-explorer Tokenizer explorer] *[https://localai.io/reference/cli-reference/ LocalAI CLI reference] =Terms= ==LLM== Large Language Model ==BPE== Byte pair encoding"

=Links=
*[https://platform.openai.com/tokenizer-explorer Tokenizer explorer]

*[https://localai.io/reference/cli-reference/ LocalAI CLI reference]

=Terms=
==LLM==
Large Language Model

==BPE==
Byte pair encoding

LocalAI

2026-05-27T19:53:07Z

Tony: /* HOWTO */

=Links=
*[https://localai.io LocalAI homepage]
*[https://localai.io/faq/ LocalAI FAQ]
*[https://github.com/open-webui/open-webui Check out Open webui]
==Installing localai==
*https://localai.io/installation/index.print

=HOWTO=
==List models==
curl http://localhost:8080/v1/models

==Audio to text==
*https://localai.io/features/audio-to-text/
*https://docs.llamaindex.ai/en/stable/examples/llm/localai/

==Apply model==
curl http://localhost:8080/models/apply -H "Content-Type: application/json" -d '{
"id": "huggingface@TheBloke/Yarn-Mistral-7B-128k-GGUF/yarn-mistral-7b-128k.Q5_K_M.gguf"
}'

==CLI==
https://localai.io/reference/cli-reference/
===Reset conversation===
?

=Scripts=
==Talk to the chat interface==
#!/bin/bash
echo -n "Ask me anything: "
read A
curl -s http://localhost:8080/v1/chat/completions \
-H "Content-Type: application/json" \
-d '{ "model": "gpt-4", "messages": [{"role": "user", "content": "'"$A"'", "temperature": 0.1}] }' |\
jq '.choices[].message.content' | sed 's/\\n/\n/g' | sed 's/\\"/"/g'

=FAQ=
==File/directory locations==
===Local-ai log===
/usr/share/local-ai/llama.log
===Models===
/usr/share/local-ai/models

==Messages==
===GPU device found but no CUDA backend present===
If running in docker, try restarting docker

===WARNING: failed to read int from file: open /sys/class/drm/card0/device/numa_node: no such file or directory===

===failed to load model with internal loader: grpc service not ready===
??

==Error messages==
===Failed to process stream===
something broken?

Ansible

2026-05-27T08:27:50Z

Tony: /* Docs */

Configuration management

=Links=
*[http://www.ansible.com/home Homepage]
*[http://www.hashbangcode.com/blog/adding-iptables-rules-ansible Adding iptables Rules With Ansible]
*[http://cloudacademy.com/blog/going-deeper-into-ansible-playbooks/ Going Deeper into Ansible Playbooks]
*[https://serversforhackers.com/an-ansible-tutorial An Ansible Tutorial]
*[https://www.cyberciti.biz/faq/how-to-install-and-configure-latest-version-of-ansible-on-ubuntu-linux/ How to Install and Configure latest version of Ansible on Ubuntu Linux]
*[https://networklore.com/ansible-getting-started/ Getting started with Ansible]
*[https://ansible-tips-and-tricks.readthedocs.io/en/latest/os-dependent-tasks/variables/ Tips and tricks]
*[https://www.ansible.com/products/awx-project AWX]
*[https://galaxy.ansible.com Ansible Galaxy]
*[https://docs.ansible.com/ansible/latest/user_guide/playbooks_async.html Timeouts]
*[https://manintheit.org/ansible/ansible-sample-scripts/ Ansible sample scripts]
*[https://gist.github.com/mgedmin/5f8ac034df0c371444be module for postfix]
*[https://docs.ansible.com/ansible/latest/collections/ Ansible collections]

=Tools=
*[https://molecule.readthedocs.io/en/latest/ Molecule] for testing roles
*ansible-lint
*ansible-console
*ansible-inventory

=Docs=
*[https://howto.cactus.de/index.php/Ansible_Howto Ansible Howto]
*[https://docs.ansible.com/ansible/latest/collections/ansible/builtin/ Ansible builtin modules]
*[https://docs.ansible.com/ansible/latest/collections/all_plugins.html All plugins]
*[http://ansible-docs.readthedocs.io/zh/stable-2.0/rst/playbooks_conditionals.html Conditionals]
*[https://docs.ansible.com/ansible/2.5/user_guide/playbooks_async.html Parallel!]
==Ansible style guides==
*[https://docs.ansible.com/ansible/2.6/dev_guide/style_guide/index.html Style guide]
*[https://redhat-cop.github.io/automation-good-practices/ Ansible good practices]

*[https://spacelift.io/blog/ansible-variables Ansible variables]

*[https://docs.ansible.com/projects/ansible/latest/reference_appendices/config.html#the-configuration-file ansible.cfg configuration file]
==Lineinfile==
*[https://docs.ansible.com/ansible/latest/collections/ansible/builtin/lineinfile_module.html Lineinfile module]

==Popular modules==
*[https://docs.ansible.com/ansible/latest/collections/ansible/builtin/file_module.html ansible.builtin.file]
*[https://docs.ansible.com/ansible/latest/collections/ansible/builtin/apt_module.html ansible.builtin.apt]
*[https://docs.ansible.com/ansible/latest/collections/ansible/builtin/lineinfile_module.html ansible.builtin.lineinfile]

=Some terms=

=Inventories=
*[https://spacelift.io/blog/ansible-inventory]
*[http://docs.ansible.com/ansible/latest/intro_dynamic_inventory.html Dynamic Inventory]
*[https://www.jeffgeerling.com/blog/creating-custom-dynamic-inventories-ansible Creating custom dynamic inventories]
*[https://www.digitalocean.com/community/tutorials/how-to-set-up-ansible-inventories Set up ansible inventories]

=Alternatives=
*[[Puppet]]
*[[Saltstack]]

=Quickstart=
On server as root create key:
ssh-keygen
(go for defaults)
and then get content of ~/.ssh/id_rsa.pub in your copypastebuffer

On 'clients' edit /etc/ssh/sshd_config to
PermitRootLogin without-password
and restart sshd

Edit/create ~root/.ssh/authorized_keys and add:
from="ip.of.ansible.server" <paste public key here>

=Scripts/playbooks=
==Maintain useraccounts==
<pre>
---

- name: remove users
user: name=exuser state=absent force=yes groups=''
with_dict: accounts
tags:
- delusers

- name: sync group
group:
name: sync
gid: 999
state: "present"

- name: fix homedir rights
lineinfile: dest=/etc/login.defs regexp=^UMASK line="UMASK 007"

- name: useraccounts
user:
name: "{{ item.key }}"
comment: "{{ item.value.name }}"
uid: "{{ item.value.uid }}"
state: "present"
shell: "/bin/bash"
groups: sudo
with_dict: accounts
tags:
- accounts

- name: userpasswords
user:
name: "{{ item.key }}"
password: "{{ lookup('csvfile',item.key + ' file=/etc/shadow delimiter=: col=1' ) }}"
with_dict: accounts

#ssh keys
- name: userkeys
authorized_key: user={{ item.key }} key="{{ lookup('file','/home/' + item.key + '/.ssh/authorized_keys' ) }}" exclusive=yes
with_dict: accounts
tags:
- keys

- name: nofoobar
user: name=foobar state=absent remove=yes
tags:
- foobar
</pre>

== comment out a line ==
- name: remove java line from rclocal
lineinfile:
dest: /etc/rc.local
regexp: '^(java.*)$'
line: '# \1'
backrefs: yes

=HOWTO=
==Add user to group==
name: add user to bargroup
user:
name: foo
groups: bargroup
append: yes

==Run command==

==Cronjobs and ssh passphrases==
See [https://gist.github.com/Justintime50/297d0d36da40834b037a65998d2149ca Use Your SSH Agent in a Crontab ( keychain)]

= FAQ =

==Notify multiple handlers==
notify:
- Call Handler1
- Call Handler2

==Print hostname in debug msg ==
debug:
msg: "Something to report in {{ inventory_hostname }}"

==Connect to a different port==
Try
--extra-vars="ansible_port=2345"

==Error messages==
===Parse errors===
====ERROR! unexpected parameter type in action: <type 'bool'>====

====ERROR! conflicting action statements: debug, msg====
'''indentation'''

====[WARNING]: Unable to parse <some hostname> as an inventory source====
Append a comma
ansible-playbook myplay.yml -i myhostname,

===Using a SSH password instead of a key is not possible because Host Key checking is enabled and sshpass does not support this.===
Please add this host's fingerprint to your known_hosts file to manage this host.

Try
ANSIBLE_HOST_KEY_CHECKING=False playbook ...
Or just ssh to the host and accept key

===Platform linux on host backup01 is using the discovered Python interpreter at /usr/bin/python3===
one hack is adding to ~/.ansible.cfg:
[defaults]
interpreter_python=auto_silent

Or fix on that system:
update-alternatives --install /usr/bin/python python /usr/bin/python3 1

===The error was: 'item' is undefined"===
wrong indentation for with_items

=== Failed to connect to the host via ssh: Permission denied (publickey,password) ===
To connect without public key in authorized keys try
--ask-pass

===SSH Connection timed out during banner exchange===
See:
*[https://oneuptime.com/blog/post/2026-02-21-how-to-configure-ansible-ssh-connection-keepalive/view How to Configure Ansible SSH Connection Keepalive ]
So far working for me:
[ssh_connection]
ssh_args = -o ServerAliveInterval=5
retries = 5

==ansible-lint==
===Use shell only when shell functionality is required===

== roles for multiple distributions ==

include_vars with "distro-{{ansible_distro_name}}.yml"

== Escape single quote ==

'foo ''bar'' '

==Syntax Error while loading YAML. did not find expected key==
Check indentation

== Newlines in output ==

instead of all those '\n':

In ansible.cfg:

stdout_callback = yaml

== Ad-hoc commands ==

[http://docs.ansible.com/ansible/latest/intro_adhoc.html http://docs.ansible.com/ansible/latest/intro_adhoc.html]

== check python code ==

ansible-test sanity --test pep8 mycode.py

== Command/shell output on single line ==

ANSIBLE_STDOUT_CALLBACK=oneline ansible-playbook foo.yml

== Storing passwords ==

[http://docs.ansible.com/ansible/2.4/vault.html http://docs.ansible.com/ansible/2.4/vault.html]

== Show all host variables ==

ansible -m setup <hostname>

== Show all OS/versions ==

ansible all -m setup -a "filter=ansible_distribution*"

== Syntax highlighting for ansible ==

*[https://github.com/chase/vim-ansible-yaml https://github.com/chase/vim-ansible-yaml]

Drop the files in ~/vim/bundle and in .vimrc:

call pathogen#infect()
call pathogen#helptags()

Or maybe better:

*[https://github.com/pearofducks/ansible-vim https://github.com/pearofducks/ansible-vim]

== Retry ==

--limit @/home/ansible/ssh.retry

==Error messages==
===ERROR! 'when' is not a valid attribute for a Play===

=== ERROR! this task 'import_playbook' has extra params ===

meh

 

=== /usr/bin/chattr: Clearing extent flag not supported ===

Probably trying to make a backup of a symlink

===Missing sudo password===
set NOPASSWD in sudo config

== Escape curly braces ==

{{ '{' }}

== Check file for string ==

tasks:
- name: grep line
shell: "grep -q swap /etc/fstab"
failed_when: false
register: grepped

- name: show grep
debug:
msg: "exists"
when: grepped.rc == 0

== Error messages ==

=== msg: The PyMySQL (Python 2.7 and Python 3.X) or MySQL-python (Python 2.X) module is required ===

Means you need to install for example python2-PyMySQL on that host

==Ansible-lint messages==
===Commands should not change things if nothing needs doing===
Ignore, or use
changed_when: false
===Shells that use pipes should set the pipefail option===
shell: |
set -o pipefail
some command

=Tips & tricks=
==Includes only when on host group==
- block:
- include: foo.yml
- include: bar.yml
when: "'foobar' in group_names"

== Show info/facts of a host ==

ansible somehost -m setup
ansible somehost -m ansible.builtin.setup

==Show distribution and version==
- name: show some host info
debug:
msg: Dist {{ ansible_distribution }} {{ ansible_distribution_version }}

[[Category:Configuration management]]
[[Category:Ansible]]

Ansible

2026-05-27T08:21:01Z

Tony: /* Connection timed out during banner exchange */

Configuration management

=Links=
*[http://www.ansible.com/home Homepage]
*[http://www.hashbangcode.com/blog/adding-iptables-rules-ansible Adding iptables Rules With Ansible]
*[http://cloudacademy.com/blog/going-deeper-into-ansible-playbooks/ Going Deeper into Ansible Playbooks]
*[https://serversforhackers.com/an-ansible-tutorial An Ansible Tutorial]
*[https://www.cyberciti.biz/faq/how-to-install-and-configure-latest-version-of-ansible-on-ubuntu-linux/ How to Install and Configure latest version of Ansible on Ubuntu Linux]
*[https://networklore.com/ansible-getting-started/ Getting started with Ansible]
*[https://ansible-tips-and-tricks.readthedocs.io/en/latest/os-dependent-tasks/variables/ Tips and tricks]
*[https://www.ansible.com/products/awx-project AWX]
*[https://galaxy.ansible.com Ansible Galaxy]
*[https://docs.ansible.com/ansible/latest/user_guide/playbooks_async.html Timeouts]
*[https://manintheit.org/ansible/ansible-sample-scripts/ Ansible sample scripts]
*[https://gist.github.com/mgedmin/5f8ac034df0c371444be module for postfix]
*[https://docs.ansible.com/ansible/latest/collections/ Ansible collections]

=Tools=
*[https://molecule.readthedocs.io/en/latest/ Molecule] for testing roles
*ansible-lint
*ansible-console
*ansible-inventory

=Docs=
*[https://howto.cactus.de/index.php/Ansible_Howto Ansible Howto]
*[https://docs.ansible.com/ansible/latest/collections/ansible/builtin/ Ansible builtin modules]
*[https://docs.ansible.com/ansible/latest/collections/all_plugins.html All plugins]
*[http://ansible-docs.readthedocs.io/zh/stable-2.0/rst/playbooks_conditionals.html Conditionals]
*[https://docs.ansible.com/ansible/2.5/user_guide/playbooks_async.html Parallel!]
==Ansible style guides==
*[https://docs.ansible.com/ansible/2.6/dev_guide/style_guide/index.html Style guide]
*[https://redhat-cop.github.io/automation-good-practices/ Ansible good practices]

*[https://spacelift.io/blog/ansible-variables Ansible variables]

==Lineinfile==
*[https://docs.ansible.com/ansible/latest/collections/ansible/builtin/lineinfile_module.html Lineinfile module]

==Popular modules==
*[https://docs.ansible.com/ansible/latest/collections/ansible/builtin/file_module.html ansible.builtin.file]
*[https://docs.ansible.com/ansible/latest/collections/ansible/builtin/apt_module.html ansible.builtin.apt]
*[https://docs.ansible.com/ansible/latest/collections/ansible/builtin/lineinfile_module.html ansible.builtin.lineinfile]

=Some terms=

=Inventories=
*[https://spacelift.io/blog/ansible-inventory]
*[http://docs.ansible.com/ansible/latest/intro_dynamic_inventory.html Dynamic Inventory]
*[https://www.jeffgeerling.com/blog/creating-custom-dynamic-inventories-ansible Creating custom dynamic inventories]
*[https://www.digitalocean.com/community/tutorials/how-to-set-up-ansible-inventories Set up ansible inventories]

=Alternatives=
*[[Puppet]]
*[[Saltstack]]

=Quickstart=
On server as root create key:
ssh-keygen
(go for defaults)
and then get content of ~/.ssh/id_rsa.pub in your copypastebuffer

On 'clients' edit /etc/ssh/sshd_config to
PermitRootLogin without-password
and restart sshd

Edit/create ~root/.ssh/authorized_keys and add:
from="ip.of.ansible.server" <paste public key here>

=Scripts/playbooks=
==Maintain useraccounts==
<pre>
---

- name: remove users
user: name=exuser state=absent force=yes groups=''
with_dict: accounts
tags:
- delusers

- name: sync group
group:
name: sync
gid: 999
state: "present"

- name: fix homedir rights
lineinfile: dest=/etc/login.defs regexp=^UMASK line="UMASK 007"

- name: useraccounts
user:
name: "{{ item.key }}"
comment: "{{ item.value.name }}"
uid: "{{ item.value.uid }}"
state: "present"
shell: "/bin/bash"
groups: sudo
with_dict: accounts
tags:
- accounts

- name: userpasswords
user:
name: "{{ item.key }}"
password: "{{ lookup('csvfile',item.key + ' file=/etc/shadow delimiter=: col=1' ) }}"
with_dict: accounts

#ssh keys
- name: userkeys
authorized_key: user={{ item.key }} key="{{ lookup('file','/home/' + item.key + '/.ssh/authorized_keys' ) }}" exclusive=yes
with_dict: accounts
tags:
- keys

- name: nofoobar
user: name=foobar state=absent remove=yes
tags:
- foobar
</pre>

== comment out a line ==
- name: remove java line from rclocal
lineinfile:
dest: /etc/rc.local
regexp: '^(java.*)$'
line: '# \1'
backrefs: yes

=HOWTO=
==Add user to group==
name: add user to bargroup
user:
name: foo
groups: bargroup
append: yes

==Run command==

==Cronjobs and ssh passphrases==
See [https://gist.github.com/Justintime50/297d0d36da40834b037a65998d2149ca Use Your SSH Agent in a Crontab ( keychain)]

= FAQ =

==Notify multiple handlers==
notify:
- Call Handler1
- Call Handler2

==Print hostname in debug msg ==
debug:
msg: "Something to report in {{ inventory_hostname }}"

==Connect to a different port==
Try
--extra-vars="ansible_port=2345"

==Error messages==
===Parse errors===
====ERROR! unexpected parameter type in action: <type 'bool'>====

====ERROR! conflicting action statements: debug, msg====
'''indentation'''

====[WARNING]: Unable to parse <some hostname> as an inventory source====
Append a comma
ansible-playbook myplay.yml -i myhostname,

===Using a SSH password instead of a key is not possible because Host Key checking is enabled and sshpass does not support this.===
Please add this host's fingerprint to your known_hosts file to manage this host.

Try
ANSIBLE_HOST_KEY_CHECKING=False playbook ...
Or just ssh to the host and accept key

===Platform linux on host backup01 is using the discovered Python interpreter at /usr/bin/python3===
one hack is adding to ~/.ansible.cfg:
[defaults]
interpreter_python=auto_silent

Or fix on that system:
update-alternatives --install /usr/bin/python python /usr/bin/python3 1

===The error was: 'item' is undefined"===
wrong indentation for with_items

=== Failed to connect to the host via ssh: Permission denied (publickey,password) ===
To connect without public key in authorized keys try
--ask-pass

===SSH Connection timed out during banner exchange===
See:
*[https://oneuptime.com/blog/post/2026-02-21-how-to-configure-ansible-ssh-connection-keepalive/view How to Configure Ansible SSH Connection Keepalive ]
So far working for me:
[ssh_connection]
ssh_args = -o ServerAliveInterval=5
retries = 5

==ansible-lint==
===Use shell only when shell functionality is required===

== roles for multiple distributions ==

include_vars with "distro-{{ansible_distro_name}}.yml"

== Escape single quote ==

'foo ''bar'' '

==Syntax Error while loading YAML. did not find expected key==
Check indentation

== Newlines in output ==

instead of all those '\n':

In ansible.cfg:

stdout_callback = yaml

== Ad-hoc commands ==

[http://docs.ansible.com/ansible/latest/intro_adhoc.html http://docs.ansible.com/ansible/latest/intro_adhoc.html]

== check python code ==

ansible-test sanity --test pep8 mycode.py

== Command/shell output on single line ==

ANSIBLE_STDOUT_CALLBACK=oneline ansible-playbook foo.yml

== Storing passwords ==

[http://docs.ansible.com/ansible/2.4/vault.html http://docs.ansible.com/ansible/2.4/vault.html]

== Show all host variables ==

ansible -m setup <hostname>

== Show all OS/versions ==

ansible all -m setup -a "filter=ansible_distribution*"

== Syntax highlighting for ansible ==

*[https://github.com/chase/vim-ansible-yaml https://github.com/chase/vim-ansible-yaml]

Drop the files in ~/vim/bundle and in .vimrc:

call pathogen#infect()
call pathogen#helptags()

Or maybe better:

*[https://github.com/pearofducks/ansible-vim https://github.com/pearofducks/ansible-vim]

== Retry ==

--limit @/home/ansible/ssh.retry

==Error messages==
===ERROR! 'when' is not a valid attribute for a Play===

=== ERROR! this task 'import_playbook' has extra params ===

meh

 

=== /usr/bin/chattr: Clearing extent flag not supported ===

Probably trying to make a backup of a symlink

===Missing sudo password===
set NOPASSWD in sudo config

== Escape curly braces ==

{{ '{' }}

== Check file for string ==

tasks:
- name: grep line
shell: "grep -q swap /etc/fstab"
failed_when: false
register: grepped

- name: show grep
debug:
msg: "exists"
when: grepped.rc == 0

== Error messages ==

=== msg: The PyMySQL (Python 2.7 and Python 3.X) or MySQL-python (Python 2.X) module is required ===

Means you need to install for example python2-PyMySQL on that host

==Ansible-lint messages==
===Commands should not change things if nothing needs doing===
Ignore, or use
changed_when: false
===Shells that use pipes should set the pipefail option===
shell: |
set -o pipefail
some command

=Tips & tricks=
==Includes only when on host group==
- block:
- include: foo.yml
- include: bar.yml
when: "'foobar' in group_names"

== Show info/facts of a host ==

ansible somehost -m setup
ansible somehost -m ansible.builtin.setup

==Show distribution and version==
- name: show some host info
debug:
msg: Dist {{ ansible_distribution }} {{ ansible_distribution_version }}

[[Category:Configuration management]]
[[Category:Ansible]]

Docker

2026-05-26T20:11:01Z

Tony: /* HOWTO */

=Links=
*[https://www.docker.com/ Homepage]

=Docs=
*[https://docs.docker.com/manuals/ The Docker Manuals]
*[https://docs.docker.com/compose Docker-compose]
*https://www.digitalocean.com/community/tutorials/how-to-install-and-use-docker-on-centos-7
*[https://www.digitalocean.com/community/tutorials/how-to-remove-docker-images-containers-and-volumes Removing images, containers and volumes]
*[https://training.play-with-docker.com/beginner-linux/ Docker for beginners]
*[https://runnable.com/docker/basic-docker-networking Docker networking]
*[https://docs.docker.com/config/pruning/ Docker pruning]
*[https://www.virtualizationhowto.com/2023/11/docker-overlay2-cleanup-5-ways-to-reclaim-disk-space/ Docker Overlay2 Cleanup: 5 Ways to Reclaim Disk Space]

=HOWTO=
==Run container==
docker run <IMAGE ID>
==List running containers==
docker ps

==List containers==
docker ps -a

==Start container==
docker start <name>
name as found with docker ps -a

==Show log==
docker logs <container>
or to follow:
docker logs -f <container>
==Show disk usage==
*https://niklasmtj.de/blog/understand-docker-storage/

docker system df
outputs:
TYPE TOTAL ACTIVE SIZE RECLAIMABLE
Images 27 10 11.35GB 5.72GB (50%)
Containers 12 12 123.6MB 0B (0%)
Local Volumes 0 0 0B 0B
Build Cache 0 0 0B 0B
===RECLAIMABLE===
Is what you get back when running
docker system prune -a

==List images==
docker images

==Remove image==
===docker rm===
removes container
docker ps -a
and then
docker rm <container id>

===docker rmi===
alias for '''docker image rm'''
docker image ls
and then
docker rmi <ID>

==Export image==
docker save <image name> > imagename.tar

==Update image==
docker pull imagename

==Get shell in running container==
To get image name
docker ps
then
docker exec -it <image-id> bash

==Network==
docker network ls
docker network inspect

==image has dependent child images==
docker inspect --format='{{.Id}} {{.Parent}}' $(docker images --filter since=<image_id> -q)
or get [https://github.com/justone/dockviz dockviz] and run
dockviz images --tree -l

==Dangling images==
===list dangling images===
docker images -f dangling=true

===Remove dangling image===
docker rmi image-id
====Errors/warnings====
=====Error response from daemon: conflict: unable to delete 9e82ccb228df (must be forced) - image is being used by stopped container a14fb2b549f1=====
Find the culprit with
docker ps -a
and then
docker rm <id you find>

===Remove all dangling images===
docker rmi $(docker images -f dangling=true -q)

==image is being used by stopped container xyz==
docker rm xyz
and try again

==Backups==
*https://linuxconfig.org/docker-container-backup-and-recovery
*[https://bobcares.com/blog/docker-backup/ Docker - Easy backup & restore]

=FAQ=
==Error messages==
===The container name "/mycontainer" is already in use by container===
It already exists, so use
docker start <container id>
instead of
docker run

OR find the culprit
docker ps -a
and then
docker rm container/name
etc

===ERROR: failed to solve: failed to read dockerfile: open Dockerfile: no such file or directory===
It really wants a file called '''Dockerfile'''

===docker.service: Start request repeated too quickly===
Try
dockerd --debug

===dial unix /var/run/docker.sock: connect: permission denied===
You're not in group '''docker'''

===docker rmi===
Error response from daemon: reference does not exist
See https://www.baeldung.com/linux/docker-image-deletion-problem-fix

===Address already in use===
First try
lsof -i:8080

==Compose==
===unknown shorthand flag: 'd' in -d===
docker-compose is probably a script/wrapper.
Install the https://docs.docker.com/engine/install/debian/

===docker: 'compose' is not a docker command.===
Check https://docs.docker.com/engine/install/debian/

===unknown flag: --detach===
apt install docker-compose-v2

=== image is being used by stopped container===
use the force

==Docker rmi not freeing space==
Correct, you need
docker image prune

Alsamixer

2026-05-26T20:06:26Z

Tony:

=Links=
*https://wiki.archlinux.org/title/Advanced_Linux_Sound_Architecture

=Howto=
==Enable channel==
M

[[Category:Sound]]

Ansible

2026-05-26T11:15:14Z

Tony: /* Error messages */

Configuration management

=Links=
*[http://www.ansible.com/home Homepage]
*[http://www.hashbangcode.com/blog/adding-iptables-rules-ansible Adding iptables Rules With Ansible]
*[http://cloudacademy.com/blog/going-deeper-into-ansible-playbooks/ Going Deeper into Ansible Playbooks]
*[https://serversforhackers.com/an-ansible-tutorial An Ansible Tutorial]
*[https://www.cyberciti.biz/faq/how-to-install-and-configure-latest-version-of-ansible-on-ubuntu-linux/ How to Install and Configure latest version of Ansible on Ubuntu Linux]
*[https://networklore.com/ansible-getting-started/ Getting started with Ansible]
*[https://ansible-tips-and-tricks.readthedocs.io/en/latest/os-dependent-tasks/variables/ Tips and tricks]
*[https://www.ansible.com/products/awx-project AWX]
*[https://galaxy.ansible.com Ansible Galaxy]
*[https://docs.ansible.com/ansible/latest/user_guide/playbooks_async.html Timeouts]
*[https://manintheit.org/ansible/ansible-sample-scripts/ Ansible sample scripts]
*[https://gist.github.com/mgedmin/5f8ac034df0c371444be module for postfix]
*[https://docs.ansible.com/ansible/latest/collections/ Ansible collections]

=Tools=
*[https://molecule.readthedocs.io/en/latest/ Molecule] for testing roles
*ansible-lint
*ansible-console
*ansible-inventory

=Docs=
*[https://howto.cactus.de/index.php/Ansible_Howto Ansible Howto]
*[https://docs.ansible.com/ansible/latest/collections/ansible/builtin/ Ansible builtin modules]
*[https://docs.ansible.com/ansible/latest/collections/all_plugins.html All plugins]
*[http://ansible-docs.readthedocs.io/zh/stable-2.0/rst/playbooks_conditionals.html Conditionals]
*[https://docs.ansible.com/ansible/2.5/user_guide/playbooks_async.html Parallel!]
==Ansible style guides==
*[https://docs.ansible.com/ansible/2.6/dev_guide/style_guide/index.html Style guide]
*[https://redhat-cop.github.io/automation-good-practices/ Ansible good practices]

*[https://spacelift.io/blog/ansible-variables Ansible variables]

==Lineinfile==
*[https://docs.ansible.com/ansible/latest/collections/ansible/builtin/lineinfile_module.html Lineinfile module]

==Popular modules==
*[https://docs.ansible.com/ansible/latest/collections/ansible/builtin/file_module.html ansible.builtin.file]
*[https://docs.ansible.com/ansible/latest/collections/ansible/builtin/apt_module.html ansible.builtin.apt]
*[https://docs.ansible.com/ansible/latest/collections/ansible/builtin/lineinfile_module.html ansible.builtin.lineinfile]

=Some terms=

=Inventories=
*[https://spacelift.io/blog/ansible-inventory]
*[http://docs.ansible.com/ansible/latest/intro_dynamic_inventory.html Dynamic Inventory]
*[https://www.jeffgeerling.com/blog/creating-custom-dynamic-inventories-ansible Creating custom dynamic inventories]
*[https://www.digitalocean.com/community/tutorials/how-to-set-up-ansible-inventories Set up ansible inventories]

=Alternatives=
*[[Puppet]]
*[[Saltstack]]

=Quickstart=
On server as root create key:
ssh-keygen
(go for defaults)
and then get content of ~/.ssh/id_rsa.pub in your copypastebuffer

On 'clients' edit /etc/ssh/sshd_config to
PermitRootLogin without-password
and restart sshd

Edit/create ~root/.ssh/authorized_keys and add:
from="ip.of.ansible.server" <paste public key here>

=Scripts/playbooks=
==Maintain useraccounts==
<pre>
---

- name: remove users
user: name=exuser state=absent force=yes groups=''
with_dict: accounts
tags:
- delusers

- name: sync group
group:
name: sync
gid: 999
state: "present"

- name: fix homedir rights
lineinfile: dest=/etc/login.defs regexp=^UMASK line="UMASK 007"

- name: useraccounts
user:
name: "{{ item.key }}"
comment: "{{ item.value.name }}"
uid: "{{ item.value.uid }}"
state: "present"
shell: "/bin/bash"
groups: sudo
with_dict: accounts
tags:
- accounts

- name: userpasswords
user:
name: "{{ item.key }}"
password: "{{ lookup('csvfile',item.key + ' file=/etc/shadow delimiter=: col=1' ) }}"
with_dict: accounts

#ssh keys
- name: userkeys
authorized_key: user={{ item.key }} key="{{ lookup('file','/home/' + item.key + '/.ssh/authorized_keys' ) }}" exclusive=yes
with_dict: accounts
tags:
- keys

- name: nofoobar
user: name=foobar state=absent remove=yes
tags:
- foobar
</pre>

== comment out a line ==
- name: remove java line from rclocal
lineinfile:
dest: /etc/rc.local
regexp: '^(java.*)$'
line: '# \1'
backrefs: yes

=HOWTO=
==Add user to group==
name: add user to bargroup
user:
name: foo
groups: bargroup
append: yes

==Run command==

==Cronjobs and ssh passphrases==
See [https://gist.github.com/Justintime50/297d0d36da40834b037a65998d2149ca Use Your SSH Agent in a Crontab ( keychain)]

= FAQ =

==Notify multiple handlers==
notify:
- Call Handler1
- Call Handler2

==Print hostname in debug msg ==
debug:
msg: "Something to report in {{ inventory_hostname }}"

==Connect to a different port==
Try
--extra-vars="ansible_port=2345"

==Error messages==
===Parse errors===
====ERROR! unexpected parameter type in action: <type 'bool'>====

====ERROR! conflicting action statements: debug, msg====
'''indentation'''

====[WARNING]: Unable to parse <some hostname> as an inventory source====
Append a comma
ansible-playbook myplay.yml -i myhostname,

===Using a SSH password instead of a key is not possible because Host Key checking is enabled and sshpass does not support this.===
Please add this host's fingerprint to your known_hosts file to manage this host.

Try
ANSIBLE_HOST_KEY_CHECKING=False playbook ...
Or just ssh to the host and accept key

===Platform linux on host backup01 is using the discovered Python interpreter at /usr/bin/python3===
one hack is adding to ~/.ansible.cfg:
[defaults]
interpreter_python=auto_silent

Or fix on that system:
update-alternatives --install /usr/bin/python python /usr/bin/python3 1

===The error was: 'item' is undefined"===
wrong indentation for with_items

=== Failed to connect to the host via ssh: Permission denied (publickey,password) ===
To connect without public key in authorized keys try
--ask-pass

===Connection timed out during banner exchange===
So far working for me:
[ssh_connection]
ssh_args = -o ServerAliveInterval=5
retries = 5

==ansible-lint==
===Use shell only when shell functionality is required===

== roles for multiple distributions ==

include_vars with "distro-{{ansible_distro_name}}.yml"

== Escape single quote ==

'foo ''bar'' '

==Syntax Error while loading YAML. did not find expected key==
Check indentation

== Newlines in output ==

instead of all those '\n':

In ansible.cfg:

stdout_callback = yaml

== Ad-hoc commands ==

[http://docs.ansible.com/ansible/latest/intro_adhoc.html http://docs.ansible.com/ansible/latest/intro_adhoc.html]

== check python code ==

ansible-test sanity --test pep8 mycode.py

== Command/shell output on single line ==

ANSIBLE_STDOUT_CALLBACK=oneline ansible-playbook foo.yml

== Storing passwords ==

[http://docs.ansible.com/ansible/2.4/vault.html http://docs.ansible.com/ansible/2.4/vault.html]

== Show all host variables ==

ansible -m setup <hostname>

== Show all OS/versions ==

ansible all -m setup -a "filter=ansible_distribution*"

== Syntax highlighting for ansible ==

*[https://github.com/chase/vim-ansible-yaml https://github.com/chase/vim-ansible-yaml]

Drop the files in ~/vim/bundle and in .vimrc:

call pathogen#infect()
call pathogen#helptags()

Or maybe better:

*[https://github.com/pearofducks/ansible-vim https://github.com/pearofducks/ansible-vim]

== Retry ==

--limit @/home/ansible/ssh.retry

==Error messages==
===ERROR! 'when' is not a valid attribute for a Play===

=== ERROR! this task 'import_playbook' has extra params ===

meh

 

=== /usr/bin/chattr: Clearing extent flag not supported ===

Probably trying to make a backup of a symlink

===Missing sudo password===
set NOPASSWD in sudo config

== Escape curly braces ==

{{ '{' }}

== Check file for string ==

tasks:
- name: grep line
shell: "grep -q swap /etc/fstab"
failed_when: false
register: grepped

- name: show grep
debug:
msg: "exists"
when: grepped.rc == 0

== Error messages ==

=== msg: The PyMySQL (Python 2.7 and Python 3.X) or MySQL-python (Python 2.X) module is required ===

Means you need to install for example python2-PyMySQL on that host

==Ansible-lint messages==
===Commands should not change things if nothing needs doing===
Ignore, or use
changed_when: false
===Shells that use pipes should set the pipefail option===
shell: |
set -o pipefail
some command

=Tips & tricks=
==Includes only when on host group==
- block:
- include: foo.yml
- include: bar.yml
when: "'foobar' in group_names"

== Show info/facts of a host ==

ansible somehost -m setup
ansible somehost -m ansible.builtin.setup

==Show distribution and version==
- name: show some host info
debug:
msg: Dist {{ ansible_distribution }} {{ ansible_distribution_version }}

[[Category:Configuration management]]
[[Category:Ansible]]

Sed

2026-05-26T09:58:12Z

Tony: /* Replace with newline */

'''S'''tream '''E'''ditor

=Links=

=Tutorials=
*[http://www.grymoire.com/Unix/Sed.html Sed - An Introduction and Tutorial by Bruce Barnett]
=HOWTO=
==Back references without escaping parenthesis==
sed 's/foo (bar)/\1/g'

=FAQ=
==+ or *==
===*===
matches 0 or more
===+===
matches 1 or more
==errror messages==
===sed: -e expression #1, char 32: unknown command: `\'===
try
's/...
instead of
'/...
==Replace with newline==
^V^M

==Replace literal \n with actual newline==
sed 's/\\n/\n/g'

==match whitespace==
\s

==replace newline==
try tr instead:
tr -d '\n' < file

==Edit in-place==
sed -i

==match number==
sed 's/.*$[0-9]\+$.*/\1/'
or
sed -r 's/.*([0-9]+).*/\1/'

==Split words==
sed -r 's/([^ ]+) +([^ ]+) +([^ ]+) +([^ ]+) +([^ ]+) +([^ ]+) +([^ ]+).*/\4/g'

Docker

2026-05-25T21:15:32Z

Tony: /* Show disk usage */

=Links=
*[https://www.docker.com/ Homepage]

=Docs=
*[https://docs.docker.com/manuals/ The Docker Manuals]
*[https://docs.docker.com/compose Docker-compose]
*https://www.digitalocean.com/community/tutorials/how-to-install-and-use-docker-on-centos-7
*[https://www.digitalocean.com/community/tutorials/how-to-remove-docker-images-containers-and-volumes Removing images, containers and volumes]
*[https://training.play-with-docker.com/beginner-linux/ Docker for beginners]
*[https://runnable.com/docker/basic-docker-networking Docker networking]
*[https://docs.docker.com/config/pruning/ Docker pruning]
*[https://www.virtualizationhowto.com/2023/11/docker-overlay2-cleanup-5-ways-to-reclaim-disk-space/ Docker Overlay2 Cleanup: 5 Ways to Reclaim Disk Space]

=HOWTO=
==Run container==
docker run <IMAGE ID>
==List running containers==
docker ps

==List containers==
docker ps -a

==Show log==
docker logs <container>
or to follow:
docker logs -f <container>
==Show disk usage==
*https://niklasmtj.de/blog/understand-docker-storage/

docker system df
outputs:
TYPE TOTAL ACTIVE SIZE RECLAIMABLE
Images 27 10 11.35GB 5.72GB (50%)
Containers 12 12 123.6MB 0B (0%)
Local Volumes 0 0 0B 0B
Build Cache 0 0 0B 0B
===RECLAIMABLE===
Is what you get back when running
docker system prune -a

==List images==
docker images

==Remove image==
===docker rm===
removes container
docker ps -a
and then
docker rm <container id>

===docker rmi===
alias for '''docker image rm'''
docker image ls
and then
docker rmi <ID>

==Export image==
docker save <image name> > imagename.tar

==Update image==
docker pull imagename

==Get shell in running container==
To get image name
docker ps
then
docker exec -it <image-id> bash

==Network==
docker network ls
docker network inspect

==image has dependent child images==
docker inspect --format='{{.Id}} {{.Parent}}' $(docker images --filter since=<image_id> -q)
or get [https://github.com/justone/dockviz dockviz] and run
dockviz images --tree -l

==Dangling images==
===list dangling images===
docker images -f dangling=true

===Remove dangling image===
docker rmi image-id
====Errors/warnings====
=====Error response from daemon: conflict: unable to delete 9e82ccb228df (must be forced) - image is being used by stopped container a14fb2b549f1=====
Find the culprit with
docker ps -a
and then
docker rm <id you find>

===Remove all dangling images===
docker rmi $(docker images -f dangling=true -q)

==image is being used by stopped container xyz==
docker rm xyz
and try again

==Backups==
*https://linuxconfig.org/docker-container-backup-and-recovery
*[https://bobcares.com/blog/docker-backup/ Docker - Easy backup & restore]

=FAQ=
==Error messages==
===The container name "/mycontainer" is already in use by container===
It already exists, so use
docker start <container id>
instead of
docker run

OR find the culprit
docker ps -a
and then
docker rm container/name
etc

===ERROR: failed to solve: failed to read dockerfile: open Dockerfile: no such file or directory===
It really wants a file called '''Dockerfile'''

===docker.service: Start request repeated too quickly===
Try
dockerd --debug

===dial unix /var/run/docker.sock: connect: permission denied===
You're not in group '''docker'''

===docker rmi===
Error response from daemon: reference does not exist
See https://www.baeldung.com/linux/docker-image-deletion-problem-fix

===Address already in use===
First try
lsof -i:8080

==Compose==
===unknown shorthand flag: 'd' in -d===
docker-compose is probably a script/wrapper.
Install the https://docs.docker.com/engine/install/debian/

===docker: 'compose' is not a docker command.===
Check https://docs.docker.com/engine/install/debian/

===unknown flag: --detach===
apt install docker-compose-v2

=== image is being used by stopped container===
use the force

==Docker rmi not freeing space==
Correct, you need
docker image prune

Docker

2026-05-25T21:14:50Z

Tony: /* RECLAIMABLE */

=Links=
*[https://www.docker.com/ Homepage]

=Docs=
*[https://docs.docker.com/manuals/ The Docker Manuals]
*[https://docs.docker.com/compose Docker-compose]
*https://www.digitalocean.com/community/tutorials/how-to-install-and-use-docker-on-centos-7
*[https://www.digitalocean.com/community/tutorials/how-to-remove-docker-images-containers-and-volumes Removing images, containers and volumes]
*[https://training.play-with-docker.com/beginner-linux/ Docker for beginners]
*[https://runnable.com/docker/basic-docker-networking Docker networking]
*[https://docs.docker.com/config/pruning/ Docker pruning]
*[https://www.virtualizationhowto.com/2023/11/docker-overlay2-cleanup-5-ways-to-reclaim-disk-space/ Docker Overlay2 Cleanup: 5 Ways to Reclaim Disk Space]

=HOWTO=
==Run container==
docker run <IMAGE ID>
==List running containers==
docker ps

==List containers==
docker ps -a

==Show log==
docker logs <container>
or to follow:
docker logs -f <container>
==Show disk usage==
docker system df
outputs:
TYPE TOTAL ACTIVE SIZE RECLAIMABLE
Images 27 10 11.35GB 5.72GB (50%)
Containers 12 12 123.6MB 0B (0%)
Local Volumes 0 0 0B 0B
Build Cache 0 0 0B 0B
===RECLAIMABLE===
Is what you get back when running
docker system prune -a

==List images==
docker images

==Remove image==
===docker rm===
removes container
docker ps -a
and then
docker rm <container id>

===docker rmi===
alias for '''docker image rm'''
docker image ls
and then
docker rmi <ID>

==Export image==
docker save <image name> > imagename.tar

==Update image==
docker pull imagename

==Get shell in running container==
To get image name
docker ps
then
docker exec -it <image-id> bash

==Network==
docker network ls
docker network inspect

==image has dependent child images==
docker inspect --format='{{.Id}} {{.Parent}}' $(docker images --filter since=<image_id> -q)
or get [https://github.com/justone/dockviz dockviz] and run
dockviz images --tree -l

==Dangling images==
===list dangling images===
docker images -f dangling=true

===Remove dangling image===
docker rmi image-id
====Errors/warnings====
=====Error response from daemon: conflict: unable to delete 9e82ccb228df (must be forced) - image is being used by stopped container a14fb2b549f1=====
Find the culprit with
docker ps -a
and then
docker rm <id you find>

===Remove all dangling images===
docker rmi $(docker images -f dangling=true -q)

==image is being used by stopped container xyz==
docker rm xyz
and try again

==Backups==
*https://linuxconfig.org/docker-container-backup-and-recovery
*[https://bobcares.com/blog/docker-backup/ Docker - Easy backup & restore]

=FAQ=
==Error messages==
===The container name "/mycontainer" is already in use by container===
It already exists, so use
docker start <container id>
instead of
docker run

OR find the culprit
docker ps -a
and then
docker rm container/name
etc

===ERROR: failed to solve: failed to read dockerfile: open Dockerfile: no such file or directory===
It really wants a file called '''Dockerfile'''

===docker.service: Start request repeated too quickly===
Try
dockerd --debug

===dial unix /var/run/docker.sock: connect: permission denied===
You're not in group '''docker'''

===docker rmi===
Error response from daemon: reference does not exist
See https://www.baeldung.com/linux/docker-image-deletion-problem-fix

===Address already in use===
First try
lsof -i:8080

==Compose==
===unknown shorthand flag: 'd' in -d===
docker-compose is probably a script/wrapper.
Install the https://docs.docker.com/engine/install/debian/

===docker: 'compose' is not a docker command.===
Check https://docs.docker.com/engine/install/debian/

===unknown flag: --detach===
apt install docker-compose-v2

=== image is being used by stopped container===
use the force

==Docker rmi not freeing space==
Correct, you need
docker image prune