markofu’s blog

I became a little tired manually downloading pcaps from the various, freely available resources on the net so I added a repo to my very basic github repo so that I could simply `git clone` from wherever I am - assuming decent bandwidth and Github don't get to pissed at storing pcaps - as it's only 1.1gb at present, I doubt they will (/me hoping :) ). I'm not really sure what I plan to do with this repo, I guess I'll extend it and add more as I get around to it. My sole goal at the minute is to use the awesome functionality of Github to manage and modify the content, as well as making it easier for me to remember where the pcaps are ;-)

In my last post , I showed how you can set up MongoDB v2.2 to syslog its logs off to a remote syslog server. As my `tcpdump` snippets show, the syslog messages hit the syslog server tagged as "user.info", which means that they're assigned to the "user" facility with a severity level of "info". I've received a few questions regarding the possiblity of splitting out syslog messages by facility, however, as everything is currently sent to a "user.info" bucket, so-to-speak, this is not possibility. There is a current feature request for this capability and work will be done on this but if this is important for you, I'd strongly encourage you to vote for this feature. In the meantime, however, (whilst not ideal) you can still do some host filtering with rsyslog as outlined here .

As per the MongoDB 2.2 release notes , log output for MongoDB can now be redirected to a remote syslog server. Here is an example configuration. MongoDB Instance MongoDB is started as follows (note the extra `syslog` switch): $ mongod --dbpath=/data/db/syslog --fork --syslog The local "/etc/syslog.conf" file (i.e. on the `mongod` instance) is configured to send everything to the syslog server (10.7.100.20): @10.7.100.20:514 Syslog Server I ran my Syslog server on Ubuntu 12.04. There are a tonne of links out there describing how to install syslog on Ubuntu - see here . The syslog "facilities" are configured in the server's `/etc/syslog.conf` file (I left this as default): ################################################################################# # # First some standard logfiles.  Log by facility. # auth,authpriv.*            /var/log/auth.log *.*;auth,authpriv.none        -/var/lo...

So if you're unlucky enough to follow me on Twitter, you'll have seen that I had a conundrum with my presentation at IrissCon :) After a little work yesterday morning, during IrissCon, I tweaked the presentation and reduced the number of slides and successfully tested my "Security Onion in EC2" demo over the hotel wifi. I even managed to show a few others what I was going to do and received good feedback :) To add to my preparation, during lunch I hooked up my laptop to the main screen in the conference and everything looked sweet, even the "live" demo ( @BrianHonan took some nice pictures also). I was so relaxed this year in comparison to previous years (I only had a 30 minute talk to do, right). Looking at Jason and the Honeyn3t lads (organisers of the CTF this year) , I recognised the bloodshot eyes and I could see the amount of stunning work that they had done (the world map of domination was simply awesome).  My relaxation was commented upon...

So last night I spoke at the Dublin Google Development Group , which is held in the Google Offices in Barrow Street . For all the times I've passed those offices, either by foot or train, I've never actually been in there and usually looked enviously upon their facilities (I believe they've now got a 25m pool, which for me would be, well, awesome). I was invited by Eoin Bailey (from Trinity), who up until last night (I believe), has been running the group and interestingly, the "head" of the group cannot be a Google employee. Apart from the slick, professional set-up there's also food and non-alcoholic drinks beforehand with a potential retirement to the Schoolhouse afterwards. The facilities were obviously excellent, sweet theatre ("What's up Doc" was the name I believe) with excellent seating, screens etc as you'd expect. The group were seemed interested in my talk but I think I lost most folk when I began talking about sharding, possib...

So back in July, I wrote a blog post talking about my experiences being a so-called "phone jockey", i.e. a support engineer, for 10gen. For those cynics out there, it wasn't written by HR, modified by marketing or requested by management or anyone in our recruiting team - I wrote it off my own back because I've a tendency to do things off my own back I wanted to explain what being a "support engineer" actually meant and more specifically, what it entailed in a small, innovative, fun company like 10gen I now have somewhere to point people too when they ask my what life as a "support engineer" in 10gen is like to get kudos within 10gen and please management When I wrote the blog post, I intended it to be a once-off (why would anyone agree to writing a multi-part blog series) but I was encouraged to at least write a second post by @francium and she's very cool so I let it slide and agreed!!! One of the ideas that I had was talking ...

Sharding, eh? There's so many questions on a daily basis about sharding - What is sharding? How do I do shard? When do I do shard? How do I know I need to shard? How many shards do I need? What shard key should I use? Can I change my shard key? What's a hotspot? How many shards do I need? Do I have a replica set within a shard? etc  and everyone is unique with a different use-case so the answer isn't always the same. Here's the official documents page (on sharding) and Kristina's blog , which is simply excellent on so many levels - I recommend reading both links (btw, it'll take a while :). Kristina uses some awesome analogies to explain sharding. This blog post isn't about the technicalities of sharding, there are much more intelligent people than me who can explain that. I wrote a simple script to learn a bit more sharding and for reproducing issues and I thought I'd share it. It's written in bash beca...