Albert White's Weblog

This question came up on the solarisx86 yahoogroup recently:

What about a patch for a large package, say the video drivers. Might some files patched in an earlier release not have needed further patching and thus have been skipped over by applying the most current release?

So if you apply say rev-03 of a patch are you getting all the fixes from -01 and -02 also?

The answer is yes. All patch revisions are cumulative so the files and fixes from previous revisions will be in the latest revision.

This also holds for accumulated/obsoleted patches. If a patch obsoletes another patch it will then contain all the files that the obsoleted patch contains. Not only that but if there are any scripts that need to be ran the obsoleting patch will have to merge in these scripts.

This was actually the source of a lot of problems for the latest s10 KU patch,  118833-36. It had accumulated so much change from other patches that it was almost impossible to get it to install. Many of the patches that comprised the KU were easy enough (relatively!) to install on their own, but once they all accumulated into the KU it became much harder to get the patch to work. A Quick glance at the readme of KU-36 will give you an idea of the complexity involved. There are good reasons why all these other patches get accumulated into the KU and they most boil down to interdependencies - a zones patch for example will need the KU but changes in the KU will only work if the zones patch is installed also - so if you use zones you need to merge the patches. We are working on ways to ensure that adding a patch like 118833/55-36 will not be so painful for customers in future!

This situation became rather silly in Solaris 8 when we had a situation where almost everything was included in the KU. When your Kernel Update patch starts patching apache you know things are going out of control. At that point we decided to split the KU back up again in a process called rejuvenation.

With rejuvenation the KU is effectively split into smaller patches again, but each requires the previous KU. The new patches have new patchid's. So you will have to install the latest KU, but subsequent KU's will have different patchid's and require that the old KU be running on the system. The catch is that it is not possible to ever uprev the old KU since we would risk overwriting files delivered in the rejuvenated patches.

The following press release has just been issued by Shamrock Rovers F.C. It touches on some of the points I made in my last post, and its good to see the club officially responding to allegations made recently by some journalists.

Shamrock Rovers and the Tallaght Community Stadium

For all press related matters please contact Shamrock Rovers Press Officer John Byrne
by mobile on 087-768-1408 or by emailing
johnbyrne@shamrockrovers.ie.

Dino has created an Irish Geocoin!

Preorders are currently (until Saturday!) being taken at  http://geocoins.croaghan.com/
This is the first official Irish Geocoin and probably will not be re-minted so get your orders in!

Last Friday Thomas Davis GAA (Gaelic Athletic Association) club took South Dublin County Council to the high court to see a judicial review of the Tallaght Stadium. Their argument is on a legal point of process, but the core of the matter is that the GAA club want the stadium redesigned to accommodate a full size GAA pitch. The matter has been discussed at length elsewhere but it simply boils down to the fact that a full sized GAA pitch does not fit and so the stadium should be completed with the current dimensions. A rectangle 150m X 90m cannot fit into a rectangle 100m X 70m! Redesigning would involve demolishing at least part of the existing stand, reducing the capacity, and cost a lot more. The government has indicated that it will only fund the current, soccer sized, design.

With the matter now before the courts some GAA journalists have gone off with blinkers on while writing about this. The best example so far came from Tom Humphries in the Irish Times.

Firstly he mentions the project as a "soccer only stadium". Martin Breheny in the Indo continues this view  saying that the stadium is for the "exclusive use of a commercial soccer concern". That's incorrect. The current plan is for a stadium that contains a pitch with soccer dimensions primarily to be used a soccer stadium. The minister of sport stated earlier in the year that the county council who have control of the stadium would be able to play other games provided they fit. This means that kids GAA games and rugby games would be accommodated as these games fit into a soccer pitch. Thomas Davis have said that they want to use the Stadium, not for themselves, but to bring inter-county games to the area. It seems more likely that they want the stadium for GAA exclusively and to remove Shamrock Rovers from the picture: "I'm confident that in any bout with Rovers that the GAA will be the last man standing," wrote David Kennedy of Thomas Davis last year in an email seen by the Irish Independent.

Humpries also goes on to paint a picture of Shamrock Rovers as an evil capitalist corporation compared to the poor benevolent volunteer GAA clubs. This is a silly distinction. Sports clubs all across the country have volunteers working for them, right the way from junior teams up to the main senior team. Shamrock Rovers have I believe 38 managers and coaches for their youth teams (over 200 players from under 7's up); all these junior sides already are based in Tallaght. The club is also ran by volunteers on a day to day basis and on matchdays. In fact Shamrock Rovers is democratically ran by its members who appoint the board of directors. No person owns Shamrock Rovers, the supporters do.

One distinction regarding professionalism is relevant however. Shamrock Rovers pays its senior team. The players are on contracts and are given salaries (with the correct tax paid to the government!). The GAA however does not pay its players, this fits with the admirable amateur ethos of the organisation, however they recently have had a campaign to try to get the government to pay their players with tax payers money!

Speaking of money, Humphries, and a couple of other GAA sources over the last week have alleged that the government paid 19 million euro towards the construction of Croke park, the superb stadium that the GAA own in Dublin. The correct figure as verified by the Department of sport was 114 million. In fact since 1998 the GAA has received 285 million in government grants. This apparently is not enough for them hence the current campaign in the media against the Minister of Sport.

Keen sports fans will know that the recent rugby matches in Ireland and the upcoming soccer match against Wales are to be played in Croke Park. This is part of a monumental decision by the GAA to set aside "Rule 42" for Croke park for these games. Rule 42 basically states that foreign sports are not allowed to be played on GAA grounds. In practice this means soccer and rugby. It does not include American Football (Notra Dame played Navy in the 1980's in Croke Park) or compromise Australian rules football which have been played in Croke park in the past. It suits the GAA to revise this rule at the moment since it brings in large amounts of cash from the soccer and rugby matches. Press reports indicate that the GAA receive in the order of 1 million euro per match from the IRFU (Irish Rugby Football Union) and FAI (Football Association of Ireland). Other grounds around the country cannot avail of this since it takes a national meeting of the GAA to make exceptions to this rule. But it seems that most clubs and counties don't want to have their grounds opened up anyway. And so the exclusion to soccer and rugby continues unless there is a lot of money to be made. Its all the more staggering that Thomas Davis could lodge their affidavit with a straight face stating that they should have access to a soccer stadium while soccer is banned  from GAA stadiums!

I expect Rule 42 will fade away as the GAA catches up with modern times, with the ban lifted the local club or county could then make the decision on whether to rent a ground or not. If a GAA club can raise funds by hosting a rugby match then it seems bad business reasoning to forbid them doing so.

An earlier version of Rule 42 banned GAA members playing foreign sports or even attending such sports as spectators, this fell by the wayside in the early 1970's. Rule 21, which is now gone, banned members of the British security & police forces playing GAA. The Police Service of Northern Ireland now field a GAA team. Rules change.

But back to Tallaght. Let me paint a picture for you.

Thomas Davis currently have excellent facilities that they use for their own purposes. The GAA have a 24 acre site just down the road in Rathcoole where they plan to build a new stadium which the Minister has offered to help fund. This would be their prime stadium on the Southside of the city; it would also be an exclusivly GAA stadium with soccer and rugby banned under the GAA's Rule 42. Tallaght Stadium gets built with the dimensions of a soccer pitch, with a 6,000 seated capacity and the facilities you expect in a modern stadium. This would be the home for a couple of soccer teams but as it is owned by the council would be available for all sports what can fit into it, including junior GAA games. All sports get very good facilities and the people of the area get Stadiums to be proud of.

That picture looks good to me but the GAA (Grab All Association?) want everything for themselves, hence the High Court Action.

The honourable thing to do at this late stage would be for Thomas Davis to withdraw their judicial review application and instead of spending the clubs money on legal costs to focus on building the stadium in Rathcoole. Unfortunately I don't think such goodwill and respect for other sports exists in Thomas Davis so we will have to stay on the legal route. Hopefully the judge will reach what I feel is the correct decision and help change my picture for sport in the area into reality. If the decision goes the other way, the half built Tallaght Stadium will remain derelict while Thomas Davis drag out a protracted legal battle leaving their club a lot poorer and the people of the area with a derelict eyesore instead of a stadium to be proud of.

Live Upgrade is a technology in Solaris that allows you to easily upgrade a system while not risking change to your running environment. You can easily revert back to your previous environment if you need to. BigAdmin has a great guide on setting up Live Upgrade.

I've mentioned before about the problems of patching live systems. With the latest Solaris 10 KU for example most of the effort went into crafting the patch scripts so that the patch could be applied to a running system. When you patch a live system for example you have to take care about replacing libraries so that the commands you are delivery and the ones on the running system will continue to work, 118833-36 does some clever loopback mounting of libraries for this. With Live Upgrade this problem goes away.

Thats why patch testers and developers like LU. For users the benefits are that patching is easier - you don't have to be in single user mode. Its safer - you can instantly return to your previous environment. And its quicker - the system can be patched while running and your downtime is just the time it takes to reboot to the new environment.

So how do you do it?

Set up an alternate boot environment.
For
this you need to have some space allocated for the boot environment
(BE), obviously it needs to be big enough to store the OS! lucreate(1M) is used to create our BE.

# lucreate -c "Current_BE" -m /:/dev/dsk/c0t0d0s1:ufs -n "New_BE"

This names our current BE "Current_BE" and the BE we want to create as
"New_BE". The root filesystem is installed on /dev/dsk/c0t0d0s1 that
will be the root filesystem of the New_BE. The Bigadmin LU guide explains more detailed options for lucreate.

Now to patching!

We use the luupgrade(1M) command to do patching. The simplest way to add a patch to our New_BE is to do:

# luupgrade -t -n "New_BE" -s /path/to/patch patchid

The -s argument indicating the patch directory is required. Adding multiple
patches is easy too. If you want to add all the patches in a directory
you can just do:

# luupgrade -t -n "New_BE" -s /path/to/patch *

luupgrade does allow you to use an order file, but since the patches
will be ordered automatically in Solaris 10 this is redundant. For
older OS's you could do this s recommended by Big Admin:

# luupgrade -t -n "New_BE" -s /path/to/patch -O  "-M /path/to/patch patch_order"

The -O option arguments are passed directly to patchadd. To remove patches we use the -T option:

# luupgrade -T -n "New_BE" patchid

Under the Hood

luupgrade re really just mounting the alternate BE, New_BE in our case, and then calling patchadd -R <mountpoint> to install the patches.

The -R argument causes, in the simplest cases, causes reloc directory from each package in the patch to be copied to /<mountpoint> rather than /.

In patch scripts the value of the -R argument is stored as $ROOTDIR, it is / is -R is not specified. So if you want your patch to say update an editable file you operate on ${ROOTDIR}/etc/file. Its good practice to prefix all filenames with ${ROOTDIR}.  Also if you are only interested in changing the running system, for example stopping and starting a service you need to check that $ROOTDIR is / before performing any operation.

At the package level the mount point is exported as $BASEDIR and $PKG_INSTALL_ROOT to the package level scripts. Similarly all paths in these scripts should be prefixed with $BASEDIR or $PKG_INSTALL_ROOT.

A wile ago some of our test suites were failing due to erroneous requests to port 80 on the test machines. The simplest thing to do was to just block requests to anything other than our webserver in the lab using ipfilter.

 pass in quick on bge2 proto tcp from any to <webserver IP> port = 80
 block in quick on bge2 from any to any port = 80

bge2 is our external interface.

The bit I got stuck on was logging any attempts. ipfilter allows you to log against any rule. When using syslog the default facility is local0 and the default levels are

LOG_INFO

Packets logged using the log keyword as the action rather than pass or block.

LOG_NOTICE

Packets logged that are also passed.

LOG_WARNING

Packets logged that are also blocked.

LOG_ERR

Packets that have been logged and that can be considered “short”.

You can alter these defaults in the rule for example as:

block in log level auth.info quick on bge2 from any to any port = 80

but the defaults are fine for me so we just use:

block in log quick on bge2 from any to any port = 80

Turning on logging will cause ipfilter to log to  /dev/ipl. You can use ipmon(1M) to monitor this, or use it to log to syslog via 'ipmon -Ds'.

 If you use syslog you need to define where the log should go as not everything automatically goes into /var/log/syslog. You need to add a line like this into /etc/syslog.conf:

local0.debug                                    /var/log/ipflog

You cannot say 'local.*' in syslog.conf, * only is valid for facilities. If you try you'll get an error of 'unknown priority name "*"'. You also cannot use spaces you must use tabs, otherwise you'll get an error like 'unknown priority name "debug /var/log/ipflog"'. Once this is defined correctly, touch /var/log/ipflog and restart syslog. You should then see connection attempts logged to this file. Since we are using the default logging above for our block rule they will be logged as local0.warning. The tabs and the * had me stuck for a while so hopefully this post will save someone else from some head scratching.

Recently I bought a 5 million candle power torch for photography. The intention was to use it to 'paint' nighttime photos. However today I thought I'd try it out to light a boquet of flowers.

	This shot was taken of a single rose in a pint glass. In order to get the dark background you just need to have a distant background and ensure that the torch is only lighting the target. The brighter the target is the darker the background will be. 109mm lens at f/11 to get some depth of field on the flower. A shutter speed of 1/10s is enough to show the flower well lit with the bright torch but not enough to being out any features in the background.
Leaves have a very detailed structure that is easily missed when photographing them when they are lit from the same direction as the camera. To bring out the detail this leaf was lit from behind. 41mm f/14 1/6s. This is a detail from a larger photo, but as you can see the depth of field (even at f/14) wasn't enough to show the whole leaf in focus. I didn't throw the background into darkness this time, the background is just a white t-shirt!
	I used a slightly differn't approach on this more usual shot. Most of the light in this shot is natural light from a nearby window. Just the tip of the flower was lit by the torch. A couple of birthday cards placed in front of the torch helped block bright light hitting the leaf. 3/10s f/11 50mm.

Some of the regulars from geocachingireland.com were featured doing what they do best on RTE's Nationwide TV Programme tonight. The 7 minute clip from the programme is on the Nationwide website.

When I did an interview for my current job in Sun I was asked what I didn't like about the company. Having been the sysadmin for some machines in college I hated Suns security patching policy. A vulnerability would be posted to bugtraq and the students would soon start trying to exploit the vulnerability. Some source code patch would come out for other OS's but the best you would get from Sun was a workaround. Eventually, often weeks/months later, a patch would come out.

A couple of years back we came up with IDR's. The initial idea was to provide a way for engineers to deliver diagnostic binaries to customers to help solve their issues in a way that would be recorded on the system. Rather than giving the customer a tarball the customer could now get a 'patch'. IDR's show up in 'patchadd -p' and also block any patches from being installed on top of them. It was quickly realised that this method solved the problem of getting quick security fixes out to customers.

On Sunday a telnet vulnerability came up on opensolaris-discus. Alan and Dan  have described a bit about how the issue was fixed. The code in opensolaris was fixed within hours and posted to opensolaris-discus. By this-morning Irish time patches for Solaris 10 were submitted and ready for testing and soon afterward were pushed to the team responsible for getting them onto sunsolve. The patches are now available - 12006[89]-02.

Two things have struck me from this experience:

1) Opensolaris. Someone posted the vulnerability and a Sun engineer was online and acted on it. Having the discoverer contact Sun privately would have been preferred I guess. But once the vulnerability was out there opensolaris was ready to fix it!

2) Sun has got a hell of a lot better at patching security vulnerabilities. It's gone from the months that I remember to 48 hours for a fully tested and supported patch. And there are probably places where a couple more hours could have been shaved off. Congrats to all involved.

ok 3 things.

3) stop using telnet. Use ssh. Then run 'netservices limited' ! :-)

Last night Shamrock Rovers were presented with the eircom League 1st Division title after the last match of the season in Cobh.

The calm before the storm in a Cobh pub:

The Hoops goalkeeper with the trophy. 

Ultras adding to the celebrations! 

After the 5-2 drubbing of the Republic of Ireland by Cyprus the team needed to get something out of the game against the Czech Republic. They did, it finished 1-1.

In typical Irish football fan style gone were the calls for resignations to be replaced by the Ole Ole brigade acting like we had actually won something. Such is the fickleness of Irish football fans, a little wallpaper of the gaping cracks and they are all happily on the bandwagon again. Pathetic really but most Irish football fans deserve no better than to see their national team in the sorry state it is now.

In the 'glory days' when we actually qualified for championships the team was made up of players who played in the leading teams in the English Premiership. They were the first choice players for their teams. Now the best experienced players on the team are Duff and Robbie Keane. Duff plays regularly for Newcastle, 13th in the English Premiership. Keane irregularly plays for Spurs who are 14th. Big contrast to 16 years ago.

So what happened. Well clearly the Irish players are not good enough to play for the top English Premiership teams anymore. As the English game has gone more global clubs are just as likely to look to south America as Ireland for players.

Why is that a problem? Because the accepted approach to developing football talent in this country is to find the best kids and ship them off at 16 to some English club and hope they do well. That is the fundamental basis of Irish football at a national level. Well that and trying to find some player who granny visited Dublin once which makes them Oirish.

Most of the Ole Ole Brigade don't see anything wrong with this. But then again they don't see any issue with following English clubs and spending their money watching English football rather than Irish football, and then complain about Irish football. They will happily jump on the nearest bandwagon that's passing, a few years ago Manchester United jerseys were all the rage in Dublin, then we had Blackburn for a while, Chelsea jerseys even appeared!  And now just to prove my point we see Sunderland jerseys!

Strangely enough when it comes to the world cup the same people will support anyone except England, even though every weekend they support English teams and not Irish ones. There are several levels of hypocrisy involved here.

The best way to improve the chances of the Irish national team is to develop talent at home. At the moment we have no youth academies, so no wonder any promising young players are sent to England at an early age.

The Irish media is obsessed with the English game giving little or no coverage to the Irish teams. The Football Association of Ireland seems to care little about Irish teams either. And when the government decides to fund a purpose build soccer stadium in an area of Dublin (Tallaght) that could do with any facilities it can get, the GAA (through Thomas Davis GAA club) objects to try to stop it getting built. That issue is to be decided in the High Court in November; if sense prevails the Thomas Davis objection will be dismissed and the ground that is now lying derelict can be completed - the council have the money, the only holdup is Thomas Davis GAA club. Oh and the Irish would much rather sit in a pub with a Sunderland jersey and call themselves football fans rather than going down the road to watch their local team.

Until attitudes change we don't deserve any better from the National team than we are getting at present.

Great night [match report]. The team scoring in the last minute of the first half in match that wasn't going your way is great. That the scorer was the same person who managed to send a last minute oppertunity out of the stadium on Friday made it even better. Poetic even! Second half Bohs got a penalty, which their experienced player/manager stepped up to take against a 20 year old Barry Murphy. And he saved it! Pandemonium. What seems like a few hours later Cassidy scored a second for Rovers and soon it was all over. Pandemonium again! The enemy was defeated. More pandemonium!

It's not worth trying to put the emotions that you feel in these games into words.

Other highlights:

The Hoops manager after complaining to the 4th official (presumably letting him know, correctly, that the linesman and referee were, in fact, idiots) was sent off. He marched up into the stand with the Bohs fans and took a seat there to watch the rest of the match from :-)  Class!

Seeing Bohs fans make comments online like "Well tonight we got what we all knew was coming, probably the worst result in 23 years of following Bohs. Losing to a first division, part time Rovers team at home." Glad to oblige! ;-)  Thats part of why this victory os one of the sweetest. 12 months ago the club was facing extinction and being wound up by the courts. Now the club is building back up again, and owned by the fans. The Thomas Davis GAA club are still trying to stop our new ground, the Tallaght Stadium, from being completed. And we got relegated, thanks partly to examinership, into the first division for the first time in our history. And we still manage to knock Bohs out of the Cup!

Replay in Dalymount park on Tuesday

Tonight the Hoops take on their old advisaries Bohemians in the third Round of the FAI Cup. Rovers are top of the first division, Bohs are a boring mid table in the premier.

Only one of the Hoops players has had any experience of this fixture before; the one who has had this to say
"I've been telling the lads they won't experience another game like this in their careers".

On paper Bohs should win it. And thats mildly worrying; as one hoop put it on the Ultras forum "I always look forward to these games as I would a Ryanair flight, you
just don't know how it will go but there's a good chance of something
dreadful happening". SIX of the rovers team are cup tied and are ineligible to play.

Still, Rovers are the undisputed kings of Irish Soccer having won the FAI cup a record 24 times and the League title 15 times. And given the enemy tonight the players will be giving it 200% from the start. Progressing in the Cup would be great; beating Bohs would be brilliant; and beating them as the underdogs all the better! Expect the atmosphere to be electric as Rovers manager Pat Scully points out
"The fact that it’s the only time the clubs will meet this season means that the fans will be even more wound up than usual".

This game has no neutrals - but tickets will be on sale at the ground for those who want to support Rovers.

Bring on the Boez! Forza Hoops!

The Patch System Test lab, like many other labs, has a mixture of different machines, some with different means of connecting up the serial console to them. The older Sun boxes have 25 pin connectors, some others have 9 pin serial connectors, and newer machines have RJ45 connectors. For the most part people will use some sort of terminal server for getting the consoles on these machines. To get the console you basically need to telnet to a port on the device and ensure that it is correctly wired to the host. A map of  server:port to host can be maintained so users know how to get to the host without needing to bother about the connection it uses.

Then along come domains on 4800's, network management ports, and system controllers etc. Now in order for users to get access to a hosts console they need to know what type of machine it is and connect appropriately.

A couple of years ago I installed conserver to replace several scripts that we had previously. Using this people can issue one command to get a console on a machine and not need to worry about the kind of machine it is. Granted if they connect to say an X4200 they will still need to know how to use it's SC, but they don't need to know how they are supposed to connect to it.

The conserver service runs on a regular machine. It has a configuration file that tells it how to connect to the hosts, more on that later. When the service starts it connects to all of the hosts in the configuration file. A user who starts the conserver client program is then connected to the host they require through the conserver service. The client program in our lab resides on the server, but I run it from my desktop and connect to the service host in the lab.

Aside from the benefits I've already mentioned there are a couple of other useful features.

You can 'view' a console. Multiple people can have the same console open at a time, but only one is attached in write mode. This is useful for keeping an eye on machines and also as a training aid.

Conserver also logs all serial traffic so you can see why a machine crashed for example.

That should be enough to convince you that this software is worth looking at, so lets look at the implementation.

Installing conserver is a fairly straightforward './configure;make;make install'.

The tricky bits, and they aren't that tricky, come with configuration.

Firstly you'll need to add

           console      782/tcp    conserver    # console server

bearass(5.9)$ head /export/PST/etc/conserver.passwd
albertw:
john:

### set up global access
default full    { rw *; }

# Default Settings
default * {        
	# The '&' character is substituted with the console name        
	logfile /var/consoles/&;        
	# timestamps every hour with activity and break logging        
	timestamp 1hab;        
	# include the 'full' default        
	include full;        
	# master server is localhost        
	master localhost;
}

# Basic Settings for the perle CS9000's
default perle {        
	type host;        
	baud 9600;        
	parity none;        
	portbase 10000;        
	portinc 1;
}

# Basic Settings for MRV console boxes
default mrv {        
	type host;        
	baud 9600;        
	parity none;        
	portbase 2000;        
	portinc 100;
}

default pst-console-03 {include mrv; host pst-console-03;}
default pst-console-04 {include perle; host pst-console-04;}

console beetle.ireland.sun.com { include pst-console-03; port 3;}
console cocaine.ireland.sun.com { include pst-console-04; port 4; }

console patchtest-x4200-4 { type exec;  exec /bin/ssh patchtest-x4200-4-sp -l root; }