I was asked today if our monitoring of our Prometheus setup would detect database problems. The directanswer is that it wouldn't (unless Prometheus itself went down); muchlike we do with Alertmanager , all wecheck for is that Prometheus is up. The more complicated answer isthat it seems hard to do this, and one reason is that while Prometheusexposes a number of specific metrics about aspects of its time seriesdatabase, it doesn't have an overall health metric for the TSDB (or forPrometheus

TLS certificates for servers are notnormally signed directly by the Certificate Authority's rootcertificate (for various good reasons); instead, they're signed byan intermediate certificate that chains up to the CA's rootcertificate (in modern usage, there generally is only one intermediatecertificate between the server certificate and the CA's rootcertificate). In theory the server is supposed to send the intermediatecertificate with its own certificate in a certificate chain , but in practice servers don't always send intermediate certificates

Part of Unix shell scripting is that Unix has a number of littlelanguages (and interpreters for them) that are commonly embedded inshell scripts to do various things. Shell scripts aren't just written inthe Bourne shell; they're effectively written in the Bourne shell plusthings like sed and awk, and later more things like Perl (the littlelanguage used by jq may in timebecome routine). However, not all languages become used on Unix thisway, even if they're interpreted and otherwise

Suppose, for reasons to be discussed in a later entry, you wouldlike to write a shell script that turns an embedded here document into a shell variable(ie, an unexported environment variable). As a preview, one reasonto want to do this is that here documents allow almost arbitrarycontents, while other forms of getting things into environmentvariables or command line arguments may block using certain charactersor require awkward quoting.

It turns out that in a modern Bourne shell, this is straightforwardwith command substitution (normally

Following my successful experience with libvirt on my desktop , I decoded to build out a general virtualizationserver for tests, scratch machines, and so on. Unfortunately, theold server I reused for this turned out not to be up to the task , at least notif I wanted it to be attractive . So today Ireinstalled things on a newer, better server and wanted to moveover the entire libvirt setup from the initial machine so that Ididn't have to redo everything. What I needed to copy (

Today I wound up helping someone with a weird and mysterious browserproblem, where they couldn't connect to a particular HTTPS sitewith either Chrome and Microsoft Edge on their up to date Windowsmachine; when they attempted to do so, Chrome (and Edge) reportedthat the TLS certificate was issued by an unknown CertificateAuthority. Firefox on their machine could connect and I could connectwith various browsers (including from Chrome and Microsoft Edge onsome Windows 10 machines I have access to). Given the title of

Over on Twitter I said some things about BMCs with Java-only KVM overIP . One ofthe suggestions was to use serial consoles with Serial over LAN. As ithappens, I have very mixed feelings about this and I don't think it'sattractive to us (although we do have serial consoles and a serialconsole server ). The problem is that almost allof what we want to use KVM over IP for is very low level, and I don'tthink this low level stuff will

Sometimes I wind up in a situation, such as using smartctl's JSONoutput , where I want to use aPython program to process and transform the output from anotherUnix command. In a situation like this, there are two ways ofstructuring things. I can have the Python program run the othercommand as a subprocess, capture its output, and process it, or Ican have a surrounding script run the other command and pipe itsoutput to the Python program, with the Python program acting as a(

One of the things that people say sometimes (including about servingstatic files on the web) is that "the filesystem is an API". On asuperficial level this sounds fine. The abstracted form of afilesystem hierarchy is a common interface between programs, onethat you can write code to use; you can create files and directories,inspect the hierarchy, read data that has been put in there, anddelete things again (if you have permissions).

However, I've come to feel that the