I wrote yesterday about the ways our fileserver environment hasmulti-tenancy . In the aftermath of that,one entirely reasonable question to ask is whether the multi-tenancyactually matters, ie whether we notice effects from it. Unfortunatelythe answer is unquestionably yes. While we have much more experiencein our old fileserver environment and some reason to hope that not all of it transfers to our newfileservers , essentially all levels ofthe multi-tenancy have caused us heartburn in the past.

The obvious direct way that multi-

One of the things that people worry about and often considera bad idea when designing systems is multi-tenancy , where one resource servesmultiple people (or, well, upstream things). The problems inherent withmulti-tenancy are well known to people who use public clouds, namelythat other people's activity (often other people's invisible activity)can adversely impact you. We have a number of levels of multi-tenancyin our fileserver environment andtoday I feel like enumerating them.

(All of

Looking back, it's been almost four years since I startedwriting our first and so far only Django web application , a system for automating much of our newUnix account requests. Since retrospectives are relatively uncommon , today I want to do one for whathas been a really faithful web app.

I suppose that's a good summary of the whole situation: after I wroteit, the application has been trouble-free. Over the years I've done afew tuneups to make it a bit more

There is somewhat of a meme around the sysadmin and web world thatApache is a bad web server that no one should use, or at least not usefor very long. And if you're using Apache or thinking about configuringsomething with Apache, maybe you should think about how to migrate awayor pick a setup that will make that easy. I once sort of felt this wayand experimented with (and still use) alternatives like lighttpd, butI no longer do so; these days I think that Apache

Normally, my sinkhole spam-capturing SMTP server is set up so that it rejects as much as possible of what I consider boring spam . The other day I decided to run itcompletely unfiltered for a while, accepting everything no matter howobviously bad it was or whether it was going to an address that hadever existed. Already something interesting to me has turned up in theresults.

In statistics drawn from our production mail system, I've previouslynoticed that viruses in email are way, waydown. Much

This is a deeper look into how I have my office workstation configuredwith ZFS On Linux for all of my user data ,because I figure that this may be of interest for people.

My office workstation's primary disks are a pair of 1 TB SATA drives.Each drive is partitioned identically into five partitions. The firstfour of those partitions (well, pairs of those partitions) are usedfor software RAID mirrors for swap, / , /boot , and a backup copyof / that I use when I

Back when I started reading about DNSSec, it seemed to be popular toassume that how DNSSec would work for clients is that if a particularDNS lookup failed DNSSec checks, the DNS resolver would tell youthat the name couldn't be resolved. In light of my personal DNSSecexperience and the general security falsepositives problem , I no longer accept this asworkable approach.

The reality of the world is that there are almost certainly going to betwo common reasons for DNSSec failures, namely DNSSec screwups by theorigin domain

When I moved my data to ZFS on Linux on my office workstation , I didn't move the entire system to ZoL forvarious reasons. My old setup was having my data on ext4 in LVM ona software RAID mirror, but having the root filesystem and swap inseparate software RAID mirrors outside of LVM. When I moved to ZoL,I converted the ext4 in LVM on MD portion to a ZFS pool with thevarious data filesystems (my home directory, virtual machine images,and so on)

A while back I wrote an entry about the temptation to switch my officeworkstation to having my data in ZFS on Linux .Not that long after I wrote the entry, in early August according to' zpool history ', I gave in to the temptation and did just that. I'vebeen running with everything except the root filesystem and swap in aZoL pool ever since, and the short summary is everything has workedsmoothly .

(Because I'm crazy, I did some wrestling with systemd and bind mounts