Some notes on using the logcli program to query Grafana Loki
One of the pieces of Grafana Loki ,sometimes misleadingly described as 'Prometheus for logs' , is logcli , an all purposecommand line program for querying Loki in various ways. Some ofwhat it can do is mostly of interest to Loki administrators, butit has two major sub-commands for making LogQL queries for either logs or metrics .I recently wrote a script that dealt with logcli and in the process I learnedsome things I want to write down for future use, although by thetime I use them Loki
I recently used Grafana Loki for fast, flexible log searching
One of the ways our environment is different from usual ones is that we have a bunch of differentsystems and services that lots of people log in to. We have a longstanding central syslog server that collectssyslog logs from all of our Linux servers, and one of the thingswe've long used it for is to search for all of the recent loginsacross our environment for a particular person. We don't do thisall that often but we do it often enough that we have a script forit
A possible path to reliable name constraints on internal TLS CAs
A while back I wrote an entry about TLS CA root certificate nameconstraints for internal Certificate Authorities . One of the traditional problemswith your own TLS CA is that this CA can be used to sign any name,even names you don't want to sign. A name constraint would limitthat, but traditionally these weren't widely supported, especiallyon TLS CA root certificates. Then I read Michal Jirků's Runningone's own root Certificate Authority in 2023 and had a realization about
Mapping out my understanding of (web-based) single sign-on systems
Suppose, not entirely hypothetically, that you want to use somesystems (perhaps external systems) that wants you to have a 'singlesign on' (SSO) system that it can use to authenticate you and yourusers. There are a number of good reasons for both sides to wantthis; you get better control and the outside system gets to outsourceall of the hassles of managing authentication to you. To create thisSSO setup, there are a number of pieces, and here is how I currentlyunderstand them
Understanding another piece of per-cgroup memory usage accounting
A while back I wrote a program I call 'memdu' to report a du-likehierarchical summary of how much memory is being used by each loggedin user and each system service, based on systemd's MemoryAccounting setting and the general Linux cgroup (v2) memory accounting .Cgroups expose a number of pieces of information about this, startingwith memory.current , the current amount of memory 'being used by'the cgroup and its descendants. What being used by means here isthat the kernel has
Doing work that scales requires being able to scale your work
Several years ago I read Tobias Bernard's Doing Things That Scale .To summarize the article badly, Tobias Bernard talked about howthey had moved away from customizing things (and then having tomaintain the customizations) in favour of doing generally usefulchanges to upstreams. I have various feelings about this as a generalprinciple (and comments on my entry on thinking about the sensiblelimits of customization gave me more things to think about), but one of the thoughts thatfirmed up is that you can only do work that
Getting some information about the Linux kernel dentry cache (dcache)
The Linux kernel's dcache subsystem is its implementation of a name cache of directory entries ;it holds dentries . As a (kernel) cache, it would be nice to knowsome information about this cache and how effective it was beingfor your worklog. Unfortunately the current pickings appear to beslim.
Basic information about the size of the dcache is exposed in /proc/sys/fs/dentry-state .This reports the total number of dentries, how many are 'unused',and how many are
A bit more trivia on the Unix V6 shell and its control flow
Over on the Fediverse, I posted about how the V6 ' goto ' and' exit ' worked , and got a good question inresponse , namelyhow did ' goto ' and ' exit ' get hold of the file descriptor forthe script that the V6 shell was executing. The answer turns outto be that the V6 shell always read from standard input (fd 0) . If it wasrunning a script, it arranged to open the script with file descriptor0 (standard input), which
Why Unix kernels have grown caches for directory entries ('name caches')
An interesting feature of modern Unix kernels is that they generallyknow the names of things like current directories and open files.Traditionally the only thing Unix knew about open files, currentdirectories, active memory mapped files, and so on was their inode(as an in-kernel data structure, including pointers to the inode'smount point and so on). However, some time back various Unixes addedin kernel caches of directory entry names and associated data (inLinux these are dentries and the dcache; in FreeBSD
The Unix V6 shell and how control flow worked in it
On Unix, ' test ' and ' [ ' are two names for ( almost ) the same program and shellbuiltin. Although today people mostly use it under its '[' name,when it was introduced in V7 along side the Bourne shell, it onlywas called ' test ' ; the '[' name was onlynascent until years later. I don't know for sure why it was called' test ', but there are interesting hints about its potential genesisin the shell used in V