Fun with Clonezilla

I had to resize my hard drive.

I used clonezilla to back up the partitions to an external USB Hard Drive. (Partition mode, not disk mode).

I then replaced the hard drive with a factory new one.

Clonezilla would not restore to the factory drive without partitions.

I used cfdisk to make partitions like the original hard drive (bigger, of course).

I restored clonezilla partitions to the new hard drive.

Windows didn't see the whole NTFS partition (dir said it was the same as the original. That's not what I wanted!). (Disk Management, yes, dir no).

I downloaded Easeus Partition Manager and SLIGHTLY decreased the partition (by about 10 MB). The large partition didn't miss the difference, but the entire space was now available when looking at "dir".

All this software was free, by the way.

Active Desktop fix recovery

Active Desktop white screen, "restore active desktop" retrieves a script error referencing Desktop.htt

Fix:
right-click, Properties
Desktop, None
[Apply]
find c:\documents and settings\current username\application data\microsoft\internet explorer\desktop.htt and rename/delete it

Change the picture in Desktop. Active Desktop error is gone.

Here is another link with a registry adjustment (in the comments) that seems to work.

How to extract the files from a .deb in Windows

I'm using ZipGenius, but 7-Zip may also work.

1) rename the .deb file or append .bz2
2) Extract with ZipGenius or 7-Zip

The .deb file has likely a few files in it. You want data.tar.gz ... extract it.

In my case, I needed firmware-bnx2_0.14+lenny1_all.deb\data.tar\lib\firmware\bnx2-06-4.0.5.fw

ASSP with MailArchiva

Oh, this is so cool and fast:

ASSP gets a facelift when coupled with MailArchiva. Set up MailArchiva (separately is ok, and perhaps even the Open Source version) and make certain that the Listen for Exchange/SMTP requests is turned on. Then in ASSP configuration, sendAllSpam to USERNAME@DOMAIN and sendAllDestination to mailarchivamachinename:8091 (or whatever port you're listening to in MailArchiva).

Apply changes, and now ASSP's spam goes to a different location, doesn't pollute your main mail archival, and yet users should be able to self-retrieve "missing" emails. Even still, I'd likely recommend upgrading MailArchiva to Enterprise Edition if only for retention purposes.

iastor.sys BSOD

I had it, and I had a bad hard drive in my SATA RAID. I turned that drive off and the RAID booted.

LVM upgrade on non-LVM system

I did a strange thing. I *wasn't* using LVM, but I think I accidentally installed it and device-mapper went all bonkers and decided to take all my drives away so I couldn't mount them:

fsck.ext3: Device or resource busy while trying to open /dev/sda1
in boot log. It appears that device-mapper usurps the /dev/sda# ... my old fstab won't work. But I'm not going to wipe it out!

What *finally* fixed it for me:
fdisk -l | grep "Disk" | grep -v "identifier"
This gives me a list of devices I *can* mount and what their sizes are. I ignored the "doesn't contain a valid partition table"
nano /etc/fstab
and changed my /dev/sda# to /dev/dm-# according to my carefully hand-written notes that compared the sda* to the dm-*. NB: the number after dm- does not necessarily map with the number after /dev/sda. My sda# skips 3 and 4. My dm-# does not skip, and also starts at 0.

Dansguardian access.log summarizing, counting, unique

I have a dansguardian access.log file in smoothwall. I'd like to get a list of unique domains in use, and who'd be a sample IP address to check on.

This, my first effort, is good as far as it goes, which is to simply alphabetize the domains and give an IP address for *someone* who has accessed it:

awk "{ split (\$5,a,\"/\"); print \$4 \"\t\" a[3]; }" access.log | sort +1 -u


Of course, if I needed a date or time, I could add it in the print statement.


But now I think to myself, what about seeing how popular a domain (front part of url) is?

awk "{ split (\$5,a,\"/\"); print \$4 \"\t\" a[3]; }" access.log | sort +1 | awk '{a[$2] = $0; b[$2]++ } END {for(i in a){ print a[i] "\t" b[i]};}' | sort +1


This gives an IP address that has accessed the domain, and how many times that domain has been accessed. It DOES NOT mean that the IP address has accessed that domain that many times. If I wanted to do that ...


awk "{ split (\$5,a,\"/\"); print \$4 \"\t\" a[3]; }" access.log | sort | awk '{a[$0] = $0; b[$0]++ } END {for(i in a){ print a[i] "\t" b[i]};}' | sort


Further, you can use the above to see who "hogs" the web...
awk "{ split (\$5,a,\"/\"); print \$4 \"\t\" a[3]; }" access.log | sort | awk '{ a[$0] = $0; b[$0]++ } END {for(i in a){ print a[i] "\t" b[i]};}' | sort -r -n +2 -t " "

Inside the " " Linux users would use, in vi: ctrl-v, then Tab to put the real tab character. This puts the biggest numbers on top, so piping through more or head would be ideal.

I would argue that using these scripts is faster than most any other log analysis program, or use it in conjunction with your log analysis program.