EventTracker PULSE

EventTracker PULSE is a smart search engine for log data. Available as a free software download, it automates the real-time collection and long term archival of all log data from Windows (servers and workstations), Unix/Linux, Cisco devices, applications and any syslog source. A Google-like interface provides searching across hundreds of gigiabytes of data, allowing users to pinpoint critical data in a matter of seconds. Hundreds of preconfigured knowledge categories help users find common events such as Cisco authentication failures or Windows logon failures. In addition, an optional Windows agent provides monitoring of CPU usage, network connections, disk space utilization, capacity utilization, user activity etc.

The benefits of Log Search limitless for system administration and security. For instance, users can quickly identify root cause of service degradations or IT failures for remediation, or in the event of an internal breach, pinpoint who did what and when and plug security holes.

EventTracker PULSE installs on any Windows server or workstation. Key features include:

• No limit on collection and archival of log data
  
• Real-time collection from Windows (servers and workstations), Unix/Linux, Cisco devices, applications and any syslog source
  
• Compressed, secure (SHA1) storage of data
  
• Easy to use Google-like interface with options for free-form searching using keywords, exact phrases, operators, wildcard characters or a combination of all for complex queries
  
• Endless refine to extract precise matches from large volumes
  
• Hundreds of preconfigured knowledge categories
  
• One-click access to the Prism KnowledgeBase for helpful descriptions on over 20,000 events
  
• Agent-optional architecture; centralized agent configuration

More details and download availabile here: http://pulse.prismmicrosys.com/

Dealing with Windows 64bit "I want SIGNED drivers!"

Solving 64-Bit Windows' "I Only Want Signed Drivers!" Tantrums

I love 64-bit Windows.  I love the ability to stick 8 gigs of RAM on a laptop, allowing me to run several virtual servers, each of which I can equip with 1.5 GB of RAM.  (Life's too short to wait for Server 2008 to get things done in 512 MB of RAM, y'know?)  I love how much snappier Adobe Lightroom is when it's no longer shackled to the 2 GB limits that 32-bit Windows requires.  And I especially love that the main problem with 64-bit Windows -- the lack of 64-bit drivers -- is largely a thing of the past, save for those cases where vendors use the new architecture as a way to force you to upgrade (and yes, I am talking to you, HP printer division and Cisco VPN folks).

Once in a while, though, I run up against the the thing that I most don't like about 64-bit Windows:  the iron rule of driver signing.  Ever since XP and 2003, the 64-bit versions of Windows have refused to load kernel executables or device drivers unless those executables and drivers are digitally signed.  Load a driver that's not signed, and 64-bit Windows pops up some scary-looking message essentially saying, "take a walk, buddy, and take your unsigned driver with you... I mean you don't really know where this thing's been, do you?"  You can get around it by pressing F8 every time you boot and disabling driver signing, but that's a pain.  There was once, briefly, a setting in bcdedit that would let you tell Windows to always skip driver signing, but Vista SP1 put an end to that -- and besides, I don't want Windows to ignore checking the signatures on all drivers, I just want it to allow me to run the occasional unsigned driver.

Look, I understand the whole thought process behind this totalitarian approach, which I understand runs something like this:

• Unsigned drivers cause the vast majority of Windows bluescreens.
  
• Unknowing users don't know that, and so blame Microsoft for blue screens
  
• This really irritates people at Microsoft and in particular Dave Cutler, Windows' Architectus Maximus
  
• Dave wants to make it easy to finger the culprit of any given blue screen
  
• Signing a driver carries with it something of a statement of personal confidence in that driver (and here, I feel, is where the whole thing falls down a bit:  signing a driver says you wrote it, not that it lacks bugs), so...
  
• 64-bit Windows requires that all drivers and kernel executables be signed.
  

It all just seems a bit heavy-handed for my taste -- sort of like, oh, say, scaring a large room full of people into thinking that you've just released a bunch of malaria-infected mosquitoes into the air to make a point about poverty.  Anyway, this month I wanted to offer a workaround for those who run 64-bit systems and really need to run an unsigned driver now and then.  The workaround?  Create your own driver signing certificate and sign the driver or application yourself!  Here are the steps.

WinBubble - tweaking tool for Vista

Lawrence Albert has a nice utility for tweaking the Windows Vista, called WinBubble, a great replacement for TweakUI.

ASP.NET Tutorial (ro)

ASP.NET tutorials for beginers, in romanian:

Part 1
Part 2
Part 3

Hyper-V Remote Management Configuration Utility

HVRemote, maintained by John Howard, Senior Program Manager in the Hyper-V Team at Microsoft, is a handy tool that reduces the manual configuration steps needed for Hyper-V Remote Management down to one or two commands.

HVRemote project site is at this address: http://code.msdn.microsoft.com/HVRemote

and author's blog can be found here.

Hyper-V Server 2008 Local Management scripts / UI

A very nice addition to the configuration script integrated in Hyper-V Server, HVS2008 UI is a CodePlex developed script that helps you manage a Hyper-V Server host.

http://www.codeplex.com/HVS2008UI

Is developed by Ravikanth Chaganti's and his blog can be found here.

Managing connections to remote servers

There are a number of ways of managing connections to databases. Configuration files, udls, odbc dsns etc. However when you have set one up to use a remote database how do you test that it is actually making a connection.

http://sqlblogcasts.com/blogs/simons/archive/2009/01/15/Managing-connections-to-remote-servers.aspx

Adding a column to every table in a database

Despite the best laid plans, sometimes circumstances or project scope change and the definition of one or more tables in your database must be altered after they have been created. It's just a fact of life for a DBA.

http://weblogs.sqlteam.com/joew/archive/2009/01/15/60824.aspx

Analyzing the SQL Server Plan Cache

Keeping in mind the importance of the cache mechanism, how could one get the plans and their usage statistics in SQL Server?

http://www.mssqltips.com/tip.asp?tip=1661

Spring Clean Your Database Schema

The utility described in this article will allow you to quickly identify which columns have mismatched datatypes across tables in a database, and should prove valuable in the everyday work of the SQL Server DBA/developer.

http://www.sqlservercentral.com/articles/Admin/65138/

Log Management, the easy way

Today i have found an interesting Log Management software, called Splunk. Seems very powerful, and they even have a free version.

Splunk website - http://www.splunk.com/

Splunk documentation - http://www.splunk.com/base/Documentation

What Splunk can do for you:

Index
With a variety of flexible input methods you can index logs, configurations, traps and alerts, messages, scripts, and code and performance data from all your applications, servers and network devices. Monitor file systems for scripts and configuration changes, capture archive files, find and tail live application logs, connect to network ports to receive syslog, SNMP and other network-based instrumentation. And this is just where it starts.

Search
Fast, free form search on anything, not just a few predetermined fields. Boolean, nested, quoted string and wildcard searches. No knowledge of specific data formats required. Combine time and term searches. Find errors across every tier of your infrastructure and configuration changes in the seconds before a system failure occurred. Fields are identified from your results as you search -- providing much more flexibility than a rigid set of field mapping rules imposed ahead of time.

Alert
Any search can be run on a schedule and trigger notifications or actions based on the search results. And because it works across different components and technologies, Splunk is the most flexible monitoring tool in your arsenal. Notifications can be sent via email, RSS or SNMP to other management consoles. Actions trigger scripts performing user described activities like restarting an application, server or network device.

Report
Splunk marries powerful reporting capabilities with the speed, flexibility and scale of IT Search. Search results can be easily summarized as reports with interactive charts, graphs and tables. The simplicity of analyzing massive amounts of data will amaze you (and your boss). And remember, because fields are identified as you search you can specify new fields without re-indexing your data.

Share
Everyone knows IT data is generally poorly documented by vendors, developers and operations staff. With Splunk everyone can add their own knowledge as they go. As you’re saving searches, identifying different types of fields, events and transactions you make the whole system smarter for everyone else. And that knowledge doesn’t walk out the door when someone leaves.

Scale
Scale your installation from a single application and just a few data sources to your whole datacenter and thousands of sources. You’ll find a wide range of options to access data, store it, search it and route it to other systems.

Secure
Of course you'll need to keep your IT data secure. Especially as you realize what a valuable information asset you have. Splunk gives you secure data handling, fine grain access controls, auditability, assurance of data integrity and integration with existing authentication systems.

When i will be done with the installation and configuration with my new servers i will give it a try, and share my experience with it.

Make your own (free) NAS or SAN

If you want to build your own cheap NAS or SAN, there are available a couple of software packages that can transform a regular PC into a full fledged NAS or SAN (or both).

This is a list of the free NAS or SAN software that i found:

1. FreeNAS - http://www.freenas.org/
2. OpenFiler - http://www.openfiler.com/
3. unRAID - http://lime-technology.com/
4. ClarkConnect - http://www.clarkconnect.com/

There are others, of course, but these are the most prominent packages i have found after a few days of searching and reading on the net. And there are free.

The most advanced is OpenFiler, which is based on rPath Linux. In the past CentOS was used. Some people regret the transition to rPath.