Use ngrep to capture syslog traffic

Instead of using wireshark on Linux to capture traffic try ngrep

# sudo ngrep -d <interface> ‘<search string>’ ‘port 514’


How to Install nginx and PHP on CentOS7

Install nginx and PHP on CentOS7

These are some notes from installing nginx on CentOS7

Install some prerequisites sudo yum -y groupinstall “Development tools” sudo yum -y install mlocate sudo yum -y install iptables-services sudo yum -y install php-mysql php-dom sudo yum -y install wget sudo service php-fpm restart Install GeoIP cd /tmp wget . . . → Read More: How to Install nginx and PHP on CentOS7

diff two files and output lines not seen in file 2


You need two diff two files and only output what is unique to file one.

text file 1 contains:

1 2 3 4 5

text file 2 contains:

6 7 1 2 3 4 Solution $ awk ‘FNR==NR{a[$0]++;next}!a[$0]’ file1 file2 6 7

Explanation of how the code works:

If we’re working on file1, track . . . → Read More: diff two files and output lines not seen in file 2

Block Countries Behind ELB

To block countries behind an ELB (Elastic Load Balancer) you should use Maxmind’s GeoIP Country Database.


You are unable to use iptables or ipset to block countries because of your Amazon Elastic Load Balancer


Use Maxmind’s GeoIP Country Database in conjunction with Apache or NGINX


This example is for Ubuntu 12.04 (Precise)

. . . → Read More: Block Countries Behind ELB

logstash ec2 instanceid

How to get Logstash to read your ec2 instance id !/bin/bash EC2_INSTANCE_ID=$(curl -s export EC2_INSTANCE_ID conf=/opt/logstash/simple.conf lsjar=/opt/logstash/logstash.jar myjava=$(which java) if [ -z $myjava ]; then echo “java is required; please install openjdk or jre” exit 1 fi # spawn logstash $myjava -jar $lsjar agent -f $conf config file /opt/logstash/simple.conf input { exec { . . . → Read More: logstash ec2 instanceid

Ubuntu Set Timezone to UTC

Objective: Set Timezone to UTC on Ubuntu 12.04 LTS Howto

You will be using tzdata and ntpdate

Setting the timezone

After running this select “etc” (hit enter) then select “UTC” (hit enter)

pkg-reconfigure tzdata Syncing the clock apt-get -y install ntpdate ntpdate Updating crontab to sync clock daily crontab -l > tmp.cron echo “@daily . . . → Read More: Ubuntu Set Timezone to UTC

nohup example

here’s a nohup example:

nohup nice -n -19 /bin/bash all_countries.txt 2>&1 >/root/cidr_to_ipset_output.log </dev/null &

nohup is a POSIX command to ignore the HUP (hangup) signal. The HUP signal is, by convention, the way a terminal warns dependent processes of logout.

Output that would normally go to the terminal goes to a file called nohup.out . . . → Read More: nohup example

Apache ProxyPass with dynamic hostname

To use Apache ProxyPass directives with dynamic hostnames you will need to also use ModRewrite.


All requests to the virtualhost will ProxyPass and ProxyPassReverse (also known as an “Apache Gateway”) to the %{HTTP_HOST}

The only reason this would make sense to do is if you have localhost entries on the apache server for specfic . . . → Read More: Apache ProxyPass with dynamic hostname

curl: (35) error:14077458:SSL routines:SSL23_GET_SERVER_HELLO:reason(1112)


When running curl you get this response:

curl: (35) error:14077458:SSL routines:SSL23_GET_SERVER_HELLO:reason(1112) Solution curl -ssl3

Ensure Beaver Log Shipping is Running

I have a love hate relationship with the beaver log shipper and ensuring that it is in fact running on all of my machines (and not in a defunct or partially running state)

I have finally whipped up a script to take care of this issue and thought i’d share it for anyone that cares.

. . . → Read More: Ensure Beaver Log Shipping is Running