https://lukehebert.com/category/sysadmin/Recent content in SysAdmin on Luke HebertHugoen-usThu, 21 Aug 2025 00:00:00 +0000https://lukehebert.com/post/basic-iptables-insert/Thu, 21 Aug 2025 00:00:00 +0000https://lukehebert.com/post/basic-iptables-insert/Learn how to insert iptables rules at a specific position using the -I flag, with syntax breakdown and a practical SSH example.https://lukehebert.com/post/add-hard-and-soft-limits-for-apache-stack/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/add-hard-and-soft-limits-for-apache-stack/Configure the soft and hard stack limits for the Apache user in /etc/security/limits.conf to prevent segmentation faults caused by insufficient stack space.https://lukehebert.com/post/awk-scan-for-wp-login/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/awk-scan-for-wp-login/A quick awk pipeline to pull wp-login.php access attempts from web server logs and flag IPs that exceed a threshold. Useful for spotting brute-force or scanning activity against WordPress sites.https://lukehebert.com/post/check-apache-stack-limit/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/check-apache-stack-limit/A quick one-liner to inspect the stack size limit applied to a running Apache httpd process on Linux. Useful when debugging segfaults or tuning worker memory.https://lukehebert.com/post/check-database-and-optimize-everything-all-databases/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/check-database-and-optimize-everything-all-databases/A quick reference for running mysqlcheck to verify and optimize MySQL databases, including the -A flag to target every database on the server in one pass.https://lukehebert.com/post/check-for-ip-block/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/check-for-ip-block/A quick way to verify whether a specific IP address is blocked by iptables rules on a Linux host. Covers the exact command and how to read the output.https://lukehebert.com/post/check-inode-counts-with-formating/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/check-inode-counts-with-formating/Practical bash one-liners for counting inodes per directory and reporting disk usage with formatted output. Handy when you need a quick snapshot of filesystem pressure without pulling in a full monitoring tool.https://lukehebert.com/post/check-web-crawler-impact/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/check-web-crawler-impact/A quick bash function to identify which search engine crawlers are hitting your Apache logs and how often, so you can spot unusual traffic patterns at a glance.https://lukehebert.com/post/chroot-suggested-monts-for-rescue/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/chroot-suggested-monts-for-rescue/A quick walkthrough of using virt-rescue to generate the correct mount commands for a chroot rescue session on a libvirt guest.https://lukehebert.com/post/count-unique-connecting-addresses/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/count-unique-connecting-addresses/A quick pipeline using awk, sort, and uniq to count how many times each unique IP address appears in a log file. Handy for spotting the most active or suspicious clients at a glance.https://lukehebert.com/post/crontab-log/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/crontab-log/Find where cron logs live on your Linux system and learn how to read them to confirm scheduled jobs actually ran.https://lukehebert.com/post/disable-mod-sec-on-a-domain-htaccess/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/disable-mod-sec-on-a-domain-htaccess/Learn how to turn off ModSecurity for a specific domain or path using a single directive in your .htaccess file. This is useful when a legitimate request is being blocked by the WAF rules.https://lukehebert.com/post/drop-all-mail-in-exim/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/drop-all-mail-in-exim/A quick one-liner to flush every message out of the Exim mail queue. Useful when a misconfigured relay or a flood of bounce messages has clogged up your server.https://lukehebert.com/post/rpm2cpio/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/rpm2cpio/Learn how to manually decompress an RPM package into a working directory using rpm2cpio and cpio, without installing the package.https://lukehebert.com/post/verbose-tracking-of-mail-being-sent/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/verbose-tracking-of-mail-being-sent/A quick reference for enabling verbose output when sending mail from the command line, so you can see the full SMTP transaction and diagnose delivery issues.https://lukehebert.com/post/force-mysql-logs-to-file/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/force-mysql-logs-to-file/Learn how to configure MySQL’s log_output variable to write slow query and general logs to files instead of tables, and why that matters for performance and log management.https://lukehebert.com/post/fsck/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/fsck/A quick reference for running a forced, verbose ext filesystem check with automatic repairs and timestamped logging.https://lukehebert.com/post/gbb-thread-dump/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/gbb-thread-dump/A quick three-command recipe for grabbing a full thread backtrace from a running httpd process with gdb, useful when Apache appears hung or unresponsive.https://lukehebert.com/post/get-gateway-hostnamed-from-mail-log/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/get-gateway-hostnamed-from-mail-log/A quick bash one-liner to pull offending IP addresses from exim relay-denied entries and resolve them to hostnames, making it easier to identify which gateways are misconfigured.https://lukehebert.com/post/ip-tables-rate-limit-bad-bots/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/ip-tables-rate-limit-bad-bots/Use iptables string matching and the recent module to drop connections from abusive bots that exceed a request threshold within a short window.https://lukehebert.com/post/inode-counts/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/inode-counts/A quick bash one-liner to identify which directories are consuming the most inodes on a Linux system, helping you pinpoint the source of ‘No space left on device’ errors when disk space still appears available.https://lukehebert.com/post/locate-largest-files-top-10/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/locate-largest-files-top-10/A quick one-liner to identify the ten largest files or directories under any path. Useful when disk space is tight and you need to find what is eating your storage.https://lukehebert.com/post/lsof-check-listening-ports/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/lsof-check-listening-ports/A quick way to list every port a process is listening on, using lsof and a simple grep filter. Handy for troubleshooting connectivity issues or auditing what services are exposed on a host.https://lukehebert.com/post/memory-by-process/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/memory-by-process/A quick one-liner to group running processes by name and rank them by memory usage. Handy when you need to spot which services are eating RAM without pulling up a full top or htop session.https://lukehebert.com/post/mod-remote-ip/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/mod-remote-ip/A troubleshooting walkthrough for getting mod_remoteip working correctly under Apache 2.4 and cPanel, including the right LogFormat directives and RemoteIP configuration so that access logs, mod_security, and other modules all see the real client IP.https://lukehebert.com/post/mod-rewrite-block-bad-bot/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/mod-rewrite-block-bad-bot/A quick Apache mod_rewrite snippet that returns a 403 Forbidden to any request whose User-Agent matches a bot pattern. Drop it into your .htaccess and you are done.https://lukehebert.com/post/mod-qos-tailblock/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/mod-qos-tailblock/A lightweight bash script that monitors Apache error logs for repeated access-denied entries and automatically blocks offending IPs via iptables. Useful for quick-and-dirty rate-based blocking without a full WAF.https://lukehebert.com/post/mount-a-labeled-drive-like-backup/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/mount-a-labeled-drive-like-backup/Learn how to mount a filesystem by its label in /etc/fstab so your mount points stay stable across reboots and hardware changes.https://lukehebert.com/post/myisamchk/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/myisamchk/A quick reference for repairing corrupted MyISAM index files with myisamchk, including the exact command and what to expect when running it against a database directory.https://lukehebert.com/post/netstat-ss-check-listening-ports/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/netstat-ss-check-listening-ports/A quick reference for checking listening ports on Linux using netstat and ss, including the flags that matter and what each output column means.https://lukehebert.com/post/numa-update-to-mysql-swap-insanity/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/numa-update-to-mysql-swap-insanity/A follow-up to the original MySQL NUMA swap post, explaining why the real issue is memory pressure on a single NUMA node rather than swap itself, and outlining a three-part solution for balanced allocation in production.https://lukehebert.com/post/ps-aux-states/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/ps-aux-states/A quick reference for the process state codes shown in the STAT column of ps aux, including both standard and BSD-specific flags.https://lukehebert.com/post/linux-rcs/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/linux-rcs/A quick reference for the core RCS (Revision Control System) commands used to initialize, check in, check out, and log file revisions on a Linux system.https://lukehebert.com/post/stop-slow-loris-attacks/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/stop-slow-loris-attacks/Slow Loris attacks tie up web server sockets with trickling requests until legitimate traffic is starved. This post walks through configuring Apache mod_qos to detect and block those connections automatically.https://lukehebert.com/post/sync-mysql-time/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/sync-mysql-time/A quick procedure to verify and correct a time mismatch between the host system clock and MySQL’s internal NOW() function, using a simple service restart.https://lukehebert.com/post/find-command-printf-switches-lost-found-and-find-output-format/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/find-command-printf-switches-lost-found-and-find-output-format/A quick reference for GNU find -printf format switches, with practical examples for inspecting file ownership, size, and mode. Includes a use case for auditing files recovered into lost+found after a filesystem check.https://lukehebert.com/post/understanding-linux-permissions/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/understanding-linux-permissions/A practical breakdown of how Linux file permissions work, including the symbolic and numeric chmod methods, special bits like setuid and sticky, and how permissions differ between files and directories.https://lukehebert.com/post/understanding-load-averages/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/understanding-load-averages/A practical guide to reading Linux load averages, with a traffic analogy that makes the numbers click. Learn the thresholds that matter, how multi-core systems change the math, and which of the three averages to watch.https://lukehebert.com/post/unmounted-disk-labels/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/unmounted-disk-labels/A quick bash one-liner that lists every disk label present in /dev/disk/by-label/ that is not currently mounted, so you can spot forgotten or orphaned volumes at a glance.https://lukehebert.com/post/update-vm-memory-usage/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/update-vm-memory-usage/Tune Linux VM memory behavior by adjusting vfs_cache_pressure, dirty_ratio, and swappiness to reduce unnecessary swapping and improve I/O throughput.https://lukehebert.com/post/rewrite-block-page-check-for-patterns-check-google/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/rewrite-block-page-check-for-patterns-check-google/Use Apache mod_rewrite to return a 400 error for a specific URI and optionally block hotlinking from other domains. A quick .htaccess snippet that keeps unwanted traffic off a single page.https://lukehebert.com/post/server-is-unwilling-to-perform-53/Wed, 16 Aug 2017 00:00:00 +0000https://lukehebert.com/post/server-is-unwilling-to-perform-53/LDAP error 53 means the destination server is refusing a password change request. This post walks through the most common Active Directory requirements and policy settings that trigger the error.https://lukehebert.com/post/checking-host-resolution-using-getent/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/checking-host-resolution-using-getent/A quick reference for using getent to verify how your Linux system resolves hostnames, short names, and IP addresses through the full NSS chain.https://lukehebert.com/post/mount-output-in-columns-formatted-output-for-mount-list/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/mount-output-in-columns-formatted-output-for-mount-list/Pipe the mount command through column -t to get a clean, aligned table of all mounted filesystems. A quick sysadmin trick for scanning devices, mount points, and options at a glance.