Solaris 10 Security Overview

Here you can download PDF presentation on Solaris security by Glenn Brunette. Nice summary what's in Solaris about security.

Richard McDougall has a blog!

Richard McDougall has started a blog! I'm sure it will be worth reading.

VxVM is cool

I had to grow filesystem on a production database by adding more disk to raid 10 but not thru concatenation as it would hit a performance but rather by recreating raid so proper config would be preserved. The trick is how to do it without any downtime. With VxVM you can do all of this on-the-fly without stopping database, unmounting filesystems, etc. and all of this on rather old Solaris 8 in a cluster environment (Sun Cluster). It took some time for VxVM to relayout data but at the end it worked without any problems or downtime of the database.

On the other hand it makes less sense to use VxVM (due to costs) as more features are put in SVM which is free with Solaris and as more features are put in mid-range and low-end arrays so a volume manager is not needed at all or SVM is good enough.
It doesn't mean of course that VxVM doesn't make sense in all cases - in many it does and it's really good software.

More than 10 args in PID provider

We run into a problem that we couldn't catch more than 10 arguments in a function using PID provider in DTrace. Thanks to Adam Leventhal for workaround. I've checked it for SPARC 32/64 bit programs and it works. Ideally it would be getting args[] working with PID provider and allowing it to get more than 10 arguments - as Adam wrote to me they do work on this and consider allowing more arguments - great!

Workaround:

sparc 32-bit:
        this->argN =
            *(uint32_t *)copyin(uregs[R_SP] + sizeof (uint32_t) * (N + 17),
            sizeof (uint32_t));
        (only applies to args past the first 6)

sparc 64-bit:
        this->argN =
            *(uint64_t *)copyin(uregs[R_SP] + 0x7ff +
            sizeof (uint64_t) * (N + 16), sizeof (uint64_t));
        (only applies to args past the first 6)

x86:
        this->argN =
            *(uint32_t *)copyin(uregs[R_SP] + sizeof (uint32_t) * (N + 1),
            sizeof (uint32_t));

amd64:
        this->argN =
            *(uint64_t *)copyin(uregs[R_SP] + sizeof (uint64_t) * (N - 5),
            sizeof (uint64_t));
        (only applies to args past the first 6)

Performance tests in Solaris development

Here you can find interesting blog entry by Fintan Ryan about "Sun's Performance Lifestyle".

Long DTrace scripts

If you try to write/run large DTrace script you can encounter problem that DTrace won't let you run such a script. In that case you can increase dtrace_dof_maxsize which can be changed on the fly (or you can put it in /etc/system). For example:

     # ./big_script.d
     dtrace: failed to enable './big_script.d': DIF program exceeds maximum program size

     # mdb -kw
     Loading modules: [ ... ]
     > dtrace_dof_maxsize/E
     dtrace_dof_maxsize:
     dtrace_dof_maxsize:      262144
     > dtrace_dof_maxsize/Z 0t524288
     dtrace_dof_maxsize:      0x40000    =    0x80000
     > dtrace_dof_max_size/E
     dtrace_dof_maxsize:
     dtrace_dof_maxsize:      524288
     > $q

     # ./big_script.d
     dtrace: script './big_script.d' matched 264 probes

Open Solaris meeting

Me and some other Open Solaris Pilot Members met in Palo Alto two weeks ago on unofficial meeting. It was really nice to meet some of Pilot members in real life. I know that there're more such unofficial meetings. And traffic on Pilot list has vastly increased lastly. Open Solaris is live even before it launched! :)

On April 26th there's gonna be first official Open Solaris Meeting in California.

SMF presentation

Liane Praza has posted really nice presentation about administering a Solaris with SMF.

SX 3/05 available

Here you can download new Solaris Express bits. Dan Price has blogged about new features in this release. In his previous blog entry you can find What's New for 2/03 release. Both releases have features and bug fixes which are not in Solaris 10 (yet). So if you want to try with latest Solaris bits SX is a way to go.

btw: some bug fixes or features in this release are result of my own BUGs or RFEs I sent to Sun. It's nice to see that Sun is really listening to its customers. And it's not the first time Sun fixed a bug or implemented RFE I requested.

Processor sets for interrupts partitioning

I have a server which has a lot of nocanput errors on GEM interfaces. Changing sq_max_size doesn't help and it's high by default in S10FCS anyway (default now is 10000). There's still quite a lot of CPU power left on server. What can I do quickly? First I did use intrstat 1 so I can identify which CPUs are used for those GEM NICs. Then I created CPU set using psrset which contains CPUs used for interrupts for GEMs. That way CPUs in the newly created CPU set are used only for interrupts. I can see about 2-3x times lower nocanput rate on this server. Quick and easy. But it's just a beginning :)

Zones How-To

Here you can find some examples on using Zones with emphasis on resource controls.

Comparing Red Hat EL 4 to Solaris 10

Here you can find a nice comparison of RHEL AS 4 and Solaris 10 on the same hardware (x64). While in 32bit Solaris lost in two tests and won one, in 64bit Solaris was a clear winner to Linux in all tests.

PID provider internals

Adam Leventhal has put interesting presentation about DTrace PID provider internals. You can find it here.

I wouldn't put it better then Adam himself:

If you're interested at all in instrumentation or want to know more about the pid provider or are just a super nerd who enjoys reading about cool, low-level hackery, it's probably worth a read.

SX 2/05 available

There is a new Solaris Express available. Here's What's New:

New and Updated Drivers - Chelsio 10gb NIC driver

Fibre Channel HBA Port Utility

Metaslot in the Cryptographic Framework

IKE Enhancements

Support for iSCSI Devices

Xorg Release 6.8.2

And there's more.

btw: SX (Solaris Express) is a snapshot of current Solaris under development, so if you want newest features it's a way to go. You can find more information about SX on its official page.

UPDATE: Thanks to Dan Price we can find here more detailed information on SX 2/05.

DTrace tricks

If you use DTrace then here you can find PDF with some tips&tricks in DTrace. It has been written by DTrace creators themselves! Some tricks are obvious some not. It's a must read for every DTrace user.