Anomaly in gparted

Gparted lists the active devices when opened in arch.
This is always true in HDD boot of the system which lista all sd, hdd, and raid items.
However, when booted into raid0 dev md0, gparted does not list md0 as a device but does list the component devices of the raid array.
The md0 array can be mounted in /mnt with the normal command...mount /dev/md0 /mnt/md...
The array is assembled from two separate CF to Sata adapters using either two 8GB or two 16GB CF cards.
Either of the arrays when booted display the same gparted anomaly, showing up in HDD when queried and not being discovered when booted in raid0.
Other than this strange behavior, the raid arrays perform as expected.
As outlined above, this occurs in both raid0 arrays.
Gparted reports that the array is identified as .../dev/md/0....no such device. Addressing the array as md0 (not md/0) permits the array to be mounted in /mnt/md when the array is the OS device as described previously
Thus gparted identifies the array correctly from HDD boots but not from raid0 array boots.
No further clues.............EDIT: x86_64 Latest kernel
Last edited by lilsirecho (2011-07-13 16:09:03)

Here are the 2 files, the first one from PS CS4, The second from LR3. I am not accessing the files on a network. and I have saved the files numerous times and re-opened them and always seem to get the same result. I can open the same file, with LR2 and it looks OK.
I just in PS CS4 changed the canvas size, to add a couple hundred pixels on either side of the file. In LR3 I still get a similar result, but the anomaly has moved to the right a bit (about the same amount as the added canvas size).
Here is the sample.

Similar Messages

Windows 7 won't boot after adding a third partition with gparted

I needed extra space on my bootcamp partition so I :
1. resized macintosh hd partition with disk utility
2.booted with gparted live disk and "growed" the bootcamp partition
Now Windows doesn't boot. Any suggestions?

Hi,
your Topic says '...adding a third partition' whereas in your message you don't mention this third partition...
So what is the right one ?
Nonetheless you might have a look at EasyBCD http://neosmart.net/dl.php?id=1 to repair the Windows 7 bootloader.
Regards
Stefan

CS4 project to CS5 anomaly

Previous project was 1080 from a digital camera.
When I imported a previous CS4 PAL DV project into CS5, all the sequences were set to 1080 not DV.
I added a DV sequence, gave up and tried again. This time the sequences were DV as they should have been originally.
This suggests that there might be an anomaly sometimes when importing projects from CS4 to CS5 when they are of different types from the immediately previous work in CS5.
Working OK now, but posted so there is a record in case others have the same problem.

If I can repeat it, or others report the same issue, I'll certainly put in a bug report. But as of now it could easily be a one-off from a particular project.

Display anomaly when waking from sleep

Ever since the SL Upgrade when my MacBook Pro wakes from sleep the very bottom right one third section of my screen does not look as it should, this thin strip of incorrect graphics ( usually mostly white ) only appears for about one second then the desktop goes back to normal down there . . . so far this is not a problem at all, just an anomaly . . . I bought my MBP early summer 2008 and never had a single problem before and after SL, just this oddity now . . . I have a ViewSonic VP2250WB LCD display mirrored via DVI . . . so I am curious if anyone else has this happening and possible reasons for it . . .

Matteo : I guess it is a good sign that only 2 of us have reported this minor glitch here . . . I may experiment with switching to a different desktop pattern and / or screen saver to see if it persists . . . also, since installing SL I have only done Sleep and of course restarts after getting the 10.6.1 update and a few others so I need to do an actual Shut Down and later start up fresh and see what happens.

24" iMac 2.8 GHz Intel Core 2 Duo OSX v10.5.5 shutdown anomaly

24” iMac 2.8 GHz Intel Core 2 Duo OSX v10.5.5 shutdown anomaly.
I have noticed that when my iMac shuts down, that initially the One Touch Maxtor 500G external drive attached to the Firewire 400 port also does a normal shut down and the light goes out. Within a few minutes I noticed that the light on the Maxtor is back on. This does not happen if I use the USB 2.0 port to attach the hard drive and iMac, the light remains off. It appears the FW400 port is active on the iMac even when in the shutdown mode. Is this normal for the iMac?
I have a 13”MacBook 2.4Ghz that does not activate the same Maxtor when it is shut down. I attach it via the MacBook FW400 port.
I hooked up an ammeter to the iMac power cord and observed the following readings:
iMac Off: From 50ma to 180ma cycling at a rate of 23 cycles/minute. Using the Watt reading of the instrument, that amounted to cycling from 0 to 5 Watts every 4 seconds.
iMac On: 1.16A 133Watts.
This iMac is new, 1 week old, does it need repair or is this normal? I like to get a FW800 external HD, but I don’t want to have to pull the plug on the HD every time I want to shut down.

Since my Maxtor doesn’t have an on/off switch, the best solution I have found so far is to use my APC 750 UPS to turn off the Maxtor. This APC has a master plug outlet that senses when the computer is turned on and activates 3 other outlets to on when the computer reaches a certain power threshold. Fortunately the threshold is user adjustable and I was able to set it high enough to turn off the Maxtor outlet when the iMac is off.
Is anyone else able to confirm that their iMac cycles like mine does, or is this peculiar to my iMac? It is new and if it needs service I would prefer to do it while it is covered under warranty.

USB Stick unrecognized/read only after Gparted

Hi
I partitioned a brand new USB thumb drive with Gparted and then installed Fedora LiveOS on it. This was just a test as I really wanted to use Larch to get Arch on the stick. So I tried to repartitioned it again. But Gaparted now complains that the stick is read only and so does not change anything.
I then moved to fdisk. fdisk will allow me to look at the partitions and will even change them. But after using Fdisk to repartition and then running mkfs.whatever-i-want the partitions can not be mounted. Even dd exits with a read only drive error.
Fdisk can manipulate the partitions but it complains that DOS mode is not supported and asks me to give the c and u commands. Despite this the drive is not recognised when I plug it into the computer.
After using fdisk on the drive several times, gparted now claims that there is no valid partition table on the drive and so shows only unallocated space. But it still won't write any partition info to the device, claiming its read only!
I'm stumped! Anybody have a clue how to get around this?
emk

dd fails with an input/output error after writing 17MB. This is an 8GB stick. Fdisk shows no partitions. But is unable to write to the drive after I create partitions. Here is the output.
dd if=/dev/zero of=/dev/sdb
dd: writing to `/dev/sdb': Input/output error
32969+0 records in
32968+0 records out
16879616 bytes (17 MB) copied, 217.003 s, 77.8 kB/s
Output of dmesg when I plug in the drive
usb 4-1: new high speed USB device using ehci_hcd and address 2
Initializing USB Mass Storage driver...
scsi2 : usb-storage 4-1:1.0
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
scsi 2:0:0:0: Direct-Access HP v115w 1100 PQ: 0 ANSI: 0 CCS
sd 2:0:0:0: Attached scsi generic sg2 type 0
sd 2:0:0:0: [sdb] 15663104 512-byte logical blocks: (8.01 GB/7.46 GiB)
sd 2:0:0:0: [sdb] Write Protect is off
sd 2:0:0:0: [sdb] Mode Sense: 43 00 00 00
sd 2:0:0:0: [sdb] Assuming drive cache: write through
sd 2:0:0:0: [sdb] Assuming drive cache: write through
sdb: sdb1
sd 2:0:0:0: [sdb] Assuming drive cache: write through
sd 2:0:0:0: [sdb] Attached SCSI removable disk
So far this looks OK. I had earlier deleted my initial 2 partitions and created one vfat partition on the drive. But then when I try to mount the drive and to repartition with fdisk dmesg gives the following:
EXT4-fs (sdb1): VFS: Can't find ext4 filesystem
EXT2-fs (sdb1): error: can't find an ext2 filesystem on dev sdb1.
FAT: bogus number of reserved sectors
VFS: Can't find a valid FAT filesystem on dev sdb1.
usb 4-1: reset high speed USB device using ehci_hcd and address 2
usb 4-1: reset high speed USB device using ehci_hcd and address 2
usb 4-1: reset high speed USB device using ehci_hcd and address 2
usb 4-1: reset high speed USB device using ehci_hcd and address 2
usb 4-1: reset high speed USB device using ehci_hcd and address 2
usb 4-1: reset high speed USB device using ehci_hcd and address 2
sd 2:0:0:0: [sdb] Unhandled sense code
sd 2:0:0:0: [sdb] Result: hostbyte=0x00 driverbyte=0x08
sd 2:0:0:0: [sdb] Sense Key : 0x7 [current]
sd 2:0:0:0: [sdb] ASC=0x27 ASCQ=0x0
sd 2:0:0:0: [sdb] CDB: cdb[0]=0x2a: 2a 00 00 00 10 70 00 00 f0 00
end_request: I/O error, dev sdb, sector 4208
Buffer I/O error on device sdb, logical block 526
lost page write due to I/O error on sdb
Buffer I/O error on device sdb, logical block 527
lost page write due to I/O error on sdb
Buffer I/O error on device sdb, logical block 528
lost page write due to I/O error on sdb
Buffer I/O error on device sdb, logical block 529
lost page write due to I/O error on sdb
Buffer I/O error on device sdb, logical block 530
lost page write due to I/O error on sdb
Buffer I/O error on device sdb, logical block 531
lost page write due to I/O error on sdb
Buffer I/O error on device sdb, logical block 532
lost page write due to I/O error on sdb
Buffer I/O error on device sdb, logical block 533
lost page write due to I/O error on sdb
Buffer I/O error on device sdb, logical block 534
lost page write due to I/O error on sdb
Buffer I/O error on device sdb, logical block 535
lost page write due to I/O error on sdb
sd 2:0:0:0: [sdb] Unhandled sense code
sd 2:0:0:0: [sdb] Result: hostbyte=0x00 driverbyte=0x08
sd 2:0:0:0: [sdb] Sense Key : 0x7 [current]
sd 2:0:0:0: [sdb] ASC=0x27 ASCQ=0x0
sd 2:0:0:0: [sdb] CDB: cdb[0]=0x2a: 2a 00 00 00 11 60 00 00 f0 00
end_request: I/O error, dev sdb, sector 4448
sd 2:0:0:0: [sdb] Write Protect is on
sd 2:0:0:0: [sdb] Mode Sense: 43 00 80 00
sd 2:0:0:0: [sdb] Assuming drive cache: write through
sd 2:0:0:0: [sdb] Unhandled sense code
sd 2:0:0:0: [sdb] Result: hostbyte=0x00 driverbyte=0x08
sd 2:0:0:0: [sdb] Sense Key : 0x7 [current]
sd 2:0:0:0: [sdb] ASC=0x27 ASCQ=0x0
sd 2:0:0:0: [sdb] CDB: cdb[0]=0x2a: 2a 00 00 00 80 c0 00 00 08 00
end_request: I/O error, dev sdb, sector 32960
sd 2:0:0:0: [sdb] Assuming drive cache: write through
sdb: unknown partition table
usb 4-1: reset high speed USB device using ehci_hcd and address 2
I don't have any ext4 partitions on it. THere should only be vfat. My initial partitions were ext3 and vfat. I then switched the ext3 to ext2 after the problems begun and finally just went with a big vfat. I initially used gparted on the drive so as to label the partitions. I really feel that gparted may be the culprit here but I have no proof. This is a brand new stick that had not been written to before.
And from gparted:
libparted : 2.3
======================
Unable to open /dev/sdb read-write (Read-only file system). /dev/sdb has been opened read-only.
Unable to open /dev/sdb read-write (Read-only file system). /dev/sdb has been opened read-only.
Unable to open /dev/sdb read-write (Read-only file system). /dev/sdb has been opened read-only.
/dev/sdb: unrecognised disk label
[1]+ Done gparted
emk
Last edited by emk (2010-07-25 00:02:50)

MFP Anomaly Detected Access Points are moving from one wlc to another and vice versa

Hi together,
a customer has lost some Access Points to another WLC with 7.2 and then they come back after 15 minutes to the origin WLC with 7.5
Attached the messages
MFP Protection is configured as optional
152
Wed Nov 27 05:33:26 2013
MFP Anomaly Detected - 1 Not encrypted event(s) found as   violated by the radio 58:bf:ea:0f:67:4a and detected by the dot11 interface   at slot 1 of AP 58:bf:ea:0f:67:40 in 300 seconds when observing . Client's   last source mac 70:11:24:e4:43:0f
153
Wed Nov 27 05:31:40 2013
AP Disassociated. Base Radio MAC:88:43:e1:56:91:d0
154
Wed Nov 27 05:31:40 2013
AP's Interface:0(802.11b) Operation State Down: Base Radio   MAC:88:43:e1:56:91:d0 Cause=New Discovery Status:NA
155
Wed Nov 27 05:31:33 2013
AP Disassociated. Base Radio MAC:58:bf:ea:0f:73:d0
156
Wed Nov 27 05:31:33 2013
AP's Interface:1(802.11a) Operation State Down: Base Radio   MAC:58:bf:ea:0f:73:d0 Cause=New Discovery Status:NA
157
Wed Nov 27 05:31:33 2013
AP's Interface:0(802.11b) Operation State Down: Base Radio   MAC:58:bf:ea:0f:73:d0 Cause=New Discovery Status:NA
158
Wed Nov 27 05:31:28 2013
AP Disassociated. Base Radio MAC:58:bf:ea:0f:fc:20
159
Wed Nov 27 05:31:28 2013
AP's Interface:1(802.11a) Operation State Down: Base Radio   MAC:58:bf:ea:0f:fc:20 Cause=New Discovery Status:NA
160
Wed Nov 27 05:31:28 2013
AP's Interface:0(802.11b) Operation State Down: Base Radio   MAC:58:bf:ea:0f:fc:20 Cause=New Discovery Status:NA
161
Wed Nov 27 05:31:17 2013
AP Disassociated. Base Radio MAC:b4:e9:b0:e4:02:20
162
Wed Nov 27 05:31:17 2013
AP's Interface:1(802.11a) Operation State Down: Base Radio   MAC:b4:e9:b0:e4:02:20 Cause=New Discovery Status:NA
163
Wed Nov 27 05:31:17 2013
AP's Interface:0(802.11b) Operation State Down: Base Radio   MAC:b4:e9:b0:e4:02:20 Cause=New Discovery Status:NA
164
Wed Nov 27 05:31:15 2013
AP Disassociated. Base Radio MAC:a4:18:75:eb:da:b0
165
Wed Nov 27 05:31:15 2013
AP's Interface:1(802.11a) Operation State Down: Base Radio   MAC:a4:18:75:eb:da:b0 Cause=New Discovery Status:NA
166
Wed Nov 27 05:31:15 2013
AP's Interface:0(802.11b) Operation State Down: Base Radio   MAC:a4:18:75:eb:da:b0 Cause=New Discovery Status:NA
167
Wed Nov 27 05:28:26 2013
MFP Anomaly Detected - 35 Not encrypted event(s) found as   violated by the radio d8:24:bd:2f:df:6f and detected by the dot11 interface   at slot 1 of AP d8:24:bd:2f:df:60 in 300 seconds when observing Deauth.   Client's last source mac 00:23:14:a7:e3:54
168
Wed Nov 27 05:23:26 2013
MFP Anomaly Detected - 23 Not encrypted event(s) found as   violated by the radio f8:4f:57:a5:40:b2 and detected by the dot11 interface   at slot 0 of AP f8:4f:57:a5:40:b0 in 300 seconds when observing . Client's   last source mac 44:4c:0c:ba:27:77
Don´t know at the moment how to handle it.
Regards
Alex

Hi lAlex,
Disable Client MFP under WLAN advanced tab & see if this still occur
Regards
Rasika
**** Pls rate all useful responses *****

[Solved] Must launch gparted as root

Not sure what update caused this, but when I click on my gparted icon on the menu in GNOME, it doesn't launch. If I run from the terminal to see what's happening, I get this output:
╭─[jowilkin::theflash::~]
╰─[04:44:02]> gparted
Inhibit all polling failed: Only uid 0 is authorized to inhibit the daemon
If I run with sudo, it works fine. I used to be able to launch with the menu icon, I don't remember if it brought up a gksudo prompt for root password or something, but it worked. What changed?
I'm also having an issue with unetbootin (installed with yaourt from aur)e that I think may be related. When I click on its icon on the GNOME menu, instead of launching unetbootin, it opens a root terminal and prompts for the root password. If I enter the root password, it simply brings me to a root bash shell, it doesn't launch unetbootin...
Last edited by jowilkin (2009-12-18 05:47:35)

Thanks ghost, that's what I was thinking too. I'm wondering why gparted installs like this as it is present in the extra repo, why don't others have this issue as well?
After adding gksudo, gparted runs just fine, but Unetbootin is still having issues. When I click the menu icon a terminal opens and then a small gui opens called "Run program" which has one text box called "Run:" and and then a dropdown menu called "As user:" which has all my users on it. If I type the same command from the terminal (gksudo /usr/sbin/unetbootin), unetbootin is successfully launched...

Interesting performance anomaly during video encode

I just noticed an interesting anomaly while my iDVD6 project was encoding video. I found that if I cover up the 'Creating Your DVD' progress bar and preview window with a Finder window, that video encoding seems to move a whole lot faster. I could tell by listening to the disk activity which seemed to be occurring about twice as fast. When I moved the Finder window away and exposed progress bar/preview window, then disk activity slowed down.
I opened Activity Monitor and looked at CPU% which showed about 70-80% with progress bar/preview window exposed. After covering up, the CPU% increased from 125-150% So apparently exposing progress bar/preview window slows things down quite a bit during video encode. I tried same trick during audio encode, and it made no difference. CPU% was about 7-8% during audio encode.
I was wondering if anyone in this discussion group noticed this performance anomaly previously.
Paul

Hi Paul
Yes I noted some relatively related phenomena during the rendering process
in FinalCutExpress that just selecting Finder seemed to speed things up.
Second: Please don't rely on the Activity monitor and most so when it says
iDVD doesn't answer. It's just rubisch. iDVD keeps on working - just wait and see.
Yours Bengt W

AP PHY Data Rate Anomaly

I did a scan using the airmagnet WiFi anaylizer and it informed me that the one of the alarms is the following AP PHY Data Rate Anomaly: APs are using data rates of 48M, 54,M which is not included in the user defined data that is allowed in the system. I checked the controller and I have both those data rates enabled?
Thanks

Thomas:
So the only problem you have is the AirMagnet alarm?
I never worked personally with AirMagnet but you better check the settings if there are defined data rates?
I think the message says the AP has 48 and 54 Mbps data rates enabled while the AirMagnet is not configured to allow those data rates.
Just an idea. hope it helps.
Amjad

Anomaly detection using ODM

I was asked the following question:
"My question is very simply, we are doing a monitoring system for a
website that helps the admin to mine on specific data (using ODM to
produce Web mining) so we want to apply the anomaly detection. We dont
know what we should do and what we should produce as a results."
A couple of suggestions come to mind:
1) For an overall discussion of intrusion detection in general using the Oracle RDBMS as an analytical platform the following paper might be useful:
http://www.oracle.com/technology/products/bi/odm/pdf/odm_based_intrusion_detection_paper_1205.pdf
2) A couple of things to think about and do:
(a) Define what is the "mining case", that is, the "object that defines what is the concept you want to mine. For example, in web mine you may want to detect anomalous session activity. This can be defined over the whole activity of a session or over time windows. In the first case each session will define a mining case (it will be a row in the training data). In the second case each section will generate many mining cases, one per time window. Let's assume for sake of discussion that the goal is to identify anomalous session activity. Then the training data will consist of the session activities (e.g., clicks, pages visited, and/or information from forms; or more generally, http requests). There will be one row per session in the training data. If we know beforehand that some of those sessions where intrusion or anomalous in some sense we can also capture this data as a target for supervised modeling.
(b) Decide what modeling to do. Two types of modeling can be performed (see the paper above for examples):
(i) Supervised modeling - case there are examples of anomalous cases as well as normal cases
This can be done by building a classifier on the training data. It is also possible to measure the quality of the classifier on a held aside sample.
(ii) Unsupervised modeling - this should be done as well even if we can create a supervised model
Unsupervised approaches don't provide a measure that indicates how good the model is at predicting anomalous events. These models are better at ranking cases by how anomalous the model believe they are.
Two common unsupervised techniques for anomaly detection are: Clustering and One-Class SVM. The latter is considered a state-of-art in many problem domains and it is the one implemented by ODM. ODM also has clustering but it does not return distance of a row to the center of cluster. This information is necessary for using it clustering for anomaly detection. If one wants to use clustering, the Oracle Data Mining blog has a post that can help compute distance from rows to centroids:
http://oracledmt.blogspot.com/2006/07/finding-most-typical-record-in-group.html
It is important to note that the method described in the post doesn't support nested column attributes.
When building unsupervised models, only the data for normal cases should be used to training the models. The unsupervised models can be seen as defining what is normal. It will recognize that something is anomalous when it does not match the definition of normality learned by the model.
(c) Use ODMR to help with modeling
(d) As new session information is gathered it is possible to score in real-time the session to detect anomalous behavior. One should score both supervised (if information was available) and unsupervised models to detect anomalous behavior. See the above paper for some discussion on this.
The supervised model will indicate if a case is anomalous or not based on known types of anomalous behavior. One should use ROC tuning in ODMR to find a good operating point for the model. This is necessary because the number of anomalous cases is usually small compared to normal ones.
The unsupervised model (one-class SVM) will provide a ranking. The higher the probability of belonging to class 1 the more normal. A 0.5 probability for class 1 indicates the boundary between normal and not normal. In reality it marks a boundary where normality dominates. There can be some anomalous cases with probability higher than 0.5 and some normal cases with probabilities less than 0.5. If working in batch mode we can rank the probabilities in ascending order and select the first K rows for investigation.
--Marcos

A suggestion to speed up the process: provide more information about your data (e.g., schema) and how you are invoking the algorithm (GUI, API, settings). Case you are using the APIs, have you tried the sample programs for anomaly detection?
Regarding the Apriori algorithm it does not support timestamps and dates columns. In fact, none of the algorithms in ODM does (see the documentation for Oracle Data Mining for the supported column data types). the dbms_predictive_analytics package does. Are you trying to do sequential association rules or just trying to do plain association rules using data from a date column? ODM does not support the former. The latter can be done by converting the date column to a VARCHAR or NUMBER column.
--Marcos

HOWTO: Resize Bootcamp (NTFS) partition for free using gparted

Hi,
Well, if you find your Bootcamp/NTFS/Windows partition running out of space, you may want to increase it or decrease it. The OSX Bootcamp utility doesn't allow resizing the NTFS partitio nor does Disk Utility. Here is a free solution ...
NOTE: I've tried this on Windows 7 64bit, but it should work with other windows setups in a similar manner.
Requirements:
1. SysRescueCD (for an NTFS capable 'gparted')
- http://www.sysresccd.org/Download
2. rEFIt bootable CD (or install to hard disk, doesn't matter)
- http://refit.sourceforge.net/doc/c1s5_burning.html
3. Windows XP/Vista/7 CD (depends what you've installed)
- just for a quick 'repair' at the end, no reinstall here!
In short:
1 Shrink Mac partition in OSX's Disk Utility
2 Grow the NTFS partition in gparted booting off sysrescue CD (reboot->option key). This may take 30mins to a few hours to complete!
3 Boot the rEFIt CD -> choose "start partitioning tool" -> hit yes when it says it needs to sync the MBR with the GPT.
4 Boot your Windows CD.
Vista/Windows7 CD -> hit the repair option to fix the boot record.
XP CD -> you may need to go to the administrative shell and type fixboot and then fixmbr.
5. Reboot and you should be able to boot into Windows via the option key as before. I liked rEFIt a lot so I installed it to my disk itself. (FYI, I did notice I needed to install rEFIt a few times to get it to show up during boot time)
Message was edited by: SidOnline

One bug I learnt:
if
1. you set the 'boot' flag on the Windows partition in gparted AND
2. you use gptsync to sync the GPT with the MBR (i.e. MBR->GPT translation)
then
you will find that your Windows partition becomes inaccessible in OS X. Your partition is OK - you can boot in windows etc - OS X just doesn't see it as a NTFS partition.
Solution:
1. Don't enable the boot flag in gparted. Simple, no need to read further.
If you're done it and have been hit by the bug and would like to see Windows/Bootcamp again in Finder, read on...
1. Goto http://www.insanelymac.com/forum/index.php?showtopic=31562, post #9 has a tool to fix it. Download the diskpart.zip file (it's got diskpart.efi)
2. Extract the diskpart.zip file, copy the diskpart.efi to /efi/tools on your OSX volume (default location for hard disk install of rEFIt).
3. Reboot, in the rEFIt menu, select the EFI terminal
4. type fs1: and hit enter. This should take you to your Leopard volume (for me fs0: was the 1st partition (EFI boot partition), fs1: was the 2nd partition (Leopard)
5. type _cd /efi/tools_ and hit enter
6. type diskpart and hit enter
7. As the post linked above says, type
+select <zero-based disk number>+
inspect
+chtype <zero-based partition number> MSDATA+
For me this was
+select 0+
inspect
+chtype 2 MSDATA+
Look at the output of select to make sure you're using the right number - if you have your eyes open it's hard to make a mistake!
Behind the scene details:
Your partition type is set to NTFS in the MBR table (which is why windows can load it up etc) but if you do the above then the partition type in the GPT is written as EFI instead of NTFS (or more accurately 'MSDATA'). This is a bug in gptsync and I believe Chris (writer of rEFIt) is aware of this - at least another post elsewhere made it look like that. I guess you can't blame it since EFI, GPT tools are still in their infancy.
BTW, to sync the GPT with the MBR, there is a tool gptsync. I believe it's a tool from Intel's EFI toobox. It exists as either an efi program (i.e. gptsync.efi, runs when you select it from rEFIt's menu) or as a OSX program (just gptsync, runs when you download it and type 'sudo gptsync').

Keynote to pdf size anomaly

I recently made a small Keynote presentation of just 12 slides, each with a photograph and some minimal text. The size of the doc is 1.8mb. I then exported as a pdf twice.
When I exported as quality ‘good’, the resulting pdf was 3.4mb.
When I exported as quality ‘best’, the resulting pdf was 1.8mb.
Any clues as to the anomaly?
Thanks
Graham

In what can only be a triumph of bad luck I have a medical poster (audit) to submit to the university tomorrow morning and up until tonight have made a number of changes and exported to PDF every time with no problems. I just decided to delete a pretty irrelevant bullet point and then export to send it to the uni. All images and tables within the poster are fine but the text has become pretty dire. Its illegible at best and just plain messy - its helvetica neue but looks more like comic sans in the export. Luckily I have iwork 09 on my MBP as well so am just going to continue from there but its really odd that this should happen now.
I have exported the same file on my MBP and its perfect but still not on the imac. Other files are exporting ok although I am now noticing colour changes etc. Up until tonight nothing was wrong with keynote or preview? at all.
Time machine did something odd today as I changed my external back up to a G drive (not sure if thats even relevant but just a thought - I'm not really tech savvy)
Has anyone got any further with this problem?

Gparted doesn't ask for password (SOLVED)

hi!
after a fresh reinstall of arch, when trying to start gparted, it doesn't ask me for root password. It simply says morelees that "gparted is potentially dangerous, and that i must be root". OK. But, in the previous arch installation, gparted, asked me for root password. and now no, why not?
In "privilige granting", su is selected, and it seems to work, as, for example, running "root terminal" it asks me for root password.
Thanks!
SOLUTION: With the menu editor in gnome, i changed the default command to "gksu -l /usr/sbin/gparted", i now, it promps for the root password. Thanks anyway!
Last edited by dienadel (2009-09-18 18:06:56)

SEB-APPSTORE,
I had a similar issue this how I dealt with it.
older version it may be creating problems. (they just did this starting 6/10)
WRITE DOWN ALL INFO IN ALL EDITABLE PANES IN CASE NEEDED LATER
I had this issue with passwords before and I first went and changes the password with the ESP, then I went to keychain access, passwords category, there you should see 2 mail entries imap. mail.xxxx..., and another with your email @ xxxx....
They should say application under kind column
Double click one one of them to open, then click show password, it will prompt you for the admin password, and probably again with user as well as password. Enter that info and it should show you the password, delete the password and re-enter to match the web based mail password, click save.
Repeat this for the other one, basically the same drill as above.
Then launch mail and sent something to yourself, like test, it may now prompt you for your password, enter it and click remember in my keychain, then click get mail it may a minute or two for the server to pass it along but it should come.
It took me a while to remember this, as I did it quite some time ago, when my esp changed the mail, previously.
Hope this helps

How to test anomaly detection in IPS6 ?

Hi!
Does anybody have experience with AD in IPS6? I tried to test it today with 3 nmap sessions each scanning 100 different IPs. I saw the Sig 13003-0 (single scanner) fired:
signature: description=AD - External TCP Scanner id=13003 version=S262
alertDetails: . adExtraData: numDestIps=150; currentThreshold=150; destPort=80
The scanner threshold was indeed set to 150:
S1# sh ad-knowledge-base vs0 thresholds current
External Zone
TCP Services
Default
Scanner Threshold
User Configuration = 150
Threshold Histogram - User Configuration
Low = 10
Medium = 3
High = 1
UDP Services
This is ok. The problem is that the Sig 13003-1 (warm) didn't fire, however the number of scanned IPs was very high:
S1# sh statistics anomaly-detection vs0
Statistics for Virtual Sensor vs0
Attack in progress
Detection - ON
Learning - OFF
Next KB rotation at 10:00:00 MSK Fri Dec 28 2007
Internal Zone
TCP Protocol
UDP Protocol
Other Protocol
External Zone
TCP Protocol
Service 80
Source IP: 10.0.1.1 Num Dest IP: 280
Questions:
- what does Low/Medium/High exactly mean in threshold histogram?
- how does the sensor detect worms? When the Sig 13003-1 fires? What sequence of events should happen?
- how can I test it?

The sensor constantly watches for scanners on each port.
There are 3 categories of scanners:
Low scanners - scanners that are only scanning a low number of hosts.
Medium scanners - scanners that are scanning a medium number of hosts
High scanners - scanners that are scanning a high number of hosts
NOTE: I can't remember for sure how many hosts must be scanned for it to be a "Low" number of hosts, or "Medium" or "High". But it may be something like 5 hosts scanned is a "Low" scanner, 20 for Medium and 100 for High. Once again I am not sure of those numbers.
Also be aware that the number of hosts scanned is not the Total numner of hosts scanned, but is instead the number of hosts scanned THAT did not respond.
If you connect to 100 web servers and all web servers respond then it does not count that as a scan. If you try to connect to 100 web servers and 92 respond, then for the 8 that don't respond you would be categorized as a Low scanner.
But just because a scanner is counted in a category does not mean an alert will be generated.
There are 2 types of alerts (subsig 0 alerts, and subsig 1 alerts)
Subsig 0 alerts are for a scanner that is scanning enough hosts that you want an alert for it even when no worm has been declared.
This is the "scanner Threshold / User Configuration = 150" that you see in the "show ad-knowledge-base vs0 thresholds current" output.
If a scanner scans more than 150 hosts then a specific alert is generated even though no worm has been declared.
Any scanners scanning less than 150 hosts are still categorized but do not have alerts generated for them when no worm has been declared.
The subsig 1 alerts are for when a Worm has been declared.
Here is how a worm gets declared:
The Thesholds for Low, Medium, and High that you see in "show ad-knowledge-base vs0 thresholds current" is the number of active scanners in each category that are allowed to normally be seen on your network (this is the number of scanners that will be seen on your network even when there are no worms).
A worm gets declared when the number of scanners in any one of the 3 catgeories goes above the threshold for that category.
Let's take for example Medium=3 as the threshold for port 21. And let's assume it takes a scan of 20 hosts to be categorized as a Medium scanner.
This means normally you could have up to 3 scanners on your network where each scanner is scanning 20 or more non-responding hosts on port 21.
(Maybe these are 3 network administrators periodically checking to see which machines have port 21 open)
Suddenly you have 5 scanners that start scanning on port 21 and each of the 5 winds up with 20 or more non-responding hosts.
That 5 has broken the threshold of 3, and a worm is declared. Now any Medium Category scanner on port 21 will begin being declared a scanner under a worm condition (subsig 1).
So for your testing.
Instead of running a scan of 100 hosts from just one machine, I would recommend you scan the same 100 hosts from 2 or 3 machines (NOTE: Only need to scan a single port across those 100 hosts).
Scanning 100 hosts should get them categorized as High scanners. And having 3 High Scanners should push it over the threshold of 1.
BUT keep in mind that it needs to be 100 hosts not responding on the scanned port.
Then you will also want to try it with fewer hosts being scanned (like say 25), but with say 5 machines running nmap doing the scanning.

Anomaly in gparted

Similar Messages

Maybe you are looking for