Pkginfo for Zones

I was looking into the features of solaris 10 , and trying out different scenarios. I managed to compile bochs in a zone, and run a Virtual Machine with DOS in the Zone. It worked, the emulation was verry slow, but it worked. I installed the gnu C++ compiler in the global zone. The compiler was available in the created zone, but did not appear with the pkg name. OK this is according to the manual.
My question now, since the Zone concept is supposed to help me manage n computers as 1, and a Zone is a secure aplication environment, I think that there should be a way to update the pkg information in the Zone. I could also Imagine to update for example the gnu compiler in the global zone, to have all the zones use the updated gnu compiler. And Yes, they will use the new gnu compiler, but depending on the zone creation time, I would see with "pkginfo gcc" , either the old version, either nothing, or the new version .
what is the concept for this ?
It is more likely , that all the software should be installed in the global zone, while in the individual Zones the software should be either used directly, or just configured to be used. That is in my oppinion the big advantage in using zones.

When a directory from the global zone is "exported" into a local zone using
an "inherit-pkg-dir" resource, the package meta-information is also
replicated in the local zone being constructed. So in the case you specified,
a user typing "pkginfo gcc" (if that's the package name) would get a successful
response within the local zone.

Similar Messages

Authentication failure for zone 1 error

We did some cleanup of old user accounts in our edir tree and after that I noticed a whole bunch of error messages on our catalina.out file. Problem is the error message does not specify what account it is looking for so I do not know what account I need to restore/recreate. Vibe seems to be working okay so I'm not sure what is broken with this account missing. Error message reads:
2014-01-18 18:38:02,429 WARN [http-8443-55] [org.kablink.teaming.module.authentication.impl.Aut henticationModuleImpl] - Authentication failure for zone 1: org.springframework.security.userdetails.UsernameN otFoundException: User account disabled or deleted; nested exception is org.kablink.teaming.security.authentication.UserAc countNotActiveException: This account has been disabled or deleted.
We are running on Vibe 3.4.0. Any help in identifying the account needed would be much appreciated.
Thank you,
Ronnie

This looks okay. An authFail indicates that someone is polling this device with the wrong community string. Check x.x.x.x to make sure there aren't any applications polling this device with wrong credentials.
Something else to note is that you should not be using '@' in your community strings. While this shouldn't really matter for routers, it's a good rule of thumb not to use '@' on Cisco devices as that character is reserved for community string indexing.

Kernel parameter for zones

Hi everybody,
I trying to install Oracle Application server in solaris native zone. I am getting the following error " Oracle application Server 10g Web Cache requires the kernel parameter rlim_fd_max to be set to a valuse of 65536 or higher. Please set rlim_fs_max to 65536 or higher , reboot the machine asn restart the installation.
but the value is already set to same value
$ ulimit -Hn
65536
Any idea how set this value for zone ?
Thanks
John

Sorry, doubled response
Edited by: brusell on Jun 10, 2010 4:24 AM

Firewall ports for Zone Sharing and Subscription?

Hi again!
What firewall ports need to be open for Zone Sharing and Subscription?...

Hello,
we updated from 11.3.1 to 11.3.2
Now i can not run the command chkconfig -a novell-proxydhcp to set the proxydhcp to autorun because i get...

Dumpadm not applicable for zones?

i run a zone and tried to configure the dumpdevice. unfortunately it didn't work because there is no /dev/dump device in the zone:
# dumpadm -d swap
dumpadm: failed to open /dev/dump: No such file or directory
# dumpadm
dumpadm: failed to open /dev/dump: No such file or directory
# ls /dev/dump
/dev/dump: No such file or directory
is there any way to correct this or is this intended behaviour and dumpadm is not intended to be used in zones?
regards,
-martin

dumpadm is not intended for zones.
The kernel is a zone is only a virtual kernel it can't crashdump.
If the kernel crashes, it will be the global zone and it will take down all the zones.

No add on for zone alarm

Hello, there is no add on for Zone Alarm Extreme Security!
Why is this?
Was very useful. Gone back to IE 9, as this browser supports this.
Thanks, Burlingandmending.

http://www.roboform.com/download
http://www.roboform.com/support/news
Why downgrade when Roboform got their act together and now supports Firefox 7.0

Crash recovery for zones

hi,
What's the best way for crash recovery for zones?
Thanks,
Rosario

there are some recipes using the snapshot feature of ZFS systems. I tried a solution for non ZFS filesystems:
to backup:
df -F nfs | sed "s/ .*//" > /tmp/excludes # this excludes NFS mounted filesystems
find /$zonepath/$zonename -fstype lofs -prune 2> /dev/null | sed "s/^\/$zonepath\///">> /tmp/excludes # this exclude LOFS mounted filesystems
echo "$zonename/root/proc" >> /tmp/excludes
echo "$zonename/root/var/run" >> /tmp/excludes
echo "$zonename/root/system/contract/all" >> /tmp/excludes
echo "$zonename/root/system/contract/process" >> /tmp/excludes
echo "$zonename/root/etc/mnttab" >> /tmp/excludes
echo "$zonename/root/etc/svc/volatile" >> /tmp/excludes
echo "$zonename/root/system/object" >> /tmp/excludes
echo "$zonename/root/tmp" >> /tmp/excludes
echo "$zonename/root/var/svc/log" >> /tmp/excludes
echo "$zonename/root/var/log/syslog*" >> /tmp/excludes
echo "$zonename/root/var/saf/zsmon/log" >> /tmp/excludes
echo "$zonename/root/var/adm/messages*" >> /tmp/excludes
echo "$zonename/root/var/adm/wtmpx" >> /tmp/excludes
echo "$zonename/root/etc/svc/volatile/repository_door" >> /tmp/excludes
echo "$zonename/root/tmp/.X11-unix/X0" >> /tmp/excludes
echo "$zonename/dev/.devfsadm_synch_door" >> /tmp/excludes
cd /$zonepath
tar -EcfX /$somepath/$zonename.tar /tmp/excludes $zonename 2> /tmp/$zonename.err
to restore:
extract tar
mkdir of all mount points
mkdir for all dynamic data (i.e. $zonename/root/proc), assigning correct permissions&ownership
create files for all dynamic data (i.e. $zonename/root/etc/mnttab), assigning correct permissions&ownership
this solution requires that the backed up machine, and the restored one, to have the same OS level and patches

Syslog logging for zone.cpu-shares ???

Hi,
I have defined two zones (zone1 and zone2) and set zone.cpu-shares in global zone.
I've set also global state for zone.cpu-shares for logging.
The questions is why I do not get any messagess in "/var/adm/messges.warning" when some zone use more cpu-shares than defined.??
Configuration follows:
root@sol10test# prctl -i zone 0 1 2
zone: 0: global
zone.cpu-shares
        privileged         20       -   none                                 -
        system          65.5K     max   none                                 -
zone: 1: zone2
NAME    PRIVILEGE       VALUE    FLAG   ACTION                       RECIPIENT
zone.cpu-shares
        privileged         10       -   none                                 -
        system          65.5K     max   none                                 -
zone: 2: zone1
NAME    PRIVILEGE       VALUE    FLAG   ACTION                       RECIPIENT
zone.cpu-shares
        privileged         70       -   none                                 -
        system          65.5K     max   none                                 -
root@sol10test# rctladm
zone.cpu-shares             syslog=warning [ no-basic no-deny no-signal count ]
root@sol10test# cat /etc/syslog.conf
*.warning                                       /var/adm/messages.warning
...P.S. does not work with syslog=notice either :((

Hi,
I have defined two zones (zone1 and zone2) and set zone.cpu-shares in global zone.
I've set also global state for zone.cpu-shares for logging.
The questions is why I do not get any messagess in "/var/adm/messges.warning" when some zone use more cpu-shares than defined.??
Configuration follows:
root@sol10test# prctl -i zone 0 1 2
zone: 0: global
zone.cpu-shares
        privileged         20       -   none                                 -
        system          65.5K     max   none                                 -
zone: 1: zone2
NAME    PRIVILEGE       VALUE    FLAG   ACTION                       RECIPIENT
zone.cpu-shares
        privileged         10       -   none                                 -
        system          65.5K     max   none                                 -
zone: 2: zone1
NAME    PRIVILEGE       VALUE    FLAG   ACTION                       RECIPIENT
zone.cpu-shares
        privileged         70       -   none                                 -
        system          65.5K     max   none                                 -
root@sol10test# rctladm
zone.cpu-shares             syslog=warning [ no-basic no-deny no-signal count ]
root@sol10test# cat /etc/syslog.conf
*.warning                                       /var/adm/messages.warning
...P.S. does not work with syslog=notice either :((

Updating memory capping for zones in default pool.

Updating memory capping for zones in default pool. Has anyone else run into this where the items for physical/locked/shared memory and swap for zones within the default pool are not changeable? Is this a known bug or feature?
After moving a zone from the default pool to a user created pool, update these values and then move back to the default pool, I find that I am at that point able to update these values for zones in the default pool now?
Anyone else hitting this?

Is it a full zone or a sparse zone?
prstat doesn't really understand everything that's going on. Its numbers are not accurate when pages are shared (very likely in a sparse zone).
Darren

Alternate Access Mapping not working for Zone : Intranet

One of our client want to set Alternate Access Mappint (intranet) with url "intranet.theirDomain.com" with local IP address.
is it possible?
subsequest to my previous question (
http://social.technet.microsoft.com/Forums/sharepoint/en-US/3f39711e-301a-40e8-aa7a-855fa2c268b1/alternate-access-mapping-not-working?forum=sharepointadmin )
I want to ask one more question
Can we configure "intranet.theirDomain.com" with local IP address for any other zone?
or
If there is ".com" within the url then it can't be configured for InTRAnet?
Thanks
S H A J A N

The names for the zones don't matter. You could use the 'extranet' zone for another intranet name if you wanted, the names are just to make it a bit more friendly for beginners.
What you describe sounds routine, you create a web application with a name, then use an AAM to allow users to access it with a more friendly name. Frequently you end up creating
http://intranet.domain.com and
http://intranet as an AAM, or vice versa.
You can use .com for an intranet site, you would need to add the site as an A Host record in your DNS server so that traffic is sent to your internal server rather than out into the wider world.

MODIFY and SAVE_TRANSACTION not working for ZONE BO

Hi
I am trying to add/delete location in transportation zone through MODIFY and SAVE_TRANSACTION but the update is not happening in database. I have done deletions and additions in other business objects but for transportation zone it is not working properly. Is something wrong with BO configuration ?
Procedure that I am following for deletion of zone:
1. Read Zone with querybyelements method
2. Read locations for this zone using retrieve_by_association method in edit mode
3. Fill modification table with deletion indicator and appropriate values for location
4. Call method Modify and then save_transaction.
I followed similar procedure for adding/deleting region in transportation zone but this also doesn't work.
Thanks
Anuraag

Hi Anuraag,
In TM you should open the transaction /SCMTMS/ZONE. Here you select the zone you would like to modify and you execute the changes you would like to make.
Regards,
Nico.

Resource for zones

Hello,
I've four zones running on PrimePower650 server (8xCPU, 64GB RAM).
All of them are only for developers (different instances of oracle 10g).
Zone config is as minimal as it can be: only shared network (the same interface on global) and FSS enabled.
Should I use some elements from resource control (capped mem and capped cpu) for each zone? 10 minutes ago it was impossible to log-in into global zone (prompt hangs after providing valid pass). When I logged in zone-04 (root@zone-04# poweroff ;)), and turned it off - prompt in global zone began to respond. That's why I think it could be something with resources.
Regards

Welcome to the Boards
This should help
http://dvdstepbystep.com/useelements.php - in some versions the templates may have moved to the Application Support Folder (do a search for .dsptemplate and you can find the path if they have moved outside the application itself, depends on DVD SP version)
You can make you own overlays and menus also, usually you would compile the items outside of DVD SP for best results (in Motion/Photoshop/Final Cut etc.)
http://dvdstepbystep.com/motion.php
http://dvdstepbystep.com/newmap.php

Cannot save configuration for zone files

I'm migrating from 10.3 to 10.4.9. The 10.4.9 system is on a new hard drive so it is a fresh install. I have no problem setting up the BIND config manually from the command line but I like to use Server Admin to start and stop the server. When I noticed I was having problems resolving my servers domain/subdomains, I used Server Admin to take a look at what was going on.
The problem I seem to be encountering is that Server Admin shows that the zones exist but it does not display any of the zone data in the window to the right of the zone list. I did a quick check on the zone files and found them to be configured correctly. When I tried to edit and then save the configuration using the Server Admin GUI I receive an error telling me that the zone had no name and that the configuration could not be saved.
Just to test things out a little bit, I dragged the DNS configuration file from the 10.3 config from the Server Admin Applition, rebooted the system back into 10.4, and dropped that configuration back onto the application window. After this process I can see the zone data in the right hand window but when I click the save button I receive the same error.
My only reference for 10.4 is the Apple Training Series: Mac OS X Server Essentials which describes the Server Admin GUI for the DNS functions and the associated files in a manner that I am familiar with but which are significantly different then what is actually appearing in the Server Admin application for 10.4.9.
Does anyone know what could possibly be wrong?
Thanks
XServe G4 Mac OS X (10.4.8)

Unfortunately, there are a number of flaws with the Server Admin DNS tool that absolutely require you to modify the files manual. For instance, you cannot properly set up MX records is the zone you are working on is NOT responsible for the mail server. In other words, you can't set up MX records. Also, the name server text fields are bugged in a way that makes it extremely difficult to add more then one name server. The tool is useless until these problems are fixed.
Basically, as you said, I used the dns tool to set up the files, then edited them manually in order to get them into a functional state. I just have to make sure that I don't ever use the tool to edit the configuration as it will blow away any changes that were made manually.
FYI The Server Admin web tool for Apache is also just as annoying, deleting data that has been added manually.

Software Installs for Zones - Best Practices

I haven't found anything in the documentation on this subject yet. I'm wondering what the best way is to install software for non global zones. Let's take a simple setup say a webserver and a database and I want them in separate non global zones. I would like to use sparse root zones and have my software in /usr/local. The problem is that if I add the software in the global zone /usr/local, the Web server zone has access to my DB install in /usr/local. I know i will be putting the data else where but I would rather not have that binary accessible. Is that possible? These are not package installs. They are binary distributions. Glassfish and Postgres.
If anyone has any answers or input it would be much appreciated.

We are using zones as part of a whole security solution. I don't see installing whole root zones as a solution. I may as well create another Solaris 10 server in that case since we are in a VM cluster anyways.
I was able to find some documentation on this subject and there is a more sensible solution to this that makes more sense and applies to using sparse root zones.
Let's say you want to have each child zone have its own writable /usr/local directory. First create the /usr/local directory within the global zone. Next add a file system to the zone configuration. Let say your zones are in /zones. You have zone1 and zone2. So create the /zones/zone1/local directory with 700 permissions. In the zone config you set the fs special to that directory and the dir to /usr/local. Give it rw,nodevices for options. Now zone1 has its own writable /usr/local that zone2 cannot access.

Guide Line for zone resources control

Hi,
i'm looking for guide line or best practices about zone resource control, especially cpu-shares, swap and RAM.
I need this information to make decision when customers has no idea but has a lot of zone configured.
For example:
t2000, 32gb ram, 32gb swap and 20 zones
Applications run only in zones.
How can I set cpu-shares, max-swap and capped memory just for security purpose?
Thanks

I'm of the opinion that the safest strategy for proactive resource management is CPU only. Playing with memory can have some effects that I'm not crazy about. Nothing unmanageable, but it can really confuse end-users unless you spend a lot of time educating them. The other consideration is that behind most resource pulls are increases in CPU use. Not always, but a lot of the time. So, if you must be proactive, go with CPU.
The best practice will depend heavily on your environment. Do you migrate zone containers in and out of the box often? Are the apps very similar or wildly differing? Many things need to be decided before mapping out a strategy. Let's take a simple case: Fairly similar apps that don't move in and out often. Figure out what percentage of the box you want each to have, then set up dynamic resource pools to match this model.
If you have a lot of zones and some degree of change, dynamic pools can get unwieldy, so you may prefer using the Fair share scehduler (FSS). In many cases however, proactive use of SRM means that you need to rebalance resources when you add/remove a zone.
I think once you understand the various resource controls available to you it's best to just make a bunch of scribbles on a white board to depict what you want at a high level and then map it into a resource constraint that best implements it. The hard part is defining what you want.

Pkginfo for Zones

Similar Messages

Maybe you are looking for