Syed Jahanzaib Personal Blog to Share Knowledge !

February 13, 2017

Windows Event-Viewer Logging to MYSQL

Filed under: Uncategorized — Syed Jahanzaib / Pinochio~:) @ 2:10 PM

out-of-the-box

In our small office environment, we are using Windows 2008 R2 Active Directory for user management/authentication and control purpose. Dueto some standard operating procedure I was asked to log User Account Creation / Removal events in Linux base mySQL DB. Since windows doesn’t provide option to directly export event into linux base mysql, therefore I made an workaround for it using specific windows events tagged with task scheduler approach. Not to mention , this approach of using task scheduler with events is not a new thing, but it was definitely a bit confusing for a numbnuts like ME on how to acquire only the very specific fields trimmed according to our taste and get it logged in remote linux mysql db. but Alhamdulillah I managed to get it in few hours struggling.

z@iB

Items I used in this post are …

  • Windows 2008 R2 server with Active Directory
  • c:\temp folder to hold temporary information for the triggered event
  • e:\userlog\ folder to hold all logs
  • Event ID which will be logged in local log file and mySQL DB [as required] :

    4720

    New User Account Created

    4726

    User Account Deleted
  • Two batch files which will be executed when specific event will occur.
  • Mysql (I used mysql-5.7.17-winx64.zip) package to add entries in mySQL DB name events 

You can download mysql-5.7.17-winx64.zip from fmy Google Drive at

mysql-5.7.17-winx64 by Syed Jahanzaib


New Account Batch File for LOG [ac-new-log.bat]

@echo off
set MYSQL_HOST=10.0.0.1
set MYSQL_ID=your_mysqlid
set MYSQL_PASS=your_password
set MYSQL_DB=your_events
set MYSQL_TB=your_table
set ACTION=Account Created
set HOLDER=c:\temp\acnew-temp.txt
set LOGFILE=e:\userlog\users-created-log.log
type nul > %HOLDER%
wevtutil qe security /rd:true /f:text /c:1 /q:"*[System/EventID=4720]" > %HOLDER%
for /f "tokens=4" %%a in ('type %HOLDER% ^| find /i "Account Name"') do set accname=%%a
for /f "tokens=3" %%a in ('type %HOLDER% ^| find /i "Event ID"') do set eventid=%%a
for /f "tokens=2" %%a in ('type %HOLDER% ^| find /i "Date"') do set dt=%%a
set HEADER=%eventid% : %accname% / %ACTION% @ ... %dt%
echo %HEADER%
echo %HEADER% >> %LOGFILE%
c:\mysql\bin\mysql -h %MYSQL_HOST% -u%MYSQL_ID% -p%MYSQL_PASS% -e "use %MYSQL_DB%; INSERT INTO %MYSQL_TB% (eventid,type,account,msg) VALUES ('%eventid%','%ACTION
%','%accname%','%HEADER%');" 

Account Delete Batch File for LOG [ac-del-log.bat]

@echo off
set MYSQL_HOST=10.0.0.1
set MYSQL_ID=MY_ID
set MYSQL_PASS=MY_PASS
set MYSQL_DB=DB
set MYSQL_TB=TABLE
set ACTION=Account Deleted
set HOLDER=c:\temp\acdel-temp.txt
set LOGFILE=e:\userlog\users-deleted-log.log
type nul > %HOLDER%
wevtutil qe security /rd:true /f:text /c:1 /q:"*[System/EventID=4726]" > %HOLDER%
for /f "tokens=3" %%a in ('type %HOLDER% ^| find /i "Account Name"') do set accname=%%a
for /f "tokens=3" %%a in ('type %HOLDER% ^| find /i "Event ID"') do set eventid=%%a
for /f "tokens=2" %%a in ('type %HOLDER% ^| find /i "Date"') do set dt=%%a
set HEADER=%eventid% : %accname% / %ACTION% @ ... %dt%
echo %HEADER%
echo %HEADER% >> %LOGFILE%
c:\mysql\bin\mysql -h %MYSQL_HOST% -u%MYSQL_ID% -p%MYSQL_PASS% -e "use %MYSQL_DB%; INSERT INTO %MYSQL_TB% (eventid,type,account,msg) VALUES ('%eventid%','%ACTION%','%accname%','%HEADER%');" 

Attaching Batch files with Specific Event ID

On Domain Controller, open event viewer, goto 4720 event, right click and select ‘Attach Task to This Event‘ and in trigger select your batch file. (for account creation)

As showed in the image below

1- accoutn creation - attach batch file via event viewer.png

1.5 - triggers.PNG

2- trigger action.PNG

Repeat same for event id 4726.

Ok to finish it.


Creating DB in mySQL

Now create a new DB with required name and tables in mySQL …

One example is as follows.

mydb.sql


;-- MySQL dump 10.13 Distrib 5.5.54, for debian-linux-gnu (i686)
--
-- Host: localhost Database: events
-- ------------------------------------------------------
-- Server version 5.5.54-0ubuntu0.12.04.1

/*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */;
/*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */;
/*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */;
/*!40101 SET NAMES utf8 */;
/*!40103 SET @OLD_TIME_ZONE=@@TIME_ZONE */;
/*!40103 SET TIME_ZONE='+00:00' */;
/*!40014 SET @OLD_UNIQUE_CHECKS=@@UNIQUE_CHECKS, UNIQUE_CHECKS=0 */;
/*!40014 SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0 */;
/*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' */;
/*!40111 SET @OLD_SQL_NOTES=@@SQL_NOTES, SQL_NOTES=0 */;

--
-- Table structure for table `mymaindb`
--

DROP TABLE IF EXISTS `mymaindb`;
/*!40101 SET @saved_cs_client = @@character_set_client */;
/*!40101 SET character_set_client = utf8 */;
CREATE TABLE `mymaindb` (
`id` bigint(20) NOT NULL AUTO_INCREMENT,
`datetime` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
`eventid` varchar(40) DEFAULT NULL,
`type` varchar(255) NOT NULL,
`account` varchar(255) NOT NULL,
`msg` varchar(10000) DEFAULT NULL,
PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=462 DEFAULT CHARSET=latin1;
/*!40101 SET character_set_client = @saved_cs_client */;

--
-- Dumping data for table `mymaindb`
--

LOCK TABLES `mymaindb` WRITE;
/*!40000 ALTER TABLE `mymaindb` DISABLE KEYS */;
INSERT INTO `mymaindb` VALUES (459,'2017-02-13 08:39:45','4720','Account Created','testing.act','4720 : testing.act / Account Created @ ... 2017-02-13T12:02:05.777'),(461,'2017-02-13 08:49:46','4726','Account Deleted','testing.act','4726 : testing.act / Account Deleted @ ... 2017-02-13T12:02:38.521');
/*!40000 ALTER TABLE `mymaindb` ENABLE KEYS */;
UNLOCK TABLES;
/*!40103 SET TIME_ZONE=@OLD_TIME_ZONE */;

/*!40101 SET SQL_MODE=@OLD_SQL_MODE */;
/*!40014 SET FOREIGN_KEY_CHECKS=@OLD_FOREIGN_KEY_CHECKS */;
/*!40014 SET UNIQUE_CHECKS=@OLD_UNIQUE_CHECKS */;
/*!40101 SET CHARACTER_SET_CLIENT=@OLD_CHARACTER_SET_CLIENT */;
/*!40101 SET CHARACTER_SET_RESULTS=@OLD_CHARACTER_SET_RESULTS */;
/*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */;
/*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */;

-- Dump completed on 2017-02-13 14:47:11

to import above DB , use following command …

mysql -uroot -pROOTPASS < mydb.sql

Script Result in CMD:

Now try to create/delete a user account in active directory, and you will see the result in mysql db.

I recommend to debug first, to make sure things are working ok, execute the bat file manually to see the results

ac-new-log.bat

script result.PNG

.

Script Result in mySQL DB :

[all above fuss was made just to acquire only specific data trimmed as per out taste, and get it logged in in remote linux mySQL otherwise task was very easy in general]

phpmyadmin snapshot

php-result

mysql cmd line snapshot


mysql> select * from MY_DB;
+-----+---------------------+---------+-----------------+-------------+--------------------------------------------------------------------+
| id | datetime | eventid | type | account | msg |
+-----+---------------------+---------+-----------------+-------------+--------------------------------------------------------------------+
| 459 | 2017-02-13 13:39:45 | 4720 | Account Created | testing.act | 4720 : testing.act / Account Created @ ... 2017-02-13 13:39:45 |
| 461 | 2017-02-13 13:49:46 | 4726 | Account Deleted | testing.act | 4726 : testing.act / Account Deleted @ ... 2017-02-13 13:39:45 |
+-----+---------------------+---------+-----------------+-------------+--------------------------------------------------------------------+
2 rows in set (0.00 sec)


This is a itty-bitty example only, on how you can build your own customized solution using out of the box approach !

Syed Jahanzaib

February 8, 2017

Windows 7 Error: 0x800704cf / Unable to Access remote network shared resources

Filed under: Uncategorized — Syed Jahanzaib / Pinochio~:) @ 2:10 PM

windows-cannot-access-shared-folder

fotolia_3115040_m_tile

Windows cannot access \\testpc
Error Code: 0x800704cf

If your system is a workstation joined with local domain controller and you are getting above (same) error while trying to access ANY shared resource/system on the network, then you may try following fix. This error gave me straight 1 hour headache, so I really don’t want anyone else to bang their head on the wall for the same.

Fix >     :~)

  • Open (Currently active) Network Adapter properties,
  • UNCHECK the ‘Client for microsoft Networks‘  / OK
  • Open Regedit, & Navigate to “HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NetBT\Parameters”
  • Create a new key with following parameters

Type: DWORD Value
Name: SMBDeviceEnabled
Data: 1

  • Once Done, Restart your computer, & MAKE SURE TO ENABLE THE ‘CLIENT FOR MICROSOFT NETWORK’ in the adapter settings.

Now check and hopefully you will be able to access the shared resources without any error.

TIP/Additional Commands

  • ipconfig /flushdns
  • nbtstat -RR
  • netsh int ip reset
  • netsh winsock reset

Regard’s
Syed Jahanzaib

January 6, 2017

Gathering Stats from remote Windows via Linux Shell

Filed under: Linux Related, Uncategorized — Tags: , , , , , , , — Syed Jahanzaib / Pinochio~:) @ 2:43 PM

Reference Post:

Following are few simple methods to query information for various instances like remote windows service status , performance monitor instance result with trimming , , execute commands on remote windows box , all being done from our beloved Linux boX 😉

I must admit that even after spending years in this field, I still feel myself very doodle, blockhead & light brain in almost every topic or subject I get confronted with ! STML plays an important role in my Deficiency  ‘_’    – 😉

ots1087__97717-1410905363-1280-1280


Executing command on remote windows server, and get its result in output

$WINEXE --user=$DOMAIN/$ADMINID%$ADMINPASS //$SERVERIP "C:\TEMP\COMMAND.EXE -syntax-if-any"

Note: above command requires WINEXE tool (Linux tools to execute command on remote windows)

Querying Remote Windows Performance Monitor Instances

Example, we have Forefront TMG 2010 and we want to see its Cache Hit % from our linux box shell, so we can use following command (It was real hard to escape nested double quotes :O )

This is very very useful command and it took few hours for me to trim the required result for plotting graph.

winexe -U domain/admin%"password" //MYSERVER 'typeperf -sc 1 -si 1 "\\MYSERVER\Forefront TMG Web Proxy\Cache Hit Ratio (%)"'

and with bash script I used it like

root@linux:/temp# cat tmg-cachehit.sh

#!/bin/bash
# Script to query TMG cache HIT after trimming
#set -x
IP="10.0.0.1"
DOMAIN="MYDOMIN"
ID="ADMIN"
PASS="PASSWORD"
TMP_HOLDER="/tmp/$IP.cache.hit.txt"
winexe -U $DOMAIN/$ID%"$PASS" //$IP 'typeperf -sc 1 -si 1 "\\101.11.11.6\Forefront TMG Web Proxy\Cache Hit Ratio (%)"' > $TMP_HOLDER
RESULT=`cat $TMP_HOLDER | sed -n 3p | awk '{print $2}' | cut -d "," -f 2 | tr -d '"' | cut -f1 -d"."`
echo $RESULT
echo $RESULT

Result:

tmg-cache-hit


Check remote windows service status

Example if we want to query service status result of Lotus domino mail server  from our linux box …

root@linux:/temp# net rpc service status "Lotus Domino Server (DLotusDominodata)" -I 10.0.0.1 --user=DOMAIN/ADMINID%PASSWORD

RESULT:

Lotus Domino Server (DLotusDominodata) service is running.
Configuration details:
Controls Accepted = 0x5
Service Type = 0x110
Start Type = 0x2
Error Control = 0x0
Tag ID = 0x0
Executable Path = "X:\Lotus\nservice.exe" "=X:\Lotus\notes.ini" "-jc" "-c"
Load Order Group =
Dependencies = /
Start Name = LocalSystem
Display Name = Lotus Domino Server (DLotusDominodata)

Allah Shuker


I used all above commands in various script for alerts and mrtg graphing. you can use it to fulfill any customized requirements.

Regard’s
Syed Jahanzaib

December 19, 2016

Incorrect key file for table ‘./conntrack/xxxx@xxxxxx@xxxxxx.MYI’; try to repair it

Filed under: Radius Manager, Uncategorized — Tags: , , — Syed Jahanzaib / Pinochio~:) @ 1:05 PM

corruption

Incorrect key file for table ‘./conntrack/2016@002d12@002d16.MYI’; try to repair it

If you see the above error while accessing Connection Tracking Reports in Radius Manager then …

Recommendations:

  • Make sure you aave plenty of Disk Space. Storage drive should be fast for high load servers preferably SSD or RAID based storage ,
  • Plenty of Memory is usually a good idea for DB systems ,
  • If its a heavy production server, try to move connection tracking to separate host as it takes lots of space and it adds good amount of payload to the CPU as well.
  • Perform tuning to enhance the mysql engine

To repair table …

Goto the conntrack folder [Ubuntu]
cd /var/lib/mysql/conntrack/
service mysql stop
# Change the file number as shown in the error 
myisamchk -r -v -f 2016@002d12@002d16.MYI

Once repair is done, start mysql / restart apache2 services , and test the desired tracking report again.

Regard’s
~Syed Jahanzaib~

December 15, 2016

Craziness with the MRTG along with BASH

Filed under: Linux Related, Uncategorized — Tags: , , , — Syed Jahanzaib / Pinochio~:) @ 9:16 AM

 


City vs Data Center Temperature !

Following is a temperature graph to compare difference between City temperature vs Data Center temperature. I made it for some local presentation purposes. Since I had no external sensor available for outside temperature monitoring, therefore I used external bash script to gather data from the internet using ‘Pakistan Meteorological Department PMD‘ website  and then after filtering , output only required data.  For NOC I used internal UPS sensor snmp query.

http://www.pmd.gov.pk/FFD/cp/pcurrenttemp.asp

1-noc-vs-karachi-temperature

 

 

#cat /temp/weather.sh


#!/bin/sh
#set -x
# Script to download KARACHI city temperature from Pakistan MET Dept web site &nbsp;and output only temperature related information
# It will also query the NCO room temperature using UPS sensor via snmp query
# I made this script to create City temperature vs NOC temperature comparison MRTG graph
# Created : 9th-DEC-2016
# Syed Jahanzaib
# aacable[at]hotmail[dot]com
# http://aacableDOTwordpressDOTcom

####### Various Variables #########

# City temperature temporary holders in /tmp folder
CITY_TEMPR_HOLDER="/tmp/khiweather.txt"
CITY_TEMPR_4_OFFLINE="/tmp/khiweather_offline.txt"
# Variables for UPS IP and SNMP community string. It ilwl be used to acquire data center temperature using UPS sensor
UPS_IP="10.0.0.10"
UPS_SNMP_STR="public"
# OID for temperature sensor using USP SNMP card/sendor
UPS_OID="1.3.6.1.4.1.13400.2.62.2.1.2.0"
URL="http://www.pmd.gov.pk/FFD/cp/pcurrenttemp.asp"

############################################################################
####### PART - 1 , DATA CENTER Temperature query via UPS SNMP enabled sensor
############################################################################

# Store DATA Center temperature queries result in buffer
NOC_TEMPR=`snmpwalk -v1 -c $UPS_SNMP_STR $UPS_IP -Onqv $UPS_OID`

# Divide stored buffer by 100 to get human readable format in Celsius
NOC_TEMPR_FINAL=`echo $(($NOC_TEMPR/100))`

# Validate if temperature is not valid, liek url not accessible, or other errors
# If error found, then PRINT ZERO 0 VALUE , else print the acquired result
NOC_TEMPR_FINAL_VALID=`echo ${#NOC_TEMPR_FINAL}`
if [ $NOC_TEMPR_FINAL_VALID -eq 2 ]; then
echo "$NOC_TEMPR_FINAL"
else
echo "0"
fi

###########################################################################
####### PART - 2 , QUERY KARACHI CITY TEMPERATURE FORM THE INTERNET
# USING PAKISTAN MET DEPt for KARACHI website, than TRIM THE RESULT #######
###########################################################################

CITY_TEMPR=`lynx -cache=1 -dump $URL &gt; $CITY_TEMPR_HOLDER`
CITY_TEMPR_VALUE=`grep -A 1 "Karachi" $CITY_TEMPR_HOLDER |sed '2q;d' | awk '{print $1}'`
CITY_TEMPR_VALID=`echo ${#CITY_TEMPR_VALUE}`

# Validate if temperature is not valid, like URL not accessible, OR other errors
# If error found, then PRINT last valid VALUE
if [ $CITY_TEMPR_VALID -eq 2 ]; then
#CITY_TEMPR_VALUE_FINAL=`echo $(($CITY_TEMPR_VALUE - 1))`
echo "$CITY_TEMPR_VALUE"
echo "$CITY_TEMPR_VALUE" &gt; $CITY_TEMPR_4_OFFLINE
else
cat $CITY_TEMPR_4_OFFLINE
fi

###################
####### END #######
###################


MRTG CFG file for weather

WorkDir:/var/www/mrtg
### MONITORING KARACHI Temprature vs our DATA Center ###
Target[KARACHI_CITY_vs_NOC_tempr]: `/temp/weather.sh`
Title[KARACHI_CITY_vs_NOC_tempr]: Temprature Monitoring / Data Center vs Karachi City using PAK MET Site by zaib
PageTop[KARACHI_CITY_vs_NOC_tempr]: &lt;h1&gt;Temprature Monitoring / Data Center vs Karachi City using PAK MET Site by zaib&lt;/h1&gt;
Options[KARACHI_CITY_vs_NOC_tempr]: gauge, growright, nopercent
MaxBytes[KARACHI_CITY_vs_NOC_tempr]: 60
Colours[KARACHI_CITY_vs_NOC_tempr]: B#467EEE,R#FF0000,BLUE#2184FF,RED#ff4f27
YLegend[KARACHI_CITY_vs_NOC_tempr]: Temprature
ShortLegend[KARACHI_CITY_vs_NOC_tempr]: c
LegendI[KARACHI_CITY_vs_NOC_tempr]: NOC Temprature
LegendO[KARACHI_CITY_vs_NOC_tempr]: City Temprature
Legend1[KARACHI_CITY_vs_NOC_tempr]: NOC Temprature
Legend2[KARACHI_CITY_vs_NOC_tempr]: City Temprature
#Unscaled[KARACHI_CITY_vs_NOC_tempr]: dwmy

 

 


Data Center Room Temperature & Humidity !

2-noc-tempr-vs-humidity

Above graph was made using Emerson Liebert UPS sensor using following OID’s and MRTG CFG

Temperature: 1.3.6.1.4.1.13400.2.62.2.1.2.0
Humidity: 1.3.6.1.4.1.13400.2.62.2.1.3.0


WorkDir:/var/www/mrtg
### MONITORING NOC ROOM TEMP ###
Target[noc_room_temp]: 1.3.6.1.4.1.13400.2.62.2.1.2.0&amp;1.3.6.1.4.1.13400.2.62.2.1.3.0:public@10.0.0.1 / 100
Options[noc_room_temp]: gauge, growright, nopercent
MaxBytes[noc_room_temp]: 100
Colours[noc_room_temp]: B#467EEE,R#FF0000,RED#ff4f27,DIRTY YELLOW#E6B420
#Unscaled[noc_room_temp]: dwmy
YLegend[noc_room_temp]: NOC Room Temprature/Humidity
Title[noc_room_temp]: NOC Room Tempr/Humidity
PageTop[noc_room_temp]: &lt;h1&gt;NOC Room Tempr/Humidity&lt;/h1&gt;
ShortLegend[noc_room_temp]: c/%
LegendI[noc_room_temp]: Temprature
LegendO[noc_room_temp]: Humidity
Legend1[noc_room_temp]: C NOC_Room Temp
Legend2[noc_room_temp]: Humidity


I will add more graphs later …

Regard’s

zaib!

July 28, 2016

Lotus Notes / Copy – Duplicating prohibtited

Filed under: IBM Related, Uncategorized — Tags: , , , — Syed Jahanzaib / Pinochio~:) @ 5:02 PM

pmail.jpg


In our company, we have IBM Lotus Domino Mail Server which i managed myself. Getting Lotus Domino support is quite a tough job, especially if you dont have any support SLA with the IBM, which generally costs heavy amount in $. Therefore I have to manage things on my own mostly using google and with some common sense lol.

Today we received an email from a valid client, and when we tried to copy or reply him with history, we receive following error.

w2.PNG

It also happens if user have selected following in mail delivery options.

w1.PNG

Without going in much details (which is already available in greater details on the internet), here is how I managed to sort it.


Requirements: Domino Admin Client.

Open user mail file via Domino Admin Client.
Goto Create / Agent,

As showed in the image below …

formula.PNG

 

Make sure you select FORMULA as shown above, and copy paste following code …

FIELD $KeepPrivate := @DeleteField;

Save it with any name like “remove keep private” and exit.


Lotus Notes Client:

Now open Lotus Notes Client , goto inbox and open the affected email,

Now goto Action / and you will see the newly created agent name. click on it.

As showed in the image below …

agent.png

it may take just a second or two most, and will remove the restriction 🙂

Enjoy !

Syed Jahanzaib

 

December 30, 2015

2015 in review

Filed under: Uncategorized — Syed Jahanzaib / Pinochio~:) @ 8:43 AM

The WordPress.com stats helper monkeys prepared a 2015 annual report for this blog.

Here’s an excerpt:

The Louvre Museum has 8.5 million visitors per year. This blog was viewed about 1,300,000 times in 2015. If it were an exhibit at the Louvre Museum, it would take about 56 days for that many people to see it.

Click here to see the complete report.

November 17, 2015

IBM Lotus Notes: Inbox Emails disappears when sort by DATE

Filed under: IBM Related, Uncategorized — Syed Jahanzaib / Pinochio~:) @ 9:14 AM

Today one of our company user faced strange issue in his lotus notes clients {8.5.3 FP6}.

When they just open the Inbox without any sorting, there is no problem and all mail shown. Once they try to sort the mails by ‘Date‘,  all emails in inbox view disappears.

After trying various things like refresh/replace design etc, we finally managed to sort the issue by running UPDALL on that specific db.

From the Domino Server Console  , Issue following command


load updall -R mail/USERDB.nsf

( -R : Rebuild All used views)

Fixed !

Jz!

 

November 12, 2015

Prioritize SpeedTest.Net Results via Mikrotik Queue

Filed under: Uncategorized — Tags: , — Syed Jahanzaib / Pinochio~:) @ 9:48 AM

speedtest


As implemented it yesterday , an old trick, NOTHING NEW really.

(Although I personally don’t see any reason why to prioritize such speed.test.net results, to fake whom, client or yourself ? lol)

Following is an simple demonstration on howto prioritize speedtest.net speed test.
Scenario: Client is allowed to get 512k , but when he will access speedtest.net to check the speed, he will able to see 2mb , (every user will be able to check it on 2mb limit , individually per ip basis) while his normal download/browsing will remain under 512k queue limit as showed in the picture above.

ROS CODE, Tested with 5.x and 6.x versions:


# Mark speedtest in Layer7 firewall
/ip firewall layer7-protocol
add name=speedtest regexp="^.+(speedtest).*\\\$"

# Marking SPEEDTEST.NET in mangle section using L7
/ip firewall mangle
add action=mark-connection chain=forward comment=SPEEDTEST layer7-protocol=speedtest new-connection-mark=speedtest_conn
add action=mark-connection chain=prerouting new-connection-mark=speedtest_conn protocol=tcp src-port=8080
add action=mark-packet chain=prerouting connection-mark=speedtest_conn new-packet-mark=speedtest_pkt passthrough=no
add action=mark-connection chain=postrouting dst-port=8080 new-connection-mark=speedtest_conn protocol=tcp
add action=mark-packet chain=postrouting connection-mark=speedtest_conn new-packet-mark=speedtest_pkt passthrough=no

# ADD PCQ so that i can be applied on per ip bases later in simple queue / zaib
/queue type
add kind=pcq name=download-2mb pcq-burst-rate=0 pcq-burst-threshold=0 pcq-burst-time=10s pcq-classifier=dst-address pcq-dst-address-mask=32 pcq-dst-address6-mask=64 pcq-limit=50 pcq-rate=2048k \
    pcq-src-address-mask=32 pcq-src-address6-mask=64 pcq-total-limit=2000
add kind=pcq name=upload-2mb pcq-burst-rate=0 pcq-burst-threshold=0 pcq-burst-time=10s pcq-classifier=src-address pcq-dst-address-mask=32 pcq-dst-address6-mask=64 pcq-limit=50 pcq-rate=2048k \
    pcq-src-address-mask=32 pcq-src-address6-mask=64 pcq-total-limit=2000

# Add simple QUEUE to limit speedtest.net 2mb PER USER
/queue simple
add burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s comment="Limit every Users at 2mb using PCQ. for speedtest only marked by mangle / zaib" direction=both disabled=no interface=all limit-at=0/0 max-limit=0/0 name=\
    "SpeedTest.Net 2Mb per use via g PCQ / zaib" packet-marks=speedtest_pkt parent=none priority=8 queue=upload-2mb/download-2mb target-addresses=192.168.5.0/24 total-queue=default-small

# Add simple QUEUE to limit user PC individually for rest of traffic, static or dynamic up to your network.
add burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s direction=both disabled=no interface=all limit-at=512k/512k max-limit=512k/512k name="Zaib Desktop 512k A llowed - 192.168.5.2" packet-marks="" \
    parent=none priority=8 queue=default-small/default-small target-addresses=192.168.5.2/32 total-queue=default-small
 

Move the speedtest.net queue on top! Ordering is very important in mikrotik, as rules are processed order wise , zero to bottom

Note: It can further be adjusted in PCQ, QUEUE TREE, etc etc as per network designed.


client


Regard’s
Jz

December 30, 2014

2014 in review

Filed under: Uncategorized — Syed Jahanzaib / Pinochio~:) @ 8:10 AM

The WordPress.com stats helper monkeys prepared a 2014 annual report for this blog.

Here’s an excerpt:

The Louvre Museum has 8.5 million visitors per year. This blog was viewed about 1,300,000 times in 2014. If it were an exhibit at the Louvre Museum, it would take about 56 days for that many people to see it.

Click here to see the complete report.

Older Posts »

%d bloggers like this: