Yes, U.S. Army secretary said there is a soldier stationed on the moon. (There isn't)
Jun. 13th, 2025 08:26 pm![[syndicated profile]](https://www.dreamwidth.org/img/silk/identity/feed.png)
Please feel free to direct me if i'm not in the right spot, I read the rules but I just wanted to see if anyone has a clear insight into this
One of our machines sitting on our domain was trying to make logon attempts to an Ubuntu Web server we have. That ubuntu machine did go down briefly. That machine shouldn't be getting logged into, and was logged in via our Highest privileged login, many contractors, outsiders, insiders know it. We were informed by a contractor that it cannot be changed since it's tied to a bunch of processes within our various DC's, essentially breaking quite a lot. I am unable to verify if the second part is completely true or not, it is tied to many, many scripts running within our domain.
The actual UFW output is servername kernel: UFW BLOCK IN=ENS60 OUT = (Mac Address of internal Computer ) . SRC is Private IP assoicated with potential 'rogue' device. DST = Private IP of Web server
No alerts on KerioControl — appears to be internal traffic issue, not external DoS. UFW logs show BLOCK OUT
entries, indicating unsolicited traffic. Devices still attempting connections after DHCP leases were removed on Kerio Control.
There's nobody physically logged into that machine, and nobody should be remoting into it. I did see 5,000 + successfull logins in Event Viewer since 5/31, but my contractor informed me that normal.
I do see a Program/script is in Windows Task Scheduler running. C:\windows\Explorer.exe. What is weird is that its a scheduled task, I don't get that. . Under add arguments it says /NoUACCCheck. I have logged into many computers in my network previously and never saw this setup on there. When clicking into it form within file explorer, everything looks normal and nothing is off with it. I just don't see anywhere online documeting that being a normal scheduled task. I haven't talked to my contractor about it, he has lied in the past about certain processes being caused by X when it was Y, so I figured I would post around first.
Nobody is using that machine in the office, that desk is empty and has been for 3 months. I do know anyone with the super remote password can log into it. Very confused and not sure whats going on with it, if anything. I only looked into it since the Web Server logs were pointing at it .
I am 1 yr into this sysadmin stuff with no guidance internally, just me, so forgive me for anything i've left out or if anything i've looked into is glaringly obvious.
Thanks for any insight, i'm sorry if this isn't the right spot for this content
I’m the IT lead at a hospital. We recently purchased an APC SRTG5KXLI UPS from an authorized distributor, and it was sold to us as brand new.
After installation, we reviewed the internal event logs via the web interface — and to our surprise, we found the following entries dated April 27, 2022: •Manual SNMP configuration. •Relay bypass fault. •Event log clear.
All of which strongly indicate prior use or at least manual handling/configuration.
When we raised this with Schneider Electric, the responses were inconsistent. At first, they denied any such entries would exist on a factory-new unit. Later, we were told it could be part of undocumented “internal factory testing” — without any documentation to back that up.
We’ve filed a case with EthicsPoint and escalated it to Schneider corporate, but the distributor is still claiming the unit was new. No one is taking ownership.
We’re left stuck between the manufacturer and the authorized reseller, and the trust gap is massive. We’re now questioning how to even verify new hardware from vendors — especially in critical environments like healthcare.
Has anyone else run into something like this? Do you log-check hardware upon delivery? Any thoughts on how to handle vendor accountability for stuff like this?
Every cat deserves a purrfect birthday bash, and our feline friends sure know how to pawty in style. Whether it's turning one or entering their golden (and slightly grumpier) years, birthday cats love being the center of pawtention.
Some cats prefer a more low-key celebration: a cozy nap in a sunbeam, extra treats, and maybe a new box to sit in like royalty. Others go full party mode, bouncing off the walls with their feline friends. Either way, these kitties are living their best nine lives.
Gifts range from new scratching posts to fancy collars, though most cats still end up playing with the wrapping paper. And let's not forget the birthday outfit! An adorable bowtie or tiny hat which will promptly be removed after 3 seconds of dignity lost. The hooman, of course, is furiously snapping photos while singing a slightly off-key rendition of "Happy Purrthday."
In the end, it's all about making our whiskered companions feel loved. Because birthdays may come and go, but the meowments we share with our cats are truly furever.
Your inbox deserves hissterical cat content. We deliver. Weekly. Subscribe here.
Hi everyone, sorry for the long post. Please help me.
System details: Microsoft Windows 11 home Version 10.0.22000
Disclaimer: Since the post is little technical and English isn't my first language, I asked ChatGpt to summarize our chat (where I tried to solve this problem) and just worked on that. So if it sounds off, that's why, I'm not a bot. This is my problem:
There’s a svchost.exe process launched under the TokenBroker service that keeps getting triggered from explorer.exe, consuming noticeable CPU and memory in cycles. This shouldn’t be happening — svchost.exe services normally stem from services.exe, not explorer.exe. Here’s the full picture (https://imgur.com/a/GrMu6Jk)
Additionally, the process is cyclical. It runs for 10-15 minutes, CPU and RAM memory both go up, and then it stops for a few minutes, and back at it again. The process doesn't appear to have a name when you look at the task manager, but if a go to its path, it's a svchost.exe inside C:/Windows/System32. If I go to details and to services, it doesn't highlight any service. It also doesn't have any service tab when you look at its properties with process explorer for example, or similar software. I will also show you the threads tab. Some images to illustrate this: https://imgur.com/a/CC9MYKa https://imgur.com/a/lM5mNAa
General details of the process provided by ProcessEplorer:
Version: 10.0.22000.527 (WinBuild.160101.0800) Image file name: C:\Windows\System32\svchost.exe Image file name: \Device\HarddiskVolume7\Windows\System32\svchost.exe Process > command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s TokenBroker Current directory > C:\Windows\System32\ Parent console: svchost.exe (7932) Parent process: explorer.exe (5492) Mitigation polices: DEP (permanent); ASLR (high entropy); CF Guard Protection: none Image type: AMD64 (64-bit)
A svchost.exe instance (with command line: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s TokenBroker) is spawned by explorer.exe instead of the usual services.exe.
It consumes CPU and memory periodically in short bursts.
It always points to TokenBroker, a system service used for Microsoft account token management.
The executable hash matches the official Microsoft build: 0ad27dc6b692903c4e129b1ad75ee8188da4b9ce34c309fed34a25fe86fb176d (Verified with virus total, I've also scanned the file, make sure the path is the correct one, went to signature > details to check if it is actually from Microsoft... Everything seems legit, like it is indeed the one from Microsoft and not very well disguised malware, but who knows)
Things I’ve Already Tried: Uninstalled Macrium Reflect, thinking it was the culprit — it wasn't.
Stopped and disabled non-essential background services like:
Dashlane Upgrade Service
App Explorer
Angry IP Scanner
OpenAL
Checked with Process Explorer and confirmed:
The svchost.exe binary is legit and signed.
Loaded DLLs seem normal.
I've also checked for windows updates and the drivers seems to be the last version.
What I’m trying to figure out Why is TokenBroker running via a svchost.exe child of explorer.exe?
What exactly is triggering it? (I can’t find a clear cause.)
Is this normal behavior for some Windows builds or account types?
If anyone has encountered something similar or knows what to check next, I’d really appreciate the help. This is driving me nuts.
Thanks in advance!
Little disclaimer I am not a sysadmin but a firmware engineer but I figured you guys would have liked this story (or despise me for it xD). Basically since yesterday both ethernet and wireless connection at my workplace randomly stopped working for apparently no reason. What followed was several hours of investigating faulty meshes,or hubs,seeing If anything was disconnected anywhere in the system. With little to no avail (keep in mind our company is very small so the IT Is composed of 4 people including me and none of us is a sysadmin,we all work on firmware,hardware and software),so we had no choice but to call the company that handles system administration for us. They were also clueless about what was the nature of the problem since it seemed to happen at random times and stop equally as randomly.The only thing they managed to find out was that random ips appeared in the LAN,suggesting a rougue DHCP Server wrecking havoc. They pointed out to Ubuntu vms or Windows vms since we decently added these at work and they could see some DHCP entries with those devices while sniffing the network from the firewall. That's when I remembered a small,fatal detail. Long story short,two weeks ago I lacked internet at home so i decided to forward Wifi from my phone hotspot through my MacBook to my PC enabling internet sharing on the Mac,and I completely forgot to turn It off,given that the Mac doesn't show any banner or alert reminding you this feature Is active... So i ps aux | grep dhcp et voilà,found the culprit... The reason I didn't notice earlier and we didn't have problems the last two weeks was that this was extremely conditional,since I activated internet sharing from WiFi to SZNX LAN 100 (which is the type of the LAN to usb-c adapter I have at home),while at work I have a USB 10/100 LAN adapter so when Wifi was active and this was plugged in nothing happened,and obviously no DHCP offers appeared listening to Port 67/68,but yesterday god knows why I decided to bring my personal adapter at work...and shit hit the fan. Hope you enjoyed my little story. I'm an idiot
Cats are known for their confidence, composure, and the firm belief that they rule the house. But nothing shatters that royal illusion faster than betrayal, usually delivered by the very hoomans they trusted most. Whether it's the ol' treat-bag rustle that turns out to be vitamins, or the classic "we're just going for a car ride" that ends in the vet's office, the look of utter feline betrayal is both dramatic and hissterical.
One minute, a kitty's curled in your lap purring like a tiny motorboat. The next? You've picked them up mid-nap and plopped them into a bath. The audacity. The pawsitivity is gone. The stare is ice cold. And the silent judgment? Meowgnificent. Even routine activities like vacuuming or rearranging furniture can feel like personal attacks. "How dare you move my sunbeam," their eyes seem to say. "I trusted you."
Still, these fluffy drama queens never hold a grudge for long, especially if snacks are involved. A crunchy apology or a soft blankie is usually enough to restore the peace. Until next time, that is. Because a cat never forgets. Or forgives. (Unless there's tuna.)
Your inbox deserves hissterical cat content. We deliver. Weekly. Subscribe here.
Ahh, Friday. It's finally the day you can wholeheartedly state that the weekend is just around the corner, and you'll be correct. It won't be some random sentence you tell yourself or your friends in the middle of the week, just to try and help all of you feel better. So no, the weekend is literally just around the corner, and that's such a relief.
And now, adding only a little delightful dose of cat energy can make this feeling a thousand times better. Adding some cats to your Friday, to welcome the weekend, is a great addition that's full of fluffy feline energy - which is the best energy to open the weekend with.
But what if you don't have around 20 cats surrounding you, like a crazy cat lady? Well, then the answer is easy. We know not everyone is a cat pawrent (even though they should), but you can always get that delightful dose of cat energy from some feline funnies in the form of memes.
Your inbox deserves hissterical cat content. We deliver. Weekly. Subscribe here.
Hello All,
I'm looking for a help desk ticketing solution for 3 technicians supporting ~100 users. An easy to use interface for the users from any location is about the only requirement. On the IT side it would be nice to have a kanban view for our work flow, automatic follow up a few days after closing a ticket, and the ability to track proactive work when there is a low call volume. What do you guys think? Thank you in advance!
Hi, I’m creating a large number of lxd containers, behind Tailscale for my students. The number of containers may be between 25-75. Each student will get their own “vm” and perhaps several, so they can experiment with clustered software.
I could create a single image, with all necessary software, then use that to create instances, but I’m wondering if I should create one container to serve as a proxy (perhaps via squid?). All other containers will have http proxy set up to point I the cache.
The idea is that every pip/apt install command will go through the proxy and these files will only need to be fetched from the internet once, then they will be cached. This will save on unnecessary downloads.
I’m coming from a software engineer/data science background and don’t have as much experience managing clusters of machines. I’m wondering if my approach is reasonable or if there are better alternatives?
Howdy all.
We have a Dell T550 with a PERC H755. Currently 8 x 1TB SSDs in RAID 5 w/hot spare. I want to replace the 1TBs with 2TBs drives. Back in the day to avoid downtime it would just be replace one, rebuild, replace next, rebuild, when done increase RAID size. Now however I'm being told that will no longer work and the only way to do it is to either backup the server, replace disks, create new virtual disk, restore or migrate the VMs to another host, replace drives, rebuild server, migrate VMs back.
Is this accurate in that it's the only way to do it now?
Thanks
Owning Service : Microsoft teams Impact Start (IST) : 2025-06-13 7:43 PM Last Communication (IST) : 2025-06-13 9:25 PM Event Start Date : 2025-06-13 7:43 PM State : ACTIVE
Title: Users are unable to use Gifs in the Microsoft Teams chats User impact: Users are unable to use Gifs in the Microsoft Teams chats. More info: Issue impacts all Microsoft Teams clients including web Microsoft Teams, Microsoft Teams desktop client, and Microsoft Teams mobile. Current status: In addition to the data provided by your organization, we're reviewing recent service changes to isolate the root cause of impact. Scope of impact: Your organization is affected by this event, and any user attempting to use Gifs in the Microsoft Teams chats is impacted. Next update by: Friday, June 13, 2025, at 6:00 PM UTC
I got a support email from a client saying that their invoice PDFs randomly stop downloading after a few months. I assumed it was a caching issue or a backend timeout. But after digging around, I found that the app was generating the PDFs in /tmp, then sending download links that expired after 24 hours — but never cleaning up the files.
Eventually the server just started silently failing when the disk filled up. There was no alert, no logs for failed writes, nothing. I only figured it out after SSH-ing in and seeing 20,000 orphaned temp files.
Copilot cleaned up the script a bit, and I asked Blackbox to check if there were any other places where we were writing to temp without cleanup. Found two more.
I added automatic cleanup and now I’m trying to convince the team to set up basic disk monitoring, something that probably should’ve been in place years ago.
Take a deep breath. Hold it for a few, serene seconds. And let it out slowly. Now let your cat climb on your lap, settle in the most comfortable position, lie down, the purr deeply. What a great moment to experience. Having a calm moment with your cat is like a beautiful boost to any cat pawrent's mental wellness. Any cat pawrent should relax with their cat every once in a while (but honestly, we wish we could do it 24/7). Cats should be registered as an anti-anxiety treatment. Such cute and fluffy feline friends.
While you're at it, petting your napping and purring cat while having this relaxing meowing moment, you can complete the experience with some funny cat memes you can easily lose your focus to. Just let your mind wander to Catland, full of fluffy feline friends and lots of cute smol kittens prancing around, meowing their soft little meows. What a funny and cute moment it must be. What magic cats are.
Your inbox deserves hissterical cat content. We deliver. Weekly. Subscribe here.
One of our favorite facts about cats is that cats domesticated themselves. Did you know that? Humans didn't have to do anything. Cats just saw all of that comfort and free food and decided that being a part of that sounds much nicer than having to fight for scraps outside. And we can't blame them. But what's even cooler than that is that we are not talking about something that happened thousands of years ago. Cats continue to domesticate themselves to this day.
Each and every day, somewhere out there in the world, a cat decides that it is done with outdoor life, that it is time to be adopted and spoiled. And it doesn't matter where they are, it doesn't matter what age they are, the meowment that they make this decision, the universe seems to just… provide. And you, as the human, will be blessed with the kitten in the most unexpected ways sometimes - even if that means finding a kitten under the hood of your car.
Your inbox deserves hissterical cat content. We deliver. Weekly. Subscribe here.
I hope you are doing fine.
As a long-time network admin and hobbyist developer, I frequently work with SSH, Git, and various CLI tools. A recurring annoyance for me has been efficiently reusing previously entered commands. About a third of the time, I find myself reaching for an older commandeither by scrolling through my Gnome Terminal history using the up arrow, or by grepping through ~/.bash_history
(e.g., cat ~/.bash_history | grep ssh
).
After years of dealing with this the manual way, I’ve decided it’s finally time to improve my workflow.
I'm looking for a more convenient way ideally integrated into the terminal or available via a lightweight GUI—to quickly search, find, and reuse my command history. Bonus points if it works across multiple terminal windows or even syncs between systems via Nextcloud or similar (though that's optional).
Would switching to a different terminal emulator help? Are there tools or shell setups you can recommend?
Looking forward to your suggestions thanks in advance! :)
Having a massive issue with 40+ brand new ZQ521 label printers.
But basically, they all choke up and stop printing mid print when printing UPS shipping labels. They show a battery with shield icon on screen and then start squealing and stop printing. The manual says this battery/shield icon indicates 'Power save' mode. I have all available power save settings turned off though....
! U1 setvar "power.sleep.enable" "off"
! U1 setvar "power.inactivity_timeout" "0"
! U1 setvar "power.energy_star.enable" "off"
! U1 setvar "power.energy_star_timeout" "off"
I have been stumped. I spent 3 hours on a call with Zebra trying to get this resolved. Trying different firmware versions, different zpl commands and settings. Nothing. All of these printers do this.
Happens whether using a fresh brand new fully charged battery, direct DC power, or a crappy old battery. Doesn't matter.
The older model ZQ520 works totally normally printing the same label with the same battery and media. This issue is only happening on ZQ521
one weird thing I noticed, if I increase darkness past 20...it slows down printing enough that essentially prevents this issue. Unfortunately it's too slow to be viable for production.