Printable View
That depends... If you want 99.999% uptime of the server or of the service.. If you want 99.999% uptime of the service, a cluster will allow the service to continue when you're rebooting/patching a server...Quote:
Originally posted here by Black Cluster
If you run a serious business and want a 99.99% availibilty and no downtime {caused by batches unless it is a core batch} run Linux .... :)
How do you get 99.99% uptime and no downtime on Linux if you need to install a new kernel?
Easy. If you know what you're doing you can go without a reboot even for a Kernel. You just have to reset a few things. Bt other than this... Why would you NEED a new Kernel? Just because a new one comes out doesn't mean you need it. On a Server in a company, the Server would be configired in a proper way anyway.Quote:
Originally posted here by SirDice
How do you get 99.99% uptime and no downtime on Linux if you need to install a new kernel?
And of course, heh, you could strip Linux down to almost nothing, hack the Web Server right into the Kernel, and tell it to discard anything else. I know Porn sites that do this and have never once been broken into. And never updated.
So that's how ;)
I think the Linux From Scratch people have something on their site about doing things like this.Quote:
And of course, heh, you could strip Linux down to almost nothing, hack the Web Server right into the Kernel,
The only reason you have to upgrade a kernel is security updates isn't it? Or can you apply a security patch to a running kernel without rebooting?
In theory, Linux has a way to do that yes. I personally don't. I usually apply updates in Kernels and reboot. But if it was a server that had to be up non stop, I'd just not install it. Really most Kernel updates for security aren't going to sting you if you've properly set up things.
Here I think the thread is about a company and servers, meaning they probably have not only a good firewall, but also the company was most likely set up in a proper manner. A firewall sitting in front of the server, and IPTables being told "Only allow this" and the system not having a bunch of crap you don't need, greatly reduces the chances you're going to have a problem.
I've tested this before. I took a SUSE installation and customized it to where the only things really installed were what was needed on an FTP server.
When I was done and checked for updates, I think I had 3 total. SUSEFirewall works very well. Someone has to be able to get in through an open port, and depending what the server is doing, you don't need to allow that.
I had FTP open. That doesn't mean someone could just FTP in, I looked over my logs and people were trying all the time to root it, none did.
Some Kernel updates I've seen are local priv escalation. So someone has to be local to do it.
Also, SUSE does code audits like OpenBSD does which is why you don't see a new update for SUSE every time RedHat or Fedora release one.
If you apply a kernal patch and don't reboot, IMHO you run higher risk of system instability.
And wouldn't we call an unstable system vulnerable?
How do you risk unstable when the new Kernel doesn't get used unless you reboot? When you install it and don't reboot, you simply aren't using it.
Lol, missed that part. Na, I wouldn't. I've never seen a hacker break into a box that has crashed and is no longer responding. ;)Quote:
Quote:
Originally posted here by Black Cluster
If you run a serious business and want a 99.99% availibilty and no downtime {caused by batches unless it is a core batch} run Linux .... :)
I don't know of a single instance where someone is running a 99.999%(actually it is 99.9999%) available system, what we call 6 sigma, on a linux system. And I work with a whole lot of IBM people.
Those systems are almost exclusively run on MVS or solaris. The most critical system I can think of in terms of always up is the New York Stock Exchange.. And they are running Oracle on Solaris. Even then.. An oracle grid still takes time to failover, and they have maintenance windows...
And even with 99.9999% available systems, you can have 3.4 minutes of downtime per 1,000,000 minutes. Which works out to two minutes or so a year... 99.99% allows for 100 minutes of downtime per 1,000,000. Which is 50 minutes per year.
But even then.. I've never come across a system that didn't factor in some sort of maintenance window. Most people you hear talking about running at 99.99 or whatever only count available minutes. Meaning that they might get 30 minutes a month for maintenance activities, and those 30 minutes don't take away from their availability metrics.
I thought 99.999 was 5 minutes per year.
Gore that five minutes a year is for unplanned downtime. It doesn't count planned mainteance. But haveing said that i did have windows servers that were up close to that level. Even had a couple of NT4 domain controllers that were up around the 95% mark if you will believe that. If you really need that type of uptime then you go with systems made for it. We used IBM Iseries or as they were called AS400. Now thats a robust system when, like linux it is properly managed.