jlj

Full on

Boy, I'm beat. I finished Phase 1 of the (practice) Splunk Architect lab tasks today, and got well stuck in with editing config files as part of Phase 2. Happily, I learned — just moments ago — that the AWS free tier includes 750 hours of t2.micro instances per month, so I'm leaving all my hard work up and running overnight; then it'll be ready for me to pick it up right away tomorrow morning. (Even with eight concurrent instances, I'll be good for a few days.)


Late last night, I decided that I'd park the Python code I was working on to parse Met Office JSON. I will come back to it — when I finally decide on a course — but, for now, a script calling jq will work fine. (I only want a few elements from the current, and following, day to display in Conky.) I was pretty chuffed with my progress last night, although it meant I was late getting to bed.

It was tough seeing my partner leave this morning, double pram full of the most precious cargo in my world. My boy is back now, though — I can hear him squealing downstairs — and seems very happy.


This is a bit of a non-sequitur: I was reading the latest Brain Food (No. 371) from Farnam Street and an excerpt from a Bloomberg article on Musk caught my eye. It was so simple: he acknowledges that he shoots from the hip on birdsite; that's why he likes it. No press releases or faff — just his mind, to the public. Which, he also acknowledges, means that lots of his tweets are “dumb.” And, that if that's the price of doing business in this way, he's happy to pay it.

I don't think that having that policy, as such an influential person, occurred to me. My sleepy brain can't fathom the pitfalls of such a policy at the moment, but I can certainly see its benefits. My tendency is to think that good communication is based on expectation management: knowing what your intended audience expects, and them knowing what to expect from you. Putting a message like this out — an implicit caveat to every tweet — certainly sets clear expectations.

End of Day 23

— jlj #100DaysToOffload

I'm writing this as part of the 100 Days To Offload project; join us at: https://100daystooffload.com/

Bunker day

Sundays are hard. I have enough data now to say it's a pattern. And I'm now taking it seriously. I've just ducked out of the family zoom. I'm not going fedi, or on birdsite. (My BBC apps went with bookface.) I'm adding virtual lockdown to my continued physical one.

I am OK, so far; better than, maybe, as I handled my three-year-old's nap-time tantrum with aplomb. I think overconfidence has been part of the problem; assuming good days mean that will just continue. But, no, vigilance is required.


Saw on Reddit that someone was asking about FOSS keyboards for Android. I'd seen that Microsoft bought SwiftKey, which had started the idea of a change buzzing about in the back of my mind; the suggestion of OpenBoard was the tipping point.

I'm happy with it so far. Nice and simple. I do miss gesture typing: I started using Swype nine years ago, I guess. (And gestures on my Palm V long before that!) But the developer has said that it's part of his plan, once he has the time. I have to say, though, I've disabled enough of Android and/or the defaults that I'm reaching another tipping point: time for a change of operating system? I hadn't even heard of Pinephone before jumping on Fosstodon, so that's probably in the mix too.

I think I'm fine for the moment, but the seed has certainly been planted well.

End of Day 22

— jlj #100DaysToOffload

I'm writing this as part of the 100 Days To Offload project; join us at: https://100daystooffload.com/

A nice day

I had a friend. His mum passed away, and, going through her old photos, so many of them were captioned simply, “A nice day,” on the back. So he created a blog that showcased a different one each day, partly for his extended family, and the conversations that would come out of identifying any subjects, and partly as a tribute to the gratitude that was so much a part of her philosophy. And, I guess, partly to help conjure some of the latter in his own life.

He's still alive and well (last I heard), but he isn't my friend now. We didn't even talk about it. I assumed that my actions over here were relayed to him in some form, and he — completely justifiably — decided I wasn't someone he cared to have in his life. He stopped responding to my emails anyway. It's still pretty raw for me, eight years later. A fifteen-year friendship, doing the maths.


I was thinking the subject line fits today as well. (That's what got me thinking about all that again.) I got this well-loved, circus-style pup tent on Freegle last year, and — pretty ingeniously, I thought — I decided to deploy it in the new paddling pool today to keep the sun off the kids while they splashed. It was a big hit all 'round.

I spent a bit of time learning git as well. Renamed my GitHub account, proved it with Keybase, uploaded an SSH key, and then cloned the examples from that Terraform course I took a while back. I don't know whether cloning that makes sense now, to be honest, but I wanted to give credit for the bulk of this code I'm using to stand up my lab environment. Anyway, for now I've committed my code as an enhancement to Ned's, with an associated project covering where I want to take it. I'm jlj77 there, if you're curious.

End of Day 21

— jlj #100DaysToOffload

I'm writing this as part of the 100 Days To Offload project; join us at: https://100daystooffload.com/

We had an indexer cluster, ladies and gentlemen!

This entry will be Splunk related. Heavily Splunk related. But I'll open with how I was asked to present my Terraform code for setting up a practice lab in AWS at our company's weekly tech talk. I was pretty proud of the slide deck I put together. When my turn came, I shared my desktop and started running through it. Halfway through, someone piped up, “Are we supposed to be seeing something? It sounds like you're expecting us to see something.” Turns out, they could see my gallery view of the meeting, 'cause my slide deck was in another workspace. And then, when I tried to share Chrome specifically instead — where I was presenting from — our meeting application complained that it needed more permissions (that wouldn't be issued until I left the meeting as part of a restart). I got through it, in the end, but I felt a bit silly.

I ran that code today, thinking I'd get much further along in my practising. And, initially, things looked good. But once I'd finished the initial indexer cluster configuration, I wasn't clear on what the contents should be of that initial cluster bundle to be sent to the peers. The Clustering Administration class had quickly gone from everything's working to let's bust an indexer and see how failover works. I did eventually find a relevant page, deep in Splunk Docs, only to find out that, while the master node was happy to validate said bundle, it was not about to push anything out to the peers.

Early on I'd noticed that the peers were in automatic detention, but, in my mind, that went in the category of, oh, they don't have any data to index yet. My colleague had spent a long time troubleshooting a problem that essentially boiled down to, oh, you won't see that until you start forwarding data to the cluster. I decided all sorts of anomalies were acceptable while my cluster was in a simple racing block position, as it were.

Silly me. Silly, silly me. Thankfully, one of our longest serving splunkers took pity on my whining in the team chat at 10pm on her Friday night. Turns out, Splunk likes to have plenty of breathing room by default. Five gigabytes of it, in fact. Without that, things... stop. EBS volumes default to 8GB. The typical Splunk Enterprise install comes in at about 3.5GB. Notice a problem?

Once I'd gone 'round my peers, knocking that default well on the head — minFreeSpace under diskUsage in server.conf, for your notes — making sure that while I did it in each peer's slave-apps, I also did it in the master's master-apps bundle directory that would soon be clobbering the former changes (I hoped), everything was tickety-boo.

And, once my runbook was up-to-date, I typed terraform destroy again. D-:

End of Day 20

— jlj #100DaysToOffload

I'm writing this as part of the 100 Days To Offload project; join us at: https://100daystooffload.com/

Partially working indexer cluster, and pub quiz win!

Apologies if this entry is all over the shop. I wanted to write it straight after work, but ran out of time, what with trying to participate in the kids' bedtime routines while still making it to my company's virtual pub quiz.

We won! The first time we had a full team, but still: we've posted dead last on more than one occasion. Very exciting. I may have indulged in the sour mash whiskey during said victory, and in the post celebrations.

I was already really chuffed because, first, I got a test run of my Terraform code working, such that an indexer was successfully made a slave of the license master, all in AWS; and then I deployed the full lab, and got all three indexers slaved to the LM, and reporting to the master node. (In automatic detention, mind, but still, I have high hopes for getting back to that point by mid morning tomorrow. I'm destroying all my kit each night, trying to minimise costs.)

In short, I felt like a proper professional today. A good feeling, to be sure. Oh, and I answered a question in the Terraform lobby on Gitter/Matrix for the first time today. And, I was approved for Tildes. And my boy was a champ for his latest jabs. And this is definitely a run-on paragraph, which is also definitely a thing.

End of Day 19

— jlj #100DaysToOffload

I'm writing this as part of the 100 Days To Offload project; join us at: https://100daystooffload.com/

Those missed years on IRC

Had another fairly productive day. Helped a colleague troubleshooting another Splunk licensing issue. Made good headway on my Terraform code for my lab set-up.

I spent a bit of time setting up an IRC client on my Linux box. I want to use irssi, but I'm just not there yet; don't have the time to commit to that learning curve. I settled on Hexchat because, as Clay Shirky says, there's power in the default (on Mint, in this case). And I immediately felt regret.

Not in the act, but in my failing to keep up with IRC over the many, many years since I was first exposed to it. I think I could use that stability right about now. I mean, I guess there are parallels IRL: moving across an ocean; flux has been my only constant for many of the last ten years. Well, I feel like things are settling down now. I have a family, a new job, a focus for my learning. Let's see what these possible connections bring over the next few years.

I was just reminded about alt.music.tool, back in the mid 90s. What a fun break from my uni assignments. In the bowels on the Engineering building — 'cause CS didn't have their own one back then — sat in front of a dimly-lit, monochrome dumb terminal, poring over each line of every track on the newly-released Ænima, theories abounding. Why did Usenet die, while IRC, dare I say, thrives?

End of Day 18

— jlj #100DaysToOffload

I'm writing this as part of the 100 Days To Offload project; join us at: https://100daystooffload.com/

Preparing for the Splunk Enterprise Deployment Practical Lab

Well, I didn't make as much progress on the subject run-book as I would've liked, but it has been a productive day. I was able to troubleshoot an inputs.conf problem for a colleague, off the top of my head, no less. That's a big deal in my view, 'cause the Admin manual for version 8.0.2 lists 64 multi-page conf files in its appendices.

And then us both being cloud novices reared its ugly head: they came back to me saying that they were unsuccessful in making their master node a license slave; the command was timing out. Well, as many (if not most) of my readers will know, by default, EC2 instances are placed in their own separate security group by default; or at least that's the theory guiding the latest troubleshooting.

My mind jumped to checking that the license master was listening, and once that was confirmed, that there might be a firewall problem. I knew how to check for iptables, but I'm a fish out of water in CentOS/Amazon Linux. However, I think that was a bit of a red herring, and I'm crossing my fingers for success once all the instances are moved into the same security group. [Edit: Theory confirmed and problem corrected apparently, hours later now, after the kids are in bed and I've had a chance to check my email.]

I bring all this up because, as practical as the subject lab is — from what I've been told, anyway — it still must be artificial or canned to ensure students are tested on their Splunk knowledge, in a timely fashion. So, practising for it, whether in the cloud or on bare metal, is bound to run into all sorts of problems that won't be relevant to the test itself. The good news is, pretty much every one of those problems will be completely relevant in the real world — a.k.a. the place where I'll be doing 99% of my future deployments.

Now that the EC2 interface/dashboard hasn't proved this task completely trivial, I'm seriously considering writing some Terraform to automate it instead. It'll be the perfect opportunity to reinforce that knowledge, and, hopefully, won't take too much time away from my Splunk practice. If it goes well, new hires will be able to use it; I'll throw it up on GitHub as well.

End of Day 17

— jlj #100DaysToOffload

I'm writing this as part of the 100 Days To Offload project; join us at: https://100daystooffload.com/

Ho-hum and Ctrl-C Club

Today was better than yesterday. Not really prepared to go further than that. Family wanted to know why I left our WhatsApp group (understandably), so that meant rehashing a lot of the awfulness of yesterday; sort of scuppered the day from there.

Still, it ended on a brighter note: I've been having loads of fun just trawling through Keybase, looking at the teams people feature, and their homes on the Web. And I found tildeverse today, liked Ctrl-C Club's blurb, and I'm in!

I'm really looking forward to learning more about Linux, but as a consequence of working on other things. For example, setting up my account on ctrl-c.club involved creating and copying over a new SSH key. I'd done all of that stuff more than 20 years ago on a friend's server, but I had to look up ssh-copy-id. Which is great, 'cause I'm sure I'll be using SSH all over the place in the deployments I do for work soon, and to just be able to get on with that aspect is perfect; I'll have enough trouble keeping all the Splunk config files straight!

So, yeah, I'm feeling a bit more positive now, as I get ready for bed. It was nice to get the verification of my club address working in my profile here as well, just before firing up this entry. I'd been trying to do the same in Keybase, not realising that they expect you to be running the referenced server. (At least I'm assuming that's what wrong with my tilde reference; makes sense, once I actually thought about it for a moment.)

End of Day 16

— jlj #100DaysToOffload

I'm writing this as part of the 100 Days To Offload project; join us at: https://100daystooffload.com/

Parsing data, and REDACTED

Writ large, today was nice: some time out on the green near the house, plenty of sun, my daughter is starting to take her first tentative steps. But it went down sharply after the (UK) Government's briefing this evening. More on that later.

I've made good progress with my Conky configuration; really happy with how it's shaping up. I'll probably put it on GitHub when I'm done, just because I'm looking for an excuse to learn more git. (It sounds like there is an opportunity at work for someone with a good handle on version control systems.)

The subproject of interrogating the Met Office's API is coming along as well: I'm able to get XML and JSON through the browser, at least. The Python code that I cobbled together from Stack Overflow posts is close as well, I think. From my limited debugging skills, I think I'm getting a 403 response, possibly because I look dodgy without the proper headers. Work to be done. I'm wondering whether it might be simpler to write a script, potentially around jq, seeing as I only want a few fields that I'll then use in Conky. I really need to learn Python properly, though, and there's nothing like a practical project to facilitate that.


I don't know what to say about my behaviour earlier this evening. I'm ashamed of it. I have apologised to both my son and my partner. In the moment, I was so angry; I imagined all sorts of things: punching bags, running until I couldn't draw breath, smashing out all the vitriol in my head on a keyboard. The latter worries me, though. I'll be applying for another visa later this year, and I know minor things can influence those decisions (e.g., cautions from the police). It feels like I've been walking on eggshells for five years now, and I don't want to mess that up on the final stretch by saying things about this Government in the heat of the moment.

I think one of the things I find most upsetting about all this is that, to my partner, most of what I do is broadly similar to my son's tantrums. I'm completely failing to communicate how my anxiety is crippling my ability to properly research this situation. Combined with little information through official channels, and I feel like we're making the decision on whether to send our kids to nursery next week blind.

I could say more, but I probably shouldn't. And I need to get to bed.

End of Day 15

— jlj #100DaysToOffload

I'm writing this as part of the 100 Days To Offload project; join us at: https://100daystooffload.com/

A neighbourhood

A few hours ago, this was going to be a very different post. I'd had a few fun hours playing with Conky while my son directed adventures with the chess set that I keep on my desk. I'd signed up to the Met Office's DataPoint, and was playing with their API. I feel that much of my time with technology, particularly back in university and early in my career, is permeated with comparisons. I spent a lot of time focussing on where others excelled, using that to diminish what I did, what I accomplished, what I enjoyed.

Now, I'm just having fun. And realising that my thoughts about being trapped in this career, or strongly directed, were a product of my perception. As were many of my problems.

We got the kids in bed fairly early this evening, and so decided to have a rare night of television. We chose Won't You Be My Neighbor? — it pains me to misspell that — the film about Fred Rogers, and the television programmes he's famous for. We both ended up bawling our eyes out. My partner, British, doesn't even know anything about him! (Well, she does now.) It was a good film.

The part that Mister Rogers played in my childhood was unclear to me, for many years. I knew the sets intimately. Just now, when they cut to scenes of him presenting some of the main set pieces of the make believe world, I felt a rush of fondness, of love, for those buildings and homes, no less strong than for any of the toys I physically played with back then. When my boy was still in utero, the show's theme was one of the songs I spontaneously chose to sing to him, early on, and became a regular in the nightly repertoire.

I was a small child. Second smallest in my class for all of what we call grade school. I had thick glasses from Grade 3. School was a place to be endured. I tended to chose one, or maybe two, comrades to meet this daily challenge, and mostly, we parted ways at the end of each day. I could walk home for much of my early schooling: I think that says more about the times than the distance involved; one certainly had time to think. And I remember the feeling each time I turned on to Thomas Street; it still stretched out quite a way before me, but it was the branch off the artery of the main road that would eventually lead to my home, to my neighbourhood.

And it really was another world.

I had friends there. Friends who I wouldn't be able to see much at school anyway, even if I was so inclined: most of them were at least a year ahead of, or a few years behind, me. Oh, but the games we played, particularly as the summer holidays stretched beyond imagining. Flashlight tag, a game with world in the title that involved a chalked circle that spanned the road — no fear of traffic on Reid Street — slowly being carved up in negotiations and chalk tosses that are too fuzzy to fathom now. But, god, it was fun.

And I had Mister Rogers.

I didn't talk to the Reid Street gang about what I was feeling, the stability my world lacked, the, at times, truly terrifying uncertainty. I looked to Mister Rogers. And what he said, reinforced as it was with his different ways of putting it, of showing it in his dealings with others, nurtured something deep inside of me.

I came out of childhood badly damaged. I didn't realise this at the time, but it's something that I've come to realise, as a much happier person now. Also with the benefit of hindsight, is the firm belief that I would've been so much worse off without the love of that man, who I never met, but love in return.

End of Day 14

— jlj #100DaysToOffload

I'm writing this as part of the 100 Days To Offload project; join us at: https://100daystooffload.com/