Monitoring RDS free space using CloudWatch alarm

If you suspect your RDS is running out of disk space, most likely it is running out it. To confirm you can create CloudWatch alarm on RDS instance metric "Freeable space" to trigger an alarm. In order to create an alarm, you will have to create a "topic" in Amazon SNS service. Once you define a "topic", you will have to click "create subscription". Under "create subscription", you will have to choose "email" as notification method and specify the email address to be notified.

Now you can go back to "Monitoring" page of your RDS and create an alarm. In the alarm, you have specify 3 parameters, Alarm metric threshold (in this particular case, RDS instance metric called "FreeStorageSpace"), alarm action and then like below:-

Alarm metric:-

Alarm action:-

Alarm preview:-

Once you have created the alarm, you will get an email from no-reply@sns.amazonaws when the threshold is reached.

MySQL backups and restore

The general syntax for MySQL backups using mysqldump tool is

Backup:

$mysqldump -h [RDS instance info] -u [rds_user_name] -p[rds_ password] --socket=[if_different_from_default] -P=[port_if_different_from_3306] [database_name] > rdsdump.sql

Single DB Backup:

$mysqldump -h [RDS instance info] -u [rds_user_name] -p[rds_ password] --socket=[if_different_from_default] -P=[port_if_different_from_3306] [database_name1] > db1dump.sql

Multiple DB Backups:

$mysqldump -h [RDS instance info] -u [rds_user_name] -p[rds_ password] --socket=[if_different_from_default] -P=[port_if_different_from_3306] [database_name1] [database_name2] > db1db2dump.sql

All DB Backups:

$mysqldump -h [RDS instance info] -u [rds_user_name] -p[rds_ password] --socket=[if_different_from_default] -P=[port_if_different_from_3306] --all-databases > alldbdump.sql

Dump of specific table:

$mysqldump -h [RDS instance info] -u [rds_user_name] -p[rds_ password] --socket=[if_different_from_default] -P=[port_if_different_from_3306] [database_name] [table_name] > db_table_name_dump.sql

Restore from dump:

$mysqldump -h [RDS instance info] -u [rds_user_name] -p[rds_ password] --socket=[if_different_from_default] -P=[port_if_different_from_3306] [database_name] < rdsdump.sql

Configuring lamp for auto start in RHEL

If you want to have your lamp process start up as a service when the EC2 instance boots up, you can create start up script in /etc/init.d/.. folder such as

• $ cd /etc/init.d
• $ vi lampprestart
• add lines 

          *************
          #!/bin/bash
          # chkconfig: 2345 55 25
          /opt/lampp/lampp restartapache
          *************

• save the file
• $chmod +x lampprestart
• $chkconfig --add lampprestart
• $chkconfig --level 2345 lampprestart on
• $service lampprestart on
• confirm if it is running by $chkconfig --list |grep lampprestart

MySQL RDS reads slow?

If you are experiencing slow sql reads from your RDS instance such as the below count(*) query:

mysql> select count(*) from customers;

  

+----------+

| count(*) |

+----------+

|   500000 |

+----------+

1 row in set (14 min 53.62 sec)

Then check your RDS Cloudwatch metrics on "Read IOPS". If the chart looks like below:-

 

then most likely you are using standard EBS volumes for your RDS instance. Typically, standard EBS volumes only support 100 iops/sec and as we can see from the above, 2000 count/sec is way over the limit. Some of the larger instance types such as m1.xlarge support EBS optimized IOPS which results in a dedicated channel from EC2 instance to RDS. If you are using such instances then you can improve the read performance by modifying the instance and enabling provisioned IOPS such as below:

NOTE - as best practices demands, always make a DB snapshot before you modify the RDS instance. Also, note that "Provisioned IOPS" value is multiple of "Allocated Storage". So if your allocated storage is 100G then IOPS limit is 1000.

Once you make the above change, you will see the count(*) query time go down as below:-

mysql> select count(*) from customers;

  

+----------+

| count(*) |

+----------+

|   500000 |

+----------+

1 row in set (1 min 22.5 sec)

Linux system analysis tools

ref: Linux system tools

Editing iptables to allow/drop ports

To enable a particular ports on iptables you can run the command

$sudo iptables -A INPUT -p tcp --dport ssh -j ACCEPT
$sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
$sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT
$sudo iptables -A INPUT -p tcp --dport smtp -j ACCEPT

If you need to listen on loopback interface, you will need to add that as the first rule below

$sudo iptables -I INPUT 1 -i lo -j ACCEPT

To confirm you can run "sudo iptables -v -L". To add a drop rule to the firewall you can add

$sudo iptables -A INPUT -j DROP

Refer to more detailed instructions at: Ubuntu IptablesHowTo

Enabling/disabling linux firewall?.

To increase the security of the instance, you want to enable linux firewall. To check the current ports open in the firewall you can run

$sudo iptables -v -L

Additionally, you can check if firewall is enabled at boot time

$ chkconfig --list |grep iptables
iptables        0:off   1:off   2:on    3:on    4:on    5:on    6:off

To disable firewall at boot time you can run the below command:

$ sudo chkconfig iptables off

To confirm the runlevels (2,3,4,5), you can again run the below command:

$ chkconfig --list | grep iptables
iptables        0:off   1:off   2:off   3:off   4:off   5:off   6:off

To the save the current firewall rules to a file, you can run

$sudo iptables-save > $HOME/firewall.rules

To restore the firewall rules, you can run

$sudo iptables-restore < $HOME/firewall.rules

To temporarily stop the firewall you can run the below command (NOTE:- before you stop iptables make sure to run iptables-save command to save the rules to a file)

$sudo /etc/init.d/iptables stop

Once the firewall has stopped, you can list the rules and it will show up like

$ sudo iptables -v -L

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

To restart firewall, run

$sudo /etc/init.d/iptables start