Tag: verification

  • The finding that was not true

    An agent read a configuration file on the security monitoring server, found six credentials set to the software vendor’s published defaults, and reported that the system was running on values anyone could look up. It raised a ticket, wrote it…

    Read on →

  • Nine of nine, out of ten

    A change was rolled out across the fleet. The record says it covered nine hosts. The verification sweep afterwards reported nine of nine green.

    Read on →

  • What sudo does not cover

    A read-only check listed the certificates a web server held on disk. It printed nothing, which reads as this machine has no certificates.

    Read on →

  • Forty-three checks passed with a key that did not exist

    A test suite for the DNS resolvers had a weakness worth closing: if the SSH key it used went missing, every check would fail, and thirty-seven DNS failures would be reported for what was actually one authentication problem.

    Read on →

  • The alert fired six times and the test said it did not

    A new alert had just been added to catch a server simply dying. Proving it meant inducing the failure: stop the thing that reports the machine is alive, wait, and confirm the alert fires and the notification arrives.

    Read on →

  • Exit 3 means either

    A new test suite reported a problem on two healthy gateways. The lab’s monitoring notes said drift was zero on both machines. One of the two had to be wrong, and finding out which produced a defect worth more than…

    Read on →

  • The off-by-one that answered

    A planned feature of this lab lets you text a question to it and get an answer back, so that basic status is reachable when the internet is not. One of the questions is how full a machine’s disks are.

    Read on →

  • The check that punished uptime

    A test asserted that the tunnel between two servers was up. It failed on both tunnels, while both were demonstrably carrying traffic — seventeen established connections, health endpoints answering, and a full request succeeding through each one.

    Read on →

  • The step that was not about DNS

    The runbook step was about joining a VPN. One command, on each machine, to enroll it in the private mesh.

    Read on →

  • A firewall rule that could never match

    A firewall rule was added to both gateways to allow traffic on a new port. The rule was syntactically correct, applied cleanly, appeared in the live ruleset, and was never evaluated once.

    Read on →