Re: Question about source IP persistence (balance source) when a server goes down:

2009-01-17 Thread Willy Tarreau
Hi Malcolm, On Fri, Jan 16, 2009 at 02:48:18PM +, Malcolm Turnbull wrote: The manual states that when using balance source: The source IP address is hashed and divided by the total weight of the running servers to designate which server will receive the request. This ensures that the

Re: Balancing OpenLDAP

2009-01-19 Thread Willy Tarreau
On Mon, Jan 19, 2009 at 10:16:46PM +0100, Jordi Espasa wrote: Jordi's question got me thinking. Does haproxy support externally scripted healthchecks? If not, this would be useful for implementing a variety of healthchecks that aren't built into haproxy. Yes. It would be a very cool feature.

Re: HAProxy: listening port set up and performance

2009-01-19 Thread Willy Tarreau
Hi, On Mon, Jan 19, 2009 at 06:11:13PM -0800, Hsin, Chih-fan wrote: Hi, I am new to HAProxy and have questions about the configuration and performance. I downloaded HAProxy 1.3.15.7 from http://haproxy.1wt.eu/blocked::http://haproxy.1wt.eu/ to /home/user/Tool Unpacked it by tar

Re: Balancing OpenLDAP

2009-01-20 Thread Willy Tarreau
On Tue, Jan 20, 2009 at 07:43:25PM +0800, Unai Rodriguez wrote: How about writing a bash script that checks LDAP status somehow and have this script managed by xinetd? The script should return HTTP/1.1 200 OK\r\n if the LDAP server is fine or something else if not (e.g. HTTP/1.1 503

Re: reqrep help

2009-01-21 Thread Willy Tarreau
Hi Dave, On Wed, Jan 21, 2009 at 12:44:53PM -0500, Dave Pascoe wrote: Long-time haproxy user...first time poster. Finally ran into a rewrite issue I just haven't been able to solve. Seems like it ought to be simple. Problem: Need to rewrite requests like /foo/favicon.ico and to just

Re: stats socket problem

2009-01-21 Thread Willy Tarreau
Hi Martin, On Wed, Jan 21, 2009 at 12:13:35PM +0100, Martin Karbon wrote: Hi I am relatively new to this great software and I am having problems with the feature stats socket. it won't write the haproxy.stat file no matter what. so I cannot run the socat. r...@lb1:~# echo show stat |

Re: stats socket problem

2009-01-21 Thread Willy Tarreau
On Wed, Jan 21, 2009 at 09:43:58PM +0100, Martin Karbon wrote: Quoting Willy Tarreau w...@1wt.eu: Hi Willy, thanks for the fast reply Hi Martin, On Wed, Jan 21, 2009 at 12:13:35PM +0100, Martin Karbon wrote: Hi I am relatively new to this great software and I am having problems

Re: Problems with HAProxy, down servers and 503 errors

2009-01-25 Thread Willy Tarreau
Hi John, On Sun, Jan 25, 2009 at 11:23:24AM -0500, John Marrett wrote: I'm embarassed to report that this is not an HAProxy issue. Don't feel embarassed. I'm glad that you found the issue. And it's kind to send us an update. In addition to the changes being made on the load balancing level,

Re: Stunnel + HAProxy + Apache + Tomcat

2009-01-25 Thread Willy Tarreau
Hi Jill, On Thu, Jan 22, 2009 at 02:30:55PM -0500, Jill Rochelle wrote: I'm just getting started with all this; I thought I had this working last year, but having issues now. When using stunnel and xforwardfor with haproxy, is the URL suppose to stay https or will it change to http? If

Re: Problems with HAProxy, down servers and 503 errors

2009-01-25 Thread Willy Tarreau
On Sun, Jan 25, 2009 at 07:06:23PM -0500, John Marrett wrote: Willy, No problem, no time wasted yet ! Well, none of your time :) It took me far longer than it should have to realise my error. Regretable, packet captures are usually my first diagnostic tool. A mistake I won't make again

Re: Reducing I/O load of logging

2009-02-13 Thread Willy Tarreau
Hi guys, On Fri, Feb 13, 2009 at 08:04:50AM -0500, John Lauro wrote: It wouldn't hurt to put RHEL 5 or Centos 5 on the box instead of FC. FC is generally meant for desktops instead of servers. A customer has encountered a similar issue a few times on RHEL3. We noticed there was swap on the

Re: Response with leading space?

2009-02-14 Thread Willy Tarreau
On Sat, Feb 14, 2009 at 10:19:33AM -0500, Luke Melia wrote: On Fri, Feb 13, 2009 at 09:30:18PM +0100, Willy Tarreau wrote: Wow. That's pretty strange. I don't see any possibility for haproxy to do something like this, especially at the beginning of the data. But I can't imagine how nor why

Re: Problem with haproxy under testload

2009-02-19 Thread Willy Tarreau
Hi Valentino, On Thu, Feb 19, 2009 at 11:04:21AM -0800, Valentino Volonghi wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, I've been trying to use haproxy 1.3.15.7 in front of a couple of erlang mochiweb servers in EC2. The server alone can deal with about 3000 req/sec and I

Re: HAProxy mod_rails (Passenger)

2009-02-19 Thread Willy Tarreau
On Thu, Feb 19, 2009 at 10:02:36AM +0100, Matthias Müller wrote: Hello there I'm trying to find a suitable solution to load balance Rails applications via Passenger and HAProxy.Currentliy I'm doing a lot of testing using Apache Bench. The setting is as simple as follows: machine A:

Re: Read stat or info from the socket via perl

2009-02-19 Thread Willy Tarreau
Hi, On Sat, Feb 14, 2009 at 10:53:11PM +0100, vmware vmware wrote: Hi all, I am trying to read the information (show info, show stat) from the socket of haproxy with a perl script in order to get a similar result when using the socat command. The problem is that I am not able to read

Re: Problem with haproxy under testload

2009-02-19 Thread Willy Tarreau
On Thu, Feb 19, 2009 at 03:59:54PM -0800, Valentino Volonghi wrote: Could you check net.ipv4.tcp_tw_reuse, and set it to 1 if it's zero ? It probably was set to 0... This fix and the change of tcp_mem to the standard values (which are created dynamically depending on the available memory)

Re: Read stat or info from the socket via perl

2009-02-20 Thread Willy Tarreau
Hello Maria, On Fri, Feb 20, 2009 at 11:56:53AM +0100, Maria wrote: Dear Willy, I don't have a lot of experience in perl to. As Nagios allows also to do this via bash or c, I can also use this. My main goal is only to read this information with a language (supported by nagios) and send

Re: protection against DDoS attacks

2009-02-24 Thread Willy Tarreau
On Tue, Feb 24, 2009 at 07:43:53PM +0300, Ahmad Al-Ibrahim wrote: Hi, I'm using HAProxy in the frontend as a reverse proxy to backend servers, I'm thinking of possible ways to protect backend servers from being attacked. How effective is doing url redirect to protect against these

Re: Tw timeout server, but no retries happened? sQ 503 NOSRV error in logs

2009-02-24 Thread Willy Tarreau
On Mon, Feb 23, 2009 at 12:12:43PM -0800, Michael Fortson wrote: Feb 23 18:50:22 www haproxy[15344]: 11.1.11.1:45025 [23/Feb/2009:18:50:21.939] webservers fast_mongrels/NOSRV 0/101/-1/-1/101 503 212 - - sQ-- 322/309/9/0/0 0/1 GET /blahblah/update/57f6c2408f HTTP/1.1 sQ The session spent

Re: Just a small inconsistency in the docs for listening on multiple ports?

2009-02-26 Thread Willy Tarreau
Hi Malcolm, On Thu, Feb 26, 2009 at 11:45:31AM +, Malcolm Turnbull wrote: I'm using haproxy-1.3.15.7.tar.gz for some testing and looking at the options to bind multiple ports. The docs imply that you can use a line such as: listen    VIP_Name :80,:81,:8080-8089 But this gives me :

Re: option httpchk is reporting servers as down when they're not

2009-03-06 Thread Willy Tarreau
Hi Thomas, On Thu, Mar 05, 2009 at 08:45:20AM -0500, Allen, Thomas wrote: Hi Jeff, The thing is that if I don't include the health check, the load balancer works fine and each server receives equal distribution. I have no idea why the servers would be reported as down but still work when

Re: load balancer and HA

2009-03-06 Thread Willy Tarreau
On Wed, Mar 04, 2009 at 12:12:21AM +0100, Alexander Staubo wrote: On Tue, Mar 3, 2009 at 11:44 PM, Martin Karbon martin.kar...@asbz.it wrote: just wanted to know if anyone knows an opensource solution for a so called transparent failover: what I mean with that is, I installed two machines

Re: measuring haproxy performance impact

2009-03-06 Thread Willy Tarreau
On Fri, Mar 06, 2009 at 11:23:02AM -0800, Michael Fortson wrote: On Fri, Mar 6, 2009 at 8:43 AM, Willy Tarreau w...@1wt.eu wrote: Hi Michael, On Thu, Mar 05, 2009 at 01:04:06PM -0800, Michael Fortson wrote: I'm trying to understand why our proxied requests have a much greater chance

Re: measuring haproxy performance impact

2009-03-06 Thread Willy Tarreau
On Fri, Mar 06, 2009 at 11:49:39AM -0800, Michael Fortson wrote: Oops, looks like it's actually Gb - Gb: http://pastie.org/409653 ah nice ! Here's a netstat -s: http://pastie.org/409652 Oh there are interesting things there : - 513607 failed connection attempts = let's assume it was

Re: measuring haproxy performance impact

2009-03-06 Thread Willy Tarreau
On Fri, Mar 06, 2009 at 01:00:38PM -0800, Michael Fortson wrote: Thanks Willy -- here's the sysctl -a |grep ^net output: http://pastie.org/409735 after a quick check, I see two major things : - net.ipv4.tcp_max_syn_backlog = 1024 = far too low, increase it to 10240 and check if it helps

Re: question about queue and max_conn = 1

2009-03-06 Thread Willy Tarreau
Hi Greg, On Fri, Mar 06, 2009 at 03:54:13PM -0500, Greg Gard wrote: hi willy and all, wondering if i can expect haproxy to queue requests when max conn per backend it set to 1. running nginx haproxy mongrel/rails2.2.2. yes, it works fine and is even the recommended way of setting it for

Re: Dropped HTTP Requests

2009-03-06 Thread Willy Tarreau
On Fri, Mar 06, 2009 at 04:55:21PM -0500, Timothy Olson wrote: I'm using HAProxy 1.3.15.7 to load-balance three Tomcat instances, and to fork requests for static content to a single Apache instance. I've found that after the initial HTML page is loaded from Tomcat, the browser's subsequent

Re: measuring haproxy performance impact

2009-03-06 Thread Willy Tarreau
On Fri, Mar 06, 2009 at 02:36:59PM -0800, Michael Fortson wrote: On Fri, Mar 6, 2009 at 1:46 PM, Willy Tarreau w...@1wt.eu wrote: On Fri, Mar 06, 2009 at 01:00:38PM -0800, Michael Fortson wrote: Thanks Willy -- here's the sysctl -a |grep ^net output: http://pastie.org/409735 after

Re: load balancer and HA

2009-03-06 Thread Willy Tarreau
On Fri, Mar 06, 2009 at 11:47:14PM +0100, Alexander Staubo wrote: On Fri, Mar 6, 2009 at 7:48 PM, Willy Tarreau w...@1wt.eu wrote: When it comes to just move an IP address between two machines an do nothing else, the VRRP protocol is really better. It's what is implemented in keepalived

Re: load balancer and HA

2009-03-06 Thread Willy Tarreau
On Sat, Mar 07, 2009 at 12:14:44AM +0100, Alexander Staubo wrote: On Sat, Mar 7, 2009 at 12:07 AM, Willy Tarreau w...@1wt.eu wrote: A less ambitious scheme would have the new proxy take over the client connection and retry the request with the next available backend. Will not work because

Re: question about queue and max_conn = 1

2009-03-06 Thread Willy Tarreau
On Fri, Mar 06, 2009 at 10:02:03PM -0500, Greg Gard wrote: thanks for taking a look willy. let me know if there's anything else i should change. (...) defaults (...) # option httpclose This one above should not be commented out. Otherwise, client doing keepalive will artificially

[ANNOUNCE] haproxy-1.3.15.8 and 1.3.14.12

2009-03-08 Thread Willy Tarreau
Hi All, as there were a bunch of pending fixes, I have released 1.3.15.8 and 1.3.14.12. The big bug was found and fixed by Krzysztof, it involved server state tracking which could become extremely inefficient with large numbers of servers because of a typo. Some user-visible fixes include the

[ANNOUNCE] haproxy-1.3.16-rc1

2009-03-08 Thread Willy Tarreau
Hi all, Yes, this is it! 1.3.16-rc1. After almost 11 months of development! There are new features I often forget about after being used to them in the dev tree, but fortunately there are people who remind me those were not in 1.3.15 when I suggest them to use those ;-) I may forget a lot of

Re: [ANNOUNCE] haproxy-1.3.15.8 and 1.3.14.12

2009-03-08 Thread Willy Tarreau
On Sun, Mar 08, 2009 at 10:13:04PM -0400, Jeffrey Buchbinder wrote: I have attached a copy of the NSLU2 armv5b build (.ipk package) for the 1.3.15.8 release. If it doesn't attach properly, it's also available at: http://www.mediafire.com/file/bmhtdnzndu2/haproxy_1.3.15.8-1_armeb.ipk Thanks

Re: option httpchk is reporting servers as down when they're not

2009-03-09 Thread Willy Tarreau
Hi Thomas, just replying quick, as I'm in a hurry. On Mon, Mar 09, 2009 at 04:01:29PM -0400, Allen, Thomas wrote: That, along with specifying HTTP1.1, did it, so thanks! What should I load into Host: ? It seems to work fine with www, but I'd prefer to use something I understand. Please keep

Re: option httpchk is reporting servers as down when they're not

2009-03-09 Thread Willy Tarreau
On Mon, Mar 09, 2009 at 04:15:34PM -0400, Allen, Thomas wrote: I used the unit 'S' for my timeouts, as in clitimeout 60S contimeout 60S srvtimeout 60S Is that to be avoided? I assumed it meant seconds. OK it's just a minor problem. You have to use a lower-case s : 60s. It's stupid that

Re: option httpchk is reporting servers as down when they're not

2009-03-09 Thread Willy Tarreau
Hi Thomas, On Mon, Mar 09, 2009 at 05:20:49PM -0400, Allen, Thomas wrote: Hi Willy, Hm, changing to 60s for each gave me 100% 504 errors, I removed all three. Bad idea, I know, but at least it works then. then use 6, that's the old way of doing it :-) I'm running 1.2.18 because the

Re: HaProxy ACL (fwd) - access control

2009-03-15 Thread Willy Tarreau
Hi Krzysztof, On Mon, Mar 09, 2009 at 01:13:31PM +0100, Krzysztof Oledzki wrote: Hi Willy, First, please excuse that it took me nearly one moth to replay to your letter, shame on me. :( no problem, I know we're all facing the same issues trying to find time :-) In fact, I think that

Re: selinux policy for haproxy

2009-03-19 Thread Willy Tarreau
Hi, On Tue, Mar 17, 2009 at 09:26:43PM +0100, Jan-Frode Myklebust wrote: Here's an selinux policy for haproxy. The patch is built and lightly tested with haproxy-1.3.15.7-1.fc10.i386 on Fedora9, and haproxy-1.2.18 on RHEL5. believe it or not, I've never experimented at all with selinux.

Re: The gap between ``Total'' and ``LbTot'' in stats page

2009-03-22 Thread Willy Tarreau
On Thu, Mar 19, 2009 at 11:14:48PM -0700, James Satterfield wrote: I just recently upgraded my LBs to 1.3.15.8 from 1.2.something and noticed those stats. I was wondering about them as well. In my setup those numbers only seem to differ where I'm using cookies for persistence. Normally

Re: Can Haproxy work as a TCP-multiplexer i.e. combine requests into one connection to a server?

2009-03-22 Thread Willy Tarreau
Hi Malcolm, On Thu, Mar 19, 2009 at 11:42:31AM +, Malcolm Turnbull wrote: Possibly a stupid question but: Can Haproxy work as a TCP-multiplexer i.e. combine requests into one connection to a server? Or would that be related to using keep-alive? It requires that we get keep-alive to work

[ANNOUNCE] haproxy-1.3.16 (Stable)

2009-03-22 Thread Willy Tarreau
Hi all, now that's it for real. 1.3.16 is out. And with it, I'm declaring 1.3 as the new stable branch. That means that only fixes and minor feature enhancements may be merged in future 1.3 versions. New development will take place in 1.4 or maybe 2.0, I'll see. Anyway I'd like to adopt a new

Re: option httpchk is reporting servers as down when they're not

2009-03-25 Thread Willy Tarreau
Hi Thomas, On Wed, Mar 25, 2009 at 12:57:41PM -0400, Allen, Thomas wrote: Hi Willy, We now have HAProxy running over our freshly released website: http://www.infrastructurereportcard.org/ thanks for the heads up ! Thanks for this great piece of software and all the help! Only two

Re: some specfile fixes

2009-03-27 Thread Willy Tarreau
Hi Jan-Frode, On Thu, Mar 26, 2009 at 03:45:53PM +0100, Jan-Frode Myklebust wrote: And here's the patch that does everything I want to do to the specfile... Sorry about the noise. Thanks for your work on this. I have no way to test that the specfiles work, and I only update a few fields in

Re: High Cpu usage : fixed

2009-03-29 Thread Willy Tarreau
Guys, I've released 1.3.17 which fixes the high CPU usage. Bart Bobrowski helped me a lot tracking this bug that I could not reproduce here. It was caused by a timeout being re-armed just after a socket is being closed. Regards, Willy

Re: cpu 100% at strange times, epoll_wait and gettimeofday gets called too often

2009-03-29 Thread Willy Tarreau
Hi, On Fri, Mar 27, 2009 at 01:09:30PM +0100, Remco Verhoef wrote: Hi, We're experiencing strange behaviour of haproxy-1.3.15.8 and haproxy-1.3.16, at frequent times it will use 100% cpu. It appears that it is wait_time is not used. I've used both poll and epoll, same behaviour. The

Re: balance source based on a X-Forwarded-For

2009-03-29 Thread Willy Tarreau
On Sun, Mar 29, 2009 at 07:46:05PM +0200, benoit wrote: Jeffrey 'jf' Lim a écrit : On Wed, Mar 25, 2009 at 8:02 PM, Benoit maver...@maverick.eu.org wrote: diff -ru haproxy-1.3.15.7/doc/configuration.txt haproxy-1.3.15.7-cur/doc/configuration.txt --- haproxy-1.3.15.7/doc/configuration.txt

Re: balance source based on a X-Forwarded-For

2009-03-29 Thread Willy Tarreau
On Sun, Mar 29, 2009 at 12:31:27PM -0700, John L. Singleton wrote: I'm a little mystified as to the usefulness of this as well. I mean, what does hashing the domain name solve that just balancing back to a bunch of Apache instances with virtual hosting turned on doesn't? Are you saying

Re: balance source based on a X-Forwarded-For

2009-03-29 Thread Willy Tarreau
On Sun, Mar 29, 2009 at 10:17:39PM +0200, benoit wrote: BTW Benoit, be careful, you left some fprintf() in your patch. Regards, Willy Heck yes, i'll have to check on this thanks. You're welcome. Btw, why isn't this list set with a default reply to the list ? Because I hate it when

Re: x-client with SMTP, revisited

2009-03-30 Thread Willy Tarreau
Hi Eric, On Sun, Mar 29, 2009 at 09:06:40PM -0700, Eric Schwab wrote: We would like to use x-client with the SMTP protocol with haproxy, as a means to pass along some basic data to the backend SMTP servers. We looked into this a month or two ago and Willy mentioned that this would be

Re: [RFC] development model for future haproxy versions

2009-03-30 Thread Willy Tarreau
On Tue, Mar 31, 2009 at 10:57:26AM +0800, Jeffrey 'jf' Lim wrote: On Tue, Mar 31, 2009 at 5:06 AM, Willy Tarreau w...@1wt.eu wrote: Hi all! Now that the storm of horror stories has gone with release of 1.3.17, I'd like to explain what I'm planning to do for future versions of haproxy

Re: Forcing SSL encryption (a.k.a. 'redirect' keyword not recognised)

2009-04-02 Thread Willy Tarreau
On Wed, Apr 01, 2009 at 12:57:36PM +0300, John Doe wrote: I am perplexed as HAproxy 1.3.15.8 doesn't recognise the 'redirect' keyword. And it's right because 1.3.15.8 does not have it. This was implemented in 1.3.16 (use 1.3.17 instead, 1.3.16 is buggy). Also, be careful, there's a small

Re: patch: nested acl evaluation

2009-04-02 Thread Willy Tarreau
Hi Jeffrey, On Thu, Apr 02, 2009 at 02:23:44PM +0800, Jeffrey 'jf' Lim wrote: (...) Ok perhaps combinatorial was not the word that i should have used, but... I hope you can see the point/s with the explanation that i gave. The head acl only gets checked once - thereafter which it goes into

Re: patch: nested acl evaluation

2009-04-04 Thread Willy Tarreau
On Sat, Apr 04, 2009 at 10:20:23AM +0800, Jeffrey 'jf' Lim wrote: OK maybe use is OK in fact, considering the alternatives. :) some proposals for the keywords: for/use condition/use cond/use (cond/use seems the best compromise - short, but understandable enough) what would you

Re: tcp proxy

2009-04-04 Thread Willy Tarreau
On Sat, Apr 04, 2009 at 11:43:38AM -0300, Nicolas Cohen wrote: Hi Willy, It seems right to implement it. I'll review this with the team and let you know once we have an available patch. Nice, thanks! Willy

Re: Delay incoming tcp connections

2009-04-04 Thread Willy Tarreau
Hi, On Sat, Apr 04, 2009 at 07:46:28PM +0400, Alexey wrote: Hi, I saw post about delaying incoming smtp connections via haproxy. Looks like I need transparent proxy for saving source ip addresses, but it requires TPROXY in linux kernel. yes it does. I need to patch kernel + iptables

Re: Forcing SSL encryption (a.k.a. 'redirect' keyword not recognised)

2009-04-12 Thread Willy Tarreau
Hi, On Tue, Apr 07, 2009 at 11:05:16AM +0300, John Doe wrote: Hi For some reason acl stunnel src 10.0.0.0/8 doesn't seem to work (with version 1.3.15.8). That's not expected at all. Are you sure you were not mixing up with another problem ? Could you please retest with 1.3.17 ?

Re: httpchk with apache tomcat

2009-04-12 Thread Willy Tarreau
On Tue, Apr 07, 2009 at 12:34:37PM -0400, Jill Rochelle wrote: I have a unique, maybe not unique, situation. The flow is like this In on apache 80 haproxy on 85 to find servers server is tomcat server but port is which goes back to apache then apache uses mod_jk to forward to

Re: Using acls to check if # connections less than number of up servers

2009-04-12 Thread Willy Tarreau
On Tue, Apr 07, 2009 at 02:58:27PM -0700, Karl Pietri wrote: Hey all I'm trying to use Acls to have a priority queue of servers for a special ip/port and fail over to the regular section and i'm wondering if its possible to have an acl that would check if dst_conn gt nbsrv(backend); the code

Re: [PATCH] Added 'option inject' for mode 'tcp'

2009-04-16 Thread Willy Tarreau
Hi Maik, On Fri, Apr 17, 2009 at 04:29:11AM +0200, Maik Broemme wrote: Hi, attached is a patch which adds a new option to HAProxy called 'inject' for the mode 'tcp'. In the current version of this patch you can only add data at the beginning of the session. I think this is very useful - at

Re: Simple TCP with backup config

2009-04-19 Thread Willy Tarreau
Hi Michael, On Fri, Apr 17, 2009 at 04:47:38PM +0100, Michael Miller wrote: Hi, I am doing some intial testing with HAProxy and have come across a problem I don't seem to be able to resolve. A summary of what I am initially trying to achieve follows. I am trying to use HAProxy to provide

Re: haproxy 1.3.14.2 bad request outage

2009-04-24 Thread Willy Tarreau
Hi, On Fri, Apr 24, 2009 at 09:36:34AM +0200, Jean-Baptiste Quenot wrote: Hi there, This morning I noticed interesting problems regarding haproxy (1.3.14.2 here, yes I know archeology might be involved, I must upgrade). I have to say that we had a blackout during a few hours this night on

Re: 1.3.17 in TCP mode sees dead servers (but they're not)

2009-05-06 Thread Willy Tarreau
On Mon, May 04, 2009 at 11:47:10AM +0200, Nicolas MONNET wrote: I'm experiencing a problem since updating to 1.3.17, whereby checks periodically see a backend service as down, one at a time, but for all 3 checks; and it picks right up again on the next check. Not sure what info I could get

Re: [PATCH] Fix 'tcp-request content [accept|reject] if condition' parser for missing 'if'.

2009-05-12 Thread Willy Tarreau
Hi Maik, On Tue, May 12, 2009 at 01:36:46AM +0200, Maik Broemme wrote: Hi, attached is a patch which fixes a configuration mistake regarding the 'tcp-request' option. If you have the following in your configuration file: acl localnet dst 10.0.0.0/8 tcp-request

Re: TCP traffic multiplexing as balance algorithm?

2009-05-12 Thread Willy Tarreau
Hi Maik, On Tue, May 12, 2009 at 01:57:47AM +0200, Maik Broemme wrote: Hi, I have a small question. Did someone know if it is possible to do simple traffic multiplexing with HAProxy? Maybe I am missing it somehow, but want to ask on the list before creating a patch for it. what do you call

Re: New HAProxy user keeps loosing connection

2009-05-13 Thread Willy Tarreau
On Wed, May 13, 2009 at 04:53:15PM -0400, Tom Potwin wrote: Thanks Alex for the info. Unfortunately, I'm already using 'option httpclose'. Here's my current cfg: global log 127.0.0.1 local0 log 127.0.0.1 local1 notice #log loghostlocal0 info maxconn

Re: reloading haproxy

2009-05-17 Thread Willy Tarreau
Hi Adrian, On Thu, May 14, 2009 at 03:33:39PM +0200, Adrian Moisey wrote: Hi I tried that, also gave the same result. What is happening is that the new haproxy process asks the old one to release the ports so that it can bind to them. So there exists a short period of time (a few hundreds of

Re: New to HAproxy - how to define custom health-check msg?

2009-05-17 Thread Willy Tarreau
Hi, On Fri, May 15, 2009 at 10:51:20AM -0400, John Lauro wrote: I think there might be a better way, but you could run the check against a different port. On that other port, you could have it run your custom check and return an OK response if your check passes and fail if it doesn't. That's

Re: Multiple httpchks per Backend (some ideas...)

2009-05-17 Thread Willy Tarreau
Hi Craig, -- I replied too early to another mail without CCing you, please consult the thread how to define custom health-check msg -- And yes, I'm for script-based checks ;-) Willy On Fri, May 15, 2009 at 05:38:38PM +0200, Craig wrote: Hi, I'd really like to do multiple and advanced

Re: ForwardFor Option Not Working?

2009-05-18 Thread Willy Tarreau
Hi Michael, On Mon, May 18, 2009 at 04:21:14PM +, Michael Tinnion wrote: Hi, I've very limited experience with HAProxy and I'm trying to get the ForwardFor option to work but with no joy. I've set the following in my 'listen' section option httpclose option

Re: difference between USE_TCPSPLICE and USE_LINUX_SPLICE?

2009-05-18 Thread Willy Tarreau
On Mon, May 18, 2009 at 11:51:04AM -0700, Brian Kruger wrote: Hi, probably a question maybe covered elsewhere and I apologize as I couldn't find anything, but am curious what the difference is between USE_TCPSPLICE and USE_LINUX_SPLICE? I know TCP_SPLICE is a patch that's needed (possibly

Re: New to HAproxy - how to define custom health-check msg?

2009-05-22 Thread Willy Tarreau
On Fri, May 22, 2009 at 09:34:39PM +0530, Sanjeev Kumar wrote: Newbie question: In response to http-health-chk string: HEAD /index.html HTTP/1.0 , if my server responds responds with only one line: HTTP/1.0 200 OK , will the health will be accepted ok. (HAproxy in not accepting this

Re: HAProxy - Inline Monitoring?

2009-05-24 Thread Willy Tarreau
Hi, On Fri, May 22, 2009 at 11:37:14AM -0700, Jonah Horowitz wrote: I¹m currently testing HAProxy for deployment. Right now we use NetScaler load balancers, and the provide a feature called ³inline monitoring². With inline monitoring the Netscaler will take a server out of rotation if it

Re: how to enable TCP/IP logging in HAproxy

2009-05-25 Thread Willy Tarreau
Hi, On Mon, May 25, 2009 at 12:22:25PM +0530, Sanjeev Kumar wrote: I need to debug why Http-healthCheck respoanse is received by proxy-machine, but HAproxy says no. Event log just displays single message: server down. How to enable detailed TCP logging in HAproxy? haproxy supports several

Re: Persistence based on a server id url param

2009-06-02 Thread Willy Tarreau
Hi Ryan, On Mon, Jun 01, 2009 at 12:22:57PM -0700, Ryan Schlesinger wrote: I've got haproxy set up (with 2 frontends) to load balance a php app which works great. However, we're using a java uploader applet that doesn't appear to handle cookies. It would be simple for me to have the

Re: Haproxy stop to serve http

2009-06-22 Thread Willy Tarreau
Hi Luca, On Mon, Jun 22, 2009 at 01:38:53PM +0200, Luca Pimpolari - Multiplayer wrote: Hi to all, I'm using haproxy to serve our web infrastructure, it serves about 500/600 concurrency connection, with some peak to 1000/1200 concurrency connection. All work great, and performance are

Re: stats are cut off

2009-06-22 Thread Willy Tarreau
On Mon, Jun 22, 2009 at 04:22:44PM +0200, Krzysztof Oledzki wrote: On Mon, 22 Jun 2009, Angelo Höngens wrote: Hey guys and girls, Hello, I'm a happy user of HAProxy, and for one of my new projects I'm running into a small problem. I have a new configuration with a 120 different

Re: Redirection with 301 for all subdomains with exception

2009-06-22 Thread Willy Tarreau
On Mon, Jun 22, 2009 at 08:32:36PM +0200, Falco SCHMUTZ wrote: Hello everybody, Could you help to fix this configuration ? I need to redirect all sub domains except 5 (admin, pro, www, img*, domain.com without sub domain) to www.domain.com I test this setting, but did not work. acl

Re: EPEL package upgraded from 1.3.14 - 1.3.18 config issues

2009-06-24 Thread Willy Tarreau
On Wed, Jun 24, 2009 at 03:03:11PM +0200, Denis Braekhus wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Willy Tarreau wrote: The build optionns are different apparently. Please run haproxy -vv on both binaries, they will report their respective build options, and presumably

Re: reset stats?

2009-06-25 Thread Willy Tarreau
On Thu, Jun 25, 2009 at 12:51:23PM -0400, Dave Pascoe wrote: Is there a way to reset haproxy stats numbers without restarting haproxy or sending a -sf? no because it's a new process starting with new stats. I know it's sometimes annoying when you're doing the initial tuning of your config, but

Re: Haproxy testing

2009-06-25 Thread Willy Tarreau
On Thu, Jun 18, 2009 at 08:11:35PM +0100, Chris Sarginson wrote: That's great Malcolm, I'll check that out, and sorry for the apallingly vague subject! warning, there are some issues with this patch. A careful code review shows that you can get nasty behaviour if the server returns no

Re: option forwardfor except network issue

2009-06-25 Thread Willy Tarreau
On Tue, Jun 16, 2009 at 04:06:36PM +0100, Sigurd Høgsbro wrote: Hello all, I'm trying to deploy haproxy as a replacement for the proxy-module in lighttpd 1.5svn (not yet released), and have managed to mostly configure it to my desires. I'm having problems getting haproxy to recognise all

Re: tcp wierdness with mysql

2009-06-25 Thread Willy Tarreau
On Mon, Jun 15, 2009 at 05:19:34PM -0700, Dima Brodsky wrote: Hi, I wonder if anybody has seen this problem with haproxy 1.3.17. We have a mysql server behind an haproxy and about 5% of the queries hang and cause haproxy to time out, i.e. the query returns after 150 seconds. On

haproxy to protect apache against Slowloris and Nkiller2 DoS attacks

2009-06-28 Thread Willy Tarreau
Hi all, since I'm seeing worried people everywhere about the apache vulnerability as they call it (while it's just a reuse of a well-known weakness), and other people suggesting incomplete haproxy configuration files, I have prepared a generic haproxy configuration file to be installed without

Re: R: Delay problem

2009-06-29 Thread Willy Tarreau
Hello, On Mon, Jun 29, 2009 at 04:44:13PM +0200, Carlo Granisso wrote: Ok, it seems that problem was in: contimeout clitimeout I've reduced these parameters and now seems that all is working fine. I've read haproxy documentation but I can't completly understand the meaning

Re: Rising number of connections

2009-07-02 Thread Willy Tarreau
On Thu, Jul 02, 2009 at 03:08:39PM -0400, John Marrett wrote: Have you perhaps incorrectly configured your SNMP tool to graph the value as a gauge instead of a counter (I assume that the SNMP module returns counters)? That would produce a continuously increasing graph. As to the old

Re: Redirection with 301 for all subdomains with exception

2009-07-03 Thread Willy Tarreau
On Fri, Jul 03, 2009 at 12:25:46PM +0200, Falco SCHMUTZ wrote: Hello, I have one question more about redirection : We want to redirect one old domain to the new one with some conditions. We configure some acl like this and it's work fine : acl es path_beg /es redirect location

Re: Rising number of connections

2009-07-05 Thread Willy Tarreau
On Sun, Jul 05, 2009 at 08:06:17PM +0100, Peter Miller wrote: Ah, we downloaded from the 'Download' section on the site, which is still defaulting to 1.3.17 rather than the 'Latest versions' which has the link to the 1.3.18 source. Luckily we're on 32-bit x86, but will upgrade asap. Oops,

Re: Selective logging

2009-07-08 Thread Willy Tarreau
Hi, On Tue, Jul 07, 2009 at 05:41:40PM +0100, Alex Forrow wrote: Hi, We have been using HAProxy very successfully on a busy website for a while now, sending all logs via syslog to a separate server. A single frontend is used to serve all public requests, and currently logs everything.

Re: httpchk is marking Apache host as down

2009-07-08 Thread Willy Tarreau
On Tue, Jul 07, 2009 at 02:50:18PM +0100, Pedro Mata-Mouros Fonseca wrote: Greetings, In the following configuration I'm doing an httpchk for an Apache host: backend hosts option httpchk server host1 127.0.0.1:8081 maxconn 50 check This is what shows up in the logs:

Re: Redirection with 301 for all subdomains with exception

2009-07-08 Thread Willy Tarreau
Hi, On Mon, Jul 06, 2009 at 02:05:09PM +0200, Falco SCHMUTZ wrote: Hello, I m sorry to disturb you again, but some problem persist. This is my final configuration and it works fine : acl es path_beg /es redirect location http://www.newdomain.com/es/marruecos.html code 301 if es acl en

Re: nginx 400 status code sometimes reported as 502 in haproxy

2009-07-09 Thread Willy Tarreau
On Thu, Jul 09, 2009 at 04:47:23PM +0200, Jean-Baptiste Quenot wrote: I could reproduce the issue in a test setup. Haproxy is running on port 80 and nginx on port 83. The client sends a very long cookie header value (4104 bytes). I used tcpdump -s 0 -i lo -w dump port 83, loaded the dump in

Re: Capture and alter a 404 from an internal server

2009-07-22 Thread Willy Tarreau
On Mon, Jul 20, 2009 at 10:11:16AM +0100, Pedro Mata-Mouros Fonseca wrote: Thank you so much Maciej, I will give it a try - although in that referenced email it seems like a scary thing to do... A hard thing to evaluate is the cost of having such rspirep processing in every response

Re: Transparent proxy of SSL traffic using Pound to HAProxy backend patch and howto

2009-07-22 Thread Willy Tarreau
On Mon, Jul 20, 2009 at 03:23:22PM +0100, Malcolm Turnbull wrote: Many thanks to Ivansceó Krisztián for working on the TPROXY patch for Pound for us, we can finally do SSL termination - HAProxy - backend with TPROXY.

Re: Still dropping TS sessions.

2009-07-22 Thread Willy Tarreau
Hi guys, On Wed, Jul 22, 2009 at 08:52:05AM -0400, Guillaume Bourque wrote: Hi Paul I just retrun from vacation so I did'nt see your previous post, but 1 thing for sure haproxy CAN be use to dispatch RDP session, I have been doing this on a couple of site with ~80 users and 4 TS servers

Re: queing problems

2009-07-22 Thread Willy Tarreau
Hi Fabian, On Mon, Jul 20, 2009 at 06:11:45PM +0200, Fabian wrote: Hi List, I'm trying to set up a simple tcp load balancing: The backend servers can only handle one request at a time and the requests take between 2-15 seconds to process. I want haproxy to distribute the tcp requests to

Re: make on os x

2009-07-22 Thread Willy Tarreau
Hi, On Thu, Jun 11, 2009 at 09:51:00AM +0200, Rapsey wrote: Sorry error in -vv output, TARGET = darwin Sergej On Thu, Jun 11, 2009 at 9:46 AM, Rapsey rap...@gmail.com wrote: I'm trying to build haproxy with kqueue on osx leopard, but I don't think it's working. There is no mention of

Re: make on os x

2009-07-23 Thread Willy Tarreau
On Thu, Jul 23, 2009 at 08:40:23AM +0200, Rapsey wrote: Yes thank you. I figured it out eventually and used the same command as you wrote to build, but kqueue was still not getting enabled. This is the make command I eventually figured out works without issues (uses the default Makefile):

Re: queing problems

2009-07-23 Thread Willy Tarreau
On Thu, Jul 23, 2009 at 03:08:52PM +0200, Fabian wrote: H Willy, Willy Tarreau schrieb: Your configuration is right. I think that your problem is simply that when you have too many incoming requests, the time to process them all one at a time is too long for the last one to be served

Re: make on os x

2009-07-25 Thread Willy Tarreau
On Thu, Jul 23, 2009 at 01:31:28PM +0200, Rapsey wrote: Even with darwin kqueue was not enabled, I tried it. Why is there even a separate osx makefile if the default one works? I don't remember, it was contributed. I believe it was due to a different make install procedure, though I'm not

  1   2   3   4   5   6   7   8   9   10   >