Willy,

I have  upgraded the Linux kernel to and haproxy to 1.4.18 and kernel
to 2.6.38-15-server
Will monitor it for few days and will let you know the updates.

-Rahul N.


On Fri, Aug 10, 2012 at 2:04 AM, Willy Tarreau <w...@1wt.eu> wrote:

> On Thu, Aug 09, 2012 at 11:54:08PM +0530, Rahul Nair wrote:
> > Willy,
> >
> > >From your description, it could be an issue with some connection
> > tracking somewhere caused by excess of source addr:ports.
> >
> > Ohh ok..
> > Also I just found that as per the documentation in this link , it says
> that
> > "it can cause problems when IP connection tracking is enabled on the
> > machine, because a same connection may be seen twice with different
> states".
> > Does this mean that I need to disable the  nf_conntrack module by adding
> > "net.netfilter.nf_conntrack_acct = 0"  to "/etc/sysctl.conf" ?
>
> You can't disable nf_conntrack using a sysctl. You need to unload the
> module itself. It's not nf_conntrack_acct but nf_conntrack.
>
> > Bu default this module seems to be enabled.
> >  cat /proc/sys/net/netfilter/nf_conntrack_acct
> > 1
> >
> > Following are the answers to your questions:
> >
> > What's your haproxy version and kernel version ?
> >
> >    - HA-Proxy version: 1.4.8 2010/06/16
>
> Be careful, this is quite outdated ! 2 years of fixes have been merged
> since :
>      $ git log --pretty=oneline v1.4.8..|grep -c BUG
>      72
>
> => Your version has 72 bugs that have already been fixed now.
>    I don't remember of any affecting transparent proxying though, but
>    when you fix the issue you'd be advised to update it.
>
> >    - Kernel Version: 2.6.32-24-server
> >    - OS: Ubuntu 10.04
>
> You should also check that your kernel is up to date, as what you're
> observing might as well simply be a kernel bug.
>
> > Are you sure all your servers route back through your haproxy box ?
> >
> >    - Yes the default gateway of all the real servers is HAProxy server.
> >    - On real servers I have multiple IPs of two different networks
> >       - One which we use for communication between HAproxy server and
> Real
> >       servers.
> >       - And One which is used by the real servers to communicate with our
> >       internal application servers
>
> OK.
>
> > Did you test only from one source machine or did you have many clients ?
> >
> >    - This issue occurs intermittently from one or two different source
> IPs
> >    - At the same time when I check the functionality from another source
> >    IP, it works fine.
>
> Fine, then it really makes me think about a conntrack issue. Also, you
> should ensure that your client never directly talks to the server without
> passing via haproxy (which I can imagine you do during your tests when
> observing the issue). It only makes the problem worse with conntrack.
>
> Regards,
> Willy
>
>


-- 
-Rahul N.
IT Department
In2M Technologies Pvt Ltd. (Finicity)
Website: www.finicity.com/india

Reply via email to