Re: Frequent disconnections occurring now

[Nick Couchman]

On Thu, Jun 9, 2022 at 12:36 AM Lockhart, Roland 
wrote:

> Hi
>
>
>
> The server is hosted in AWS, so drivers are native. Instance is T2.large
> if you know what that is
>
>
>
> Internal network traffic is symmetrical line speed determined by the
> instance type. Internet will be the same
>
>
>
> HM VM’s does the host have? Hundreds I would guess. Hypervisor in ZEN
>
>
>
> The instances runs 5 docker containers with proxy, database and 3 guac
> services
>
>
>
> The guac version is 0.99
>
>
There was never any such version as 0.99 - there probably was a 0.9.9, but
that is many years old. Can you confirm that this is indeed the version of
Guacamole you're running? If so, you might want to start by upgrading it.

-Nick

>

RE: Frequent disconnections occurring now

[Lockhart, Roland]

Hi

The server is hosted in AWS, so drivers are native. Instance is T2.large if you 
know what that is

Internal network traffic is symmetrical line speed determined by the instance 
type. Internet will be the same

HM VM's does the host have? Hundreds I would guess. Hypervisor in ZEN

The instances runs 5 docker containers with proxy, database and 3 guac services

The guac version is 0.99

Hope that helps

Roland



From: Sean Hulbert 
Sent: Thursday, June 9, 2022 11:52 AM
To: user@guacamole.apache.org
Subject: RE: Frequent disconnections occurring now

CAUTION: This email originated from outside of the organization. Do not click 
links or open attachments unless you recognize the sender and know the content 
is safe.

What type of bandwidth do you have?

Upload
Download

Are you symmetrical or Asymmetrical on speeds?

Then on your internal network, are you 1000Mbps or 100Mbps.
Also does the Guacamole system have the VM drivers installed ?
What type of load does the host server have (how many VMs running at once)

What type of Hypervisor ?

Microsoft Hyper-v
Citrix Xenserver
VMware ESXi
Oracle cloud/virtual box ?

The more I know about your infrastructure the better I can assist.


Thank You
Sean Hulbert

Founder / CEO
Work Ph: 925.292.4309

www.securitycentric.net<http://www.securitycentric.net/>
A Cybersecurity Enablement Company
We don't just run you through the motions, Our labs teach you how to think!

 [logo-acad400]

System Award Management
CAGE: 8AUV4

AFCEA San Francisco Chapter V.P.

If you have heard of a hacker by name, he/she has failed, fear the hacker you 
haven't heard of!

CONFIDENTIALITY NOTICE: This communication with its contents may contain 
confidential and/or legally privileged information. It is solely for the use of 
the intended recipient(s). Unauthorized interception, review, use or disclosure 
is prohibited and may violate applicable laws including the Electronic 
Communications Privacy Act. If you are not the intended recipient, please 
contact the sender and destroy all copies of the communication. Content within 
this email communication is not legally binding as a contract and no promises 
are guaranteed unless in a formal contract outside this email communication.

igitur qui desiderat pacem, praeparet bellum!!!

Epitoma Rei Militaris

From: Lockhart, Roland [mailto:r.lockh...@aamgroup.com]
Sent: Wednesday, June 8, 2022 8:05 PM
To: user@guacamole.apache.org<mailto:user@guacamole.apache.org>
Subject: RE: Frequent disconnections occurring now

Thanks Sean

The server is 2 vcpu 8GB RAM, moderate network

For the last 4 weeks, while disconnections are occurring, CPU has not got above 
30%

We have about 25 users, but not more than 5 concurrent users at any time

Version is older.

Any guidance appreciated

Roland




From: Sean Hulbert 
mailto:shulb...@securitycentric.net.INVALID>>
Sent: Wednesday, June 1, 2022 9:37 AM
To: user@guacamole.apache.org<mailto:user@guacamole.apache.org>
Subject: RE: Frequent disconnections occurring now

CAUTION: This email originated from outside of the organization. Do not click 
links or open attachments unless you recognize the sender and know the content 
is safe.

How many users to a guacamole server?

Memory CPU play a big part.

We service over 2000 users across 5 Guacamole servers

Guacamole Specs:

  *   8 vCPU
  *   64G Ram
  *   10G Network
Connection are stable with these specs.

Versions:

  *   x2 1.3.0
  *   x3 1.4.0



Thank You
Sean Hulbert

Founder / CEO
Work Ph: 925.292.4309

www.securitycentric.net<http://www.securitycentric.net/>
A Cybersecurity Enablement Company
We don't just run you through the motions, Our labs teach you how to think!

 [logo-acad400]

System Award Management
CAGE: 8AUV4

AFCEA San Francisco Chapter V.P.

If you have heard of a hacker by name, he/she has failed, fear the hacker you 
haven't heard of!

CONFIDENTIALITY NOTICE: This communication with its contents may contain 
confidential and/or legally privileged information. It is solely for the use of 
the intended recipient(s). Unauthorized interception, review, use or disclosure 
is prohibited and may violate applicable laws including the Electronic 
Communications Privacy Act. If you are not the intended recipient, please 
contact the sender and destroy all copies of the communication. Content within 
this email communication is not legally binding as a contract and no promises 
are guaranteed unless in a formal contract outside this email communication.

igitur qui desiderat pacem, praeparet bellum!!!

Epitoma Rei Militaris

From: Lockhart, Roland [mailto:r.lockh...@aamgroup.com]
Sent: Tuesday, May 31, 2022 5:50 PM
To: user@guacamole.apache.org<mailto:user@guacamole.apache.org>
Subject: Frequent disconnections occurring now

Hi

All our current users are reporting frequent disconnections and slow service 
from Guacamole

I performed the usual maintenance recently, stop / start server, and rollover 
the docker i

RE: Frequent disconnections occurring now

[Sean Hulbert]

What type of bandwidth do you have?

 

Upload

Download 

 

Are you symmetrical or Asymmetrical on speeds?

 

Then on your internal network, are you 1000Mbps or 100Mbps.

Also does the Guacamole system have the VM drivers installed ?

What type of load does the host server have (how many VMs running at once)  

 

What type of Hypervisor ?

 

Microsoft Hyper-v

Citrix Xenserver

VMware ESXi 

Oracle cloud/virtual box ?

 

The more I know about your infrastructure the better I can assist. 

 

 

Thank You

Sean Hulbert

 

Founder / CEO

Work Ph: 925.292.4309

 

www.securitycentric.net <http://www.securitycentric.net/> 

A Cybersecurity Enablement Company

We don't just run you through the motions, Our labs teach you how to think!

 

 

 

System Award Management

CAGE: 8AUV4

 

AFCEA San Francisco Chapter V.P.

 

If you have heard of a hacker by name, he/she has failed, fear the hacker
you haven't heard of!

 

CONFIDENTIALITY NOTICE: This communication with its contents may contain
confidential and/or legally privileged information. It is solely for the use
of the intended recipient(s). Unauthorized interception, review, use or
disclosure is prohibited and may violate applicable laws including the
Electronic Communications Privacy Act. If you are not the intended
recipient, please contact the sender and destroy all copies of the
communication. Content within this email communication is not legally
binding as a contract and no promises are guaranteed unless in a formal
contract outside this email communication.

 

igitur qui desiderat pacem, praeparet bellum!!!

Epitoma Rei Militaris

 

From: Lockhart, Roland [mailto:r.lockh...@aamgroup.com] 
Sent: Wednesday, June 8, 2022 8:05 PM
To: user@guacamole.apache.org
Subject: RE: Frequent disconnections occurring now

 

Thanks Sean

 

The server is 2 vcpu 8GB RAM, moderate network

 

For the last 4 weeks, while disconnections are occurring, CPU has not got
above 30%

 

We have about 25 users, but not more than 5 concurrent users at any time

 

Version is older.

 

Any guidance appreciated

 

Roland

 

 

 

 

From: Sean Hulbert mailto:shulb...@securitycentric.net.INVALID> > 
Sent: Wednesday, June 1, 2022 9:37 AM
To: user@guacamole.apache.org <mailto:user@guacamole.apache.org> 
Subject: RE: Frequent disconnections occurring now

 

CAUTION: This email originated from outside of the organization. Do not
click links or open attachments unless you recognize the sender and know the
content is safe.

 

How many users to a guacamole server?

 

Memory CPU play a big part.

 

We service over 2000 users across 5 Guacamole servers

 

Guacamole Specs:

*   8 vCPU
*   64G Ram
*   10G Network

Connection are stable with these specs. 

 

Versions: 

*   x2 1.3.0
*   x3 1.4.0

 

 

 

Thank You

Sean Hulbert

 

Founder / CEO

Work Ph: 925.292.4309

 

www.securitycentric.net <http://www.securitycentric.net/> 

A Cybersecurity Enablement Company

We don't just run you through the motions, Our labs teach you how to think!

 

 

 

System Award Management

CAGE: 8AUV4

 

AFCEA San Francisco Chapter V.P.

 

If you have heard of a hacker by name, he/she has failed, fear the hacker
you haven't heard of!

 

CONFIDENTIALITY NOTICE: This communication with its contents may contain
confidential and/or legally privileged information. It is solely for the use
of the intended recipient(s). Unauthorized interception, review, use or
disclosure is prohibited and may violate applicable laws including the
Electronic Communications Privacy Act. If you are not the intended
recipient, please contact the sender and destroy all copies of the
communication. Content within this email communication is not legally
binding as a contract and no promises are guaranteed unless in a formal
contract outside this email communication.

 

igitur qui desiderat pacem, praeparet bellum!!!

Epitoma Rei Militaris

 

From: Lockhart, Roland [mailto:r.lockh...@aamgroup.com] 
Sent: Tuesday, May 31, 2022 5:50 PM
To: user@guacamole.apache.org <mailto:user@guacamole.apache.org> 
Subject: Frequent disconnections occurring now

 

Hi

 

All our current users are reporting frequent disconnections and slow service
from Guacamole

 

I performed the usual maintenance recently, stop / start server, and
rollover the docker images which usually clears the issue, but its not
fixing this now

 

Any ideas of where to look?

 

Guac has been in service for about 3 years now. I am keen to upgrade but
that's another thread.

 

Thanks

 

Roland

 

 

 


  <https://aamgroup.com/wp-content/uploads/2021/09/aam-sig-woolpert.png> 

Roland Lockhart
DevOps Team Lead 
+61 8 9228 6807
+61 408 384 993
 <mailto:r.lockh...@aamgroup.com> r.lockh...@aamgroup.com
 <https://aamgroup.com/> aamgroup.com
 <http://www.linkedin.com/company/aam-pty-ltd>
<https://t

RE: Frequent disconnections occurring now

[Lockhart, Roland]

Thanks Sean

The server is 2 vcpu 8GB RAM, moderate network

For the last 4 weeks, while disconnections are occurring, CPU has not got above 
30%

We have about 25 users, but not more than 5 concurrent users at any time

Version is older.

Any guidance appreciated

Roland




From: Sean Hulbert 
Sent: Wednesday, June 1, 2022 9:37 AM
To: user@guacamole.apache.org
Subject: RE: Frequent disconnections occurring now

CAUTION: This email originated from outside of the organization. Do not click 
links or open attachments unless you recognize the sender and know the content 
is safe.

How many users to a guacamole server?

Memory CPU play a big part.

We service over 2000 users across 5 Guacamole servers

Guacamole Specs:

  *   8 vCPU
  *   64G Ram
  *   10G Network
Connection are stable with these specs.

Versions:

  *   x2 1.3.0
  *   x3 1.4.0



Thank You
Sean Hulbert

Founder / CEO
Work Ph: 925.292.4309

www.securitycentric.net<http://www.securitycentric.net/>
A Cybersecurity Enablement Company
We don't just run you through the motions, Our labs teach you how to think!

 [logo-acad400]

System Award Management
CAGE: 8AUV4

AFCEA San Francisco Chapter V.P.

If you have heard of a hacker by name, he/she has failed, fear the hacker you 
haven't heard of!

CONFIDENTIALITY NOTICE: This communication with its contents may contain 
confidential and/or legally privileged information. It is solely for the use of 
the intended recipient(s). Unauthorized interception, review, use or disclosure 
is prohibited and may violate applicable laws including the Electronic 
Communications Privacy Act. If you are not the intended recipient, please 
contact the sender and destroy all copies of the communication. Content within 
this email communication is not legally binding as a contract and no promises 
are guaranteed unless in a formal contract outside this email communication.

igitur qui desiderat pacem, praeparet bellum!!!

Epitoma Rei Militaris

From: Lockhart, Roland [mailto:r.lockh...@aamgroup.com]
Sent: Tuesday, May 31, 2022 5:50 PM
To: user@guacamole.apache.org<mailto:user@guacamole.apache.org>
Subject: Frequent disconnections occurring now

Hi

All our current users are reporting frequent disconnections and slow service 
from Guacamole

I performed the usual maintenance recently, stop / start server, and rollover 
the docker images which usually clears the issue, but its not fixing this now

Any ideas of where to look?

Guac has been in service for about 3 years now. I am keen to upgrade but that's 
another thread.

Thanks

Roland



[AAM Group]
Roland Lockhart
DevOps Team Lead
+61 8 9228 6807
+61 408 384 993
r.lockh...@aamgroup.com<mailto:r.lockh...@aamgroup.com>
aamgroup.com<https://aamgroup.com/>
[https://aamgroup.com/wp-content/uploads/2021/07/icon-linkedin.png]<http://www.linkedin.com/company/aam-pty-ltd>
 [https://aamgroup.com/wp-content/uploads/2021/07/icon-twitter.png] 
<https://twitter.com/AAMGroup>  
[https://aamgroup.com/wp-content/uploads/2021/07/icon-youtube.png] 
<https://www.youtube.com/AAMPtyLtd>


 Attention 
Email Disclaimer Notice - This message is the property of AAM Pty Ltd. The 
information in this email is confidential and may be legally privileged. It is 
intended solely for the addressee. Access to this email by anyone else is 
unauthorised. If you are not the intended recipient, any disclosure, copying, 
distribution or any action taken or omitted to be taken in reliance on it is 
prohibited and may be unlawful. If you have received this message in error 
please notify AAM Pty Ltd immediately via email to 
mailad...@aamgroup.com<mailto:mailad...@aamgroup.com> This email has been 
scanned and cleared by Exchange Online Protection, however AAM Pty Ltd does not 
guarantee this message free of viruses, or interference.
 Attention 
Email Disclaimer Notice - This message is the property of AAM Pty Ltd. The 
information in this email is confidential and may be legally privileged. It is 
intended solely for the addressee. Access to this email by anyone else is 
unauthorised. If you are not the intended recipient, any disclosure, copying, 
distribution or any action taken or omitted to be taken in reliance on it is 
prohibited and may be unlawful. If you have received this message in error 
please notify AAM Pty Ltd immediately via email to mailad...@aamgroup.com This 
email has been scanned and cleared by Exchange Online Protection, however AAM 
Pty Ltd does not guarantee this message free of viruses, or interference.

Re: Frequent disconnections occurring now

[Nick Couchman]

On Wed, Jun 1, 2022 at 8:18 PM Lockhart, Roland 
wrote:

> Hi
>
>
>
> These seem to be from the same user with 4 sessions this morning
>
>
>
> There seem to be various causes
>
>
>
> That user logs in via a highly available corporate network so it should be
> reliable
>
>
>
> I am curious about these two logged events
>
>
>
> "The disconnection was initiated by an administrative tool on the server
> running in the user's session.”
>
>
>
> Could the user be doing something?
>
>
>

This would seem to indicate either the user doing something (logging off)
or an administrative setting kicking in that is forcing the logoff (idle
session timeout, session time limit, etc.).

-Nick

>

RE: Frequent disconnections occurring now

[Lockhart, Roland]

ER 
(0x000B):\n","stream":"stdout","time":"2022-06-01T23:09:42.885880203Z"}
{"log":"The disconnection was initiated by an administrative tool on the server 
running in the user's 
session.\n","stream":"stdout","time":"2022-06-01T23:09:42.885884161Z"}
{"log":"guacd[1]: INFO:\u0009Connection 
\"$64b09ff5-13bb-45fa-b5b4-f720efb400a6\" 
removed.\n","stream":"stderr","time":"2022-06-01T23:09:42.890570614Z"}
{"log":"guacd[1]: INFO:\u0009Creating new client for protocol 
\"rdp\"\n","stream":"stderr","time":"2022-06-01T23:09:47.440281804Z"}
{"log":"guacd[1]: INFO:\u0009Connection ID is 
\"$e4a04c06-1381-4d19-b2ab-95e695d644c2\"\n","stream":"stderr","time":"2022-06-01T23:09:47.444034951Z"}
{"log":"guacd[4599]: INFO:\u0009Security mode: 
TLS\n","stream":"stderr","time":"2022-06-01T23:09:47.485166304Z"}
{"log":"guacd[4599]: INFO:\u0009Resize method: 
none\n","stream":"stderr","time":"2022-06-01T23:09:47.485200891Z"}
{"log":"guacd[4599]: INFO:\u0009User \"@4f593e5f-1f34-40ca-af4c-05dada81b1f0\" 
joined connection \"$e4a04c06-1381-4d19-b2ab-95e695d644c2\" (1 users now 
present)\n","stream":"stderr","time":"2022-06-01T23:09:47.485205273Z"}
{"log":"guacd[4599]: INFO:\u0009Loading keymap 
\"base\"\n","stream":"stderr","time":"2022-06-01T23:09:47.485931046Z"}
{"log":"guacd[4599]: INFO:\u0009Loading keymap 
\"en-us-qwerty\"\n","stream":"stderr","time":"2022-06-01T23:09:47.485940499Z"}
{"log":"guacd[4599]: INFO:\u0009guacdr 
connected.\n","stream":"stderr","time":"2022-06-01T23:09:47.538009098Z"}
{"log":"guacd[4599]: INFO:\u0009guacsnd 
connected.\n","stream":"stderr","time":"2022-06-01T23:09:47.538038448Z"}
{"log":"guacd[4599]: INFO:\u0009Connected to RDPDR 1.13 as client 
0x0003\n","stream":"stderr","time":"2022-06-01T23:09:47.673723551Z"}
{"log":"guacd[4599]: INFO:\u0009Ignoring server capability set type=0x0001, 
length=44\n","stream":"stderr","time":"2022-06-01T23:09:47.674932579Z"}
{"log":"guacd[4599]: INFO:\u0009Ignoring server capability set type=0x0002, 
length=8\n","stream":"stderr","time":"2022-06-01T23:09:47.674946511Z"}
{"log":"guacd[4599]: INFO:\u0009Ignoring server capability set type=0x0003, 
length=8\n","stream":"stderr","time":"2022-06-01T23:09:47.674950686Z"}
{"log":"guacd[4599]: INFO:\u0009Ignoring server capability set type=0x0004, 
length=8\n","stream":"stderr","time":"2022-06-01T23:09:47.674954378Z"}
{"log":"guacd[4599]: INFO:\u0009Ignoring server capability set type=0x0005, 
length=8\n","stream":"stderr","time":"2022-06-01T23:09:47.674957908Z"}
{"log":"guacd[4599]: INFO:\u0009Sending 
capabilities...\n","stream":"stderr","time":"2022-06-01T23:09:47.674961481Z"}
{"log":"guacd[4599]: INFO:\u0009Capabilities 
sent.\n","stream":"stderr","time":"2022-06-01T23:09:47.674964889Z"}
{"log":"guacd[4599]: INFO:\u0009Client ID 
confirmed\n","stream":"stderr","time":"2022-06-01T23:09:47.674968207Z"}
{"log":"guacd[4599]: INFO:\u0009RDP server closed connection: Manually logged 
off.\n","stream":"stderr","time":"2022-06-01T23:10:22.307578295Z"}
{"log":"guacd[4599]: INFO:\u0009User \"@4f593e5f-1f34-40ca-af4c-05dada81b1f0\" 
disconnected (0 users 
remain)\n","stream":"stderr","time":"2022-06-01T23:10:22.33316709Z"}
{"log":"guacd[4599]: INFO:\u0009Last user of connection 
\"$e4a04c06-1381-4d19-b2ab-95e695d644c2\" 
disconnected\n","stream":"stderr","time":"2022-06-01T23:10:22.333196954Z"}
{"log":"connected to 
10.202.3.224:3389\n","stream":"stdout","time":"2022-06-01T23:10:22.3339

Re: Frequent disconnections occurring now

[Michael Jumper]

On Tue, May 31, 2022, 23:37 Lockhart, Roland 
wrote:

> These are the guacd logs for a session which I was disconnected from today
> while working
>
> ...
>
> {"log":"guacd[4459]: ERROR:\u0009User is not
> responding.\n","stream":"stderr","time":"2022-06-01T05:27:37.281117085Z"}
>
If you were indeed still connected (you didn't close the browser tab), this
indicates that there was a network disruption. Something interrupted
communication and resulted in Guacamole considering your connection closed
and cleaning up your connection.

> Other users are reporting disconnected sessions of 46 seconds and such like
>
You will need to locate the logs for those disconnects to determine the
cause. The fact that other connections closed is not enough to determine
why they closed.

- Mike

RE: Frequent disconnections occurring now

[Lockhart, Roland]

These are the guacd logs for a session which I was disconnected from today 
while working



{"log":"guacd[1]: INFO:\u0009Creating new client for protocol 
\"rdp\"\n","stream":"stderr","time":"2022-06-01T04:50:32.261007419Z"}
{"log":"guacd[1]: INFO:\u0009Connection ID is 
\"$bccb5f53-437d-472a-a73f-2fafdee99c19\"\n","stream":"stderr","time":"2022-06-01T04:50:32.261805112Z"}
{"log":"guacd[4459]: INFO:\u0009Security mode: 
TLS\n","stream":"stderr","time":"2022-06-01T04:50:32.309144347Z"}
{"log":"guacd[4459]: INFO:\u0009Resize method: 
none\n","stream":"stderr","time":"2022-06-01T04:50:32.309177184Z"}
{"log":"guacd[4459]: INFO:\u0009User \"@10976fbc-9d18-43b8-bde1-3b8c191dabe8\" 
joined connection \"$bccb5f53-437d-472a-a73f-2fafdee99c19\" (1 users now 
present)\n","stream":"stderr","time":"2022-06-01T04:50:32.309183017Z"}
{"log":"guacd[4459]: INFO:\u0009Loading keymap 
\"base\"\n","stream":"stderr","time":"2022-06-01T04:50:32.310055251Z"}
{"log":"guacd[4459]: INFO:\u0009Loading keymap 
\"en-us-qwerty\"\n","stream":"stderr","time":"2022-06-01T04:50:32.310066682Z"}
{"log":"guacd[4459]: INFO:\u0009guacdr 
connected.\n","stream":"stderr","time":"2022-06-01T04:50:32.583240814Z"}
{"log":"guacd[4459]: INFO:\u0009guacsnd 
connected.\n","stream":"stderr","time":"2022-06-01T04:50:32.583273008Z"}
{"log":"guacd[4459]: INFO:\u0009Connected to RDPDR 1.13 as client 
0x0002\n","stream":"stderr","time":"2022-06-01T04:50:33.527621421Z"}
{"log":"guacd[4459]: INFO:\u0009Ignoring server capability set type=0x0001, 
length=44\n","stream":"stderr","time":"2022-06-01T04:50:33.52848374Z"}
{"log":"guacd[4459]: INFO:\u0009Ignoring server capability set type=0x0002, 
length=8\n","stream":"stderr","time":"2022-06-01T04:50:33.528494569Z"}
{"log":"guacd[4459]: INFO:\u0009Ignoring server capability set type=0x0003, 
length=8\n","stream":"stderr","time":"2022-06-01T04:50:33.52849869Z"}
{"log":"guacd[4459]: INFO:\u0009Ignoring server capability set type=0x0004, 
length=8\n","stream":"stderr","time":"2022-06-01T04:50:33.528502498Z"}
{"log":"guacd[4459]: INFO:\u0009Ignoring server capability set type=0x0005, 
length=8\n","stream":"stderr","time":"2022-06-01T04:50:33.52850601Z"}
{"log":"guacd[4459]: INFO:\u0009Sending 
capabilities...\n","stream":"stderr","time":"2022-06-01T04:50:33.528509637Z"}
{"log":"guacd[4459]: INFO:\u0009Capabilities 
sent.\n","stream":"stderr","time":"2022-06-01T04:50:33.52851296Z"}
{"log":"guacd[4459]: INFO:\u0009Client ID 
confirmed\n","stream":"stderr","time":"2022-06-01T04:50:33.528648925Z"}
{"log":"guacd[4459]: INFO:\u0009User logged 
on\n","stream":"stderr","time":"2022-06-01T04:50:56.780295933Z"}
{"log":"guacd[4459]: INFO:\u0009All supported devices 
sent.\n","stream":"stderr","time":"2022-06-01T04:50:56.780352551Z"}





{"log":"guacd[4459]: ERROR:\u0009User is not 
responding.\n","stream":"stderr","time":"2022-06-01T05:27:37.281117085Z"}
{"log":"guacd[4459]: INFO:\u0009User \"@10976fbc-9d18-43b8-bde1-3b8c191dabe8\" 
disconnected (0 users 
remain)\n","stream":"stderr","time":"2022-06-01T05:27:37.281152594Z"}
{"log":"guacd[4459]: INFO:\u0009Last user of connection 
\"$bccb5f53-437d-472a-a73f-2fafdee99c19\" 
disconnected\n","stream":"stderr","time":"2022-06-01T05:27:37.281157493Z"}
{"log":"guacd[4459]: INFO:\u0009Internal RDP client 
disconnected\n","stream":"stderr","time":"2022-06-01T05:27:37.764634834Z"}
{"log":"connected to 
172.31.1.167:3389\n","stream":"stdout","time"

Re: Frequent disconnections occurring now

[Michael Jumper]

On Tue, May 31, 2022, 18:35 Lockhart, Roland 
wrote:

> And these
>
>
>
> {"log":"01:21:32.408 [Thread-1461] ERROR
> o.a.g.w.GuacamoleWebSocketTunnelEndpoint - Connection to guacd terminated
> abnormally: Connection to guacd timed
> out.\n","stream":"stdout","time":"2022-06-01T01:21:32.408781702Z"}
>
These messages indicate that Guacamole is unable to connect to guacd. The
most likely cause is guacd is not running.

If you are still seeing issues after starting guacd, you really need to
check the guacd logs. The logs you are looking at now are the Guacamole
(webapp) logs. The webapp will not be aware of the specifics of any issues
guacd may be having in connecting to your remote desktops.

- Mike

RE: Frequent disconnections occurring now

[Sean Hulbert]

How many users to a guacamole server?

 

Memory CPU play a big part.

 

We service over 2000 users across 5 Guacamole servers

 

Guacamole Specs:

. 8 vCPU

. 64G Ram

. 10G Network

Connection are stable with these specs. 

 

Versions: 

. x2 1.3.0

. x3 1.4.0

 

 

 

Thank You

Sean Hulbert

 

Founder / CEO

Work Ph: 925.292.4309

 

www.securitycentric.net  

A Cybersecurity Enablement Company

We don't just run you through the motions, Our labs teach you how to think!

 

 

 

System Award Management

CAGE: 8AUV4

 

AFCEA San Francisco Chapter V.P.

 

If you have heard of a hacker by name, he/she has failed, fear the hacker
you haven't heard of!

 

CONFIDENTIALITY NOTICE: This communication with its contents may contain
confidential and/or legally privileged information. It is solely for the use
of the intended recipient(s). Unauthorized interception, review, use or
disclosure is prohibited and may violate applicable laws including the
Electronic Communications Privacy Act. If you are not the intended
recipient, please contact the sender and destroy all copies of the
communication. Content within this email communication is not legally
binding as a contract and no promises are guaranteed unless in a formal
contract outside this email communication.

 

igitur qui desiderat pacem, praeparet bellum!!!

Epitoma Rei Militaris

 

From: Lockhart, Roland [mailto:r.lockh...@aamgroup.com] 
Sent: Tuesday, May 31, 2022 5:50 PM
To: user@guacamole.apache.org
Subject: Frequent disconnections occurring now

 

Hi

 

All our current users are reporting frequent disconnections and slow service
from Guacamole

 

I performed the usual maintenance recently, stop / start server, and
rollover the docker images which usually clears the issue, but its not
fixing this now

 

Any ideas of where to look?

 

Guac has been in service for about 3 years now. I am keen to upgrade but
that's another thread.

 

Thanks

 

Roland

 

 

 


   

Roland Lockhart
DevOps Team Lead 
+61 8 9228 6807
+61 408 384 993
  r.lockh...@aamgroup.com
  aamgroup.com
 
    

 

 


Attention Email Disclaimer Notice - This message is the property of AAM Pty
Ltd. The information in this email is confidential and may be legally
privileged. It is intended solely for the addressee. Access to this email by
anyone else is unauthorised. If you are not the intended recipient, any
disclosure, copying, distribution or any action taken or omitted to be taken
in reliance on it is prohibited and may be unlawful. If you have received
this message in error please notify AAM Pty Ltd immediately via email to
mailad...@aamgroup.com   This email has been
scanned and cleared by Exchange Online Protection, however AAM Pty Ltd does
not guarantee this message free of viruses, or interference. 

RE: Frequent disconnections occurring now

[Lockhart, Roland]

And these

{"log":"01:21:32.408 [Thread-1461] ERROR 
o.a.g.w.GuacamoleWebSocketTunnelEndpoint - Connection to guacd terminated 
abnormally: Connection to guacd timed 
out.\n","stream":"stdout","time":"2022-06-01T01:21:32.408781702Z"}
{"log":"01:21:32.408 [Thread-1461] INFO  o.a.g.tunnel.TunnelRequestService - 
User \"user1\" disconnected from connection \"169713266\". Duration: 1788967 
milliseconds\n","stream":"stdout","time":"2022-06-01T01:21:32.408840889Z"}
{"log":"01:26:55.250 [Thread-1464] ERROR 
o.a.g.w.GuacamoleWebSocketTunnelEndpoint - Connection to guacd terminated 
abnormally: Connection to guacd timed 
out.\n","stream":"stdout","time":"2022-06-01T01:26:55.250610867Z"}
{"log":"01:26:55.250 [Thread-1464] INFO  o.a.g.tunnel.TunnelRequestService - 
User \"user2\" disconnected from connection \"149539123\". Duration: 2050544 
milliseconds\n","stream":"stdout","time":"2022-06-01T01:26:55.250663201Z"}

Thanks


From: Michael Jumper 
Sent: Wednesday, June 1, 2022 8:57 AM
To: user@guacamole.apache.org
Subject: Re: Frequent disconnections occurring now

CAUTION: This email originated from outside of the organization. Do not click 
links or open attachments unless you recognize the sender and know the content 
is safe.

On Tue, May 31, 2022, 17:50 Lockhart, Roland 
mailto:r.lockh...@aamgroup.com>> wrote:
Hi

All our current users are reporting frequent disconnections and slow service 
from Guacamole

I performed the usual maintenance recently, stop / start server, and rollover 
the docker images which usually clears the issue, but its not fixing this now

Any ideas of where to look?
Check the guacd logs.
Guac has been in service for about 3 years now. I am keen to upgrade but that’s 
another thread.

You really should upgrade as soon as you can. Three years is a lot of fixes to 
be missing out on.

- Mike

 Attention 
Email Disclaimer Notice - This message is the property of AAM Pty Ltd. The 
information in this email is confidential and may be legally privileged. It is 
intended solely for the addressee. Access to this email by anyone else is 
unauthorised. If you are not the intended recipient, any disclosure, copying, 
distribution or any action taken or omitted to be taken in reliance on it is 
prohibited and may be unlawful. If you have received this message in error 
please notify AAM Pty Ltd immediately via email to mailad...@aamgroup.com This 
email has been scanned and cleared by Exchange Online Protection, however AAM 
Pty Ltd does not guarantee this message free of viruses, or interference.

RE: Frequent disconnections occurring now

[Lockhart, Roland]

Hi

Thanks for your response

I’m seeing a lot of these about time that the disconnections seem to occur



"log":"Exception in thread \"Thread-1455\" java.lang.IllegalStateException: 
Message will not be sent because the WebSocket session has been 
closed\n","stream":"stderr","time":"2022-06-01T00:36:32.44543639Z"}
{"log":"\u0009at 
org.apache.tomcat.websocket.WsRemoteEndpointImplBase.writeMessagePart(WsRemoteEndpointImplBase.java:381)\n","stream":"stderr","time":"2022-06-01T00:36:32.445451978Z"}
{"log":"\u0009at 
org.apache.tomcat.websocket.WsRemoteEndpointImplBase.startMessage(WsRemoteEndpointImplBase.java:338)\n","stream":"stderr","time":"2022-06-01T00:36:32.445456284Z"}
{"log":"\u0009at 
org.apache.tomcat.websocket.WsRemoteEndpointImplBase$TextMessageSendHandler.write(WsRemoteEndpointImplBase.java:730)\n","stream":"stderr","time":"2022-06-01T00:36:32.44545997Z"}
{"log":"\u0009at 
org.apache.tomcat.websocket.WsRemoteEndpointImplBase.sendPartialString(WsRemoteEndpointImplBase.java:250)\n","stream":"stderr","time":"2022-06-01T00:36:32.445463469Z"}
{"log":"\u0009at 
org.apache.tomcat.websocket.WsRemoteEndpointImplBase.sendString(WsRemoteEndpointImplBase.java:193)\n","stream":"stderr","time":"2022-06-01T00:36:32.445466921Z"}
{"log":"\u0009at 
org.apache.tomcat.websocket.WsRemoteEndpointBasic.sendText(WsRemoteEndpointBasic.java:37)\n","stream":"stderr","time":"2022-06-01T00:36:32.44547025Z"}
{"log":"\u0009at 
org.apache.guacamole.websocket.GuacamoleWebSocketTunnelEndpoint$2.run(GuacamoleWebSocketTunnelEndpoint.java:152)\n","stream":"stderr","time":"2022-06-01T00:36:32.445473574Z"}



From: Michael Jumper 
Sent: Wednesday, June 1, 2022 8:57 AM
To: user@guacamole.apache.org
Subject: Re: Frequent disconnections occurring now

CAUTION: This email originated from outside of the organization. Do not click 
links or open attachments unless you recognize the sender and know the content 
is safe.

On Tue, May 31, 2022, 17:50 Lockhart, Roland 
mailto:r.lockh...@aamgroup.com>> wrote:
Hi

All our current users are reporting frequent disconnections and slow service 
from Guacamole

I performed the usual maintenance recently, stop / start server, and rollover 
the docker images which usually clears the issue, but its not fixing this now

Any ideas of where to look?
Check the guacd logs.
Guac has been in service for about 3 years now. I am keen to upgrade but that’s 
another thread.

You really should upgrade as soon as you can. Three years is a lot of fixes to 
be missing out on.

- Mike

 Attention 
Email Disclaimer Notice - This message is the property of AAM Pty Ltd. The 
information in this email is confidential and may be legally privileged. It is 
intended solely for the addressee. Access to this email by anyone else is 
unauthorised. If you are not the intended recipient, any disclosure, copying, 
distribution or any action taken or omitted to be taken in reliance on it is 
prohibited and may be unlawful. If you have received this message in error 
please notify AAM Pty Ltd immediately via email to mailad...@aamgroup.com This 
email has been scanned and cleared by Exchange Online Protection, however AAM 
Pty Ltd does not guarantee this message free of viruses, or interference.

Re: Frequent disconnections occurring now

[Michael Jumper]

On Tue, May 31, 2022, 17:50 Lockhart, Roland 
wrote:

> Hi
>
>
>
> All our current users are reporting frequent disconnections and slow
> service from Guacamole
>
>
>
> I performed the usual maintenance recently, stop / start server, and
> rollover the docker images which usually clears the issue, but its not
> fixing this now
>
>
>
> Any ideas of where to look?
>
Check the guacd logs.

> Guac has been in service for about 3 years now. I am keen to upgrade but
> that’s another thread.
>

You really should upgrade as soon as you can. Three years is a lot of fixes
to be missing out on.

- Mike