Fwd: Haproxy-1.5.12 High memory usage problem

2017-04-20 Thread lizj3624 lizj3624
hi willy, Our production environment is use Haproxy-1.5.12 as load balancer, our haproxy loads a lot of configuration information, resulting in the start up of memory to reach 300m, after running for a period of time, a single process memory occupancy rate reached 1G, We must reload haproxy, memo

Re: Haproxy 1.5.4 unable to accept new TCP request, backlog full, tens of thousands close_wait connection

2017-04-20 Thread jaseywang
> > Could you please confirm that most of the CLOSE_WAIT are on the front side > and the ESTABLISHED on the backend side ? If that's the case, can you also > please verify if there are pending data in the send queue for CLOSE_WAIT > sockets (3rd column in netstat) ? > Most of the close_wait/establi

Re: Certificate order

2017-04-20 Thread Willy Tarreau
On Thu, Apr 20, 2017 at 11:33:17PM +0200, Lukas Tribus wrote: > Hello, > > > Am 20.04.2017 um 15:05 schrieb Sander Hoentjen: > > A new patch, that puts the order like this: > > config: > > crt A crt B > > > > [...] > > If A contains wildcard, and B contains exact match, then wildcard is used. >

Re: upd logging

2017-04-20 Thread Willy Tarreau
Hello Vladimir, On Thu, Apr 20, 2017 at 11:58:32AM +0200, Vladimír Houba ml. wrote: > Hello, > > the usual setup for haproxy logging is using an udp. Though, this comes > with the risk of dropped datagrams. It is very difficult to figure out a > dropped packet. I think that it would be nice if ea

Re: Haproxy 1.5.4 unable to accept new TCP request, backlog full, tens of thousands close_wait connection

2017-04-20 Thread Willy Tarreau
On Thu, Apr 20, 2017 at 11:03:42PM +0800, jaseywang wrote: > 1. The backlog of haproxy soon become full and begin to drop new tcp > connection since peak traffic begin, before CDN, our net.core.somaxconn is > 1024, and use default backlog of haproxy, everything performs well. After > using CDN, eve

Re: Haproxy 1.5.4 unable to accept new TCP request, backlog full, tens of thousands close_wait connection

2017-04-20 Thread Willy Tarreau
On Fri, Apr 21, 2017 at 10:23:53AM +0800, jaseywang wrote: > Hi, Willy > Thanks for your help. We upgrade the version from 1.5.4 to 1.5.19, but > still the same issue, and what's your recommended version we can use for > production env? OK nice, at least you're not facing one of the many already f

Re: Haproxy 1.5.4 unable to accept new TCP request, backlog full, tens of thousands close_wait connection

2017-04-20 Thread jaseywang
Hi, Willy Thanks for your help. We upgrade the version from 1.5.4 to 1.5.19, but still the same issue, and what's your recommended version we can use for production env? $ haproxy -vv HA-Proxy version 1.5.19 2016/12/25 Copyright 2000-2016 Willy Tarreau Build options : TARGET = linux26 CPU

Re: trying to understand sticky counters

2017-04-20 Thread Igor Cicimov
Hi Adam, On Wed, Apr 12, 2017 at 3:00 AM, Adam Spiers wrote: > Hi all, > > I've pored over the Configuration Manual again and again, and I'm > still struggling to fully understand sticky counters. This paragraph > seems to hold some important information: > >Once a "track-sc*" rule is execu

Re: Certificate order

2017-04-20 Thread Lukas Tribus
Hello, Am 20.04.2017 um 15:05 schrieb Sander Hoentjen: A new patch, that puts the order like this: config: crt A crt B [...] If A contains wildcard, and B contains exact match, then wildcard is used. This last one is different behavior from what is implemented now. People rely on the specif

Re: [PATCH] minor harmless bugfix in server_parse_sni_expr

2017-04-20 Thread Willy Tarreau
On Thu, Apr 20, 2017 at 06:25:17PM +0200, Olivier Houchard wrote: > Hi, > > In server_parse_sni_expr(), we use the "proxy" global variable when I think > we really want to use the "px" argument, so the attached patch fixes this. Merged, thanks Olivier! > Hopefully one day that proxy variable wil

Re: TLS-PSK support for haproxy?

2017-04-20 Thread Willy Tarreau
On Thu, Apr 20, 2017 at 07:27:47PM +0200, Nenad Merdanovic wrote: > Gil, > > On 04/05/2017 10:02 AM, Gil Bahat wrote: > > Hey Nenad, > > > > did anything come out of this? interestingly enough, some compliance > > challenges I was facing brought this to mind again. > > Sadly I didn't have any ti

Re: TLS-PSK support for haproxy?

2017-04-20 Thread Nenad Merdanovic
Gil, On 04/05/2017 10:02 AM, Gil Bahat wrote: > Hey Nenad, > > did anything come out of this? interestingly enough, some compliance > challenges I was facing brought this to mind again. Sadly I didn't have any time to work on this. I did check a bit and found the maps interface somewhat counter-

[PATCH] minor harmless bugfix in server_parse_sni_expr

2017-04-20 Thread Olivier Houchard
Hi, In server_parse_sni_expr(), we use the "proxy" global variable when I think we really want to use the "px" argument, so the attached patch fixes this. Hopefully one day that proxy variable will be renamed :) Olivier >From eb5033db545ae093f73485e4a29c112e126c159c Mon Sep 17 00:00:00 2001 From:

Re: Certificate order

2017-04-20 Thread Sander Hoentjen
Now with patch attached, thanks Fred :) On 04/20/2017 03:05 PM, Sander Hoentjen wrote: > A new patch, that puts the order like this: > config: > crt A crt B > > if A contains wildcard, but not exact match, then wildcard is used. > if A contains exact match, exact match is used. > (this also means

Re: Haproxy 1.5.4 unable to accept new TCP request, backlog full, tens of thousands close_wait connection

2017-04-20 Thread Willy Tarreau
Hello, On Thu, Apr 20, 2017 at 11:03:42PM +0800, jaseywang wrote: > Our haproxy 1.5.4 MS cluster performs quite well before, and the peak (...) > Now, the weird thing is why haproxy has so many closewait connections? and > why the backlog queue soon becomes full? Usually so many closewait means >

Haproxy 1.5.4 unable to accept new TCP request, backlog full, tens of thousands close_wait connection

2017-04-20 Thread jaseywang
Our haproxy 1.5.4 MS cluster performs quite well before, and the peak current connections is about 6k. Haproxy forward the request from client to Nginx, Nginx send the request to upstream JVM servers like this: client -> Haproxy -> Nginx -> upstream This week we use CDN to accept request from clie

Re: Certificate order

2017-04-20 Thread Sander Hoentjen
A new patch, that puts the order like this: config: crt A crt B if A contains wildcard, but not exact match, then wildcard is used. if A contains exact match, exact match is used. (this also means that if A contains both wildcard and exact match, exact match is used.) If A contains wildcard, and B

Re: server templates

2017-04-20 Thread Frederic Lecaille
Hello HAProxy ML, On 04/10/2017 05:00 PM, Baptiste wrote: On Mon, Apr 10, 2017 at 2:30 PM, Willy Tarreau mailto:w...@1wt.eu>> wrote: On Mon, Apr 10, 2017 at 10:02:29AM +0200, Frederic Lecaille wrote: > With server templates, haproxy could preallocate 'server' objects which > would

upd logging

2017-04-20 Thread Vladimír Houba ml .
Hello, the usual setup for haproxy logging is using an udp. Though, this comes with the risk of dropped datagrams. It is very difficult to figure out a dropped packet. I think that it would be nice if each message could have a counter that would make it possible to detect that some messages were d