minconn, maxconn and fullconn

2011-03-23 Thread James Bardin
Hello, I've been going through haproxy in depth recently, but I can't quite figure out the details with full, min, and maxconn. First of all, fullconn confuses me, and this example doesn't help Example : # The servers will accept between 100 and 1000 concurrent connections each #

counter reset on hot reconfiguration

2011-03-25 Thread James Bardin
Is the answer here correct? http://serverfault.com/questions/205093/restarting-haproxy-without-losing-counters I would love for the counters to be saved across reloads, but I haven't seen this in my testing (most extensively on 1.4.11). Thanks, -jim

Re: Build error on CentOS 5.5 x86_64 with PCRE support

2011-03-31 Thread James Bardin
On Thu, Mar 31, 2011 at 1:37 PM, g...@desgames.com g...@desgames.com wrote: /usr/bin/ld: skipping incompatible /usr/lib/libpcre.so when searching for -lpcre /usr/bin/ld: skipping incompatible /usr/lib/libpcre.a when searching for -lpcre It's looking in /usr/lib, which only 32bit. Try

Re: Transparent front end

2011-04-10 Thread James Bardin
Hi Sara, What you've described is basically what haproxy (or any reverse proxy for that matter) does. Have you tried using it? Did you have any problems? -jim 2011/4/10 sara fahmy geila...@hotmail.com: Hi every one I want to know is it possible to create a transparent front end? so that if

Re: Linux routing performace

2011-05-04 Thread James Bardin
Thanks guys, On Tue, May 3, 2011 at 10:50 PM, Joseph Hardeman jwharde...@gmail.com wrote: route add -net 192.168.1.16 netmask 255.255.255.240 gw 10.0.0.1 A simple route doesn't work in this case, as the packets have to leave out the correct interface as well, or they will be dropped by the

Re: Linux routing performace

2011-05-05 Thread James Bardin
On Thu, May 5, 2011 at 7:02 AM, Willy Tarreau w...@1wt.eu wrote: I have no idea with ip rules impact performance that much for you. Anyway, since you're dealing with two interfaces, you can explicitly bind haproxy to each of them and still have a default route on each interface. The trick is

Re: Help on SSL termination and balance source

2011-06-09 Thread James Bardin
On Thu, Jun 9, 2011 at 7:33 AM, habeeb rahman pk.h...@gmail.com wrote: apache rewrite rule:  RewriteRule ^/(.*)$ http://127.0.0.1:2443%{REQUEST_URI} [P,QSA,L] Why are you using a rewrite instead of mod_proxy? ProxyPass does some nice things by default, like adding the X-Forwarded-For header

Re: nice wiki doc of haproxy

2011-06-15 Thread James Bardin
Just throwing my $.02; how about converting the documentation to something more easily parse-able, like markdown? -- -jim

roundrobin vs leastconn

2011-06-17 Thread James Bardin
This is more for my own curiosity (I'm not advocating a change in the haproxy defaults) - Is there any inherit drawback to always using leasconn instead of roundrobin? Since it uses roundrobin internally when servers are equally loaded, it seems that this would be the most fair algorithm in most

Re: roundrobin vs leastconn

2011-06-17 Thread James Bardin
On Fri, Jun 17, 2011 at 2:32 PM, Willy Tarreau w...@1wt.eu wrote: The round robin of the leastconn will not apply weigths, it's only used between servers which have the exact same amount of connections in order to avoid the common syndrom of the low load always hitting the same server because

Re: more than one haproxy instance on one host/IP

2011-07-11 Thread James Bardin
On Mon, Jul 11, 2011 at 2:18 PM, Alexander Hollerith alex.holler...@gmail.com wrote: Thank you very much for pointing me into that direction. I think that definitely answers my question. Since haproxy itself might keep more than one process alive after dealing with an -sf (at least for as

Re: https from source to destination

2011-07-13 Thread James Bardin
On Wed, Jul 13, 2011 at 5:57 PM, Craig cr...@haquarter.de wrote: I hereby request the feature to do https to backends Sometimes it's really troublesome not being able to do that, even more so if a different party administrates the servers. I'm not sure if you're serious or not, but If

Re: https from source to destination

2011-07-13 Thread James Bardin
if there's a compelling performance case, probably because of a shorter data pipeline, but SSL is the cpu here, not the extra memory copies or buffering (we'll just have to wait for some tests ;). Some IT contracts suck. ;) Yes, they do :) -- James Bardin jbar...@bu.edu Systems Engineer Boston

Re: https from source to destination

2011-07-14 Thread James Bardin
On Thu, Jul 14, 2011 at 4:44 AM, Brane F. Gračnar brane.grac...@najdi.si wrote: I guess your only option is nginx, which supports https upstreams. I mentioned this earlier, but you can use stunnel in client mode to connect to a remote https server. It's unfortunate that nginx doesn't yet

maintenance mode and server affinity

2011-08-01 Thread James Bardin
I have a number if instances using tcp mode, and a stick-table on src ip for affinity. When a server is in maintenance mode, clients with an existing affinity will still connect to the disabled server, and only be re-dispatched if the connection fails (and error responses from the backend are

Re: maintenance mode and server affinity

2011-08-02 Thread James Bardin
On Tue, Aug 2, 2011 at 2:52 AM, Willy Tarreau w...@1wt.eu wrote: Are you sure your server was set in maintenance mode, did you not just set its weight to zero ? Yes. I've confirmed that when using a stick-table for persistence, putting a server in maintenance mode does not block traffic from

Re: maintenance mode and server affinity

2011-08-02 Thread James Bardin
On Tue, Aug 2, 2011 at 2:44 PM, Willy Tarreau w...@1wt.eu wrote: OK thanks for confirming. Could you check if you have option persist somewhere in your config ? From what I can tell from the code, this is the only reason why a server set in maintenance mode would be selected :        if

Re: unknown keyword 'userlist' in '****' section

2011-08-05 Thread James Bardin
On Fri, Aug 5, 2011 at 1:10 PM, Tom Sztur tsz...@gmail.com wrote: correction, Version is HA-Proxy version 1.3.15.2 Userlist is not an option in 1.3. See your version's documentation: http://haproxy.1wt.eu/download/1.3/doc/configuration.txt

Re: HAProxy and TIME_WAIT

2011-11-28 Thread James Bardin
On Mon, Nov 28, 2011 at 11:50 AM, Daniel Rankov daniel.ran...@gmail.com wrote: And on loaded server this will cause trouble. Isn't there a chance for HAProxy to send RST, so that conneciton will be dropped ? An RST packet won't make the TIME_WAIT socket disappear. It's part if the TCP

Re: HAProxy and TIME_WAIT

2011-11-28 Thread James Bardin
On Mon, Nov 28, 2011 at 12:28 PM, Daniel Rankov daniel.ran...@gmail.com wrote: Yeap, I'm aware of net.ipv4.tcp_tw_reuse and the need of TIME_WAIT state, but still if there is a way to send a RST /either configuration or compile parameter/ the connection will be destroyed. TIME_WAIT is usually

Re: source ip - tcp mode

2012-01-18 Thread James Bardin
On Wed, Jan 18, 2012 at 5:43 AM, Karthik Iyer karthiksz...@gmail.com wrote: Is there any way to get the souce ip exposed to the nodes for tcp mode in someway while running haproxy as non-tproxy, for haproxy 1.4 ? The most common use for TCP mode is balancing SSL traffic, where having the IP

Re: performance quick fix?

2012-01-24 Thread James Bardin
On Tue, Jan 24, 2012 at 1:43 PM, Coates, James jcoa...@icgcommerce.com wrote: We recently moved to Exchange 2010 and decided to balance the exchange servers behind haproxy.  We’re currently running haproxy on an old Dell server with a Pentium D 915 2.8GHz and we’re starting to pin the CPU now