Re: Haproxy Load-Balance Scaling

On 6 December 2013 20:13, Qingshan Xie wrote: > Jonathan, > I am interested in what you mentioned about using 1.5 "peers". I googled > it, but a little confused about "peers". Is "peers" used for Failover or > for Load-Balancer scaling? I do not find a detail information how "peers" > is workin

Re: Haproxy Load-Balance Scaling

On 6 December 2013 17:50, Qingshan Xie wrote: > Godbach, > Thanks for the quick reply and suggestions. > To enable multi-process mode does increase the capacity but limited by host > NIC bandwidth. Can HAProxy be scaled to multi-node to host the same > traffic? Yes it can, but *you* have to make

Re: performance problem about haproxy with libvirt20131201

this list's archives to find information that's come up in the past on this exact topic. This list is archived in a few different places - once such place is here: http://marc.info/?l=haproxy Regards, Jonathan -- Jonathan Matthews Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: need an information on urgent basis.....

On 19 November 2013 15:42, sushant dangare wrote: > Hi, > > we are going to set an Ha-proxy setup so please let us know if we need an > any help / support will you help me? > > or can we get purchased licence any thing like that...? > > please revert on urgent basis. Hi Sushant - This is the pub

Re: RES: RES: RES: RES: RES: RES: RES: High CPU Usage (HaProxy)

On 5 November 2013 11:16, Willy Tarreau wrote: >> It is a Xeon E5-2650 Dual (So we have 16 physical cores to use here and 32 >> threads). > > OK. Do you know if you have a single or multiple interrupts on your NICs, > and if they're delivered to a single core, multiple cores, or floating > around

Re: HTTP and send-proxy

On 29 October 2013 08:30, Ge Jin wrote: > Hi, Baptiste! > > Thanks for your reply, I found there is an incorrect configure in my ... email client? >;-)

Re: HAProxy

On 24 Oct 2013 08:31, "Abdul Majid Yaqub Compaore" < abdul.profit...@gmail.com> wrote: > I would like to know how to deal with HA proxy without load balancing.I'm only requiring fail over. Any suggestion? Thanks in advance. Hi Abdul - Your colleague (?) Lisa asked the same question on this list s

Re: Haproxy for high load/High availability Mail Server on SSL

al with because you opened up a SMTP port online. Just my 2 cents. Other opinions are available ;-) Jonathan -- Jonathan Matthews Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: Redirect help

Have you tried searching online for the answer?

Re: HaProxy service usage

on this list. Regards, Jonathan -- Jonathan Matthews Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: Haproxy SSL certificat exception with root

and add www? As David said, there is nothing that HAProxy can do to help here. Regards, Jonathan -- Jonathan Matthews Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: HA Proxy Install Guide

e documentation linked from it, please do make that suggestion here, on this public mailing list. > also can I install HA Proxy without > root userid. I would imagine that would work just fine with certain caveats. Let us know how you get on! Regards, Jonathan -- Jonathan Matthews Ox

Re: HTTP Content-Check

ature: http://cbonte.github.io/haproxy-dconv/configuration-1.4.html#http-check expect Regards, Jonathan -- Jonathan Matthews Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: Major differences between 1.4 and 1.5

ick tables in as features. That stable/dev difference may decide it for you - it would for me in most circumstances. I'm sure more knowledgable people will chime in with more detailed comparisons. J -- Jonathan Matthews Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: Prevent HAProxy from toggeling back from fallback to primary

to put a high number of required successes for the non-backup servers' health checks. I.e. several thousand (or whatever - do the mathS that makes sense for your situation) in the per-server "rise" setting: http://cbonte.github.io/haproxy-dconv/configuration-1.4.html#rise

Re: Meaning of hrsp_2xx in show_stat

On 14 June 2013 10:10, Ashish Jaiswal wrote: > HI Jonathan, > > You mean to say that the hrsp_2xx will always increment. But it doesn't > seems to be as the value are always floating. > My major concern is how will one manage to see that how many client are > getting and 3xx/2xx code when they ar

Re: Meaning of hrsp_2xx in show_stat

ntal counters over the lifetime of the HAProxy process. I don't think the 2 (rate & counters) are directly comparable, and I'd definitely expect them to show different values. HTH, Jonathan -- Jonathan Matthews // Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: Question about HTTP load balancing using HAProxy

ttp-downloads for some more information on this. Regards, Jonathan -- Jonathan Matthews // Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: Question about HTTP load balancing using HAProxy

HTTP, of course :-) > Does HAProxy help in this context? It can do, due to its extremely configurable health checks. If you've committed to solving this problem entirely, however, it will need more than just HAProxy. That's the sort of situation into which I normally step wearing my "

Re: Question about HTTP load balancing using HAProxy

n HAProxy. I do appreciate your comments. I don't think that HAProxy's sessions are related to the kind of in-request failure you seem to be concerned about. But I haven't run the current 1.5 development version, so I may be out of touch with what it does in this area. Regards, Jo

Re: Meaning of hrsp_2xx in show stat

member that #33 is useful if you're looking at it at a single point in time, but if you're trying to graph it, you might find it more useful to collect "stot" directly and calculate rates from that instead. Jonathan -- Jonathan Matthews // Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: smtpchk when using proxy protocol

erver has to explicitly support the PROXY protocol. Either way - if it's just something being tickled in the postfix code which replies with a multi-line response or if it doesn't understand PROXY messages entirely - I'm afraid I don't have any suggestions for fixing it. You mi

Re: Redirect 1 time per day

ou start by looking at http://en.wikipedia.org/wiki/WURFL for a generic solution to this problem. I'm not sure if anyone has it integrated with HAProxy, however. Regards, Jonathan -- Jonathan Matthews // Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: HAProxy and MySQL failover

In the past I've used a ludicrously high setting on the primary for "rise", the number of health checks it has to pass before it's considered to be up again. It's definitely a hack, though that's not to say I haven't used it in production ;-) Jonathan -- J

Re: Websockets and RTMP

only in HAProxy 1.5. Jonathan -- Jonathan Matthews // Oxford, London, UK http://www.jpluscplusm.com/contact.html

Balancing SIP

Does anyone have anything they could share about using HAProxy for load-balancing SIP? Positive /or/ negative, of course! :-) Jonathan

Re: Couchsurfing hiring Senior Linux DevOps for incredible social travel community

te unusual perks. > > regards, > Anthony > > -- > Anthony Mansfield - Technical Recruiter - couchsurfing.com > anthony.mansfi...@couchsurfing.com -- Jonathan Matthews // Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: help on http post use_backend when dst port is 8080

st_port 8080 I don't understand how you hope to see traffic aimed at ports 80 or 8080 on a frontend bound to port 5800. If you believe this /should/ work, I suggest you've misunderstood HAProxy's role somehow, and should reread the fine documentation. Jonathan PS Please avoid sending

Re: Counting number given session cookies used by sticky load balancer?

figure out how many users each of your HAProxy instances will support, then this isn't helpful. But then you wouldn't care about distinguishing user1 from user2 - you'd just look at actual simultaneous connections, I guess :-) HTH, Jonathan -- Jonathan Matthews // Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: Separated config file support

http-defaults -f conf/http-listeners -f conf/tcp-defaults -f conf/tcp-listeners HTH Jonathan -- Jonathan Matthews // Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: Default certificate wrongly delivered.

he default cert to clients that don't provide SNI hints. Other than moving to IP-per-SSL-site, I don't believe there's anything you can do to avoid this when you don't control the clients. Jonathan -- Jonathan Matthews // Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: pinning IRQs w/tproxy

the entire box. > We've been running perfectly stable this way for months. Thanks for that, Brendon - great data points. I wish more people would post information like this, relating req/s and the hardware that delivers it in production. Jonathan -- Jonathan Matthews // Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: Systemd Support

ere's anything you'd like to add, get involved in, or test ... Cheers! Jonathan -- Jonathan Matthews // Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: haproxy 1.4.10 and apache 2.2 re-routing issues

s down to your judgement, and the operational trade-offs you and the business around you need to make. Cheers, Jonathan -- Jonathan Matthews // Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: Can HAProxy use a response header value to redirect to a different URL?

t do this at the infra level myself. Cheers, Jonathan -- Jonathan Matthews // Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: haproxy invoked oom-killer

om-killer -- Jonathan Matthews // Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: RoundRobin seems to be missing a bit

endpoints for HAProxy's use that can withstand 1Hz checks (i.e. 2 active/passive HAProxy nodes @ 2 second intervals). 30 seconds isn't frequent enough, for my money. YMMV. Jonathan -- Jonathan Matthews // Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: CSS not displayed

ng in the backend: http://cbonte.github.com/haproxy-dconv/configuration-1.4.html#option%20httpclose Jonathan -- Jonathan Matthews // Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: HA proxy

and log of the steps you took, what you saw, and what you expected to see. Thanks, Jonathan -- Jonathan Matthews // Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: Simple health check return... -- without backend needed?

On 18 January 2013 02:26, Joel Krauska wrote: > monitor-uri looks like it would only work as a path match. > > I need to match a Host header. Could you elaborate a bit on why you're trying to do this? Is it for a human or machine audience? Etc etc ... Jonathan -- Jonathan Matt

Re: Simple health check return... -- without backend needed?

quot;monitor-uri": http://cbonte.github.com/haproxy-dconv/configuration-1.4.html#monitor-uri. Jonathan -- Jonathan Matthews // Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: Tactics for load balancing all connections

ancing algorithm is applied. --- The "otherwise" caveat sounds like what you're looking for. Jonathan -- Jonathan Matthews // Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: Issue managing multiple SSL certs

nd-same-port Until SNI is more widely adopted, you need a distinct IP address for each cert you wish to use. Regards, Jonathan -- Jonathan Matthews // Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: 'check' command in server 'keyword' causes Connection resests on Mac with 1.5-dev.x

is more of a user question, what is the real use-case for the > check command? Is it okay to just leave it out? The documentation describes what it does. Have you read it? What information do you feel you need that isn't there? http://cbonte.github.com/haproxy-dconv/configuration-1.5.html#che

Re: Strange 'Down' status on backend

ss. I don't have access to a working HAProxy to check against at the moment ... Jonathan -- Jonathan Matthews // Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: Authentication cookie enforcement?

calability.com/blog/2012/9/12/using-varnish-for-paywalls-moving-logic-to-the-edge.html). Keep HAP for what it's awesome at - routing requests based on backend *health*, not backed *logic*. My 2 cents, Jonathan -- Jonathan Matthews // Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: Who replies to client requests?

ckends as-is. [ This would result in the loss of some information at the HTTP level, such as the client's IP, but may be sufficient for you. ] Jonathan PS Please disable HTML mail to this list if you're able. Thanks. -- Jonathan Matthews // Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: NTLM/Issues With HaProxy to SQUID need help...

On 5 December 2012 12:47, David Touzeau wrote: > Thanks Willy for this clarification but if i turn to tunnel mode,did i lose > the x-forwarded-for HTTP header ? Yes, on all but the first request I believe. Jonathan -- Jonathan Matthews // Oxford, London, UK http://www.jpluscplu

Re: Question on active server connection counter on backend context switch

e to be responding to health checks for the service to be considered "up" 3) configure backup servers for the service to use instead of the normal server pool, once the service has been determined to have gone "down" as per the criteria you defined in #2. If it's possibl

Re: help with option httpchk - http-check expect

speak as for any problems you see after you fix that - I've never seen POSTs and request bodies being used in a health check before! HTH, Jonathan -- Jonathan Matthews // Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: help with option httpchk - http-check expect

question, but I think you're missing an extra "\r\n" that should represent the blank line between the POST's headers and its body. Also, I think the length of 35 might be wrong, as it doesn't take into account the last "\r\n" (which might be superfluou

Re: HAproxy with multiple backends tcp and http

t; default_backend: 'tester'. > [ALERT] 299/152956 (5477) : Fatal errors found in configuration. > > Any ideas? I thought you could have http and tcp backends running > simultaneously. Hasn't the "frontend tester" picked up the default "mode http", h

Re: option accept-invalid-http-request

Is it a bug or am I missing something? Percentage signs are valid in URIs. Your application could be doing /anything/ with them; HAProxy doesn't know what. I don't /believe/ it's a validating parser's job to disallow these - it sounds like you want more of a WAF. All IMHO,

Re: Source IP not passing through

of using the PROXY protocol, but I have no idea if Apache speaks it. It would require a dev version of HAProxy in the 1.5 branch. See http://haproxy.1wt.eu/download/1.5/doc/proxy-protocol-v2-draft-20120621.txt Cheers, Jonathan -- Jonathan Matthews // Oxford, London, UK

Re: [better solution] Re: Q about ssl and acls

** That's just a simplification of your config. I'm pretty sure there would be more that could be removed if I knew WP better ;-) Jonathan -- Jonathan Matthews Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: Multiple required http-check URLs

ithub.com/haproxy-dconv/configuration-1.4.html#http-check%20disable-on-404 help? It allow for the nicer (IMHO) behaviour of variable rise/fall settings for the healthcheck, but an immediate drop out on (and *only* on) 404s. Jonathan -- Jonathan Matthews Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: Detecting Flapping Service

care of > flapping services? Any help would be appreciated. Have you looked at the "rise" (and "fall") server parameters? Jonathan -- Jonathan Matthews Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: question about save source addr

simpler solution than either of these. HTH, Jonathan -- Jonathan Matthews Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: Proxied connections via SSH tunnel are up/down based on state of ssh tunnel not service

ease of setup) OpenVPN? With those, you'd have the advantage of being able to do TCP checks of the remote port instead of a localhost one, without having to care about the layer7 checks. Which isn't a /good/ thing - layer7 checks are the way forward! But it helps if you're not talking a layer7 protocol that HAProxy knows about. HTH, Jonathan -- Jonathan Matthews Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: Problems putting a persistence cookie in the defaults section

On 7 July 2012 15:09, Willy Tarreau wrote: > On Sat, Jul 07, 2012 at 01:22:01PM +0100, Jonathan Matthews wrote: >> Willy - how is this actually configured? I'm assuming you don't mean >> by using 2 separate instances ... > > It's like I suggested at the end of

Re: Problems putting a persistence cookie in the defaults section

outs differ a lot). Willy - how is this actually configured? I'm assuming you don't mean by using 2 separate instances ... -- Jonathan Matthews Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: No PID file when running in foreground

on't need to be notified of multiple PIDs in non-daemon mode - it's just the parent's single child that needs to be monitored. Jonathan -- Jonathan Matthews Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: TCP reverse proxy

h does not report >> addresses or ports inside the payload. For instance, it works well >> on SSH, SMTP, LDAP, RDP, PeSIT, SSL, etc... but not on FTP, most RPC, >> etc... In general, any protocol which can easily be translated will >> work. I think this is the case for all tho

Re: unresolvable host names as errors

On 27 April 2012 21:37, Andres Thomas Stivalet wrote: > Currently, if haproxy tries to start up and a webserver is down (and > it's defined as a hostname in the config file) haproxy refuses to > start. Do you really mean "down", or "unresolvable" as per your su

Re: Building HAProxy on Linux

gt; right thing? That's exactly what I use on our production boxes. Works for me. Jonathan -- Jonathan Matthews Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: nice wiki doc of haproxy

dispensable. Thanks for > doing this! +2. Our Junior SA grits her teeth when I point her at the text doc for answers; I'm sure this will ease such annoyance hugely :-) Jonathan -- Jonathan Matthews Oxford, London, UK http://www.jpluscplusm.com/contact.html

Re: haproxy keeps sending traffic to an offine backend

er a "server DOWN" log from one process, another process still >> sends >> traffic to it because it has not detected it as down yet. >> >> I'm seeing nothing particularly wrong below. You could improve your end >> user experience by replacing "httpclose" with "http-server-close". >> >> Regards, >> Willy >> > -- Jonathan Matthews London, Oxford, UK http://www.jpluscplusm.com/contact.html

Re: mailing list archives

On 7 April 2012 04:27, Jonathan Matthews wrote: > On 7 April 2012 01:43, Aman Gupta wrote: >> The mailing list archive at http://www.formilux.org/archives/haproxy/ >> appears to be broken. Are messages archived anywhere else? > > Works for me. What are you seeing? My ba

Re: mailing list archives

On 7 April 2012 01:43, Aman Gupta wrote: > The mailing list archive at http://www.formilux.org/archives/haproxy/ > appears to be broken. Are messages archived anywhere else? Works for me. What are you seeing? Jonathan -- Jonathan Matthews London, Oxford, UK http://www.jpluscplu

Re: Weird log output

valents. Not a complete superset, of course, but sufficiently greater timing and switching information that you may want to to consider keeping them in preference to nginx's. Jonathan -- Jonathan Matthews London, Oxford, UK http://www.jpluscplusm.com/contact.html

Re: Header manipulation generates a response?

oes this work? acl path_match path_beg /url1 use_backend options if path_match METH_OPTIONS It seems more visible to me to avoid acl accumulation at definition time, and to make the use_backend the place that they're AND'd. YMMV. Jonathan -- Jonathan Matthews London, Oxford, UK http://www.jpluscplusm.com/contact.html

Re: Header manipulation generates a response?

- but I may not totally grok a 204's intended usage, to be honest .. :-) Jonathan -- Jonathan Matthews London, Oxford, UK http://www.jpluscplusm.com/contact.html

Re: balance uri archaic options

On 2 April 2012 19:28, Sameh Ghane wrote: > Le (On) Mon, Apr 02, 2012 at 06:32:31PM +0100, Jonathan Matthews ecrivit > (wrote): >> On 2 April 2012 17:25, Sameh Ghane wrote: >> > >> > Is there anything I missed ? Like setting a specific request header which >

Re: balance uri archaic options

On 2 April 2012 17:25, Sameh Ghane wrote: > > Is there anything I missed ? Like setting a specific request header which > would > be the result of a regexp on the URI, and balancing on that header ? I don't understand what you've written. Could you say it again, but differently? Some examples wo

Re: Haproxy Slow Reload in DB Mode

QL connections. Whilst you /can/ get HAProxy to kill connections after a certain timeout, it's not a good solution unless your clients have robust error handling. You more likely need your MySQL clients to implement a connection timeout themselves, so that they control the process. J

Re: Is this a problem of stable version 1.4.20?

r B will never be > removed/updated. > > I am not sure this is a bug or not, but I guess this might be one problem. http://martinfowler.com/bliki/TwoHardThings.html This is not a problem that HAProxy is in any place to help you with, IMHO :-) You will need to solve the cach

Re: problems with enabling/disabling servers via socket

or anyone on list to fix your script, hence providing a simple command using very simple primitives (bash; socat; etc) that we can repeat until failure occurs will really help to clarify the failure you're observing. FWIW, I suggest you /don't/ provide the script :-) All the best, Jonathan

Re: hdr_end(host) not matching?

erence between these. One is for checking request headers and the other is for checking response headers. Cheers, Jonathan -- Jonathan Matthews London and Oxford, UK http://www.jpluscplusm.com/contact.html

Re: "observe layer7" acceptable response codes

On 10 March 2012 07:20, Willy Tarreau wrote: > On Wed, Mar 07, 2012 at 02:40:20PM +0000, Jonathan Matthews wrote: >> It seems to me that there's a trivial DoS available whenever "observe >> layer7" is enabled if, as I'm imagining, the set of acceptable >&g

"observe layer7" acceptable response codes

bserve layer4", of course. This is unhelpful in this scenario, as we're vhosting to a single IP on the origin servers. It will only guard against the entire HTTPd dying - not a specific vhost having problems. Any ideas? Cheers, Jonathan PS Thanks to all involved for HAProxy - an awesome bit of kit :-) -- Jonathan Matthews London, UK http://www.jpluscplusm.com/contact.html

Disabling logging of stats page requests

or-net; or perhaps just an increase in the number of times it can be specified incrementally without overriding the last setting? Many thanks, Jonathan -- Jonathan Matthews London, UK http://www.jpluscplusm.com/contact.html

Re: Logging per-connection Time To First Byte

On 13 May 2011 13:32, Willy Tarreau wrote: > On Fri, May 13, 2011 at 12:00:59AM +0100, Jonathan Matthews wrote: >> Just wondered if there'd ever been any discussion of recording each >> connection's Time To First Byte in the log output? > > Time to end of response

Logging per-connection Time To First Byte

e relatively standardised metric of TTFB that I thought I'd raise the idea here. Any thoughts? Cheers! Jonathan -- Jonathan Matthews London, UK http://www.jpluscplusm.com/contact.html

Re: Rate Limiting Blog Link

t yet", the rest of your email was rather light on *detail*. If other people are comprehending and happily using the functionality based on the existing config requirements and documentation, then perhaps the flaw doesn't lie with the config and/or documentation. My 2-pence, Jonathan --

<    1   2