Hello everyone, I'm writing to the list to talk about an issue I cannot solve.
I would like to use HAproxy on AWS, and now I'm facing to an issue. The setup is basic, on frontend (with HTTP and HTTPS binding), and a backend with a single backend server. Frequently, the time to connect to the backend server is equal to the "timeout connect" defined in the configuration file. The connection always succeed, but the time to connect is exactly the same as the "timeout connect". I first thought I could be related to the backend server, but after a deeper exploration using a network trace from the HAproxy server, I've found that the connection is really trying to be established at "time to frontend request + timeout connect". The behavior has been reproduced with HAproxy 1.8.3, and more recently with HAproxy 1.8.4 (Debian 9, OpenSSL 1.0.2l), and it can be reproduced with no load. Have you ever seen this issue ? Is anyone has an idea where this behavior can come from ? Example of log I can see: 2018-02-21 09:41:05.357 haproxy[1445]: A.B.C.D:45992 [21/Feb/2018:09:41:05.355] frontend1~ backend1/instance1 0/0/1/1/2 302 301 - - ---- 1/1/0/0/0 0/0 "GET /toto HTTP/1.1" 2018-02-21 09:41:05.493 haproxy[1445]: A.B.C.D:45993 [21/Feb/2018:09:41:05.491] frontend1~ backend1/instance1 0/0/1/1/2 302 301 - - ---- 1/1/0/0/0 0/0 "GET /toto HTTP/1.1" 2018-02-21 09:41:05.631 haproxy[1445]: A.B.C.D:45994 [21/Feb/2018:09:41:05.629] frontend1~ backend1/instance1 0/0/1/0/1 302 301 - - ---- 1/1/0/0/0 0/0 "GET /toto HTTP/1.1" 2018-02-21 09:41:05.769 haproxy[1445]: A.B.C.D:45995 [21/Feb/2018:09:41:05.767] frontend1~ backend1/instance1 0/0/1/0/1 302 301 - - ---- 1/1/0/0/0 0/0 "GET /toto HTTP/1.1" 2018-02-21 09:41:05.901 haproxy[1445]: A.B.C.D:45996 [21/Feb/2018:09:41:05.900] frontend1~ backend1/instance1 0/0/1/0/1 302 301 - - ---- 1/1/0/0/0 0/0 "GET /toto HTTP/1.1" 2018-02-21 09:41:06.032 haproxy[1445]: A.B.C.D:45997 [21/Feb/2018:09:41:06.031] frontend1~ backend1/instance1 0/0/1/0/1 302 301 - - ---- 1/1/0/0/0 0/0 "GET /toto HTTP/1.1" 2018-02-21 09:41:06.166 haproxy[1445]: A.B.C.D:45998 [21/Feb/2018:09:41:06.164] frontend1~ backend1/instance1 0/0/1/1/2 302 301 - - ---- 1/1/0/0/0 0/0 "GET /toto HTTP/1.1" 2018-02-21 09:41:06.300 haproxy[1445]: A.B.C.D:45999 [21/Feb/2018:09:41:06.298] frontend1~ backend1/instance1 0/0/0/1/1 302 301 - - ---- 1/1/0/0/0 0/0 "GET /toto HTTP/1.1" 2018-02-21 09:41:06.432 haproxy[1445]: A.B.C.D:46000 [21/Feb/2018:09:41:06.430] frontend1~ backend1/instance1 0/0/0/1/1 302 301 - - ---- 1/1/0/0/0 0/0 "GET /toto HTTP/1.1" 2018-02-21 09:41:11.568 haproxy[1445]: A.B.C.D:46001 [21/Feb/2018:09:41:06.565] frontend1~ backend1/instance1 0/0/5002/1/5003 302 301 - - ---- 1/1/0/0/1 0/0 "GET /toto HTTP/1.1" 2018-02-21 09:41:11.700 haproxy[1445]: A.B.C.D:46003 [21/Feb/2018:09:41:11.699] frontend1~ backend1/instance1 0/0/0/1/1 302 301 - - ---- 1/1/0/0/0 0/0 "GET /toto HTTP/1.1" 2018-02-21 09:41:11.829 haproxy[1445]: A.B.C.D:46004 [21/Feb/2018:09:41:11.827] frontend1~ backend1/instance1 0/0/0/1/1 302 301 - - ---- 1/1/0/0/0 0/0 "GET /toto HTTP/1.1" 2018-02-21 09:41:11.958 haproxy[1445]: A.B.C.D:46005 [21/Feb/2018:09:41:11.956] frontend1~ backend1/instance1 0/0/0/1/1 302 301 - - ---- 1/1/0/0/0 0/0 "GET /toto HTTP/1.1" 2018-02-21 09:41:12.089 haproxy[1445]: A.B.C.D:46006 [21/Feb/2018:09:41:12.087] frontend1~ backend1/instance1 0/0/0/1/1 302 301 - - ---- 1/1/0/0/0 0/0 "GET /toto HTTP/1.1" 2018-02-21 09:41:12.219 haproxy[1445]: A.B.C.D:46007 [21/Feb/2018:09:41:12.218] frontend1~ backend1/instance1 0/0/0/1/1 302 301 - - ---- 1/1/0/0/0 0/0 "GET /toto HTTP/1.1" 2018-02-21 09:41:12.350 haproxy[1445]: A.B.C.D:46008 [21/Feb/2018:09:41:12.348] frontend1~ backend1/instance1 0/0/1/1/2 302 301 - - ---- 1/1/0/0/0 0/0 "GET /toto HTTP/1.1" 2018-02-21 09:41:12.485 haproxy[1445]: A.B.C.D:46009 [21/Feb/2018:09:41:12.483] frontend1~ backend1/instance1 0/0/1/0/1 302 301 - - ---- 1/1/0/0/0 0/0 "GET /toto HTTP/1.1" The request at "09:41:06.565" takes 5002ms to connect to backend server. In a tcpdump capture I will see that TCP SYN packet sent to backend server will be sent at T+5s, (with a timeout connect set to 5s) Thanks, -- Erwan
