Re: reconnect question
Yoann Vandoorselaere <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <1209712604.6414.68.camel@arwen> |
Le mardi 29 avril 2008 à 08:22 -0500, LC Bruzenak a écrit : > On Tue, 2008-04-29 at 10:33 +0200, Yoann Vandoorselaere wrote: > > Le lundi 28 avril 2008 à 09:34 -0500, LC Bruzenak a écrit : > > > On Mon, 2008-04-21 at 19:33 +0200, Yoann Vandoorselaere wrote: > > > > Le jeudi 17 avril 2008 à 19:05 -0700, LC Bruzenak a écrit : > > > > > In testing, when the prelude-manager on my collection machine is stopped the > > > > > clients are unable to reconnect on their own. > > > > > I am forced to go restart those services in order to reestablish connection. > > > > > I realize that the collection server should never go away; it should be a > > > > > high-availability type of system. > > > > > > > > This is what is supposed to happen: once an agent notice the connection > > > > loss, it will wait for ten seconds then attempt a reconnection. > > > > > > > > Each time the reconnection attempt fail, the connection timeout is > > > > increased by a factor of two, up to one hour total. > > > > > > > > - 10 seconds > > > > - 20 seconds > > > > - 40 seconds > > > > - 80 seconds > > > > - ... > > > > - 3600 seconds > > > > > > > > Aren't you observing this behavior? > > > > > > This may be happening as you describe. > > > > > > We left the connection disabled for ~23 minutes, after which time your > > > algorithm would be at or near the 1-hour reconnect time. > > > > > > It gets to a long time rather quickly this way...the first 3 checks in > > > the series happen in < 1 minutes, while the last 3 are at the 21.2 > > > minutes, 42.4 minutes and 1 hour mark IIUC. > > > > > > This is a long time - the reconnect time dominates the downtime. > > > > > > Is there a reason for the incremental reconnect delay? > > > > Not really, we always achieved this behavior, and never got any negative > > feedback concerning it. Anyone out there would also like to see shorter > > reconnection time? > > > > What about the same incremental delay, with the maximum timeout being > > ten minutes? > > Perhaps a configurable maximum? That would be possible, although it could be a pain to implement, since the API is used by a lot of Prelude modules. At first, it would be easier to have nicer default values. Suggestions? -- Yoann Vandoorselaere | Responsable R&D / CTO | PreludeIDS Technologies Tel: +33 (0)8 70 70 21 58 Fax: +33(0)4 78 42 21 58 http://www.prelude-ids.com _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-user