Re: [Pound Mailing List] Pound 2.7 Hickups on OpenBSD 5.6
"Nino Fink, Contria GmbH" <[email protected]>
| Newsgroups | gmane.comp.web.pound.general |
|---|---|
| Message-ID | <[email protected]> |
Hi, I checked our DNS infrastructure, but could not find anything wrong with it. Next I changed the NIC to an E1000 and afterwards to an E1000E, but this ended both times in an Kernel Panic after I started putting some load on the server. So I returned to using VMXNET3. After this I modified the pound.cfg, to "Threads 512", which we are currently testing with. If we set Threads to higher than 1024 pound stops working, the daemon continues to run but wont deliver sites other than Error 503. I made sure "ulimit" was set to 8192 (default was 128, which meant that only 128 users were able to login to the site) I will now test the openbsd and the freebsd in parallel, if i have any news i will let you know. (I opened a new thread for the problems i am experiencing in freebsd: "No Logs, Pound on FreeBSD 10.0") Freundliche Grüsse Nino Fink -- Netzwerkabteilung Contria GmbH Steinackerweg 18 4901 Langenthal Tel. +41 62 919 07 90 Fax. +41 62 919 07 99 www.contria.ch 2015-04-09 21:42 GMT+02:00 Nick Rogers <[email protected]>: > > > On Thu, Apr 9, 2015 at 9:01 AM, Nino Fink, Contria GmbH <[email protected]> > wrote: > >> We are running Pound 2.7 on a OpenBSD 5.6 Sever, with LIbreSSL 2.1.6, as >> nologin user "_pound" in a jailed environment. >> >> The server itself runs on ESX 5.5 (Dell R620 2*8 Core 192GB Ram with a >> 20GBit backbone) >> The VM got 4 Cores, 4GB Ram, 16GB HDD and one NIC assigned. >> >> In busy times (100-200 users) our pound is experiencing hickups, which >> means, the server becomes unresponsive for 3-10 seconds, in this time no >> logs are written and no user is able to login via ssh. >> After this the server is fine(fast and responsive, the site gets >> delivered fast), we don`t see any sign of work overload using top and the >> vsphere utillities. >> > >> What could be the cause for this behavior? >> > > Heres my two cents from experience... > > I haven't used OpenBSD in many years, and have since moved to FreeBSD for > various reasons, but it sounds like you are running into some kind of > resource limitation in the kernel, particularly if you are not able to SSH > to the machine in addition to the pound issues. I would make sure you are > not hitting some low limit on number of sockets, connections, mbufs, etc. I > don't recall the specific OpenBSD tunables. Check syslog for messages from > the kernel about hitting limits. > > Specific to pound, you might want to increase your Threads limit. The > default is 128, which can cause performance issues if you have many > simultaneous requests. However I don't see this affecting sshd. > > I would also make sure there is nothing going on with the VMware ESXI > layer. Make sure there are no known performance issues with the OpenBSD > virtual NIC driver. > > If your existing SSH sessions perform fine when this happens, its likely a > connections/sockets/threads limit or such in the kernel. If the existing > SSH sessions hang during this time, then the problem is likely something > deeper and related to the NIC driver or elsewhere. > > Sometimes making sure vmware-tools is installed in the guest OS can help > with weird problems like this, but that is a longshot. > > -Nick > > >> our config: >> >> ________________________________________________________________________________ >> >> User "_pound" >> >> Group "_pound" >> >> RootJail "/path/pound/jail" >> >> >> #Control Socket >> >> Control "/path/pound.socket" >> >> >> # 0=none, 1=normal, 2=extended, 3=CLF, etc. >> >> LogLevel 5 >> >> >> # backend check interval (in seconds) >> >> Alive 5 >> >> # client timeout >> >> Client 5 >> >> >> # backend timeout >> >> TimeOut 300 >> >> >> ListenHTTP >> >> Address xxx.xxx.xxx.xxx >> >> Port 80 >> >> # 0=GET/POST/HEAD, 1+=PUT/DELETE, 2+=WebDAV, 3+=MS WebDAV, 4+=MS >> RPC >> >> xHTTP 0 >> >> #ErrPages >> >> Err414 "/path/414.html" >> >> Err500 "/path/500.html" >> >> Err501 "/path/501.html" >> >> Err503 "/anon/503.html" >> >> End >> >> >> ListenHTTPS >> >> Address xxx.xxx.xxx.xxx >> >> Port 443 >> >> # Zertifikatsfile wird vor dem chroot gelesen und im memory >> gehalten >> >> Cert "/path/anon.sha256.pem" >> >> Cert "/path/anon.org.sha256.pem" >> >> # 0=GET/POST/HEAD, 1+=PUT/DELETE, 2+=WebDAV, 3+=MS WebDAV, 4+=MS >> RPC >> >> xHTTP 0 >> >> #ErrPages >> >> Err414 "/path/414.html" >> >> Err500 "/path/500.html" >> >> Err501 "/path/501.html" >> >> Err503 "/anon/503.html" >> >> # CIPHER >> >> SSLHonorCipherOrder 1 >> >> Ciphers >> "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:DHE-RSA-DES-CBC3-SHA" >> >> End >> >> # web1.anon.org >> >> Service >> >> HeadRequire "Host: (.?)*anon\.org.*" >> >> BackEnd >> >> Address xxx.xxx.xxx.xxx >> >> Port 80 >> >> End >> >> Session >> >> Type Cookie >> >> ID "PHPSESSID" >> >> TTL 10800 >> >> End >> >> End >> >> ___________________________________________________________________ >> >> >> Freundliche Grüsse >> Nino Fink >> >> -- >> Netzwerkabteilung >> >> Contria GmbH >> Steinackerweg 18 >> 4901 Langenthal >> >> Tel. +41 62 919 07 90 >> Fax. +41 62 919 07 99 >> www.contria.ch >> > >