Re: Scheduling lc, rr, persistent.
Denis <[email protected]> Fri, 2 Feb 2007 08:13:05 -0300
| Newsgroups | gmane.linux.highavailability.ultramonkey |
|---|---|
| Message-ID | <[email protected]> |
How can I verify if the 'ipvsadm' service is running at one server at time? I can see that just one of the servers is taken the virtual IP at time and the command ldirectord /etc/ldirectord.cf status shows that in one machine is running and in another is not. I followed the streamline example on ultramonkey and used all the sysctl commands that are listeds there. net.ipv4.ip_forward = 1 net.ipv4.conf.all.arp_ignore = 1 net.ipv4.conf.eth0.arp_ignore = 1 net.ipv4.conf.eth1.arp_ignore = 1 net.ipv4.conf.eth2.arp_ignore = 1 net.ipv4.conf.all.arp_announce = 2 net.ipv4.conf.eth0.arp_announce = 2 net.ipv4.conf.eth1.arp_announce = 2 net.ipv4.conf.eth2.arp_announce = 2 have another sysctl line to configure? thanx 2007/2/2, Andersson Mattias <[email protected]>: > The ipvsadm service should only run at one of the servers at a time, > this is what heartbeat should make certain if configured correctly. And > if you are using streamline I hope you use the sysctl.conf > arp-problem-fix instead of arptables. > > /Mattias > > > -----Original Message----- > > From: [email protected] > [mailto:ultramonkey-users- > > [email protected]] On Behalf Of Denis > > Sent: Wednesday, January 31, 2007 8:43 PM > > To: [email protected] > > Subject: Scheduling lc, rr, persistent. > > > > Hello guys! I''m Im trouble with a Squid proxy that uses a LB+HA > > streamlined DR server . > > > > > > I was using the rr scheduler but the users were always having problems > > with slugishness and frequently timeouts when accessing the internet. > > > > I tried to change my scheduler to lc persistent mode but some users > > can connect and anothers can't. and if u wait for a minutes u can > > connect, and not, and yes, and not intermittent. With the persistent > > option disabled, sometimes that occurs to, and sometimes not. > > > > When I type the ipvsadm -L -n > > > > the tables in two machines is different from another one, > > > > sometimes have a lot of connections on all colluns and sometimes so > few > > conn. > > > > machine one: > > Proxy-Node1:~# ipvsadm -L -n > > IP Virtual Server version 1.2.0 (size=4096) > > Prot LocalAddress:Port Scheduler Flags > > -> RemoteAddress:Port Forward Weight ActiveConn InActConn > > TCP 172.16.8.77:3128 lc persistent 180 > > -> 172.16.8.83:3128 Local 1 19 130 > > -> 172.16.8.85:3128 Route 1 11 388 > > > > Proxy-Node2:~# ipvsadm -L -n > > IP Virtual Server version 1.2.0 (size=4096) > > Prot LocalAddress:Port Scheduler Flags > > -> RemoteAddress:Port Forward Weight ActiveConn InActConn > > TCP 172.16.8.77:3128 lc persistent 180 > > -> 172.16.8.83:3128 Route 1 0 94 > > -> 172.16.8.85:3128 Local 1 40 56 > > > > > > in another time: > > > > Proxy-Node1:~# ipvsadm -L -n > > IP Virtual Server version 1.2.0 (size=4096) > > Prot LocalAddress:Port Scheduler Flags > > -> RemoteAddress:Port Forward Weight ActiveConn InActConn > > TCP 172.16.8.77:3128 lc > > -> 172.16.8.83:3128 Local 1 99 518 > > -> 172.16.8.85:3128 Route 1 190 398 > > > > Proxy-Node2:~# ipvsadm -L -n > > IP Virtual Server version 1.2.0 (size=4096) > > Prot LocalAddress:Port Scheduler Flags > > -> RemoteAddress:Port Forward Weight ActiveConn InActConn > > TCP 172.16.8.77:3128 lc > > -> 172.16.8.83:3128 Route 1 181 660 > > -> 172.16.8.85:3128 Local 1 182 741 > > > > that looks as a DOS atacck, so I enabled the 3 options of dos defence > from > > lvs: > > > > echo 1 > /proc/sys/net/ipv4/vs/secure_tcp && echo 1 > > > /proc/sys/net/ipv4/vs/drop_packet && echo 1 > > > /proc/sys/net/ipv4/vs/drop_entry > > > > I tried to reduce the timeout from tcp, tcp_fin and udp connections > too: > > > > ipvsadm --set 300 120 120 > > > > > > but I still having that problem... > > > > The browser can't connect to the proxy, analizing the tcpdump from a > > client that cant connect to proxy at real time, the output is this: > > > > 17:03:31.967415 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > 17:03:31.967490 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > 17:03:31.967696 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > 17:03:31.967841 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > 17:03:31.968210 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > 17:03:31.967945 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > 17:03:31.968342 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > 17:03:31.968105 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > 17:03:31.968610 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > 17:03:31.968508 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > 17:03:31.969067 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > 17:03:31.980978 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > 17:03:31.984454 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > 17:03:31.984587 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > 17:03:31.984687 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > 17:03:31.984733 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > 17:03:31.985094 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > 17:03:31.985148 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > 17:03:31.985858 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > 17:03:31.985898 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > 17:03:31.986199 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > 17:03:31.986233 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > 17:03:31.986579 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > 17:03:31.986649 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > > > > > that is as the client try to connect but the server does't answer. > > > > What I want is to use this system for a ha+lb proxy My machines are > > two PIV 3.0 with 1Gb Ram > > > > Looking at mrtg the processor load stays about 5% all the day and the > > memory about 30% > > > > I have about 1000~1300 clients. Are my servers less than I need? > > > > > > Regards, thanks. > > > > =) And sorry for my poor english =D > > > > > > -- > > Ultra Monkey - http://www.ultramonkey.org/ > > To UNSUBSCRIBE, email to [email protected], with a body: > > unsubscribe ultramonkey-users [email protected] > > where "[email protected]" is YOUR email address. > > > > > > -- Ultra Monkey - http://www.ultramonkey.org/ To UNSUBSCRIBE, email to [email protected], with a body: unsubscribe ultramonkey-users [email protected] where "[email protected]" is YOUR email address.