Re: Scheduling lc, rr, persistent.
Denis <[email protected]> Fri, 2 Feb 2007 10:07:51 -0300
| Newsgroups | gmane.linux.highavailability.ultramonkey |
|---|---|
| Message-ID | <[email protected]> |
hm... sometimes, actually, when I restart the heartbeat, it looks as you told. But when I restart the machines, it appears as I told: Ldirectord running on one machine, just one assigned with the Virtual IP, but the two nodes answering the command ipvsadm -L -n (with very diferent data between them). In wich files of my configuration can I look for mistakes? Now, reading some articles I got a doubt: I saw that to use DR the machines must be in the same network. So, its means that the clients of my proxy must be in the same lan? e.g.: here i have about 30 sub-networks, all acessing internet trought this ha+lb streamline proxy. Should I use another type of LVS forwarding? I didn't tought to use the NAT way becouse all my inter-lans are routeds, but i got a doubt if I must use the tunelled way. I'm getting crazy becouse sometimes it works as a dream, and sometimes it crashes a lot of connections. even so on clients in the same lan of the servers. Any advices? Best regards, Denis. *again sorry my poor english =$ 2007/2/2, Andersson Mattias <[email protected]>: > This sounds all fine. > > > > -----Original Message----- > > From: Denis [mailto:[email protected]] > > Sent: Friday, February 02, 2007 12:13 PM > > To: Andersson Mattias; [email protected] > > Subject: Re: Scheduling lc, rr, persistent. > > > > How can I verify if the 'ipvsadm' service is running at one server at > > time? > > You can run > # ipvsadm > If it really isn't running it should just say something like: > IP Virtual Server version 1.0.8 (size=65536) > Prot LocalAddress:Port Scheduler Flags > -> RemoteAddress:Port Forward Weight ActiveConn InActConn > > If it is running it will also show all active virtual servers... > > /Mattias > > > > > > I can see that just one of the servers is taken the virtual IP at time > > and the command ldirectord /etc/ldirectord.cf status > > > > shows that in one machine is running and in another is not. > > > > I followed the streamline example on ultramonkey and used all the > > sysctl commands that are listeds there. > > > > net.ipv4.ip_forward = 1 > > net.ipv4.conf.all.arp_ignore = 1 > > net.ipv4.conf.eth0.arp_ignore = 1 > > net.ipv4.conf.eth1.arp_ignore = 1 > > net.ipv4.conf.eth2.arp_ignore = 1 > > net.ipv4.conf.all.arp_announce = 2 > > net.ipv4.conf.eth0.arp_announce = 2 > > net.ipv4.conf.eth1.arp_announce = 2 > > net.ipv4.conf.eth2.arp_announce = 2 > > > > have another sysctl line to configure? > > > > > > thanx > > > > > > 2007/2/2, Andersson Mattias <[email protected]>: > > > The ipvsadm service should only run at one of the servers at a time, > > > this is what heartbeat should make certain if configured correctly. > And > > > if you are using streamline I hope you use the sysctl.conf > > > arp-problem-fix instead of arptables. > > > > > > /Mattias > > > > > > > -----Original Message----- > > > > From: [email protected] > > > [mailto:ultramonkey-users- > > > > [email protected]] On Behalf Of Denis > > > > Sent: Wednesday, January 31, 2007 8:43 PM > > > > To: [email protected] > > > > Subject: Scheduling lc, rr, persistent. > > > > > > > > Hello guys! I''m Im trouble with a Squid proxy that uses a LB+HA > > > > streamlined DR server . > > > > > > > > > > > > I was using the rr scheduler but the users were always having > problems > > > > with slugishness and frequently timeouts when accessing the > internet. > > > > > > > > I tried to change my scheduler to lc persistent mode but some > users > > > > can connect and anothers can't. and if u wait for a minutes u can > > > > connect, and not, and yes, and not intermittent. With the > persistent > > > > option disabled, sometimes that occurs to, and sometimes not. > > > > > > > > When I type the ipvsadm -L -n > > > > > > > > the tables in two machines is different from another one, > > > > > > > > sometimes have a lot of connections on all colluns and sometimes > so > > > few > > > > conn. > > > > > > > > machine one: > > > > Proxy-Node1:~# ipvsadm -L -n > > > > IP Virtual Server version 1.2.0 (size=4096) > > > > Prot LocalAddress:Port Scheduler Flags > > > > -> RemoteAddress:Port Forward Weight ActiveConn > InActConn > > > > TCP 172.16.8.77:3128 lc persistent 180 > > > > -> 172.16.8.83:3128 Local 1 19 130 > > > > -> 172.16.8.85:3128 Route 1 11 388 > > > > > > > > Proxy-Node2:~# ipvsadm -L -n > > > > IP Virtual Server version 1.2.0 (size=4096) > > > > Prot LocalAddress:Port Scheduler Flags > > > > -> RemoteAddress:Port Forward Weight ActiveConn > InActConn > > > > TCP 172.16.8.77:3128 lc persistent 180 > > > > -> 172.16.8.83:3128 Route 1 0 94 > > > > -> 172.16.8.85:3128 Local 1 40 56 > > > > > > > > > > > > in another time: > > > > > > > > Proxy-Node1:~# ipvsadm -L -n > > > > IP Virtual Server version 1.2.0 (size=4096) > > > > Prot LocalAddress:Port Scheduler Flags > > > > -> RemoteAddress:Port Forward Weight ActiveConn > InActConn > > > > TCP 172.16.8.77:3128 lc > > > > -> 172.16.8.83:3128 Local 1 99 518 > > > > -> 172.16.8.85:3128 Route 1 190 398 > > > > > > > > Proxy-Node2:~# ipvsadm -L -n > > > > IP Virtual Server version 1.2.0 (size=4096) > > > > Prot LocalAddress:Port Scheduler Flags > > > > -> RemoteAddress:Port Forward Weight ActiveConn > InActConn > > > > TCP 172.16.8.77:3128 lc > > > > -> 172.16.8.83:3128 Route 1 181 660 > > > > -> 172.16.8.85:3128 Local 1 182 741 > > > > > > > > that looks as a DOS atacck, so I enabled the 3 options of dos > defence > > > from > > > > lvs: > > > > > > > > echo 1 > /proc/sys/net/ipv4/vs/secure_tcp && echo 1 > > > > > /proc/sys/net/ipv4/vs/drop_packet && echo 1 > > > > > /proc/sys/net/ipv4/vs/drop_entry > > > > > > > > I tried to reduce the timeout from tcp, tcp_fin and udp > connections > > > too: > > > > > > > > ipvsadm --set 300 120 120 > > > > > > > > > > > > but I still having that problem... > > > > > > > > The browser can't connect to the proxy, analizing the tcpdump from > a > > > > client that cant connect to proxy at real time, the output is > this: > > > > > > > > 17:03:31.967415 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > > > 17:03:31.967490 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > > > 17:03:31.967696 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > > > 17:03:31.967841 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > > > 17:03:31.968210 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > > > 17:03:31.967945 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > > > 17:03:31.968342 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > > > 17:03:31.968105 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > > > 17:03:31.968610 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > > > 17:03:31.968508 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > > > 17:03:31.969067 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > > > 17:03:31.980978 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > > > 17:03:31.984454 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > > > 17:03:31.984587 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > > > 17:03:31.984687 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > > > 17:03:31.984733 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > > > 17:03:31.985094 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > > > 17:03:31.985148 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > > > 17:03:31.985858 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > > > 17:03:31.985898 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > > > 17:03:31.986199 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > > > 17:03:31.986233 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > > > 17:03:31.986579 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > > > 17:03:31.986649 IP 172.16.8.126.4512 > 172.16.8.77.3128: S > > > > 687174948:687174948(0) win 65535 <mss 1460,nop,nop,sackOK> > > > > > > > > > > > > that is as the client try to connect but the server does't answer. > > > > > > > > What I want is to use this system for a ha+lb proxy My machines > are > > > > two PIV 3.0 with 1Gb Ram > > > > > > > > Looking at mrtg the processor load stays about 5% all the day and > the > > > > memory about 30% > > > > > > > > I have about 1000~1300 clients. Are my servers less than I need? > > > > > > > > > > > > Regards, thanks. > > > > > > > > =) And sorry for my poor english =D > > > > > > > > > > > > -- > > > > Ultra Monkey - http://www.ultramonkey.org/ > > > > To UNSUBSCRIBE, email to [email protected], with a body: > > > > unsubscribe ultramonkey-users [email protected] > > > > where "[email protected]" is YOUR email address. > > > > > > > > > > > > > > > > -- Ultra Monkey - http://www.ultramonkey.org/ To UNSUBSCRIBE, email to [email protected], with a body: unsubscribe ultramonkey-users [email protected] where "[email protected]" is YOUR email address.