Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have several Entropy Keys with egd in front of them and then all load balanced by haproxy. I then have many client machines using the haproxy service IP as a network source of entropy. I have no idea how much entropy they are requesting.

The Entropy Keys can produce a limited amount of usable entropy. The specs say about 30 kilobit/sec minimum. As far as I can see, the Entropy Key doesn't have a way to query how much it is being asked for. The EGD protocol seems quite hard to sniff to find this information. Clients can request a variable amount of entropy, and they might not get back the same amount.

Has anyone found a simple way to measure how much is being requested from an Entropy Key?

It would be good to know, in order to be able to plan when additional keys are required, and to spot haywire clients.

share|improve this question
    
What is Entropy Key? Is it a hardware RNG? –  Hubert Kario Jan 28 '12 at 13:08
    
@HubertKario Yes. It's manufactured by Simtec Electronics in the UK. –  James O'Gorman Jan 28 '12 at 14:37

2 Answers 2

The only two things that come to mind is trying to measure the response time of your entropy server (there should be a significant increase in latency if it can't keep up) or pooling /proc/sys/kernel/random/entropy_avail and monitoring how much entropy you have (I'm assuming that egd is using /dev/random and not the hardware directly).

share|improve this answer
    
ekeyd-egd-linux is accessing the hardware directly (and AFAIK it can only work this way). Unfortunately I have no access to many of the clients, so I cannot tell how many of them are not getting the entropy they request. I think I should be able to request some entropy directly from the individual key and check how long it takes to supply it as you suggest. That should give me some hint as to whether it is overloaded at least. –  grifferz Jan 28 '12 at 16:23

It looks like the source tarball for ekeyd has a munin plugin for providing ekey statistics.

Even if you're not running munin I guess it would be possible to extrapolate the script into something usable for your infrastructure.

I think we both know the authors of the device and software though, so might be worth prodding them. :-)

share|improve this answer
    
AFAIK this only exposes what you can get from ekeydctl stats which simtec have already confirmed will not tell me what I need to know - I have already asked them. :( I was just wondering what others did. –  grifferz Jan 29 '12 at 0:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.