Tag Info

New answers tagged

1

I have a very similar set up in HAProxy which works. I can only find two differences between your configuration and mine. In /etc/hosts I have bound example.com to 0.0.0.0 rather than 127.0.0.1. In my frontend, both bind entries contain a wildcard (*) in front of the colon. Example: bind *:80 bind *:443 ssl crt /etc/ssl/ssl.pem 2a. I actually used a pem ...


0

The problem was SELinux only allowing the web server to make outbound connections to a limited set of ports. Fixed by doing: semanage port --add --type http_port_t --proto tcp 8001 after installing semanage with yum install policycoreutils-python Nodejs Nginx error: (13: Permission denied) while connecting to upstream


1

Kind of - it is called "backup": server backend-default 10.10.10.3:3300 check inter 5000 rise 1 fall 3 backup From the haproxy docs: Since version 1.1.17, it is possible to specify backup servers. These servers are only sollicited when no other server is available. This may only be useful to serve a maintenance page, or define one active and one ...


0

You can use HAProxy backend health checking mechanism: backend farm1 server s1 192.168.1.10:80 check server s2 192.168.1.11:80 check More info: http://cbonte.github.io/haproxy-dconv/configuration-1.5.html#check


1

You may use different backend section for specified URL. For example: frontend webserver use_backend srv_noerrors if { url_beg /display_blank_when_errored } default_backend srv_werrors backend srv_noerrors errorfile 503 /etc/haproxy/errors/503err_blank.http backend srv_werrors errorfile 503 /etc/haproxy/errors/503err_info.http


0

I was just about to ask if the value of the address variables was changing, heh. The way I've been seeing this done in dynamic containered environments is to use a service discovery tool like etcd or Consul to help the load balancer find the backends - looks like Consul has a tool specifically for the HAProxy use case.


0

If the root of your issue is the fact that the backend servers expect traffic to be HTTPS rather than HTTP, try encrypting the HTTP and do your regular Layer7 load balancing. listen https_handler bind 1.2.3.4:443 ssl crt /etc/ssl/certs/certs.pem mode http balance leastconn # any stick rules you need server s1 1.1.1.1:443 ssl server ...


1

The easiest solution is to use balance source, but if many clients come from the same IP, it may not be very fair on your backend servers. See http://blog.haproxy.com/2013/04/22/client-ip-persistence-or-source-ip-hash-load-balancing/ for more discussion on methods to accomplish this.


0

I've resolved (or sort of) my problem using another HAProxy to serve static content, by this way performance now is very high and response times are way better than before. Anyway, I will be studying what happend with this.


2

As it turns out I was very close to a working config. Changing the redirect line to read redirect prefix / code 301 if old_url made it work as expected. I wrote a blog post which outlines the problem in a little more detail: http://fromanegg.com/post/105250564587/how-to-rewrite-and-redirect-with-haproxy


0

Nerijus is right, this issue is caused by the HAProxy having a client timeout, which means, if the connection is considered idle for more than X ms then the connection is dropped. TCP can send keep-alive packets to ensure an idle connection should stay open. You can check your TCP parameter for keep-alive packets using the following command: $ cat ...


0

Instead of blocking abusers you could add response headers indicating client IP address that broke the rules. Something like this: http-request add-header X-Haproxy-Abuse %ci if connabuse http-request add-header X-Haproxy-Kill %ci if connkill where %ci represents Client IP address, you can log any other param mentioned here: ...


1

Two haproxy instances can share load by using 2 virtual IPs with each instance the master for one of those. Round robin DNS roughly balances between the 2 virtual IPs (and consequently between the two haproxy instances). This method also works with SSL. One reason to think twice about this active-active setup though is if one instance can't cope with the ...


2

Nice picture :) timeout connect is on server side, it is the maximum time to run the TCP handshake http-request starts from the ACK on the client side until whole HTTP headers have been received Tq starts from the client Handshake TCP. Tr is until we receive the response Headers Baptiste


2

I had the same problem as @tom-angelo-clemente, but solved it by using the broadcast address on the bind parameter of a frontend: frontend wfe bind 0.0.0.0:80 This will bind the proxy to any IP address the machine is using (not sure about addresses on different NIC devices), so be careful when using this way if you have a private management interface ...


0

I had problem where telnet 127.0.0.1 9200 gave 503 Server unavailable response, but when I executed /usr/bin/clustercheck as root it showed that everything was fine. With this command I was able to execute clustercheck as user nobody and got real MySQL error to /tmp/cluster.log: sudo -H -u nobody bash -c "/usr/bin/clustercheck clustercheckuser ...


2

I don't know of an existing tool offhand. But you can take the work done with this logstash grok regex, convert to a regex in the language of your choice and spit out the object as csv.


1

All other answers are pre-2010, hence adding an updated comparison. Nginx A full web server, other features can also be used. Eg: HTTP Compression SSL Support Very light weight as Nginx was designed to be light from the start. Near Varnish caching performance Close to HAProxy load balancing performance Varnish best for complex caching scenarios and ...



Top 50 recent answers are included