Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
9 10
 Nice Answer
~206k people reached

  • 0 posts edited
  • 0 helpful flags
  • 35 votes cast
comment HAProxy is swapping (Major Faults) when Serving Web Sockets
OK so this instance is taking 15GB of RAM currently and its configuration allows it to grow up to 40G. Thus there's nothing alarming since there are 34G available as cache. It's just that the system has decided that part of the memory was better used for the cache than for haproxy. Actually it could make sense to disable swapping on this machine, or you risk getting into hard-to-debug issues (eg: slow connection times). BTW, you still need to ensure that the 34GB are really cache. For this you can echo 3 > /proc/sys/vm/drop_caches.
comment haproxy redirect keep querystring
no, look, the request is changed, not only the domain.
comment Haproxy not properly passing on X-Forwarded-For header
It does not do that by default, and I suspect that your application does not iterate over all headers but randomly picks one and uses the value it carries. Haproxy never modifies the existing header, it always adds one with the new value. It may be the one your application is seeing, but your application should also see the previous ones.
comment Haproxy not properly passing on X-Forwarded-For header
I don't get your point then. The client's IP is sent in the XFF header to the server. Concerning keep-alive, you may then use "forceclose" to disable it more efficiently than with "httpclose" as it releases the server connection earlier.
comment HAProxy causing delay
1) virtualized environments are notoriously known for adding long random delays, sometimes multiple milliseconds. Run a ping between 2 EC2 instances and you'll see. 2) no, do not use nf_conntrack, it could even reduce performance, I was just checking. 5) logs: you need to enable them via your syslog daemon, it's also explained in the doc if you want.
comment How can I use HAproxy with SSL and get X-Forwarded-For headers AND tell PHP that SSL is in use?
Sorry Josh, I don't know enough about pfSense to know if you can update components on it or not, and since you were speaking about installing a package, I believed it was the case. Last time I tried it was around 5 years ago so I don't remember all the details.
comment Should I use an ssl terminator or just haproxy?
Yes haproxy supports SSL termination since 1.5-dev12, which greatly simplifies SSL termination and session sharing.
comment Do HTTP reverse proxies typically enable HTTP Keep-Alive on the client side of the proxied connection and not on the server side?
Kudos for the excellent explanation Graeme, I never spent enough time for that long a reply to whoever asked me this, and I'll sure keep a link to this post to serve as a very clear response now :-)
comment How to forcast the spec of a Linux load balancer?
Hi Kyle, do not forget that SSL consumes an additional 64kB per connection, which significantly reduces the amount of concurrent connections you can stand per GB of RAM. That said, I agree with all your points :-)
comment Haproxy and CNAME
This has nothing to do with load balancing then. Why are you using a load balancer to do that ?
comment HAProxy: Possible to dynamically construct new headers based on the HTTP request?
I'd add that it's expected to be possible in a next version, but not too soon as some changes are still necessary.
comment Should Nginx be at the front of HAProxy or opposite?
Not exactly. Haproxy may connect to the server using the client's IP address, but that requires kernel cooperation (eg: TPROXY feature). This should be avoided wherever possible though.
comment Other options to “balance source” in haproxy
Then dest port hashing will not guarantee that each client will go to a different port. What you'd better do then is to manually assign the servers to the ports. It would be a lot easier for your case.
comment Tuning Linux IP routing parameters — secret_interval and tcp_mem
When this happens, the message is different in dmesg, you see "too many of orphaned sockets". However I agree with you that orphans can consume a huge amount of memory.
comment Alternative reverse proxy that supports HTTP 1.1, SSL, and keep-alive?
Cache-control is an example of header which is unconditionally sent regardless of the client's advertised version because many agents announcing do 1.0 in fact support some of the cache-control values or are not concerned and forward it. In the example above, nginx was used to decipher SSL, it's not concerned by this header and will pass it on. I agree about the other points you made, but they're not the most commonly used by small app servers in general.
comment Alternative reverse proxy that supports HTTP 1.1, SSL, and keep-alive?
@symcbean: do you have examples of other very useful things that can only be done in 1.1 and not in 1.0 ? Considering that many people install their servers behind nginx which does not support 1.1 on the server side, I guess that very little people miss those features !
comment Alternative reverse proxy that supports HTTP 1.1, SSL, and keep-alive?
@user41356: I've not said chunked encoding is only good when the server compresses, but that in this situation it's particularly useful. It has other uses but they are less common.
comment HAProxy not passing SSL traffic in TCP mode (unknown protocol)
"mode tcp" is the default. If you need to specify it in both sections, then this means you have a "defaults" section above which sets "mode http" and possibly other settings. I strongly suggest that you don't put some TCP sections after such a defaults section. Better define a new defaults section for TCP settings in order to reset those dedicated to HTTP.
comment HAProxy being killed with more that 54,000 connections
At 54000 concurrent connections, you should be careful about your TCP settings. If running with default settings (87kB read buffer, 16kB write buffer), you can end up eating 10 gigs of memory just for the sockets. It is very likely that in 32-bit, the system encountered memory allocation issues and decided to kill the most hungry user-space process, which "dmesg" should tell you.
comment HAProxy Per server URL rewriting in the backend (reqirep?)
But this is unrelated. Nginx will receive the original unmodified request for the valid host and with its full URL. You must not have your servers bound to their own hostname but to the public hostname.