I have Sphinx installed and have around 40 indexes which connect to external mysql database to pull data. I have cronjobs set up for these indexes and re-index them every 5 minutes. So in other words every 5 minutes my server does 40 connections to an external mysql server.

The problem is that in approximately 10 minutes this stops working and if I ssh to sphinx server and try to connect to mysql database from command line, it returns

ERROR: index '...': sql_connect: Can't connect to MySQL server on '...' (110) (DSN=mysql://...:***@...:3306/...).

If I do the same from my local machine, I can connect so the mysql server itself is perfectly fine. Now if I SSH to the sphinx server and restart iptables, everything starts working again and it can once again connect to external mysql server. I am not very familiar with iptables so if anyone could give me some clues how to debug this or what could be causing this, I'd highly appreciate this!

  • have you compared iptables -vnL output before and after it stops working? Maybe there is some other tool running managing the firewall through iptables? – Petter H Jun 19 '13 at 16:37
  • I tried doing that but can't see anything special in the output of that command. Immediately after the restart, the output of that command is pretty small. After 5-10 minutes of running, it gets much larger but I can't find the IP of the blocked mysql server mentioned anywhere. The IP of the other mysql server, the one that doesn't get blocked, is on the other hand mentioned in ALLOWIN and ALLOWOUT sections. – Eugene Jun 19 '13 at 16:58
  • I am no MySQL expert, but perhaps your MySQL server keeps connections open for a while? And is having the connections open when you apply your rules. And after some time it closes them down to put up new ones which cannot connect because they are being blocked by your iptables rules. Perhaps you allow already connected connections, but not new ones? – espenfjo Jun 19 '13 at 17:14
  • It sounds to me like there is a tool managing your iptables rules. If it is mentioned in ALLOWIN and ALLOWOUT, does iptables -vnL indicate that these rules are actually triggered? is there a rule above which may be dropping your packages? – Petter H Jun 19 '13 at 18:09

Not quite a good answer but that's the only solution that I've managed to find: I ended up adding the IP of that mysql server to csf.allow file which holds the list of IPs that should never be blocked. It seems to be working so far. I've also found the IP of the other mysql server there which explains why it has been working without being blocked.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.