rlib's questions

I am trying to restrict maximal number of TCP connections from amazon NLB to a target group. Example of a desired scenario:

We have 2 instances and NLB. The first 100 users with 100 TCP connections are directed to the first instance and are connected for 1 hour. During this hour another 100 users connect to NLB and are directed to the second instance. The user number 201 is not allowed to connect.

I have not found any metric on NLB or autoscaling group which can allow restriction by conenction number. Is it possible with NLB?

From the documentation:

maxconn <number>
Sets the maximum per-process number of concurrent connections to <number>. It
is equivalent to the command-line argument "-n". Proxies will stop accepting
connections when this limit is reached. The "ulimit-n" parameter is
automatically adjusted according to this value. See also "ulimit-n". Note:
the "select" poller cannot reliably use more than 1024 file descriptors on
some platforms. If your platform only supports select and reports "select
FAILED" on startup, you need to reduce maxconn until it works (slightly
below 500 in general).

As I understand, when client tries to connect to the proxy and the proxy has maxconn connections, it will just will not send SYN+ACK package to the client so the client will finally timeout.

I want to make haproxy send RST to the client if maxconn is reached. Is it possible?

I'm using haproxy 1.6.8.

The following information is output on

echo "show sess" | nc -U /var/lib/haproxy/stats 


0x1696d40: proto=tcpv4 src=67.55.94.187:51183 fe=adf be=adfback srv=capped ts=08 age=0s calls=4 rq[f=8400a0h,i=0,an=2000h,rx=,wx=,ax=] rp[f=400000h,i=0,an=60000h,rx=59s,wx=,ax=] s0=[7,8h,fd=186,ex=] s1=[7,108h,fd=209,ex=] exp=59s
0x17d4dd0: proto=tcpv4 src=173.239.36.124:19785 fe=adf be=adfback srv=capped2 ts=08 age=0s calls=4 rq[f=8400a0h,i=0,an=2000h,rx=,wx=,ax=] rp[f=400000h,i=0,an=60000h,rx=59s,wx=,ax=] s0=[7,8h,fd=100,ex=] s1=[7,108h,fd=246,ex=] exp=59s
0x16f7fc0: proto=tcpv4 src=67.55.94.183:54971 fe=adf be=adfback srv=capped ts=08 age=0s calls=4 rq[f=8400a0h,i=0,an=2000h,rx=,wx=,ax=] rp[f=400000h,i=0,an=60000h,rx=59s,wx=,ax=] s0=[7,8h,fd=168,ex=] s1=[7,108h,fd=288,ex=] exp=59s
0x1a8b170: proto=tcpv4 src=67.55.94.182:18194 fe=adf be=adfback srv=capped ts=08 age=0s calls=4 rq[f=8400a0h,i=0,an=2000h,rx=,wx=,ax=] rp[f=400000h,i=0,an=60000h,rx=59s,wx=,ax=] s0=[7,8h,fd=45,ex=] s1=[7,108h,fd=299,ex=] exp=59s

How can I interpret that data? Is there any docs on that?

I want to know how many http transactions occur through a specific connection of Haproxy with a client (frontend).

If I could associate connection (session) id with the frontend's request I would be able to count number of log lines with this id, calculating the rate.

Is it possible to do with Haproxy 1.6?

EDIT

The docs state:

At the moment, logs will not indicate whether requests came from the same session or not. The accept date reported in the logs corresponds to the end of the previous request, and the request time corresponds to the time spent waiting for a new request. The keep-alive request time is still bound to the timeout defined by "timeout http-keep-alive" or "timeout http-request" if not set.

Is it possible to retrieve required data with Lua scripting?

I have to choose between IBM X3650 M4 and HP DL380pG8 servers. Both are 6-cores Xeon e5-2620 with 64 Mb of RAM and the same price. What factors should I consider to make a choice between them? They seems to be the same in performance. What to take?

I have nginx server that sends 404 errors to apache httpd at 1.1.1.1:8081. How can I pass all original headers to the error server?

I have the following config:

server {
   error_page 404 = http://1.1.1.1:8081/404.php?remote=1;
}

When examining headers in 404.php I get client original ip but no cookies from the client; also, I get request uri set to 404.php?remote=1 and not url that caused the 404 error:

<?php
  // 404.php file
  file_put_content("log.txt", $_SERVER['REQUEST_URI'], FILE_APPEND); // :(
  file_put_content("log.txt", $_SERVER['REMOTE_ADDR'], FILE_APPEND); // Ok
  file_put_content("log.txt", $_COOKIE['MyCookie'], FILE_APPEND); // :( empty
?>

To test my MongoDB 3.2 / WiredTiger on CentOS6, I use the script from http://vladmihalcea.com/2013/12/01/mongodb-facts-80000-insertssecond-on-commodity-hardware/. Here I list the script (a little modified):

// Run me as:
// mongo random --eval "var arg1=50000000;arg2=1" create_random.js

var minDate = new Date(2012, 0, 1, 0, 0, 0, 0);
var maxDate = new Date(2013, 0, 1, 0, 0, 0, 0);
var delta = maxDate.getTime() - minDate.getTime();

var job_id = arg2;

var documentNumber = arg1;
var batchNumber = 5 * 2000;

var job_name = 'Job#' + job_id
var start = new Date();
var tsPrev = start;

var batchDocuments = new Array();
var index = 0;

while(index < documentNumber) {
    var date = new Date(minDate.getTime() + Math.random() * delta);
    var value = Math.random();
    var document = {
        created_on : date,
        value : value
    };
    batchDocuments[index % batchNumber] = document;
    if((index + 1) % batchNumber == 0) {
        db.randomData.insert(batchDocuments, {writeConcern:{w:0}, ordered: false});
    }
    index++;

    if(index % 100000 == 0) {
        var tsNow = new Date();
        print(job_name + ' inserted ' + index + ' documents in ' + (tsNow-tsPrev)/1000 + 's; Total time: ' + (tsNow-start)/1000 + 's');
        tsPrev = tsNow;
    }
}
print(job_name + ' inserted ' + documentNumber + ' in ' + (new Date() - start)/1000.0 + 's');

I get on average 11,000 inserts/s independent on number of documents in batch, write concert or ordered flag. The data from mongostats:

insert query update delete getmore command % dirty % used flushes   vsize     res qr|qw ar|aw netIn netOut conn                      time
 15424    *0     *0     *0       0     1|0     0.5   17.6       0    3.2G    2.8G   0|0   0|1  930k    18k   33 2015-12-15T23:32:40+01:00
 12430    *0     *0     *0       0     6|0     0.5   17.6       0    3.2G    2.8G   0|0   0|0  807k    19k   33 2015-12-15T23:32:41+01:00
 14330    *0     *0     *0       0     1|0     0.5   17.6       0    3.2G    2.8G   0|0   0|1  868k    18k   33 2015-12-15T23:32:42+01:00
 15670    *0     *0     *0       0     1|0     0.5   17.6       0    3.2G    2.8G   0|0   0|0  992k    18k   33 2015-12-15T23:32:43+01:00
 10794    *0     *0     *0       0     1|0     0.5   17.6       0    3.2G    2.8G   0|0   0|1  620k    18k   33 2015-12-15T23:32:44+01:00
 15370    *0     *0     *0       0     1|0     0.6   17.7       0    3.2G    2.8G   0|0   0|1  992k    18k   33 2015-12-15T23:32:45+01:00
 13836    *0     *0     *0       0     6|0     0.6   17.7       0    3.2G    2.8G   0|0   0|0  869k    19k   33 2015-12-15T23:32:46+01:00
 13900    *0     *0     *0       0     1|0     0.6   17.7       0    3.2G    2.8G   0|0   0|1  806k    18k   33 2015-12-15T23:32:47+01:00
 15121    *0     *0     *0       0     1|0     0.6   17.7       0    3.2G    2.9G   0|0   0|1  992k    18k   33 2015-12-15T23:32:48+01:00
 11040    *0     *0     *0       0     1|0     0.6   17.7       0    3.2G    2.9G   0|0   0|1  682k    18k   33 2015-12-15T23:32:49+01:00

The data from the script itself:

Job#3 inserted 100000 documents in 7.353s; Total time: 7.353s
Job#3 inserted 200000 documents in 7.261s; Total time: 14.614s
Job#3 inserted 300000 documents in 7.495s; Total time: 22.109s
Job#3 inserted 400000 documents in 8.094s; Total time: 30.203s
Job#3 inserted 500000 documents in 7.39s; Total time: 37.593s
Job#3 inserted 600000 documents in 8.088s; Total time: 45.681s
Job#3 inserted 700000 documents in 7.682s; Total time: 53.363s
Job#3 inserted 800000 documents in 7.728s; Total time: 61.091s

Not even close to 80,000 ins/s.

iostats 10 gives:

Device:            tps    kB_read/s    kB_wrtn/s    kB_read    kB_wrtn
sda               0.40         0.00         2.40          0         24
sdb              34.70         0.00      1801.20          0      18012

avg-cpu:  %user   %nice %system %iowait  %steal   %idle
           3.72    0.00    0.58    0.03    0.00   95.67

Device:            tps    kB_read/s    kB_wrtn/s    kB_read    kB_wrtn
sda              26.10         0.40      5464.40          4      54644
sdb              32.50         0.00      1889.60          0      18896

I have 32Gb RAM, Intel(R) Xeon(R) CPU E5-2620 0 @ 2.00GHz and SSD 1T IBM ServeRAID M5110e (scsi).

What can be the reason for such low performance relative to the blog's results? Where can I find more benchmarks on MongoDB to have a reference point?

Amazon Web Services, Server version: Apache/2.4.6 (Red Hat Enterprise Linux)

The apache log reports:

[Fri Aug 07 13:53:40.793562 2015] [:error] [pid 10730] [client 149.88.114.40:40800] PHP Warning:  file_put_contents(./test.txt): failed to open stream: Permission denied in /var/www/html/vraim/index.php on line 18

Here is PHP code which tries to write to the current directory:

<?php
file_put_contents("./test.txt", "Test"); // <=== This cannot write!!!
$uid = posix_getuid();
echo "PosixGetUID: " . $uid . "<br/>";
$userinfo = posix_getpwuid($uid);
print_r($userinfo);
?>

The permissions on the directory:

# namei -movl /var/www/html/vraim/
f: /var/www/html/vraim/
dr-xr-xr-x root   root /
drwxr-xr-x root   root var
drwxr-xr-x root   root www
drwxr-xr-x apache root html
drwxrwxrwx apache root vraim

The httpd.conf for the virtual host:

DocumentRoot /var/www/html/vraim
<Directory />
   Require all granted
</Directory>

What do I do wrong? Why PHP cannot write to the folder which is in ownership of Apache?

PHP script itself outputs the following info about its effective user id:

PosixGetUID: 48
Array ( [name] => apache [passwd] => x [uid] => 48 [gid] => 48 [gecos] => Apache [dir] => /usr/share/httpd [shell] => /sbin/nologin )

I have a server X (45.55.245.182) which is connected to server Y by VPN. VPN interface on X is tap0 with ip 10.200.0.2; VPN interface on Y is tap0 with ip 10.200.0.1. I run netcat on server Y to listen to UDP 35000:

nc -lu 10.200.0.1 35000

On server X the packets of port 35000 are DNAT'ed with the following rule of iptables:

iptables -t nat -A PREROUTING -p udp --dport 35000 -j DNAT --to-destination 10.200.0.1

Running tcpdump on server Y on its tap0 interface shows the packets come as expected:

11:54:44.000610 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 10.200.0.1 tell 10.200.0.2, length 28
11:54:44.000638 ARP, Ethernet (len 6), IPv4 (len 4), Reply 10.200.0.1 is-at fa:0f:00:1a:57:59 (oui Unknown), length 28
11:54:44.154702 IP (tos 0x8, ttl 47, id 52840, offset 0, flags [DF], proto UDP (17), length 34)
    hotnet-213-57-17-185.hotnet.net.il.24740 > 10.200.0.1.35000: [udp sum ok] UDP, length 6

See the diagram showing setup:

However, I cannot see that listening netcat on the server Y get the data (nothing echoes on the screen of Y when I press enter on the client).

What can be a problem?

On server 1.1.1.1:

iptables -t nat -A PREROUTING -p tcp --dport 20000 -j DNAT --to-destination: 2.2.2.2:20000

iptables -t nat -A PREROUTING -p tcp --dport 20000 -j LOG --log-prefix pre20k

iptables -t nat -A POSTROUTING -p tcp --dport 20000 -j LOG --log-prefix post20k

On server 2.2.2.2:

iptables -t nat -A PREROUTING -p tcp --dport 20000 -j LOG --log-prefix pre20k

On client 3.3.3.3:

nc 1.1.1.1 20000

I can see in the logs of 1.1.1.1 that postrouting packages do have SIP=3.3.3.3 and DIP=2.2.2.2 (and not 1.1.1.1 as in original prerouting package).

However, none of the packages delivered from 1.1.1.1 arrive at 2.2.2.2. I cannot see them neither in iptables log nor in tcpdump.

Why?

Is it possible to set up Linux Virtual Server on VPN?

The real servers should lie on the same LAN segment. I want the real server to be a non-LAN server connected to the Internet. Could it be possible? I thought to put Linux director and real server on VPN.