Encoderer's questions

The service I run, cronitor.io, has a telemetry collection API that sees bursts of traffic around 1000rps. (overall baseline is much lower, call it 100rps)

Most of our requests come from things like curl and the most popular HTTP libraries in each language (Requests, Guzzle, etc). These clients do not maintain an SSL session the way a browser would. This results in a lot of SSL handshakes for comparatively small http requests.

I would love any tips on optimizing nginx for this use case. We upstream requests to uwsgi. Relevant portion from current nginx.conf:

worker_processes auto;

events {
    worker_connections 1024;
}

sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
client_max_body_size 20M;
gzip on;

This was essentially cloned from our app servers. I've done some research and I have some ideas on things to try (disabling server tokens, for example) but I would love any advice.

I run a SaaS monitoring service. Our standard integration example is to make a curl request to a special URL we provide. We have an intermittent issue where a user is hitting a 10 second curl timeout (-m 10 param). However, I can see in my server logs that the requests being processed around that time were only taking 100-300ms which is about normal for us.

We do see spikes in traffic at the top of every minute, but even then we seldom take longer than 1000ms.

We have had a single user in particular who seems susceptible to timeouts. I've asked him to set our IP in his hosts file to ensure this is not a DNS issue. (Though i feel very confident it's not DNS).

I'd love any ideas on minimally invasive ways I could ask this user to help me troubleshoot. Before we dumped the amazon ELB timeouts were more common (though still very rare) and I was able to reproduce it a couple times and I saw very strange "timed out at 0ms" errors as if the connection was somehow rejected immediately despite a 10 second timeout.

There is nothing exotic in our iptables config, just blocking ports and bad ips. The webserver stack is nginx-uwsgi

I spent some time today auditing my iptables script. I'm a software engineer, not an Ops guru, but I've tried to pick up the basics of iptables. I noticed something that must have been broken for a long time:

# Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT -i lo -d 127.0.0.0/8 -j REJECT

Ok, so, that looks like it should be:

-A INPUT -i ! lo -d 127.0.0.0/8 -j REJECT

Right?

Trouble is, the server is running live traffic. While this looks like a harmless change, I treat iptables with a proper amount of deference. Also, it means that i've been accepting traffic from /8 that comes from other interfaces. What does that mean in real world terms? How would the machine receive any requests from 127/8 on a different interface?

I've got a MediaTemple DV server. I've been seeing a lot of QOS alerts for "numothersock" which is defined as:

The number of sockets other than TCP ones. Local (UNIX-domain) sockets are used for communications inside the system. UDP sockets are used, for example, for Domain Name Service (DNS) queries. UDP and other sockets may also be used in some very specialized applications (SNMP agents and others).

How can I determine what application/daemon/etc is creating these sockets? The limit is 300 and we're hitting that several times a day recently.

Thanks in advance.

I've got a couple local repositories that I can successfully access using Apache WebDav.

This apache is also a production webserver and I've got directory listings disabled globally.

Here's the Location config:

<Location /svn>
   DAV svn
   SVNParentPath /var/local/svn
   SSLRequireSSL
   AuthType Basic
   AuthName "Dining Deals Network SVN"
   AuthUserFile /var/local/users/svn.passwd
   Require valid-user
</Location>

We have 2 repo's in /var/local/svn. Right now, you have to navigate to them directly. If you just go to https://www.ourdomain.com/svn you get a

(403) Forbidden

You don't have permission to access /svn/ on this server.

I've tried adding a (and i've also tried a just for kicks) with an Options Indexes but it didn't accomplish anything.

Any help would be appreciated.