Lots of ActiveConn very few InActConn

[Nielsen, Steve]

What exactly then was done to solve the issue?

-----Original Message-----
From: lvs-users-bounces at LinuxVirtualServer.org
[mailto:lvs-users-bounces at LinuxVirtualServer.org] On Behalf Of G. Allen
Morris III
Sent: Wednesday, December 06, 2006 9:57 AM
To: LinuxVirtualServer.org users mailing list.
Subject: Re: Lots of ActiveConn very few InActConn

On Sat, Dec 02, 2006 at 11:44:55PM -0500, G. Allen Morris III wrote:
> I have LVS set up on a fedora core 5 box and it shows lots of
> ActiveConn (like 2000) and very few InActConn (like 1) and then only
for
> a second or so.  This is very differenet from what I am used to
seeing.
> The ActiveConn number does go down, but very slowly.
> 
> The ActiveConn number has nothing to do with the number of connects, I
> looked at the servers.  I am running under limited load right now and
I
> am afraid that this will break under more load.
> 
> Has anyone seen anything like this, or have any hints on what it might
> be?

I solved my problem.  iptables was set up with the following:

#firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 161 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j
ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j
ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j
ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT

I don't know why this was causing the problem though. 

Allen Morris


_______________________________________________
LinuxVirtualServer.org mailing list - lvs-users at LinuxVirtualServer.org
Send requests to lvs-users-request at LinuxVirtualServer.org
or go to http://www.in-addr.de/mailman/listinfo/lvs-users