Re: Lots of ActiveConn very few InActConn

["G. Allen Morris III" <gam3-lvs-users@xxxxxxxx>]

On Sat, Dec 02, 2006 at 11:44:55PM -0500, G. Allen Morris III wrote:
> I have LVS set up on a fedora core 5 box and it shows lots of
> ActiveConn (like 2000) and very few InActConn (like 1) and then only for
> a second or so.  This is very differenet from what I am used to seeing.
> The ActiveConn number does go down, but very slowly.
> 
> The ActiveConn number has nothing to do with the number of connects, I
> looked at the servers.  I am running under limited load right now and I
> am afraid that this will break under more load.
> 
> Has anyone seen anything like this, or have any hints on what it might
> be?

I solved my problem.  iptables was set up with the following:

#firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 161 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT

I don't know why this was causing the problem though. 

Allen Morris