I've been seeing some unexplained failures to authenticate 802.1X clients when my system is under heavier load, and I suspect that I don't have enough threads running.  For reference, I currently have four servers in a load balanced group with identical configs.  Thread settings are these:

 

        max_servers = 32

        min_spare_servers = 3

        max_spare_servers = 10

        max_requests_per_server = 0

 

We have about 14,500 wireless clients at peak times, though that number will climb, I'm sure.

 

Is there a rule of thumb that will tell me how many threads I should have (max_servers)?  Also, I suspect that there have been authentication failures due to all threads on a server being busy.  Is there a good way to confirm that?  I've poked around in the radiusd logs a bit, but haven't found much, other than the odd "Login failed" with no reason given.  (For "normal" failures, there are two messages, one of which has a cause like "bad password" or "account locked out" or some such thing.)

 

Advice is welcome.

 

--J