Fwd: Error: Ignoring duplicate packet from client
Hi Thank you in advance for your help I'm using freeradius-3.0.13-15 with ldap like DB. I've 2 servers listening to 1812 and 1813, 3 BNG like NAS for AAA. The problem is that setting the AAA in this BNG, start this messages and the server doesn't respond: Wed Jul 7 15:57:17 2021 : WARNING: (363) WARNING: Module rlm_ldap became unblocked Wed Jul 7 15:57:17 2021 : Error: 7 requests have been waiting in the processing queue for 36 seconds. Check that all databases are running properly! Wed Jul 7 15:57:17 2021 : Error: (951) Ignoring duplicate packet from client SMMAIJR01 port 61631 - ID: 247 due to unfinished request in component <core> module <queue> Wed Jul 7 15:57:18 2021 : Error: Unresponsive child for request 759, in component authorize module ldap Wed Jul 7 15:57:19 2021 : Error: (958) Ignoring duplicate packet from client SMMAIJR01 port 57003 - ID: 178 due to unfinished request in component <core> module <queue> Wed Jul 7 15:57:19 2021 : Error: (947) Ignoring duplicate packet from client ZPCOMRM20 port 59223 - ID: 14 due to unfinished request in component <core> module <queue> Wed Jul 7 15:57:20 2021 : Error: (964) Ignoring duplicate packet from client SMMAIJR01 port 59320 - ID: 229 due to unfinished request in component <core> module <queue> Wed Jul 7 15:57:20 2021 : Error: (966) Ignoring duplicate packet from client ZPCOMRM20 port 38093 - ID: 15 due to unfinished request in component <core> module <queue> Wed Jul 7 15:57:20 2021 : Error: (967) Ignoring duplicate packet from client SMDRUJR01 port 52605 - ID: 160 due to unfinished request in component <core> module <queue> Wed Jul 7 15:57:20 2021 : Error: (968) Ignoring duplicate packet from client SMDRUJR01 port 62396 - ID: 244 due to unfinished request in component <core> module <queue> Wed Jul 7 15:57:20 2021 : Error: (971) Ignoring duplicate packet from client SMDRUJR01 port 56405 - ID: 186 due to unfinished request in component <core> module <queue> Wed Jul 7 15:57:21 2021 : Error: (972) Ignoring duplicate packet from client SMMAIJR01 port 54919 - ID: 124 due to unfinished request in component <core> module <queue> Wed Jul 7 15:57:22 2021 : Error: (982) Ignoring duplicate packet from client SMMAIJR01 port 54919 - ID: 245 due to unfinished request in component <core> module <queue> Wed Jul 7 15:57:22 2021 : Error: (984) Ignoring duplicate packet from client SMMAIJR01 port 64021 - ID: 246 due to unfinished request in component <core> module <queue> Wed Jul 7 15:57:23 2021 : Error: (966) Ignoring duplicate packet from client ZPCOMRM20 port 38093 - ID: 15 due to unfinished request in component <core> module <queue> Wed Jul 7 15:57:23 2021 : Error: (986) Ignoring duplicate packet from client SMMAIJR01 port 60240 - ID: 227 due to unfinished request in component <core> module <queue> Wed Jul 7 15:57:23 2021 : Error: (989) Ignoring duplicate packet from client SMDRUJR01 port 56405 - ID: 82 due to unfinished request in component <core> module <queue> Wed Jul 7 15:57:24 2021 : Error: (990) Ignoring duplicate packet from client SMMAIJR01 port 54919 - ID: 251 due to unfinished request in component <core> module <queue> Wed Jul 7 15:57:24 2021 : Error: (994) Ignoring duplicate packet from client ZPCOMRM20 port 34429 - ID: 16 due to unfinished request in component <core> module <queue> Wed Jul 7 15:57:25 2021 : Error: (1004) Ignoring duplicate packet from client SMDRUJR01 port 52605 - ID: 92 due to unfinished request in component <core> module <queue> Wed Jul 7 15:57:25 2021 : Error: (1005) Ignoring duplicate packet from client SMDRUJR01 port 52605 - ID: 222 due to unfinished request in component <core> module <queue> Wed Jul 7 15:57:42 2021 : WARNING: (370) WARNING: Module rlm_ldap became unblocked Wed Jul 7 15:57:42 2021 : Error: 9 requests have been waiting in the processing queue for 37 seconds. Check that all databases are running properly! Wed Jul 7 15:57:42 2021 : WARNING: (371) WARNING: Module rlm_ldap became unblocked Wed Jul 7 15:57:42 2021 : Error: (1131) Ignoring duplicate packet from client SMMAIJR01 port 60240 - ID: 129 due to unfinished request in component <core> module <queue> Wed Jul 7 15:57:43 2021 : Error: Unresponsive child for request 896, in component authorize module ldap Wed Jul 7 15:57:44 2021 : Error: Unresponsive child for request 898, in component authorize module ldap Wed Jul 7 15:57:44 2021 : Error: (1145) Ignoring duplicate packet from client ZPCOMRM20 port 41190 - ID: 19 due to unfinished request in component <core> module <queue> I don't know the problem, but the cpu of the ldap process grows up 80-90% and the BNGs inform timeout or unrecheable. What could be the reason for this? Thanks & regards *NC*
On Jul 7, 2021, at 4:21 PM, Nicolás Ciuffolotti via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
Hi Thank you in advance for your help I'm using freeradius-3.0.13-15
You should really upgrade. 3.0.13 is many years out of date.
with ldap like DB.
LDAP "like"? Or actual LDAP? Which LDAP server are you using?
I've 2 servers listening to 1812 and 1813, 3 BNG like NAS for AAA. The problem is that setting the AAA in this BNG, start this messages and the server doesn't respond:
Wed Jul 7 15:57:17 2021 : WARNING: (363) WARNING: Module rlm_ldap became unblocked
There is no reason for the LDAP server to not respond to FreeRADIUS. If the LDAP server is down, then FreeRADIUS can't do anything. Fix your LDAP server so that it replies to FreeRADIUS. Nothing else will fix the problem.
Wed Jul 7 15:57:17 2021 : Error: 7 requests have been waiting in the processing queue for 36 seconds. Check that all databases are running properly! Wed Jul 7 15:57:17 2021 : Error: (951) Ignoring duplicate packet from client SMMAIJR01 port 61631 - ID: 247 due to unfinished request in component <core> module <queue>
That message is a side effect of the main problem: the LDAP server is down.
I don't know the problem, but the cpu of the ldap process grows up 80-90% and the BNGs inform timeout or unrecheable. What could be the reason for this?
The LDAP server is down. Fix that. And upgrade to a version released in the past 4 years. Alan DeKok.
Alan Thanks for the reply. Sorry about my English, I'm still learning. I have a Red Hat Enterprise Linux Server release 7.9 server and I have package freeradius-3.0.13-15.el7.x86_64 already installed and latest version installed for rhel-7-server-rpms repository I have installed openldap-2.4.44-23.el7_9.x86_64 as well. The LDAP server is active at all times, but when the FR starts receiving connections from NAS, the cpu process grows up and those errors start to be written to the radius log. On Wed, Jul 7, 2021 at 7:00 PM Alan DeKok <aland@deployingradius.com> wrote:
On Jul 7, 2021, at 4:21 PM, Nicolás Ciuffolotti via Freeradius-Users < freeradius-users@lists.freeradius.org> wrote:
Hi Thank you in advance for your help I'm using freeradius-3.0.13-15
You should really upgrade. 3.0.13 is many years out of date.
with ldap like DB.
LDAP "like"? Or actual LDAP? Which LDAP server are you using?
I've 2 servers listening to 1812 and 1813, 3 BNG like NAS for AAA. The problem is that setting the AAA in this BNG, start this messages and the server doesn't respond:
Wed Jul 7 15:57:17 2021 : WARNING: (363) WARNING: Module rlm_ldap became unblocked
There is no reason for the LDAP server to not respond to FreeRADIUS. If the LDAP server is down, then FreeRADIUS can't do anything.
Fix your LDAP server so that it replies to FreeRADIUS. Nothing else will fix the problem.
Wed Jul 7 15:57:17 2021 : Error: 7 requests have been waiting in the processing queue for 36 seconds. Check that all databases are running properly! Wed Jul 7 15:57:17 2021 : Error: (951) Ignoring duplicate packet from client SMMAIJR01 port 61631 - ID: 247 due to unfinished request in component <core> module <queue>
That message is a side effect of the main problem: the LDAP server is down.
I don't know the problem, but the cpu of the ldap process grows up 80-90% and the BNGs inform timeout or unrecheable. What could be the reason for this?
The LDAP server is down. Fix that.
And upgrade to a version released in the past 4 years.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jul 7, 2021, at 8:23 PM, Nicolás Ciuffolotti via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
Sorry about my English, I'm still learning.
Your English is fine.
I have a Red Hat Enterprise Linux Server release 7.9 server and I have package freeradius-3.0.13-15.el7.x86_64 already installed and latest version installed for rhel-7-server-rpms repository I have installed openldap-2.4.44-23.el7_9.x86_64 as well. The LDAP server is active at all times, but when the FR starts receiving connections from NAS, the cpu process grows up and those errors start to be written to the radius log.
Yes, I understood that from your first message. You don't need to repeat it. The "Module rlm_ldap became unblocked" message comes out because of the following: * FreeRADIUS receives a packet * FreeRADIUS queries LDAP * nothing happens for 5 seconds * LDAP eventually returns an answer to FreeRADIUS The solution is simple: Fix LDAP so that it doesn't take 5 seconds to respond to FreeRADIUS. There is NOTHING you can do to FreeRADIUS to fix the LDAP server. And there is no reason for FreeRADIUS to use 80-90% CPU. The default configuration is fast, and can handle 20K packets/s at 50% CPU load. So the question is: What changes did you make in the default configuration? WHY is it using 80-90% CPU? We can't explain why it's using 80% CPU, because (a) the default configuration doesn't do that, and (b) you haven't described what changes you made. i.e. You should know what you've changed, and your shouldn't make changes which use 80% CPU. Alan DeKok.
Alan, again, thank you very much for the responses. Trying to be clearer, the cpu processes that grow are on the slapd service, but only when the errors start "Error: (382) Ignoring duplicate packet from client" prior to this, with only 2 NAS sending request does not happen, in the more I add one more Juniper NAS, these errors start. About of configuration on FR, I changed minimus of default PID USER PR NI VIRT RES SHR S *%CPU* %MEM TIME+ COMMAND 1660 ldap 20 0 1618712 156540 2956 S *674.5* 1.0 162:54.30 *slapd* 534 root 20 0 125084 65852 65536 S 5.9 0.4 0:33.31 systemd-journal 16851 radiusd 20 0 2608468 27604 4384 S 2.0 0.2 0:05.99 radiusd LDAP works perfectly, but adding NAS to it, these errors start Thu Jul 8 12:13:31 2021 : Info: rlm_ldap (ldap): Opening additional connection (380), 1 of 12 pending slots used Thu Jul 8 12:13:33 2021 : Info: rlm_ldap (ldap): Closing connection (353): Hit idle_timeout, was idle for 22 seconds Thu Jul 8 12:13:33 2021 : Info: rlm_ldap (ldap): Closing connection (373): Hit idle_timeout, was idle for 22 seconds Thu Jul 8 12:13:34 2021 : Info: rlm_ldap (ldap): Closing connection (374): Hit idle_timeout, was idle for 21 seconds Thu Jul 8 12:13:34 2021 : Info: Need 14 more connections to reach 29 spares Thu Jul 8 12:13:34 2021 : Info: rlm_ldap (ldap): Opening additional connection (381), 1 of 14 pending slots used Thu Jul 8 12:13:35 2021 : Info: Need 13 more connections to reach 29 spares Thu Jul 8 12:13:35 2021 : Info: rlm_ldap (ldap): Opening additional connection (382), 1 of 13 pending slots used Thu Jul 8 12:13:36 2021 : Info: Need 10 more connections to reach 29 spares Thu Jul 8 12:13:36 2021 : Info: rlm_ldap (ldap): Opening additional connection (383), 1 of 12 pending slots used Thu Jul 8 12:13:38 2021 : Info: Need 11 more connections to reach 29 spares Thu Jul 8 12:13:38 2021 : Info: rlm_ldap (ldap): Opening additional connection (384), 1 of 11 pending slots used Thu Jul 8 12:13:38 2021 : Info: Need 10 more connections to reach 29 spares Thu Jul 8 12:13:38 2021 : Info: rlm_ldap (ldap): Opening additional connection (385), 2 of 11 pending slots used Thu Jul 8 12:13:39 2021 : Info: Need 9 more connections to reach 29 spares Thu Jul 8 12:13:39 2021 : Info: rlm_ldap (ldap): Opening additional connection (386), 1 of 9 pending slots used Thu Jul 8 12:13:39 2021 : Error: (605) Ignoring duplicate packet from client SMDRUJR01 port 56405 - ID: 169 due to unfinished request in component authorize module ldap Thu Jul 8 12:13:40 2021 : Error: (606) Ignoring duplicate packet from client SMDRUJR01 port 58429 - ID: 29 due to unfinished request in component authorize module ldap Thu Jul 8 12:13:40 2021 : Info: Need 8 more connections to reach 29 spares Thu Jul 8 12:13:40 2021 : Info: rlm_ldap (ldap): Opening additional connection (387), 1 of 8 pending slots used Thu Jul 8 12:13:41 2021 : Info: Need 5 more connections to reach 29 spares Thu Jul 8 12:13:41 2021 : Info: rlm_ldap (ldap): Opening additional connection (388), 1 of 7 pending slots used Thu Jul 8 12:13:42 2021 : Info: Need 3 more connections to reach 29 spares Thu Jul 8 12:13:42 2021 : Info: rlm_ldap (ldap): Opening additional connection (389), 1 of 6 pending slots used Thu Jul 8 12:13:44 2021 : Info: Need 2 more connections to reach 29 spares Thu Jul 8 12:13:44 2021 : Info: rlm_ldap (ldap): Opening additional connection (390), 1 of 5 pending slots used Thu Jul 8 12:13:46 2021 : Info: Need 2 more connections to reach 29 spares Thu Jul 8 12:13:46 2021 : Info: rlm_ldap (ldap): Opening additional connection (391), 1 of 4 pending slots used Thu Jul 8 12:13:57 2021 : Info: rlm_ldap (ldap): Closing connection (361): Hit idle_timeout, was idle for 23 seconds Thu Jul 8 12:13:57 2021 : Info: rlm_ldap (ldap): Closing connection (322): Hit idle_timeout, was idle for 23 seconds Thu Jul 8 12:13:57 2021 : Info: rlm_ldap (ldap): Closing connection (318): Hit idle_timeout, was idle for 22 seconds Thu Jul 8 12:13:57 2021 : Info: rlm_ldap (ldap): Closing connection (356): Hit idle_timeout, was idle for 22 seconds Thu Jul 8 12:11:51 2021 : Error: (374) Ignoring duplicate packet from client ZPCOMRM21 port 33899 - ID: 200 due to unfinished request in component authorize module ldap Thu Jul 8 12:11:53 2021 : Error: Unresponsive child for request 367, in component authorize module ldap Thu Jul 8 12:11:54 2021 : Error: Unresponsive child for request 368, in component authorize module ldap Thu Jul 8 12:11:54 2021 : Error: (374) Ignoring duplicate packet from client ZPCOMRM21 port 33899 - ID: 200 due to unfinished request in component authorize module ldap Thu Jul 8 12:11:54 2021 : Error: Unresponsive child for request 369, in component authorize module ldap Thu Jul 8 12:11:55 2021 : Error: (375) Ignoring duplicate packet from client ZPCOMRM21 port 34052 - ID: 201 due to unfinished request in component authorize module ldap Thu Jul 8 12:11:56 2021 : Error: Unresponsive child for request 370, in component authorize module ldap Thu Jul 8 12:11:58 2021 : Error: (375) Ignoring duplicate packet from client ZPCOMRM21 port 34052 - ID: 201 due to unfinished request in component authorize module ldap Thu Jul 8 12:11:59 2021 : Error: (376) Ignoring duplicate packet from client ZPCOMRM21 port 48955 - ID: 202 due to unfinished request in component authorize module ldap Thu Jul 8 12:12:02 2021 : Error: (376) Ignoring duplicate packet from client ZPCOMRM21 port 48955 - ID: 202 due to unfinished request in component authorize module ldap Thu Jul 8 12:12:06 2021 : Error: (377) Ignoring duplicate packet from client ZPCOMRM21 port 38356 - ID: 203 due to unfinished request in component authorize module ldap Thu Jul 8 12:12:07 2021 : WARNING: (346) WARNING: Module rlm_ldap became unblocked Thu Jul 8 12:12:09 2021 : Error: (377) Ignoring duplicate packet from client ZPCOMRM21 port 38356 - ID: 203 due to unfinished request in component authorize module ldap Thu Jul 8 12:12:10 2021 : WARNING: (345) WARNING: Module rlm_ldap became unblocked Thu Jul 8 12:12:10 2021 : Error: (378) Ignoring duplicate packet from client ZPCOMRM21 port 47111 - ID: 204 due to unfinished request in component authorize module ldap Thu Jul 8 12:12:11 2021 : Error: Unresponsive child for request 372, in component authorize module ldap Thu Jul 8 12:12:13 2021 : Error: (378) Ignoring duplicate packet from client ZPCOMRM21 port 47111 - ID: 204 due to unfinished request in component authorize module ldap Thu Jul 8 12:12:15 2021 : Info: rlm_ldap (ldap): Closing connection (321): Hit idle_timeout, was idle for 25 seconds Thu Jul 8 12:12:15 2021 : WARNING: (347) WARNING: Module rlm_ldap became unblocked Thu Jul 8 12:12:17 2021 : Error: (379) Ignoring duplicate packet from client ZPCOMRM21 port 48758 - ID: 205 due to unfinished request in component authorize module ldap Thu Jul 8 12:12:18 2021 : Error: Unresponsive child for request 373, in component authorize module ldap Thu Jul 8 12:12:20 2021 : Error: (379) Ignoring duplicate packet from client ZPCOMRM21 port 48758 - ID: 205 due to unfinished request in component authorize module ldap Thu Jul 8 12:12:20 2021 : Error: (380) Ignoring duplicate packet from client ZPCOMRM21 port 59594 - ID: 206 due to unfinished request in component authorize module ldap Thu Jul 8 12:12:22 2021 : Info: rlm_ldap (ldap): Opening additional connection (322), 1 of 1 pending slots used Thu Jul 8 12:12:23 2021 : Error: (380) Ignoring duplicate packet from client ZPCOMRM21 port 59594 - ID: 206 due to unfinished request in component authorize module ldap Thu Jul 8 12:12:24 2021 : Error: (381) Ignoring duplicate packet from client SMDRUJR01 port 58429 - ID: 219 due to unfinished request in component <core> module <queue> Thu Jul 8 12:12:25 2021 : WARNING: (348) WARNING: Module rlm_ldap became unblocked Thu Jul 8 12:12:25 2021 : Error: (382) Ignoring duplicate packet from client SMDRUJR01 port 56405 - ID: 52 due to unfinished request in component <core> module <queue> Thu Jul 8 12:12:25 2021 : Error: (383) Ignoring duplicate packet from client SMDRUJR01 port 58429 - ID: 202 due to unfinished request in component <core> module <queue> Thu Jul 8 12:12:25 2021 : Error: (384) Ignoring duplicate packet from client SMDRUJR01 port 56405 - ID: 55 due to unfinished request in component <core> module <queue> Thu Jul 8 12:12:26 2021 : Error: Unresponsive child for request 374, in component authorize module ldap Thu Jul 8 12:12:30 2021 : Error: Unresponsive child for request 375, in component authorize module ldap Thu Jul 8 12:12:30 2021 : Error: (385) Ignoring duplicate packet from client ZPCOMRM21 port 41561 - ID: 207 due to unfinished request in component <core> module <queue> Thu Jul 8 12:12:33 2021 : Error: (385) Ignoring duplicate packet from client ZPCOMRM21 port 41561 - ID: 207 due to unfinished request in component <core> module <queue> Thu Jul 8 12:12:34 2021 : Error: Unresponsive child for request 376, in component authorize module ldap Thu Jul 8 12:12:38 2021 : Error: (386) Ignoring duplicate packet from client SMDRUJR01 port 52605 - ID: 99 due to unfinished request in component <core> module <queue> Thu Jul 8 12:12:39 2021 : Error: (387) Ignoring duplicate packet from client SMDRUJR01 port 56405 - ID: 127 due to unfinished request in component <core> module <queue> Thu Jul 8 12:12:41 2021 : Error: Unresponsive child for request 377, in component authorize module ldap I can see that multiple connections are established from FR to LDAP pto 389 tcp6 1 0 :::389 :::* LISTEN tcp6 0 0 :::22 :::* LISTEN tcp6 0 0 ::1:25 :::* LISTEN tcp6 0 0 ::1:389 ::1:59342 ESTABLISHED tcp6 0 0 ::1:389 ::1:59324 ESTABLISHED tcp6 0 0 ::1:59366 ::1:389 ESTABLISHED tcp6 0 0 ::1:59382 ::1:389 ESTABLISHED tcp6 0 0 ::1:389 ::1:59336 ESTABLISHED tcp6 0 0 ::1:59352 ::1:389 ESTABLISHED tcp6 0 0 ::1:389 ::1:59338 ESTABLISHED tcp6 0 0 ::1:389 ::1:59346 ESTABLISHED tcp6 0 0 ::1:389 ::1:59374 ESTABLISHED tcp6 0 0 ::1:59356 ::1:389 ESTABLISHED tcp6 0 0 ::1:389 ::1:59350 ESTABLISHED tcp6 0 0 ::1:389 ::1:59358 ESTABLISHED tcp6 0 0 ::1:389 ::1:59370 ESTABLISHED tcp6 0 0 ::1:389 ::1:59328 ESTABLISHED tcp6 0 0 ::1:59354 ::1:389 ESTABLISHED tcp6 14 0 ::1:59320 ::1:389 ESTABLISHED tcp6 14 0 ::1:59334 ::1:389 ESTABLISHED tcp6 14 0 ::1:59326 ::1:389 ESTABLISHED tcp6 0 0 ::1:389 ::1:59326 ESTABLISHED tcp6 14 0 ::1:59328 ::1:389 ESTABLISHED tcp6 0 0 ::1:59380 ::1:389 ESTABLISHED tcp6 0 0 ::1:59364 ::1:389 ESTABLISHED tcp6 0 0 ::1:389 ::1:59332 ESTABLISHED tcp6 54 0 ::1:389 ::1:59382 ESTABLISHED tcp6 0 0 ::1:389 ::1:59322 ESTABLISHED tcp6 14 0 ::1:59330 ::1:389 ESTABLISHED tcp6 14 0 ::1:59340 ::1:389 ESTABLISHED tcp6 0 0 ::1:389 ::1:59356 ESTABLISHED tcp6 0 0 ::1:389 ::1:59330 ESTABLISHED tcp6 0 0 ::1:59368 ::1:389 ESTABLISHED tcp6 0 0 ::1:389 ::1:59360 ESTABLISHED tcp6 0 0 ::1:59378 ::1:389 ESTABLISHED tcp6 0 0 ::1:389 ::1:59320 ESTABLISHED tcp6 0 0 ::1:389 ::1:59340 ESTABLISHED tcp6 14 0 ::1:59350 ::1:389 ESTABLISHED tcp6 0 0 ::1:59370 ::1:389 ESTABLISHED tcp6 0 0 ::1:59362 ::1:389 ESTABLISHED tcp6 14 0 ::1:59324 ::1:389 ESTABLISHED tcp6 14 0 ::1:59336 ::1:389 ESTABLISHED tcp6 0 0 ::1:389 ::1:59354 ESTABLISHED tcp6 14 0 ::1:59338 ::1:389 ESTABLISHED tcp6 0 0 ::1:59358 ::1:389 ESTABLISHED tcp6 0 0 ::1:389 ::1:59348 ESTABLISHED tcp6 0 0 ::1:59342 ::1:389 ESTABLISHED tcp6 0 0 ::1:59376 ::1:389 ESTABLISHED tcp6 0 0 ::1:389 ::1:59344 ESTABLISHED tcp6 14 0 ::1:59332 ::1:389 ESTABLISHED tcp6 0 0 ::1:389 ::1:59366 ESTABLISHED tcp6 14 0 ::1:59348 ::1:389 ESTABLISHED tcp6 0 0 ::1:389 ::1:59372 ESTABLISHED tcp6 14 0 ::1:59344 ::1:389 ESTABLISHED tcp6 14 0 ::1:59322 ::1:389 ESTABLISHED tcp6 0 0 ::1:389 ::1:59378 ESTABLISHED tcp6 0 0 ::1:389 ::1:59368 ESTABLISHED tcp6 0 0 ::1:59374 ::1:389 ESTABLISHED tcp6 0 0 ::1:389 ::1:59376 ESTABLISHED tcp6 0 0 ::1:59372 ::1:389 ESTABLISHED tcp6 0 0 ::1:389 ::1:59362 ESTABLISHED tcp6 0 0 ::1:389 ::1:59334 ESTABLISHED tcp6 0 0 ::1:389 ::1:59364 ESTABLISHED tcp6 14 0 ::1:59346 ::1:389 ESTABLISHED tcp6 0 0 ::1:59360 ::1:389 ESTABLISHED tcp6 0 0 ::1:389 ::1:59380 ESTABLISHED tcp6 0 0 ::1:389 ::1:59352 ESTABLISHED On Thu, Jul 8, 2021 at 10:07 AM Alan DeKok <aland@deployingradius.com> wrote:
On Jul 7, 2021, at 8:23 PM, Nicolás Ciuffolotti via Freeradius-Users < freeradius-users@lists.freeradius.org> wrote:
Sorry about my English, I'm still learning.
Your English is fine.
I have a Red Hat Enterprise Linux Server release 7.9 server and I have package freeradius-3.0.13-15.el7.x86_64 already installed and latest version installed for rhel-7-server-rpms repository I have installed openldap-2.4.44-23.el7_9.x86_64 as well. The LDAP server is active at all times, but when the FR starts receiving connections from NAS, the cpu process grows up and those errors start to be written to the radius log.
Yes, I understood that from your first message. You don't need to repeat it.
The "Module rlm_ldap became unblocked" message comes out because of the following:
* FreeRADIUS receives a packet * FreeRADIUS queries LDAP * nothing happens for 5 seconds * LDAP eventually returns an answer to FreeRADIUS
The solution is simple: Fix LDAP so that it doesn't take 5 seconds to respond to FreeRADIUS.
There is NOTHING you can do to FreeRADIUS to fix the LDAP server.
And there is no reason for FreeRADIUS to use 80-90% CPU. The default configuration is fast, and can handle 20K packets/s at 50% CPU load.
So the question is: What changes did you make in the default configuration? WHY is it using 80-90% CPU?
We can't explain why it's using 80% CPU, because (a) the default configuration doesn't do that, and (b) you haven't described what changes you made.
i.e. You should know what you've changed, and your shouldn't make changes which use 80% CPU.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jul 8, 2021, at 11:41 AM, Nicolás Ciuffolotti via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
Alan, again, thank you very much for the responses.
Trying to be clearer, the cpu processes that grow are on the slapd service,
Then fix the slapd service. This is not a FreeRADIUS issue.
but only when the errors start "Error: (382) Ignoring duplicate packet from client" prior to this,
Again, this is a side effect. That message is coming because the LDAP server has ALREADY STOPPED RESPONDING TO FREERADIUS. I really don't know how to explain this in any other way.
with only 2 NAS sending request does not happen, in the more I add one more Juniper NAS, these errors start.
How many packets/s is it receiving? Tens? Millions? You're so stuck on reading the debug messages and the high CPU load, that you are doing NOTHING to understand the root cause of the issue. If the NAS is sending FreeRADIUS 100K packets/s, then of course there's an issue. It likely can't keep up with the load. Or, if you've configured FreeRADIUS to do 100K LDAP queries per packet, then of course there's an issue.
About of configuration on FR, I changed minimus of default
<sigh> I didn't ask how much you changed. I asked WHAT you changed. If you're not going to give useful answers to my questions, then I will probably just stop trying to help you. WHAT did you change? The rest of the information you posted is not helpful. You've already posted the log messages with errors. You're wasting your time by posting them again. We already know that FreeRADIUS is talking to LDAP. So posting "there are multiple connections established" is similarly useless. You need to find the CAUSE of the problem. This involves tracking down what's going on, and understanding the system you built. Stop looking at CPU loads. Stop looking at FreeRADIUS debug output. Stop looking at connections between FreeRADIUS and the LDAP server. All of that is useless and irrelevant. Instead, look ELSEWHERE for the problem. You've looked at the current information many times, and gotten nowhere. This should be a strong hint that the information you're looking at isn't useful. Start with the default configuration. It works. Make ONE change. Test it. If it works, save a copy of the configuration. Repeat with more changes. At some point, the system may go crazy. THAT change is the one which is the problem. Alan DeKok.
participants (2)
-
Alan DeKok -
Nicolás Ciuffolotti