Back on October 18th, we had a conversation about threading issues. In the message it was said:
The issues is "bad record mac", not "failed in system call". The second error message is a result of the first.
I suspect threading issues. Try running the server in non-threaded mode. If that works, then the SSL locking code should be back-ported from the CVS head (src/main/threads.c)
Alan DeKok.
I was wondering if anything had come of this? Vista is on the way, and I can't stay at version 1.0.4 indefinatly. (I know there have been some major fixes since then) Michael King
King, Michael wrote:
I suspect threading issues. Try running the server in non-threaded mode. If that works, then the SSL locking code should be back-ported from the CVS head (src/main/threads.c)
I was wondering if anything had come of this?
Did anyone run the server in non-threaded mode to see if the SSL errors go away? I can do it, but I don't see SSL errors, so I can't reproduce the problem. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
King, Michael wrote:
I did run the server in single threaded mode, and it appeared to go away.
OK. I don't have good net connectivity right now, or access to a machine to do real development, so this fix didn't make it into 1.1.4. 1.1.4 was released today in part because it's been too long since 1.1.3, and also to ensure that the Vista patches made it into MAC OSX Leopard. :) Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
King, Michael wrote:
-----Original Message----- OK. I don't have good net connectivity right now, or access to a machine to do real development, so this fix didn't make it into 1.1.4.
Would this change be in the CVS head?
Yes. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Just want to report back. I build a server from the January 16th snapshot. It would seem this problem has NOT resurfaced. I will be adding more load to it later today to see if anything happens, but it's been up for about 48 hours now, where as the 1.1.x release trains would exhibit the behavior after about 20 seconds. I've also figured out some more background info. I use a centrally managed AP solution, and when I make a change, such as change a RADIUS server, it forces all the clients to re-auth simultaneously. So the load spikes up to 1000-1500 clients authing simultaneously, and then goes back to my normal 10-20 a second. Would this fix show up in the 1.1.x train, or is it slated for 2.0? And not to be too needy, but when could I hope to see this? (Weeks, months?) Mike
-----Original Message----- From: freeradius-users-bounces+mking=bridgew.edu@lists.freeradius.or g [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freer adius.org] On Behalf Of Alan DeKok Sent: Tuesday, January 09, 2007 8:56 PM To: FreeRadius users mailing list Subject: Re: SSL locking code
King, Michael wrote:
-----Original Message----- OK. I don't have good net connectivity right now, or access to a machine to do real development, so this fix didn't make it into 1.1.4.
Would this change be in the CVS head?
Yes.
Alan DeKok.
King, Michael wrote:
I build a server from the January 16th snapshot.
It would seem this problem has NOT resurfaced. I will be adding more load to it later today to see if anything happens, but it's been up for about 48 hours now, where as the 1.1.x release trains would exhibit the behavior after about 20 seconds.
Ok, that says it's the SSL locking code. <sigh>
I've also figured out some more background info. I use a centrally managed AP solution, and when I make a change, such as change a RADIUS server, it forces all the clients to re-auth simultaneously. So the load spikes up to 1000-1500 clients authing simultaneously, and then goes back to my normal 10-20 a second.
Yeah, that would make a difference.
Would this fix show up in the 1.1.x train, or is it slated for 2.0? And not to be too needy, but when could I hope to see this? (Weeks, months?)
Maybe weeks. I'll see if a patch is easy, and mail it to the list for testing. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
participants (2)
-
Alan DeKok -
King, Michael