Re: haproxy bug or by design ? acl path_beg overriding stick-table rate limiting ?

2012-02-18 Thread Baptiste
haproxy logs :) On Sat, Feb 18, 2012 at 11:23 AM, hapr...@serverphorums.com wrote: You mean haproxy logs or backend web server (apache/nginx logs) ? --- posted at http://www.serverphorums.com http://www.serverphorums.com/read.php?10,447870,447964#msg-447964

Re: haproxy bug or by design ? acl path_beg overriding stick-table rate limiting ?

2012-02-18 Thread haproxy
K enabled logging in haproxy but even more confused i think i had a misconfiguration the problem my www_backend had incorrect conn rate limit set as 200bytes acl DATARATE_ABUSER sc2_bytes_out_rate gt 200 instead of acl DATARATE_ABUSER sc2_bytes_out_rate gt 2000 but in either case

Re: haproxy bug or by design ? acl path_beg overriding stick-table rate limiting ?

2012-02-18 Thread Cyril Bonté
Hi, Le 18/02/2012 12:52, hapr...@serverphorums.com a écrit : but in either case once rate was corrected, with or without acl in place, /forums/images/i.png still bypassed stick-tables ? I don't understand. I've played with the configuration you provided (without any defaults section btw),

Re: haproxy bug or by design ? acl path_beg overriding stick-table rate limiting ?

2012-02-18 Thread haproxy
looks like problem was with forward slashes match acl imagepath path_beg /images/ acl imagepathforums path_beg /forums/images/ use_backend imagepath_backend if imagepath or imagepathforums doesn't work acl imagepath path_beg /images acl imagepathforums path_beg /forums/images use_backend

haproxy bug or by design ? acl path_beg overriding stick-table rate limiting ?

2012-02-17 Thread haproxy
Reading up on 2 blog posts regarding DDOS protection via haproxy stick-tables http://blog.serverfault.com/2010/08/26/1016491873/ http://blog.exceliance.fr/2011/08/25/protect-apache-against-apache-killer-script/ Problem i tried testing this on my local test server with haproxy v1.5 dev7. But it

Re: haproxy bug or by design ? acl path_beg overriding stick-table rate limiting ?

2012-02-17 Thread Baptiste
Hi, In both cases, what does the log lines says about the backend used? I thought it could be related to the functions available depending on the network level. I mean that the acl path* are layer 7 functions while the tcp-request content is layer 4 only. When you enable the acl you moved up to