<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>Ah. Thats it! I also see a fix in 4.54, am I right?</div><div><blockquote type="cite"><ul style="font-family: 'Arial CE', Arial, Helvetica, sans-serif; font-size: small; background-color: rgb(255, 255, 255); "><li>"delay = yes" fixed to work even if specified *after* "connect" option.</li><li>Multiple "connect" targets fixed to also work with delayed resolver.</li></ul></blockquote><div><font face="Arial CE, Arial, Helvetica, sans-serif" size="2">--Matt</font></div><div><font face="Arial CE, Arial, Helvetica, sans-serif" size="2"><br></font></div><div><div>On Jan 7, 2013, at 11:39 AM, Michal Trojnara <<a href="mailto:Michal.Trojnara@mirt.net">Michal.Trojnara@mirt.net</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Hi Matt,<br><br>Load balancing is incompatible with delayed resolver. Remove "delay =<br>yes" from your configuration file.<br><br>Mike<br><br>On 2013-01-07 18:38, Matt Wise wrote:<br><blockquote type="cite">I've got dozens of clients connecting with Stunnel to a group of 5 servers. Each system has a config that looks like this:<br><br><blockquote type="cite">cert = /etc/stunnel/zookeeper.pem<br>key = /etc/stunnel/zookeeper.key<br>CAfile = /etc/stunnel/zookeeper_ca.pem<br>verify = 2<br>delay = yes<br>sslVersion = TLSv1<br>client = yes<br>setuid = stunnel4<br>setgid = stunnel4<br>pid = /var/lib/stunnel4/zookeeper.stunnel4.pid<br>socket = l:TCP_NODELAY=1<br>socket = r:TCP_NODELAY=1<br>TIMEOUTconnect = 2<br>session = 86400<br>debug = 5<br>[zookeeper]<br>accept = 127.0.0.1:2182<br>failover = rr<br>connect = prod-zookeeper:2182<br>connect = prod-zookeeper-1:2182<br>connect = prod-zookeeper-2:2182<br>connect = prod-zookeeper-3:2182<br>connect = prod-zookeeper-4:2182<br>connect = prod-zookeeper-5:2182<br></blockquote><br>Essentially the first host is a load balancer, and the next 5 are the actual zookeeper hosts so that we can bypass the ELB if its giving us fits. Now what we're seeing is that almost every connection ends up on prod-zookeeper-5. Over and over and over again, our hosts pick the same system each time. We're running Stunnel 4.52:<br><br><blockquote type="cite">Clients allowed=8000<br>stunnel 4.52 on i486-pc-linux-gnu platform<br>Compiled/running with OpenSSL 0.9.8k 25 Mar 2009<br>Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:POLL,IPv6<br></blockquote><br>Any ideas what might be wrong here? Obviously we want the connections to be *roughly* random across the list of hosts... and if one of the hosts goes down, and the connection fails, we want the stunnel service to try again, and randomly pick a new host. It doesn't really seem to be doing that though. <br><br>--Matt<br><br>_______________________________________________<br>stunnel-users mailing list<br><a href="mailto:stunnel-users@stunnel.org">stunnel-users@stunnel.org</a><br>https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users<br></blockquote><br><br>_______________________________________________<br>stunnel-users mailing list<br><a href="mailto:stunnel-users@stunnel.org">stunnel-users@stunnel.org</a><br>https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users<br></blockquote></div><br></div></body></html>