church of default

I mentioned before some of the tcp problems I’ve had with my A10 loadbalancer. Solved the client->a10 aspect of that connection and thought everything was fine. Turns out nope, the a10->server part does the same basic thing. The connection stays open on the server even though the a10 timed it out and has moved on. For webservers you don’t care cuz its just one of a couple hundred apache children counting toward its own timeout, but for mysql it means if you had a long running query it’ll keep running chewing up resources that eventually add up to annoyances if not full blown problems. So now I’m back to “my tcp proxy is fucking up my universe” support-ticket/bug-report land.

Speaking of which, I wound up running into another bug in the NAT code that just starting hanging random one-out-of-some-hundred connections until the box got rebooted. Turns out it was a known bug with a code fix already out, but it took quite the support adventure to get to that knowledge.

You always want to throw a temper tantrum and blame the vendor for this stuff, but since I’m being kinda ghetto and using a loadbalancer as a firewall I have to acknowledge I brought some of this on myself. Plus, even if it were “just” a firewall, I’ve been in a dozen pix/screen scenarios where tcp session/timeout/segment-size ruined my week. Loadbalancer/firewall adventures remind me of a description I once heard about knife fights: even when you win you get cut.

Dell has hit me with this three times in the last two quarters. Combined its added over a month to my project timeline, a month I did not have to spare.

I know I shouldn’t get my hopes up, the whole point of using dell is cheap solid hardware with parts service, but I really think next time I’m in a datacenter-building/server-vendor-shopping place I’m gonna take a much harder look around. The sales engineers were of marginal help, I wound up having to get all my answers from the techcenter wiki and a friend.

But not important enough to answer without making you sit on hold for 23 (and counting) minutes.

Chalk up some fail points for Entrust customer support.

Hahaha wait it gets better at 25 min they just dump you to voicemail. Now the clock is on to see how long till I get a callback.

edit: It gets better! An hour later still no callback, so I call them. I get told the office is now closed, their biz hours are 6am to 8pm. Now, its 6:15 by me (EDT)… so it seems clear to me that Entrust has found the secret island of Atlantis and is headquartered at GMT-3.

edit2: turns out they’re canadian and thursday was a holiday where they left early, voicemail didn’t reflect