Re: Second failover failure with conntrackd - INVALID packets

[Yoann Juet <yoann.juet@univ-nantes.fr>]

[-- Attachment #1: Type: text/plain, Size: 1409 bytes --]

 > That's another known problem of 0.9.6. Probably, you don't see EINVAL
 > but a message like "N entries can't be committed". I suggest you to
 > upgrade to latest. I'm about to release 0.9.10, using current would 
 >make my life easier to provide you support.

Well, I installed conntrack-tools 0.9.9 and libnetfilter_conntrack 
0.0.99 on the cluster. No more "delayed packet" message or another 
warning or error message. Unfortunately, I get the same result when the 
second failover is triggered. Packets are denied due to INVALID state.

PS: the new configuration subblock "Filter from Kernelspace" in 
conntrackd.conf is not parsed correctly. I get an error message:

"Error parsing config file: line (190), symbol 'from': syntax error"

I have to delete it to make starting conntrackd.

Regards,

Pablo Neira Ayuso wrote:
> Yoann Juet wrote:
>> Hi,
>>
>> I see tons of messages "[warning] delayed packet?", even before the
>> first failover, but nothing related to EINVAL. Does it help ?
> 
> That's another known problem of 0.9.6. Probably, you don't see EINVAL
> but a message like "N entries can't be committed". I suggest you to
> upgrade to latest. I'm about to release 0.9.10, using current would make
> my life easier to provide you support.
> 
>> FYI, the cluster is a KVM guest using hardware virtualization with net
>> virtio.
> 
> Interesting. I have never used it in such environment.
> 


[-- Attachment #2: yoann_juet.vcf --]
[-- Type: text/x-vcard, Size: 375 bytes --]

begin:vcard
fn:Yoann Juet
n:Juet;Yoann
org;quoted-printable:;DSI Universit=C3=A9 de Nantes
adr;quoted-printable:BP92208;;2, rue de la Houssini=C3=A8re;Nantes;;44322;France
email;internet:yoann.juet@univ-nantes.fr
title;quoted-printable:Ing=C3=A9nieur s=C3=A9curit=C3=A9 & r=C3=A9seau
tel;work:02.51.12.53.93
tel;fax:02.51.12.58.60
x-mozilla-html:FALSE
version:2.1
end:vcard