Re: soft lockup with conntrackd / keepalived / VLAN

[Adam Gundy <arg@cyberscience.com>]

Adam Gundy wrote:
> I've built a pair of router boxes which are using keepalived and 
> conntrackd to provide a redundant router setup. we're also using a 
> single 802.1Q VLAN on the box.
> 
> occasionally, the box will lockup for 5 minutes, during which time 
> routed traffic is extremely delayed (2 or 3 second ping times). 
> initially, there were no log messages about the lockup. we switched from 
> using an internal nvidia (forcedeth) NIC in the belief that it may have 
> been causing the problem.. however: with the new gigabit NICs, we still 
> see the hangs, but we also get this in the kernel log:

> PS: this is a Ubuntu Lucid kernel - 2.6.32. I'm working on a stock 
> kernel to see if it still happens..

the issue appears to be IPSEC. pings across an IPSEC tunnel get slower and 
slower until the 'five minute fit', then ALL pings (IPSEC or not), plus the 
machine itself are extremely slow or non-responsive.

this behavior is also visible with a stock 2.6.32.15 kernel, but not 
reproducible with 2.6.33.5.

it looks like there were some IPSEC locking changes between those two kernels, 
but I couldn't find any obvious bug reports with similar symptoms..