why my proxy.node.cache_hit_ratio drops

2014-09-29 Thread Jay Li (jianli)
Hi, guys I configured ATS as full transparent proxy, but I found the proxy.node.cache_hit_ratio dropped when I played the same video from client every time. How can I monitor if the video cached by ATS ? [ats@ats2n ~]$ /home/ats/test/local/trafficserver-5.0.1/bin/traffic_line -r proxy.node.ca

Re: privilege elevation in traffic_server

2014-09-29 Thread James Peach
On Sep 29, 2014, at 5:42 PM, Alan M. Carroll wrote: > Monday, September 29, 2014, 4:21:02 PM, you wrote: > >>> At some point would be it worthwhile to go through the least privilege >>> exercise on traffic_manager too? For example, I assume that >>> traffic_manager would not need DAC overrid

Re: privilege elevation in traffic_server

2014-09-29 Thread Alan M. Carroll
Monday, September 29, 2014, 4:21:02 PM, you wrote: >> At some point would be it worthwhile to go through the least privilege >> exercise on traffic_manager too? For example, I assume that traffic_manager >> would not need DAC override privilege. > I expect that traffic_manager would retain CAP

Re: privilege elevation in traffic_server

2014-09-29 Thread James Peach
On Sep 29, 2014, at 1:21 PM, Susan Hinrichs wrote: > > On 9/29/2014 12:57 PM, James Peach wrote: >> Hi all, >> >> I've been looking at the way Traffic Server elevated privilege, and it's >> quite inconsistent right now, and it doesn't work correctly in all >> configurations. I am working on

Re: privilege elevation in traffic_server

2014-09-29 Thread Susan Hinrichs
On 9/29/2014 12:57 PM, James Peach wrote: Hi all, I've been looking at the way Traffic Server elevated privilege, and it's quite inconsistent right now, and it doesn't work correctly in all configurations. I am working on making this consistent. Here is the behavior I plan to implement:

privilege elevation in traffic_server

2014-09-29 Thread James Peach
Hi all, I've been looking at the way Traffic Server elevated privilege, and it's quite inconsistent right now, and it doesn't work correctly in all configurations. I am working on making this consistent. Here is the behavior I plan to implement: 1. traffic_manager runs with real root creden

Re: The config error of records.config

2014-09-29 Thread Jay Li (jianli)
Hi, guys The issue is fixed when I configure it with non-root user and run it with root user. Jay On 9/29/14, 6:01 PM, "Jay Li (jianli)" wrote: >Hi, guys > >When I rebuilt it with root permission, I found the traffic_server process >was restarted frequently when I enabled tr-full, and the

Re: The config error of records.config

2014-09-29 Thread Jay Li (jianli)
Hi, guys When I rebuilt it with root permission, I found the traffic_server process was restarted frequently when I enabled tr-full, and the output of manager.log was 3250 [Sep 29 07:45:57.772] Manager {0x7fc44cb037e0} NOTE: [Alarms::signalAlarm] Server Process born 3251 [Sep 29 07:45:59.829] M

[GitHub] trafficserver pull request: 5.1.x

2014-09-29 Thread jinxmcg
GitHub user jinxmcg opened a pull request: https://github.com/apache/trafficserver/pull/127 5.1.x The possibility to bind on all IP addreses of a interface having ip-in = ip-out. Now you can do it like that for each IP: CONFIG proxy.config.http.server_ports STRING PORT:ip-i

Re: The config error of records.config

2014-09-29 Thread Jay Li (jianli)
Hi, Ruca I am using CentOS, and I checked with the below output. I think the kernel is supported, right? [root@ats2n trafficserver-5.0.1]# uname -r 2.6.32-220.el6.x86_64 [root@ats2n ~]# grep "TPROXY" /boot/config-2.6.32-220.el6.x86_64 CONFIG_NETFILTER_TPROXY=m CONFIG_NETFILTER_XT_TARGET_TPROXY=

RE: The config error of records.config

2014-09-29 Thread Luca Rea
Hi Jay Li, did you check SELinux?