You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@guacamole.apache.org by Nick Couchman <vn...@apache.org> on 2025/07/28 09:54:48 UTC
Re: [EXT] SSH Connection Limit of 60 per guacd
On Mon, Jul 28, 2025 at 04:21 Alex_Yin <sk...@163.com> wrote:
> Hello Julian,
> Thank you for your suggestion. My problem is indeed very similar to the
> link you provided. I also found this bug link
> https://issues.apache.org/jira/browse/GUACAMOLE-1998. It seems that it
> has not been solved yet. I found two solutions from these two links:
> 1. Use version 1.5.3;
> 2. Build guacd image based on Debian 12.
> I think I can try to roll back to version 1.5.3 first.
>
What version of guacd are you running when you encounter this?
Part of the challenge with the issue linked above is that we've been unable
to reproduce the issue reliably - I've got a very similar environnent
(guacd 1.5.5 on CentOS 7), and it's been running for several weeks with
hundreds of connections having been made with it and I've not seen this
issue. There must be some other factor contributing to producing this
behavior, we just haven't figured that out, yet.
-Nick
>
Re: [EXT] SSH Connection Limit of 60 per guacd
Posted by Nick Couchman <vn...@apache.org>.
On Tue, Jul 29, 2025 at 3:24 AM Tobias Feller | OPC <tf...@opc.de> wrote:
> Hi,
>
> i did one more test on another machine (also debian 12) but with native
> installed guacd.
>
> No problem to connect concurrent to more than 70 hosts.
>
> Than i fire up a guacamole in docker with the :latest official images on
> the same host.
>
> And i have the same effect on this host (16GB mem and 4core, instead of
> 6GB and 2Core) after 60 connections. I can't connect to any more hosts.
> Instead of the problem described in
>
> https://www.mail-archive.com/user@guacamole.apache.org/msg12565.html
>
> after i close one active connection and the guacd-process for this is
> gone, the not working connection is able to connect. This leads me to the
> assumption that the problem is due to a limit of Docker or the Alpine base
> image. Or I'm wrong?
>
So, if I understand what you're saying correctly, you're hitting a limit of
60 *concurrent* connections - that is, a single guacd instance running in
Docker cannot open more than 60 connections at the same time?
Some of the previous issues we saw (but that have been fixed) were not with
concurrent connections, but with accumulated connections - that is, you
could open and close a connection 60 times, and the 61st try would fail,
even if no other connections were active.
Just want to clarify the scope of the problem, here. I'm trying to get some
infrastructure set up for running some test environments for various
Guacamole issues, and I'll have to see if I can reproduce this and get 60
concurrent connections open.
-Nick
>
Re: [EXT] SSH Connection Limit of 60 per guacd
Posted by Tobias Feller | OPC <tf...@opc.de>.
Hi,
i did one more test on another machine (also debian 12) but with native
installed guacd.
No problem to connect concurrent to more than 70 hosts.
Than i fire up a guacamole in docker with the :latest official images on
the same host.
And i have the same effect on this host (16GB mem and 4core, instead of
6GB and 2Core) after 60 connections. I can't connect to any more hosts.
Instead of the problem described in
https://www.mail-archive.com/user@guacamole.apache.org/msg12565.html
after i close one active connection and the guacd-process for this is
gone, the not working connection is able to connect. This leads me to
the assumption that the problem is due to a limit of Docker or the
Alpine base image. Or I'm wrong?
Should i try to build the docker image against other alpine versions?
here are some infos about the native-install vs docker version running
Native Install/Host:
6.1.0-37-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.140-1 (2025-05-22)
x86_64 GNU/Linux
ii freerdp2-dev 2.10.0+dfsg1-1 amd64 Free Remote Desktop
Protocol library (development files)
ii libfreerdp-client2-2:amd64 2.10.0+dfsg1-1 amd64 Free
Remote Desktop Protocol library (client library)
ii libfreerdp-server2-2:amd64 2.10.0+dfsg1-1 amd64 Free
Remote Desktop Protocol library (server library)
ii libfreerdp-shadow-subsystem2-2:amd64 2.10.0+dfsg1-1 amd64
FreeRDP Remote Desktop Protocol shadow subsystem libraries
ii libfreerdp-shadow2-2:amd64 2.10.0+dfsg1-1 amd64
FreeRDP Remote Desktop Protocol shadow libraries
ii libfreerdp2-2:amd64 2.10.0+dfsg1-1 amd64 Free
Remote Desktop Protocol library (core library)
ii libssl-dev:amd64 3.0.16-1~deb12u1 amd64 Secure Sockets Layer
toolkit - development files
ii libssl-doc 3.0.16-1~deb12u1 all Secure Sockets Layer
toolkit - development documentation
ii libssl1.0.2:amd64 1.0.2u-1~deb9u7 amd64 Secure Sockets Layer
toolkit - shared libraries
ii libssl1.1:amd64 1.1.1w-0+deb11u2 amd64 Secure Sockets Layer
toolkit - shared libraries
ii libssl3:amd64 3.0.16-1~deb12u1 amd64 Secure Sockets Layer
toolkit - shared libraries
In the docker environment, with a startet rdp-session i see this via
"lsof -p 332043" (spawned guacd)
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
guacd 332043 cwd DIR 0,45 4096 1725749 /
guacd 332043 rtd DIR 0,45 4096 1725749 /
guacd 332043 txt REG 0,45 49384 1709877
/opt/guacamole/sbin/guacd
guacd 332043 mem REG 8,1 1709877
/opt/guacamole/sbin/guacd (stat: No such file or directory)
guacd 332043 mem REG 8,1 1709712
/opt/guacamole/lib/freerdp2/librdpgfx-client.so (stat: No such file or
directory)
guacd 332043 mem REG 8,1 1709672
/opt/guacamole/lib/freerdp2/libdisp-client.so (stat: No such file or
directory)
guacd 332043 mem REG 8,1 1709678
/opt/guacamole/lib/freerdp2/libguac-common-svc-client.so (stat: No such
file or directory)
guacd 332043 mem REG 8,1 1709809
/opt/guacamole/lib/libssh2.so.1.0.1 (stat: No such file or directory)
guacd 332043 mem REG 8,1 1709738
/opt/guacamole/lib/*libfreerdp2.so.2.11.7* (stat: No such file or directory)
guacd 332043 mem REG 8,1 1709733
/opt/guacamole/lib/*libfreerdp-client2.so.2.11.7* (stat: No such file or
directory)
guacd 332043 mem REG 8,1 1709848
/opt/guacamole/lib/libwinpr2.so.2.11.7 (stat: No such file or directory)
guacd 332043 mem REG 8,1 1709755
/opt/guacamole/lib/libguac-client-rdp.so.0.0.0 (stat: No such file or
directory)
guacd 332043 mem REG 8,1 1717165
/usr/lib/libmd.so.0.0.5 (stat: No such file or directory)
guacd 332043 mem REG 8,1 1716768
/usr/lib/libbsd.so.0.11.7 (stat: No such file or directory)
guacd 332043 mem REG 8,1 1716762
/usr/lib/libbrotlicommon.so.1.0.9 (stat: No such file or directory)
guacd 332043 mem REG 8,1 1716732
/usr/lib/libXdmcp.so.6.0.0 (stat: No such file or directory)
guacd 332043 mem REG 8,1 1716730
/usr/lib/libXau.so.6.0.0 (stat: No such file or directory)
guacd 332043 mem REG 8,1 1716764
/usr/lib/libbrotlidec.so.1.0.9 (stat: No such file or directory)
guacd 332043 mem REG 8,1 1716770
/usr/lib/libbz2.so.1.0.8 (stat: No such file or directory)
guacd 332043 mem REG 8,1 1716785
/usr/lib/libexpat.so.1.10.1 (stat: No such file or directory)
guacd 332043 mem REG 8,1 1717366
/usr/lib/libsharpyuv.so.0.0.1 (stat: No such file or directory)
guacd 332043 mem REG 8,1 1717321
/usr/lib/libpixman-1.so.0.42.2 (stat: No such file or directory)
guacd 332043 mem REG 8,1 1717716
/usr/lib/libxcb-shm.so.0.0.0 (stat: No such file or directory)
guacd 332043 mem REG 8,1 1717693
/usr/lib/libxcb-render.so.0.0.0 (stat: No such file or directory)
guacd 332043 mem REG 8,1 1717768
/usr/lib/libxcb.so.1.1.0 (stat: No such file or directory)
guacd 332043 mem REG 8,1 1716738
/usr/lib/libXrender.so.1.3.0 (stat: No such file or directory)
guacd 332043 mem REG 8,1 1716734
/usr/lib/libXext.so.6.4.0 (stat: No such file or directory)
guacd 332043 mem REG 8,1 1716728
/usr/lib/libX11.so.6.4.0 (stat: No such file or directory)
guacd 332043 mem REG 8,1 1716793
/usr/lib/libfreetype.so.6.19.0 (stat: No such file or directory)
guacd 332043 mem REG 8,1 1716789
/usr/lib/libfontconfig.so.1.12.0 (stat: No such file or directory)
guacd 332043 mem REG 8,1 1705933
/lib/libz.so.1.2.13 (stat: No such file or directory)
guacd 332043 mem REG 8,1 1717599
/usr/lib/libwebp.so.7.1.8 (stat: No such file or directory)
guacd 332043 mem REG 8,1 1715161
/lib/libuuid.so.1.3.0 (stat: No such file or directory)
guacd 332043 mem REG 8,1 1715043
/lib/libcrypto.so.1.1 (stat: No such file or directory)
guacd 332043 mem REG 8,1 1717336
/usr/lib/libpng16.so.16.44.0 (stat: No such file or directory)
guacd 332043 mem REG 8,1 1717125
/usr/lib/libjpeg.so.8.2.2 (stat: No such file or directory)
guacd 332043 mem REG 8,1 1716774
/usr/lib/libcairo.so.2.11708.0 (stat: No such file or directory)
guacd 332043 mem REG 8,1 1715145
/lib/*libssl.so.1.1* (stat: No such file or directory)
guacd 332043 mem REG 8,1 1709805
/opt/guacamole/lib/libguac.so.25.0.0 (stat: No such file or directory)
guacd 332043 mem REG 8,1 1705918
/lib/ld-musl-x86_64.so.1 (stat: No such file or directory)
guacd 332043 0u CHR 1,3 0t0 5 /dev/null
guacd 332043 1w FIFO 0,13 0t0 7995649 pipe
guacd 332043 2w FIFO 0,13 0t0 7995650 pipe
guacd 332043 3u sock 0,8 0t0 7996605 protocol: UNIX
guacd 332043 4u sock 0,8 0t0 7996606 protocol: TCP
guacd 332043 5u sock 0,8 0t0 8085998 protocol: TCP
guacd 332043 6u a_inode 0,14 0 1048 [eventfd:22]
guacd 332043 7u sock 0,8 0t0 8087212 protocol: UNIX
guacd 332043 8u sock 0,8 0t0 8087215 protocol: UNIX-STREAM
guacd 332043 9u a_inode 0,14 0 1048 [eventfd:23]
guacd 332043 10u a_inode 0,14 0 1048 [eventfd:24]
guacd 332043 11u a_inode 0,14 0 1048 [eventfd:25]
guacd 332043 12u a_inode 0,14 0 1048 [eventfd:26]
guacd 332043 13u a_inode 0,14 0 1048 [eventfd:27]
guacd 332043 14u a_inode 0,14 0 1048 [eventfd:28]
guacd 332043 15u a_inode 0,14 0 1048 [eventfd:29]
guacd 332043 16u a_inode 0,14 0 1048 [eventfd:30]
guacd 332043 17u a_inode 0,14 0 1048 [eventfd:31]
guacd 332043 18u a_inode 0,14 0 1048 [eventfd:32]
guacd 332043 19u a_inode 0,14 0 1048 [eventfd:33]
guacd 332043 20u a_inode 0,14 0 1048 [eventfd:34]
guacd 332043 21u a_inode 0,14 0 1048 [eventfd:35]
guacd 332043 22u a_inode 0,14 0 1048 [eventfd:36]
guacd 332043 23u a_inode 0,14 0 1048 [eventfd:37]
guacd 332043 24u a_inode 0,14 0 1048 [eventfd:38]
guacd 332043 25u a_inode 0,14 0 1048 [eventfd:39]
guacd 332043 26u a_inode 0,14 0 1048 [eventfd:40]
guacd 332043 27u a_inode 0,14 0 1048 [eventfd:41]
guacd 332043 28u a_inode 0,14 0 1048 [eventfd:44]
guacd 332043 29u a_inode 0,14 0 1048 [eventfd:45]
guacd 332043 30u a_inode 0,14 0 1048 [eventfd:46]
guacd 332043 31u sock 0,8 0t0 8087836 protocol: TCP
guacd 332043 32u a_inode 0,14 0 1048 [eventfd:47]
guacd 332043 33u a_inode 0,14 0 1048 [eventfd:48]
guacd 332043 34u a_inode 0,14 0 1048 [eventfd:49]
On the native Install
guacd 332434 guacd mem REG 8,1 688160 2108404
/usr/lib/x86_64-linux-gnu/libssl.so.3
...
guacd 332434 guacd mem REG 8,1 732352 2097194
/usr/lib/x86_64-linux-gnu/libfreerdp-client2.so.2.10.0
guacd 332434 guacd mem REG 8,1 1530200 2097190
/usr/lib/x86_64-linux-gnu/libfreerdp2.so.2.10.0
...
guacd 332434 guacd mem REG 8,1 83504 2097933
/usr/lib/x86_64-linux-gnu/freerdp2/libguac-common-svc-client.so
in general many more libs loaded.
Maybe this helps to get to the right direction with this problem.
Tobias
Am 28.07.2025 um 18:48 schrieb Tobias Feller | OPC:
>
> Hi Sean,
>
> i all ready send Nick some infos...
>
> I think it is not a general problem with the system resources. because
> on different servers we always hit the 60+ limit. Maybe a combination
> of docker, debian 12 as host and some generic limits (i don't know) in
> default system config.
>
> Here was my test with 60+1 opened rdp-sessions (chrome browser
> windows) on a smaller test-machine (docker, gucad 1.6) that is running
> on a Debian 12 host - no remote usage at all. but as you see the
> spawned guacd-processes are there 1 per each active session + 1 for
> the guacd-demon.
>
> After 60+1 i can't connect any more...
>
> guacd | guacd[67639]: DEBUG: guac_rdp_fs_close: Closed "\" (file_id=0)
> *guacd | guacd[67639]: DEBUG: SSL_CTX_new failed
> guacd | guacd[67639]: DEBUG:
> transport_connect_tls:freerdp_set_last_error_ex
> ERRCONNECT_CONNECT_CANCELLED [0x0002000B]*
> guacd | guacd[67639]: DEBUG: SVC "rdpdr" disconnected.
>
> and also seen this..
>
> guacd | guacd[67838]: DEBUG: guac_rdp_fs_close: Closed "\" (file_id=0)
> *guacd | guacd[67838]: DEBUG: BIO_should_retry returned a system
> error 32: Broken pipe
> guacd | guacd[67838]: DEBUG:
> transport_write:freerdp_set_last_error_ex
> ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D]
> guacd | guacd[67838]: DEBUG: BIO_should_retry returned a system
> error 32: Broken pipe
> guacd | guacd[67838]: DEBUG:
> transport_write:freerdp_set_last_error_ex
> ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D]*
> guacd | guacd[67838]: DEBUG: freerdp_post_connect failed
>
> Hi
>
> best regards,
>
> Tobias
>
> Am 28.07.2025 um 18:27 schrieb Sean Hulbert:
>>
>>
>> On 7/28/2025 3:22 AM, Tobias Feller | OPC wrote:
>>
>>> Hi Nick, Hi Alex,
>>>
>>> @Nick
>>>
>>> /"I've got a very similar environnent (guacd 1.5.5 on CentOS 7), and
>>> it's been running for several weeks with hundreds of connections
>>> having been made with it and I've not seen this issue."/
>>>
>>> The Problem was for me only on *concurrent connections*. I'm running
>>> also the 1.5.5 (docker) on our two guacamole (Loadbalanced) Hosts
>>> since some month without problems. but with this 2 hosts we don't
>>> hit the 60 concurrent connection limit at the moment.
>>>
>>> Maybe i can try to do a test on another standby host that is using
>>> 1.6 and connect via some servers to 60 hosts at the same time.
>>>
>>> Tobias
>>>
>>> Am 28.07.2025 um 12:07 schrieb Alex_Yin:
>>>> I am running guacd 1.5.5 on Centos 7.9 vm
>>>>
>>>> ---- Replied Message ----
>>>> From Nick Couchman<vn...@apache.org> <ma...@apache.org>
>>>> Date 07/28/2025 17:54
>>>> To user<us...@guacamole.apache.org> <ma...@guacamole.apache.org>
>>>> Subject Re: [EXT] SSH Connection Limit of 60 per guacd
>>>>
>>>>
>>>> On Mon, Jul 28, 2025 at 04:21 Alex_Yin <sk...@163.com> wrote:
>>>>
>>>> Hello Julian,
>>>> Thank you for your suggestion. My problem is indeed very
>>>> similar to the link you provided. I also found this bug link
>>>> https://issues.apache.org/jira/browse/GUACAMOLE-1998. It seems
>>>> that it has not been solved yet. I found two solutions from
>>>> these two links:
>>>> 1. Use version 1.5.3;
>>>> 2. Build guacd image based on Debian 12.
>>>> I think I can try to roll back to version 1.5.3 first.
>>>>
>>>>
>>>> What version of guacd are you running when you encounter this?
>>>>
>>>> Part of the challenge with the issue linked above is that we've
>>>> been unable to reproduce the issue reliably - I've got a very
>>>> similar environnent (guacd 1.5.5 on CentOS 7), and it's been
>>>> running for several weeks with hundreds of connections having been
>>>> made with it and I've not seen this issue. There must be some other
>>>> factor contributing to producing this behavior, we just haven't
>>>> figured that out, yet.
>>>>
>>>> -Nick
Re: [EXT] SSH Connection Limit of 60 per guacd
Posted by Tobias Feller | OPC <tf...@opc.de>.
Hi Sean,
i all ready send Nick some infos...
I think it is not a general problem with the system resources. because
on different servers we always hit the 60+ limit. Maybe a combination of
docker, debian 12 as host and some generic limits (i don't know) in
default system config.
Here was my test with 60+1 opened rdp-sessions (chrome browser windows)
on a smaller test-machine (docker, gucad 1.6) that is running on a
Debian 12 host - no remote usage at all. but as you see the spawned
guacd-processes are there 1 per each active session + 1 for the
guacd-demon.
After 60+1 i can't connect any more...
guacd | guacd[67639]: DEBUG: guac_rdp_fs_close: Closed "\" (file_id=0)
*guacd | guacd[67639]: DEBUG: SSL_CTX_new failed
guacd | guacd[67639]: DEBUG:
transport_connect_tls:freerdp_set_last_error_ex
ERRCONNECT_CONNECT_CANCELLED [0x0002000B]*
guacd | guacd[67639]: DEBUG: SVC "rdpdr" disconnected.
and also seen this..
guacd | guacd[67838]: DEBUG: guac_rdp_fs_close: Closed "\" (file_id=0)
*guacd | guacd[67838]: DEBUG: BIO_should_retry returned a system
error 32: Broken pipe
guacd | guacd[67838]: DEBUG: transport_write:freerdp_set_last_error_ex
ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D]
guacd | guacd[67838]: DEBUG: BIO_should_retry returned a system error
32: Broken pipe
guacd | guacd[67838]: DEBUG: transport_write:freerdp_set_last_error_ex
ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D]*
guacd | guacd[67838]: DEBUG: freerdp_post_connect failed
best regards,
Tobias
Am 28.07.2025 um 18:27 schrieb Sean Hulbert:
>
> Hope this helps, this is how we get past the limitation of concurrent
> connection users (CCU)
>
>
> *1. CPU*
>
> * *Minimum*: 8 vCPUs
> * *Optimal*: 16-32 vCPUs depending on the intensity of user sessions
> and the types of remote connections (e.g., RDP, VNC, SSH).
> o Guacamole's backend services (Tomcat) and the guacd daemon
> benefit from higher CPU cores for concurrent session management.
>
> *2. RAM*
>
> * *Minimum*: 16 GB
> * *Optimal*: 32-64 GB
> o Allocate memory based on the average session count and types
> of connections (e.g., RDP requires more RAM per session
> compared to SSH).
>
> *3. Storage*
>
> * *Disk Space*: Depends on log retention, drive sharing, and session
> recording needs.
> o *Base Installation*: ~10 GB
> o Allocate additional space for:
> + Logs: 100 GB+ if extensive logging is enabled.
> + File sharing: Depends on user needs.
> * Use SSDs for better performance.
>
> *4. Network*
>
> * *Bandwidth*: At least 1 Gbps is required for smooth operation; 10
> Gbps is ideal for high-volume environments.
> o Each session consumes about *50–150 kbps*, depending on the
> resolution and activity level.
> * Configure network settings for optimal performance:
> o Ensure low latency for remote connections.
> o Use load balancing if needed.
>
> *5. Guacamole Configuration*
>
> * *guacd Instances*: Each guacd instance can handle ~100–200
> simultaneous sessions.
> o Deploy multiple guacd instances using Docker or separate
> servers for scaling.
> o Use a load balancer (e.g., NGINX, HAProxy) to distribute
> traffic among guacd instances.
>
> *6. Tomcat (Guacamole Web Application) Tuning*
>
> * *Heap Size*: Set the Java heap size for Tomcat:
>
> -Xms8g -Xmx16g
>
> This provides 8–16 GB of memory for the web application.
>
> * *Thread Configuration*: Increase the number of threads in the
> Tomcat connector configuration in server.xml:
>
> <Connector port="8080" protocol="HTTP/1.1"
>
> maxThreads="500"
>
> minSpareThreads="100"
>
> connectionTimeout="20000"
>
> URIEncoding="UTF-8"/>
>
> *7. Database*
>
> * Guacamole stores user information and connection details in a
> database (e.g., MySQL, PostgreSQL).
> o Ensure proper indexing for large user bases.
> o Use *read replicas* for load distribution if querying becomes
> heavy.
>
> *8. Scalability*
>
> * Use a *clustered architecture*:
> o Multiple application servers for the Guacamole frontend.
> o Multiple guacd servers distributed via a load balancer.
> o Centralized database with high availability.
>
> *9. Monitoring*
>
> Implement monitoring tools to ensure resource utilization and
> performance stability:
>
> * *CPU and RAM*: Monitor usage and scale horizontally/vertically as
> needed.
> * *Session Metrics*: Monitor active session counts and peak usage times.
> * *Logs*: Centralized logging (e.g., ELK stack) for analyzing errors
> and trends.
>
> *Example Deployment for 10,000 Users:*
>
> * *Frontend Servers*: 4 (each with 8 vCPUs, 16–32 GB RAM).
> * *guacd Servers*: 5–10 instances (each with 8 vCPUs, 16 GB RAM).
> * *Database*: 1 primary + 1 replica (8 vCPUs, 32 GB RAM).
>
>
> *Thank You*
> Sean Hulbert
>
> On 7/28/2025 3:22 AM, Tobias Feller | OPC wrote:
>
>> Hi Nick, Hi Alex,
>>
>> @Nick
>>
>> /"I've got a very similar environnent (guacd 1.5.5 on CentOS 7), and
>> it's been running for several weeks with hundreds of connections
>> having been made with it and I've not seen this issue."/
>>
>> The Problem was for me only on *concurrent connections*. I'm running
>> also the 1.5.5 (docker) on our two guacamole (Loadbalanced) Hosts
>> since some month without problems. but with this 2 hosts we don't hit
>> the 60 concurrent connection limit at the moment.
>>
>> Maybe i can try to do a test on another standby host that is using
>> 1.6 and connect via some servers to 60 hosts at the same time.
>>
>> Tobias
>>
>> Am 28.07.2025 um 12:07 schrieb Alex_Yin:
>>> I am running guacd 1.5.5 on Centos 7.9 vm
>>>
>>> ---- Replied Message ----
>>> From Nick Couchman<vn...@apache.org> <ma...@apache.org>
>>> Date 07/28/2025 17:54
>>> To user<us...@guacamole.apache.org> <ma...@guacamole.apache.org>
>>> Subject Re: [EXT] SSH Connection Limit of 60 per guacd
>>>
>>>
>>> On Mon, Jul 28, 2025 at 04:21 Alex_Yin <sk...@163.com> wrote:
>>>
>>> Hello Julian,
>>> Thank you for your suggestion. My problem is indeed very similar
>>> to the link you provided. I also found this bug link
>>> https://issues.apache.org/jira/browse/GUACAMOLE-1998. It seems
>>> that it has not been solved yet. I found two solutions from
>>> these two links:
>>> 1. Use version 1.5.3;
>>> 2. Build guacd image based on Debian 12.
>>> I think I can try to roll back to version 1.5.3 first.
>>>
>>>
>>> What version of guacd are you running when you encounter this?
>>>
>>> Part of the challenge with the issue linked above is that we've been
>>> unable to reproduce the issue reliably - I've got a very similar
>>> environnent (guacd 1.5.5 on CentOS 7), and it's been running for
>>> several weeks with hundreds of connections having been made with it
>>> and I've not seen this issue. There must be some other factor
>>> contributing to producing this behavior, we just haven't figured
>>> that out, yet.
>>>
>>> -Nick
Re: [EXT] SSH Connection Limit of 60 per guacd
Posted by Sean Hulbert <sh...@securitycentric.net.INVALID>.
Hope this helps, this is how we get past the limitation of concurrent
connection users (CCU)
*1. CPU*
* *Minimum*: 8 vCPUs
* *Optimal*: 16-32 vCPUs depending on the intensity of user sessions
and the types of remote connections (e.g., RDP, VNC, SSH).
o Guacamole's backend services (Tomcat) and the guacd daemon
benefit from higher CPU cores for concurrent session management.
*2. RAM*
* *Minimum*: 16 GB
* *Optimal*: 32-64 GB
o Allocate memory based on the average session count and types of
connections (e.g., RDP requires more RAM per session compared to
SSH).
*3. Storage*
* *Disk Space*: Depends on log retention, drive sharing, and session
recording needs.
o *Base Installation*: ~10 GB
o Allocate additional space for:
+ Logs: 100 GB+ if extensive logging is enabled.
+ File sharing: Depends on user needs.
* Use SSDs for better performance.
*4. Network*
* *Bandwidth*: At least 1 Gbps is required for smooth operation; 10
Gbps is ideal for high-volume environments.
o Each session consumes about *50–150 kbps*, depending on the
resolution and activity level.
* Configure network settings for optimal performance:
o Ensure low latency for remote connections.
o Use load balancing if needed.
*5. Guacamole Configuration*
* *guacd Instances*: Each guacd instance can handle ~100–200
simultaneous sessions.
o Deploy multiple guacd instances using Docker or separate servers
for scaling.
o Use a load balancer (e.g., NGINX, HAProxy) to distribute traffic
among guacd instances.
*6. Tomcat (Guacamole Web Application) Tuning*
* *Heap Size*: Set the Java heap size for Tomcat:
-Xms8g -Xmx16g
This provides 8–16 GB of memory for the web application.
* *Thread Configuration*: Increase the number of threads in the Tomcat
connector configuration in server.xml:
<Connector port="8080" protocol="HTTP/1.1"
maxThreads="500"
minSpareThreads="100"
connectionTimeout="20000"
URIEncoding="UTF-8"/>
*7. Database*
* Guacamole stores user information and connection details in a
database (e.g., MySQL, PostgreSQL).
o Ensure proper indexing for large user bases.
o Use *read replicas* for load distribution if querying becomes heavy.
*8. Scalability*
* Use a *clustered architecture*:
o Multiple application servers for the Guacamole frontend.
o Multiple guacd servers distributed via a load balancer.
o Centralized database with high availability.
*9. Monitoring*
Implement monitoring tools to ensure resource utilization and
performance stability:
* *CPU and RAM*: Monitor usage and scale horizontally/vertically as
needed.
* *Session Metrics*: Monitor active session counts and peak usage times.
* *Logs*: Centralized logging (e.g., ELK stack) for analyzing errors
and trends.
*Example Deployment for 10,000 Users:*
* *Frontend Servers*: 4 (each with 8 vCPUs, 16–32 GB RAM).
* *guacd Servers*: 5–10 instances (each with 8 vCPUs, 16 GB RAM).
* *Database*: 1 primary + 1 replica (8 vCPUs, 32 GB RAM).
*Thank You*
Sean Hulbert
On 7/28/2025 3:22 AM, Tobias Feller | OPC wrote:
> Hi Nick, Hi Alex,
>
> @Nick
>
> /"I've got a very similar environnent (guacd 1.5.5 on CentOS 7), and
> it's been running for several weeks with hundreds of connections
> having been made with it and I've not seen this issue."/
>
> The Problem was for me only on *concurrent connections*. I'm running
> also the 1.5.5 (docker) on our two guacamole (Loadbalanced) Hosts
> since some month without problems. but with this 2 hosts we don't hit
> the 60 concurrent connection limit at the moment.
>
> Maybe i can try to do a test on another standby host that is using 1.6
> and connect via some servers to 60 hosts at the same time.
>
> Tobias
>
> Am 28.07.2025 um 12:07 schrieb Alex_Yin:
>> I am running guacd 1.5.5 on Centos 7.9 vm
>>
>> ---- Replied Message ----
>> From Nick Couchman<vn...@apache.org> <ma...@apache.org>
>> Date 07/28/2025 17:54
>> To user<us...@guacamole.apache.org> <ma...@guacamole.apache.org>
>> Subject Re: [EXT] SSH Connection Limit of 60 per guacd
>>
>>
>> On Mon, Jul 28, 2025 at 04:21 Alex_Yin <sk...@163.com> wrote:
>>
>> Hello Julian,
>> Thank you for your suggestion. My problem is indeed very similar
>> to the link you provided. I also found this bug link
>> https://issues.apache.org/jira/browse/GUACAMOLE-1998. It seems
>> that it has not been solved yet. I found two solutions from these
>> two links:
>> 1. Use version 1.5.3;
>> 2. Build guacd image based on Debian 12.
>> I think I can try to roll back to version 1.5.3 first.
>>
>>
>> What version of guacd are you running when you encounter this?
>>
>> Part of the challenge with the issue linked above is that we've been
>> unable to reproduce the issue reliably - I've got a very similar
>> environnent (guacd 1.5.5 on CentOS 7), and it's been running for
>> several weeks with hundreds of connections having been made with it
>> and I've not seen this issue. There must be some other factor
>> contributing to producing this behavior, we just haven't figured that
>> out, yet.
>>
>> -Nick
Re: [EXT] SSH Connection Limit of 60 per guacd
Posted by Tobias Feller | OPC <tf...@opc.de>.
Hi Nick, Hi Alex,
@Nick
/"I've got a very similar environnent (guacd 1.5.5 on CentOS 7), and
it's been running for several weeks with hundreds of connections having
been made with it and I've not seen this issue."/
The Problem was for me only on *concurrent connections*. I'm running
also the 1.5.5 (docker) on our two guacamole (Loadbalanced) Hosts since
some month without problems. but with this 2 hosts we don't hit the 60
concurrent connection limit at the moment.
Maybe i can try to do a test on another standby host that is using 1.6
and connect via some servers to 60 hosts at the same time.
Tobias
Am 28.07.2025 um 12:07 schrieb Alex_Yin:
> I am running guacd 1.5.5 on Centos 7.9 vm
>
> ---- Replied Message ----
> From Nick Couchman<vn...@apache.org> <ma...@apache.org>
> Date 07/28/2025 17:54
> To user<us...@guacamole.apache.org> <ma...@guacamole.apache.org>
> Subject Re: [EXT] SSH Connection Limit of 60 per guacd
>
>
> On Mon, Jul 28, 2025 at 04:21 Alex_Yin <sk...@163.com> wrote:
>
> Hello Julian,
> Thank you for your suggestion. My problem is indeed very similar
> to the link you provided. I also found this bug link
> https://issues.apache.org/jira/browse/GUACAMOLE-1998. It seems
> that it has not been solved yet. I found two solutions from these
> two links:
> 1. Use version 1.5.3;
> 2. Build guacd image based on Debian 12.
> I think I can try to roll back to version 1.5.3 first.
>
>
> What version of guacd are you running when you encounter this?
>
> Part of the challenge with the issue linked above is that we've been
> unable to reproduce the issue reliably - I've got a very similar
> environnent (guacd 1.5.5 on CentOS 7), and it's been running for
> several weeks with hundreds of connections having been made with it
> and I've not seen this issue. There must be some other factor
> contributing to producing this behavior, we just haven't figured that
> out, yet.
>
> -Nick
Re: [EXT] SSH Connection Limit of 60 per guacd
Posted by Alex_Yin <sk...@163.com>.
I am running guacd 1.5.5 on Centos 7.9 vm
---- Replied Message ----
| From | Nick Couchman<vn...@apache.org> |
| Date | 07/28/2025 17:54 |
| To | user<us...@guacamole.apache.org> |
| Subject | Re: [EXT] SSH Connection Limit of 60 per guacd |
On Mon, Jul 28, 2025 at 04:21 Alex_Yin <sk...@163.com> wrote:
Hello Julian,
Thank you for your suggestion. My problem is indeed very similar to the link you provided. I also found this bug link https://issues.apache.org/jira/browse/GUACAMOLE-1998. It seems that it has not been solved yet. I found two solutions from these two links:
1. Use version 1.5.3;
2. Build guacd image based on Debian 12.
I think I can try to roll back to version 1.5.3 first.
What version of guacd are you running when you encounter this?
Part of the challenge with the issue linked above is that we've been unable to reproduce the issue reliably - I've got a very similar environnent (guacd 1.5.5 on CentOS 7), and it's been running for several weeks with hundreds of connections having been made with it and I've not seen this issue. There must be some other factor contributing to producing this behavior, we just haven't figured that out, yet.
-Nick