You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@trafficserver.apache.org by James Peach <jp...@apache.org> on 2014/11/15 01:15:11 UTC
Re: [1/2] git commit: TS-2986: Adding stats to TLS errors
> On Aug 6, 2014, at 10:20 AM, James Peach <jp...@apache.org> wrote:
>
> On Aug 5, 2014, at 12:16 PM, Brian Geffon <br...@gmail.com> wrote:
>
>> Technically you'd probably aggregate all of these into a single variable
>> for production monitoring, but having insight into the individual failure
>> scenarios could prove to be very valuable.
>
> I'm still very dubious about these stats.
>
> SSL_ERROR_WANT_WRITE, SSL_ERROR_WANT_READ, and SSL_ERROR_WANT_X509_LOOKUP boil down to rescheduling the I/O. Hard to see how a metric for that is useful. The other things here end up as an error or EOF. Again, hard to see how this is helpful as a metric.
>
> Handshake errors (client and server) seems like they could be interesting to monitor, but these are bundled in "ssl_error_ssl", so you'll really have no idea what is happening.
Well, I now have a handshake error in production and no logging :-/ Does anyone know how I can debug this?
The only thing I can get out of logs now is this:
[Nov 14 23:58:13.204] Server {0x2aaaba64a700} DEBUG: <SSLNetVConnection.cc:735 (sslClientHandShakeEvent)> (ssl.error) SSLNetVConnection::sslClientHandShakeEvent, SSL_ERROR_SSL
J
Re: [1/2] git commit: TS-2986: Adding stats to TLS errors
Posted by James Peach <ja...@me.com>.
> On Nov 14, 2014, at 4:18 PM, Brian Geffon <br...@apache.org> wrote:
>
> Weird that error message should have errno attached:
> SSL_CLR_ERR_INCR_DYN_STAT(ssl_error_ssl, "SSLNetVConnection::sslClientHandShakeEvent, SSL_ERROR_SSL errno=%d", errno);
yeh that looks more promising in master, though I think it should be able to pass the VC doen to SSLDiagnostic
>
> Your version must be older
5.1.0
> can you hack together a debug build that logs errno?
>
> Brian
>
>
> On Fri, Nov 14, 2014 at 4:15 PM, James Peach <jp...@apache.org> wrote:
>
> > On Aug 6, 2014, at 10:20 AM, James Peach <jp...@apache.org> wrote:
> >
> > On Aug 5, 2014, at 12:16 PM, Brian Geffon <br...@gmail.com> wrote:
> >
> >> Technically you'd probably aggregate all of these into a single variable
> >> for production monitoring, but having insight into the individual failure
> >> scenarios could prove to be very valuable.
> >
> > I'm still very dubious about these stats.
> >
> > SSL_ERROR_WANT_WRITE, SSL_ERROR_WANT_READ, and SSL_ERROR_WANT_X509_LOOKUP boil down to rescheduling the I/O. Hard to see how a metric for that is useful. The other things here end up as an error or EOF. Again, hard to see how this is helpful as a metric.
> >
> > Handshake errors (client and server) seems like they could be interesting to monitor, but these are bundled in "ssl_error_ssl", so you'll really have no idea what is happening.
>
> Well, I now have a handshake error in production and no logging :-/ Does anyone know how I can debug this?
>
> The only thing I can get out of logs now is this:
>
> [Nov 14 23:58:13.204] Server {0x2aaaba64a700} DEBUG: <SSLNetVConnection.cc:735 (sslClientHandShakeEvent)> (ssl.error) SSLNetVConnection::sslClientHandShakeEvent, SSL_ERROR_SSL
>
> J
>
Re: [1/2] git commit: TS-2986: Adding stats to TLS errors
Posted by Brian Geffon <br...@apache.org>.
Weird that error message should have errno attached:
SSL_CLR_ERR_INCR_DYN_STAT(ssl_error_ssl,
"SSLNetVConnection::sslClientHandShakeEvent,
SSL_ERROR_SSL errno=%d", errno);
Your version must be older, can you hack together a debug build that logs
errno?
Brian
On Fri, Nov 14, 2014 at 4:15 PM, James Peach <jp...@apache.org> wrote:
>
> > On Aug 6, 2014, at 10:20 AM, James Peach <jp...@apache.org> wrote:
> >
> > On Aug 5, 2014, at 12:16 PM, Brian Geffon <br...@gmail.com> wrote:
> >
> >> Technically you'd probably aggregate all of these into a single variable
> >> for production monitoring, but having insight into the individual
> failure
> >> scenarios could prove to be very valuable.
> >
> > I'm still very dubious about these stats.
> >
> > SSL_ERROR_WANT_WRITE, SSL_ERROR_WANT_READ, and
> SSL_ERROR_WANT_X509_LOOKUP boil down to rescheduling the I/O. Hard to see
> how a metric for that is useful. The other things here end up as an error
> or EOF. Again, hard to see how this is helpful as a metric.
> >
> > Handshake errors (client and server) seems like they could be
> interesting to monitor, but these are bundled in "ssl_error_ssl", so you'll
> really have no idea what is happening.
>
> Well, I now have a handshake error in production and no logging :-/ Does
> anyone know how I can debug this?
>
> The only thing I can get out of logs now is this:
>
> [Nov 14 23:58:13.204] Server {0x2aaaba64a700} DEBUG:
> <SSLNetVConnection.cc:735 (sslClientHandShakeEvent)> (ssl.error)
> SSLNetVConnection::sslClientHandShakeEvent, SSL_ERROR_SSL
>
> J
Re: [1/2] git commit: TS-2986: Adding stats to TLS errors
Posted by Brian Geffon <br...@apache.org>.
Weird that error message should have errno attached:
SSL_CLR_ERR_INCR_DYN_STAT(ssl_error_ssl,
"SSLNetVConnection::sslClientHandShakeEvent,
SSL_ERROR_SSL errno=%d", errno);
Your version must be older, can you hack together a debug build that logs
errno?
Brian
On Fri, Nov 14, 2014 at 4:15 PM, James Peach <jp...@apache.org> wrote:
>
> > On Aug 6, 2014, at 10:20 AM, James Peach <jp...@apache.org> wrote:
> >
> > On Aug 5, 2014, at 12:16 PM, Brian Geffon <br...@gmail.com> wrote:
> >
> >> Technically you'd probably aggregate all of these into a single variable
> >> for production monitoring, but having insight into the individual
> failure
> >> scenarios could prove to be very valuable.
> >
> > I'm still very dubious about these stats.
> >
> > SSL_ERROR_WANT_WRITE, SSL_ERROR_WANT_READ, and
> SSL_ERROR_WANT_X509_LOOKUP boil down to rescheduling the I/O. Hard to see
> how a metric for that is useful. The other things here end up as an error
> or EOF. Again, hard to see how this is helpful as a metric.
> >
> > Handshake errors (client and server) seems like they could be
> interesting to monitor, but these are bundled in "ssl_error_ssl", so you'll
> really have no idea what is happening.
>
> Well, I now have a handshake error in production and no logging :-/ Does
> anyone know how I can debug this?
>
> The only thing I can get out of logs now is this:
>
> [Nov 14 23:58:13.204] Server {0x2aaaba64a700} DEBUG:
> <SSLNetVConnection.cc:735 (sslClientHandShakeEvent)> (ssl.error)
> SSLNetVConnection::sslClientHandShakeEvent, SSL_ERROR_SSL
>
> J