Stick tables are great. Just make sure you put the statements in the right order. The new simplified syntax might alleviate that but I haven’t tried it yet.
line, under "http_req_rate" section. In the article you wrote: "The second line is what inserts or updates a key in the table and updates its counters.". I think with that you were talking about the third line and that you skipped the second line in the explanation.
Your right, I frequently look as inspect-delay as not being a real line given that it doesn't do much itself.
I have an explanation of inspect-delay a bit further down:
When tcp-request inspect-delay is present, it will hold the request until the rules in that block have the data they need to make a decision or until the specified delay is reached, whichever is first.
Basically if an ACL requires an http request (such as updating the http_req_rate counter) but the action is tcp-request it tells HAProxy to wait until it has a http request before it continues. If using an http-request track-* action its not required as HAProxy won't process http-request until it has an HTTP request to add to the counters.
Since HAProxy won't send a request to a backend in HTTP mode until it has a full request inspect-delay doesn't actually delay the request at all; just the processing phase for a bit (in TCP mode where it doesn't it gets a bit more complicated).
Hello, feel free to hop on the HAProxy Slack: slack.haproxy.org or optionally on IRC: Freenode/chat.freenode.net #haproxy and we'll be more than happy to take a peek at the errors / configuration in question.
Stick tables are a type of key-value store where the key is what you track across requests, such as a client IP, and the values consist of counters that, for the most part, HAProxy takes care of calculating for you. They are commonly used to store information like how many requests a given IP has made within the past 10 seconds.
10 comments
[ 2.6 ms ] story [ 30.3 ms ] threadSeriously, great article OP. Def. gave me a much better understanding of stick tables!
> tcp-request inspect-delay 10s
line, under "http_req_rate" section. In the article you wrote: "The second line is what inserts or updates a key in the table and updates its counters.". I think with that you were talking about the third line and that you skipped the second line in the explanation.
Basically if an ACL requires an http request (such as updating the http_req_rate counter) but the action is tcp-request it tells HAProxy to wait until it has a http request before it continues. If using an http-request track-* action its not required as HAProxy won't process http-request until it has an HTTP request to add to the counters.
Since HAProxy won't send a request to a backend in HTTP mode until it has a full request inspect-delay doesn't actually delay the request at all; just the processing phase for a bit (in TCP mode where it doesn't it gets a bit more complicated).
Just started happening in our containers earlier this week.