On Tue, Jul 21, 2009 at 01:54:25PM -0700, Quanah Gibson-Mount wrote:
--On Tuesday, July 21, 2009 4:51 PM -0400 "Clowser, Jeff"
<jeff_clowser@fanniemae.com> wrote:
> Do you have any facts/numbers to back this up? I've never seen F5's
> slow things down noticably.
We've had F5's be the root of the problem with several clients who load
balanced their LDAP servers, and pointed postfix at the F5 for delivery.
They added just a few milliseconds of time to each LDAP query, but that
was enough to completely back up their mail delivery system. Removing
the F5 from the picture allowed mail to flow smoothly, no more problems.
I can't speak for any other clients that Quanah may be referencing, but we
experienced this with our Zimbra deployment. However, I emphatically
disagree with his stance against running LDAP services behind a hardware
load balancer.
I'm not sure if Quanah heard the final resolution, which was to change the
LDAP VIP type from Standard to "Performance (Layer 4)." This solved the
problem immediately. I didn't see the final response from F5, but my
impression was that Performance (Layer 4) bypasses a lot of the hooks that
let you manipulate packets and connections. Interestingly, CPU consumption
on our BigIPs was low and therefore didn't prompt us to troubleshoot from
that angle. This was the first we've seen this behavior; our non-Zimbra
OpenLDAP nodes have a higher operation rate (~12k operations/sec
aggregate) and had been servicing a similar mail infrastructure before we
started moving to Zimbra's software.