{"action":"created","issue":{"url":"https://api.github.com/repos/Azure/WALinuxAgent/issues/931","repository_url":"https://api.github.com/repos/Azure/WALinuxAgent","labels_url":"https://api.github.com/repos/Azure/WALinuxAgent/issues/931/labels{/name}","comments_url":"https://api.github.com/repos/Azure/WALinuxAgent/issues/931/comments","events_url":"https://api.github.com/repos/Azure/WALinuxAgent/issues/931/events","html_url":"https://github.com/Azure/WALinuxAgent/issues/931","id":270411417,"node_id":"MDU6SXNzdWUyNzA0MTE0MTc=","number":931,"title":"Constant stream at 800k/min Rx, 140k/min Tx on CentoOS 7.4","user":{"login":"rhertzler","id":33293720,"node_id":"MDQ6VXNlcjMzMjkzNzIw","avatar_url":"https://avatars1.githubusercontent.com/u/33293720?v=4","gravatar_id":"","url":"https://api.github.com/users/rhertzler","html_url":"https://github.com/rhertzler","followers_url":"https://api.github.com/users/rhertzler/followers","following_url":"https://api.github.com/users/rhertzler/following{/other_user}","gists_url":"https://api.github.com/users/rhertzler/gists{/gist_id}","starred_url":"https://api.github.com/users/rhertzler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rhertzler/subscriptions","organizations_url":"https://api.github.com/users/rhertzler/orgs","repos_url":"https://api.github.com/users/rhertzler/repos","events_url":"https://api.github.com/users/rhertzler/events{/privacy}","received_events_url":"https://api.github.com/users/rhertzler/received_events","type":"User","site_admin":false},"labels":[{"id":6519869,"node_id":"MDU6TGFiZWw2NTE5ODY5","url":"https://api.github.com/repos/Azure/WALinuxAgent/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":9,"created_at":"2017-11-01T18:48:19Z","updated_at":"2018-06-26T16:29:10Z","closed_at":null,"author_association":"NONE","body":"A newly provisioned CentOS 7.4 VM receives a constant stream at 800k/min from blob.bn1prdstr01a.store.core.windows.net and blob.bz6prdstr09a.store.core.windows.net and also sends a 140k/min stream to blob.bz6prdstr09a.store.core.windows.net. The VM is not actively used yet so is basically just sitting there. The process causing the traffic is \"python -u /usr/sbin/waagent -run-exthandlers\" and when the process is suspended, the traffic totally stops. \r\n\r\nIt is one of two VMs built from the same image and the other has only a tiny amount of static traffic from waagent. Both VMs have identical waagent.conf files which have been modified from stock to create a swap file in “/mnt/resource”. After the VMs were created, OmsAgentForLinux was added but then subsequently removed through the Azure Portal. \r\n\r\n![netusegraph](https://user-images.githubusercontent.com/33293720/32291134-8c21bbea-bf12-11e7-9c02-64c1b26207a8.png)\r\nThe graph shows this static background traffic. The gaps are our troubleshooting efforts to narrow the problem to waagent. Not sure where to go next to find the specific problem and coming up empty on relevant differences between the two VMs. \r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/Azure/WALinuxAgent/issues/comments/400377558","html_url":"https://github.com/Azure/WALinuxAgent/issues/931#issuecomment-400377558","issue_url":"https://api.github.com/repos/Azure/WALinuxAgent/issues/931","id":400377558,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMDM3NzU1OA==","user":{"login":"eruditej","id":34778848,"node_id":"MDQ6VXNlcjM0Nzc4ODQ4","avatar_url":"https://avatars3.githubusercontent.com/u/34778848?v=4","gravatar_id":"","url":"https://api.github.com/users/eruditej","html_url":"https://github.com/eruditej","followers_url":"https://api.github.com/users/eruditej/followers","following_url":"https://api.github.com/users/eruditej/following{/other_user}","gists_url":"https://api.github.com/users/eruditej/gists{/gist_id}","starred_url":"https://api.github.com/users/eruditej/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eruditej/subscriptions","organizations_url":"https://api.github.com/users/eruditej/orgs","repos_url":"https://api.github.com/users/eruditej/repos","events_url":"https://api.github.com/users/eruditej/events{/privacy}","received_events_url":"https://api.github.com/users/eruditej/received_events","type":"User","site_admin":false},"created_at":"2018-06-26T16:29:09Z","updated_at":"2018-06-26T16:29:09Z","author_association":"NONE","body":"it could depend, restart the agent on the boxes that arent sending as much.\n\nthey may have been started at a time when they couldn't reach the public IP\nand fallen back to the wire server endpoint (the 169 address)\n\nI don't recommend doing that though since you could increase the amount of\ntraffic hitting your firewall\n\n\n\nOn Tue, Jun 26, 2018, 3:36 PM Chris Wright <notifications@github.com> wrote:\n\n> Thanks Ill give that a go.\n>\n> Does anyone know why only some machines send lots of traffic and others\n> send hardly any, when they are all essentially identical except for host\n> name?\n>\n> Thanks\n>\n> c.\n>\n> > On 27 Jun 2018, at 00:02, eruditej <notifications@github.com> wrote:\n> >\n> > set the http_proxy in the walinuxagent conf file to localhost and it the\n> > client will fall back to the wire server endpoint instead of using the\n> > routed public IP\n> >\n> > This issue occurs with virtual firewalls with a forced tunnel mode and\n> > since most of them are forced to use 1 gigabit virtual links this is too\n> > impactful for a sizable deployment.\n> >\n> >\n> >\n> > On Tue, Jun 26, 2018 at 8:58 AM Chris Wright <notifications@github.com>\n> > wrote:\n> >\n> > > I am experiencing a similar issue, but I still dont understand what is\n> > > going on. We have 3 VMs on the same subnet in the same vnet, all\n> created\n> > > from the same Centos 7 OpenLogic OS image, however 1 of them is\n> sending a\n> > > bucket load of traffic constantly to 52.239.131.36 -\n> > > blob.syd23prdstr01a.store.core.windows.net but the other 2 send\n> virtually\n> > > none - why is one sending so much and the others sending hardly any?\n> They\n> > > are identical machines (created with terraform). They are behind a\n> virtual\n> > > fortigate firewall appliance and thus I can see all the traffic.\n> > >\n> > > These machines are not supposed to have any outbound access and I will\n> be\n> > > dropping all teh traffic at the firewall soon - what problems will this\n> > > cause?\n> > >\n> > > Finally where is the documentation that explains all this, the azure\n> > > documentation about the agent doesn't seem to explain that this is how\n> it\n> > > all works, nor explain whether we can or cannot block this traffic?\n> > >\n> > > —\n> > > You are receiving this because you commented.\n> > > Reply to this email directly, view it on GitHub\n> > > <\n> https://github.com/Azure/WALinuxAgent/issues/931#issuecomment-400318639>,\n> > > or mute the thread\n> > > <\n> https://github.com/notifications/unsubscribe-auth/AhKu4BHVngR31jBLfeIFc1_0DJ5APBZDks5uAj4DgaJpZM4QOpbV\n> >\n> > > .\n> > >\n> > —\n> > You are receiving this because you commented.\n> > Reply to this email directly, view it on GitHub <\n> https://github.com/Azure/WALinuxAgent/issues/931#issuecomment-400320034>,\n> or mute the thread <\n> https://github.com/notifications/unsubscribe-auth/ADwOolqkAwxxjY25HWj6OTAY7vRUvXZLks5uAj7hgaJpZM4QOpbV\n> >.\n> >\n>\n> —\n> You are receiving this because you commented.\n> Reply to this email directly, view it on GitHub\n> <https://github.com/Azure/WALinuxAgent/issues/931#issuecomment-400332454>,\n> or mute the thread\n> <https://github.com/notifications/unsubscribe-auth/AhKu4I45n5fixjic7MpJvoXiU6lW1hv4ks5uAkb5gaJpZM4QOpbV>\n> .\n>\n"}}
{"actor":{"display_login":"eruditej"}}