On friday the 5th I started my trip to MX. I am assisting to Debconf 6 from the very first day, so that I can help the local team (at least with translations and such). I arrived to the airport early, so that I didnt have to suffer last minute stress if I see that the line is way too long and I have too little time to catch the plane. It all started fine (well, I forgot my keys at home when taking the dog for a walk, but I managed to reach my girlfriend and she came back to open the door for me). I must be the worst traveler in the world, since I seem to be causing only problems. Or maybe is that I question too many things that are the status quo and seem reasonable for other people. From the begining. It was check-in time, and the lady ask me about my hand luggage. I mentioned that since my friends were going to be waiting for me at the airport for almost 2 hours, I had prepared all my stuff so that I was not carrying anything dangerous in my two backpacks. Heck, I even left behind the regular tools that I carry with me, including the nail scissors,... The lady said it was not possible. "Sir, you can only carry 8 kilos of hand luggage". I looked around and saw people with lighter bags, but bulkier than mine. "Sorry, but, what is the reason? My luggage is smaller that the regular luggage, and I just need to get out asap". "Security reasons, sir". "Could you describe those reasons?". "... ... (surprise face) Security, sir. I would like to travel with my 20 kilos os luggage with me, sir". Yeah, sure. I am happy about that. I dont recall going away for such an extended period with such an small amount of things. When did all this madness start? Well, she did not manage to give me any reason why I could not take my things with me, but she got her sweet revenge. She put me on the back of the plane, with a guy who had at least 50k more on than I, although we both paid the same price for the ticket. I wonder where the security reasons are then, for those 50k... (Mental note: add to the travel checklist not to EVER forget deodorant and to take a shower before leaving home. Two showers. I had enough torture with the guy beside me...) The nice part of the flight was that for the first time i traveled on a Jet. Boy, is nice. Landed in Germany. The plane went to park on the backyard of the airport. We had a long 10min trip back to the terminal. The check-in for the plane to MX was a full hour set in advance, so that the HUGE amount of people that fits on one of those 747 had the time to show (for the 10th time) the passport. But looking aroung one wonders again where those security reasons not to let me carry my 8 kilos of luggage are: people around me had bought nearly their year salary on duty free stuff that wights more than 15k. Oh, boy, now I am confused. Is it so that someone has decided to add a rule in the name of security at some point after 11/9 and they forgot why? What difference does it make to get the luggage with 8 kilos from outside the terminal than from inside? As a side note, one can see that mexicans still keep much of the Spanish attitude. The speaker goes on, a man speaks in German and explains that people with children will board before anyone else. Nobody has understood anything, but they are already piling before the boarding gate. Once the man speaks in English, only the ones who dont understand English still await impatientily at the gate, mostly disturbing the check-in procedure for the flight, which will probably be delayed because of that. The second part of the trip was a bit more relaxed... I will skip the story about the looks-like-it-is-not-her-day flight attendant who could not understand a shit, and will only mention that when she served me a light coke and I handed her the empty can for dispossal, she gave me another full can with a face of "take-this-and-shut-up,dont-you-see-i-am-not-having-a-good-day?". I did not know Mexico was in the south hemisphere. At least that was the reason given for the satellite-linked internet only working the first three hours, although we were flying through Greenland, Canada, USA and Mexico's gulf for the 12h of flight, and Mexico IS on the (using the lonstanding critizised convention of not putting the map upside-down and say that is the right possition) north side. After landing it was a bit of rush, until I had to wait for my luggage, which of course came after waiting for almost 40min (Revenge of the Check-in Lady, take three... hi, if you read me). The people who create those inmigration forms MUST have short names. They have a big horizontal box with small vertical lines on the boxes to put your data trying to force you to put every character of your name in one small designated area. So there you go: "J E S U S _ D A N I E L _ C L I M E" That's right. Not even my first surname fits. Forget the second. This are the times that a friend of mine comes to mind: Enrique Garcia-Villarubia Gomez-Limon (Hi, if you read me). After all this I went out to find Amaya and h01ger waiting for me. We met Ganneff, Stockholm, Sam and Jeroen, and Damog, along with Agi, were coming right after picking up the van. We put Ganneff and Stockholm on a taxi and sent them to Oaxtepec, and left the airport for some dinner. Mexico is BIG, BIG, BIG. After driving for more than half an hour we got to a bridge from where you could see the city lights. And still, they were covering the horizon. HUGE. That realization is something I have not digested yet. Some local beers and tacos made the end of the night and we headed to Hector's place, where we were going to spend the night. From a not so negative point of view, the whole experience has been positive, and enlightening, to say it mildly. The food is mostly spicy. It could burn hell. Amaya is trying to get use to it by eating an insane amount of hot stuff but I refuse to do so. For the scared (hi, helix) I have not managed to get anything from the tap water. So nobody is dead, yet, although rumor has it that some are in comas. The net is here, although the roundtrip values are not very exciting. Mao has visited already the place, and said it is here to stay. Summary for the ones to come: this is HOT. I mean, really HOT. Forget your long jeans and bring shorts, even if you dont like to show your legs, sun screen cream, t-shirts, deodorant, swimming suit, and keep a bottle of water all the time with you. Food is served at a more sensible time than in Finland: 02:00h and 20:00h. See you in MX.

Looks like my plans for installing cfengine are hitting problems before I’ve even started getting very far. By default cfengine will not copy files from the master host to the client nodes if their clocks are “too far” out of sync. Unfortunately I cannot sync the clocks on all my nodes, much as I would like to, since UML doesn’t play nice with clocks going backwards .. On the plus side I’ve got a nifty script which will push updates to remote systems via a combination of rsync + dpkg - that allowed me to update 50ish machines and cause them all to start logging remotely with syslog-ng in the space of around an hour. If I could generalise this system it might be sufficient to copy files, do minor edits, and essentially do the tasks I wanted to automate with cfengine in the first place! In related news the more I learn of ruby the more I’m coming to dislike it…. It is just so .. un-perl! Still ruby is nicer than daemontools

... and already liking it. Though, first things first, some notes about the trip so far: The plane from vienna took off 50 minutes late due to weather reasons. It was quite nice, though, and I hope that some of the night pictures of town lightnings are usable. At least the delay reduced my waiting time at the madrid airport quite a bit. Which brings me to that airport. It's... HUGE! I mean... erm, it has signs telling people that it will take 25 minutes to the gate that the plane to mexico will be leaving. And that is including the trip on some underground train they have that it doesn't take you much longer than that... But appart from that, I arrived on the gate area before midnight so I was able to order some drink at the starbucks. At least some shop that knows how to let people enjoy the waiting time. :) The plane to mexico left on schedule at 1:50, so it was completely dark outside when we started. And almost the whole trip, up until about the last 20 minutes or so of the 13 hour flight, it was completely dark outside, because we were travelling ahead of the sun. So it wasn't too bad, being able to get some good sleep, at least as good as possible on a plane. Having arrived in mexio airport with a short delay and waiting a bit for my suitcase I finally met up with Frans Pop, because I was too scared of getting lost without any sense for the spanish language yet. We took one of the prepaid official taxis to the bus that will take us the rest of the trip. The taxi drive was really... well, interesting. It was the fastest trip I've ever seen in any car in city area, but the bad thing: I can't even tell you how fast we were at times because the speedometer was b0rked and displayed only zero all of the time. I guess taxi drivers are most the same all around the world, but this one definitely mastered the art. The bustrip wasn't anything notable, besides a bit tiresome due to the air in the bus, the partly monotonous vegetation outside and that I was sure to not be able to watch the movie to the end, besides that the sound was too silent. :) Finally arrived at Oaxtepec, which turned out that our hotel seems to be in some sort of recreation area, maybe even a bit of themepark... At least it has some rollercoasters, at least they showed them on the video. We'll see. I at least tried out the pool already, it's not even feeling cold for me. Not have met all the people yet that are rumoured to be around already, but I guess it might happen at lunch, which is expected soonish. Due to network not working though this blog post will have to wait until afterwards.

Today I went over to Brian's to work on some problems with the dilab. The remaineder of this blog entry is unlikely to be interesting to anyone except possibly sparc and mips porters, but I wanted to write it all down. First thing I noticed was that the internal network was very slow and lossey. I isolated this to its switch, which must be broken. Brian lent me a 7 port hub, which I put the more demanding machines on, leaving the others on the switch, and hopefully this will clear up some of the network issues I've been seeing during tests, until I can install a proper new switch. Unfortunatly, this still didn't clear up the proliant's failure to use its emulated network CD drives, which I'd hoped it would. Still working on figuring out why that's broken. As I was testing out all the machines after that to make sure they still worked, I heard a very strange sound from one of the X-10 appliance modules (#3). Sounded like a CD drive failing to open. I think its relay must be fried, after 1.5 years of turning on and off half a dozen times a day. So I had to move the raq 1 on that over to a different power module (#1), and moved the ia64 that was on that one over to a non-controlled power port. The raq 2, that handles d-i daily mipsel builds, was hung with "booting Debian" on its LCD, and power cycling didn't help, unfortunatly it lacks a serial console to see what's wrong. So I pulled it and took it home, will have to investigate it and try to get a stable system on it. Until then mipsel d-i dailys are still down, until ths takes them over. Finally, I took a look at the 2.6 kernel issue on the sparc ultra 5, which worked with 2.4 but not 2.6. Luckily Brian knows a lot about suns and a lot about serial (used to be my sysop, and still is in a way), and he diagnosed it as having the port running too fast, dropping it down to 9600 fixed that problem. So, shopping/todo list from the day:

• I need 1-3 more X-10 appliance modules or tranceivers.
• I need a new 16 port switch. That'll be the third one, the lab's already eaten two now.
• I need at least one more serial null modem cable for the raq 2.
• Need to diagnose the raq 2.
• Still need to figure out why ILO on the proliant doesn't like my web server's CD images anymore.
• The a-500 is still not seeing its PCI bus.
• Need to rewire the whole rack with better patch cables and also moving all these wires around has created a bit of a mess.

As of 20 minutes ago, I've officially reached that age. I don't think that's worth celebrating much. Especially not since I would much rather have celebrated it in .mx rather than in .be. Grmbl. In other (and totally unrelated) news, I joined another choir. It's called 'Caljente', it's for everyone between the age of 25 and 45, and it's part of the same choir family as the youth choir 'Cantilene' (16-25) that I was a member of for the better part of a decade. This is a brand new choir; today was its third ever rehearsal. Things are going rather well there; for interested people, we'll be doing a small concert in a month or two. Nothing big and fancy, but at least something. Watch this space. Or this space, if you speak Dutch.

A new development version of backup-manager has been published.

This release provides two new upload methods. The first one is called “ssh-gpg” and lets you upload your locally-built archives to untrusted remote places. During the upload (permormed with SSH), the archives are encrypted using GPG. The other one, called “s3″ is able to upload your archives to the Amazon S3 Storage service (if you have a valid account). This release also comes with a couple of bug fixes (filenames with spaces are now fully supported) and provides some other new options.

As requested on the users mailing-list, a Debian package will come very soon.

I have a laptop that supports bluetooth. By using gnome-bluetooth (which unfortunately isn't packaged yet—and no, I don't have the time to start doing more packages), I can accept data transfers over Bluetooth to my laptop, which sometimes is handy. Some people seem to think it's funny to start sending me unsolicited files while I'm on the train, hacking away on my laptop. I swear, they're spamming me. Of course, it's not something that can't be solved by running killall gnome-obex-server, but it's annoying. I'm thinking of writing my own obex server (or modifying g-o-s) so that the box that appears when it asks whether I want to accept some file has the option to "spam back", i.e., send the same file to the sending device over and over again. But then, that wouldn't be ethical, would it?

Last year Black Cat decided they wanted to be more organised about offering dedicated servers. We already had a rackful but they were all in use. So we looked around for a suitable supplier. Originally Dell were the front runner; although they have a bad reputation we already had a bunch of machines from them and they'd been reasonable reliable, did serial BIOS properly and were competitively priced. Dom pointed out that having hotswap drive bays would be a really good plan; we'd already specced the machines with dual drives to enable RAID1, but if they were hotswap then we could easily move drives into a spare chassis in the event something went wrong, meaning the customer could be back up and running again quickly while we investigated the old machine. Good plan. This started to push Dell into ridiculous pricing, so we had a look around. We had some machines from Xinit, which again we hadn't had issues with. They were able to give us a price that wasn't that different to the non hotswap Dells, so we decided to go ahead with them. Bad move. On September 6th I informed them we wanted to go ahead. They'd quoted us a 10-14 working day lead time. As we didn't have a credit account already set up with them and it was likely to take a while to sort out we said we'd pay up front in the interest of getting things moving as quickly as possible. By September 22nd we still hadn't heard anything from them, like even confirmation that payment had been received and an ETA for delivery. So I contacted them, received confirmation they'd received full payment by September 13th and was told we should see systems by September 30th or October 3rd at worst. On September 26th they emailed to say there was a problem with their shipment and we'd be receiving a part shipment with the rest to follow. 4 servers were delivered on October 12th. It turned out none of them had been configured as requested (serial console, 9600 8n1, all set to auto power on after power failure), so I ended up having to plug a monitor and keyboard into each machine before connecting it up to the serial console server and power cycler. I chased Xinit again on 24th October. They'd claimed a 5th server was to be delivered before that and still hadn't told me anything about the remaining 15. I was not impressed. A new contact got back in touch and made all manner of apologies and promises about keeping in better contact and keeping me up to date with what was happening. Suffice to say this didn't happen, and calls to the main Xinit number were of no use as no one could help, and the mobile number I'd been given for this contact was unanswered more often than not. On 1st November we received another 11 machines. These were at least configured as requested, but during our testing we discovered they had been misassembled. 5 machines had CPU heatsinks put on incorrectly; visually misaligned and such that any load caused a machine crash. Very unimpressive from a company who supposedly does full burn in tests on machines before shipping them (and indeed used this as an excuse for not shipping us machines sooner on occasion). Further chasing didn't have much effect, but we eventually received the remaining servers on December 5th. Nearly 3 months after we initially placed the order. While Xinit have happily provided many platitudes they have failed to address the numerous failings in their organisation. They are appalling at responding to phone calls or email. They continuously fail to make good on any of the promises they make. They can't provide realistic delivery dates and don't have the decency to get in contact and let you know when they're going to miss them. They have proved unable to assembly machines to any level of competence; most of what they do is buy in chassis and fit parts to them - this is not complicated and yet they managed to get it wrong on several of the machines we ordered. We were promised a machine or two in compensation, but of course these never arrived. In addition, they're so badly organised that in the middle of March we received a spam from one of their sales people who was completely unaware we'd been customers of them! I cannot stress how much you should never consider using this company. I've spoken to others who've bought machines from them or had dealings with them and I know I'm not alone in this. Really. Don't do it. You'll regret it. I suspect it would have taken less of my time and energy to buy all the parts and assemble the machines myself. I wish I'd done so instead. This does leave me lacking a hardware supplier however. We're in the position of needing more machines, but given recent power pricing increases Xeon LVs (the new Sossaman cores) look like the way forward. Except no one appears to have any stock. And even if they do, how do I know I won't get my fingers burned again?

One of the most bitter and hardest tasks of running a large international conference such as Debconf 6 is the absurd process to ensure that every person interested in attending is able to do so.
Before I start ranting, let me point you to a very well written text my father wrote about two years ago, out of a similar frustration after organizing the XXV International Colloquium on Group Theoretical Methods in Physics - On travelling to Scientific Meetings.
Mexico is not a first world country, as you all know it (you didn't know? Well, please take note). Mexico is not a country that gets heavy migration - quite to the contrary, it is a country from where masses of people live in the United States (seven to ten million). We should not fear migrants staying at our country and stealing our precious job sources. The countries Mexico requests visa for are mostly those at or under our economic level (i.e. most of South America) or those with infrequent travellers coming (i.e. most of Eastern Europe, Asia and Africa (of course, we have to make sure they don't suddenly become tourists and give us more money).
Were it not for the "intelligent borders" the USA government is demanding on ours as a precondition to walk towards a migratory agreement that could in the future legalize at least part of the Mexicans that live in the USA, it would be impossible for me to understand why does a situation like what we have experienced happen.
We started, yes, the visa request process a bit late, due to some organization problems which should remain internal to the local organizing committee - However, we requested the visas for 25 people coming from Bangladesh, Bolivia, Bosnia Herzegovina, Brazil, Colombia, Croacia, El Salvador, India, Per and Russia with a process that started on March 25 - Well before May 5, where the first of them is scheduled to arrive. Of course, we knew the process would not be easy, but we were armed by the written assurement of a migration officer to my father assuring him the migration procedures would be vastly simplified during 2005.
I will try to keep the story short. I cannot also speak the whole experience, as it was my wife together with the Nul-Unu people who had the burden of doing all this.
Once you enter your request, it is impossible to track where it is - INM is a maze of twisty little passages, all alike. You cannot get any information by phone. When the papers were submitted, Nadezhda was told to come back in 10 days for getting the status update. Ten days later, she was told no information was yet available. Some days after that, she found the papers had been sent to Cuernavaca (Morelos state capital), where we should have presented them, because the conference is taking place in Oaxtepec, Morelos... No, they didn't pay attention to the fact that we repeated over and over that the organization running the conference, AMESOL, was based on Mexico City.
Ok, no big deal - We went to Cuernavaca so that the AMESOL president was interviewed on what the conference is about and why should we let all that people in our country, and demanding from him to accept personally the responsability of making sure each of them leaves the country as promised. Not only that, we had to go again because not all of the requests were sent the same day, and they belonged to different batches. They also asked the Oaxtepec people if the list of people had a room booked - of course, the hotel crew knew the group was coming, but not the list of individuals!
But no reply yet. The office in Cuernavaca said they would fax the results back to Mexico the next day. That next day took almost two weeks.
With the results already in Mexico, and with the help of some insiders we came in contact with thanks to different coincidences (I'm not giving any names or functions here, hope you understand), we finally got notice last Friday (April 28) that most visas were approved, but a handful (Bosnia, Bangladesh and Colombia) were held for national security reasons. At long last, yesterday (May 2) we told most of the group was approved, and got the magic authorization number with which they could go get their visas. Not all of them yet... I really hope the authorization can come on time, and we can get the rest of them here. At least it helped a bit that we as a committee invited them - Otherwise, people from poorer countries would have to show bank account statements assuring they have had an average of US$2000 in their savings account for at least one year - Impossible even for most Mexicans.
But the story, incredibly, does not end here. Why didn't I write about this before? Because I was just pissed off. Today, I am enraged.
Not only you have to go through a stupidly long process to be awarded a visa. Once the visa is awarded, you have to pay its fees. The visa is expensive, more or less as expensive as the USA visa is for us - around US$40. But the visa is worth nothing without the FM3 migratory document - I knew the FM3 was used by foreigner residents. It's basically a complete passport. A stupid, unnecessarily long document, where your entries and exits are recorded, where you should note your work place, etc. - All fine for a long-term resident... But we are being awarded limited one entry tourist visas. Oh, and by the way: An FM3 costs around US$100... So for the poorer countries, after being mistreated, ignored and degraded, you have to pay US$140, probably one whole fucking month of your salary just to get the needed permits?!
We complain a lot on how the USA government does not respect Mexicans. Just this Monday, May 1st, there was a massive migrant movement in the USA, seconded in Mexico via an (symbolic, yes, but nevertheless true) one day long economic boycott against USA companies. Mexicans speak of the rights of our migrants, of the abuse that the USA authorities make... But we are unable to treat others with dignity, to welcome them as our country did for many decades.
This makes me very sad. And very angry. I should have been writing information for you all to have a good and easy time when coming to Mexico, but that will have to be a bit later - I cannot just stay and stand this situation.

Spring Seoul is looking much better than earlier. I am happy to be back from my travels in Beijing. The air is so much cleaner here in Seoul! I’ve just corrected some spelling mistakes and added some links to some appropriate pictures to my blog posts of my 10 days in Beijing, China. I’ve had my post-travel disaster, by washing a 2USD towel I had to buy because it’s cheaper to buy a new towel in China than actually wash it, with the rest of my clothes! AARRGGGHHHH! I’m not sure how to fix this. I am just washing the clothes again and taking up prayer. Argh, it hasn’t helped. Since my last post I discovered Beef Noodles! They are so incredibly delicious. I had them in a pleasant artsy area just south of Tienanmen square by bike of course. Last Tuesday I visited the Sina offices and gave a impromptu webpy presentation for the Beijing Python User Group. It went well and they asked me also to talk about Debian, as they were unfamiliar with it (to my surprise). Nice bunch of guys. Afterwards we went out for Taiwanese cuisine where you cook fresh food in a hot broth. Very good. They were all impressed I could drink three large bottles of beer in such a short space of time. I’ve been practicing and my throat was so dry from the air pollution in Beijing. I’ve also uploaded some videos of China I took with my sister’s camera. This is my favourite video with me riding along the top of Tiananmen.

I've been investigating alternative system inits from time to time the last few years. With the advent of bootchart, there was quite a hype around improving boot times with parallelization and such. Recently this topic has manifested itself in the initscripts-ng group on alioth, and some to-be Google Summer of Code projects. I've been using a modified version of minit for a long time, just lately I was to lazy and switched back to regular init. Since I use suspend2, I don't really reboot my system often anyway. However, minit has more features than being parallel and small. It offers service monitoring and respawning. Which brings me to something missing totally from current linux init systems: service state tracking. Right now, when you start a service, e.g. the web server, you pretty much hope it will never die. Agreed, apache does a good job here. Others may or may not. Mysql uses a really hackish shell script to respawn. And then there are of course tools like monit that check your services and respawn them when needed. There are a couple of things wrong with starting services via SysVInit style scripts from the shell. For example, in order to start a service you need root rights. And then this will "leak" file descriptors from your shell to the daemon (thats why some apps need to be started with "nohup"). Which also causes extra errors with SELinux, for example. And this is just one of the differences from services being started by manually running their init script from the script being run by runlevel changes. Therefore, I think we should move to a new init that can offer full state tracking for services, and is actually used for all services (and not just initial start and getty respawning...) Here's a fairly extensive state diagram I came up with:
Some features I'd like to have in a new init:

• state tracking with interim states
• dependency management with virtual services (e.g. webserver)
• service monitoring and respawning
• control fifos for starting/stopping services through init
• init monitoring socket for e.g. DBUS connector and service failure notifications

Sorry, no comments on my blog, intentionally. Please use the initscripts-ng mailing list for discussion, thats what the list is for!

Phillip, my blog has no comments feature for similar reasons as madduck has pointed out. As you may have read, I wrote "[Debian Live will be] first [an] unofficial [project], then trying to bring it into Debian and become an official subproject". As you may have read too, Joey wrote "Debian Live [...] is an official sub-project of Debian". I just created those resources on my own webserver for beeing quicker and more flexible in the beginning, I would be happy to move everything to debian.org. However, this would need a large amount of time for bureaucracy (especially for a poor little NM like me). Time, which I don't have and neither want to invest nor want to waste at the moment. If you volunteer for that job, feel free to be my guest (to avoid misunderstandings: alioth isn't an option, hosting several ISO images isn't possible on haydn due to lack of bandwith and space). And yes, I agree... I'm unworthy to run something officially because I'm not a DD. I'm patiently stuck in the queue since nearly a year, currently waiting on my AM who has the major PITA to check 75 packages... (my earnest and deepest sympathy to you, rene).

I’ve been using OpenSWAN for a little while now, and have been quite unhappy w/ it. Aside from being poorly documented and a pain in the ass, we’ve run into kernel bugs and stability issues; the various SWAN implementations feel very cobbled together. I also firmly believe that network stacks should be implemented in userspace, and linux’s IPSec stack confirms that belief (Van Jocobson’s network channels display a nice example of how an efficient userspace tcp stack would work). Layering GRE tunnels and using OSPF over the tunnels simply adds to the complexity. Playing around w/ OpenVPN was such a pleasant experience. It has excellent documentation, and was a breeze to configure/set up. I was concerned with speed issues, however; OpenSWAN uses the kernel’s IPSec stack, while OpenVPN has to copy packets between kernelspace and userspace, and uses SSL + Linux’s tun device. I experimented w/ two machines; a dual opteron and a single processor 2.4GHz p4, both w/ Debian’s 2.6.15-1-686-smp kernel. Doing a straight netcat of /dev/zero between the two machines yielded 98mbit/s (according to iptraf). Using an OpenSWAN tunnel and a GRE tunnel [0], I got about 81mbit/s sustained between the two machines. The load on the slower machine hovered around 0.30 while this was happening. Using OpenVPN in UDP mode, I got about 15mbit/s, w/ a load avg of 1.84. Very disappointing results. I was curious if using OpenVPN in TCP mode made a difference; it did. With it, I got about 17mbit/s, w/ a load avg of 2.10. This wasn’t very satisfactory; replacing OpenSWAN w/ OpenVPN when it could only do 17mbit/s over a 100mbit connection, and drove the load way up while doing it was not going to work. Looking at the config, I tried another change; disabling compression [1]. This made all the difference. With OpenVPN in UDP mode and compression disabled, I got 98mbit/s between the two machines, w/ a load avg of about 1.90. This made me much happier; looks like I’ll be replacing OpenSWAN. No need for GRE tunnels over top of the OpenVPN tunnels, either; OSPF works just fine between the tun devices. [0] There are a number of reasons to use GRE tunnels over OpenSWAN IPSec tunnels; Ken Bantoft’s Linux Symposium paper on the subject summarizes them nicely. [1] Most of the traffic that goes across our tunnel links is compressed already, anyways. No sense recompressing it.

Womble2 (Ben Hutchings) as one of your newest DDs! Quite a few people know him in the UK, and some of you may have met him over at DC5.

I'm not sure if I've got the subject of this post right, but it is meant to be Spanish, as we're so near DC6 :)