Time, filtering, bonds, and proxies | LFCS: Linux administration in production

Concept and mechanism

An active time daemon may still lack a selected source. Inspect tracking and sources to connect state, offset, and reachability. Changing timezone changes time representation and does not correct an unsynchronized clock. On a financial-processing system, assess a clock step’s effect on schedules, logs, and applications before forcing it. The same principle of checking effective state applies to firewalld: a runtime rule may work now and disappear after reload if absent from permanent configuration. Treat zone, scope, and persistence as parts of the approved change; do not indiscriminately save every temporary rule.

Guided application

In an active-backup bond, only one interface is active for transmission; two 1 Gbit/s ports do not promise 2 Gbit/s for one flow. Define the failure mode to withstand and verify link monitoring. Two links on one switch may retain a shared dependency. With reverse proxies, a direct backend health check does not test the client path. If NGINX attempts an old port and receives connection refused, compare configured upstream, listener, and recent change before increasing timeouts. Validate syntax before applying configuration, retain rollback, and test a transaction through the proxy. Preserve TLS and access controls while correcting backend connectivity.

IN PRACTICE

The backend moved to 9100 but proxy_pass uses 9000: correcting the dependency is more targeted than increasing timeout.

Common pitfalls

Active chronyd as synchronization; runtime as permanent; bond as guaranteed aggregation; green backend as a validated complete path.

Related topics: Storage, mounts, and recovery · Commands and operational evidence

Take this idea with you

Acceptance needs effective state, intended persistence, and testing through the real user path.

Create account

Reference: NGINX HTTP proxy module · LFCS current five-domain outline; exact edition date unconfirmed