Lexa Software: Nginx-ru@sysoev.ru archive

2010/12/9 Maxim Dounin <mdounin@xxxxxxxxxx>

Hello!

On Thu, Dec 09, 2010 at 12:07:32AM +0300, -=HaRius=- wrote:

> ÎÁ×ĹŇÎĎĹ ĐÉÎÁÔŘ ÂŐÄĹÔĹ ÎĹ × ÔĹÍŐ ŇÁÓÓŮĚËÉ, ÎĎ ÓÖÁĚŘÔĹÓŘ!!!
>
> Ó 12 ŢÁÓĎ× ĚĹÖÉÍÓ =(
>
> ŢĹ ÄĹĚÁÔŘ ŐÖĹ ÉÄĹÉ ËĎÎŢÁĚÉÓŘ
> ĐĹŇĹËŇŐÔÉĚ sysctl ŐÖĹ ×Ď ×ÓĹ ÓÔĎŇĎÎŮ
> ÓĹŇ×ÁË ÎÁŢÁĚ ÎĹÍÎĎÇĎ ĐĎĚÚÁÔŘ, ÎĎ ËÁË ÔĎĚŘËĎ
> nginx ÚÁĐŐÓËÁŔ × ËĎÎÓĎĚŘ ÓŇÁÚŐ ÎÁŢÉÎÁĹÔ ×ÁĚÉÔÓŃ
>
> Dec š8 23:56:08 mail kernel: interrupt storm detected on "irq257:";
> throttling interrupt source
> Dec š8 23:56:08 mail kernel: Limiting open port RST response from 169 to 50
> packets/sec
> Dec š8 23:56:09 mail kernel: interrupt storm detected on "irq257:";
> throttling interrupt source
> Dec š8 23:56:09 mail kernel: Limiting open port RST response from 230 to 50
> packets/sec

ń ĐŇÁ×ÉĚŘÎĎ ĐĎÎÉÍÁŔ, ŢÔĎ irq257 - ÓĹÔĹ×ŐČÁ? šĺÓĚÉ ĎÎÁ
ÓËĎĚŘËĎ-ÎÉÂŐÄŘ ĐŇÉĚÉŢÎÁŃ, ÔĎ ĐĎĐŇĎÂĎ×ÁÔŘ ĐĎÔŔÎÉÔŘ ÂŐĆĹŇÁ/ÚÁÄĹŇÖËÉ
ĐŇĹŇŮ×ÁÎÉĘ. šîŐ ÉĚÉ ĐŇĎÓÔĎ ĐĎÄÎŃÔŘ hw.intr_storm_threshold, ŢÔĎÂŮ
ĐĎ ËŇÁĘÎĹĘ ÍĹŇĹ ÓĹÔŘ ĐŮÔÁĚÁÓŘ ŇÁÂĎÔÁÔŘ.

> × ĚĎÇÁČ ĐĎĚÎĎ:
>
> 80.138.138.94 - - [08/Dec/2010:23:32:16 +0300] "GET / HTTP/1.1" 0 0 "-" "IE
> 7.0"

[...]

> ŢÔĎ ÓÄĹĚÁÎĎ
> 1. fail2ban ÎÁÔŇÁ×ĚĹÎ ÎÁ ĐĎÉÓË ÁÇĹÎÔÁ "IE 7.0" š- ÂĚĎŢÉÔ, ÎĎ ÎĹ ÓĐÁÓÁĹÔ
> 2. ×ŇĹÍĹÎÎĎ location = / { return 200; } - ÎĹ ÓĐÁÓÁĹÔ
> 3. if ($http_user_agent = "IE 7.0" ) { return 412;}
>
> š š š š if ($http_referer = "") { return 412;} - ÔĎÖ ÎĹ ÓÔÁÓÁĹÔ

îŐ ŐÖ ÔĎÇÄÁ return 444;.

> 4. sysctl - ÎÁËŇŐŢĹÎ
>
> sysctl -n kern.ipc.numopensockets
> 90228

reset_timedout_connection on;

čĎÔŃ 90k - ÜÔĎ × ĎÂÝĹÍ ÎĹ ÍÎĎÇĎ.

>
> # netstat -Lan
> Current listen queue sizes (qlen/incqlen/maxqlen)
> Proto Listen š š š š Local Address
> tcp4 š0/0/128 š š š š*.4949
> tcp4 š0/0/4096 š š š 88.212.196.18.443
> tcp4 š0/0/4096 š š š 88.212.196.18.80
> tcp4 š0/0/128 š š š š*.22
> tcp4 š0/0/500 š š š š*.25
> tcp4 š0/0/5 š š š š š88.212.196.18.5666
> tcp4 š0/0/20 š š š š 127.0.0.1.53
> tcp4 š0/0/511 š š š š127.0.0.1.80
> Some tcp sockets may have been created or deleted.
> unix š0/0/1 š š š š š/var/run/fail2ban/fail2ban.sock
> unix š0/0/4 š š š š š/var/run/devd.pipe

îŐ ĐŇĎÓÔĎ ÔÁËÉ ÔÉŰÉÎÁ É ĐĎËĎĘ. š÷ĐŇĎŢĹÍ, ÜÔĎ ×ĹŇĎŃÔÎĎ ÓĚĹÄÓÔ×ÉĹ
"throttling interrupt source".

> # netstat -m
> 1377/36183/37560 mbufs in use (current/cache/total)
> 754/33038/33792/33792 mbuf clusters in use (current/cache/total/max)

á ÇĎ×ĎŇÉÔĹ sysctl ÎÁËŇŐŢĹÎ. šő ×ÁÓ mbuf cluster'Ď× Ó ÇŐĚŘËÉÎ ĆÉÇ.

sysctl kern.ipc.nmbclusters=262144

÷ nginx'Ĺ ÍĎÖÎĎ ĹÝŁ ĐĎŐÍĹÎŘŰÁÔŘ ÂŐĆĹŇÁ ÎÁ ÓĎËĹÔÁČ (listen ...
rcvbuf=... sndbuf=...), ÄÁÂŮ ÎĹÍÎĎÇĎ ĐĎÜËĎÎĎÍÉÔŘ ĐÁÍŃÔŘ ĹÓĚÉ ĹŁ ÎĹ
Č×ÁÔÁĹÔ.

> 36/1628 mbuf+clusters out of packet secondary zone in use (current/cache)
> 0/0/0/16896 4k (page size) jumbo clusters in use (current/cache/total/max)
> 0/0/0/8448 9k jumbo clusters in use (current/cache/total/max)
> 0/0/0/4224 16k jumbo clusters in use (current/cache/total/max)
> 1852K/75121K/76974K bytes allocated to network (current/cache/total)
> 0/17954981/0 requests for mbufs denied (mbufs/clusters/mbuf+clusters)
> 0/0/0 requests for jumbo clusters denied (4k/9k/16k)
> 0/0/0 sfbufs in use (current/peak/max)
> 0 requests for sfbufs denied
> 0 requests for sfbufs delayed
> 1377 requests for I/O initiated by sendfile
> 0 calls to protocol drain routines
>
> ËÁË ĹÝĹ ÂĎŇĎÔŘÓŃ ?????

îŐ É vmstat -z ĐĎÓÍĎÔŇÉÔĹ ÄĚŃ ËĎÍĐĚĹËÔÁ, ÔÁÍ ĚŐŢŰĹ ×ÉÄÎĎ ŢĹÇĎ ÎĹ
Č×ÁÔÁĹÔ.

îĎ ĐŇÉ ÔÁËĎÍ ËĎĚÉŢĹÓÔ×Ĺ mbuf cluster'Ď× ĐŇÉ ÔÁËĎÍ ËĎĚÉŢĹÓÔ×Ĺ
ÓĎËĹÔĎ× - ÓÔŇÁÎÎĎ ŢÔĎ ĎÎĎ ×ĎĎÂÝĹ ŇÁÂĎÔÁĹÔ, ÄĎĚÖÎĎ ×ÓŁ ×
zonelimit'Ĺ ×ÉÓĹÔŘ ÂĹÓĐŇĎÂŐÄÎĎ.

Maxim Dounin

_______________________________________________
nginx-ru mailing list
nginx-ru@xxxxxxxxx
http://nginx.org/mailman/listinfo/nginx-ru

Re: ÍĚŃ ÁÔÁËÁ =(