281

CentOS7重新编译内核优化TIME_WAIT数量

 7 years ago
source link: https://zhuanlan.zhihu.com/p/32386693?
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
neoserver,ios ssh client

CentOS7重新编译内核优化TIME_WAIT数量

上一篇写了LB方案，上线后发现四层Nginx的TIME_WAIT居高不下，本地端口很快被用完，用完后本地将无法像后端机器建立TCP连接。一般处理TIME_WAIT数量过多的方法主要有以下几种：

  • 增加local_port_range ，增大可用端口数量
  • 限制tw_buckets的最大数量
  • 打开recycle，此选项慎重
  • 重新编译内核，修改TIME_WAIT值为5秒

本文主要来说一下最后一种方法是如何操作及效果，以CentOS 7.4为例：

1.安装所需要的模块：

yum install rpm-build.x86_64 \
redhat-rpm-config.noarch \
patchutils.x86_64 \
elfutils-libelf-devel.x86_64 \
binutils-devel.x86_64 \
hmaccalc.x86_64 \
rng-tools.x86_64

2.下载src.rpm包

wget http://vault.centos.org/7.4.1708/os/Source/SPackages/kernel-3.10.0-693.el7.src.rpm
rpm -ivh kernel-2.6.32-71.29.1.el6.src.rpm

3.创建补丁

cd ~/rpmbuild/SPECS
rpmbuild -bp kernel.spec
cd ~/rpmbuild/BUILD
cp -r kernel-3.10.0-693.el7 kernel-3.10.0-693.el7.org
cp -r kernel-3.10.0-693.el7 kernel-3.10.0-693.el7.new
#创建pgp密钥
rngd -r /dev/urandom
gpg --homedir . --batch --gen-key /root/rpmbuild/SOURCES/genkey
#修改tcp.h文件
vim kernel-3.10.0-693.el7.new/linux-3.10.0-693.el7.centos.x86_64/include/net/tcp.h 
修正前
#define TCP_TIMEWAIT_LEN (60*HZ) /* how long to wait to destroy TIME-WAIT
修正後
#define TCP_TIMEWAIT_LEN (5*HZ) /* how long to wait to destroy TIME-WAIT
#创建一个补丁
diff -uNrp kernel-3.10.0-693.el7.org/ kernel-3.10.0-693.el7.new/ > ../SOURCES/tcph.patch
cd ~/rpmbuild/SPECS
vi kernel.spec
修改前
# %define buildid .local
修改后
%define buildid .tcp5
# empty final patch file to facilitate testing of kernel patches
Patch00: tcph.patch　　←追加
Patch999999: linux-kernel-test.patch
ApplyOptionalPatch tcph.patch　　←追加
ApplyOptionalPatch linux-kernel-test.patch

5.构建新内核

rpmbuild -ba kernel.spec

6.内核更新

cd ~/rpmbuild/RPMS/x86_64
rpm -Uvh --force kernel-3.10.0-693.el7.centos.tcp5.x86_64.rpm

7. TIME_WAIT确认

1秒间隔
watch -n 1 "netstat -a | grep http"
5秒后断开

8.效果监控图

v2-7cfc36e6d2f65cb2b0af8c5e542f0af0_720w.webp




report

Recommend

About Joyk


Aggregate valuable and interesting links.
Joyk means Joy of geeK