目录
修改完文件配置文件
nginx -t
nginx -s reload
nginx并发优化
auto 会根据cpu核心数分配
processes 2; //最多开启8个,将其设置为可用的CPU内核数将是一个好的开始
cpu_affinity 01 10; //cpu有多少个核，就有几位数，1代表内核开启，0代表内核关闭
cpu_affinity : 01 10; 0001 0010 0100 1000
use epoll; //使用epoll模型
修改用户进程可打开文件数限制
/etc/security/limits.conf
nginx - nofile 65535
Linux系统级的最大打开文件数限制
fs.file-max = 188414 //和内存容量相关
修改网络内核对TCP连接的有关限制
net.ipv4.ip_local_port_range = 1024 65535
限制接收新 TCP 连接侦听队列的大小
net.core.somaxconn = 2048
启用tcp连接timewait快速回收和重用
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_tw_reuse = 1
nginx均衡实现负载
[root@server1 conf]# /usr/local/openresty/nginx/sbin/nginx -s stop
[root@server1 conf]# systemctl start nginx
[root@server1 conf]# vim nginx.conf
[root@server1 conf]# nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@server1 conf]# nginx -s reload
二三主机上，安装httpd，进行测试
1 yum install httpd -y
2 systemctl disable --now firewalld.service
3 setenforce 0
4 echo server2 > /var/www/html/index.html # server3页面是server3
5 cat /var/www/html/index.html
6 systemctl start httpd
测试
[root@foundation10 images]# curl 172.25.10.1
server2
[root@foundation10 images]# curl 172.25.10.1
server3
[root@foundation10 images]# curl 172.25.10.1
server2
[root@foundation10 images]# curl 172.25.10.1
server3
nginx 平滑更新
下载nginx新版本软件，正常执行
要与前面的编译对应
./configure --prefix=/usr/local/nginx --with-http_ssl_module --with-http_stub_status_module
和make 但不要执行make install
[root@server1 nginx-1.19.1]# nginx -v
nginx version: nginx/1.18.0
备份原程序：拷贝新程序：
[root@server1 nginx-1.19.1]# cd /usr/local/nginx/sbin/
[root@server1 sbin]# ls
nginx
[root@server1 sbin]# mv nginx nginx.old
[root@server1 sbin]# ls
nginx.old
[root@server1 ~]# cp nginx-1.19.1/objs/nginx /usr/local/nginx/sbin/
[root@server1 sbin]# ls
nginx nginx.old
- 获取当前nginx主进程pid：
ps ax|grep nginx - 升级新程序：
kill -USR2 17646 - 关闭原worker进程但保留主进程：为了回退
kill -WINCH 17646
版本回退：
- 还原nginx程序：
[root@server1 sbin]# mv nginx nginx.new
[root@server1 sbin]# ls
nginx.new nginx.old
[root@server1 sbin]# mv nginx.old nginx
- 唤醒原进程：# kill -HUP 17646
- 回收新版本的worker进程： kill -WINCH 22457
- 关闭新版本主进程： kill -QUIT 22457
nginx 配置
配置虚拟主机
localhost www.westos.org www.linux.org
访问不同配置
[root@server1 conf]# pwd
/usr/local/nginx/conf
[root@server1 conf]# cat nginx.conf
user nginx nginx;
#user nobody;
worker_processes 2;
worker_cpu_affinity 01 10;
#error_log logs/error.log;
#error_log logs/error.log notice;
#error_log logs/error.log info;
#pid logs/nginx.pid;
events {
use epoll;
worker_connections 1024;
}
http {
upstream westos {
server 172.25.10.2:80;
server 172.25.10.3:80;
}
include mime.types;
default_type application/octet-stream;
#log_format main '$remote_addr - $remote_user [$time_local] "$request" '
# '$status $body_bytes_sent "$http_referer" '
# '"$http_user_agent" "$http_x_forwarded_for"';
#access_log logs/access.log main;
sendfile on;
#tcp_nopush on;
#keepalive_timeout 0;
keepalive_timeout 65;
#gzip on;
server {
listen 80;
server_name localhost;
#charset koi8-r;
#access_log logs/host.access.log main;
location / {
root html;
index index.html index.htm;
}
# location / {
# proxy_pass http://westos;
# }
#error_page 404 /404.html;
# redirect server error pages to the static page /50x.html
#
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
# proxy the PHP scripts to Apache listening on 127.0.0.1:80
#
#location ~ \.php$ {
# proxy_pass http://127.0.0.1;
#}
# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
#
location ~ \.php$ {
root html;
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
#fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
include fastcgi.conf;
}
# deny access to .htaccess files, if Apache's document root
# concurs with nginx's one
#
#location ~ /\.ht {
# deny all;
#}
}
# another virtual host using mix of IP-, name-, and port-based configuration
#
#server {
# listen 8000;
# listen somename:8080;
# server_name somename alias another.alias;
# location / {
# root html;
# index index.html index.htm;
# }
#}
# HTTPS server
#
server {
listen 443 ssl;
server_name localhost;
ssl_certificate cert.pem;
ssl_certificate_key cert.pem;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
location / {
root html;
index index.html index.htm;
}
}
server {
listen 80;
server_name www.westos.org;
location / {
proxy_pass http://westos;
}
}
server {
listen 80;
server_name www.linux.org;
location / {
root /web1;
index index.html;
}
}
}
[root@server1 conf]# cd /etc/pki/tls/certs/
[root@server1 certs]# pwd
/etc/pki/tls/certs
[root@server1 certs]# ls
ca-bundle.crt ca-bundle.trust.crt make-dummy-cert Makefile renew-dummy-cert
[root@server1 certs]# make cert.pem
umask 77 ; \
PEM1=`/bin/mktemp /tmp/openssl.XXXXXX` ; \
PEM2=`/bin/mktemp /tmp/openssl.XXXXXX` ; \
/usr/bin/openssl req -utf8 -newkey rsa:2048 -keyout $PEM1 -nodes -x509 -days 365 -out $PEM2 ; \
cat $PEM1 > cert.pem ; \
echo "" >> cert.pem ; \
cat $PEM2 >> cert.pem ; \
rm -f $PEM1 $PEM2
Generating a 2048 bit RSA private key
.....................+++
..........................................+++
writing new private key to '/tmp/openssl.2H0vJ9'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:shaanxi
Locality Name (eg, city) [Default City]:xi'an
Organization Name (eg, company) [Default Company Ltd]:westos
Organizational Unit Name (eg, section) []:linux
Common Name (eg, your name or your server's hostname) []:server1
Email Address []:root@westos.org
[root@server1 certs]# ls
ca-bundle.crt cert.pem Makefile
ca-bundle.trust.crt make-dummy-cert renew-dummy-cert
[root@server1 certs]#mv cert.pem /usr/local/nginx/conf/
[root@server1 conf]# mkdir /web1
[root@server1 conf]# echo server1 > /web1/index.html
nginx -t
nginx -s reload
[root@foundation10 ~] cat /etc/hosts
172.25.10.1 server1 www.westos.org www.linux.org
[root@foundation10 ~]# curl www.westos.org
server3
[root@foundation10 ~]# curl www.westos.org
server2
[root@foundation10 ~]# curl www.westos.org
server2
[root@foundation10 ~]# curl www.linux.org
\server2
sticky;
基于cookie来进行负载转发，保证将来自同一cookie的访问始终定向到同一服务器响应
unzip nginx-goodies-nginx-sticky-module-ng-08a395c66e42.zip
重新编译
[root@server1 ~]# cd nginx-1.18.0/
[root@server1 nginx-1.18.0]# ls
auto CHANGES CHANGES.ru conf configure contrib html LICENSE Makefile man objs README src
[root@server1 nginx-1.18.0]# make clean
rm -rf Makefile objs
[root@server1 nginx-1.18.0]# ./configure --prefix=/usr/local/nginx --with-http_ssl_module --with-http_stub_status_module --add-dynamic-module=/root/nginx-goodies-nginx-sticky-module-ng-08a395c66e42
[root@server1 nginx-1.18.0]# make
[root@server1 nginx-1.18.0]# cd objs/
[root@server1 objs]# ls
addon Makefile nginx.8 ngx_auto_headers.h ngx_modules.o
autoconf.err nginx ngx_auto_config.h ngx_modules.c src
[root@server1 objs]# nginx -s stop
[root@server1 objs]# cp nginx /usr/local/nginx/sbin/nginx
[root@server1 objs]# cd -
/usr/local/nginx/sbin
[root@server1 sbin]# ls
nginx nginx.new nginx.old
[root@server1 sbin]# nginx -v
nginx version: nginx/1.18.0
[root@server1 conf]# pwd
/usr/local/nginx/conf
[root@server1 conf]# vim nginx.conf
http {
upstream westos {
sticky;
server 172.25.10.2:80;
server 172.25.10.3:80;
}
[root@server1 conf]# nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@server1 conf]# nginx -s reload
server3也可以调度到，但会一直显示server2
nginx限流
vim /usr/local/nginx/conf/nginx.conf
http {
upstream westos {
sticky;
server 172.25.10.2:80;
server 172.25.10.3:80;
}
........
41 limit_conn_zone $binary_remote_addr zone=addr:10m;
//$binary_remote_addr 表示通过remote_addr这个标识来做限制
//zone=addr:10m 表示生成一个大小为10M，名字为addr的内存区域
server {
.....
50 location /download/ {
51 limit_conn addr 1; #限制并发数
imit_rate 50k; #限制带宽
设置并发数量。当超过并发数量时，会失败
[root@server1 html]# mkdir download
[root@server1 html]# cd download/
[root@server1 download]# pwd
/usr/local/nginx/html/download
[root@server1 download]# ls
vim.jpg ##400k
imit_rate 50k; #限制带宽
需要8秒的处理时间``
[root@foundation10 mnt]# ab -c1 -n1 http://172.25.10.1/download/vim.jpg
This is ApacheBench, Version 2.3 <$Revision: 1843412 $>
Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Licensed to The Apache Software Foundation, http://www.apache.org/
Benchmarking 172.25.10.1 (be patient).....done
Server Software: nginx/1.18.0
Server Hostname: 172.25.10.1
Server Port: 80
Document Path: /download/vim.jpg
Document Length: 453575 bytes
Concurrency Level: 1
Time taken for tests: 8.014 seconds
Complete requests: 1
Failed requests: 0
限制单位时间内的请求数目,以及速度限制：
burst 让其等待，不等待则之后只能处理一个
nodelay : 没进入消息队列的不处理
http {
limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;
//rate=1r/s表示允许相同标识的客户端的访问频次，这里限制的是每秒1次
server {
location /download/ {
limit_conn addr 1;
#limit_rate 50k;
limit_req zone=one burst=5 nodelay;
}
}
}
limit_req zone=one
只能处理一个
limit_req zone=one burst=5
让没处理的先待在消息队列等待处理，直至全部处理
limit_req zone=one burst=5 nodelay; 一个正在处理，等5个，设置的加压处理的个数总数为10个，所有还有4个并未被处理
nginx配置管理
自动索引：下载方便
location /download/ {
..........
autoindex on;
}
Nginx expire缓存配置: 缓存可以降低网站带宽，加速用户访问
location /download/ {
........}
location ~ .*\.(gif|jpg|png)$ {
expires 365d;
root html;
}
[root@foundation10 mnt]# curl -I http://172.25.10.1/download/vim.jpg
HTTP/1.1 200 OK
Server: nginx/1.18.0
Date: Sun, 04 Apr 2021 05:00:24 GMT
Content-Type: image/jpeg
Content-Length: 453575
Last-Modified: Sun, 04 Apr 2021 02:13:58 GMT
日志轮询：
[root@server1 opt]# vim nginx_log.sh
# cat nginxlog.sh
#!/bin/bash
cd /usr/local/nginx/logs && mv access.log access_$(date +%F -d -1day).log
kill -USR1 `cat /usr/local/nginx/logs/nginx.pid`
[root@server1 opt]# chmod +x nginx_log.sh
[root@server1 opt]# ./nginx_log.sh
[root@server1 opt]# cd /usr/local/nginx/logs/
[root@server1 logs]# ll
total 80
-rw-r--r--. 1 root root 53745 Apr 4 13:00 access_2021-04-03.log
-rw-r--r--. 1 nginx root 0 Apr 4 13:05 access.log
-rw-r--r--. 1 nginx root 15939 Apr 4 12:59 error.log
-rw-r--r--. 1 root root 5 Apr 4 09:00 nginx.pid
-rw-r--r--. 1 root root 6 Apr 3 15:23 nginx.pid.oldbin
- 再加入crontab定时任务
00 00 * * * /opt/scripts/nginxlog.sh &> /dev/null - 为了安全，日志目录不需要给你nginx用户访问权限
chmod -R 700 /usr/local/nginx/logs
禁用不必要的日志记录，以节省磁盘IO的消耗
location ~ .*.(js|jpg|jpeg|png|css|bmp|gif)$ {
access_log off;
}
location /download/ {
limit_conn addr 1;
#limit_rate 50k;
limit_req zone=one burst=5 nodelay;
autoindex on;
}
location ~ .*\.(gif|jpg|png)$ {
expires 365d;
root html;
access_log off;
}
curl -I http://172.25.10.1/download/vim.jpg 访问的时候，access.log不计入
- 站点目录和文件的限制
location ~ ^/images/.*.(sh|php)$ {
deny all;
}
解决中文乱码
charset utf-8;
写入http{
}中
限制IP
location /download {
deny 172.25.10.10;
allow 172.25.10.0/24;
deny all;
}
if ($remote_addr = 172.25.10.254) {
return 403;
}
nginx 重定向
防止域名恶意解析到服务器IP:
server {
listen 80;
server_name localhost;
return 500;
}
重定向：
server {
listen 80;
server_name localhost;
rewrite ^(.*) http://www.westos.org permanent;
}
[root@foundation10 mnt]# curl -I 172.25.10.1
HTTP/1.1 301 Moved Permanently
Server: nginx/1.18.0
Date: Sun, 04 Apr 2021 05:22:10 GMT
Content-Type: text/html
Content-Length: 169
Connection: keep-alive
Location: http://www.westos.org
80重定向443:
#打开文件的ssl ``文件见前文``
server {
listen 80;
server_name www.westos.org;
rewrite ^/(.*)$ https://www.westos.org/$1 permanent;
}
www.westos.org------->https://www.westos.org
www.westos.org/bbs 重定向bbs.westos.org:
rewrite ^/bbs$ http://bbs.westos.org permanent;
rewrite ^/bbs/(.*)$ http://bbs.westos.org/$1 permanent; ##www.linux.org/bbs/index.html 也可以重定向
server {
listen 80;
server_name www.linux.org;
rewrite ^/bbs$ http://bbs.linux.org permanent;
location / {
root /web1;
index index.html;
}
}
server {
listen 80;
server_name bbs.linux.org;
location / {
root /bbs;
index index.html;
}
}
[root@server1 ~]# cat /web1/index.html
www.linux.org
[root@server1 ~]# cat /bbs/index.html
bbs.linux.org
[root@foundation10 mnt]# curl -I www.linux.org/bbs
HTTP/1.1 301 Moved Permanently
Server: nginx/1.18.0
Date: Sun, 04 Apr 2021 05:38:35 GMT
Content-Type: text/html
Content-Length: 169
Connection: keep-alive
Location: http://bbs.linux.org
bbs.westos.org 重定向www.westos.org/bbs:
if ($host = "bbs.westos.org"){
rewrite ^/(.*)$ http://www.westos.org/bbs/$1 permanent;
}
server {
listen 80;
server_name www.linux.org bbs.linux.org;
#rewrite ^/bbs$ http://bbs.linux.org permanent;
if ($host = "bbs.linux.org"){
rewrite ^/(.*)$ http://www.linux.org/bbs/$1 permanent;
}
location / {
root /web1;
index index.html;
}
}
#server {
# listen 80;
# server_name bbs.linux.org;
#
# location / {
# root /bbs;
# index index.html;
# }
#}
[root@server1 bbs]# cd -
/web1
[root@server1 web1]# mv /bbs/ .
[root@server1 web1]# ls
bbs index.html
[root@foundation10 ~]# curl -I bbs.linux.org
HTTP/1.1 301 Moved Permanently
Server: nginx/1.18.0
Date: Sun, 04 Apr 2021 05:53:19 GMT
Content-Type: text/html
Content-Length: 169
Connection: keep-alive
Location: http://www.linux.org/bbs/
nginx 防盗链
server {
listen 80;
server_name www.westos.org;
location ~ \.(jpg|png)$ {
valid_referers none blocked www.westos.org;
if ($invalid_referer) {
#return 403;
rewrite ^/ http://172.25.10.3/daolian.jpg;
}
}
}
访问172.25.10.2时，直接访问的是index.html文件里面定义的地址http://www.westos.org/download/vim.jpg",在172.25.10.1主机里面nginx的配置文件里面定义的是定向到3主机的daolian.jpg
[root@sever2 ~]# cd /var/www/html/
[root@sever2 html]# ls
index.html
[root@sever2 html]# vim index.html
[root@sever2 html]# cat index.html
<body>
<img src="http://www.westos.org/download/vim.jpg"/>
</body>
[root@server3 ~]# cd /var/www/html/
[root@server3 html]# ls
daolian.jpg index.html
[root@server3 html]# ls
daolian.jpg index.html
goaccess 日志可视化
软件安装：
# wget https://tar.goaccess.io/goaccess-1.4.tar.gz
# tar -xzvf goaccess-1.4.tar.gz
# cd goaccess-1.4/
# ./configure --enable-utf8 --enable-geoip=legacy
# make
# make install
软件使用：
# goaccess access.log -o /usr/local/nginx/html/report.html --log-format=COMBINED --real-time-html
tomcat结合memcache
server2和server3安装tomcat
rpm -ivh jdk-8u121-linux-x64.rpm
10 tar zxf apache-tomcat-7.0.37.tar.gz
11 ls
12 mv apache-tomcat-7.0.37 /usr/local/tomcat
13 cd /usr/local/tomcat/
14 ls
15 bin/startup.sh
[root@foundation10 mnt]# scp test.jsp root@172.25.10.2:/usr/local/tomcat/webapps/ROOT/
root@172.25.10.2's password:
test.jsp 100% 968 1.5MB/s 00:00
[root@foundation10 mnt]# scp test.jsp root@172.25.10.3:/usr/local/tomcat/webapps/ROOT/
root@172.25.10.3's password:
test.jsp 100% 968 1.4MB/s 00:00
[root@foundation10 mnt]#
http {
upstream westos {
sticky;
server 172.25.10.2:80;
server 172.25.10.3:80;
}
upstream tomcat{
sticky;
server 172.25.10.2:8080;
server 172.25.10.3:8080;
}
location ~ \.jsp$ {
proxy_pass http://tomcat;
}
当server2挂掉时，会接管到server3，但数据丢失
交叉存储
在2,3上做同样操作
yum install memcached -y
systemctl enable --now memcached.service
拷贝jar包到/usr/local/tomcat/lib目录：
[root@foundation10 jar]# ls
asm-3.2.jar minlog-1.2.jar
kryo-1.04.jar msm-kryo-serializer-1.6.3.jar
kryo-serializers-0.10.jar reflectasm-1.01.jar
memcached-session-manager-1.6.3.jar spymemcached-2.7.3.jar
memcached-session-manager-tc7-1.6.3.jar
[root@foundation10 jar]# scp * root@172.25.10.2:/usr/local/tomcat/lib/
配置tomcat
vim /usr/local/tomcat/conf/context.xml
server2
<Manager className="de.javakaffee.web.msm.MemcachedBackupSessionManager"
memcachedNodes="n1:172.25.10.2:11211,n2:172.25.10.3:11211"
failoverNodes="n1"
requestUriIgnorePattern=".*\.(ico|png|gif|jpg|css|js)$"
transcoderFactoryClass="de.javakaffee.web.msm.serializer.kryo.KryoTranscoderFactory"
/>
server3
<Manager className="de.javakaffee.web.msm.MemcachedBackupSessionManager"
memcachedNodes="n1:172.25.10.2:11211,n2:172.25.10.3:11211"
failoverNodes="n2"
requestUriIgnorePattern=".*\.(ico|png|gif|jpg|css|js)$"
transcoderFactoryClass="de.javakaffee.web.msm.serializer.kryo.KryoTranscoderFactory"
/>
[root@sever2 tomcat]# bin/shutdown.sh
Using CATALINA_BASE: /usr/local/tomcat
Using CATALINA_HOME: /usr/local/tomcat
Using CATALINA_TMPDIR: /usr/local/tomcat/temp
Using JRE_HOME: /usr
Using CLASSPATH: /usr/local/tomcat/bin/bootstrap.jar:/usr/local/tomcat/bin/tomcat-juli.jar
[root@sever2 tomcat]# bin/startup.sh
Using CATALINA_BASE: /usr/local/tomcat
Using CATALINA_HOME: /usr/local/tomcat
Using CATALINA_TMPDIR: /usr/local/tomcat/temp
Using JRE_HOME: /usr
Using CLASSPATH: /usr/local/tomcat/bin/bootstrap.jar:/usr/local/tomcat/bin/tomcat-juli.jar
重新加载
当2shutdown 后数据不消失
2的数据存储到3中，3的数据存储到3上，当2挂掉时，2的数据并不会消失
3764
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
