系统日志 time wait、__ratelimit、 SYN flooding含义

服务var/log/messages出现几种日志：

kernel: TCP: time wait bucket table overflow

kernel: __ratelimit: 5400 callbacks suppressed

kernel: possible SYN flooding on port 80. Sending cookies.

根据网上部分资料：

kernel: TCP: time wait bucket table overflow

是因为net.ipv4.tcp_max_tw_buckets过小导致。调整/etc/sysctl.conf中net.ipv4.tcp_max_tw_buckets值。

kernel: __ratelimit: 5400 callbacks suppressed

是因为kernel: TCP: time wait bucket table overflow错误过多导致。

含义是：限制了一些系统日志输出。避免加载日志路径。这里的5400条就已经很多了，也说明系统log信息太多导致，需要注意。

可以参见：

'net_ratelimit()' is used to limit syslog messages from kernel.
This "callbacks suppressed" message implies it suppressed a bulk of 44 syslog messages.
This is an attempt to avoid loading your syslog logging path.

Here is the source reference if you are interested,
FreeBSD/Linux Kernel Cross Reference; sys/net/core/utils.c,
It calls sys/lib/ratelimit.c -- ___ratelimit()

以及

int ___ratelimit(struct ratelimit_state *rs, const char *func)
{
         unsigned long flags;
            int ret;
    
            if (!rs->interval)
                    return 1;
    
            /*
             * If we contend on this state's lock then almost
             * by definition we are too busy to print a message,
             * in addition to the one that will be printed by
             * the entity that is holding the lock already:
             */
            if (!raw_spin_trylock_irqsave(&rs->lock, flags))
                    return 0;
    
            if (!rs->begin)
                    rs->begin = jiffies;
    
            if (time_is_before_jiffies(rs->begin + rs->interval)) {
                    if (rs->missed)
                            printk(KERN_WARNING "%s: %d callbacks suppressed\n",
                                    func, rs->missed);
                    rs->begin   = 0;
                    rs->printed = 0;
                    rs->missed  = 0;
            }

 

参考资料：

http://serverfault.com/questions/277009/what-does-net-ratelimit-44-callbacks-suppressed-mean-on-a-linux-based-router

http://fxr.watson.org/fxr/source/lib/ratelimit.c?v=linux-2.6

http://lxr.oss.org.cn/source/lib/ratelimit.c?v=2.6.30

转载于:https://www.cnblogs.com/magic-xiao/p/3664097.html