Skip to content

使用HAProxy给MySQL slave群进行负载均衡和状态监控

blog_haproxy

一.安装haproxy

haproxy机器 http://haproxy.1wt.deu 需翻墙

tar zxvf haproxy-1.4.25.tar.gz cd haproxy-1.4.25 make TARGET=linux26 make install mkdir -p /usr/local/haproxy/ chown nobody:nobody /usr/local/haproxy/ mkdir /etc/haproxy/ cp examples/haproxy.cfg /etc/haproxy/ cp examples/haproxy.init /etc/init.d/haproxy chown root:root /etc/init.d/haproxy chmod 700 /etc/init.d/haproxy

修改haproxy启动脚本

/usr/sbin/$BASENAME 改成 /usr/local/sbin/$BASENAME

sed -i -r ‘s|/usr/sbin|/usr/local/sbin|’ /etc/init.d/haproxy

编辑配置文件 vi /etc/haproxy/haproxy.cfg

global #log 127.0.0.1 local0 log 127.0.0.1 local3 info #log loghost local0 info maxconn 4096 chroot /usr/local/haproxy uid nobody gid nobody daemon debug #quiet defaults log global mode tcp #option httplog option dontlognull retries 3 option redispatch maxconn 2000 contimeout 5000 clitimeout 50000 srvtimeout 50000 frontend mysql bind 192.168.0.107:3306 maxconn 3000 default_backend mysql_slave backend mysql_slave #cookie SERVERID rewrite mode tcp balance roundrobin #balance source #balance leastconn contimeout 10s timeout check 2s option httpchk OPTIONS * HTTP/1.1\r\nHost:\ www server mysql_192_168_0_104_3306 192.168.0.104:3306 weight 1 check port 9300 inter 5s rise 2 fall 3 server mysql_192_168_0_104_3307 192.168.0.104:3307 weight 1 check port 9301 inter 5s rise 2 fall 3 #server mysql_192_168_0_106_3306 192.168.0.106:3306 weight 1 check port 9300 inter 5s rise 2 fall 3 listen admin_status mode http bind 192.168.0.107:8000 option httplog log global stats enable stats refresh 30s stats hide-version stats realm Haproxy\ Statistics stats uri /admin-status stats auth admin:123456 stats admin if TRUE

打开监控的iptables

iptables -A INPUT -p tcp -m tcp -s 192.168.0.0/24 –dport 8000 -j ACCEPT

添加自启动并启动haproxy服务

chkconfig –add haproxy chkconfig haproxy on service haproxy start

被监控机上

我这里是单机双实例,所以有2个脚本,单机只需一个脚本和一个服务端口就行 编辑mysql检测3306脚本 vi /opt/shell/mysqlchk_status_3306.sh

#!/bin/bash # # /usr/local/bin/mysqlchk_status.sh # # This script checks if a mysql server is healthy running on localhost. It will # return: # # “HTTP/1.x 200 OK\r” (if mysql is running smoothly) # # – OR – # # “HTTP/1.x 503 Internal Server Error\r” (else) # MYSQL_HOST=”localhost” MYSQL_PORT=”3306″ MYSQL_USERNAME=”mysqlcheck” MYSQL_PASSWORD=”paSSword” MYSQL_PATH=”/opt/mysql/bin/” # # We perform a simple query that should return a few results #${MYSQL_PATH}mysql -h${MYSQL_HOST} -P${MYSQL_PORT} -u${MYSQL_USERNAME} -p${MYSQL_PASSWORD} -e “show slave status\G;” >/tmp/rep${MYSQL_PORT}.txt ${MYSQL_PATH}mysql -h${MYSQL_HOST} -P${MYSQL_PORT} -u${MYSQL_USERNAME} -p${MYSQL_PASSWORD} -e “show full processlist;” >/tmp/processlist${MYSQL_PORT}.txt ${MYSQL_PATH}mysql -h${MYSQL_HOST} -P${MYSQL_PORT} -u${MYSQL_USERNAME} -p${MYSQL_PASSWORD} -e “show slave status\G;” >/tmp/rep${MYSQL_PORT}.txt iostat=`grep “Slave_IO_Running” /tmp/rep${MYSQL_PORT}.txt |awk ‘{print $2}’` sqlstat=`grep “Slave_SQL_Running” /tmp/rep${MYSQL_PORT}.txt |awk ‘{print $2}’` result=$(cat /tmp/processlist${MYSQL_PORT}.txt|wc -l) echo iostat:$iostat and sqlstat:$sqlstat # if slave_IO_Running and Slave_sql_Running ok,then return 200 code if [ “$result” -gt “3” ] && [ “$iostat” = “Yes” ] && [ “$sqlstat” = “Yes” ]; then # mysql is fine, return http 200 /bin/echo -e “HTTP/1.1 200 OK\r\n” else # mysql is down, return http 503 /bin/echo -e “HTTP/1.1 503 Service Unavailable\r\n” fi

vi /opt/shell/mysqlchk_status_3307.sh

#!/bin/bash # # /usr/local/bin/mysqlchk_status.sh # # This script checks if a mysql server is healthy running on localhost. It will # return: # # “HTTP/1.x 200 OK\r” (if mysql is running smoothly) # # – OR – # # “HTTP/1.x 503 Internal Server Error\r” (else) # MYSQL_HOST=”localhost” MYSQL_PORT=”3307″ MYSQL_USERNAME=”mysqlcheck” MYSQL_PASSWORD=”paSSword” MYSQL_PATH=”/opt/mysql/bin/” # # We perform a simple query that should return a few results #${MYSQL_PATH}mysql -h${MYSQL_HOST} -P${MYSQL_PORT} -u${MYSQL_USERNAME} -p${MYSQL_PASSWORD} -e “show slave status\G;” >/tmp/rep${MYSQL_PORT}.txt ${MYSQL_PATH}mysql -S/data/mysql/mysql.sock -u${MYSQL_USERNAME} -p${MYSQL_PASSWORD} -e “show full processlist;” >/tmp/processlist${MYSQL_PORT}.txt ${MYSQL_PATH}mysql -S/data/mysql/mysql.sock -u${MYSQL_USERNAME} -p${MYSQL_PASSWORD} -e “show slave status\G;” >/tmp/rep${MYSQL_PORT}.txt iostat=`grep “Slave_IO_Running” /tmp/rep${MYSQL_PORT}.txt |awk ‘{print $2}’` sqlstat=`grep “Slave_SQL_Running” /tmp/rep${MYSQL_PORT}.txt |awk ‘{print $2}’` result=$(cat /tmp/processlist${MYSQL_PORT}.txt|wc -l) #echo iostat:$iostat and sqlstat:$sqlstat echo $result # if slave_IO_Running and Slave_sql_Running ok,then return 200 code if [ “$result” -gt “3” ] && [ “$iostat” = “Yes” ] && [ “$sqlstat” = “Yes” ]; then # mysql is fine, return http 200 /bin/echo -e “HTTP/1.1 200 OK\r\n” else # mysql is down, return http 503 /bin/echo -e “HTTP/1.1 503 Service Unavailable\r\n” fi

chmod 775 /opt/shell/mysqlchk_status_3306.sh chmod 775 /opt/shell/mysqlchk_status_3307.sh

在mysql slave另行建立一个具有process和slave_client权限的账号。

CREATE USER ‘mysqlcheck’@’localhost’ IDENTIFIED BY ‘PaSSword’; GRANT PROCESS , REPLICATION CLIENT ON * . * TO ‘mysqlcheck’@’localhost’ IDENTIFIED BY ‘PaSSword’ WITH MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 MAX_USER_CONNECTIONS 0 ; flush privileges;

测试脚本 ./mysqlchk_status_3306.sh

添加服务 绑定内网ip,运行于930端口,只开放给192.168.0内网 yum install -y xinetd vim /etc/xinetd.d/mysql_status

service mysqlchk_status3306 { flags = REUSE socket_type = stream bind = 192.168.0.104 port = 9300 wait = no user = nobody server = /opt/shell/mysqlchk_status_3306.sh log_type = FILE /dev/null log_on_failure += USERID disable = no only_from = 192.168.0.0/24 } service mysqlchk_status3307 { flags = REUSE socket_type = stream bind = 192.168.0.104 port = 9301 wait = no user = nobody server = /opt/shell/mysqlchk_status_3307.sh log_type = FILE /dev/null log_on_failure += USERID disable = no only_from = 192.168.0.0/24 }

bind和only_from的ip地址要有haproxy能请求的权限,使用drbd用0.0.0.0 user要用server脚本的执行权限 port端口要在/etc/service 中声明

chattr -i /etc/services vi /etc/services

mysqlchk_status3306 9300/tcp #haproxy mysql check mysqlchk_status3307 9301/tcp #haproxy mysql check

services中的mysqlchk_status3306 要和xinetd.d中service名对应

打开iptables

iptables -A INPUT -p tcp -m tcp -s 192.168.0.0/24 –dport 9300 -j ACCEPT iptables -A INPUT -p tcp -m tcp -s 192.168.0.0/24 –dport 9301 -j ACCEPT

/etc/init.d/iptables save

添加自启动及启动服务 chkconfig xinetd –level 345 on /etc/init.d/xinetd start

查看是否运行 netstat -lntp

Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:9300 0.0.0.0:* LISTEN 4863/xinetd tcp 0 0 0.0.0.0:9301 0.0.0.0:* LISTEN 4863/xinetd

如果没有的话注意检测下bind地址及服务端口

在监控机运行测试 telnet 192.168.0.104 9300

Trying 192.168.0.104… Connected to 192.168.0.104 (192.168.0.104). Escape character is ‘^]’. /opt/shell/mysqlchk_status_3306.sh: line 24: /tmp/processlist3306.txt: Permission denied /opt/shell/mysqlchk_status_3306.sh: line 25: /tmp/rep3306.txt: Permission denied HTTP/1.1 200 OK Connection closed by foreign host.

之前用root运行过所以报错,在被监控机删除临时文件

rm -f /tmp/processlist3306.txt /tmp/processlist3307.txt rm -f /tmp/rep3306.txt /tmp/rep3307.txt

没有输出则需检查mysqlchk_status_3306.sh脚本执行权限

启动后/var/log/messages 中会有很多日志

Oct 23 14:37:00 lova xinetd[11057]: START: mysqlchk_status3306 pid=11464 from=192.168.0.22 Oct 23 14:37:00 lova xinetd[11057]: EXIT: mysqlchk_status3306 status=0 pid=11464 duration=0(sec) Oct 23 14:37:05 lova xinetd[11057]: START: mysqlchk_status3306 pid=11494 from=192.168.0.22 Oct 23 14:37:05 lova xinetd[11057]: EXIT: mysqlchk_status3306 status=0 pid=11494 duration=0(sec)

在haproxy配置中将日志输出到黑洞 log_type = FILE /dev/null

查看监控

直接访问localhost是503 http://localhost/ 503 Service Unavailable

No server is available to handle this request.

加上admin-status http://localhost/admin-status

应用时需在slave mysql上的mysql添加通过haproxy的用户权限

haproxy的命令 /etc/init.d/haproxy Usage: haproxy {start|stop|restart|reload|condrestart|status|check}

附 优化time_wait,防止端口耗尽 vi /etc/sysctl.conf

net.ipv4.ip_local_port_range = 1025 65000 net.ipv4.tcp_tw_reuse = 1 net.ipv4.tcp_tw_recycle = 1 net.ipv4.tcp_fin_timeout = 15 net.ipv4.tcp_max_tw_buckets = 35000

sysctl -p

使用nginx反向代理haprox后台

#省略 listen admin_status mode http bind 192.168.0.107:8000 option httplog log global stats enable stats refresh 30s stats hide-version stats realm Haproxy\ Statistics #stats uri /admin-status stats uri /haproxy/ #stats auth admin:123456 #stats admin if TRUE

nginx.conf

#省略 location ~* ^/haproxy/ { proxy_pass http://192.168.0.107:8000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; #proxy_set_header X-Forwarded-For $remote_addr; proxy_redirect off; } #省略

参考: http://linux.die.net/man/5/xinetd.conf http://adslroot.blogspot.com/2013/12/haproxy-mysql.html

Posted in haproxy/Atlas, 技术.

Tagged with , , , .

rev="post-1728" No comments

By C1G – 2014/11/07

linux查看和改变网卡工作速率

同一机柜其它机器都在千兆模式但有几台却是百兆,调整速度后还自动降速到百兆. 最后让机房换了网线立马解决问题,数据库的进程排队也降低了

查看网卡信息,网卡支持千兆但工作在百兆. ethtool eth2

Advertised link modes: 10baseT/Half 10baseT/Full 100baseT/Half 100baseT/Full 1000baseT/Full Advertised pause frame use: No Advertised auto-negotiation: Yes Speed: 100Mb/s Duplex: Full

调整到千兆 ethtool -s eth2 speed 1000 duplex full

tail /var/log/messages

Oct 23 10:17:22 C1g kernel: e1000e: eth2 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None Oct 23 10:17:23 C1g kernel: e1000e: eth2 NIC Link is Down Oct 23 10:17:33 C1g kernel: e1000e: eth2 NIC Link is Up 100 Mbps Full Duplex, Flow Control: None Oct 23 10:17:33 C1g kernel: 0000:03:00.1: eth2: 10/100 speed: disabling TSO

又变回到百兆

ethtool备注 ethtool ethX //查询ethX网口基本设置 ethtool –h //显示ethtool的命令帮助(help) ethtool –i ethX //查询ethX网口的相关信息 ethtool –d ethX //查询ethX网口注册性信息 ethtool –r ethX //重置ethX网口到自适应模式 ethtool –S ethX //查询ethX网口收发包统计 ethtool –s ethX [speed 10|100|1000]\ //设置网口速率10/100/1000M [duplex half|full]\ //设置网口半/全双工 [autoneg on|off]\ //设置网口是否自协商

Posted in linux 维护优化.

Tagged with , , .

rev="post-1721" No comments

By C1G – 2014/10/23

禁止微软搜索蜘蛛

禁止微软蜘蛛,爬的太疯狂了,还不带流量… 同时降低频率到60秒间隔. 在web根目录下编辑robots.txt

User-agent: Bingbot Disallow: / User-agent: Adidxbot Disallow: / User-agent: MSNBot Disallow: / User-agent: BingPreview Disallow: / User-agent: * Disallow: Crawl-delay: 60 Disallow: /api/ Disallow: /data/

参考: http://www.bing.com/webmaster/help/which-crawlers-does-bing-use-8c184ec0 http://tool.chinaz.com/robots/

Posted in SEO, 网站建设.

Tagged with , , .

rev="post-1717" No comments

By C1G – 2014/10/23

mysql多列索引使用注意

MySQL可以为多个列创建索引。一个索引可以包括15个列。 CREATE TABLE test ( id INT NOT NULL, cola CHAR(30) NOT NULL, colb CHAR(30) NOT NULL, PRIMARY KEY (id), INDEX name (cola ,colb ) );

select from tables where colb=’2014′; select from tables where cola=’c1g’ or colb=’2014′;

SELECT * from tbltables where keycola LIKE ‘%c1g%’;

select from tables order by cola asc,colb desc; select from tables order by cola desc,colb asc; 以上是用不到索引的

select from tables where cola=’c1g’ select from tables where cola=’c1g’ and colb=’2014′; select from tables where cola=’c1g’ and colb>’2000′ and colb<'2015'; select from tables where cola=’c1g’ and (colb=’2000′ and colb=’2015′);

SELECT * from tbltables where keycola LIKE ‘c1g%’;

select from tables order by cola asc,colb asc; select from tables order by cola desc,colb desc; 以上是可以用到索引的.

用于排序的column的排序顺序必须一致。

Posted in Mysql.

Tagged with .

rev="post-1714" No comments

By C1G – 2014/10/16

mysql连接本地非默认端口

今天需DUMP个本地MYSQL db时遇到的奇怪问题,用mysql_multi起的多实例,连接到localhost时-P端口无效. mysqldump和mysql一样无效

常规连接mysql数据库命令为,没问题 mysql -hlocalhost -uroot -p

连接本地其它端口老是跑到3306去,但是用其它机器加IP是可以连接. mysql -hlocalhost -P3308 -uroot -p

暂时用socket连接解决问题,只导出结构. mysqldump -s/tmp/mysql_3308.sock -uroot -p -d mydb > mydb createdb.sql

Posted in Mysql.

Tagged with .

rev="post-1712" No comments

By C1G – 2014/10/15

OpenSSH SFTP远程溢出漏洞

近日曝出OpenSSH SFTP 远程溢出漏洞。OpenSSH服务器中如果OpenSSH服务器中没有配置”ChrootDirectory”，普通用户就可以访问所有文件系统的资源，包括 /proc，在>=2.6.x的Linux内核上，/proc/self/maps会显示你的内存布局，/proc/self/mem可以让你任意在当前进程上下文中读写，而综合两者特性则可以造成远程溢出。

目前受影响的版本是<=OpenSSH 6.6，安恒信息建议使用该系统的用户尽快升级到最新版本OpenSSH 6.7, OpenSSH 6.7包含了降低风险的方案：sftp-server使用prctl()来阻止直接访问/proc/self/{mem,maps}。Grsecurity/PaX直接禁止了/proc/pid/mem的可写，所以如果您的生产环境中部署了Grsecurity/PaX的话这个漏洞可以不用担心。

OpenSSH 6.7下载地址：

ftp://ftp.openbsd.com/pub/OpenBSD/OpenSSH/portable/openssh-6.7p1.tar.gz

参考信息：

http://seclists.org/fulldisclosure/2014/Oct/35

注：首先你需要有权限登录的用户才能干点事。

Posted in 安全通告.

Tagged with , , .

rev="post-1710" No comments

By C1G – 2014/10/11

曝Bash安全漏洞 比心血还严重 附测试及补救

20140925曝出的来的漏洞,该漏洞对电脑用户构成的威胁可能比今年4月发现的“心脏流血”(Heartbleed)漏洞更大. 网络安全公司Rapid7工程部经理托德·贝尔德斯利(Tod Beardsley)警告称，Bash漏洞的严重级别为“10”，意味着它对用户电脑的威胁最大。Bash漏洞的利用复杂度级别为“低”，意味着黑客可以相对轻松地利用它发动攻击。

测试方法,执行下面命令

$ env x='() { :;}; echo vulnerable’ bash -c “echo this is a test” vulnerable this is a test

出现上面文字侧需要打补丁了.

我试了下centos5.4 5.5 6.0等都有问题 GNU bash, version 3.2.25(1)-release-(x86_64-redhat-linux-gnu) GNU bash, version 4.1.2(1)-release-(x86_64-unknown-linux-gnu)

补救

yum -y update bash

升级后再测

env x='() { :;}; echo vulnerable’ bash -c “echo this is a test” bash: warning: x: ignoring function definition attempt bash: error importing function definition for `x’ this is a test

如上显示就已修复

参考: https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/

Posted in 安全通告.

Tagged with , .

rev="post-1707" No comments

By C1G – 2014/09/25

centos固定多网卡启动顺序

系统插上PCI网卡每次重启后顺序可能都会不同,影响nagios检控准确度.

CentOS6

在CentOS6中，具体网卡的配置文件在/etc/udev/rules.d/70-persistent-net.rules cat /etc/udev/rules.d/70-persistent-net.rules

# PCI device 0x14e4:0x163b (bnx2) (custom name provided by external tool) SUBSYSTEM==”net”, ACTION==”add”, DRIVERS==”?*”, ATTR{address}==”78:2b:cb:xx:xx:02″, ATTR{type}==”1″, KERNEL==”eth*”, NAME=”eth1″ # PCI device 0x14e4:0x163b (bnx2) (custom name provided by external tool) SUBSYSTEM==”net”, ACTION==”add”, DRIVERS==”?*”, ATTR{address}==”78:2b:cb:xx:xx:03″, ATTR{type}==”1″, KERNEL==”eth*”, NAME=”eth2″ # USB device 0x9710:0x7830 (usb) (custom name provided by external tool) SUBSYSTEM==”net”, ACTION==”add”, DRIVERS==”?*”, ATTR{address}==”00:60:6e:xx:xx:f6″, ATTR{type}==”1″, KERNEL==”eth*”, NAME=”eth0″ # PCI device 0x14e4:0x165a (tg3) SUBSYSTEM==”net”, ACTION==”add”, DRIVERS==”?*”, ATTR{address}==”00:10:18:xx:xx:51″, ATTR{type}==”1″, KERNEL==”eth*”, NAME=”eth3″ # PCI device 0x8086:0x10c9 (igb) SUBSYSTEM==”net”, ACTION==”add”, DRIVERS==”?*”, ATTR{address}==”00:1b:21:xx:xx:a1″, ATTR{type}==”1″, KERNEL==”eth*”, NAME=”eth4″ # PCI device 0x8086:0x10c9 (igb) SUBSYSTEM==”net”, ACTION==”add”, DRIVERS==”?*”, ATTR{address}==”00:1b:21:xx:xx:a0″, ATTR{type}==”1″, KERNEL==”eth*”, NAME=”eth5″

删除(usb),(tg3)并调整bnx2及igb的名称,调整后如下

# PCI device 0x14e4:0x163b (bnx2) (custom name provided by external tool) SUBSYSTEM==”net”, ACTION==”add”, DRIVERS==”?*”, ATTR{address}==”78:2b:cb:xx:xx:02″, ATTR{type}==”1″, KERNEL==”eth*”, NAME=”eth0″ # PCI device 0x14e4:0x163b (bnx2) (custom name provided by external tool) SUBSYSTEM==”net”, ACTION==”add”, DRIVERS==”?*”, ATTR{address}==”78:2b:cb:xx:xx:03″, ATTR{type}==”1″, KERNEL==”eth*”, NAME=”eth1″ # PCI device 0x8086:0x10c9 (igb) SUBSYSTEM==”net”, ACTION==”add”, DRIVERS==”?*”, ATTR{address}==”00:1b:21:xx:xx:a1″, ATTR{type}==”1″, KERNEL==”eth*”, NAME=”eth2″ # PCI device 0x8086:0x10c9 (igb) SUBSYSTEM==”net”, ACTION==”add”, DRIVERS==”?*”, ATTR{address}==”00:1b:21:xx:xx:a0″, ATTR{type}==”1″, KERNEL==”eth*”, NAME=”eth3″

配置网卡文件 同时修改/etc/sysconfig/network-scripts/ifcfg-eth*网卡配置文件,修改设备名和MAC地址和udev对应. 同时注意ip地址和网关.

重启服务器 reboot

centos5.8

dmesg中看到intel的pci网卡先于内置网卡

e1000e: Intel(R) PRO/1000 Network Driver – 1.4.4-k e1000e: Copyright(c) 1999 – 2011 Intel Corporation. e1000e 0000:03:00.0: Disabling ASPM L1 GSI 25 sharing vector 0x52 and IRQ 25 ACPI: PCI Interrupt 0000:03:00.0[A] -> GSI 38 (level, low) -> IRQ 82 PCI: Setting latency timer of device 0000:03:00.0 to 64 EDAC MC: Ver: 2.0.1 Feb 21 2012 e1000e 0000:03:00.0: eth0: (PCI Express:2.5GT/s:Width x4) 00:15:17:2d:52:c4 e1000e 0000:03:00.0: eth0: Intel(R) PRO/1000 Network Connection e1000e 0000:03:00.0: eth0: MAC: 0, PHY: 4, PBA No: D28207-005 e1000e 0000:03:00.1: Disabling ASPM L1 GSI 26 sharing vector 0x62 and IRQ 26 ACPI: PCI Interrupt 0000:03:00.1[B] -> GSI 45 (level, low) -> IRQ 98 PCI: Setting latency timer of device 0000:03:00.1 to 64 sd 0:0:0:0: Attached scsi generic sg0 type 0 sd 0:0:1:0: Attached scsi generic sg1 type 0 scsi 3:0:0:0: Attached scsi generic sg2 type 5 e1000e 0000:03:00.1: eth1: (PCI Express:2.5GT/s:Width x4) 00:15:17:2d:52:c5 e1000e 0000:03:00.1: eth1: Intel(R) PRO/1000 Network Connection e1000e 0000:03:00.1: eth1: MAC: 0, PHY: 4, PBA No: D28207-005 bnx2: Broadcom NetXtreme II Gigabit Ethernet Driver bnx2 v2.1.11 (July 20, 2011) GSI 27 sharing vector 0x72 and IRQ 27 ACPI: PCI Interrupt 0000:01:00.0[A] -> GSI 36 (level, low) -> IRQ 114 PCI: Setting latency timer of device 0000:01:00.0 to 64 eth2: Broadcom NetXtreme II BCM5716 1000Base-T (C0) PCI Express found at mem da000000, IRQ 114, node addr 0024e86cd577 GSI 28 sharing vector 0x7A and IRQ 28 ACPI: PCI Interrupt 0000:01:00.1[B] -> GSI 48 (level, low) -> IRQ 122 PCI: Setting latency timer of device 0000:01:00.1 to 64 eth3: Broadcom NetXtreme II BCM5716 1000Base-T (C0) PCI Express found at mem dc000000, IRQ 122, node addr 0024e86cd578 sr0: scsi3-mmc drive: 24x/24x cd/rw xa/form2 cdda tray

cat /etc/udev/rules.d/60-net.rules

ACTION==”add”, SUBSYSTEM==”net”, IMPORT{program}=”/lib/udev/rename_device” SUBSYSTEM==”net”, RUN+=”/etc/sysconfig/network-scripts/net.hotplug”

查看driver和bus-info ethtool -i eth0 driver: bnx2 version: 2.1.11 firmware-version: bc 4.6.4 NCSI 1.0.6 bus-info: 0000:01:00.0 ethtool -i eth1 driver: bnx2 version: 2.1.11 firmware-version: bc 4.6.4 NCSI 1.0.6 bus-info: 0000:01:00.1 ethtool -i eth2 driver: e1000e version: 1.4.4-k firmware-version: 5.11-2 bus-info: 0000:03:00.0 ethtool -i eth3 driver: e1000e version: 1.4.4-k firmware-version: 5.11-2 bus-info: 0000:03:00.1

编辑顺序 DRIVER指driver: e1000e ID是指bus-info:PCI ID

vi /etc/udev/rules.d/60-net.rules

DRIVER==”bnx2″,ID==”0000:01:00.0″,NAME=”eth0″ DRIVER==”bnx2″,ID==”0000:01:00.1″,NAME=”eth1″ DRIVER==”e1000e”,ID==”0000:03:00.0″,NAME=”eth2″ DRIVER==”e1000e”,ID==”0000:03:00.1″,NAME=”eth3″

重启 reboot

input: PC Speaker as /class/input/input0 bnx2: Broadcom NetXtreme II Gigabit Ethernet Driver bnx2 v2.1.11 (July 20, 2011) GSI 25 sharing vector 0x52 and IRQ 25 ACPI: PCI Interrupt 0000:01:00.0[A] -> GSI 36 (level, low) -> IRQ 82 PCI: Setting latency timer of device 0000:01:00.0 to 64 eth0: Broadcom NetXtreme II BCM5716 1000Base-T (C0) PCI Express found at mem da000000, IRQ 82, node addr 0024e86cd577 GSI 26 sharing vector 0x5A and IRQ 26 ACPI: PCI Interrupt 0000:01:00.1[B] -> GSI 48 (level, low) -> IRQ 90 PCI: Setting latency timer of device 0000:01:00.1 to 64 eth1: Broadcom NetXtreme II BCM5716 1000Base-T (C0) PCI Express found at mem dc000000, IRQ 90, node addr 0024e86cd578 EDAC MC: Ver: 2.0.1 Feb 21 2012 e1000e: Intel(R) PRO/1000 Network Driver – 1.4.4-k e1000e: Copyright(c) 1999 – 2011 Intel Corporation. e1000e 0000:03:00.0: Disabling ASPM L1 GSI 27 sharing vector 0x62 and IRQ 27 ACPI: PCI Interrupt 0000:03:00.0[A] -> GSI 38 (level, low) -> IRQ 98 PCI: Setting latency timer of device 0000:03:00.0 to 64 sd 0:0:0:0: Attached scsi generic sg0 type 0 sd 0:0:1:0: Attached scsi generic sg1 type 0 scsi 3:0:0:0: Attached scsi generic sg2 type 5 e1000e 0000:03:00.0: eth2: (PCI Express:2.5GT/s:Width x4) 00:15:17:2d:52:c4 e1000e 0000:03:00.0: eth2: Intel(R) PRO/1000 Network Connection e1000e 0000:03:00.0: eth2: MAC: 0, PHY: 4, PBA No: D28207-005 e1000e 0000:03:00.1: Disabling ASPM L1 GSI 28 sharing vector 0x72 and IRQ 28 ACPI: PCI Interrupt 0000:03:00.1[B] -> GSI 45 (level, low) -> IRQ 114 PCI: Setting latency timer of device 0000:03:00.1 to 64 e1000e 0000:03:00.1: eth3: (PCI Express:2.5GT/s:Width x4) 00:15:17:2d:52:c5 e1000e 0000:03:00.1: eth3: Intel(R) PRO/1000 Network Connection e1000e 0000:03:00.1: eth3: MAC: 0, PHY: 4, PBA No: D28207-005 sr0: scsi3-mmc drive: 24x/24x cd/rw xa/form2 cdda tray

nagios的check_traffic.sh脚本查看顺序 ./check_traffic.sh -V 2c -C privatepass -H localhost -L

List Interface for host localhost. Interface index 1 orresponding to lo Interface index 2 orresponding to eth0 Interface index 3 orresponding to eth1 Interface index 4 orresponding to eth2 Interface index 5 orresponding to eth3

Posted in linux 维护优化.

Tagged with , .

rev="post-1703" No comments

By C1G – 2014/09/24

nagios 监控redis

安装redis支持 perl -MCPAN -e shell cpan>install Redis

下载check_redis.pl http://exchange.nagios.org/directory/Plugins/Databases/check_redis-2Epl/details https://github.com/willixix/WL-NagiosPlugins

测试 ./check_redis.pl -H 192.168.0.130 -p 6379 -a ‘connected_clients,blocked_clients’ -w ~,~ -c ~,~ -f

OK: REDIS 2.6.12 on 192.168.0.130:6379 has 1 databases (db0) with 49801 keys, up 3 days 14 hours – connected_clients is 1, blocked_clients is 0 | connected_clients=1 blocked_clients=0

commands.cfg添加

define command { command_name check_redis command_line $USER1$/check_redis.pl -H $HOSTADDRESS$ -p $ARG1$ -a $ARG2$ -w $ARG3$ -c $ARG4$ -f }

加入主机监控

define service{ use local-service ; Name of service template to use host_name c1gredis service_description redis check_command check_redis!6379!’connected_clients,blocked_clients’!~,~!~,~ notifications_enabled 0 }

重新载入配置。

/etc/init.d/nagios reload

参考: http://exchange.nagios.org/directory/Plugins/Databases/check_redis-2Epl/details http://www.ttlsa.com/nagios/nagios-redis-monitor/ http://bbs.linuxtone.org/thread-6241-1-1.html

Posted in Nagios.

Tagged with , .

rev="post-1700" No comments

By C1G – 2014/09/22

Analog的安装与配置,分析汇总多域名web日志

Analog是一款基于C语言功能强大的开源的网站访问日志分析软件,支持多语言(含中文),可以运行在linux,windows下,支持apache、ngix、iis等主流WEB日志.速度飞快，10分钟内可以处理2千万条日志,数据统计以PV为主,相比Awstats和Webalizer 的报告页面简单了点，更漂亮的图表可用Report Magic 2.21.

目前最新版为analog-6.0,作者自19-Dec-04后就没更新过.演示地址 安装很简单,到:http://www.analog.cx/download.html 下载相应的版本,这里以源码版为例:将下载回来的源码包解压到安装目录,再进入该目录执行make命令即可.

wget http://www.analog.cx/analog-6.0.tar.gz tar zxvf analog-6.0.tar.gz cp -ar analog-6.0 /usr/local/ cd /usr/local/analog-6.0 make ln -s analog-6.0 analog mkdir /opt/htdocs/www/analog chown www:website /opt/htdocs/www/analog cp images /opt/htdocs/www/analog/ mkdir conf cp analog.cfg conf/c1g.cfg

配置

vi conf/c1g.cfg

#定义为中文 LANGUAGE SIMP-CHINESE #nginx日志格式 LOGFORMAT (%s – %j [%d/%M/%Y:%h:%n:%j %j] “%j %r %j” %c %b “%f” “%B”\n) #日志文件 LOGFILE /opt/log/Y.%M/*/*c1gstudio.com.log.gz #输出文件 OUTFILE /opt/htdocs/www/analog/c1gstudiolY.%M/index.html #主机名 HOSTNAME “c1gstudio.com” #主机URL HOSTURL http://www.c1gstudio.com/ #web图片目录 IMAGEDIR ../images/ #只列出访问最高的200个页面URL REQFLOOR 1000p #forum.php文件算一个文件 FILEALIAS /forum.php* /forum.php #统计子目录 SUBDIR */*

LOGFORMAT 说明

%S host (the client hostname, or address of the computer making the request) %s numerical IP address of client (if recorded in a separate field; used when %S is empty) %r file requested %q query string (part of filename after ?, if recorded in a separate field) %B browser %A browser with +’s instead of spaces %f referrer %u user (tip: a cookie or session id can usefully be defined as %u too) %v virtual host (the server hostname, also called the virtual domain) %d day of the month %m month in digits %M month, three letter English abbreviation %y year, last two digits %Y year, four digits %Z year, two or four digits (less efficient) %h hour of the day %n minute of the hour %a a or A for am, or p or P for pm, if %h is in the 12-hour clock. (So to match “am” you need %am and to match “AM” you need %aM) %U “Unix time” (seconds since beginning of 1970, GMT). If it includes decimals, use %U.%j %b number of bytes transferred %t processing time in seconds %T processing time in milliseconds %D processing time in microseconds %c HTTP status code %C code words used instead of HTTP status code in some servers — only used internally %j junk: ignore this field (field can be empty too) %w white space: spaces or tabs %W optional white space %% % sign \n new line \t tab stop \\ single backslash

我的nginx日志格式

‘$remote_addr – $remote_user [$time_local] “$request” ‘ ‘$status $body_bytes_sent “$http_referer” ‘ ‘”$http_user_agent” $http_x_forwarded_for’; 183.62.5.13 – – [06/Aug/2014:17:16:44 +0800] “GET /aboutc1g.html HTTP/1.1” 200 6642 “http://www.c1gstudio.com/web/hello.html” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36” 183.62.5.13

我这多了个$http_x_forwarded_for’,后面也要加个%j表示丢弃,它不会处理”-“

LOGFORMAT (%s – %j [%d/%M/%Y:%h:%n:%j %j] “%j %r %j” %c %b “%f” “%B” %j\n)

更多参考

LOGFILE 和OUTFILE说明

LOGFILE new1.log,old.log LOGFILE /opt/log/%Y.%M/%D/.c1gstudio.com.log.gz 支持通配符,日期变量及gz压缩,OUTFILE不会自动创建目录

%D date of month %m month name, in English %M month number %y two-digit year %Y four-digit year %H hour %n minute %w day of week, in English

但是日期不支持运算有点麻烦,需要外部用shell来解决了 更多参考

2014-8-26更新

The arguments to LOGFILE and CACHEFILE commands are checked for containing only certain allowed characters (specifically, letters, digits, /\.:_*? space, and – between two {letter, digit, underscore}’s). This is because they could match an UNCOMPRESS command and thus be passed to the shell when the uncompress command is popen()’ed.

可以将一个月份分成3部分来减轻压力 LOGFILE /opt/log/%Y.%M/[2-3]?/*.c1gstudio.com.log.gz Analog运行时会将日志读到内存中,想要运行快最好准备比日志大的内存,CACHEOUTFILE和CACHEFILE会占用大量空间,感觉没什么用.

配置文件内统计开关变量

MONTHLY ON # one line for each month WEEKLY ON # one line for each week DAILYREP ON # one line for each day DAILYSUM ON # one line for each day of the week HOURLYREP ON # one line for each hour of the day GENERAL ON # the General Summary at the top REQUEST ON # which files were requested FAILURE ON # which files were not found DIRECTORY ON # Directory Report HOST ON # which computers requested files ORGANISATION ON # which organisations they were from DOMAIN ON # which countries they were in REFERRER ON # where people followed links from FAILREF ON # where people followed broken links from SEARCHQUERY ON # the phrases and words they used… SEARCHWORD ON # …to find you from search engines BROWSERSUM ON # which browser types people were using OSREP ON # and which operating systems FILETYPE ON # types of file requested SIZE ON # sizes of files requested STATUS ON # number of each type of success and failure

命令行参数

x GENERAL General Summary 1 YEARLY Yearly Report Q QUARTERLY Quarterly Report m MONTHLY Monthly Report W WEEKLY Weekly Report D DAILYREP Daily Report d DAILYSUM Daily Summary H HOURLYREP Hourly Report h HOURLYSUM Hourly Summary w WEEKHOUR Hour of the Week Summary 4 QUARTERREP Quarter-Hour Report 6 QUARTERSUM Quarter-Hour Summary 5 FIVEREP Five-Minute Report 7 FIVESUM Five-Minute Summary S HOST Host Report l REDIRHOST Host Redirection Report L FAILHOST Host Failure Report Z ORGANISATION Organisation Report o DOMAIN Domain Report r REQUEST Request Report i DIRECTORY Directory Report t FILETYPE File Type Report z SIZE File Size Report P PROCTIME Processing Time Report E REDIR Redirection Report I FAILURE Failure Report f REFERRER Referrer Report s REFSITE Referring Site Report N SEARCHQUERY Search Query Report n SEARCHWORD Search Word Report Y INTSEARCHQUERY Internal Search Query Report y INTSEARCHWORD Internal Search Word Report k REDIRREF Redirected Referrer Report K FAILREF Failed Referrer Report B BROWSERREP Browser Report b BROWSERSUM Browser Summary p OSREP Operating System Report v VHOST Virtual Host Report R REDIRVHOST Virtual Host Redirection Report M FAILVHOST Virtual Host Failure Report u USER User Report j REDIRUSER User Redirection Report J FAILUSER User Failure Report c STATUS Status Code Report

#+a可以带上全部统计 更多参考

#输出当前配置 analog -settings > file

#使用命令行配置LOGFILE和OUTFILE ./analog +O/opt/htdocs/www/analog/c1gstudio2014.html /opt/log/2014.08/02/*.c1gstudio.com.log.gz 我使用时一直会报日志格式错误,无法出报告

#我使用的参数 /usr/local/analog -G +g/usr/local/analog/conf/c1g.cfg +b +s +S -n -o -Z -r +b 浏览器概要报告 -n 检索字报告 +s 来源网站报告 -o 网域报告 -Z 来源组织单位报告 +S 主机报告 -r 请求报告

-G 不读analog.cfg +g读取自定义配置文件

我这每日报告用awstats统计,每月报告用analog统计,每个域名汇总一个月报告. 日志按天存放在/opt/log/2014.08/07/目录下 www.c1gstudio.com.log.gz blog.c1gstudio.com.log.gz www.c1g.com.log.gz

每日运行完awstats后运行analog crontab

10 5 * * * /bin/sh /opt/shell/analog.sh > /dev/null 2>&1

vi /opt/shell/analog.sh

#!/bin/sh ana_dir=/usr/local/analog/ web_dir=/opt/htdocs/www/analog/ conf_dir=”${ana_dir}/conf/” today=`date +%d` yesterday=`date +%Y%m%d` lastday_month=`date +%Y.%m -d ‘1 day ago’` lastday_day=`date +%d -d ‘1 day ago’` c1g_LOGFILE=/opt/log/${lastday_month}/*/*c1gstudio.com.log.gz c1g_OUTFILE=${web_dir}c1gstudio${lastday_month}/index.html POST_LOGFILE=/opt/log/${lastday_month}/*/c1g.com.log.gz POST_OUTFILE=${web_dir}c1g${lastday_month}/index.html #if [ $today == “02” ]; then if [ ! -d $(dirname “${c1g_OUTFILE}”) ]; then mkdir -p $(dirname “${c1g_OUTFILE}”) chown www:website $(dirname “${c1g_OUTFILE}”) fi if [ ! -d $(dirname “${POST_OUTFILE}”) ]; then mkdir -p $(dirname “${POST_OUTFILE}”) chown www:website $(dirname “${POST_OUTFILE}”) fi sed -i “s;LOGFILE.*;LOGFILE ${c1g_LOGFILE};” ${conf_dir}c1gstudio.cfg sed -i “s;OUTFILE.*;OUTFILE ${c1g_OUTFILE};” ${conf_dir}c1gstudio.cfg sed -i “s;LOGFILE.*;LOGFILE ${POST_LOGFILE};” ${conf_dir}c1g.cfg sed -i “s;OUTFILE.*;OUTFILE ${POST_OUTFILE};” ${conf_dir}c1g.cfg #fi ${ana_dir}analog -G +g${conf_dir}c1gstudio.cfg +b +D -d +s +S -n -o -Z -r ${ana_dir}analog -G +g${conf_dir}c1g.cfg +b +D -d +s +S -n -o -Z +r

Posted in 日志.

Tagged with , .

rev="post-1691" No comments

By C1G – 2014/08/08