linux 参数优化 FAQ

旧城等待， 2022-08-23 03:52 176阅读 0赞

# 1、kernel: TCP: time wait bucket table overflow解决方案 #

/var/log/messages 出现如下日志：

Sep 19 08:20:27 localhost kernel: printk: 17679 messages suppressed.  
Sep 19 08:20:27 localhost kernel: TCP: time wait bucket table overflow  
查看网络连接情况如下：  
\# netstat -an | awk '\{print $6\}' | sort | uniq -c | sort -rn  
12317 TIME\_WAIT  
657 CONNECTED  
90 FIN\_WAIT2  
81 LAST\_ACK  
72 ESTABLISHED  
37 STREAM  
18 LISTEN  
查看 /proc/sys/net/ipv4/tcp\_max\_tw\_buckets 文件的值为 5000  
解决办法：更改 net.ipv4.tcp\_max\_tw\_buckets 这个内核参数

修改：/etc/sysct.conf 的net.ipv4.tcp\_max\_tw\_buckets 值，调整为：20000后用 sysctl -p 使它生效。再次看日志错误信息消失。

注：如果出现is an unknown key ，见下面部分2、内核参数优化部分的解决方案

# 2、内核参数优化 #

说明：本优化适合apache，nginx，squid多种等web应用，特殊的业务也可能需要略作调整。  
\[root@c64 ~\]\# vi /etc/sysctl.conf  
\#by sun in 20131001  
net.ipv4.tcp\_fin\_timeout = 2  
net.ipv4.tcp\_tw\_reuse = 1  
net.ipv4.tcp\_tw\_recycle = 1  
net.ipv4.tcp\_syncookies = 1  
net.ipv4.tcp\_keepalive\_time =600  
net.ipv4.ip\_local\_port\_range = 4000 65000  
net.ipv4.tcp\_max\_syn\_backlog = 16384  
net.ipv4.tcp\_max\_tw\_buckets = 36000  
net.ipv4.route.gc\_timeout = 100  
net.ipv4.tcp\_syn\_retries = 1  
net.ipv4.tcp\_synack\_retries = 1  
net.core.somaxconn = 16384  
net.core.netdev\_max\_backlog = 16384  
net.ipv4.tcp\_max\_orphans = 16384  
\#一下参数是对iptables防火墙的优化，防火墙不开会有提示，可以忽略不理。  
net.ipv4.ip\_conntrack\_max = 25000000  
net.ipv4.netfilter.ip\_conntrack\_max = 25000000  
net.ipv4.netfilter.ip\_conntrack\_tcp\_timeout\_established = 180  
net.ipv4.netfilter.ip\_conntrack\_tcp\_timeout\_time\_wait = 120  
net.ipv4.netfilter.ip\_conntrack\_tcp\_timeout\_close\_wait = 60  
net.ipv4.netfilter.ip\_conntrack\_tcp\_timeout\_fin\_wait = 120  
\[root@localhost ~\]\# sysctl –p \#使配置文件生效  
  
  
提示：由于CentOS6.X系统中的模块名不是ip\_conntrack，而是nf\_conntrack，所以在/etc/sysctl.conf优化时，需要把net.ipv4.netfilter.ip\_conntrack\_max 这种老的参数，改成net.netfilter.nf\_conntrack\_max这样才可以。  
即对防火墙的优化，在5.8上是  
  
  
net.ipv4.ip\_conntrack\_max = 25000000  
net.ipv4.netfilter.ip\_conntrack\_max = 25000000  
net.ipv4.netfilter.ip\_conntrack\_tcp\_timeout\_established = 180  
net.ipv4.netfilter.ip\_conntrack\_tcp\_timeout\_time\_wait = 120  
net.ipv4.netfilter.ip\_conntrack\_tcp\_timeout\_close\_wait = 60  
net.ipv4.netfilter.ip\_conntrack\_tcp\_timeout\_fin\_wait = 120  
  
  
在6.4上是  
net.nf\_conntrack\_max = 25000000  
net.netfilter.nf\_conntrack\_max = 25000000  
net.netfilter.nf\_conntrack\_tcp\_timeout\_established = 180  
net.netfilter.nf\_conntrack\_tcp\_timeout\_time\_wait = 120  
net.netfilter.nf\_conntrack\_tcp\_timeout\_close\_wait = 60  
net.netfilter.nf\_conntrack\_tcp\_timeout\_fin\_wait = 120  
  
  
另外，在此优化过程中可能会有报错：  
  
  
1、5.8版本上  
error: "net.ipv4.ip\_conntrack\_max" is an unknown key  
error: "net.ipv4.netfilter.ip\_conntrack\_max" is an unknown key  
error: "net.ipv4.netfilter.ip\_conntrack\_tcp\_timeout\_established" is an unknown key  
error: "net.ipv4.netfilter.ip\_conntrack\_tcp\_timeout\_time\_wait" is an unknown key  
error: "net.ipv4.netfilter.ip\_conntrack\_tcp\_timeout\_close\_wait" is an unknown key  
error: "net.ipv4.netfilter.ip\_conntrack\_tcp\_timeout\_fin\_wait" is an unknown key  
  
  
这个错误可能是你的防火墙没有开启或者自动处理可载入的模块ip\_conntrack没有自动载入，解决办法有二，一是开启防火墙，二是自动处理开载入的模块ip\_conntrack  
modprobe ip\_conntrack  
echo "modprobe ip\_conntrack" >> /etc/rc.local  
  
  
2、6.4版本上  
123456 error: "net.nf\_conntrack\_max" is an unknown key  
error: "net.netfilter.nf\_conntrack\_max" is an unknown key  
error: "net.netfilter.nf\_conntrack\_tcp\_timeout\_established" is an unknown key  
error: "net.netfilter.nf\_conntrack\_tcp\_timeout\_time\_wait" is an unknown key  
error: "net.netfilter.nf\_conntrack\_tcp\_timeout\_close\_wait" is an unknown key  
error: "net.netfilter.nf\_conntrack\_tcp\_timeout\_fin\_wait" is an unknown key  
  
  
这个错误可能是你的防火墙没有开启或者自动处理可载入的模块ip\_conntrack没有自动载入，解决办法有二，一是开启防火墙，二是自动处理开载入的模块ip\_conntrack  
  
  
modprobe nf\_conntrack  
echo "modprobe nf\_conntrack" >> /etc/rc.local  
  
  
3、6.4版本上  
  
  
error: "net.bridge.bridge-nf-call-ip6tables" is an unknown key  
error: "net.bridge.bridge-nf-call-iptables" is an unknown key  
error: "net.bridge.bridge-nf-call-arptables" is an unknown key  
  
  
这个错误是由于自动处理可载入的模块bridge没有自动载入，解决办法是自动处理开载入的模块ip\_conntrack  
  
  
modprobe bridge  
echo "modprobe bridge" >> /etc/rc.local