|
|
@@ -0,0 +1,143 @@
|
|
|
+/proc/sys/net/ipv4/vs/* Variables:
|
|
|
+
|
|
|
+am_droprate - INTEGER
|
|
|
+ default 10
|
|
|
+
|
|
|
+ It sets the always mode drop rate, which is used in the mode 3
|
|
|
+ of the drop_rate defense.
|
|
|
+
|
|
|
+amemthresh - INTEGER
|
|
|
+ default 1024
|
|
|
+
|
|
|
+ It sets the available memory threshold (in pages), which is
|
|
|
+ used in the automatic modes of defense. When there is no
|
|
|
+ enough available memory, the respective strategy will be
|
|
|
+ enabled and the variable is automatically set to 2, otherwise
|
|
|
+ the strategy is disabled and the variable is set to 1.
|
|
|
+
|
|
|
+cache_bypass - BOOLEAN
|
|
|
+ 0 - disabled (default)
|
|
|
+ not 0 - enabled
|
|
|
+
|
|
|
+ If it is enabled, forward packets to the original destination
|
|
|
+ directly when no cache server is available and destination
|
|
|
+ address is not local (iph->daddr is RTN_UNICAST). It is mostly
|
|
|
+ used in transparent web cache cluster.
|
|
|
+
|
|
|
+debug_level - INTEGER
|
|
|
+ 0 - transmission error messages (default)
|
|
|
+ 1 - non-fatal error messages
|
|
|
+ 2 - configuration
|
|
|
+ 3 - destination trash
|
|
|
+ 4 - drop entry
|
|
|
+ 5 - service lookup
|
|
|
+ 6 - scheduling
|
|
|
+ 7 - connection new/expire, lookup and synchronization
|
|
|
+ 8 - state transition
|
|
|
+ 9 - binding destination, template checks and applications
|
|
|
+ 10 - IPVS packet transmission
|
|
|
+ 11 - IPVS packet handling (ip_vs_in/ip_vs_out)
|
|
|
+ 12 or more - packet traversal
|
|
|
+
|
|
|
+ Only available when IPVS is compiled with the CONFIG_IPVS_DEBUG
|
|
|
+
|
|
|
+ Higher debugging levels include the messages for lower debugging
|
|
|
+ levels, so setting debug level 2, includes level 0, 1 and 2
|
|
|
+ messages. Thus, logging becomes more and more verbose the higher
|
|
|
+ the level.
|
|
|
+
|
|
|
+drop_entry - INTEGER
|
|
|
+ 0 - disabled (default)
|
|
|
+
|
|
|
+ The drop_entry defense is to randomly drop entries in the
|
|
|
+ connection hash table, just in order to collect back some
|
|
|
+ memory for new connections. In the current code, the
|
|
|
+ drop_entry procedure can be activated every second, then it
|
|
|
+ randomly scans 1/32 of the whole and drops entries that are in
|
|
|
+ the SYN-RECV/SYNACK state, which should be effective against
|
|
|
+ syn-flooding attack.
|
|
|
+
|
|
|
+ The valid values of drop_entry are from 0 to 3, where 0 means
|
|
|
+ that this strategy is always disabled, 1 and 2 mean automatic
|
|
|
+ modes (when there is no enough available memory, the strategy
|
|
|
+ is enabled and the variable is automatically set to 2,
|
|
|
+ otherwise the strategy is disabled and the variable is set to
|
|
|
+ 1), and 3 means that that the strategy is always enabled.
|
|
|
+
|
|
|
+drop_packet - INTEGER
|
|
|
+ 0 - disabled (default)
|
|
|
+
|
|
|
+ The drop_packet defense is designed to drop 1/rate packets
|
|
|
+ before forwarding them to real servers. If the rate is 1, then
|
|
|
+ drop all the incoming packets.
|
|
|
+
|
|
|
+ The value definition is the same as that of the drop_entry. In
|
|
|
+ the automatic mode, the rate is determined by the follow
|
|
|
+ formula: rate = amemthresh / (amemthresh - available_memory)
|
|
|
+ when available memory is less than the available memory
|
|
|
+ threshold. When the mode 3 is set, the always mode drop rate
|
|
|
+ is controlled by the /proc/sys/net/ipv4/vs/am_droprate.
|
|
|
+
|
|
|
+expire_nodest_conn - BOOLEAN
|
|
|
+ 0 - disabled (default)
|
|
|
+ not 0 - enabled
|
|
|
+
|
|
|
+ The default value is 0, the load balancer will silently drop
|
|
|
+ packets when its destination server is not available. It may
|
|
|
+ be useful, when user-space monitoring program deletes the
|
|
|
+ destination server (because of server overload or wrong
|
|
|
+ detection) and add back the server later, and the connections
|
|
|
+ to the server can continue.
|
|
|
+
|
|
|
+ If this feature is enabled, the load balancer will expire the
|
|
|
+ connection immediately when a packet arrives and its
|
|
|
+ destination server is not available, then the client program
|
|
|
+ will be notified that the connection is closed. This is
|
|
|
+ equivalent to the feature some people requires to flush
|
|
|
+ connections when its destination is not available.
|
|
|
+
|
|
|
+expire_quiescent_template - BOOLEAN
|
|
|
+ 0 - disabled (default)
|
|
|
+ not 0 - enabled
|
|
|
+
|
|
|
+ When set to a non-zero value, the load balancer will expire
|
|
|
+ persistent templates when the destination server is quiescent.
|
|
|
+ This may be useful, when a user makes a destination server
|
|
|
+ quiescent by setting its weight to 0 and it is desired that
|
|
|
+ subsequent otherwise persistent connections are sent to a
|
|
|
+ different destination server. By default new persistent
|
|
|
+ connections are allowed to quiescent destination servers.
|
|
|
+
|
|
|
+ If this feature is enabled, the load balancer will expire the
|
|
|
+ persistence template if it is to be used to schedule a new
|
|
|
+ connection and the destination server is quiescent.
|
|
|
+
|
|
|
+nat_icmp_send - BOOLEAN
|
|
|
+ 0 - disabled (default)
|
|
|
+ not 0 - enabled
|
|
|
+
|
|
|
+ It controls sending icmp error messages (ICMP_DEST_UNREACH)
|
|
|
+ for VS/NAT when the load balancer receives packets from real
|
|
|
+ servers but the connection entries don't exist.
|
|
|
+
|
|
|
+secure_tcp - INTEGER
|
|
|
+ 0 - disabled (default)
|
|
|
+
|
|
|
+ The secure_tcp defense is to use a more complicated state
|
|
|
+ transition table and some possible short timeouts of each
|
|
|
+ state. In the VS/NAT, it delays the entering the ESTABLISHED
|
|
|
+ until the real server starts to send data and ACK packet
|
|
|
+ (after 3-way handshake).
|
|
|
+
|
|
|
+ The value definition is the same as that of drop_entry or
|
|
|
+ drop_packet.
|
|
|
+
|
|
|
+sync_threshold - INTEGER
|
|
|
+ default 3
|
|
|
+
|
|
|
+ It sets synchronization threshold, which is the minimum number
|
|
|
+ of incoming packets that a connection needs to receive before
|
|
|
+ the connection will be synchronized. A connection will be
|
|
|
+ synchronized, every time the number of its incoming packets
|
|
|
+ modulus 50 equals the threshold. The range of the threshold is
|
|
|
+ from 0 to 49.
|
Horms