I. optimization before compilation and installation

The optimization before compilation and installation is mainly used to modify the program name and so on, so as to hide the software name and version number by changing the source code.

First, please. download I provide the required source package.

1. Start installation:

[root@nginx ~]# yum -y erase httpd        #Uninstall the system's default httpd service to prevent port conflicts
[root@nginx ~]# yum -y install openssl-devel pcre-devel    #Installation dependency
[root@nginx src]# rz          #rz command to upload the required source package
[root@nginx src]# ls          #Confirm the uploaded source package
nginx-sticky-module.zip    nginx-1.14.0.tar.gz    ngx_cache_purge-2.3.tar.gz
#Decompress the uploaded source package
[root@nginx src]# tar zxf nginx-1.14.0.tar.gz  
[root@nginx src]# unzip nginx-sticky-module.zip 
[root@nginx src]# tar zxf ngx_cache_purge-2.3.tar.gz 
[root@nginx src]# cd nginx-1.14.0/        #Switch to nginx directory
[root@nginx nginx-1.14.0]# vim src/core/nginx.h    #Modify the following two lines of configuration
#define NGINX_VERSION      "6.6"       #Here is the revision number of nginx
#define NGINX_VER          "IIS/" NGINX_VERSION    #The name of the software is changed here. I changed the original nginx to IIS.
#After modification, save to exit
[root@nginx nginx-1.14.0]# vim src/http/ngx_http_header_filter_module.c   #Edit the file
#Before modification, it is as follows:
static u_char ngx_http_server_string[] = "Server: nginx" CRLF;     #Forty-ninth elements
#Revised as follows:
static u_char ngx_http_server_string[] = "Server: IIS" CRLF;   #This IIS is best aligned with the previous file change.
#After the change is completed, save to exit.
[root@nginx nginx-1.14.0]# vim src/http/ngx_http_special_response.c   #Modify this configuration file to prevent the page from displaying errors with nginx and version number.
#Before modification, it is as follows:
static u_char ngx_http_error_tail[] =     #Before that, there was a line very similar to this one. Note that there is no word build after the error in this line.
"<hr><center>nginx</center>" CRLF           #Thirty-sixth elements
"</body>" CRLF
"</html>" CRLF
#The changes are as follows:
static u_char ngx_http_error_tail[] =
"<hr><center>IIS</center>" CRLF       #Change the original nginx to IIS
"</body>" CRLF
"</html>" CRLF
#After the change is completed, save to exit
[root@nginx nginx-1.14.0]# useradd -M -s /sbin/nologin www   #Create nginx run user
[root@nginx nginx-1.14.0]# ./configure --prefix=/usr/local/nginx1.14 --user=www --group=www --with-http_stub_status_module  --with-http_realip_module  --with-http_ssl_module --with-http_gzip_static_module  --http-client-body-temp-path=/var/tmp/nginx/client --http-proxy-temp-path=/var/tmp/nginx/proxy  --http-fastcgi-temp-path=/var/tmp/nginx/fcgi --with-pcre  --add-module=/usr/src/ngx_cache_purge-2.3  --with-http_flv_module --add-module=/usr/src/nginx-sticky-module --with-http_dav_module --with-http_addition_module --with-http_sub_module --with-http_mp4_module && make && make install
#Compilation and installation
[root@nginx nginx-1.14.0]# ln -sf /usr/local/nginx1.14/sbin/nginx /usr/local/sbin/  #Create nginx command soft connection
[root@nginx nginx-1.14.0]# mkdir -p /var/tmp/nginx/client      #Create directory for temporary files
[root@nginx nginx-1.14.0]# nginx -t       #Check profile
[root@nginx nginx-1.14.0]# nginx       #Start nginx when there are no errors
[root@nginx nginx-1.14.0]# netstat -anput | grep 80      #Make sure port 80 is listening

The command line verifies that the software name and version number of the http header have changed:

[root@nginx conf]# curl -I 127.0.0.1     #Visit this machine
HTTP/1.1 200 OK
Server: IIS/6.6             #OK, let's change the name and version
Date: Fri, 25 Oct 2019 00:10:17 GMT
Content-Type: text/html
Content-Length: 612
Last-Modified: Fri, 25 Oct 2019 00:03:52 GMT
Connection: keep-alive
ETag: "5db23be8-264"
Accept-Ranges: bytes
[root@nginx conf]# curl -I 127.0.0.1/a.html       #Visit a page that does not exist
HTTP/1.1 404 Not Found
Server: IIS/6.6           #The information echoed by the error page is also changed by us, OK
Date: Fri, 25 Oct 2019 00:11:07 GMT
Content-Type: text/html
Content-Length: 164
Connection: keep-alive

II. Nginx configuration item optimization

Nginx is a master/worker structure: a master process that generates one or more worker processes. The schematic diagram is as follows:

The master worker design pattern mainly includes two main components: master and worker. Master maintains the worker queue, distributes requests to multiple workers and executes them. Worker mainly performs actual logic calculation and returns the results to master.

The advantage of Nginx's adoption of this process model is that it adopts independent processes, so that they will not affect each other. After one process exits, other processes are still working, and the service will not be interrupted. The master process will restart the new worker process soon. When an exception occurs to the worker, all requests on the current worker will fail without affecting other worker processes.

All the next configuration parameters are written in the global of the Nginx configuration file

1. Adjust the number of Nginx running processes

[root@nginx ~]# vim /usr/local/nginx1.14/conf/nginx.conf    #Edit Master profile
 worker_processes  4;    #Generally set as the core or core number of CPU x2
  [root@nginx ~]# nginx -s reload          #Restart Nginx service
  [root@nginx ~]# ps -ef | grep nginx | grep worker    #View open worker processes
  www      128282   6761  0 11:41 ?        00:00:00 nginx: worker process
  www      128283   6761  0 11:41 ?        00:00:00 nginx: worker process
  www      128284   6761  0 11:41 ?        00:00:00 nginx: worker process
  www      128285   6761  0 11:41 ?        00:00:00 nginx: worker process

2. CPU affinity of Nginx

[root@nginx ~]# VIM / usr / local / nginx1.14/conf/nginx.conf <! -- edit the main configuration file -- >
<!--If it is a four core configuration, it should be configured as follows:-->
worker_processes 4;
worker_cpu_affinity 0001 0010 0100 1000;
       <!--
//Above is to open a worker for each core. If you want each core to correspond to two workers,
//It needs to be written: worker CPU affinity 0001 0010 0100 1000 0001 0010 0100 1000;
                                 -->
<!--  If it is an eight core configuration, it should be configured as follows:  -->
worker_processes 8;
worker_cpu_affinity 00000001 00000010 00000100 00001000 00010000 00100000 01000000
10000000;
worker_rlimit_nofile 65535;      <!--modify nginx Maximum number of files that can be opened-->
         <!--   
        //This configuration refers to the maximum number of file descriptions opened by a nginx process. The theoretical value should be the maximum number of files opened by the system (view with ulimit-n command) divided by the nginx process. However, the allocation request of nginx is not so uniform, so it is better to keep consistent with the value obtained by ulimit-n command.
//The value specified above is "65535", but the system default is 1024. What should I do?  
                               -->
[root@docker ~]# Ulimit - N <! -- determine the system's most open files -- >
1024
<!--If it starts at this time nginx Service, there will be exceptions.-->
[root@docker ~]# VIM / etc / security / limits.conf <! -- edit this file to modify the default number of files on the system -- >
<!--Add the following fields at the end of the configuration file -->
*       soft    nofile  65535
*       hard    nofile  65535
<!--Save exit when changes are complete-->
[root@nginx conf]# Su - <! -- log in again for effect -- >
[root@nginx ~]# Ulimit - N <! -- check again to confirm whether the modification is successful -- >
65535
[root@nginx ~]# Nginx - s reload <! -- restart nginx service for configuration to take effect -- >

At most, 8 processes can be opened. If there are more than 8 processes, the performance will not be improved, and the stability will be lower, so 8 processes are enough.

Since the next step is to add some configuration items to the configuration file, write the configuration items and explain them directly.

3. Nginx event processing model

#The configuration file is modified as follows:
events {
    use epoll;
    worker_connections  65535;
    multi_accept on;
}

Nginx adopts epoll event model, which has high processing efficiency. Work ﺾ connections is the maximum number of connections allowed to clients for a single worker process. This number is generally determined according to server performance and memory. The actual concurrent amount of nginx server is the number of worker processes multiplied by work ﺾ connections, and a 65535 is filled in, which means that the concurrent amount can reach 65535 x 4 = 262140. Concurrency, concurrency of a website to such a large number, is also a big station!
Multi accept tells nginx to accept as many connections as possible after receiving a new connection notification.

Note: all the following configurations will be written in the http {} module.

4. Enable efficient transmission mode

http {
    include       mime.types;
    default_type  application/octet-stream;
         ........................#Omit part of the content
    sendfile        on;        #This line is on by default
    tcp_nopush     on;     #Remove the comment at the beginning of this line

5. Connection timeout

The main purpose of modifying and adding the following content is to protect server resources, CPU, memory, and control the number of connections, because establishing connections also consumes resources.

#Add the following to the http {} field:
    keepalive_timeout  65;
    tcp_nodelay on;
    client_header_buffer_size 4k;
    open_file_cache max=102400 inactive=20s;
    open_file_cache_valid 30s;
    open_file_cache_min_uses 1;
    client_header_timeout 15;
    client_body_timeout 15;
    reset_timedout_connection on;
    send_timeout 15;
    server_tokens off;
    client_max_body_size 10m;

6. fastcgi optimization

Fastcgi (fast universal Gateway Interface) is an interface between static service and dynamic service. Cache represents write cache and Buffer represents read cache.

In the production environment, we also need to decide whether we need to enable the caching function of dynamic pages according to our company's website. After all, dynamic pages change rapidly. In most cases, we will not enable the caching of dynamic pages.

#The following configuration is written in the http {} field
    fastcgi_connect_timeout 600;
    fastcgi_send_timeout 600;
    fastcgi_read_timeout 600;
    fastcgi_buffer_size 64k;
    fastcgi_buffers 4 64k;
    fastcgi_busy_buffers_size 128k;
    fastcgi_temp_file_write_size 128k;
    fastcgi_temp_path /usr/local/nginx1.10/nginx_tmp;
    fastcgi_intercept_errors on;
    fastcgi_cache_path /usr/local/nginx1.10/fastcgi_cache levels=1:2 keys_zone=cache_fastcgi:128m inactive=1d max_size=10g;

Conclusion:

• The caching functions of nginx are: proxy cache / fastcgi cache
• The function of proxy cache is to cache the content of back-end server, which may be anything, including static and dynamic.
• fastcgi_cache is used to cache the content generated by fastcgi. In many cases, it is the dynamic content generated by php.
• Proxy cache reduces the times of communication between nginx and back-end, and saves the transmission time and back-end broadband.
• Fastcgi cache reduces the number of communication between nginx and php, and also reduces the pressure of php and mysql.

7. gzip tuning

#The following configuration items are written in the http {} field:
gzip on;
gzip_min_length 2k;
gzip_buffers 4 32k;
gzip_http_version 1.1;
gzip_comp_level 6;
gzip_types  text/plain  text/css  text/javascript  application/json  application/javascript application/x-javascript application/xml;
gzip_vary on;
gzip_proxied any;

8. Tuning of expires cache

Cache is mainly used when there is little chance to change the elements such as picture, css, js, etc., especially when the picture takes up a large bandwidth. We can completely set the picture to be cached in the browser for 365d. css, js, html can be cached for more than 10 days. In this way, the first time the user opens the cache, the second time, it is very fast! When caching, we need to list the extensions that need to be cached, and the Expires cache is configured in the server field.

    server {
        listen       80;
        server_name  localhost;
                ................#Omit part of the content
        location ~* \.(ico|jpe?g|gif|png|bmp|swf|flv)$ {
            expires 30d;
            log_not_found off;
            access_log off;
        }
        location ~* \.(js|css)$ {
            expires 7d;
            log_not_found off;
            access_log off;
        }
                ..........#Omit part of the content
}
#Note: log not found off: indicates whether to record non-existent errors in the error log. It is on by default.

9. Configure anti-theft chain

The function of the anti-theft chain is to prevent other people from quoting pictures and other links directly from your website, which consumes our resources and network traffic, and we have not got any benefits, and we have to work hard not to please.

The following method is to give 404 error prompt directly or jump to the specified prompt page.

#The following configuration is written in the server {} field:
        location ~* ^.+\.(jpg|gif|swf|flv|wma|wmv|asf|mp3|mmf|zip|rar)$ {
            valid_referers none blocked www.test.com test.com;    #This field specifies the domain name that allows jump access.
            if ($invalid_referer) {
            #return 302 http://www.test.com/img/nolink.png; ා the configuration item of the comment indicates that it can be redirected to the specified file
            return 404;          #Here is the status code 404 directly returned to the client.
            break;
            }
            access_log off;         #Close access log
          }
        location / {            #The configuration of the anti-theft chain must be written before all the location fields
            root   html;
            index  index.html index.htm;
        }
#When redirecting to another file, you need to pay special attention that its suffix cannot match the anti-theft chain rule, or the client will get the prompt "too many times of redirection".
#I will select the return status code 404 first.

The complete configuration file after the above modification is as follows:

#user  nobody;
worker_processes  4;
worker_cpu_affinity 0001 0010 0100 1000;
worker_rlimit_nofile 65535;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;

events {
    use epoll;
    worker_connections  65535;
    multi_accept on;
}

http {
    include       mime.types;
    default_type  application/octet-stream;
    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;
    tcp_nodelay on;
    client_header_buffer_size 4k;
    open_file_cache max=102400 inactive=20s;
    open_file_cache_valid 30s;
    open_file_cache_min_uses 1;
    client_header_timeout 15;
    client_body_timeout 15;
    reset_timedout_connection on;
    send_timeout 15;
    server_tokens off;
    client_max_body_size 10m;

    fastcgi_connect_timeout 600;
    fastcgi_send_timeout 600;
    fastcgi_read_timeout 600;
    fastcgi_buffer_size 64k;
    fastcgi_buffers 4 64k;
    fastcgi_busy_buffers_size 128k;
    fastcgi_temp_file_write_size 128k;
    fastcgi_temp_path /usr/local/nginx1.10/nginx_tmp;
    fastcgi_intercept_errors on;
    fastcgi_cache_path /usr/local/nginx1.10/fastcgi_cache levels=1:2 keys_zone=cache_fastcgi:128m inactive=1d max_size=10g;
    gzip  on;
    gzip_min_length 2k;
    gzip_buffers 4 32k;
    gzip_http_version 1.1;
    gzip_comp_level 6;
    gzip_types  text/plain  text/css  text/javascript  application/json  application/javascript application/x-javascript application/xml;
    gzip_vary on;
    gzip_proxied any;

    server {
        listen       80;
        server_name  localhost;

        #charset koi8-r;

        #access_log  logs/host.access.log  main;
        location ~* ^.+\.(jpg|gif|png|swf|flv|wma|wmv|asf|mp3|mmf|zip|rar)$ {
            valid_referers none blocked 192.168.20.5 www.test.com;
            if ($invalid_referer) {
            return 302 http://192.168.20.5/img/nolink.png;
            #return 404;
            break;
            }
            access_log off;
          }
        location / {
            root   html;
            index  index.html index.htm;
        }
        location ~* \.(ico|jpe?g|gif|png|bmp|swf|flv)$ {
            expires 30d;
            log_not_found off;
            access_log off;
        }
        location ~* \.(js|css)$ {
            expires 7d;
            log_not_found off;
            access_log off;
        }
        ......................#Omit the following notes

10. Kernel parameter optimization

[root@nginx conf]# vim /etc/sysctl.conf       #This profile needs to be edited
#Write the following configuration items at the end:
fs.file-max = 999999
net.ipv4.ip_forward = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 68719476736
kernel.shmall = 4294967296
net.ipv4.tcp_max_tw_buckets = 6000
net.ipv4.tcp_sack = 1
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_rmem = 10240 87380 12582912
net.ipv4.tcp_wmem = 10240 87380 12582912
net.core.wmem_default = 8388608
net.core.rmem_default = 8388608
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.core.netdev_max_backlog = 262144
net.core.somaxconn = 40960
net.ipv4.tcp_max_orphans = 3276800
net.ipv4.tcp_max_syn_backlog = 262144
net.ipv4.tcp_timestamps = 0
net.ipv4.tcp_synack_retries = 1
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_mem = 94500000 915000000 927000000
net.ipv4.tcp_fin_timeout = 1
net.ipv4.tcp_keepalive_time = 30
net.ipv4.ip_local_port_range = 1024 65000
[root@nginx conf]# sysctl -p       #Refresh to make kernel modification effective. Normally, all configuration items will be returned.
#After refreshing, all configuration items will be written to a directory in the form of a file. You can specify the find command to find and verify.
#To find the file corresponding to "net.core.netdev_max_backlog", you can execute the command "find / -name netdev_max_backlog" to find it.

11. Optimization of the number of system connections

In linux system, the default value of open files is 1024, which means that the server can only open 1024 files at the same time. You can use the command ulimit-a to view all the limit values of the current system, and use the command ulimit-n to view the current maximum number of open files.
By default, the newly installed linux is only 1024. It is easy to encounter error: too many open files on servers with large load. Therefore, it needs to be enlarged.

[root@nginx core]# vim /etc/security/limits.conf     #Modify this profile
#Add the following fields at the end of the file:
*       soft    nofile  65535
*       hard    nofile  65535
*       soft    noproc  65535
*       hard    noproc  65535
#After adding, users need to log in again for the changes to take effect.
[root@nginx ~]# bash
[root@nginx ~]# ulimit -a     #Check whether it is effective

III. verify the above optimization and Nginx server stress test

1. Test the function of anti-theft chain:

Prepare two servers, one is the Nginx server just optimized, and the other is free to provide web functions.

The IP address of the Nginx server just optimized is 192.168.20.5, and that of the other server is 192.168.20.2.

1) the configuration of Nginx server is as follows:

[root@nginx html]# Ls <! -- the web root directory of nginx server is as follows -- >
50x.html  index.html  test.png
[root@nginx html]# VIM.. / conf / nginx. Conf <! -- its anti-theft chain configuration is as follows -- >
    ......................#Omit part of the content
location ~* ^.+\.(jpg|gif|png|swf|flv|wma|wmv|asf|mp3|mmf|zip|rar)$ {
            valid_referers none blocked 192.168.20.5 www.test.com;
            if ($invalid_referer) {
            #return 302 http://192.168.20.5/img/nolink.png;
            return 404;
            break;
            }
            access_log off;
          }
    ......................#Omit part of the content
<!--According to its anti-theft chain configuration, if the client accesses the resources of the server through the link provided by another server, it will get 404 status code.--> 
[root@nginx html]# nginx -s reload      #Restart the Nginx server to make the anti-theft chain configuration effective

2) the web page file of the second server is as follows:

[root@daolian html]# cat index.html      #Its hyperlink address points to the test.png image of the first Nginx server.
<a href="http://192.168.20.5/test.png">lianjie</a>

3) if the client directly accesses the Nginx server, it will see the page of test.png as follows:

4) test of client accessing the second server:

After clicking the hyperlink, you will see the following pages:

5) now change another anti-theft chain rule and test again:

[root@nginx html]# vim ../conf/nginx.conf        #Edit its profile
        location ~* ^.+\.(jpg|gif|png|swf|flv|wma|wmv|asf|mp3|mmf|zip|rar)$ {
            valid_referers none blocked 192.168.20.5 www.test.com;
            if ($invalid_referer) {
            return 302 http://192.168.20.5/img/nolink.png; ා redirect it to nolink.png picture in img directory
            #return 404;     #Comment out the 404 status code returned
            break;
            }
            access_log off;
          }
[root@nginx html]# nginx -s reload      #Restart for configuration to take effect
[root@nginx img]# ls /usr/local/nginx1.14/html/img     #The redirected files are as follows:
nolink.png

6) when the client clicks the hyperlink again for testing, it will see the following page:

2. Pressure test

If the static page and php dynamic page of the web page are stress tested, the LNMP architecture needs to be installed and deployed. Here, a single deployment is used. Please refer to the document for the deployment process: LNMP architecture based on centos 7
, if it is only used for stress testing, MySQL database can not be installed.

Deployment LNMP schema process omitted...

After deployment, you need to change the configuration file:

[root@nginx html]# vim ../conf/nginx.conf      #Edit Master profile
#Add the following to the server {} field
location ~ \.php$ {
            root           html;
            fastcgi_pass   127.0.0.1:9000;
            fastcgi_index  index.php;
            fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
            include        fastcgi.conf;
        }
[root@nginx html]# pwd
/usr/local/nginx1.14/html
[root@nginx html]# cat test.php      #The contents of the test.php file in the root directory of the web page are as follows:
<?php
phpinfo();
?>

When you are finished, you need to make sure that you can see the following pages when you visit 192.168.20.5/test.php:

1) start the test:

[root@nginx ~]# ab -c 500 -n 50000 127.0.0.1/index.html
#Test the performance of static pages, 500 requests at a time, a total of 50000 requests.
Requests per second:    2407.58 [#/sec] (mean)     #Throughput of Nginx server
#We mainly focus on the above return information, that is, the throughput of Nginx server.
#Better server performance, higher throughput
[root@nginx html]# ab -c 100 -n 1000 127.0.0.1/test.php    #Select the corresponding value according to the server performance

For the explanation of other information returned by ab, please refer to the blog: Centos 7.3 deployment LAMP architecture dynamic static separation.

————————Thank you for reading————————