ipvs-sysctl.txt 5.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143
  1. /proc/sys/net/ipv4/vs/* Variables:
  2. am_droprate - INTEGER
  3. default 10
  4. It sets the always mode drop rate, which is used in the mode 3
  5. of the drop_rate defense.
  6. amemthresh - INTEGER
  7. default 1024
  8. It sets the available memory threshold (in pages), which is
  9. used in the automatic modes of defense. When there is no
  10. enough available memory, the respective strategy will be
  11. enabled and the variable is automatically set to 2, otherwise
  12. the strategy is disabled and the variable is set to 1.
  13. cache_bypass - BOOLEAN
  14. 0 - disabled (default)
  15. not 0 - enabled
  16. If it is enabled, forward packets to the original destination
  17. directly when no cache server is available and destination
  18. address is not local (iph->daddr is RTN_UNICAST). It is mostly
  19. used in transparent web cache cluster.
  20. debug_level - INTEGER
  21. 0 - transmission error messages (default)
  22. 1 - non-fatal error messages
  23. 2 - configuration
  24. 3 - destination trash
  25. 4 - drop entry
  26. 5 - service lookup
  27. 6 - scheduling
  28. 7 - connection new/expire, lookup and synchronization
  29. 8 - state transition
  30. 9 - binding destination, template checks and applications
  31. 10 - IPVS packet transmission
  32. 11 - IPVS packet handling (ip_vs_in/ip_vs_out)
  33. 12 or more - packet traversal
  34. Only available when IPVS is compiled with the CONFIG_IPVS_DEBUG
  35. Higher debugging levels include the messages for lower debugging
  36. levels, so setting debug level 2, includes level 0, 1 and 2
  37. messages. Thus, logging becomes more and more verbose the higher
  38. the level.
  39. drop_entry - INTEGER
  40. 0 - disabled (default)
  41. The drop_entry defense is to randomly drop entries in the
  42. connection hash table, just in order to collect back some
  43. memory for new connections. In the current code, the
  44. drop_entry procedure can be activated every second, then it
  45. randomly scans 1/32 of the whole and drops entries that are in
  46. the SYN-RECV/SYNACK state, which should be effective against
  47. syn-flooding attack.
  48. The valid values of drop_entry are from 0 to 3, where 0 means
  49. that this strategy is always disabled, 1 and 2 mean automatic
  50. modes (when there is no enough available memory, the strategy
  51. is enabled and the variable is automatically set to 2,
  52. otherwise the strategy is disabled and the variable is set to
  53. 1), and 3 means that that the strategy is always enabled.
  54. drop_packet - INTEGER
  55. 0 - disabled (default)
  56. The drop_packet defense is designed to drop 1/rate packets
  57. before forwarding them to real servers. If the rate is 1, then
  58. drop all the incoming packets.
  59. The value definition is the same as that of the drop_entry. In
  60. the automatic mode, the rate is determined by the follow
  61. formula: rate = amemthresh / (amemthresh - available_memory)
  62. when available memory is less than the available memory
  63. threshold. When the mode 3 is set, the always mode drop rate
  64. is controlled by the /proc/sys/net/ipv4/vs/am_droprate.
  65. expire_nodest_conn - BOOLEAN
  66. 0 - disabled (default)
  67. not 0 - enabled
  68. The default value is 0, the load balancer will silently drop
  69. packets when its destination server is not available. It may
  70. be useful, when user-space monitoring program deletes the
  71. destination server (because of server overload or wrong
  72. detection) and add back the server later, and the connections
  73. to the server can continue.
  74. If this feature is enabled, the load balancer will expire the
  75. connection immediately when a packet arrives and its
  76. destination server is not available, then the client program
  77. will be notified that the connection is closed. This is
  78. equivalent to the feature some people requires to flush
  79. connections when its destination is not available.
  80. expire_quiescent_template - BOOLEAN
  81. 0 - disabled (default)
  82. not 0 - enabled
  83. When set to a non-zero value, the load balancer will expire
  84. persistent templates when the destination server is quiescent.
  85. This may be useful, when a user makes a destination server
  86. quiescent by setting its weight to 0 and it is desired that
  87. subsequent otherwise persistent connections are sent to a
  88. different destination server. By default new persistent
  89. connections are allowed to quiescent destination servers.
  90. If this feature is enabled, the load balancer will expire the
  91. persistence template if it is to be used to schedule a new
  92. connection and the destination server is quiescent.
  93. nat_icmp_send - BOOLEAN
  94. 0 - disabled (default)
  95. not 0 - enabled
  96. It controls sending icmp error messages (ICMP_DEST_UNREACH)
  97. for VS/NAT when the load balancer receives packets from real
  98. servers but the connection entries don't exist.
  99. secure_tcp - INTEGER
  100. 0 - disabled (default)
  101. The secure_tcp defense is to use a more complicated state
  102. transition table and some possible short timeouts of each
  103. state. In the VS/NAT, it delays the entering the ESTABLISHED
  104. until the real server starts to send data and ACK packet
  105. (after 3-way handshake).
  106. The value definition is the same as that of drop_entry or
  107. drop_packet.
  108. sync_threshold - INTEGER
  109. default 3
  110. It sets synchronization threshold, which is the minimum number
  111. of incoming packets that a connection needs to receive before
  112. the connection will be synchronized. A connection will be
  113. synchronized, every time the number of its incoming packets
  114. modulus 50 equals the threshold. The range of the threshold is
  115. from 0 to 49.