系统日志 time wait、__ratelimit、 SYN flooding含义
2014-04-14 15:05
309 查看
服务var/log/messages出现几种日志:
kernel: TCP: time wait bucket table overflow
kernel: __ratelimit: 5400 callbacks suppressed
kernel: possible SYN flooding on port 80. Sending cookies.
根据网上部分资料:
kernel: TCP: time wait bucket table overflow
是因为net.ipv4.tcp_max_tw_buckets过小导致。调整/etc/sysctl.conf中net.ipv4.tcp_max_tw_buckets值。
kernel: __ratelimit: 5400 callbacks suppressed
是因为kernel: TCP: time wait bucket table overflow错误过多导致。
含义是:限制了一些系统日志输出。避免加载日志路径。这里的5400条就已经很多了,也说明系统log信息太多导致,需要注意。
可以参见:
This "callbacks suppressed" message implies it suppressed a bulk of 44 syslog messages.
This is an attempt to avoid loading your syslog logging path.
Here is the source reference if you are interested,
FreeBSD/Linux Kernel Cross Reference; sys/net/core/utils.c,
It calls sys/lib/ratelimit.c --
以及
参考资料:
http://serverfault.com/questions/277009/what-does-net-ratelimit-44-callbacks-suppressed-mean-on-a-linux-based-router http://fxr.watson.org/fxr/source/lib/ratelimit.c?v=linux-2.6 http://lxr.oss.org.cn/source/lib/ratelimit.c?v=2.6.30
kernel: TCP: time wait bucket table overflow
kernel: __ratelimit: 5400 callbacks suppressed
kernel: possible SYN flooding on port 80. Sending cookies.
根据网上部分资料:
kernel: TCP: time wait bucket table overflow
是因为net.ipv4.tcp_max_tw_buckets过小导致。调整/etc/sysctl.conf中net.ipv4.tcp_max_tw_buckets值。
kernel: __ratelimit: 5400 callbacks suppressed
是因为kernel: TCP: time wait bucket table overflow错误过多导致。
含义是:限制了一些系统日志输出。避免加载日志路径。这里的5400条就已经很多了,也说明系统log信息太多导致,需要注意。
可以参见:
'net_ratelimit()' is used to limit syslog messages from kernel.
This "callbacks suppressed" message implies it suppressed a bulk of 44 syslog messages.
This is an attempt to avoid loading your syslog logging path.
Here is the source reference if you are interested,
FreeBSD/Linux Kernel Cross Reference; sys/net/core/utils.c,
It calls sys/lib/ratelimit.c --
___ratelimit()
以及
int ___ratelimit(struct ratelimit_state *rs, const char *func) { unsigned long flags; 31 int ret; 32 33 if (!rs->interval) 34 return 1; 35 36 /* 37 * If we contend on this state's lock then almost 38 * by definition we are too busy to print a message, 39 * in addition to the one that will be printed by 40 * the entity that is holding the lock already: 41 */ 42 if (!raw_spin_trylock_irqsave(&rs->lock, flags)) 43 return 0; 44 45 if (!rs->begin) 46 rs->begin = jiffies; 47 48 if (time_is_before_jiffies(rs->begin + rs->interval)) { 49 if (rs->missed) 50 printk(KERN_WARNING "%s: %d callbacks suppressed\n", 51 func, rs->missed); 52 rs->begin = 0; 53 rs->printed = 0; 54 rs->missed = 0; 55 }
参考资料:
http://serverfault.com/questions/277009/what-does-net-ratelimit-44-callbacks-suppressed-mean-on-a-linux-based-router http://fxr.watson.org/fxr/source/lib/ratelimit.c?v=linux-2.6 http://lxr.oss.org.cn/source/lib/ratelimit.c?v=2.6.30
相关文章推荐
- linux系统日志__ratelimit: N callbacks suppressed
- linux系统日志__ratelimit: N callbacks suppressed
- Linux系统消除未被及时释放的TIME_WAIT状态的TCP连接
- 系统出现大量time_wait的解决办法
- 在系统启动时,Windows Vista 中、 在 Windows 7 中,Windows Server 2008 中和在 Windows Server 2008 R2 中的 497 天后未关闭 TIME_WAIT 状态的所有 TCP/IP 端口
- TIME_WAIT导致系统越来越慢
- 在linux系统中处理TIME_WAIT连接过多
- 系统调优,你所不知道的TIME_WAIT和CLOSE_WAIT
- 系统存在大量TIME_WAIT状态的连接解决方法。
- 数据库超时--TIME_WAIT数量骤降,CLOSE_WAIT增加(四次握手)系统IO wait增加 --导致线上故障(274)
- 通讯系统经验谈【一】TCP连接状态分析:SYNC_RECV,CLOSE_WAIT,TIME_WAIT
- 系统出现大量TIME_WAIT状态的连接的解决办法
- 优化Linux下的内核TCP参数以提高系统性能 (TIME_WAIT处理)
- message日志报错:TCP: time wait bucket table overflow,K哥
- TCP编程:系统出现 TIME_WAIT 原因及解决办法
- 服务器日志中出现大量的“TIME_WAIT ”
- Centos6.5系统压力测试过程大量TIME_WAIT
- 通讯系统经验谈【一】TCP连接状态分析:SYNC_RECV,CLOSE_WAIT,TIME_WAIT
- 解决系统存在大量TIME_WAIT状态的连接
- 系统 TIME_WAIT累积与端口耗尽的问题