共计 20025 个字符，预计需要花费 51 分钟才能阅读完成。
系统环境：
SUSE Linux Enterprise Server 10 SP1 (x86_64)
注：所有软件包都放置在 /data/software 目录下
nginx_tcp_proxy_module：
https://github.com/yaoweibin/nginx_tcp_proxy_module
nginx-hmux-module：
https://github.com/wangbin579/nginx-hmux-module
ngx_cache_purge：
http://labs.frickle.com/files/
#———————————————————————————————————————————————
1、内存管理库
# tar -zxvf libunwind-1.0.1.tar.gz
# cd libunwind-1.0.1
# LAGS=-fPIC ./configure –prefix=/usr/local
# make LAGS=-fPIC
# make LAGS=-fPIC install
# tar -zxvf gperftools-2.0.tar.gz
# cd gperftools-2.0
# ./configure –prefix=/usr/local
# make && make install
#———————————————————————————————————————————————
2、正则库
# tar -xvzf pcre-8.32.tar.gz
# cd pcre-8.32
# LAGS=-fPIC ./configure –prefix=/usr/local
# make LAGS=-fPIC
# make LAGS=-fPIC install
#———————————————————————————————————————————————
3、OpenSSL 库
# tar xvzf openssl-1.0.1g.tar.gz
# cd openssl-1.0.1g
# ./config shared –prefix=/usr/local
# make && make install
#———————————————————————————————————————————————
4、IP 地理位置定位组件
# tar xvzf GeoIP-latest.tar.gz
# cd GeoIP-1.5.0
# ./configure –prefix=/usr/local
# make && make install
#———————————————————————————————————————————————
5、相关目录创建
# mkdir -p /data/nginx_temp/{nginx_client,nginx_proxy,nginx_fastcgi,nginx_temp,nginx_cache}
# mkdir -p /data/logs/{nginx,web} /data/web/{data,conf}
#———————————————————————————————————————————————
6、Tengine 编译安装
# tar xvzf nginx-hmux-module-1.3.tar.gz
# tar xvzf nginx_tcp_proxy_module-0.4.5.tar.gz
# tar xvzf tengine-1.5.2.tar.gz
# cd tengine-1.5.2
# patch -p1 < ../nginx_tcp_proxy_module-0.4.5/tcp.patch
# ./configure –prefix=/usr/local/nginx \
–lock-path=/var/lock/nginx.lock \
–pid-path=/var/run/nginx.pid \
–error-log-path=/data/logs/nginx/error.log \
–http-log-path=/data/logs/nginx/access.log \
–user=nobody \
–group=nogroup \
–with-pcre=../pcre-8.32 \
–with-pcre-opt=-fPIC \
–with-openssl=../openssl-1.0.1g \
–with-openssl-opt=-fPIC \
–with-backtrace_module \
–with-http_stub_status_module \
–with-http_gzip_static_module \
–with-http_realip_module \
–with-http_concat_module=shared \
–with-http_sysguard_module=shared \
–with-http_limit_conn_module=shared \
–with-http_limit_req_module=shared \
–with-http_split_clients_module=shared \
–with-http_footer_filter_module=shared \
–with-http_geoip_module=shared \
–with-http_sub_module=shared \
–with-http_access_module=shared \
–with-http_upstream_ip_hash_module=shared \
–with-http_upstream_least_conn_module=shared \
–with-http_referer_module=shared \
–with-http_rewrite_module=shared \
–with-http_memcached_module=shared \
–with-http_upstream_session_sticky_module=shared \
–with-http_addition_module=shared \
–with-http_xslt_module=shared \
–with-http_image_filter_module=shared \
–with-http_user_agent_module=shared \
–with-http_empty_gif_module=shared \
–with-http_browser_module=shared \
–with-google_perftools_module \
–with-http_map_module=shared \
–with-http_userid_filter_module=shared \
–with-http_charset_filter_module=shared \
–with-http_trim_filter_module=shared \
–with-http_lua_module=shared \
–without-http_fastcgi_module \
–without-http_uwsgi_module \
–without-http_scgi_module \
–without-select_module \
–without-poll_module \
–add-module=../nginx-hmux-module-1.3 \
–add-module=../nginx_tcp_proxy_module-0.4.5 \
–with-ld-opt=’-ltcmalloc_minimal’ \
–http-client-body-temp-path=/data/nginx_temp/nginx_client \
–http-proxy-temp-path=/data/nginx_temp/nginx_proxy \
–http-fastcgi-temp-path=/data/nginx_temp/nginx_fastcgi
# make && make install
#———————————————————————————————————————————————
7、Tengine 缓存刷新模块
# cd /data/software
# tar xvzf ngx_cache_purge-2.0.tar.gz
# ./dso_tool –add-module=/data/software/ngx_cache_purge-2.0
#———————————————————————————————————————————————
8、Tengine 配置
# rm -f /usr/local/nginx/html/*.html
# rm -f /usr/local/nginx/conf/*.default
# mkdir /usr/local/nginx/conf/SET
# vim /usr/local/nginx/conf/nginx.conf
user nobody nogroup;
worker_processes auto;
worker_cpu_affinity auto;
error_log /data/logs/nginx/error.log crit;
pid /var/run/nginx.pid;
google_perftools_profiles /var/tmp/tcmalloc;
worker_rlimit_nofile 65535;
dso {
load ngx_http_rewrite_module.so;
load ngx_http_access_module.so;
load ngx_http_concat_module.so;
load ngx_http_limit_conn_module.so;
load ngx_http_limit_req_module.so;
load ngx_http_sysguard_module.so;
load ngx_http_upstream_session_sticky_module.so;
load ngx_http_cache_purge_module.so;
load ngx_http_trim_filter_module.so;
}
events {
use epoll;
worker_connections 10240;
}
http {
server_tokens off;
server_tag off;
autoindex off;
access_log off;
include mime.types;
default_type application/octet-stream;
server_names_hash_bucket_size 128;
client_header_buffer_size 32k;
large_client_header_buffers 4 32k;
client_max_body_size 10m;
client_body_buffer_size 256k;
sendfile on;
tcp_nopush on;
keepalive_timeout 60;
tcp_nodelay on;
gzip on;
gzip_min_length 1k;
gzip_buffers 4 16k;
gzip_http_version 1.0;
gzip_comp_level 2;
gzip_types text/plain application/x-javascript text/css application/xml;
gzip_vary on;
proxy_connect_timeout 600;
proxy_read_timeout 600;
proxy_send_timeout 600;
proxy_buffer_size 128k;
proxy_buffers 4 128k;
proxy_busy_buffers_size 256k;
proxy_temp_file_write_size 256k;
proxy_headers_hash_max_size 1024;
proxy_headers_hash_bucket_size 128;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_temp_path /data/nginx_temp/nginx_temp;
proxy_cache_path /data/nginx_temp/nginx_cache levels=1:2 keys_zone=cache_one:2048m inactive=30m max_size=60g;
# backend web server address pool
include SET/*.conf;
log_format access ‘$remote_addr – $remote_user [$time_local] “$request”‘
‘$status $body_bytes_sent “$http_referer”‘
‘”$http_user_agent” $http_x_forwarded_for’;
# system resource overload protect
server {
sysguard on;
sysguard_load load=10.5 action=/loadlimit;
sysguard_mem swapratio=20% action=/swaplimit;
sysguard_mem free=100M action=/freelimit;
location /loadlimit {
return 503;
}
location /swaplimit {
return 503;
}
location /freelimit {
return 503;
}
}
# refuse request server by ipaddr
server {
server_name _;
return 404;
}
# web page cache and proxy setting
include /data/web/conf/*.conf;
}
# vim /usr/local/nginx/conf/SET/NORTH1.conf
upstream NORTH1_SERVER_PROXY {
consistent_hash $request_uri;
server 192.168.1.101:80 weight=1;
server 192.168.1.102:80 weight=1;
server 192.168.1.103:80 weight=1;
server 192.168.1.104:80 weight=1;
session_sticky;
check interval=3000 rise=2 fall=5 timeout=1000 type=http;
check_http_send “GET / HTTP/1.0\r\n\r\n”;
check_http_expect_alive http_2xx http_3xx;
}
# mkdir -p /data/logs/web/test.qq.com
# vim /data/web/conf/test.qq.com.conf
server {
listen 80;
server_name test.qq.com;
index index.html index.htm index.php;
root /data/nginx_temp/nginx_cache;
access_log on;
trim on;
trim_jscss on;
location / {
proxy_next_upstream http_500 http_502 http_503 http_504 error timeout invalid_header;
proxy_pass http://NORTH1_SERVER_PROXY;
#存在静态首页时，才需添加此规则
if (-d $request_filename) {
rewrite ^/(.*)$ http://$host/index.html break;
}
}
location ~ .*\. (php)?$ {
proxy_next_upstream http_500 http_502 http_503 http_504 error timeout invalid_header;
proxy_pass http://NORTH1_SERVER_PROXY;
}
location ~ /purge(/.*) {
allow 127.0.0.1;
allow 192.168.1.0/24;
deny all;
proxy_cache_purge cache_one $host$1$is_args$args;
}
location ~ .*\.(htm|html|js|css|gif|jpg|jpeg|png|bmp|ico|swf|flv)$ {
proxy_next_upstream http_500 http_502 http_503 http_504 error timeout invalid_header;
proxy_cache cache_one;
proxy_cache_valid 200 304 15m;
proxy_cache_valid 301 302 10m;
proxy_cache_valid any 1m;
proxy_cache_key $host$uri$is_args$args;
add_header Ten-webcache ‘$upstream_cache_status from $host’;
proxy_pass http://NORTH1_SERVER_PROXY;
expires 30m;
}
location ~ /\.ht {
deny all;
}
access_log /data/logs/web/test.qq.com/access.log access;
}
#———————————————————————————————————————————————
9、Tengine 启动脚本
# vim /etc/init.d/nginx
#!/bin/sh
#
# nginx – this script start and stop the nginx daemon
#
# chkconfig: 2345 55 25
# description: Startup script for nginx
# processname: nginx
# config: /usr/local/nginx/conf/nginx.conf
# pidfile: /var/run/nginx.pid
#
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
DAEMON=/usr/local/nginx/sbin/nginx
CONFIGFILE=/usr/local/nginx/conf/nginx.conf
PIDFILE=/var/run/nginx.pid
SCRIPTNAME=/etc/init.d/nginx
LOCKFILE=/var/lock/nginx.lock
set -e
[-x “$DAEMON”] || exit 0
start() {
echo “Startting Nginx……”
[-x $DAEMON] || exit 5
[-f $CONFIGFILE] || exit 6
$DAEMON -c $CONFIGFILE || echo -n “Nginx already running!”
[$? -eq 0] && touch $LOCKFILE
}
stop() {
echo “Stopping Nginx……”
MPID=`ps aux | grep nginx | awk ‘/master/{print $2}’`
if [“${MPID}X” != “X” ]; then
kill -QUIT $MPID
[$? -eq 0] && rm -f $LOCKFILE
else
echo “Nginx server is not running!”
fi
}
reload() {
echo “Reloading Nginx……”
MPID=`ps aux | grep nginx | awk ‘/master/{print $2}’`
if [“${MPID}X” != “X” ]; then
kill -HUP $MPID
else
echo “Nginx can’t reload!”
fi
}
case “$1” in
start)
start
;;
stop)
stop
;;
reload)
reload
;;
restart)
stop
sleep 1
start
;;
*)
echo “Usage: $SCRIPTNAME {start|stop|reload|restart}”
exit 3
;;
esac
exit 0
# chmod +x /etc/init.d/nginx
# chkconfig –add nginx
# service nginx start
#———————————————————————————————————————————————
10、Tengine 健康检测
# mkdir -p /data/web/data/mycheckweb.act.qq.com
# echo “OK” > /data/web/data/mycheckweb.act.qq.com/index.html
# echo “ 你的内网 IP mycheckweb.act.qq.com” >> /etc/hosts
# touch /var/lock/check_web.lock
#vim /data/web/conf/checkweb_for_nginx.conf
server {
listen 80;
server_name mycheckweb.act.qq.com;
access_log off;
location / {
root /data/web/data/mycheckweb.act.qq.com;
index index.html;
}
location ~ health_status {
check_status;
allow 127.0.0.1;
allow 192.168.1.0/24;
deny all;
}
}
# vim /usr/local/nginx/sbin/check_web.sh
#!/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
retval=`ping -c 3 mycheckweb.act.qq.com | awk ‘/received/ {print $4}’`
[[${retval} -eq 0 ]] && exit 1
retval=`curl -I -s “http://mycheckweb.act.qq.com” | grep “200 OK”`
if [[“${retval}x” = “x” ]]; then
[[-e /usr/local/nginx]] && /sbin/service nginx restart >/dev/null 2>&1
fi
#chmod +x /usr/local/nginx/sbin/check_web.sh
# crontab -e
*/5 * * * * (flock –timeout=0 /var/lock/check_web.lock /usr/local/nginx/sbin/check_web.sh >/dev/null 2>&1)
#———————————————————————————————————————————————
11、Tengine 访问日志切割与清理
# vim /usr/local/nginx/sbin/cut_nginx_log.sh
#!/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
## the nginx access logs base path
WEBLOG_PATH=”/data/logs/web”
retval=`ps aux | grep ngin[x] | wc -l`
if [${retval} -eq 0 ]; then
echo “The daemon process for nginx has no found.”
exit 1
fi
## avoid errors for USR1 signal, and modify 750 privilege
chown -R nobody:nogroup /data/logs/{nginx,web}
chmod -R 750 /data/logs/{nginx,web}
## cut nginx access logs
for LOGFILE in `find ${WEBLOG_PATH} -type f -name access.log`
do
LOGPATH=`dirname ${LOGFILE}`
mv ${LOGPATH}/access.log ${LOGPATH}/access_$(date -d “yesterday” +”%Y-%m-%d”).log
done
kill -USR1 `ps aux | grep nginx | awk ‘/master/{print $2}’`
## and then modify original privileges
chown -R nobody:nogroup /data/logs/{nginx,web}
chmod -R 640 /data/logs/{nginx,web}
## clear 10 days ago’s nginx access logs
LOGFILE=access_$(date -d “10 days ago” +”%Y-%m-%d”).log
find ${WEBLOG_PATH} -type f -name ${LOGFILE} -exec rm -f {} \;
# crontab -e
00 00 * * * /bin/bash /usr/local/nginx/sbin/cut_nginx_log.sh >/dev/null 2>&1
#———————————————————————————————————————————————
12、系统优化
## 网络参数设置
# vim /etc/sysctl.conf
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_keepalive_time = 1200
net.ipv4.ip_local_port_range = 1024 65000
net.ipv4.tcp_max_syn_backlog = 8192
net.ipv4.tcp_max_tw_buckets = 80000
net.core.somaxconn = 32768
net.ipv4.tcp_keepalive_probes = 5
net.ipv4.tcp_keepalive_intvl = 20
net.core.wmem_default = 8388608
net.core.rmem_default = 8388608
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216
net.core.netdev_max_backlog = 32768
net.ipv4.tcp_timestamps = 0
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 2
net.ipv4.tcp_retries2 = 5
net.ipv4.tcp_mem = 41943040 73400320 94371840
net.ipv4.tcp_max_orphans = 3276800
fs.file-max = 1300000
# sysctl -p
## 文件描述符设置
# echo “ulimit -SHn 65535” >> /etc/profile
# source /etc/profile
#———————————————————————————————————————————————
13、测试
本地 HOSTS 绑定访问
http://mycheckweb.act.qq.com/health_status
相关阅读 ：
CentOS 6.4 制作 Tengine 的 rpm 包 http://www.linuxidc.com/Linux/2013-12/93786.htm
Tengine 动态开启模块试用 http://www.linuxidc.com/Linux/2012-12/75849.htm
CentOS 6.3 用 ICC 编译 PHP5.4.8+Percona5.5.27+Tengine1.4.1 http://www.linuxidc.com/Linux/2012-12/76636.htm
基于淘宝 Tengine 和 Scribe 的 WEB 日志收集方案 http://www.linuxidc.com/Linux/2012-02/52997.htm
基于 Tengine 部署 LNMP 环境 http://www.linuxidc.com/Linux/2014-01/95148.htm
Tengine 的详细介绍 ：请点这里
Tengine 的下载地址 ：请点这里
本文永久更新链接地址 ：http://www.linuxidc.com/Linux/2015-09/123058.htm
