一．体系架构 在Keepalived + Nginx高可靠负载均衡 架构中，keepalived负责实现High-availability (HA) 功能控制前端机VIP(虚拟网络地址)，当有设备发生故障时，热备服务器可以瞬间将VIP自动切换过来，实际运行中体验只有2秒钟切换时间，DNS服务可以负责前端VIP的负载均衡。tr eam具有负载均衡能力，可以自动判断后端的机器，并且自动踢出不能正常提供服务的机器；正则 分发和重定向更为灵活。而Keepalvied可保证单个nginx负载均衡器的有效性，避免单点故障；集群 机器安装：windows server 2008 R2+IIS7，分别命名为: WEB_1，WEB_2。wall -1-INPUT -mstat e --state NEW -m tcp -p tcp --dport 80 -j ACCEPTdate ls patch perl mhash(哈稀函数库)mkfs 之类的命令 才能真正地使用它，tmpfs 是一个文件系统，而不是块设备；您只是安装它，它就可以使用了。mkdir /dev/shm/tmpchmod 777 /dev/shm/tmpcd /usr/local/src #进入目录ftp ://ftp.csx.cam.ac.uk/pub/software/programming/pcre/pcre-8.30.tar.gzfile s/ngx_cache_purge-1.5.tar.gzdd www #添加www组useradd -g www www -s /bin/false #创建nginx运行账户www并加入到www组，不允许www用户直接登录系统 du le --with-openssl=/usr/inc lude/opensslzip _static_module解压 的路径，而不是安装的路径，否则编译会报错chown www.www -R /usr/local/nginx/html #设置目录所有者#!/bin/bash # nginx Startup script for the Nginx HTTP Server # it is v.1.3.0 version. # chkconfig : - 85 15 # description: Nginx is a high-perform ance web and proxy server. # It has a lot of features, but it's not for everyone. # processname: nginx # pidf ile: /var/run/nginx.pid # config: /usr/local/nginx/conf/nginx.conf nginxd=/usr/local/nginx/sbin/nginx nginx_config=/usr/local/nginx/conf/nginx.conf nginx_pid=/usr/local/nginx/logs/nginx.pid RETVAL=0 prog="nginx" # Source function library. . /etc/rc.d/init.d/functions # Source networking configuration. . /etc/sysconfig/network # Check that networking is up. [ ${NETWORKING} = "no" ] && ex it 0 [ -x $nginxd ] || exit 0 # Start nginx daemons functions. start() { if [ -e $nginx_pid ];then echo "nginx already running...." exit 1 fi echo -n $"Starting $prog: " daemon $nginxd -c ${nginx_config} RETVAL=$? echo [ $RETVAL = 0 ] && touch /var/lock/su bsys/nginx return $RETVAL } # Stop nginx daemons functions. stop() { echo -n $"Stopping $prog: " kill proc $nginxd RETVAL=$? echo [ $RETVAL = 0 ] && rm -f /var/lock/subsys/nginx /usr/local/nginx/logs/nginx.pid } reload() { echo -n $"Reloading $prog: " #kill -HUP `cat ${nginx_pid}` killproc $nginxd -HUP RETVAL=$? echo } # See how we were called. case "$1" in start) start ;; stop) stop ;; reload) reload ;; restart) stop start ;; status) status $prog RETVAL=$? ;; *) echo $"Usage: $prog {start|stop|restart|reload|status|help}" exit 1 esac exit $RETVAL mv /usr/local/nginx/conf/nginx.conf /usr/local/nginx/conf/nginx.conf.bakuser www www; worker_processes 4; # 工作进程数,为CPU的核心数或者两倍 error_log logs/error.log crit; # debug|info|notice|warn|error|crit pid logs/nginx.pid; events { use epoll; #Linux最常用支持大并发的事件触发机制 worker_connections 65535; } http { include mime.types; #设定mime类型,类型由mime.type文件定义 default_type application/octet-stream; log_format main '$remote_addr - $remote_user [$time _local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; access_log logs/access.log main; #设定请求缓冲 server_names_hash_bucket_size 256; #增加,原为128 client_header_buffer_size 256k; #增加,原为32k large_client_header_buffers 4 256k; #增加，原为32k #size limits client_max_body_size 50m; #允许客户端请求的最大的单个文件字节数 client_header_timeout 3m; client_body_timeout 3m; send_timeout 3m; sendfile on; tcp_nopush on; keepalive_timeout 120; tcp_nodelay on; server_tokens off; #不显示nginx版本信息 limit_conn_zone $binary_remote_addr zone=perip:10m; #添加limit_zone,限制同一IP并发数 #fastcgi_intercept_errors on; #开启错误页面跳转 include gzip .conf; #压缩 配置文件 include proxy.conf; #proxy_cache参数配置文件 include vhost/*.conf; #nginx虚拟主机包含文件目录 include mysvrhost.conf; #后端WEB服务器列表文件 } proxy_temp_path /tmp/proxy_temp; proxy_cache_path /tmp/proxy_cache levels=1:2 keys_zone=cache_one:500m inactive=1d max_size=3g; client_body_buffer_size 512k; #原为512k proxy_connect_timeout 50; #代理连接超时 proxy_read_timeout 600; #代理发送超时 proxy_send_timeout 600; #代理接收超时 proxy_buffer_size 128k; #代理缓冲大小，原为32k proxy_buffers 16 256k; #代理缓冲，原为4 64k proxy_busy_buffers_size 512k; #高负荷下缓冲大小，原为128k proxy_temp_file_write _size 1024m; #proxy缓存临时文件的大小原为128k #proxy_ignore_client_abort on; #不允许代理端主动关闭连接 proxy_next_upstream error timeout invalid_header http_500 http_503 http_404 http_502 http_504; upstream cn100 { ip_hash; #会话保持 server 192.168.0.115 max_fails=1 fail_timeout=60s; server 192.168.0.109 max_fails=1 fail_timeout=60s; } #网页GZIP压缩设置 #2012.4.2 #可通过http://tool.chinaz.com/Gzips/检测压缩情况 # #启动预压缩功能，对所有类型的文件都有效 gzip_static on; #开启nginx_static后，对于任何文件都会先查找是否有对应的gz文件 #找不到预压缩文件，进行动态压缩 gzip on; gzip_min_length 1k; #设置最小的压缩值,单位为bytes.超过设置的min_length的值会进行压缩,小于的不压缩. gzip_comp_level 3; #压缩等级设置,1-9,1是最小压缩,速度也是最快的;9刚好相反,最大的压缩,速度是最慢的,消耗的CPU资源也多 gzip_buffers 16 64k; #设置系统的缓存大小,以存储GZIP压缩结果的数据流,它可以避免nginx频烦向系统申请压缩空间大小 gzip_types text/plain application/x-javascript text/css text/javascript; #关于gzip_types，如果你想让图片也开启gzip压缩，那么用以下这段吧： #gzip_types text/plain application/x-javascript text/css text/javascript application/x-httpd -php image/jpeg image/gif image/png; #gzip公共配置 gzip_http_version 1.1; #识别http的协议版本(1.0/1.1) gzip_proxied any; #设置使用代理时是否进行压缩，默认是off的 gzip_vary on; #和http头有关系,加个vary头,代理判断是否需要压缩 gzip_disable "MSIE [1-6]."; #禁用IE6的gzip压缩 server { listen 80; server_name localhost; #charset GB2312; location / { proxy_redirect off; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_pass http://cn100; } # 查看nginx的并发连接数配置 location /NginxStatus { stub_status on; access_log off; auth_basic "NginxStatus"; } access_log off; error_page 404 /404.html; error_page 500 502 503 504 /404.html; location = /404.html { root html; } limit_conn perip 50; #同一ip并发数为50,超过会返回503 } net.ipv4.ip_forward = 0 net.ipv4.conf.default.rp_filter = 1 net.ipv4.conf.default.accept_source_route = 0 kernel.sysrq = 0 kernel.core_uses_pid = 1 net.ipv4.tcp_sync ookies = 1 kernel.msgmnb = 65536 kernel.msgmax = 65536 kernel.shmmax = 68719476736 kernel.shmall = 4294967296 net.ipv4.tcp_max_tw_buckets = 6000 net.ipv4.tcp_sack = 1 net.ipv4.tcp_window_scaling = 1 net.ipv4.tcp_rmem = 4096 87380 4194304 net.ipv4.tcp_wmem = 4096 16384 4194304 net.core.wmem_default = 8388608 net.core.rmem_default = 8388608 net.core.rmem_max = 16777216 net.core.wmem_max = 16777216 net.core.netdev_max_backlog = 262144 net.core.somaxconn = 262144 net.ipv4.tcp_max_orphans = 3276800 net.ipv4.tcp_max_syn_backlog = 262144 net.ipv4.tcp_timestamps = 0 net.ipv4.tcp_synack_retries = 1 net.ipv4.tcp_syn_retries = 1 net.ipv4.tcp_tw_recycle = 1 net.ipv4.tcp_tw_reuse = 1 net.ipv4.tcp_mem = 94500000 915000000 927000000 net.ipv4.tcp_fin_timeout = 1 net.ipv4.tcp_keepalive_time = 30 net.ipv4.ip_local_port_range = 1024 65000 允许系统打开的端口范围 cut _nginx_log.sh#/bin/bash savepath_log='/usr/local/nginx/logs' nglogs='/usr/local/nginx/logs' mkdir -p $savepath_log/$(date +%Y)/$(date +%m) mv $nglogs/access.log $savepath_log/$(date +%Y)/$(date +%m)/access.$(date +%Y%m%d).log mv $nglogs/error.log $savepath_log/$(date +%Y)/$(date +%m)/error.$(date +%Y%m%d).log kill -USR1 `cat /usr/local/nginx/logs/nginx.pid` crontab ，每天凌晨00:00切割nginx访问日志server { listen 80; server_name localhost; #charset GB2312; location / { proxy_pass http://cn100; proxy_redirect off; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_cache cache_one; proxy_cache_valid 200 302 304 1h; #200、302、304错误状态码保存1小时 proxy_cache_valid 301 1d; #301错误状态码保存1天 proxy_cache_valid any 1m; #其余的保存1分钟 #以域名、URI、参数组合成Web缓存的Key值，存储缓存内容到二级缓存目录内 proxy_cache_key $host$uri$is_args$args; expires 30d; #设置失效时间为30天 } # 设置手动清除URL缓存 location ~ /purge(/.*) { # 设置只允许指定的IP或IP段才可以清除URL缓存 allow 127.0.0.1; allow 192.168.0.0/16; deny all ; proxy_cache_purge cache_one $host$1$is_args$args; } location /NginxStatus { stub_status on; access_log off; auth_basic "NginxStatus"; allow 192.168.0.0/16; deny all; } access_log off; error_page 404 /404.html; error_page 500 502 503 504 /404.html; location = /404.html { root html; } limit_conn ctohome_zone 50; #同一ip并发数为50,超过会返回503 } ! Configuration File for keepalived global_defs { notification_email { servererror@cn100.com } notification_email_from Alexandre.Cassen@firewall.loc smtp_server mail.cn100.com # smtp_connect_timeout 30 router_id LVS_DEVEL } vrrp_script chk_http_port { script "/etc/keepalived/nginx_pid.sh" # 检查nginx状态的脚本 interval 2 weight 3 } vrrp_instance VI_1 { state MASTER interface eth0 virtual_router_id 51 priority 100 advert_int 1 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 192.168.0.56 # 192.168.200.17 # 192.168.200.18 } track_script { chk_http_port } } #!/bin/bash #version 0.0.1 # A=`ps -C nginx --no-header |wc -l` if [ $A -eq 0 ];then # /usr/sbin/nginx service nginx start sleep 3 if [ `ps -C nginx --no-header |wc -l` -eq 0 ];then # killall keepalived service keepalived stop fi fi col ，虚拟路由器冗余协议） 在iptables配置当中增加：-I INPUT -s 192.168.0.47 -d 224.0.0.18 -j１. 当NGINX_MASTER、NGINX_BACKUP服务器nginx均正常工作时在NGINX_MASTER上：２.关闭NGINX_MASTER的keepalived和nginx服务 ，NGINX_BACKUP正常工作时在NGINX_MASTER上：３.将 NGINX_MASTER的keepalived和nginx服务启动，关闭NGINX_BACKUP的keepalived和nginx服务NGINX_MASTER的eth0网卡重新绑定VIP，通过浏览器访问网站正常。 ４.关闭WEB_1服务器，通过浏览器访问网站正常。
运维网声明
1、欢迎大家加入本站运维交流群:群②:261659950 群⑤:202807635 群⑦870801961 群⑧679858003运维网
QQ群⑧：
窥视卡
雷达卡
发表于 2015-11-20 03:36:06
提升卡
置顶卡
沉默卡
喧嚣卡
变色卡
千斤顶
显身卡