TCP: time wait bucket table overflow 解决案例
#一台Nginx+php-fcgi的服务器做了负载均衡，在主控端发现一直在报错：
view source
print?
01#----------------------------引用文字-开始----------------------------
02Apr 19 14:48:38 chengyongxu.com kernel: TCP: time wait bucket table overflow
03Apr 19 14:48:44 chengyongxu.com kernel: printk: 137 messages suppressed.
04Apr 19 14:48:44 chengyongxu.com kernel: TCP: time wait bucket table overflow
05Apr 19 14:48:52 chengyongxu.com kernel: printk: 251 messages suppressed.
06Apr 19 14:48:52 chengyongxu.com kernel: TCP: time wait bucket table overflow
07Apr 19 14:48:53 chengyongxu.com kernel: printk: 51 messages suppressed.
08Apr 19 14:48:53 chengyongxu.com kernel: TCP: time wait bucket table overflow
09Apr 19 14:48:59 chengyongxu.com kernel: printk: 119 messages suppressed.
10#----------------------------引用文字-结束----------------------------
#再看80端口连接状态
view source
print?
01netstat -an | grep 80 | awk '{print $6}' | sort | uniq -c | sort -rn
02#----------------------------引用文字-开始----------------------------
03 4202 TIME_WAIT
04 30 FIN_WAIT1
05 9 ESTABLISHED
06 5 SYN_RECV
07 4 LISTEN
08 4 FIN_WAIT2
09 4 CLOSING
10 2 CONNECTED
11 2
12#----------------------------引用文字-结束----------------------------
#根据报错提示，需要更改net.ipv4.tcp_max_tw_buckets这个内核参数。这个参数是系统同时保持timewait套接字的最大数量。如果超过这个数字，time-wait套接字将立刻被清除并打印警告信息。这个限制仅仅是为了防止简单的 DoS攻击，你绝对不能过分依靠它或者人为地减小这个值，如果网络实际需要大于缺省值，更应该增加这个值(如果增加了内存之后)。
view source
print?
01vi /etc/sysconfig/sysctl.conf
02#----------------------------引用文字-开始----------------------------
03#找到：
04net.ipv4.tcp_max_tw_buckets = 6000
05#改为
06net.ipv4.tcp_max_tw_buckets = 10000
07#----------------------------引用文字-结束----------------------------
08#保存并打印设置
09sysctl -p
10
11#再看80端口连接状态
12netstat -an | grep 80 | awk '{print $6}' | sort | uniq -c | sort -rn
13#----------------------------引用文字-开始----------------------------
14 5928 TIME_WAIT
15 42 FIN_WAIT1
16 14 ESTABLISHED
17 10 FIN_WAIT2
18 6 CLOSING
19 4 SYN_RECV
20 4 LISTEN
21 2 CONNECTED
22 2
23#----------------------------引用文字-结束----------------------------
24netstat -an | grep 80 | awk '{print $6}' | sort | uniq -c | sort -rn
25#----------------------------引用文字-开始----------------------------
26 5510 TIME_WAIT
27 34 FIN_WAIT1
28 9 SYN_RECV
29 9 ESTABLISHED
30 7 FIN_WAIT2
31 6 CLOSING
32 4 LISTEN
33 2 CONNECTED
34 2
35#----------------------------引用文字-结束----------------------------
36netstat -an | grep 80 | awk '{print $6}' | sort | uniq -c | sort -rn
37#----------------------------引用文字-开始----------------------------
38 5687 TIME_WAIT
39 38 FIN_WAIT1
40 16 ESTABLISHED
41 10 SYN_RECV
42 6 FIN_WAIT2
43 6 CLOSING
44 4 LISTEN
45 2 CONNECTED
46 2
47#----------------------------引用文字-结束----------------------------
48netstat -an | grep 80 | awk '{print $6}' | sort | uniq -c | sort -rn
49#----------------------------引用文字-开始----------------------------
50 5688 TIME_WAIT
51 38 FIN_WAIT1
52 19 ESTABLISHED
53 9 SYN_RECV
54 6 FIN_WAIT2
55 6 CLOSING
56 4 LISTEN
57 2 CONNECTED
58 2
59#----------------------------引用文字-结束----------------------------
#再看/var/log/messages和dmesg的信息，已经不再报错了，看来net.ipv4.tcp_max_tw_buckets=10000暂时是够用了