我如何知道如果tcp调谐会帮助我?

在Centos7上运行logstash,我认为网卡可能已经饱和了。

在logstash服务器上,我可以看到服务器发送日志的请求q。 但我不确定如果请求q是高的基于我的设置,或者如果tcp调整将帮助我在这里。

一些信息:

sysctl -a | grep mem net.core.optmem_max = 20480 net.core.rmem_default = 212992 net.core.rmem_max = 212992 net.core.wmem_default = 212992 net.core.wmem_max = 212992 net.ipv4.igmp_max_memberships = 20 net.ipv4.tcp_mem = 227763 303685 455526 net.ipv4.tcp_rmem = 4096 87380 6291456 net.ipv4.tcp_wmem = 4096 16384 4194304 net.ipv4.udp_mem = 229686 306249 459372 net.ipv4.udp_rmem_min = 4096 net.ipv4.udp_wmem_min = 4096 vm.lowmem_reserve_ratio = 256 256 32 vm.memory_failure_early_kill = 0 vm.memory_failure_recovery = 1 vm.nr_hugepages_mempolicy = 0 vm.overcommit_memory = 0 netstat -na --tcp | grep :9123 tcp6 0 0 :::9123 :::* LISTEN tcp6 247834 0 192.168.123.123:9123 10.16.1.82:52289 ESTABLISHED tcp6 241242 0 192.168.123.123:9123 10.31.31.232:65293 ESTABLISHED tcp6 0 0 192.168.123.123:9123 10.16.1.198:53693 ESTABLISHED tcp6 0 0 192.168.123.123:9123 10.16.1.198:56751 ESTABLISHED tcp6 331114 0 192.168.123.123:9123 10.31.35.157:53998 ESTABLISHED tcp6 256047 0 192.168.123.123:9123 10.16.2.155:52221 ESTABLISHED tcp6 240498 0 192.168.123.123:9123 10.19.5.166:51805 ESTABLISHED tcp6 312648 0 192.168.123.123:9123 10.18.16.155:57975 ESTABLISHED tcp6 234321 0 192.168.123.123:9123 10.18.19.242:51664 ESTABLISHED tcp6 255079 0 192.168.123.123:9123 10.19.4.51:51458 ESTABLISHED tcp6 256328 0 192.168.123.123:9123 10.18.45.89:56821 ESTABLISHED tcp6 237167 0 192.168.123.123:9123 10.18.33.26:49278 ESTABLISHED tcp6 248204 0 192.168.123.123:9123 10.18.30.250:54267 ESTABLISHED tcp6 248573 0 192.168.123.123:9123 10.16.1.198:57522 ESTABLISHED tcp6 238348 0 192.168.123.123:9123 10.18.11.169:55147 ESTABLISHED tcp6 243762 0 192.168.123.123:9123 10.31.22.48:60425 ESTABLISHED tcp6 258035 0 192.168.123.123:9123 10.31.46.31:60432 ESTABLISHED tcp6 241863 0 192.168.123.123:9123 10.18.45.113:63376 ESTABLISHED tcp6 327889 0 192.168.123.123:9123 10.18.3.219:58640 ESTABLISHED tcp6 317363 0 192.168.123.123:9123 10.31.37.249:65162 ESTABLISHED tcp6 252394 0 192.168.123.123:9123 10.16.1.92:56360 ESTABLISHED tcp6 326401 0 192.168.123.123:9123 10.31.17.74:53948 ESTABLISHED tcp6 0 0 192.168.123.123:9123 10.16.2.12:53781 ESTABLISHED tcp6 244669 0 192.168.123.123:9123 10.18.18.100:49281 ESTABLISHED tcp6 250264 0 192.168.123.123:9123 10.18.32.116:56795 ESTABLISHED tcp6 0 0 192.168.123.123:9123 10.16.1.82:49304 ESTABLISHED tcp6 310864 0 192.168.123.123:9123 10.18.11.25:64230 ESTABLISHED tcp6 247973 0 192.168.123.123:9123 10.18.22.230:55209 ESTABLISHED tcp6 0 0 192.168.123.123:9123 10.17.1.8:51741 ESTABLISHED tcp6 0 0 192.168.123.123:9123 10.16.2.12:54507 ESTABLISHED tcp6 251552 0 192.168.123.123:9123 10.18.24.83:63499 ESTABLISHED tcp6 251481 0 192.168.123.123:9123 10.16.2.72:57268 ESTABLISHED tcp6 0 0 192.168.123.123:9123 10.16.1.198:53406 ESTABLISHED tcp6 312263 0 192.168.123.123:9123 10.19.12.239:52173 ESTABLISHED tcp6 238878 0 192.168.123.123:9123 10.18.5.198:57978 ESTABLISHED tcp6 322460 0 192.168.123.123:9123 10.18.5.124:53117 ESTABLISHED tcp6 0 0 192.168.123.123:9123 10.16.2.72:54883 ESTABLISHED tcp6 237717 0 192.168.123.123:9123 10.16.2.12:56387 ESTABLISHED tcp6 315963 0 192.168.123.123:9123 10.18.26.44:49197 ESTABLISHED tcp6 248914 0 192.168.123.123:9123 10.18.41.101:51859 ESTABLISHED tcp6 0 0 192.168.123.123:9123 10.16.2.155:49303 ESTABLISHED tcp6 316994 0 192.168.123.123:9123 10.18.44.120:49375 ESTABLISHED tcp6 236421 0 192.168.123.123:9123 10.31.43.130:51590 ESTABLISHED tcp6 240929 0 192.168.123.123:9123 10.17.1.114:63546 ESTABLISHED tcp6 306346 0 192.168.123.123:9123 10.17.2.159:61633 ESTABLISHED tcp6 239360 0 192.168.123.123:9123 10.18.39.43:54080 ESTABLISHED tcp6 245361 0 192.168.123.123:9123 10.19.13.107:52629 ESTABLISHED tcp6 244398 0 192.168.123.123:9123 10.18.11.195:53257 ESTABLISHED 

您当然可以调整您的网卡,“ RedHatnetworking性能调整指南”提供了一个相当完整的(并且有些近期的,2015年的)一系列要考虑的项目。

例如,该文档build议用于TCP rmem的16384 349520 16777216 (无论您需要调整wmem取决于您的设置 – 从您分享的内容看,这似乎不是必要的)。

但是,在我看来,这将指向logstash是一个瓶颈 – 您的接收队列是在给定端口(logstash)上侦听进程的缓冲区,因此增加这些缓冲区并不能真正解决潜在的问题。 它看起来像logstash已经(相对)慢,更多的networking缓冲区听起来不像它会使速度更快。

检查您的logstashconfiguration/parsing器是否可以针对您的情况/需求进行优化(如果您使用正则expression式,这可能是一个很好的调查领域)。

您可能需要增加可用于logstash的资源,和/或考虑对logstash基础架构进行分层,以减轻面向客户/源代码实例的负载。

换句话说,有一个前端接收数据,几乎没有任何实际的工作(只需添加一些标签/信息,也许一些路由到特定的处理器),然后让前端传递数据进一步处理到另一个实例或者像Kafka这样的消息队列)。

值得注意的是,如果您使用DNS和geoIP插件,一旦事件/日志/数据完全parsing,在中心位置执行这些事情通常是有意义的)。