blob: 7a3c047295914cbc8c4273506a9b6d35246a1750 [file] [log] [blame]
Horms6ce16692006-07-03 19:35:40 -07001/proc/sys/net/ipv4/vs/* Variables:
2
3am_droprate - INTEGER
4 default 10
5
6 It sets the always mode drop rate, which is used in the mode 3
7 of the drop_rate defense.
8
9amemthresh - INTEGER
10 default 1024
11
12 It sets the available memory threshold (in pages), which is
13 used in the automatic modes of defense. When there is no
14 enough available memory, the respective strategy will be
15 enabled and the variable is automatically set to 2, otherwise
16 the strategy is disabled and the variable is set to 1.
17
Julian Anastasov0c125822013-03-09 23:25:04 +020018backup_only - BOOLEAN
19 0 - disabled (default)
20 not 0 - enabled
21
22 If set, disable the director function while the server is
23 in backup mode to avoid packet loops for DR/TUN methods.
24
Simon Horman7e777dd2011-09-09 17:07:43 +090025conntrack - BOOLEAN
26 0 - disabled (default)
27 not 0 - enabled
28
29 If set, maintain connection tracking entries for
30 connections handled by IPVS.
31
32 This should be enabled if connections handled by IPVS are to be
33 also handled by stateful firewall rules. That is, iptables rules
34 that make use of connection tracking. It is a performance
35 optimisation to disable this setting otherwise.
36
37 Connections handled by the IPVS FTP application module
38 will have connection tracking entries regardless of this setting.
39
Simon Horman40cb1f92011-09-29 16:27:37 +090040 Only available when IPVS is compiled with CONFIG_IP_VS_NFCT enabled.
Simon Horman7e777dd2011-09-09 17:07:43 +090041
Horms6ce16692006-07-03 19:35:40 -070042cache_bypass - BOOLEAN
43 0 - disabled (default)
44 not 0 - enabled
45
46 If it is enabled, forward packets to the original destination
47 directly when no cache server is available and destination
48 address is not local (iph->daddr is RTN_UNICAST). It is mostly
49 used in transparent web cache cluster.
50
51debug_level - INTEGER
52 0 - transmission error messages (default)
53 1 - non-fatal error messages
54 2 - configuration
55 3 - destination trash
56 4 - drop entry
57 5 - service lookup
58 6 - scheduling
59 7 - connection new/expire, lookup and synchronization
60 8 - state transition
61 9 - binding destination, template checks and applications
62 10 - IPVS packet transmission
63 11 - IPVS packet handling (ip_vs_in/ip_vs_out)
64 12 or more - packet traversal
65
Simon Horman40cb1f92011-09-29 16:27:37 +090066 Only available when IPVS is compiled with CONFIG_IP_VS_DEBUG enabled.
Horms6ce16692006-07-03 19:35:40 -070067
68 Higher debugging levels include the messages for lower debugging
69 levels, so setting debug level 2, includes level 0, 1 and 2
70 messages. Thus, logging becomes more and more verbose the higher
71 the level.
72
73drop_entry - INTEGER
74 0 - disabled (default)
75
76 The drop_entry defense is to randomly drop entries in the
77 connection hash table, just in order to collect back some
78 memory for new connections. In the current code, the
79 drop_entry procedure can be activated every second, then it
80 randomly scans 1/32 of the whole and drops entries that are in
81 the SYN-RECV/SYNACK state, which should be effective against
82 syn-flooding attack.
83
84 The valid values of drop_entry are from 0 to 3, where 0 means
85 that this strategy is always disabled, 1 and 2 mean automatic
86 modes (when there is no enough available memory, the strategy
87 is enabled and the variable is automatically set to 2,
88 otherwise the strategy is disabled and the variable is set to
89 1), and 3 means that that the strategy is always enabled.
90
91drop_packet - INTEGER
92 0 - disabled (default)
93
94 The drop_packet defense is designed to drop 1/rate packets
95 before forwarding them to real servers. If the rate is 1, then
96 drop all the incoming packets.
97
98 The value definition is the same as that of the drop_entry. In
99 the automatic mode, the rate is determined by the follow
100 formula: rate = amemthresh / (amemthresh - available_memory)
101 when available memory is less than the available memory
102 threshold. When the mode 3 is set, the always mode drop rate
103 is controlled by the /proc/sys/net/ipv4/vs/am_droprate.
104
105expire_nodest_conn - BOOLEAN
106 0 - disabled (default)
107 not 0 - enabled
108
109 The default value is 0, the load balancer will silently drop
110 packets when its destination server is not available. It may
111 be useful, when user-space monitoring program deletes the
112 destination server (because of server overload or wrong
113 detection) and add back the server later, and the connections
114 to the server can continue.
115
116 If this feature is enabled, the load balancer will expire the
117 connection immediately when a packet arrives and its
118 destination server is not available, then the client program
119 will be notified that the connection is closed. This is
120 equivalent to the feature some people requires to flush
121 connections when its destination is not available.
122
123expire_quiescent_template - BOOLEAN
124 0 - disabled (default)
125 not 0 - enabled
126
127 When set to a non-zero value, the load balancer will expire
128 persistent templates when the destination server is quiescent.
129 This may be useful, when a user makes a destination server
130 quiescent by setting its weight to 0 and it is desired that
131 subsequent otherwise persistent connections are sent to a
132 different destination server. By default new persistent
133 connections are allowed to quiescent destination servers.
134
135 If this feature is enabled, the load balancer will expire the
136 persistence template if it is to be used to schedule a new
137 connection and the destination server is quiescent.
138
139nat_icmp_send - BOOLEAN
140 0 - disabled (default)
141 not 0 - enabled
142
143 It controls sending icmp error messages (ICMP_DEST_UNREACH)
144 for VS/NAT when the load balancer receives packets from real
145 servers but the connection entries don't exist.
146
147secure_tcp - INTEGER
148 0 - disabled (default)
149
Simon Horman325aadc2011-09-29 16:14:51 +0900150 The secure_tcp defense is to use a more complicated TCP state
151 transition table. For VS/NAT, it also delays entering the
152 TCP ESTABLISHED state until the three way handshake is completed.
Horms6ce16692006-07-03 19:35:40 -0700153
Simon Horman325aadc2011-09-29 16:14:51 +0900154 The value definition is the same as that of drop_entry and
Horms6ce16692006-07-03 19:35:40 -0700155 drop_packet.
156
157sync_threshold - INTEGER
158 default 3
159
160 It sets synchronization threshold, which is the minimum number
161 of incoming packets that a connection needs to receive before
162 the connection will be synchronized. A connection will be
163 synchronized, every time the number of its incoming packets
164 modulus 50 equals the threshold. The range of the threshold is
165 from 0 to 49.
Simon Horman7e777dd2011-09-09 17:07:43 +0900166
167snat_reroute - BOOLEAN
168 0 - disabled
169 not 0 - enabled (default)
170
171 If enabled, recalculate the route of SNATed packets from
172 realservers so that they are routed as if they originate from the
173 director. Otherwise they are routed as if they are forwarded by the
174 director.
175
176 If policy routing is in effect then it is possible that the route
177 of a packet originating from a director is routed differently to a
178 packet being forwarded by the director.
179
180 If policy routing is not in effect then the recalculated route will
181 always be the same as the original route so it is an optimisation
182 to disable snat_reroute and avoid the recalculation.
183
Julian Anastasov4d0c8752013-06-24 22:44:41 +0300184sync_persist_mode - INTEGER
185 default 0
186
187 Controls the synchronisation of connections when using persistence
188
189 0: All types of connections are synchronised
190 1: Attempt to reduce the synchronisation traffic depending on
191 the connection type. For persistent services avoid synchronisation
192 for normal connections, do it only for persistence templates.
193 In such case, for TCP and SCTP it may need enabling sloppy_tcp and
194 sloppy_sctp flags on backup servers. For non-persistent services
195 such optimization is not applied, mode 0 is assumed.
196
Simon Horman7e777dd2011-09-09 17:07:43 +0900197sync_version - INTEGER
198 default 1
199
200 The version of the synchronisation protocol used when sending
201 synchronisation messages.
202
203 0 selects the original synchronisation protocol (version 0). This
204 should be used when sending synchronisation messages to a legacy
205 system that only understands the original synchronisation protocol.
206
207 1 selects the current synchronisation protocol (version 1). This
208 should be used where possible.
209
210 Kernels with this sync_version entry are able to receive messages
211 of both version 1 and version 2 of the synchronisation protocol.