Culayska server-ka VPN oo la sharraxay: isticmaalayaal, CPU ama xiriirka kor?
Dhibcaha culayska oo hooseeya waxay ka dhigan karaan isticmaalayaal shaqo la'aan ah, CPU bannaan ama xiriir kor oo ballaaran. Akhri loadavg, tirtiraha interface-ka iyo faylka xaaladda ka hor inta aanad ugu yeerin degdeg.
Gateway culayskiisu yahay 0.4 wali wuu gurguuran karaa isticmaale kasta oo ka dambeeya. Celceliska culaysku wuxuu tiriyaa hawlo la fulin karo ama ku xayiran hurdo aan la joojin karin, iyo host afar cores leh hal hab hawleed buuxsamay ayaa ku filan inuu u riixo 1.0 halka saddex cores ay fadhiyaan wax qaban. In lambarkan loo akhriyo kayd ahaan waa khaladka ugu badan ee doorashada barta ugu dambeysa. Waxa dhab ahaan xaddida tunnel-ka badanaa waa mid ka mid ah afar shay: hal core mashquul ah, xiriirka kor, safka hortiisa ama siyaasad kasta oo session ah oo aan cidina diiwaangelin.
Celceliska culaysku wuxuu tiriyaa hawlo, ma aha wax soo saar
Kernel-ku wuxuu muunad ka qaataa safka fulinta iyo tirada hawlo sugaya gelitaanka iyo bixidda, ka dibna labadaba wuu simayaa muddo hal, shan iyo shan iyo toban daqiiqo ah. Waxba sharraxaaddaas kama hadlayso bytes, baakadaha ama tunnel-yada. Host leh kayd xiran ayaa sheegi kara culays sare isagoo aan lahayn trafik; host-ka gigabit ku riixaya dariiqa xogta kernel-ka ayaa sheegi kara mid raaxo leh.
Sidaa darteed culayska la xiriirka waxqabadka tunnel-ka wuxuu u baahan yahay aragti core kasta. Haddii hal core buuxsamay, boqolkiiba guud ee dashboard-ka wali wuu u ekaan doonaa mid wanaagsan:
cat /proc/loadavg
mpstat -P ALL 1 1
top -H -b -n 1 | head -n 20Amarka saddexaad waa tan ugu muhiimsan host-yada VPN. Habaynta baakadaha ee booska isticmaalaha ee OpenVPN 2.x waa inta badan mid isku xigta hab kasta, sidaas darteed hal dun mashquul ah ayaa noqon kara saqafka halka dashboard-ku sheegayo awood bannaan oo badan. Haddii hal dun inta lagu jiro waqtigaaga gaabis ah uu qabto inta badan core, host-ku guud ahaan lama yaraan; waxaa lagu xaddiday cabbirka si kadis ah muhiim u ah.
U fiirso waqtiga sidoo kale. Celceliska shan iyo toban daqiiqo wuxuu qariyaa qaraxa kharaabiyay wicitaan, sidaas darteed sawir shaashad ah oo la qaaday cabashada ka dib waa caddayn daciif ah. Muunad qaado inta dhibaatadu socoto, oo hayso shaabadda waqtiga iyo natiijada.
Xiriirka kor iyo safka hortiisa
Tirtiraha interface-ku wuxuu ka jawaabaa su'aasha ballaca xadhiga ee tirooyinka CPU aanay ka jawaabi karin. Waxay sidoo kale kala soocaan awoodda iyo luminta, kuwaas oo ah cilado kala duwan oo leh xalal kala duwan:
ip -s link show dev eth0
tc -s qdisc show dev eth0
nstat -az TcpRetransSegs TcpExtTCPLostRetransmitXiriirka u dhow heerka loo qoondeeyay inta lagu jiro imtixaankaaga waa sharraxaadda, oo wax qadar CPU bannaan ah ma beddelo. Sadarka qdisc wuxuu ku daraa faahfaahinta muhiimka u ah trafikka is dhexgalka: dib u dhac iyo tuurista waxay sheegaan haddii baakaduhu safka ku sugayaan ka hor inta aysan bixin. Saf buuxsama hoosta gelin weyn wuxuu si sax ah u soo saaraa calaamadda dadku u nisbeeyaan server-ka fog, taas oo ah wicitaanno gaabis ah xiriir wali si fiican u qiimeeya.
Tirtiraha dib-u-gudbinta waxay qabtaan kiiska baakaduhu baxaan laakiin aan waligood si nadiif ah u iman. Haddii dib-u-gudbintu kordho daaqadda gaabis ah oo interface-ku aanu awood u dhowayn, dhibaatadu waxay ku jirtaa wadada ee ma aha host-ka, oo u guurista barta kale ee isla magaalada ma caawin doonto.
Tirada session-yadu waxay qeexdaa baahida, ma aha kaydka
Liiska guud kastaa wuxuu muujiyaa tiro isticmaalayaal xiran, oo ku dhowaad midkoodna ma sheego waxa isticmaalayaashu qabanayaan. Labaatan session oo shaqo is dhexgal ah qabta iyo afar session oo faylal waaweyn jiidaya waxay isla hardware-ka ku abuuraan culays aad u kala duwan. Qaabka labaad kuma muuqdo tirada isticmaalayaasha, oo isaga ayaa kharaabiya fiidkii. Sidaa darteed tirada session-ka waxaa ugu fiican in loo akhriyo calaamad ku saabsan baahida, marnaba ma aha odhaah ku saabsan awood bannaan.
| Number on the page | What it is really measuring | What it cannot tell you |
|---|---|---|
| Connected users | How many sessions hold an address | How much each one is transferring |
| Load or score | Whatever the operator chose to publish | Whether that definition matches your task |
| Uptime | How long since the process started | Current capacity, queue depth or packet loss |
| Distance or ping | Round-trip time on a small probe | Throughput under sustained transfer |
Host aad maamusho, faylka xaaladdu wuxuu bixiyaa cabbirka maqan. OpenVPN wuxuu qoraa sawir xilliyeed oo ay ku jiraan tirtiraha byte kasta macmiil, taasna waxay ku filan tahay inaad aragto haddii hal session mas'uul ka yahay xiriirka kor oo dhan:
status /run/openvpn/server.status 10
# then, after at least one interval
grep -E "^CLIENT_LIST" /run/openvpn/server.statusLaba muunad oo toban il-biriqsi kala fog ayaa tirtirahaas urursan u beddela heer macmiil kasta. Taasi waa cabbirka tirada isticmaalayaashu metelayo, oo sidaas oo kale ayaad ogaanaysaa in hal macmiil si khaldan loo habaystay uu xiriirka buuxiyo habeen kasta isla saacaddaas.
Xaddidaadda session kasta waxay ku dhex qarsoon tahay siyaasadda
Server-ku wuu shaqo la'aan karaa oo wali wuu diidi karaa inuu ku siiyo ballaca xadhiga. Xaddidaadda heerka, saqafka ballaca xadhiga macmiil kasta iyo qaabaynta trafikka ayaa inta badan lagu dabaqaa magac guud ama barkad, sidaas darteed laba isticmaale oo isla gateway ah waxay heli karaan natiijooyin aad u kala duwan. Habdhisku ma aha mid qarsoon, laakiin dibadda waa lagama arki karo sababtoo ah tunnel-ku si caadi ah ayuu u kacaa labada kiis.
Ka raadi qaabaynta interface-ka tunnel-ka ee ma aha tan jireed. Hubi haddii xaddidaaddu raacdo isticmaalaha, shahaadada ama barkadda ciwaannada. Haddii akoonkaaga tijaabada uu ku dhaco barkadda aan xaddidnayn, waxaad soo gabagabeyn doontaa in server-ku fiican yahay oo isticmaalaha cabanaya uu qaldan yahay. Gabagabadaas way ka xun tahay gabagabo la'aan, sababtoo ah waxay xirtaa tigidhka.
Isbarbar dhig laba barta ugu dambeysa hal hawlo go'an
Tijaabada dhinaca macmiilka wali way mudan tahay in la sameeyo, laakiin kaliya haddii doorsoomayaashu go'an yihiin. Isticmaal isla qalabka, isla shabakadda gelitaanka, isla borotokoolka iyo isla faylka loo socdo, ka dib ku celi barta labaad oo masaafo la mid ah. Wax kasta oo is beddela inta u dhaxaysa socodka, oo ay ku jirto waqtiga maalinta, wuu wasakheeyaa natiijada.
Diiwaangeli guuldarrooyinka sida guulaha oo kale. Taxane saddex barta shaqeeyaan oo mid waqti dhaafo waa mid macluumaad badan ka bixiya afar lambar oo xawaare, sababtoo ah waxay tilmaamaysaa dhibaato waddo ama siyaasad ah ee ma aha awood. Ordaw kiis kasta ugu yaraan laba jeer; hal muunad gaabis ah waxba kama caddayn shabakad la wadaago.
Ugu dambeyntii, hayso tirooyinka aad ururisay iyagoo la socda sheegashada ay taageerayaan. "Bartaankan ayaa wareejinta ku dhammeeyay isla daaqaddii tan kale ku xannibanayd" waa mid la difaaci karo, halka "bartaankan ayaa ka degdeg badan" ay ku martiqaadaysato dood aadan ku guulaysan karin dhibcaha bogga hore. Buugga OpenVPN 2.6 wuxuu diiwaangelinayaa faylka xaaladda iyo xulashooyinka qaabaynta haddii aad u baahan tahay tilmaamaha saxda ah ee dhinaca host-ka.