<div dir="ltr">I thought I did a good job detailing my issue and setup and clearly didn't do that well. I apologize.<div><br></div><div>1) I am using limits, which is why i mentioned it is delaying requests. Specifically i'm using limit_req zone=proxyzone burst=6;</div>
<div><br></div><div>2) I understand the difference between delay request and one responded to with a 503. What I think i'm getting hung up on is what to expect under a given scenario. If i setup the zone with a rate of 4r/s I would expect no matter what, pivoting on the IP a person should be able to perform 4 requests every second without any delay or 503's. (assuming we're able to count ONLY proxy hits and not take static content into account for the current requests..which is what i'm attempting to do) Using a burst of 6, i would expect a request of 8 in one second would have 4 at full speed, 2 delayed and 2 dropped but it seems that's where i'm horribly wrong. You said "<span style="font-family:arial,sans-serif;font-size:13px">As long as rate is set to 4r/s, it's enough to do two requests </span><span style="font-family:arial,sans-serif;font-size:13px">with less than 250ms between them to trigger "delaying request </span><span style="font-family:arial,sans-serif;font-size:13px">message". I'm confused, why would 4r/s not allow 4 requests per second at full speed?? Isn't that the entire point.</span></div>
<div><span style="font-family:arial,sans-serif;font-size:13px"><br></span></div><div><span style="font-family:arial,sans-serif;font-size:13px">I do realize a given page with have numerous static hits that would normally count against a person's request rate, but i'm literally attempting to take all other static requests out of the equation so the rate per second as well as the burst/503's are only applied to a given url pattern. I really shouldn't/will not throttle static requests but I do know for any proxy hits, an actual person browsing the site should never exceed 4 requests per second and for a bit of a fudge factor, allow them a burst of up to 6. After 6 I expect the site to start spitting out 503's.</span></div>
<div><span style="font-family:arial,sans-serif;font-size:13px"><br></span></div><div><span style="font-family:arial,sans-serif;font-size:13px">3) I was pointing out i am refreshing the config. I"m not worried about hit counters as in reality if my counting of ONLY proxy hits was working properly, this wouldn't be any real issue.</span></div>
<div><span style="font-family:arial,sans-serif;font-size:13px"><br></span></div><div><span style="font-family:arial,sans-serif;font-size:13px">4) Yup i do have numerous location directives and I'm only placing the limit_req directive under a single proxy location directive.</span></div>
<div><span style="font-family:arial,sans-serif;font-size:13px"><br></span></div><div><span style="font-family:arial,sans-serif;font-size:13px">5) Thanks for the link, but I have read that document a hundred times and there is still a ton that it doesn't cover.</span></div>
<div><div><br></div></div><div><br></div><div>I appreciate your response Maxim!</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">
On Wed, Nov 13, 2013 at 5:27 AM, Maxim Dounin <span dir="ltr"><<a href="mailto:mdounin@mdounin.ru" target="_blank">mdounin@mdounin.ru</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hello!<br>
<div><div class="h5"><br>
On Tue, Nov 12, 2013 at 09:24:57PM -0600, Justin Deltener wrote:<br>
<br>
> For the life of me I can't seem to get my configuration correct to limit<br>
> requests. I'm running nginx 1.5.1 and have it serving up static content and<br>
> pushing all non-existent requests to the apache2 proxy backend for serving<br>
> up. I don't want to limit any requests to static content but do want to<br>
> limit requests to the proxy. It seems no matter what I put in my<br>
> configuration I continue to see entries in the error log for ip addresses<br>
> which are not breaking the rate limit.<br>
><br>
> 2013/11/12 20:55:28 [warn] 10568#0: *1640292 delaying request, excess:<br>
> 0.412, by zone "proxyzone" client ABCD<br>
><br>
> I've tried using a map in the top level like so<br>
><br>
> limit_req_zone $limit_proxy_hits zone=proxyzone:10m rate=4r/s;<br>
><br>
> map $request_filename $limit_proxy_hits<br>
> {<br>
> default "";<br>
> ~/$ $binary_remote_addr; (only limit filename requests ending in<br>
> slash as we may have something.php which should not be limited)<br>
> }<br>
><br>
> yet when i look at the logs, ip ABCD has been delayed for a url ending in<br>
> slash BUT when i look at all proxy requests for the IP, it is clearly not<br>
> going over the limit. It really seems that no matter what, the<br>
> limit_req_zone still counts static content against the limit or something<br>
> else equally as confusing.<br>
><br>
> I've also attempted<br>
><br>
> limit_req_zone $limit_proxy_hits zone=proxyzone:10m rate=4r/s;<br>
><br>
> and then use $limit_proxy_hits inside the server/location<br>
><br>
> server<br>
> {<br>
> set $limit_proxy_hits "";<br>
><br>
> location /<br>
> {<br>
> set $limit_proxy_hits $binary_remote_addr;<br>
> }<br>
> }<br>
><br>
> and while the syntax doesn't bomb, it seems to exhibit the exact same<br>
> behavior as above as well.<br>
><br>
> ASSERT:<br>
><br>
> a) When i clearly drop 40 requests from an ip, it clearly lays the smack<br>
> down on a ton of requests as it should<br>
> b) I do a kill -HUP on the primary nginx process after each test<br>
> c) I keep getting warnings on requests from ip's which are clearly not<br>
> going over the proxy limit<br>
> d) I have read the leaky-bucket algorithm and unless i'm totally missing<br>
> something a max of 4r/s should always allow traffic until we start to go<br>
> OVER 4r/s which isn't the case.<br>
><br>
> The documentation doesn't have any real deep insight into how this works<br>
> and I could really use a helping hand. Thanks!<br>
<br>
</div></div>Just some arbitrary facts:<br>
<br>
1. The config you've provided doesn't configure any limits, as it<br>
doesn't contatin limit_req directive. See<br>
<a href="http://nginx.org/r/limit_req" target="_blank">http://nginx.org/r/limit_req</a> for documentation.<br>
<br>
2. The "delaying request" message means exactly this - nginx is<br>
delaying requests since average speed of requests exceeds<br>
configured request rate. It basically means that the "bucket"<br>
isn't empty and a request have to wait some time till it will be<br>
allowed to continue. This message shouldn't be confused with<br>
"limiting requests" message, which is logged when requests are<br>
rejected due to burst limit reached.<br>
<br>
As long as rate is set to 4r/s, it's enough to do two requests<br>
with less than 250ms between them to trigger "delaying request"<br>
message, which can easily happen as a pageview usually results in<br>
multiple requests (one request to load the page itself, and<br>
several other requests to load various include resources like css,<br>
images and so on).<br>
<br>
It might be a good idea to use "limit_req ... nodelay" to<br>
instruct nginx to don't do anything unless configured burst limit<br>
is reached.<br>
<br>
3. Doing a "kill -HUP" doesn't clear limit_req stats and mostly<br>
useless between tests.<br>
<br>
4. To differentiate between various resources, there is a<br>
directive called "location", see <a href="http://nginx.org/r/location" target="_blank">http://nginx.org/r/location</a>.<br>
If you want to limit requests to some resources, but not others, it's<br>
good idea to do so by using two distinct locations, e.g.:<br>
<br>
location / {<br>
limit_req zone burst=10 nodelay;<br>
proxy_pass http://...<br>
}<br>
<br>
location /static/ {<br>
# static files, no limit_req here<br>
}<br>
<br>
5. The documentation is here:<br>
<br>
<a href="http://nginx.org/en/docs/http/ngx_http_limit_req_module.html" target="_blank">http://nginx.org/en/docs/http/ngx_http_limit_req_module.html</a><br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
Maxim Dounin<br>
<a href="http://nginx.org/en/donation.html" target="_blank">http://nginx.org/en/donation.html</a><br>
<br>
_______________________________________________<br>
nginx mailing list<br>
<a href="mailto:nginx@nginx.org">nginx@nginx.org</a><br>
<a href="http://mailman.nginx.org/mailman/listinfo/nginx" target="_blank">http://mailman.nginx.org/mailman/listinfo/nginx</a><br>
</font></span></blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr"><p><a name="SafeHtmlFilter_SafeHtmlFilter_SafeHtmlFilter__MailAutoSig"><span style="font-size:10.5pt;font-family:Consolas">Justin Deltener</span></a></p>
<p><span style="font-family:Consolas;font-size:10.5pt">Nerd Curator | Alpha Omega Battle Squadron</span></p><p><span style="font-family:Consolas;font-size:10.5pt">Toll Free: 1-877-216-5446 x3921</span></p><p><span style="font-family:Consolas;font-size:10.5pt">Local: 701-253-5906 </span><span style="font-family:Consolas;font-size:14px">x3921</span></p>
<p><span style="font-family:Consolas;font-size:10.5pt"><img src="http://www.realtruck.com/images/realtruck_logo_200.jpg"></span></p>
<p><span style="font-size:10.5pt;font-family:Consolas"><a href="http://www.realtruck.com/" target="_blank">RealTruck.com</a></span></p>
<p><a href="http://www.realtruck.com/about-realtruck/#realtrucks-guiding-principles" target="_blank"><span style="font-size:9.0pt;font-family:Consolas">Guiding Principle #3</span></a><span style="font-size:9pt;font-family:Consolas">: Improve</span></p>
</div>
</div>