Snapt Accelerator Manual Version 2.0 pg. 1
Contents Chapter 1: Introduction... 3 Chapter 2: General Usage... 3 Accelerator Dashboard... 4 Standard Configuration Default Settings... 5 Standard Configuration Logging Options... 6 Standard Configuration Performance & Security... 8 Standard Configuration GZip Settings... 9 Standard Configuration Header Manipulation... 11 Standard Configuration Alerts & Notices... 12 Standard Configuration Backups... 13 Advanced Configuration Connection Limit Zones... 14 Advanced Configuration Request Limit Zones... 15 Advanced Configuration Keepalive Settings... 16 Caching Caching Options... 17 Caching Cache Profiles... 20 Caching Cache Directories... 22 Caching Cache Purge... 23 Modules PageSpeed... 24 SSL SSL Options (Page Changed SSL section Changed and moved to Setup Menu)... 25 SSL SSL Certificates (Setup > SSL > SSL Certificates)... 26 Views & Data Metric Monitor... 27 Views & Data Last Hour/Day/Week... 27 Accelerator Wizard... 28 Chapter 3: Upstream and Front-end Management... 30 Upstreams (web servers)... 30 Locations (URLs)... 32 HTTP Servers (Front-ends)... 33 Front-end Settings... 35 Front-end Locations... 37 SSL Servers (Front-ends)... 37 pg. 2
Chapter 4: Standard Operation... 38 Chapter 5: Reporting (in Reporting Menu)... 41 Chapter 1: Introduction The Snapt Accelerator is an HTTP and HTTPS content accelerator it is used to optimize and protect your servers and web applications in order to reduce the load and decrease page load times. One such optimization is through caching of content, which reduces the need for requests to be sent to your servers, and can have a considerable impact on performance. The PageSpeed engine uses best practice optimizations to transparently rewrite your content to minify, compress and re-encode, resulting in a significant decrease in page load times. There is also a range of protection mechanisms used to prevent denial of service (DoS) and optimise bandwidth usage. In a nutshell, your web application will load faster while simultaneously reducing the load on your servers, be more reliable as a result of monitoring and redundancy features, and be better secured. You can use the Accelerator on its own, communicating directly with your web servers, or use it to add another layer to your infrastructure by configuring it to sit in front of the Balancer which in turn communicates with your web servers. Chapter 2: General Usage This manual assumes you have already set up your Snapt installation and enabled the Accelerator plugin. If you have not, please install it from the Modules & Plugins section under the Setup menu. Everything you will need to do regarding the Accelerator happens under the Accelerator menu item. The first main menu option is Standard Configuration, and this specifies all the default global configuration options. pg. 3
Accelerator Dashboard pg. 4
Standard Configuration Default Settings This section specifies defaults for the Accelerator, controlling overall performance and limitations of the plugin. Worker Processes This specifies the number of Accelerator processes to run simultaneously in order to accept incoming connections. This value is typically matched to your number of CPU cores. Max Connections This specifies the maximum number of connections each worker process will accept. The number of worker processes multiplied by the max connections per worker determines the maximum number of connections the Accelerator will accept in total. For example, a server with two CPU cores, and therefore two worker processes with 5,000 connections per worker means the maximum number of connections accepted on the Accelerator is 10,000. pg. 5
Max Open Handlers This specifies the maximum number of open handlers (including connections) per worker process. As it includes connections, the value must be higher than the maximum number of connections on the Accelerator. Use Sendfile Sendfile copies data from one file descriptor to another. Because this copying occurs within the kernel, it is more efficient than reading/writing data normally as this requires transferring data to and from user space on the Linux system. However, not all systems support it. Server Tokens This enables/disables the Accelerator from disclosing version information. This is set to Off by default as it is considered a security risk. Enable Underscores in headers Missing This enables/disabled the use of underscores in client request header fields. When the use of underscore is disabled, request header fields whose names contain underscore are marked as invalid and become subject to the ignore_invalid_headers directive. Error Log This specifies the path of the Accelerator log file. The default is /var/log/nginx/error.log Max Client Body Size This determines the maximum amount of data a client can send in the body of their request. This typically limits the upload size. Standard Configuration Logging Options Logging is an integral part of the Accelerator as with the other core plugins, as it provides details around ongoing performance, errors, and more. pg. 6
Enable Logging Enabling this will perform automatic logging and reporting of information like sessions, throughput, errors, and more for all of your upstream/back-ends and front-ends. We advise enabling this, but it is disabled by default. Log Frequency This is the interval (in minutes) at which a log line will be stored for each server you have in the Accelerator. This setting can be customized because your database can grow very quickly. For larger numbers of upstreams and front-ends, we advise 15- or 30-minute logging intervals, whereas for smaller sites, a default of 5 minutes is recommended. Enable HTTP Logging This enables logging of every single request, and can be useful for diagnosing errors or establishing trends, for example. However, it can generate a huge amount of logging data and therefore needs to be managed carefully. It is recommended that this only be used when this type of detailed logging is required. It is therefore disabled by default. Log File Location This specifies the path where you would like to store the log file. You will also need to manage this log and analyse it outside of Snapt. pg. 7
Standard Configuration Performance & Security The Performance Tuning section involves operating system performance values and DoS tweaks that can be made. These settings modify the actual Linux kernel values to suggested Snapt values in order to increase the performance available from a system. Each option has a tooltip explanation available, and you are able to manually control these sysctl values if you are an advanced user. If not, you can enable the various options to use the Snapt recommended defaults. pg. 8
Standard Configuration GZip Settings Enable GZip This enables/disables the GZip compression module on the Accelerator. This optional module compresses traffic on-the-fly which improves client performance, as less data is transmitted, in addition to saving your bandwidth. This is enabled by default (once the Quick Setup wizard has been completed). Compression Level This specifies the level of compression to apply to traffic, with 1 being the fastest (but with the least compression) and 9 being the slowest (but with the most compression). As compression is a CPU intensive task, however, care should be taken when modifying this setting. A default of 1 is recommended. Min Length (Size) This specifies the minimum length (size) of content to be compressed. Note that there is a trade-off between the delay in compression and small content, so care should be taken when modifying this setting. A default of 0 is recommended, meaning all content will be compressed. pg. 9
HTTP Version This enables/disables GZip compression depending on the HTTP request version. A default of HTTP 1.1 is recommended. GZip Vary This enables/disables the Vary: Accept-Encoding response header. This ensures different encodings are respected so clients get the content they expect. Note, however, that if you intend to support legacy clients running IE 4-6, this should remain off, as a bug exists which causes these browsers to stop caching. Quick Change These buttons facilitate a quick and easy way of adjusting the content types that will be compressed, with the Pages Only button only compressing plain text and HTML, whereas the Snapt Recommended button adjusts it to compress all recommended content types, including but not limited to JavaScript and XML. Content Type List [advanced] This provides a list of the actual content types compression will be applied to, and changes whenever the Quick Change option described above is used. This facilitates adding additional content types over and above the Snapt Recommended values. This is therefore for advanced users only. pg. 10
Standard Configuration Header Manipulation The Header Manipulation section is used for site-wide configurations, and therefore applies to all hosts. Using these, you can manipulate requests and responses for a wide variety of purposes. Request Add Parameters added here will be added to requests and will be visible to your web servers. For example, the $remote_addr parameter in the screenshot will provide the web server(s) with the IP address of the client. Response Add Parameters added here will be added to responses and will be visible to clients connecting to the Accelerator. For example, the $upstream_cache_status parameter in the screenshot will advise whether the query was returned via cache as a hit, miss, bypass, etc. pg. 11
Standard Configuration Alerts & Notices This section is used to configure alerts and notices, which will be displayed in the Notices section and emailed to relevant users (depending on your configuration). Current Alerts This tab is used to view/delete existing alerts as shown in the above screenshot. Default options include alerting whenever a Permission denied issue occurs, amongst others. Add Alerts First you need to specify what type of alert this will be for either Simple Logging or Accelerator Error Logging. Thereafter, you need to specify the relevant alerting parameter, such as [crit] to facilitate alerts when critical errors occur. Configure Alerts Alert Status This option enables/disables the alerting function and affects whether issues trigger any alerts as a result. Re-alert Limit This specifies the interval at which individual alerts can trigger notices. pg. 12
Add Defaults This is a quick way to re-add the default Alerts onto your Snapt instance. Note that this will overwrite any alerts you currently have in place. Standard Configuration Backups Snapt will automatically create configuration backups and retain these for the last 20 changes made, including a description of what change occurred. Please note that as these are entire config backups, all subsequent changes made will be lost if you restore from an earlier backup. You are also able to get a config dump using the Export tab should you wish to export it without Snapt. pg. 13
Advanced Configuration Connection Limit Zones This optional function can be used to apply limits on the number of sessions (connections) a server or location will allow, based either per IP or for the server. The use of this functionality involves creating a zone, which can then be applied/used on any Front-ends as needed. View Zones This tab provides a list of all zones currently in place on the system, and facilitates both modifying zone settings and deleting any zones as needed. Add Zone When adding a zone, the first step is specifying a name: The next step involves specifying a few values: Zone Size This specifies the actual size of the zone in shared memory. As an example, a 1MB zone can store approximately 32,000 entries. A default value of 1MB is recommended as higher settings are only required on large instances. pg. 14
Zone Type This specifies the type of restriction this zone will apply, be it IP-based (total per IP address) or server-based (total for the server). To learn how to use these zones, please refer to Chapter 3. Advanced Configuration Request Limit Zones A Request Limit Zone acts similarly to the Connection Limit Zones explained previously, except it is used to limit the number of requests a server or location will allow. This can also be based on the IP or server. View Zones As with the Connection Limit Zones, this tab provides a list of all zones currently in place on the system, and facilitates both modifying zone settings and deleting any zones as needed. Add Zone When adding a zone, the first step is specifying a name: pg. 15
The next step involves specifying a few values: Zone Size This specifies the actual size of the zone in shared memory. As an example, a 1MB zone can store approximately 32,000 entries. A default value of 1MB is recommended as higher settings are only required on large instances. Zone Type This specifies the type of restriction this zone will apply, be it IP-based (total per IP address) or server-based (total for the server). Limit This value specifies the requests/second limit to be applied. Advanced Configuration Keepalive Settings Keepalive is used to keep a connection open, often so the same TCP connection can be used to send and receive multiple HTTP requests/responses rather than opening a new connection for every single request/response pair. This has many advantages, but if misconfigured could lead to poor performance. It is therefore intended for advanced users only. pg. 16
Keepalive Timeout This specifies the time a keepalive connection without data will stay open before the Accelerator will close it. A default value of 65 seconds is recommended. Keepalive Requests This option specifies the number of requests that can be made through a single keepalive connection before it is closed. A default value of 100 is recommended. Caching Caching Options Caching is especially useful as it serves static content faster than requesting it from a web application, for example as it bypasses database queries. This section covers the setting of a few key options. pg. 17
Min Uses Before Caching This specifies the number of times an object must be requested before it is cached. A default value of 1 is recommended, as it causes all possible objects to be cached, even after just one request. Default Valid Time This value specifies the timeframe for which an object in cache is considered valid. A default value of 1 hour is recommended, as setting this value too high may cause changes to an object not to be seen by clients in a timely manner. Connect Timeout This option specifies the time after which a timeout will be registered during a connection. A default value of 60 seconds is recommended. Read Timeout This option specifies the time after which a timeout will be registered during the reading of data. pg. 18
A default value of 60 seconds is recommended. Write Timeout This option specifies the time after which a timeout will be registered during the writing of data. A default value of 60 seconds is recommended. Proxy Buffer Size This sets the buffer size into which the first part of the response obtained from the proxy server will be read. Care should be taken with this setting as it affects RAM utilization. For it to remain effective, the server should not swap to disk. The recommended value is 256k. Proxy Buffers This sets the number and size of the buffers into which the answer obtained from the proxy server will be read. The recommended value is 128 at 16k. pg. 19
Caching Cache Profiles This section controls templates that are used for configuring caching on a server or location basis. This facilitates specifying when a cache should be used, such as which status codes. This section allows you to either modify the settings of a created cache profile, edit the default profile settings, or add/delete profiles. Once created or when editing the default profile, a range of options can be configured, as detailed below. Use Stale This option facilitates the use of stale cached content when specific errors occur, and allows you to specify the error conditions where this should apply if available. Cache Methods This specifies which request methods should be cached. By default, HEAD and GET methods are cached. pg. 20
Ignore NoCache Headers [Advanced] This option facilitates ignoring NoCache headers which may be sent from your server(s), allowing caching of dynamic content. This is disabled by default as it is intended for advanced users only. Custom Headers [Advanced] This facilitates custom headers which can be used for other purposes, such as the client s IP address. No Cache Options [Advanced] This specifies the content rules which should be applied for preventing caching. Responses Cache [Advanced] This specifies which responses should be cached, in addition to their duration. Custom Include [Advanced] This facilitates specifying the path to a config file in order to manually include it for the given profile. As conflicts and other errors could occur, this is intended for advanced users only. Cache Key [Advanced] This specifies custom key values for each stored content piece or object. pg. 21
Caching Cache Directories This section facilitates the configuration of the cache storage paths. These can be local to the server or elsewhere, depending on your environment. It is recommended to have one directory per site to avoid conflicts and other issues. View Directories You can edit settings for existing directories and add/delete directories. Add Directory Adding a directory involves specifying a name, followed by the configuration of a few other options. Storage Directory This specifies the actual path to the Cache Directory. pg. 22
Storage Time This specifies the duration an object will be stored without being requested before it is deleted. Max Size This specifies the maximum size the directory may grow to. Directory Levels This specifies the preferred directory structure level. A default value of 1:2 is recommended. Key Zone Name and Size This specifies a unique name and size for the key zone in shared memory. A default size of 10m is recommended. Caching Cache Purge This menu facilitates removing specific content from the cache store. It is used when changes have been made and the cached content needs to be refreshed, or when content is stale. Care should be taken as this can have a major impact on the performance of the system. pg. 23
Modules PageSpeed The PageSpeed module applies a wide range of web performance best practices to your pages and associated assets, such as CSS, JavaScript, and images, without requiring that you modify your existing content or workflow. Content should be tested whenever changes are made here to ensure it is still working correctly. In addition to specifying these settings, the PageSpeed engine needs to be enabled in each Front-end. pg. 24
SSL SSL Options (Page Changed SSL section Changed and moved to Setup Menu) The SSL Options section provides access to SSL-specific configuration options as follows: Certificate Path This is the path on the server where certificates are stored. This is /var/snapt/certs by default. Max SSL Connections This is the maximum number of SSL connections which will be allowed at any one time. It is similar to the Max Connections limit. Ciphers Preset This allows you to configure the Balancer to use a series of Cipher templates based around security and compatibility with clients. pg. 25
SSL SSL Certificates (Setup > SSL > SSL Certificates) This section provides management of the SSL certificates in use by the Balancer. View Certificates This tab allows you to view the currently uploaded certificates in order to delete them if they are no longer in use. Add a Certificate This tab facilitates the uploading of SSL certificates in PEM format. You are able to specify the name of the certificate to a logical value for easy referencing. Make a Certificate This tab provides information on how to generate a self-signed certificate by using the command line on the Snapt instance. However, as self-signed certificates are not validated on browsers, it is not recommended. SSL Check This tab loads the Snapt SSL Tool in order for you to test your SSL installation and verify it is installed and working correctly. (Your Snapt instance requires internet connectivity as this tool is loaded from an external source.) pg. 26
Views & Data Metric Monitor This menu option provides the ability to draw graphs based on various metrics and statistics, ranging from CPU usage and open connections, to request rates. Views & Data Last Hour/Day/Week There are three options available to view the number of requests per second over hourly, daily, or weekly periods. pg. 27
Accelerator Wizard This wizard performs the initial configuration of core accelerator values and adding your first functioning accelerator group. This is also the wizard that will open if you click the Quick Setup option after first installing the Accelerator plugin on the banner that will be displayed. Step 1: Basic Options (Page changed to Quick Setup and is right at the top of accelerator menu, Create and Accelerator is an advanced setting) This asks for a series of default configuration parameters: pg. 28
1. You need to specify the maximum number of connections this Accelerator server will allow. Note: As this is a global setting, it applies to the total number of connections spread across your front-end/back-end groups. 2. Specify the number of CPU cores assigned to this Snapt instance. In most cases this is automatically detected. 3. You can optionally enable the logging facility on the Accelerator. 4. Select whether GZip compression should be used. 5. Finally, you can enable whether traffic should be cached with the Accelerator. Step 2: Adding Upstream Servers At this point, you can add a few upstream servers immediately, by providing the necessary IP addresses and port numbers. As with all the wizards within Snapt, you can always add more servers at a later stage. Step 3: Listening Server pg. 29
Here you specify the front-end configuration options, by selecting the appropriate IP address, as well as the port number the front-end should listen and accept connections on. Chapter 3: Upstream and Front-end Management At its core, the Accelerator is based around the configured upstream (back-end) and front-end groups. When you create an upstream group, you are specifying IP addresses and port numbers, configuring the options, and adding the servers the incoming requests should be dispatched to. The front-end accepts these connections, and the upstream (back-end) dispatches them. Upstreams (web servers) This section covers the configuration of upstream (back-end) server groups. A minimum of one server is required per upstream. View Upstreams This tab facilitates easy access to delete upstreams, add servers to existing upstreams, or modify the settings for an upstream group. pg. 30
Add Upstream The addition of an upstream group is a simple process. First you specify a name which will be used to identify this group: Thereafter, you need to specify the options that need to apply to your new upstream. This particular page is the same as clicking Settings next to any existing upstream group. Use IP Hash Enabling this option causes requests to be distributed between upstream servers, based on the IP address of the client where the request originated from. This is disabled by default. pg. 31
Keepalive Cache When this is on any setting other than Disabled it will enable persistent connections to HTTP 1.1 web servers (i.e. your upstreams). This maintains a set of idle keepalive connections for use, and since it is already established, it does not need to create a new TCP connection. This reduces latency for transactions between the Accelerator and the upstreams, in addition to reducing the rate at which ephemeral ports are used. It can therefore handle large volumes of traffic. The default value of 32 per worker is recommended. Locations (URLs) Through the creation of locations, you are able to define rules that can later be used in servers in order to send traffic to specific upstreams. This can be useful if, for example, you want to send requests for images to a specific location. This provides a central management point so you can use a location in many servers. Add a Location The addition of a location involves specifying a name, as well as a set of options to determine what rules need to apply for this location accordingly. pg. 32
Quick Add This facilitates an easy way of specifying the criteria the location will match, and provides options to match a full URL in addition to either the start or end of a URL. This should be used if possible alternatively a Manual Entry is also supported, but is for advanced users only. Match Basis As with Quick Add, this allows specifying whether it should be an exact match, beginning, or end of the string. Location String This is the actual string you want the location to match, for example, an images URL. HTTP Servers (Front-ends) The HTTP Servers menu option provides a list of your current front-ends in addition to a tab to add new front-ends. The options on this page allow you to edit the Settings of an existing front-end, manage the Locations assigned, or Delete a front-end accordingly. It also shows at a glance which Back-end is used and which caching location/type. pg. 33
Add Server After adding your upstreams, the next critical step is adding the front-end server that would listen for the incoming connections from clients. Server Name You should specify a unique name for your front-end so it can be easily identified. IP Address This option allows you to either bind the front-end to any IP address added to the Snapt server, or select a specific IP address. Port Number This option specifies the port number that should be used to bind the front-end server to listen for incoming requests. It should be noted that this will be the external facing component in an ADC setup, and unless you are using NAT from an external firewall, port 80 should be used so normal browser-based clients can access any web applications or sites normally. pg. 34
Front-end Settings The options specified during the adding of a front-end or the editing of the settings of an existing front-end are the same. Numerous options is available to configure your front-end as required. (Screenshot changed) new on includes Enable underscores in headers Server [Host] Name This is an optional setting to facilitate virtual host support, ensuring that a particular host name (like www.snapt.net for example) can be used on a specific front-end. pg. 35
Mobile Redirect This facilitates the optional redirection to a URL intended specifically for mobile devices, such as cellphones and tablets. Default Upstream This option specifies the default upstream server group to which requests should be dispatched, in addition to the desired protocol, be it HTTP or HTTPS. Upstream HTTP Version This option specifies the HTTP version that should be used to communicate with the upstream server(s). The recommended value is HTTP 1.1. Default Cache This specifies which cache (if any) should be used for this server, in addition to the desired caching profile. PageSpeed This enables/disables the optional PageSpeed module discussed earlier in this manual for this front-end. Connection Limiting [Advanced] This is an optional setting that is only available if you have created at least one connection limit zone, and will facilitate configuring the number of connections per IP address you want to allow. For IP rules, it is the maximum sessions per IP, whereas with server rules, it is the maximum sessions for the server. Specifying 0 or leaving the field blank will unset the zone from this front-end. pg. 36
Request Limiting [Advanced] This is an optional setting that is only available if you have created at least one request limit zone. It will facilitate enabling a particular zone for this front-end, in addition to an optional burst rate for the occasional spike in requests. Throughput Limiting [Advanced] This section facilitates the limiting of session throughput in kilobits per second for this front-end. It can be done either on sessions or the entire server. When it is configured on sessions, you can also optionally set it to only apply after a certain amount of data has been transferred. This can be useful to ease the load on your server when clients are downloading large images, for example. Note, however, that clients can have more than one session, so care should be taken in configuring these values as it could have a detrimental impact on the client experience. Front-end Locations The settings in this section are identical to the Front-end Settings section, except you can also optionally set an expiry value on content. For example, you could set images to Maximum. SSL Servers (Front-ends) This section is identical to the HTTP Servers section, except in addition to the normal range of options, you can also set the required SSL Certificate and Key that should be used on this Front-end when SSL Termination is used. This is only possible once you have added the necessary certificates and private keys in the SSL section. pg. 37
Chapter 4: Standard Operation After the successful configuration of the Accelerator, the next step is the control and maintenance thereof. The majority of the functions are available on the Accelerator Dashboard. Here you will see several tabs as follows: Dashboard This displays various statistics and values, such as the overall status of the Accelerator. The connections and requests line charts are drawn from your chosen logging intervals, and display a rough guide of your traffic flow. You can run a full report under the Reports menu item. pg. 38
Program The Program tab is used to start and stop the Accelerator, in addition to reloading after configuration changes and displaying a quick status update showing memory usage and version number. Modules This tab shows the supported modules and whether they are available for use. pg. 39
Error Log This tab shows a list of the last errors that have occurred on the Accelerator. pg. 40
Chapter 5: Reporting (in Reporting Menu) A key component of your Snapt Accelerator installation is the ability to generate reports if configured correctly under the Logging Options earlier in this manual. This will facilitate the ability to run these on the Reports menu option. Clicking on the main Reports button will take you to an overview of all your available reports. The Accelerator will add one report to this module as follows: Connections Report This provides an overview of the activity on the server with regard to connections. pg. 41