CentOS7 Operation and Maintenance-Nginx Configuration Tutorial
One, Nginx overview
A high-performance and lightweight Webservice software
2. Nginx service status
① Start service
nginx -tCheck the configuration file syntax structure is correct
cat /usr/local/nginx/logs/nginx.pidview nginxof the PIDnumber
More ways to view the process number
lsof -i :80
netstat -natp | grep nginx
ss -tnlp | grep nginx
ps -ef | grep nginx
pgrep nginx
② Stop service
killFollowed by the pidnumber killallfollowed by the process name
kill -3 <PID号>
kill -s QUIT <PID号>
killall -3 nginx
killall -s QUIT nginx
③ Overload service
kill -1 <PID号>
kill -s HUP <PID号>
killall -1 nginx
killall -s HUP nginx
④ Log split
Principle: When certain conditions are met, save and delete old logs
kill -USR1 <PID号>
⑤ Smooth upgrade
kill -USR2 <PID号>
Three, add program system service
Method 1: systemctl
echo '
[Unit]
Description=nginx
After=network.target
[Service]
Type=forking
PIDFile=/usr/local/nginx/logs/nginx.pid
ExecStart=/usr/local/nginx/sbin/nginx
ExecReload=/bin/kill -s HUP $MAINPID
ExecStop=/bin/kill -s QUIT $MAINPID
PrivateTmp=true
[Install]
WantedBy=multi-user.target' > /lib/systemd/system/nginx.service
Method 2: init.d
vim /etc/init.d/nginx
#!/bin/bash
#chkconfig: - 99 20
#description:Nginx 服务
COM="/usr/local/nginx/sbin/nginx"
PID="/usr/local/nginx/logs/nginx.pid"
case "$1" in
start)
$COM
;;
stop)
kill -s QUIT ${cat PID}
;;
restart)
$0 stop
$0 start
;;
reload)
kill -s HUP ${cat PID}
;;
*)
exit 1
esac
exit 0
Add system services and grant execution permissions
chmod +x /etc/init.d/nginx
chkconfig --add nginx
Four, Nginx main configuration file
user_nobodyThe running user, if not specified during compilation, the default is nobdy
worker_processes 1; the number of work processes can be configured as 内核数 * 2[Generally 1 is enough]
error_log logs/error.log;The location of the error log
pid logs/nginx.pid PIDfile location
① How to improve performance
I/O event configuration
events {
use epoll;
#2.6以上版本的系统核心建议使用epoll模型以提高性能
worker _connections 4095
#每个进程处理 4096 个连接
}
② How to increase the number of connections per process?
When the Linuxplatform is TCPprocessing high-concurrency connections, the maximum number of concurrent connections is subject to the system
's restriction on the number of files that can be opened simultaneously by a single user process. TCPCreate one for each connection. socket
Each sockethandle is also a file handle.
ulimit -n 65535Temporarily modify the maximum number of files that
ulimit -acan be opened by each process locally. You can view the maximum number of files that can be opened by the current system user.[open files项]
Five, HTTP configuration
http {
##文件扩展名与文件类型映射表
include mime.types;
##默认文件类型
default_type application/octet-stream;
##日志格式设定
#log_format main '$remote_ addr - $remote. user [stime_ local] "$request" '
# '$status $body_ bytes_ sent "Shttp_ referer" '
# "$http_user_agent" "$http_x_forwarded_for"';
##访问日志位置
#access_Log logs/access.log main;
#支持文件发送(下载)
sendfile on;
##此选项允许或禁止使用socket的TCP_CORK的选项( 发送数据包前先缓存数据)，此选项仅在使用sendfile的时候使用
#tcp_nopush on;
##连接保持超时时间，单位是秒
#keepalive_timeout 0;
keepalive.timeout 65;
##gzip模块设置，设置是否开启gzip压缩输出
#gzip on;
#Web服务的监听配置
##Web服务的监听配置
server (
##监听地址及端口
listen 80;
##站点域名，可以有多个，用空格隔开
server.name www.benet.com;
##网页的默认字符集
charset utf-8;
##根目录配置
location / {
##网站根目录的位置/usr/local/nginx/html
root html;
##默认首页文件名
index index.html index.php;
}
##内部错误的反馈页而
error_page 500 502 503 504 /50x.html;
#错误页而配置
location = /50x.html {
root html;
}
}
}
Six, log format setting
$remote_addr与$http_x_forwarded_for用以记录客户端的ip地址;
$remote_user: 用来记录客户端用卢名称;
$time_local: 用来记录访问时间与时区;
$request: 用来记录请求的url与http协议;
$status: 用来记录请求状态,成功是200;
$body_bytes_sent: 记录发送给客户端文件主体内容大小;
$http_referer: 用来记录从那个页面链接访问过来的;
$http_user_agent: 记录客户浏览器的相关信息;
通常web服务器放在反向代理的后面，这样就不能获取到客户的IP地址了，通过$remote_add拿到的IP地址是反向代理服务器的IP地址。反问代理服务器在转发请求的http头信息中，可以增加x_forwarded_for信息，用以记录原有客户端的IP地址和原来客户端的请求的服务器地址。
##location常见配置指令，root、alias、proxy_pass
root（根路径配置): 请求www.benet.com/1.jpg，会返回文件/usr/local/nginx/html/test/1.jpg
alias（别名配置): 请求ww . benet.com/test/1.jpg，会返回文件/usr/local/nginx/html/1.jpg
proxy_pass（反向代理配置>;
proxy_pass http://127.0.0.1:8080/; 会转发请求到http://127.0.0.1:8080/1.jpg
proxy_pass http://127.0.0.1:8080;
Seven, access status statistics
Check if there are HTTP_STUB_STATUSmodules
nginx -t
Enter the nginxmain configuration file and addstub_status
cd /usr/local/nginx/conf
cp nginx.conf{
,.bak}
vim /usr/local/nginx/conf/nginx.conf
.....
http {
.....
server {
listen 80;
server_name www.benet.com;
charset utf-8;
location / {
root html;
index index.html index.html;
}
##添加stub_status 配置##
location /status {
#访问位置为/status
stub_status on; #打开状态统计功能
access_log off; #关闭此位置的日志记录
}
}
}
Eight, Nginx access control
① Access control based on authorization
Generate user password authentication files
can also be generated online
yum install -y httpd-tools
htpasswd -c /usr/local/nginx/passwd.db fox
If you delete the permissions of ordinary users, you need to set the owner of the file
chown nginx /usr/local/nginx/passwd.db
chmod 700 /usr/local/nginx/passwd.db
Modify the corresponding directory of the main configuration file and add authentication configuration items
vim /usr/local/nginx/conf/nginx.conf
......
server {
location / {
......
##添加认证配置##
auth_basic "secret" ;
auth_basic_user_file /usr/local/nginx/passwd.db;
}
}
② Client-based access control
The access control rules are as follows:
deny IP/IP segment: deny client access of a certain IP or IP segment.
Allow IP/IP segment: allow client access
rules of a certain IP or IP segment to execute from top to bottom, and stop if it matches. No longer match down
vim /usr/local/nginx/conf/nginx.conf
server {
location / {
#添加控制规则
deny 192.168.0.10;
#拒绝访问的客户端IP
allow all;
#允许其它IP客户端访问
}
}
systemctl restart nginx
Nine, Nginx virtual host
① Virtual hosting based on domain name
echo "192.168.0.50 www.benet.com www.accp.com" >> /etc/hosts
►Prepare web documents for virtual hosting
mkdir -p /var/www/html/accp
mkdir -p /var/www/html/benet
echo "<h1>www.accp.com</h1>" > /var/www/html/accp/index.html
echo "<h1>www.benet.com</h1>" > /var/www/html/benet/index.html
►Modify Nginx configuration file
vim /usr/local/nginx/conf/nginx.conf
http {
server {
listen 80;
server_name www.accp.com;
charset utf-8;
access_log logs/www.accp.com.access.log;
location / {
root /var/www/html/accp;
index index.html index.html;
}
error_page 500 502 503 504 /50x.html;
location = 50x.html{
root html;
}
}
server {
listen 80;
server_name www.benet.com;
charset utf-8;
access_log logs/www.benet.access.com.log;
location / {
root /var/www/html/benet;
index index.html index.html;
}
error_page 500 502 503 504 /50x.html;
location = 50x.html{
root html;
}
}
}
nginx -t
systemctl restart nginx
② IP-based virtual host
ifconfig ens33:0 192.168.0.60/24
vim /usr/local/nginx/conf/nginx.conf
http {
server {
listen 192.168.0.50:80;
server_name www.benet.com;
charset utf-8;
access_log logs/www.benet.access.log;
location / {
root /var/www/html/benet;
index index.html index.php;
}
error_page 500 502 503 504 /50x.html;
location = 50x.html{
root html;
}
}
server {
listen 192.168.0.60:80;
server_name www.accp.com;
charset utf-8;
access_log logs/www.accp.access.log;
location / {
root /var/www/html/accp;
index index.html index.html;
}
error_page 500 502 503 504 /50x.html;
location = 50x.html{
root html;
}
}
}
nginx -t
systemctl restart nginx
③ Port-based virtual host
vim /usr/local/nginx/conf/nginx.conf
http {
server {
listen 192.168.0.50:233;
server_name www.accp.com;
charset utf-8;
access_log logs/www.accp.access.log;
location / {
root /var/www/html/accp;
index index.html index.html;
}
error_page 500 502. 503 504 /50x.html;
location = 50x.html{
root html;
}
}
server {
listen 192.168.0.50:8080;
server_name www.benet.com;
charset utf-8;
access_log logs/www.benet.access.log;
location / {
root /var/www/html/benet;
index index.html index.php;
}
error_page 500 502 503 504 /50x.html;
location = 50x.html{
root html;
}
}
}
nginx -t
systemctl restart nginx.service
