AWS SDK for PHPでのslab増大とNSS_SDB_USE_CACHE対策の効果確認

色々調べると、GuzzleHttpがHTTPSで通信する際に増えるらしい

まとめ

AWS SDKのクライアント、GuzzleHttpも最終的にphpのcurl_～関数を呼んでいる
※constructorでcurlが無い場合、Exception吐くコードがあるし、AWSの要件にもcurlが入っている
php curl の nssは多分、ビルドされたcurlのNSSバージョンに依存してそう
※curl -V のNSS/3.27 の部分
curlをmakeすると、その時のOSのnssバージョンが組み込まれた
curl 7.19.7 (x86_64-unknown-linux-gnu) libcurl/7.19.7 NSS/3.36
かつ、その際、nss-softokn-3.14.3-23.3.el6_8.x86_64 で、curlコマンドのNSS_SDB_USE_CACHE=yes は有効だった
phpのcurlバージョンは、コマンドと同じくlibcurlに依存してそうだが、curl_version(); 又は、phpinfo(); で確認できる

各種情報

[root@ip-172-31-16-82 centos]# cat /etc/redhat-release
CentOS release 6.9 (Final)
[root@ip-172-31-16-82 centos]# rpm -qa | grep nss-softokn
nss-softokn-freebl-3.14.3-23.3.el6_8.x86_64
nss-softokn-3.14.3-23.3.el6_8.x86_64
[root@ip-172-31-16-82 centos]# php -v
PHP 5.5.38 (cli) (built: Mar  1 2018 11:12:35)
Copyright (c) 1997-2015 The PHP Group
Zend Engine v2.5.0, Copyright (c) 1998-2015 Zend Technologies


[centos@ip-172-31-16-82 slab-nss]$ cat composer.json
{
    "require": {
        "aws/aws-sdk-php": "^2.8"
    }
}

[root@ip-172-31-16-82 centos]# cat /etc/redhat-release

CentOS release 6.9 (Final)

[root@ip-172-31-16-82 centos]# rpm -qa | grep nss-softokn

nss-softokn-freebl-3.14.3-23.3.el6_8.x86_64

nss-softokn-3.14.3-23.3.el6_8.x86_64

[root@ip-172-31-16-82 centos]# php -v

PHP 5.5.38 (cli) (built: Mar 1 2018 11:12:35)

[centos@ip-172-31-16-82 slab-nss]$ cat composer.json

{

"require": {

"aws/aws-sdk-php": "^2.8"

}

AWS-SDKでSNSへpublishするテストコードを準備

<?php

require_once('./vendor/autoload.php');
use Aws\Sns\SnsClient;

$arn = "arn:aws:sns:ap-northeast-1:xxxxxx:aws-sdk-nss-dentry-test";
$message = 'dummy message';

$client = SnsClient::factory(array(
    'profile' => 'default',
    'region'  => 'ap-northeast-1',
));

for ($i = 0; $i < 100; $i ++) {
    $result = $client->publish(array(
        'TopicArn' => $arn,
        'Message' => $message
    ));
}

<?php

require_once('./vendor/autoload.php');

use Aws\Sns\SnsClient;

$arn = "arn:aws:sns:ap-northeast-1:xxxxxx:aws-sdk-nss-dentry-test";

$message = 'dummy message';

$client = SnsClient::factory(array(

'profile' => 'default',

'region' => 'ap-northeast-1',

));

for ($i = 0; $i < 100; $i ++) {

$result = $client->publish(array(

'TopicArn' => $arn,

'Message' => $message

));

}

実行前後の情報

[centos@ip-172-31-16-82 ~]$ sar -v 0
Linux 2.6.32-696.30.1.el6.x86_64 (ip-172-31-16-82.ap-northeast-1.compute.internal)      07/08/2018      _x86_64_        (1 CPU)

07:51:10 AM dentunusd   file-nr  inode-nr    pty-nr
07:51:10 AM     41344       736      7227         5
[centos@ip-172-31-16-82 ~]$ sar -v 0
Linux 2.6.32-696.30.1.el6.x86_64 (ip-172-31-16-82.ap-northeast-1.compute.internal)      07/08/2018      _x86_64_        (1 CPU)

07:51:33 AM dentunusd   file-nr  inode-nr    pty-nr
07:51:33 AM     61344       736      7227         5

[centos@ip-172-31-16-82 ~]$ slabtop -o | grep dentry
 48140  48105  99%    0.19K   2407       20      9628K dentry
[centos@ip-172-31-16-82 ~]$ slabtop -o | grep dentry
 68100  68100 100%    0.19K   3405       20     13620K dentry

[centos@ip-172-31-16-82 ~]$ free
             total       used       free     shared    buffers     cached
Mem:        499996     174200     325796        160      14212      53744
-/+ buffers/cache:     106244     393752
Swap:      1048572       1280    1047292
[centos@ip-172-31-16-82 ~]$ free
             total       used       free     shared    buffers     cached
Mem:        499996     178176     321820        160      14220      53744
-/+ buffers/cache:     110212     389784
Swap:      1048572       1280    1047292

[centos@ip-172-31-16-82 ~]$ sar -v 0

Linux 2.6.32-696.30.1.el6.x86_64 (ip-172-31-16-82.ap-northeast-1.compute.internal) 07/08/2018 _x86_64_ (1 CPU)

07:51:10 AM dentunusd file-nr inode-nr pty-nr

07:51:10 AM 41344 736 7227 5

[centos@ip-172-31-16-82 ~]$ sar -v 0

Linux 2.6.32-696.30.1.el6.x86_64 (ip-172-31-16-82.ap-northeast-1.compute.internal) 07/08/2018 _x86_64_ (1 CPU)

07:51:33 AM dentunusd file-nr inode-nr pty-nr

07:51:33 AM 61344 736 7227 5

[centos@ip-172-31-16-82 ~]$ slabtop -o | grep dentry

48140 48105 99% 0.19K 2407 20 9628K dentry

[centos@ip-172-31-16-82 ~]$ slabtop -o | grep dentry

68100 68100 100% 0.19K 3405 20 13620K dentry

[centos@ip-172-31-16-82 ~]$ free

total used free shared buffers cached

Mem: 499996 174200 325796 160 14212 53744

-/+ buffers/cache: 106244 393752

Swap: 1048572 1280 1047292

[centos@ip-172-31-16-82 ~]$ free

total used free shared buffers cached

Mem: 499996 178176 321820 160 14220 53744

-/+ buffers/cache: 110212 389784

Swap: 1048572 1280 1047292

dentunusedが増加し、dentryのslabが増加している。

buffers/cacheが減少している。

対策コードを追加

<?php
putenv("NSS_SDB_USE_CACHE=yes"); // ★追加

require_once('./vendor/autoload.php');
use Aws\Sns\SnsClient;

$arn = "arn:aws:sns:ap-northeast-1:xxxxxx:aws-sdk-nss-dentry-test";
$message = 'dummy message';

$client = SnsClient::factory(array(
    'profile' => 'default',
    'region'  => 'ap-northeast-1',
));

for ($i = 0; $i < 100; $i ++) {
    $result = $client->publish(array(
        'TopicArn' => $arn,
        'Message' => $message
    ));
}

<?php

putenv("NSS_SDB_USE_CACHE=yes"); // ★追加

require_once('./vendor/autoload.php');

use Aws\Sns\SnsClient;

$arn = "arn:aws:sns:ap-northeast-1:xxxxxx:aws-sdk-nss-dentry-test";

$message = 'dummy message';

$client = SnsClient::factory(array(

'profile' => 'default',

'region' => 'ap-northeast-1',

));

for ($i = 0; $i < 100; $i ++) {

$result = $client->publish(array(

'TopicArn' => $arn,

'Message' => $message

));

}

実行前後の情報

[centos@ip-172-31-16-82 ~]$ sar -v 0
Linux 2.6.32-696.30.1.el6.x86_64 (ip-172-31-16-82.ap-northeast-1.compute.internal)      07/08/2018      _x86_64_        (1 CPU)

07:55:05 AM dentunusd   file-nr  inode-nr    pty-nr
07:55:05 AM     61349       736      7230         5
[centos@ip-172-31-16-82 ~]$ sar -v 0
Linux 2.6.32-696.30.1.el6.x86_64 (ip-172-31-16-82.ap-northeast-1.compute.internal)      07/08/2018      _x86_64_        (1 CPU)

07:55:15 AM dentunusd   file-nr  inode-nr    pty-nr
07:55:15 AM     61349       736      7230         5

[centos@ip-172-31-16-82 ~]$ slabtop -o | grep dentry
 68120  68110  99%    0.19K   3406       20     13624K dentry
[centos@ip-172-31-16-82 ~]$ slabtop -o | grep dentry
 68160  68136  99%    0.19K   3408       20     13632K dentry

[centos@ip-172-31-16-82 ~]$ free
             total       used       free     shared    buffers     cached
Mem:        499996     178300     321696        160      14292      53844
-/+ buffers/cache:     110164     389832
Swap:      1048572       1280    1047292
[centos@ip-172-31-16-82 ~]$ free
             total       used       free     shared    buffers     cached
Mem:        499996     178300     321696        160      14300      53844
-/+ buffers/cache:     110156     389840
Swap:      1048572       1280    1047292

[centos@ip-172-31-16-82 ~]$ sar -v 0

Linux 2.6.32-696.30.1.el6.x86_64 (ip-172-31-16-82.ap-northeast-1.compute.internal) 07/08/2018 _x86_64_ (1 CPU)

07:55:05 AM dentunusd file-nr inode-nr pty-nr

07:55:05 AM 61349 736 7230 5

[centos@ip-172-31-16-82 ~]$ sar -v 0

Linux 2.6.32-696.30.1.el6.x86_64 (ip-172-31-16-82.ap-northeast-1.compute.internal) 07/08/2018 _x86_64_ (1 CPU)

07:55:15 AM dentunusd file-nr inode-nr pty-nr

07:55:15 AM 61349 736 7230 5

[centos@ip-172-31-16-82 ~]$ slabtop -o | grep dentry

68120 68110 99% 0.19K 3406 20 13624K dentry

[centos@ip-172-31-16-82 ~]$ slabtop -o | grep dentry

68160 68136 99% 0.19K 3408 20 13632K dentry

[centos@ip-172-31-16-82 ~]$ free

total used free shared buffers cached

Mem: 499996 178300 321696 160 14292 53844

-/+ buffers/cache: 110164 389832

Swap: 1048572 1280 1047292

[centos@ip-172-31-16-82 ~]$ free

total used free shared buffers cached

Mem: 499996 178300 321696 160 14300 53844

-/+ buffers/cache: 110156 389840

Swap: 1048572 1280 1047292

ほぼ増加しなくなったことがわかる。

nss-softokn-3.14.3-23.3.el6_8 の環境でも効果がありそうだ。

GuzzleHttp

コードを追っていくと、内部でphp curlを使っているようだ

if (!extension_loaded('curl')) {
    // @codeCoverageIgnoreStart
    throw new RuntimeException('The PHP cURL extension must be installed to use Guzzle.');
    // @codeCoverageIgnoreEnd
}

if (!extension_loaded('curl')) {

// @codeCoverageIgnoreStart

throw new RuntimeException('The PHP cURL extension must be installed to use Guzzle.');

// @codeCoverageIgnoreEnd

}

curl と nss

[centos@ip-172-31-16-82 slab-nss]$ php -r "phpinfo();" | grep "^curl" -A24
PHP Warning:  phpinfo(): It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected the timezone 'UTC' for now, but please set date.timezone to select your timezone. in Command line code on line 1
curl

cURL support => enabled
cURL Information => 7.19.7
Age => 3
Features
AsynchDNS => No
CharConv => No
Debug => No
GSS-Negotiate => Yes
IDN => Yes
IPv6 => Yes
krb4 => No
Largefile => Yes
libz => Yes
NTLM => Yes
SPNEGO => No
SSL => Yes
SSPI => No
Protocols => tftp, ftp, telnet, dict, ldap, ldaps, http, file, https, ftps, scp, sftp
Host => x86_64-redhat-linux-gnu
SSL Version => NSS/3.27.1
ZLib Version => 1.2.3
libSSH Version => libssh2/1.4.2

[centos@ip-172-31-16-82 slab-nss]$ php -r "phpinfo();" | grep "^curl" -A24

PHP Warning: phpinfo(): It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected the timezone 'UTC' for now, but please set date.timezone to select your timezone. in Command line code on line 1

curl

cURL support => enabled

cURL Information => 7.19.7

Age => 3

Features

AsynchDNS => No

CharConv => No

Debug => No

GSS-Negotiate => Yes

IDN => Yes

IPv6 => Yes

krb4 => No

Largefile => Yes

libz => Yes

NTLM => Yes

SPNEGO => No

SSL => Yes

SSPI => No

Protocols => tftp, ftp, telnet, dict, ldap, ldaps, http, file, https, ftps, scp, sftp

Host => x86_64-redhat-linux-gnu

SSL Version => NSS/3.27.1

ZLib Version => 1.2.3

libSSH Version => libssh2/1.4.2

[centos@ip-172-31-16-82 slab-nss]$ php -r "print_r(curl_version());"
Array
(
    [version_number] => 463623
    [age] => 3
    [features] => 1597
    [ssl_version_number] => 0
    [version] => 7.19.7
    [host] => x86_64-redhat-linux-gnu
    [ssl_version] => NSS/3.27.1
    [libz_version] => 1.2.3
    [protocols] => Array
        (
            [0] => tftp
            [1] => ftp
            [2] => telnet
            [3] => dict
            [4] => ldap
            [5] => ldaps
            [6] => http
            [7] => file
            [8] => https
            [9] => ftps
            [10] => scp
            [11] => sftp
        )

)

[centos@ip-172-31-16-82 slab-nss]$ php -r "print_r(curl_version());"

Array

(

[version_number] => 463623

[age] => 3

[features] => 1597

[ssl_version_number] => 0

[version] => 7.19.7

[host] => x86_64-redhat-linux-gnu

[ssl_version] => NSS/3.27.1

[libz_version] => 1.2.3

[protocols] => Array

(

[0] => tftp

[1] => ftp

[2] => telnet

[3] => dict

[4] => ldap

[5] => ldaps

[6] => http

[7] => file

[8] => https

[9] => ftps

[10] => scp

[11] => sftp

)

NSS/3.27.1 が使われているようだ。

osにinstallされているnss-softknは使われていない？

curlをmakeして確かめてみる

同じバージョンをインストール

#  cd /usr/local/src/
#  curl -O https://curl.haxx.se/download/archeology/curl-7.19.7.tar.gz
#  tar xvzf curl-7.19.7.tar.gz
#  cd curl-7.19.7

#  yum install gcc g++
#  yum install nspr-devel
#  yum install nss-devel

#  ./configure --with-nss --disable-manual
#  make

# cd /usr/local/src/

# curl -O https://curl.haxx.se/download/archeology/curl-7.19.7.tar.gz

# tar xvzf curl-7.19.7.tar.gz

# cd curl-7.19.7

# yum install gcc g++

# yum install nspr-devel

# yum install nss-devel

# ./configure --with-nss --disable-manual

# make

システムのnssが使われた事の確認と効果の確認

[root@ip-172-31-16-82 curl-7.19.7]# rpm -qa | grep nss
nss-softokn-freebl-3.14.3-23.3.el6_8.x86_64
nss-util-3.36.0-1.el6.x86_64
nss-softokn-freebl-devel-3.14.3-23.3.el6_8.x86_64
nss-sysinit-3.36.0-8.el6.x86_64
nss-devel-3.36.0-8.el6.x86_64
openssh-server-5.3p1-123.el6_9.x86_64
nss-util-devel-3.36.0-1.el6.x86_64
nss-softokn-devel-3.14.3-23.3.el6_8.x86_64
nss-3.36.0-8.el6.x86_64
nss-tools-3.36.0-8.el6.x86_64
nss-softokn-3.14.3-23.3.el6_8.x86_64
openssl-1.0.1e-57.el6.x86_64
openssh-5.3p1-123.el6_9.x86_64
openssh-clients-5.3p1-123.el6_9.x86_64

[root@ip-172-31-16-82 curl-7.19.7]# ./src/curl -V
curl 7.19.7 (x86_64-unknown-linux-gnu) libcurl/7.19.7 NSS/3.36
Protocols: tftp ftp telnet dict http file https ftps
Features: IPv6 Largefile SSL

[root@ip-172-31-16-82 curl-7.19.7]# strace -fc -e trace=access ./src/curl  -s https://www.google.co.jp/ > /dev/null
Process 28940 attached
Process 28941 attached
Process 28942 attached
Process 28943 attached
Process 28944 attached
Process 28946 attached
Process 28945 attached
Process 28947 attached
Process 28949 attached
Process 28948 attached
Process 28950 attached
Process 28951 attached
Process 28953 attached
Process 28952 attached
% time     seconds  usecs/call     calls    errors syscall
------ ----------- ----------- --------- --------- ----------------
  0.00    0.000000           0       938       926 access
------ ----------- ----------- --------- --------- ----------------
100.00    0.000000                   938       926 total
[root@ip-172-31-16-82 curl-7.19.7]# NSS_SDB_USE_CACHE=yes strace -fc -e trace=access ./src/curl  -s https://www.google.co.jp/ > /dev/null
Process 29010 attached
Process 29011 attached
Process 29012 attached
Process 29014 attached
Process 29015 attached
Process 29017 attached
Process 29016 attached
Process 29018 attached
Process 29020 attached
Process 29019 attached
Process 29021 attached
Process 29022 attached
Process 29024 attached
Process 29023 attached
% time     seconds  usecs/call     calls    errors syscall
------ ----------- ----------- --------- --------- ----------------
  0.00    0.000000           0        24        12 access
------ ----------- ----------- --------- --------- ----------------
100.00    0.000000                    24        12 total

[root@ip-172-31-16-82 curl-7.19.7]# rpm -qa | grep nss

nss-softokn-freebl-3.14.3-23.3.el6_8.x86_64

nss-util-3.36.0-1.el6.x86_64

nss-softokn-freebl-devel-3.14.3-23.3.el6_8.x86_64

nss-sysinit-3.36.0-8.el6.x86_64

nss-devel-3.36.0-8.el6.x86_64

openssh-server-5.3p1-123.el6_9.x86_64

nss-util-devel-3.36.0-1.el6.x86_64

nss-softokn-devel-3.14.3-23.3.el6_8.x86_64

nss-3.36.0-8.el6.x86_64

nss-tools-3.36.0-8.el6.x86_64

nss-softokn-3.14.3-23.3.el6_8.x86_64

openssl-1.0.1e-57.el6.x86_64

openssh-5.3p1-123.el6_9.x86_64

openssh-clients-5.3p1-123.el6_9.x86_64

[root@ip-172-31-16-82 curl-7.19.7]# ./src/curl -V

curl 7.19.7 (x86_64-unknown-linux-gnu) libcurl/7.19.7 NSS/3.36

Protocols: tftp ftp telnet dict http file https ftps

Features: IPv6 Largefile SSL

[root@ip-172-31-16-82 curl-7.19.7]# strace -fc -e trace=access ./src/curl -s https://www.google.co.jp/ > /dev/null

Process 28940 attached

Process 28941 attached

Process 28942 attached

Process 28943 attached

Process 28944 attached

Process 28946 attached

Process 28945 attached

Process 28947 attached

Process 28949 attached

Process 28948 attached

Process 28950 attached

Process 28951 attached

Process 28953 attached

Process 28952 attached

% time seconds usecs/call calls errors syscall

------ ----------- ----------- --------- --------- ----------------

0.00 0.000000 0 938 926 access

------ ----------- ----------- --------- --------- ----------------

100.00 0.000000 938 926 total

[root@ip-172-31-16-82 curl-7.19.7]# NSS_SDB_USE_CACHE=yes strace -fc -e trace=access ./src/curl -s https://www.google.co.jp/ > /dev/null

Process 29010 attached

Process 29011 attached

Process 29012 attached

Process 29014 attached

Process 29015 attached

Process 29017 attached

Process 29016 attached

Process 29018 attached

Process 29020 attached

Process 29019 attached

Process 29021 attached

Process 29022 attached

Process 29024 attached

Process 29023 attached

% time seconds usecs/call calls errors syscall

------ ----------- ----------- --------- --------- ----------------

0.00 0.000000 0 24 12 access

------ ----------- ----------- --------- --------- ----------------

100.00 0.000000 24 12 total

nss-softokn-3.14.3-23.3 で nss-softokn-3.14.3-23.3 が使えているだろうと思われる。

slab増大とcurlのNSS_SDB_USE_CACHE対策の効果確認

コメントを残す

AWS SDKを使用しているとslabが肥大化していく現象

NSS_SDB_USE_CACHE=yesが利用できるのが、nss3.16以上とあるが、

nss-softokn-3.14.3-12.el6 という情報もあるため、確認

https://bugzilla.redhat.com/show_bug.cgi?id=1044666

http://tama1029hq.hatenablog.com/entry/2016/12/12/105353

—

Amazon Linux

[root@freeserver ec2-user]# rpm -qa | grep nss-softokn
nss-softokn-3.16.2.3-14.2.38.amzn1.x86_64
nss-softokn-freebl-3.16.2.3-14.2.38.amzn1.x86_64
[root@freeserver ec2-user]# curl -V
curl 7.47.1 (x86_64-redhat-linux-gnu) libcurl/7.47.1 NSS/3.21 Basic ECC zlib/1.2.8 libidn/1.18 libpsl/0.6.2 (+libicu/50.1.2) libssh2/1.4.2
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp
Features: AsynchDNS IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz UnixSockets PSL

[root@freeserver ec2-user]# rpm -qa | grep nss-softokn

nss-softokn-3.16.2.3-14.2.38.amzn1.x86_64

nss-softokn-freebl-3.16.2.3-14.2.38.amzn1.x86_64

[root@freeserver ec2-user]# curl -V

curl 7.47.1 (x86_64-redhat-linux-gnu) libcurl/7.47.1 NSS/3.21 Basic ECC zlib/1.2.8 libidn/1.18 libpsl/0.6.2 (+libicu/50.1.2) libssh2/1.4.2

Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp

Features: AsynchDNS IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz UnixSockets PSL

この場合、NSS/3.21が有効なのだろうか。

[root@freeserver ec2-user]# strace -fc -e trace=access curl -s https://www.google.co.jp/ > /dev/null
Process 29754 attached
% time     seconds  usecs/call     calls    errors syscall
------ ----------- ----------- --------- --------- ----------------
100.00    0.000008           0      5383      5378 access
------ ----------- ----------- --------- --------- ----------------
100.00    0.000008                  5383      5378 total
[root@freeserver ec2-user]# NSS_SDB_USE_CACHE=yes strace -fc -e trace=access curl -s https://www.google.co.jp/ > /dev/null
Process 29780 attached
% time     seconds  usecs/call     calls    errors syscall
------ ----------- ----------- --------- --------- ----------------
  0.00    0.000000           0        17        14 access
------ ----------- ----------- --------- --------- ----------------
100.00    0.000000                    17        14 total
[root@freeserver ec2-user]# yum list nss-softokn

[root@freeserver ec2-user]# strace -fc -e trace=access curl -s https://www.google.co.jp/ > /dev/null

Process 29754 attached

% time seconds usecs/call calls errors syscall

------ ----------- ----------- --------- --------- ----------------

100.00 0.000008 0 5383 5378 access

------ ----------- ----------- --------- --------- ----------------

100.00 0.000008 5383 5378 total

[root@freeserver ec2-user]# NSS_SDB_USE_CACHE=yes strace -fc -e trace=access curl -s https://www.google.co.jp/ > /dev/null

Process 29780 attached

% time seconds usecs/call calls errors syscall

------ ----------- ----------- --------- --------- ----------------

0.00 0.000000 0 17 14 access

------ ----------- ----------- --------- --------- ----------------

100.00 0.000000 17 14 total

[root@freeserver ec2-user]# yum list nss-softokn

→効いている。

—

さくら（CentOS release 6.6 (Final)）

[nilesflow@dev ~]$ cat /etc/redhat-release
CentOS release 6.6 (Final)
[nilesflow@dev ~]$ rpm -qa | grep nss-softokn
nss-softokn-3.14.3-18.el6_6.x86_64
nss-softokn-freebl-3.14.3-18.el6_6.x86_64
[nilesflow@dev ~]$ curl -V
curl 7.46.0 (x86_64-pc-linux-gnu) libcurl/7.46.0 OpenSSL/1.0.1e zlib/1.2.3 libidn/1.18
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp smb smbs smtp smtps telnet tftp
Features: IDN IPv6 Largefile NTLM NTLM_WB SSL libz UnixSockets

[nilesflow@dev ~]$ cat /etc/redhat-release

CentOS release 6.6 (Final)

[nilesflow@dev ~]$ rpm -qa | grep nss-softokn

nss-softokn-3.14.3-18.el6_6.x86_64

nss-softokn-freebl-3.14.3-18.el6_6.x86_64

[nilesflow@dev ~]$ curl -V

curl 7.46.0 (x86_64-pc-linux-gnu) libcurl/7.46.0 OpenSSL/1.0.1e zlib/1.2.3 libidn/1.18

Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp smb smbs smtp smtps telnet tftp

Features: IDN IPv6 Largefile NTLM NTLM_WB SSL libz UnixSockets

[nilesflow@dev ~]$ strace -fc -e trace=access curl 'https://www.google.com' > /dev/null
Process 3673 attached
Process 3673 detached
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 12028    0 12028    0     0  84852      0 --:--:-- --:--:-- --:--:-- 87795
% time     seconds  usecs/call     calls    errors syscall
------ ----------- ----------- --------- --------- ----------------
  -nan    0.000000           0         3         2 access
------ ----------- ----------- --------- --------- ----------------
100.00    0.000000                     3         2 total

[nilesflow@dev ~]$ strace -fc -e trace=access curl 'https://www.google.com' > /dev/null

Process 3673 attached

Process 3673 detached

% Total % Received % Xferd Average Speed Time Time Time Current

Dload Upload Total Spent Left Speed

100 12028 0 12028 0 0 84852 0 --:--:-- --:--:-- --:--:-- 87795

% time seconds usecs/call calls errors syscall

------ ----------- ----------- --------- --------- ----------------

-nan 0.000000 0 3 2 access

------ ----------- ----------- --------- --------- ----------------

100.00 0.000000 3 2 total

→再現しない

—

CentOS6.9（Amazonマーケットプレイス）

[centos@ip-172-31-16-82 ~]$ cat /etc/redhat-release
CentOS release 6.9 (Final)
[centos@ip-172-31-16-82 ~]$ rpm -qa | grep nss-softokn
nss-softokn-freebl-3.14.3-23.3.el6_8.x86_64
nss-softokn-3.14.3-23.3.el6_8.x86_64
[centos@ip-172-31-16-82 ~]$ curl -V
curl 7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1 zlib/1.2.3 libidn/1.18 libssh2/1.4.2
Protocols: tftp ftp telnet dict ldap ldaps http file https ftps scp sftp
Features: GSS-Negotiate IDN IPv6 Largefile NTLM SSL libz

[centos@ip-172-31-16-82 ~]$ cat /etc/redhat-release

CentOS release 6.9 (Final)

[centos@ip-172-31-16-82 ~]$ rpm -qa | grep nss-softokn

nss-softokn-freebl-3.14.3-23.3.el6_8.x86_64

nss-softokn-3.14.3-23.3.el6_8.x86_64

[centos@ip-172-31-16-82 ~]$ curl -V

curl 7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1 zlib/1.2.3 libidn/1.18 libssh2/1.4.2

Protocols: tftp ftp telnet dict ldap ldaps http file https ftps scp sftp

Features: GSS-Negotiate IDN IPv6 Largefile NTLM SSL libz

[centos@ip-172-31-16-82 ~]$ strace -fc -e trace=access curl -s https://www.google.co.jp/ > /dev/null
% time     seconds  usecs/call     calls    errors syscall
------ ----------- ----------- --------- --------- ----------------
100.00    0.000072           0      1811      1808 access
------ ----------- ----------- --------- --------- ----------------
100.00    0.000072                  1811      1808 total
[centos@ip-172-31-16-82 ~]$ NSS_SDB_USE_CACHE=yes  strace -fc -e trace=access curl -s https://www.google.co.jp/ > /dev/null
% time     seconds  usecs/call     calls    errors syscall
------ ----------- ----------- --------- --------- ----------------
  0.00    0.000000           0        24        21 access
------ ----------- ----------- --------- --------- ----------------
100.00    0.000000                    24        21 total

[centos@ip-172-31-16-82 ~]$ strace -fc -e trace=access curl -s https://www.google.co.jp/ > /dev/null

% time seconds usecs/call calls errors syscall

------ ----------- ----------- --------- --------- ----------------

100.00 0.000072 0 1811 1808 access

------ ----------- ----------- --------- --------- ----------------

100.00 0.000072 1811 1808 total

[centos@ip-172-31-16-82 ~]$ NSS_SDB_USE_CACHE=yes strace -fc -e trace=access curl -s https://www.google.co.jp/ > /dev/null

% time seconds usecs/call calls errors syscall

------ ----------- ----------- --------- --------- ----------------

0.00 0.000000 0 24 21 access

------ ----------- ----------- --------- --------- ----------------

100.00 0.000000 24 21 total

→効いている

furoom

タグアーカイブ:nss

AWS SDK for PHPでのslab増大とNSS_SDB_USE_CACHE対策の効果確認

まとめ

各種情報

AWS-SDKでSNSへpublishするテストコードを準備

実行前後の情報

対策コードを追加

実行前後の情報

GuzzleHttp

curl と nss

curlをmakeして確かめてみる

slab増大とcurlのNSS_SDB_USE_CACHE対策の効果確認