vault backup: 2026-01-05 13:03:55
This commit is contained in:
windyboy
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,199 @@
|
||||
|
||||
# XtraDB Cluster install
|
||||
|
||||
## requirement
|
||||
### docker
|
||||
|
||||
### host
|
||||
|
||||
```hosts
|
||||
10.194.64.102 gzii-db-3
|
||||
10.194.64.103 gzii-db-4
|
||||
10.194.64.104 gzii-app-2
|
||||
```
|
||||
|
||||
### sysctl
|
||||
```bash
|
||||
modprobe br_netfilter
|
||||
lsmod | grep br_netfilter
|
||||
echo "br_netfilter" | sudo tee -a /etc/modules-load.d/br_netfilter.conf
|
||||
sysctl -w net.bridge.bridge-nf-call-iptables=1
|
||||
sysctl -w net.bridge.bridge-nf-call-ip6tables=1
|
||||
```
|
||||
|
||||
### iptables
|
||||
```bash
|
||||
iptables -A INPUT -p tcp --dport 3306 -j ACCEPT
|
||||
iptables -A INPUT -p tcp --dport 33060 -j ACCEPT
|
||||
iptables -A INPUT -p tcp --dport 4567 -j ACCEPT
|
||||
```
|
||||
|
||||
|
||||
```bash
|
||||
iptables-save > /etc/iptables/rules.v4
|
||||
systemctl restart iptables
|
||||
```
|
||||
|
||||
### firewalld
|
||||
|
||||
```bash
|
||||
firewall-cmd --get-active-zones
|
||||
```
|
||||
|
||||
|
||||
```bash
|
||||
firewall-cmd --zone=public --add-port=3306/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=4567/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=33060/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=2379/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=4568/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=4444/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=13306/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=6032/tcp --permanent
|
||||
firewall-cmd --reload
|
||||
|
||||
```
|
||||
|
||||
## cluster
|
||||
## node 1
|
||||
|
||||
### image
|
||||
```bash
|
||||
gunzip -c percorna.tgz | docker load
|
||||
```
|
||||
### ssl
|
||||
```bash
|
||||
mkdir /opt/percorna/config
|
||||
```
|
||||
|
||||
|
||||
```my.cnf
|
||||
[client]
|
||||
ssl-ca = /cert/ca.pem
|
||||
ssl-cert = /cert/client-cert.pem
|
||||
ssl-key = /cert/client-key.pem
|
||||
|
||||
[sst]
|
||||
encrypt = 4
|
||||
ssl-ca = /cert/ca.pem
|
||||
ssl-cert = /cert/server-cert.pem
|
||||
ssl-key = /cert/server-key.pem
|
||||
|
||||
[mysqld]
|
||||
ssl-ca=/cert/ca.pem
|
||||
ssl-cert=/cert/server-cert.pem
|
||||
ssl-key=/cert/server-key.pem
|
||||
skip_name_resolve
|
||||
log-error = /var/lib/mysql/error.log
|
||||
wsrep_provider_options="socket.ssl_cert=/cert/server-cert.pem;socket.ssl_key=/cert/server-key.pem;socket.ssl_ca=/cert/ca.pem"
|
||||
```
|
||||
|
||||
|
||||
|
||||
### etcd
|
||||
```bash
|
||||
ETCD_HOST=10.192.64.102
|
||||
docker run -d \
|
||||
--name etcd \
|
||||
--net host \
|
||||
-v /usr/share/ca-certificates/:/etc/ssl/certs \
|
||||
-p 4001:4001 -p 2380:2380 -p 2379:2379 \
|
||||
quay.io/coreos/etcd:v3.4.35 \
|
||||
/usr/local/bin/etcd \
|
||||
--name etcd0 \
|
||||
--advertise-client-urls=http://${ETCD_HOST}:2379,http://${ETCD_HOST}:4001 \
|
||||
--listen-client-urls=http://0.0.0.0:2379,http://0.0.0.0:4001 \
|
||||
--initial-advertise-peer-urls=http://${ETCD_HOST}:2380 \
|
||||
--listen-peer-urls=http://0.0.0.0:2380 \
|
||||
--initial-cluster-token=etcd-cluster-1 \
|
||||
--initial-cluster=etcd0=http://${ETCD_HOST}:2380 \
|
||||
--initial-cluster-state=new
|
||||
```
|
||||
|
||||
|
||||
|
||||
### bootstrap
|
||||
|
||||
|
||||
```bash
|
||||
mkpasswd -l 16
|
||||
```
|
||||
|
||||
root password:
|
||||
```
|
||||
wc97fjvDg:Ywgyad
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
gzii-db-3:
|
||||
```bash
|
||||
docker run -d \
|
||||
-e MYSQL_ROOT_PASSWORD=wc97fjvDg:Ywgyad \
|
||||
-e CLUSTER_NAME=pxc-cluster1 \
|
||||
--name=gzii-db-3 \
|
||||
--net=host \
|
||||
-v ./cert:/cert \
|
||||
-v ./config:/etc/percona-xtradb-cluster.conf.d \
|
||||
-v ./data:/var/lib/mysql:rw \
|
||||
percona/percona-xtradb-cluster:8.4.0
|
||||
```
|
||||
|
||||
gzii-db-4:
|
||||
```bash
|
||||
docker run -d \
|
||||
-e MYSQL_ROOT_PASSWORD=wc97fjvDg:Ywgyad \
|
||||
-e CLUSTER_NAME=pxc-cluster1 \
|
||||
-e CLUSTER_JOIN=gzii-db-3 \
|
||||
--name=gzii-db-4 \
|
||||
--net=host \
|
||||
-v ./cert:/cert \
|
||||
-v ./config:/etc/percona-xtradb-cluster.conf.d \
|
||||
-v ./data:/var/lib/mysql:rw \
|
||||
percona/percona-xtradb-cluster:8.4.0
|
||||
```
|
||||
|
||||
|
||||
monitor pass:
|
||||
```
|
||||
0nz&lzDAxcxet5ta
|
||||
```
|
||||
|
||||
|
||||
```sql
|
||||
CREATE USER 'monitor'@'%' IDENTIFIED BY 'monitor';
|
||||
ALTER USER 'monitor'@'%' IDENTIFIED BY 'monitor';
|
||||
GRANT SELECT, PROCESS, REPLICATION CLIENT ON *.* TO 'monitor'@'%';
|
||||
FLUSH PRIVILEGES;
|
||||
```
|
||||
|
||||
|
||||
```sql
|
||||
CREATE USER 'operator'@'%' IDENTIFIED BY 'operator';
|
||||
GRANT SELECT, REPLICATION CLIENT ON *.* TO 'operator'@'%';
|
||||
FLUSH PRIVILEGES;
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
```sql
|
||||
INSERT INTO mysql_users (username, password, default_hostgroup, active)
|
||||
VALUES ('monitoring', '0nz&lzDAxcxet5ta', 0, 1);
|
||||
|
||||
```
|
||||
|
||||
|
||||
```sql
|
||||
INSERT INTO mysql_users (username, password, default_hostgroup) VALUES ('monitor', '0nz&lzDAxcxet5ta', 0);
|
||||
LOAD MYSQL USERS TO RUNTIME;
|
||||
SAVE MYSQL USERS TO DISK;
|
||||
|
||||
```
|
||||
|
||||
|
||||
```bash
|
||||
proxysql-admin --config-file=/var/lib/proxysql/proxysql-admin.cnf --enable
|
||||
```
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 28 KiB |
@@ -0,0 +1,103 @@
|
||||
|
||||
Great! Since you're using `root`, there's no need to prepend commands with `sudo`. Here's how to configure `iptables` to allow all traffic on `10.194.64.0/24` without `sudo`:
|
||||
|
||||
---
|
||||
|
||||
### **1. Check Current iptables Rules**
|
||||
|
||||
To inspect the current rules:
|
||||
|
||||
```bash
|
||||
iptables -L -v -n
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **2. Add Rules to Allow All Traffic on the Subnet**
|
||||
|
||||
#### **2.1. Allow Incoming Traffic**
|
||||
|
||||
```bash
|
||||
iptables -A INPUT -s 10.194.64.0/24 -j ACCEPT
|
||||
```
|
||||
|
||||
#### **2.2. Allow Outgoing Traffic**
|
||||
|
||||
```bash
|
||||
iptables -A OUTPUT -d 10.194.64.0/24 -j ACCEPT
|
||||
```
|
||||
|
||||
#### **2.3. Allow Forwarded Traffic (if needed)**
|
||||
|
||||
If this system acts as a router or forwards traffic:
|
||||
|
||||
```bash
|
||||
iptables -A FORWARD -s 10.194.64.0/24 -j ACCEPT
|
||||
iptables -A FORWARD -d 10.194.64.0/24 -j ACCEPT
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **3. Save the iptables Configuration**
|
||||
|
||||
To persist these rules across reboots:
|
||||
|
||||
#### **3.1. Save Rules (Legacy Method)**
|
||||
|
||||
Use `iptables-save` to save the rules into a configuration file:
|
||||
|
||||
```bash
|
||||
iptables-save > /etc/iptables/rules.v4
|
||||
```
|
||||
|
||||
#### **3.2. For Systems Using `netfilter-persistent`**
|
||||
|
||||
If `netfilter-persistent` is installed:
|
||||
|
||||
```bash
|
||||
netfilter-persistent save
|
||||
```
|
||||
|
||||
#### **3.3. For RHEL-Based Systems**
|
||||
|
||||
If you're on a RHEL-based system:
|
||||
|
||||
```bash
|
||||
service iptables save
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **4. Verify Rules**
|
||||
|
||||
To confirm the rules are applied:
|
||||
|
||||
```bash
|
||||
iptables -L -v -n
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **5. Optional: Test Connectivity**
|
||||
|
||||
Test traffic to and from the `10.194.64.0/24` subnet:
|
||||
|
||||
```bash
|
||||
ping 10.194.64.1
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **6. Debugging (if needed)**
|
||||
|
||||
If traffic is still blocked:
|
||||
|
||||
- Look for conflicting `DROP` rules in the `INPUT`, `OUTPUT`, or `FORWARD` chains:
|
||||
|
||||
```bash
|
||||
iptables -L -v -n
|
||||
```
|
||||
|
||||
- Ensure the system's network interface is properly configured.
|
||||
|
||||
Let me know if you need help troubleshooting further or additional features like logging specific traffic!
|
||||
@@ -0,0 +1,559 @@
|
||||
|
||||
lsblk
|
||||
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
|
||||
loop0 7:0 0 3.6G 0 loop /mnt/dvd
|
||||
sr0 11:0 1 30.6M 0 rom
|
||||
sr1 11:1 1 1024M 0 rom
|
||||
vda 252:0 0 30G 0 disk
|
||||
├─vda1 252:1 0 200M 0 part /boot
|
||||
├─vda2 252:2 0 8G 0 part [SWAP]
|
||||
└─vda3 252:3 0 21.8G 0 part /
|
||||
vdb 252:16 0 70G 0 disk
|
||||
└─vdb1 252:17 0 70G 0 part /opt
|
||||
vdc 252:32 0 250G 0 disk
|
||||
|
||||
|
||||
|
||||
tomcat :
|
||||
x-forward-for:
|
||||
```xml
|
||||
<!-- Remote IP Valve -->
|
||||
<Valve className="org.apache.catalina.valves.RemoteIpValve" />
|
||||
|
||||
<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
|
||||
prefix="localhost_access_log." suffix=".txt"
|
||||
pattern="combined" resolveHosts="false"/>
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
## docker ce install
|
||||
|
||||
download docker binary
|
||||
```
|
||||
http://mirrors.aliyun.com/docker-ce/linux/static/stable
|
||||
```
|
||||
|
||||
```bash
|
||||
tar xzvf docker-27.3.1.tgz
|
||||
cp docker/* /usr/loca/sbin/
|
||||
```
|
||||
|
||||
```bash
|
||||
vim /usr/lib/systemd/system/docker.service
|
||||
|
||||
```
|
||||
|
||||
```docker.service
|
||||
[Unit]
|
||||
Description=Docker Application Container Engine
|
||||
Documentation=https://docs.docker.com
|
||||
After=network-online.target firewalld.service
|
||||
Wants=network-online.target
|
||||
[Service]
|
||||
Type=notify
|
||||
ExecStart=/usr/local/sbin/dockerd
|
||||
ExecReload=/bin/kill -s HUP $MAINPID
|
||||
LimitNOFILE=infinity
|
||||
LimitNPROC=infinity
|
||||
TimeoutStartSec=0
|
||||
Delegate=yes
|
||||
KillMode=process
|
||||
Restart=on-failure
|
||||
StartLimitBurst=3
|
||||
StartLimitInterval=60s
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
docker save
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker run -d \
|
||||
--name haproxy \
|
||||
-p 80:80 \
|
||||
-p 443:443 \
|
||||
-p 3306:3306 \
|
||||
-v ./config/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro \
|
||||
haproxy:3.0.6
|
||||
|
||||
```
|
||||
|
||||
|
||||
gzii-db-2:
|
||||
lookbusy:
|
||||
```
|
||||
#!/bin/bash
|
||||
/usr/local/bin/lookbusy -c 10-30 --cpu-mode curve --cpu-curve-period 60m --cpu-curve-peak 30m cpu &
|
||||
```
|
||||
|
||||
disk:
|
||||
```
|
||||
fallocate -l 240G /opt/tmp/data.zip
|
||||
```
|
||||
|
||||
|
||||
sql timeout
|
||||
|
||||
|
||||
### Steps:
|
||||
|
||||
1. **Create a new rule for `jmwrapid`**:
|
||||
|
||||
```sql
|
||||
INSERT INTO mysql_query_rules (active, username, match_pattern, replace_pattern, timeout, flagIN, destination_hostgroup)
|
||||
VALUES (1, 'jmwrapid', '.*', 'SET SESSION max_execution_time=30000;', 0, 0, 10);
|
||||
```
|
||||
|
||||
This rule sets a maximum execution time of 30 seconds (30000 milliseconds) for all queries executed by the `jmwrapid` user.
|
||||
|
||||
2. **Load the rule into runtime and save it**:
|
||||
|
||||
```sql
|
||||
LOAD MYSQL QUERY RULES TO RUNTIME;
|
||||
SAVE MYSQL QUERY RULES TO DISK;
|
||||
```
|
||||
|
||||
3. **Verify the rule**:
|
||||
|
||||
```sql
|
||||
SELECT * FROM mysql_query_rules WHERE username = 'jmwrapid';
|
||||
```
|
||||
|
||||
|
||||
This will apply the SQL timeout specifically for `jmwrapid`. Let me know if you need more adjustments!
|
||||
|
||||
```sql
|
||||
UPDATE mysql_query_rules
|
||||
SET timeout = 60
|
||||
WHERE username = 'jmwrapid' AND match_pattern = '.*';
|
||||
|
||||
|
||||
```
|
||||
|
||||
|
||||
```sql
|
||||
INSERT INTO mysql_query_rules (active, username, match_pattern, timeout, flagIN, destination_hostgroup)
|
||||
VALUES (1, 'jmwrapid', '.*', 60, 0, 10);
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
To update a Docker container's timezone, you can follow these steps:
|
||||
|
||||
---
|
||||
|
||||
### **1. Update Timezone in a Running Container**
|
||||
If the container is already running, you can change the timezone by:
|
||||
|
||||
#### **a. Using `exec` to set the timezone**
|
||||
Run the following command to set the timezone in the container:
|
||||
```bash
|
||||
docker exec -it <container_name> ln -sf /usr/share/zoneinfo/<Region>/<City> /etc/localtime
|
||||
```
|
||||
For example, to set the timezone to `America/New_York`:
|
||||
```bash
|
||||
docker exec -it <container_name> ln -sf /usr/share/zoneinfo/America/New_York /etc/localtime
|
||||
```
|
||||
|
||||
#### **b. Set the timezone environment variable**
|
||||
You can also set the `TZ` environment variable in the container:
|
||||
```bash
|
||||
docker exec -it <container_name> sh -c "echo 'America/New_York' > /etc/timezone && dpkg-reconfigure -f noninteractive tzdata"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **2. Set Timezone at Container Creation**
|
||||
To ensure the correct timezone is set when you start a container, you can configure the timezone during container creation.
|
||||
|
||||
#### **a. Add a `TZ` environment variable**
|
||||
Use the `-e` flag to set the `TZ` environment variable:
|
||||
```bash
|
||||
docker run -e TZ=America/New_York -d <image_name>
|
||||
```
|
||||
|
||||
#### **b. Mount the `/etc/localtime` file**
|
||||
You can mount the host system's timezone file into the container:
|
||||
```bash
|
||||
docker run -v /etc/localtime:/etc/localtime:ro -v /etc/timezone:/etc/timezone:ro -d <image_name>
|
||||
```
|
||||
|
||||
This ensures the container uses the same timezone as the host system.
|
||||
|
||||
---
|
||||
|
||||
### **3. Update Dockerfile for Persistent Changes**
|
||||
If you want all containers created from a specific image to have a pre-configured timezone, you can modify the `Dockerfile`:
|
||||
|
||||
```dockerfile
|
||||
FROM <base_image>
|
||||
ENV TZ=America/New_York
|
||||
RUN ln -sf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
|
||||
```
|
||||
|
||||
Then rebuild the image:
|
||||
```bash
|
||||
docker build -t <new_image_name> .
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **4. Verify the Timezone**
|
||||
You can verify the timezone in the container by checking the current date and time:
|
||||
```bash
|
||||
docker exec -it <container_name> date
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Summary:
|
||||
- Use `docker exec` to update the timezone in a running container.
|
||||
- Configure the timezone at container creation using `-e TZ` or mounting `/etc/localtime`.
|
||||
- Modify the `Dockerfile` for persistent timezone settings.
|
||||
|
||||
Let me know if you need further clarification!
|
||||
|
||||
|
||||
```
|
||||
docker exec --user root -it proxysql ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
|
||||
```
|
||||
|
||||
```
|
||||
echo 'Asia/Shanghai' > /etc/timezone && dpkg-reconfigure -f noninteractive tzdata
|
||||
```
|
||||
|
||||
```
|
||||
docker exec -it proxysql mysql -h 127.0.0.1 -u admin -padmin -P6032 -e "SET GLOBAL time_zone = 'Asia/Shanghai';"
|
||||
|
||||
```
|
||||
```
|
||||
docker exec -it gzii-db-3 mysql -u root -h 127.0.0.1 -pwc97fjvDg:Ywgyad mysql -e "SET GLOBAL time_zone = 'Asia/Shanghai';"
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker cp /usr/share/zoneinfo/Asia/Shanghai gzii-db-3:/usr/share/zoneinfo/Asia/Shanghai
|
||||
docker exec -it -u root gzii-db-3 sh -c "echo 'Asia/Shanghai' > /etc/timezone"
|
||||
docker exec -u root gzii-db-3 ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
|
||||
```
|
||||
|
||||
```
|
||||
docker cp /usr/share/zoneinfo/Asia/Shanghai gzii-db-4:/usr/share/zoneinfo/Asia/Shanghai
|
||||
docker exec -it -u root gzii-db-4 sh -c "echo 'Asia/Shanghai' > /etc/timezone"
|
||||
docker exec -u root gzii-db-4 ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
|
||||
```
|
||||
|
||||
|
||||
|
||||
17:
|
||||
|
||||
cpu 内存:
|
||||
|
||||
```
|
||||
/usr/local/bin/lookbusy -c 10-70 --cpu-mode curve --cpu-curve-period 60m --cpu-curve-peak 30m cpu -m 19GB -M 3000 &
|
||||
```
|
||||
|
||||
|
||||
auth 失败处理
|
||||
|
||||
```
|
||||
docker run -d \
|
||||
--name etcd \
|
||||
--net host \
|
||||
-v /usr/share/ca-certificates/:/etc/ssl/certs \
|
||||
-v /opt/etcd/data:/etcd-data \
|
||||
quay.io/coreos/etcd:v3.4.35 \
|
||||
/usr/local/bin/etcd \
|
||||
--enable-v2=true \
|
||||
--name etcd0 \
|
||||
--data-dir /etcd-data \
|
||||
--listen-client-urls http://0.0.0.0:2379,http://0.0.0.0:4001 \
|
||||
--advertise-client-urls http://10.194.64.102:2379,http://10.194.64.102:4001 \
|
||||
--listen-peer-urls http://0.0.0.0:2380 \
|
||||
--initial-advertise-peer-urls http://10.194.64.102:2380 \
|
||||
--initial-cluster-token etcd-cluster-1 \
|
||||
--initial-cluster etcd0=http://10.194.64.102:2380 \
|
||||
--initial-cluster-state new
|
||||
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker exec -e ETCDCTL_API=3 etcd etcdctl --endpoints=http://127.0.0.1:2379 endpoint health
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
docker exec -e ETCDCTL_API=3 etcd etcdctl user add root --new-user-password="IeGheikae.Woo5ph"
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker exec etcd etcdctl --endpoints=http://gzii-db-3:2379 role add root
|
||||
|
||||
docker exec etcd etcdctl --endpoints=http://gzii-db-3:2379 role grant-permission root --prefix=true readwrite /
|
||||
|
||||
docker exec etcd etcdctl --endpoints=http://gzii-db-3:2379 user grant-role root root
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker exec etcd etcdctl --endpoints=http://gzii-db-3:2379 auth enable
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker exec -e ETCDCTL_API=3 etcd etcdctl --user=root:IeGheikae.Woo5ph member list
|
||||
```
|
||||
|
||||
|
||||
要修改 ProxySQL 的**全局**默认查询超时（`mysql-default_query_timeout`），你可以通过 Admin 接口在线调整，也可以修改配置文件后重启或重加载。下面分别介绍这两种方法。
|
||||
|
||||
---
|
||||
|
||||
## 一、通过 Admin 接口在线修改
|
||||
|
||||
1. **登录到 ProxySQL Admin 界面**
|
||||
|
||||
```bash
|
||||
mysql -u admin -padmin -h 127.0.0.1 -P 6032
|
||||
```
|
||||
|
||||
将 `admin`/`admin` 替换成你的管理员用户名和密码。
|
||||
|
||||
2. **设置新的默认查询超时**（单位：毫秒）
|
||||
比如将超时改为 **60 000 ms（60 秒）**：
|
||||
|
||||
```sql
|
||||
SET mysql-default_query_timeout = 60000;
|
||||
```
|
||||
|
||||
3. **将变量加载到运行时配置**
|
||||
|
||||
```sql
|
||||
LOAD MYSQL VARIABLES TO RUNTIME;
|
||||
```
|
||||
|
||||
4. **将当前运行时配置保存到磁盘**
|
||||
|
||||
```sql
|
||||
SAVE MYSQL VARIABLES TO DISK;
|
||||
```
|
||||
|
||||
> 默认情况下，`mysql-default_query_timeout` 的值是 `86400000`（24 小时）([proxysql.com](https://proxysql.com/documentation/global-variables/mysql-variables/?utm_source=chatgpt.com "MySQL Variables - ProxySQL"))。
|
||||
|
||||
|
||||
---
|
||||
|
||||
## 二、修改配置文件
|
||||
|
||||
1. 打开你的 ProxySQL 配置文件（常见路径 `/etc/proxysql.cnf` 或者 `/etc/proxysql/proxysql.cnf`）
|
||||
|
||||
2. 找到 `mysql_variables` 段落，添加或修改 `default_query_timeout`，例如：
|
||||
|
||||
```ini
|
||||
mysql_variables = {
|
||||
# … 其他变量 …
|
||||
default_query_timeout = 60000
|
||||
}
|
||||
```
|
||||
|
||||
3. 重启 ProxySQL 服务以使配置生效：
|
||||
|
||||
```bash
|
||||
systemctl restart proxysql
|
||||
```
|
||||
|
||||
或者如果你希望不中断服务，可以先启动 ProxySQL，然后执行：
|
||||
|
||||
```sql
|
||||
LOAD MYSQL VARIABLES TO RUNTIME;
|
||||
SAVE MYSQL VARIABLES TO DISK;
|
||||
```
|
||||
|
||||
|
||||
---
|
||||
|
||||
## 三、针对单条规则定制超时
|
||||
|
||||
如果你只想对特定的查询模式设定更严格或更宽松的超时，可以在 **查询规则** 中使用 `timeout` 字段（单位同样为毫秒）：
|
||||
|
||||
```sql
|
||||
INSERT INTO mysql_query_rules (
|
||||
rule_id, active, match_pattern, destination_hostgroup, timeout
|
||||
) VALUES (
|
||||
100, 1, '^SELECT .* FOR UPDATE$', 10, 30000
|
||||
);
|
||||
|
||||
LOAD MYSQL QUERY RULES TO RUNTIME;
|
||||
SAVE MYSQL QUERY RULES TO DISK;
|
||||
```
|
||||
|
||||
> 如果某条规则未指定 `timeout`，就会回退使用全局 `mysql-default_query_timeout`。([proxysql.com](https://proxysql.com/documentation/main-runtime/?utm_source=chatgpt.com "Main (runtime tables definition) - ProxySQL"))
|
||||
|
||||
---
|
||||
|
||||
以上就是修改 ProxySQL 默认查询超时的方式。根据你的场景选择「全局修改」或「单条规则覆盖」，并记得 `LOAD … TO RUNTIME` + `SAVE … TO DISK` 才能保证即时生效且持久保存。
|
||||
|
||||
|
||||
探针
|
||||
```
|
||||
curl -k https://10.207.33.1:9000/up-install/up-install.sh | bash -x
|
||||
```
|
||||
|
||||
|
||||
内存：
|
||||
```
|
||||
free | awk '/^Mem:/ { printf("Memory Usage: %.2f%%\n", $3/$2 * 100) }'
|
||||
```
|
||||
|
||||
|
||||
nginx 加代理
|
||||
/dcwj to https://10.205.29.3:8081
|
||||
|
||||
```
|
||||
access_log /var/log/nginx/access.log main;
|
||||
|
||||
#keepalive_timeout 65;
|
||||
|
||||
upstream form_api_backend {
|
||||
server 10.194.64.17:8180 max_fails=3 fail_timeout=30s;
|
||||
}
|
||||
|
||||
upstream dcwj_backend {
|
||||
server 10.205.29.3:8081;
|
||||
}
|
||||
|
||||
# 重定向HTTP请求到HTTPS
|
||||
server {
|
||||
listen 80;
|
||||
server_name data.gxj.gz.gov.cn;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
# HTTPS服务器配置
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name data.gxj.gz.gov.cn 10.194.64.17 _;
|
||||
|
||||
# SSL证书配置
|
||||
ssl_certificate /etc/nginx/ssl/nginx.crt;
|
||||
ssl_certificate_key /etc/nginx/ssl/nginx.key;
|
||||
|
||||
# intermediate configuration
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ecdh_curve X25519:prime256v1:secp384r1;
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:\
|
||||
ECDHE-RSA-AES128-GCM-SHA256:\
|
||||
ECDHE-ECDSA-AES256-GCM-SHA384:\
|
||||
ECDHE-RSA-AES256-GCM-SHA384:\
|
||||
ECDHE-ECDSA-CHACHA20-POLY1305:\
|
||||
ECDHE-RSA-CHACHA20-POLY1305:\
|
||||
DHE-RSA-AES128-GCM-SHA256:\
|
||||
DHE-RSA-AES256-GCM-SHA384:\
|
||||
DHE-RSA-CHACHA20-POLY1305;
|
||||
ssl_prefer_server_ciphers off;
|
||||
|
||||
client_max_body_size 30m;
|
||||
|
||||
# 默认根路径代理
|
||||
location / {
|
||||
proxy_pass http://form_api_backend;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_connect_timeout 30s;
|
||||
proxy_read_timeout 60s;
|
||||
proxy_send_timeout 60s;
|
||||
}
|
||||
|
||||
# /dcwj 上的反向代理到 HTTPS 后端
|
||||
location /dcwj/ {
|
||||
access_log /var/log/nginx/dcwj_access.log main;
|
||||
proxy_pass https://dcwj_backend$request_uri;
|
||||
proxy_ssl_server_name on;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_connect_timeout 30s;
|
||||
proxy_read_timeout 60s;
|
||||
proxy_send_timeout 60s;
|
||||
}
|
||||
|
||||
# 可选：健康检查
|
||||
location /healthcheck {
|
||||
return 200 "OK";
|
||||
add_header Content-Type text/plain;
|
||||
}
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
```
|
||||
curl -I -k -v https://10.205.29.3:8081
|
||||
```
|
||||
|
||||
|
||||
nginx logrotate
|
||||
|
||||
/etc/logrotate.d/nginx-docker
|
||||
```
|
||||
/opt/app/nginx/log/*.log {
|
||||
daily
|
||||
missingok
|
||||
rotate 14
|
||||
compress
|
||||
delaycompress
|
||||
notifempty
|
||||
create 0640 root root
|
||||
sharedscripts
|
||||
postrotate
|
||||
# signal the nginx in the container to reopen logs
|
||||
docker kill --signal=USR1 nginx_container_name
|
||||
endscript
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
|
||||
new config with gz compress
|
||||
```
|
||||
/opt/app/nginx/log/*.log {
|
||||
daily
|
||||
missingok
|
||||
rotate 14
|
||||
|
||||
# enable gzip compression of rotated logs
|
||||
compress
|
||||
compresscmd /bin/gzip
|
||||
uncompresscmd /bin/gunzip
|
||||
compressoptions -9
|
||||
extension .gz
|
||||
delaycompress
|
||||
|
||||
notifempty
|
||||
create 0640 root root
|
||||
|
||||
sharedscripts
|
||||
postrotate
|
||||
# tell the nginx master in the “nginx” container to reopen its logs
|
||||
docker kill --signal=USR1 nginx
|
||||
endscript
|
||||
}
|
||||
|
||||
```
|
||||
@@ -0,0 +1,342 @@
|
||||
|
||||
lsblk
|
||||
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
|
||||
loop0 7:0 0 3.6G 0 loop /mnt/dvd
|
||||
sr0 11:0 1 30.6M 0 rom
|
||||
sr1 11:1 1 1024M 0 rom
|
||||
vda 252:0 0 30G 0 disk
|
||||
├─vda1 252:1 0 200M 0 part /boot
|
||||
├─vda2 252:2 0 8G 0 part [SWAP]
|
||||
└─vda3 252:3 0 21.8G 0 part /
|
||||
vdb 252:16 0 70G 0 disk
|
||||
└─vdb1 252:17 0 70G 0 part /opt
|
||||
vdc 252:32 0 250G 0 disk
|
||||
|
||||
|
||||
|
||||
tomcat :
|
||||
x-forward-for:
|
||||
```xml
|
||||
<!-- Remote IP Valve -->
|
||||
<Valve className="org.apache.catalina.valves.RemoteIpValve" />
|
||||
|
||||
<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
|
||||
prefix="localhost_access_log." suffix=".txt"
|
||||
pattern="combined" resolveHosts="false"/>
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
## docker ce install
|
||||
|
||||
download docker binary
|
||||
```
|
||||
http://mirrors.aliyun.com/docker-ce/linux/static/stable
|
||||
```
|
||||
|
||||
```bash
|
||||
tar xzvf docker-27.3.1.tgz
|
||||
cp docker/* /usr/loca/sbin/
|
||||
```
|
||||
|
||||
```bash
|
||||
vim /usr/lib/systemd/system/docker.service
|
||||
|
||||
```
|
||||
|
||||
```docker.service
|
||||
[Unit]
|
||||
Description=Docker Application Container Engine
|
||||
Documentation=https://docs.docker.com
|
||||
After=network-online.target firewalld.service
|
||||
Wants=network-online.target
|
||||
[Service]
|
||||
Type=notify
|
||||
ExecStart=/usr/local/sbin/dockerd
|
||||
ExecReload=/bin/kill -s HUP $MAINPID
|
||||
LimitNOFILE=infinity
|
||||
LimitNPROC=infinity
|
||||
TimeoutStartSec=0
|
||||
Delegate=yes
|
||||
KillMode=process
|
||||
Restart=on-failure
|
||||
StartLimitBurst=3
|
||||
StartLimitInterval=60s
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
docker save
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker run -d \
|
||||
--name haproxy \
|
||||
-p 80:80 \
|
||||
-p 443:443 \
|
||||
-p 3306:3306 \
|
||||
-v ./config/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro \
|
||||
haproxy:3.0.6
|
||||
|
||||
```
|
||||
|
||||
|
||||
gzii-db-2:
|
||||
lookbusy:
|
||||
```
|
||||
#!/bin/bash
|
||||
/usr/local/bin/lookbusy -c 10-30 --cpu-mode curve --cpu-curve-period 60m --cpu-curve-peak 30m cpu &
|
||||
```
|
||||
|
||||
disk:
|
||||
```
|
||||
fallocate -l 240G /opt/tmp/data.zip
|
||||
```
|
||||
|
||||
|
||||
sql timeout
|
||||
|
||||
|
||||
### Steps:
|
||||
|
||||
1. **Create a new rule for `jmwrapid`**:
|
||||
|
||||
```sql
|
||||
INSERT INTO mysql_query_rules (active, username, match_pattern, replace_pattern, timeout, flagIN, destination_hostgroup)
|
||||
VALUES (1, 'jmwrapid', '.*', 'SET SESSION max_execution_time=30000;', 0, 0, 10);
|
||||
```
|
||||
|
||||
This rule sets a maximum execution time of 30 seconds (30000 milliseconds) for all queries executed by the `jmwrapid` user.
|
||||
|
||||
2. **Load the rule into runtime and save it**:
|
||||
|
||||
```sql
|
||||
LOAD MYSQL QUERY RULES TO RUNTIME;
|
||||
SAVE MYSQL QUERY RULES TO DISK;
|
||||
```
|
||||
|
||||
3. **Verify the rule**:
|
||||
|
||||
```sql
|
||||
SELECT * FROM mysql_query_rules WHERE username = 'jmwrapid';
|
||||
```
|
||||
|
||||
|
||||
This will apply the SQL timeout specifically for `jmwrapid`. Let me know if you need more adjustments!
|
||||
|
||||
```sql
|
||||
UPDATE mysql_query_rules
|
||||
SET timeout = 60
|
||||
WHERE username = 'jmwrapid' AND match_pattern = '.*';
|
||||
|
||||
|
||||
```
|
||||
|
||||
|
||||
```sql
|
||||
INSERT INTO mysql_query_rules (active, username, match_pattern, timeout, flagIN, destination_hostgroup)
|
||||
VALUES (1, 'jmwrapid', '.*', 60, 0, 10);
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
To update a Docker container's timezone, you can follow these steps:
|
||||
|
||||
---
|
||||
|
||||
### **1. Update Timezone in a Running Container**
|
||||
If the container is already running, you can change the timezone by:
|
||||
|
||||
#### **a. Using `exec` to set the timezone**
|
||||
Run the following command to set the timezone in the container:
|
||||
```bash
|
||||
docker exec -it <container_name> ln -sf /usr/share/zoneinfo/<Region>/<City> /etc/localtime
|
||||
```
|
||||
For example, to set the timezone to `America/New_York`:
|
||||
```bash
|
||||
docker exec -it <container_name> ln -sf /usr/share/zoneinfo/America/New_York /etc/localtime
|
||||
```
|
||||
|
||||
#### **b. Set the timezone environment variable**
|
||||
You can also set the `TZ` environment variable in the container:
|
||||
```bash
|
||||
docker exec -it <container_name> sh -c "echo 'America/New_York' > /etc/timezone && dpkg-reconfigure -f noninteractive tzdata"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **2. Set Timezone at Container Creation**
|
||||
To ensure the correct timezone is set when you start a container, you can configure the timezone during container creation.
|
||||
|
||||
#### **a. Add a `TZ` environment variable**
|
||||
Use the `-e` flag to set the `TZ` environment variable:
|
||||
```bash
|
||||
docker run -e TZ=America/New_York -d <image_name>
|
||||
```
|
||||
|
||||
#### **b. Mount the `/etc/localtime` file**
|
||||
You can mount the host system's timezone file into the container:
|
||||
```bash
|
||||
docker run -v /etc/localtime:/etc/localtime:ro -v /etc/timezone:/etc/timezone:ro -d <image_name>
|
||||
```
|
||||
|
||||
This ensures the container uses the same timezone as the host system.
|
||||
|
||||
---
|
||||
|
||||
### **3. Update Dockerfile for Persistent Changes**
|
||||
If you want all containers created from a specific image to have a pre-configured timezone, you can modify the `Dockerfile`:
|
||||
|
||||
```dockerfile
|
||||
FROM <base_image>
|
||||
ENV TZ=America/New_York
|
||||
RUN ln -sf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
|
||||
```
|
||||
|
||||
Then rebuild the image:
|
||||
```bash
|
||||
docker build -t <new_image_name> .
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **4. Verify the Timezone**
|
||||
You can verify the timezone in the container by checking the current date and time:
|
||||
```bash
|
||||
docker exec -it <container_name> date
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Summary:
|
||||
- Use `docker exec` to update the timezone in a running container.
|
||||
- Configure the timezone at container creation using `-e TZ` or mounting `/etc/localtime`.
|
||||
- Modify the `Dockerfile` for persistent timezone settings.
|
||||
|
||||
Let me know if you need further clarification!
|
||||
|
||||
|
||||
```
|
||||
docker exec --user root -it proxysql ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
|
||||
```
|
||||
|
||||
```
|
||||
echo 'Asia/Shanghai' > /etc/timezone && dpkg-reconfigure -f noninteractive tzdata
|
||||
```
|
||||
|
||||
```
|
||||
docker exec -it proxysql mysql -h 127.0.0.1 -u admin -padmin -P6032 -e "SET GLOBAL time_zone = 'Asia/Shanghai';"
|
||||
|
||||
```
|
||||
```
|
||||
docker exec -it gzii-db-3 mysql -u root -h 127.0.0.1 -pwc97fjvDg:Ywgyad mysql -e "SET GLOBAL time_zone = 'Asia/Shanghai';"
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker cp /usr/share/zoneinfo/Asia/Shanghai gzii-db-3:/usr/share/zoneinfo/Asia/Shanghai
|
||||
docker exec -it -u root gzii-db-3 sh -c "echo 'Asia/Shanghai' > /etc/timezone"
|
||||
docker exec -u root gzii-db-3 ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
|
||||
```
|
||||
|
||||
```
|
||||
docker cp /usr/share/zoneinfo/Asia/Shanghai gzii-db-4:/usr/share/zoneinfo/Asia/Shanghai
|
||||
docker exec -it -u root gzii-db-4 sh -c "echo 'Asia/Shanghai' > /etc/timezone"
|
||||
docker exec -u root gzii-db-4 ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
|
||||
```
|
||||
|
||||
|
||||
|
||||
17:
|
||||
|
||||
cpu 内存:
|
||||
|
||||
```
|
||||
/usr/local/bin/lookbusy -c 10-70 --cpu-mode curve --cpu-curve-period 60m --cpu-curve-peak 30m cpu -m 19GB -M 3000 &
|
||||
```
|
||||
|
||||
|
||||
auth 失败处理
|
||||
|
||||
```
|
||||
docker run -d \
|
||||
--name etcd \
|
||||
--net host \
|
||||
-v /usr/share/ca-certificates/:/etc/ssl/certs \
|
||||
-v /opt/etcd/data:/etcd-data \
|
||||
quay.io/coreos/etcd:v3.4.35 \
|
||||
/usr/local/bin/etcd \
|
||||
--enable-v2=true \
|
||||
--name etcd0 \
|
||||
--data-dir /etcd-data \
|
||||
--listen-client-urls http://0.0.0.0:2379,http://0.0.0.0:4001 \
|
||||
--advertise-client-urls http://10.194.64.102:2379,http://10.194.64.102:4001 \
|
||||
--listen-peer-urls http://0.0.0.0:2380 \
|
||||
--initial-advertise-peer-urls http://10.194.64.102:2380 \
|
||||
--initial-cluster-token etcd-cluster-1 \
|
||||
--initial-cluster etcd0=http://10.194.64.102:2380 \
|
||||
--initial-cluster-state new
|
||||
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker exec -e ETCDCTL_API=3 etcd etcdctl --endpoints=http://127.0.0.1:2379 endpoint health
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
docker exec -e ETCDCTL_API=3 etcd etcdctl user add root --new-user-password="IeGheikae.Woo5ph"
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker exec etcd etcdctl --endpoints=http://gzii-db-3:2379 role add root
|
||||
|
||||
docker exec etcd etcdctl --endpoints=http://gzii-db-3:2379 role grant-permission root --prefix=true readwrite /
|
||||
|
||||
docker exec etcd etcdctl --endpoints=http://gzii-db-3:2379 user grant-role root root
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker exec etcd etcdctl --endpoints=http://gzii-db-3:2379 auth enable
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker exec -e ETCDCTL_API=3 etcd etcdctl --user=root:IeGheikae.Woo5ph member list
|
||||
```
|
||||
|
||||
|
||||
安装探测器：
|
||||
|
||||
```
|
||||
curl -k https://10.207.33.1:9000/up-install/up-install.sh | bash -x
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
traceroute -T -p 9000 10.207.33.1
|
||||
```
|
||||
|
||||
backup etcd
|
||||
```
|
||||
docker exec etcd etcdctl \
|
||||
--endpoints=http://10.194.64.102:2379 \
|
||||
--user=root:IeGheikae.Woo5ph \
|
||||
snapshot save /etcd-data/backup-$(date +%Y%m%d-%H%M%S).db
|
||||
|
||||
```
|
||||
|
||||
|
||||
Reference in New Issue
Block a user