ื ืืืืืืื ืคืืจืขืจ ืืื ืืจืืืก ืืืืฃ ืืื ืื ื ืื ืืื ืืงืก ืกืืืืืืข ืฆื ืืขืจืืจืืืื ืืึทืงืกืืืื ืคืึธืจืฉืืขืืื ื ืคึฟืึทืจ ืคึผืจืึทืกืขืกืื ื ืืืืคึผ ืจืืงืืืขืก. ืื ืคืืจืืขืืืืื ืืขืืืึธืืก ืืขืืืื ืขืก ืืขืืืขื ืฆื ืคืึทืจืืจืขืกืขืจื ืื ืคืึธืจืฉืืขืืื ื ืคืื ืื JSON ืคึผืจืึทืกืขืกืขืจ ืืืืืจื ืืืืฃ ืื ืืืืจืขืึทืงืืึธืจ ืืืืืืึธืืขืง ืืื ืืขืจ Amazon EC2 ืกืืืืืืข (4 vCPU) ืคึฟืื 224 ืืืืื ื ืึทืคึผื ืจืืงืืืขืก ืคึผืขืจ ืกืขืงืื ืืข ืืื ื ืึธืจืืึทื ืกืขืืืื ืืก ืคืื Amazon Linux 2 ืืื ืงืขืจื 4.14 ืฆื 1.2 ืืืืืึธื ืจืืงืืืขืก ืคึผืขืจ ืกืขืงืื ืืข. ืจืืข ื ืึธื ืึทืคึผืืึทืืึทืืืืฉืึทื (ืึท ืคืึทืจืืจืขืกืขืจื ืคืื 436%), ืืื ืืืื ืืขืคึฟืืจื ืฆื ืึท ืจืขืืืงืฆืืข ืืื ืืืืืื ืืื ืคึผืจืึทืกืขืกืื ื ืจืืงืืืขืก ืืื 79%. ืื ืคืืจืืขืืืืื ืืขืืืึธืืก ืืขื ืขื ื ืืฉื ืกืคึผืขืฆืืคืืฉ ืคึฟืึทืจ ืืืืขืจืึทืงืืึธืจ ืืื ืึทืจืืขื ืืืขื ื ืืฆื ืื ืืขืจืข ืืืืคึผ ืกืขืจืืืขืจืก, ืึทืจืืึทื ืืขืจืขืื ื nginx, Actix, Netty ืืื Node.js (ืืืืจืขืึทืงืืึธืจ ืืื ืืขื ืืฆื ืืื ืืขืกืฅ ืืืืึทื ืื ืืืืืื ื ืืืืืจื ืืืืฃ ืขืก ืืขืืืืื ืืขืกืขืจ ืคืึธืจืฉืืขืืื ื).
ืืงืขืจืืืง ืึธืคึผืืืืืืึทืืืึธื ืก:
- ืึธืคึผืืืืืืื ื ืืืืขืจืึทืงืืึธืจ ืงืึธื. ืื R18 ืึธืคึผืฆืืข ืคืื โโืื Techempower ืื ืืืขื ืืึทืจ ืืื ืืขื ืืฆื ืืื ืึท ืืงืขืจ, ืืืึธืก ืืื ืืืคึผืจืืืื ืืืจื ืจืืืืืืื ื ืงืึธื ืฆื ืืึทืืจืขื ืขืฆื ืื ื ืืืขืจ ืคืื ืงืคึผื ืงืึธืจืขืก (ืึทืคึผืืึทืืึทืืืืฉืึทื ืขืจืืืืื ืฆื ืคืึทืจืืืืขืจื ืื ืึทืจืืขื ืืื 25-27%), ืึทืกืขืืืึทื ืืื GCC ืืื ืื "-O3" ืึธืคึผืฆืืขืก (ืึท ืคืึทืจืืจืขืกืขืจื ืคืื 5-10%) ืืื "-ืืึทืจืฅ-ืืขืืืืจื" (5-10%), ืจืืคึผืืืืกืื ื ืืืืขื ืขื / ืฉืจืืึทืื ืงืึทืืืก ืืื ืจืขืื / ืฉืืงื (5-10%) ืืื ืจืืืืกืื ื ืึธืืืืขืจืืขื ืืืขื ื ืืฆื ืคึผืืืจืขืึทืืก (2-3%) . ืื ืงืืืืขืืืืง ืคืึธืจืฉืืขืืื ื ืคืึทืจืืจืขืกืขืจื ื ืึธื ืงืึธื ืึทืคึผืืึทืืึทืืืืฉืึทื ืืื ืืขืืืขื 55%, ืืื ืืจืืคึผืื ืืขืืืืงืกื ืคืื 224 ืง ืจืขืง / s ืฆื 347 ืง ืจืขืง / s.
- ืืืกืืืืึทื ืฉืืฅ ืงืขืื ืกืคึผืขืงืืืึทืืืืืข ืืืจืืคืืจืื ื ืืืึทืื ืขืจืึทืืืืืืื. ื ืืฆื ืื ืคึผืึทืจืึทืืขืืขืจืก "nospectre_v1 nospectre_v2 pti=off mds=off tsx_async_abort=off" ืืืขื ืืึธืืืื ื ืื ืงืขืจื ืขืจืืืืื ืฆื ืคืึทืจืืจืขืกืขืจื ืคืึธืจืฉืืขืืื ื ืืื 28%, ืืื ืืจืืคึผืื ืืขืืืืงืกื ืคืื 347 ืง ืจืขืง / s ืฆื 446 ืง ืจืขืง / s. ืกืขืคึผืขืจืึทืืื, ืื ืคืึทืจืืจืขืกืขืจื ืคืื ืื ืคึผืึทืจืึทืืขืืขืจ "ื ืึธืกืคึผืขืงืืจืข_ืื1" (ืฉืืฅ ืคึฟืื ืกืคึผืขืงืืขืจ ืื1 + ืกืืืึทืคึผืก) ืืื ืืขืืืขื 1-2%, "ื ืึธืกืคึผืขืงืืจืข_ืื2" (ืฉืืฅ ืคึฟืื ืกืคึผืขืงืืขืจ ืื2) - 15-20%, "ืคึผืื = ืึทืืืขืง" (ืกืคึผืขืงืืจืข ืื3 / ืืขืืืืึธืืื) - 6%, "mds=off tsx_async_abort=off" (MDS/Zombieload ืืื TSX Asynchronous Abort) - 6%. ืื ืกืขืืืื ืืก ืคึฟืึทืจ ืฉืืฅ ืงืขืื L1TF/Foreshadow (l1tf=flush), iTLB multihit, ืกืคึผืขืงืืืึทืืืืืข ืกืืึธืจ ืืืืคึผืึทืกืก ืืื SRBDS ืื ืคืืื ืืขื ืขื ืืื ืงืก ืึทื ืืฉืืื ืืืฉื, ืืืึธืก ืืื ื ืืฉื ืืืืจืงื ืคืึธืจืฉืืขืืื ื ืืื ื ืืื ืืึธืื ื ืืฉื ืื ืืขืจืกืขืงืืื ืืื ืื ืืขืกืืขื ืงืึทื ืคืืืืขืจืืืฉืึทื (ืืืฉื, ืกืคึผืขืฆืืคืืฉ ืฆื KVM, ื ืขืกืืขื ืืืืจืืืึทืืืืึทืืืึธื ืืื ืื ืืขืจืข ืงืคึผื ืืึธืืขืืก).
- ืืืกืืืืืื ื ืึทืืึทืืื ื ืืื ืกืืกืืขื ืจืืคื ืืืึทืงืื ื ืืขืงืึทื ืืืึทืื ื ืืฆื ืื "auditctl -a never,task" ืืึทืคึฟืขื ืืื ืกืคึผืขืฆืืคืืฆืืจื ืื "--security-opt secomp=unconfined" ืึธืคึผืฆืืข ืืืขื ืกืืึทืจืืื ื ืื ืืึธืงืงืขืจ ืงืึทื ืืืื ืขืจ. ืื ืงืืืืขืืืืง ืคืึธืจืฉืืขืืื ื ืคืึทืจืืจืขืกืขืจื ืืื ืืขืืืขื 11%, ืืื ืืจืืคึผืื ืืขืืืืงืกื ืคืื 446 ืง ืจืขืง / s ืฆื 495 ืง ืจืขืง / s.
- ืืืกืืืืึทื ืืคึผืืึทืืืขืก / ื ืขืืคืืืืขืจ ืืืจื ืึทื ืืึธืืืื ื ืื ืคึฟืึทืจืืื ืื ืงืขืจื ืืึทืืืฉืืื. ืืขืจ ืืขืืึทื ืง ืฆื ืืืกืืืืึทื ืื ืคืืืจืืืึทื, ืืืึธืก ืืื ื ืืฉื ืืขื ืืฆื ืืื ืึท ืกืคึผืขืฆืืคืืฉ ืกืขืจืืืขืจ ืืืืืื ื, ืืื ืืขืืืขื ืคึผืจืึทืืคึผืืื ืืืจื ืคึผืจืึธืคืืืื ื ืจืขืืืืืึทืื, ืืืื ืืฉืคืื ืืืจื ืืืึธืก ืื nf_hook_slow ืคึฟืื ืงืฆืืข ืืขื ืืืขื 18% ืคืื ืื ืฆืืื ืฆื ืืืกืคืืจื. ืขืก ืืื ืืืืขืจืงื ืึทื nftables ืึทืจืืขื ืืขืจ ืืคืืฉืึทื ืืื ืืื ืืคึผืืึทืืืขืก, ืึธืืขืจ ืึทืืึทืืึธื ืืื ืืงืก ืืืื ืฆื ื ืืฆื ืืคึผืืึทืืืขืก. ื ืึธื ืืืกืืืืึทืืื ื ืืคึผืืึทืืืขืก, ืื ืคืึธืจืฉืืขืืื ื ืคืึทืจืืจืขืกืขืจื ืืื ืืขืืืขื 22%, ืืื ืื ืืจืืคึผืื ืืขืืืืงืกื ืคืื 495 ืง ืจืขืง / s ืฆื 603 ืง ืจืขืง / s.
- ืจืืืืกื ืืืืืจืืืฉืึทื ืคืื ืืึทื ืืืขืจืก ืฆืืืืฉื ืคืึทืจืฉืืืขื ืข ืงืคึผื ืงืึธืจืขืก ืฆื ืคึฟืึทืจืืขืกืขืจื ืื ืขืคืขืงืืืืืงืืึทื ืคืื ืคึผืจืึทืกืขืกืขืจ ืงืึทืฉ ื ืืฆื. ืึธืคึผืืืืืืึทืืืึธื ืืื ืืขืืืขื ืืืจืืืขืงืึธืื ืืื ืื ืืืจืื ืคืื ืืืื ืืื ื ืืืืขืจืึทืงืืึธืจ ืคึผืจืึทืกืขืกืึทื ืฆื ืงืคึผื ืงืึธืจืขืก (CPU Pinning) ืืื ืืืจื ืคึผืื ืื ื ืงืขืจื ื ืขืฅ ืืึทื ืืืขืจืก (ืืึทืงืืืขื ืกืืื ืกืงืืืืื ื). ืคึฟืึทืจ ืืืึทืฉืคึผืื, irqbalance ืืื ืคืึทืจืงืจืืคึผืื ืืื ืจืื ืึทืคืื ืืื ืฆื ืื ืงืคึผื ืืื ืืคืืจืืฉ ืืึทืฉืืืื ืืื /proc/irq/$IRQ/smp_affinity_list. ืฆื ื ืืฆื ืื ืืขืืืข ืงืคึผื ืืึทืจืฅ ืฆื ืคึผืจืึธืฆืขืก ืื ืืืืขืจืึทืงืืึธืจ ืคึผืจืึธืฆืขืก ืืื ืื ื ืขืฅ ืจืื ืคืื ืื ืงืึทืืื ื ืคึผืึทืงืืฅ, ืึท ืื ืื BPF ืืึทื ืืืขืจ ืืื ืืขื ืืฆื, ืคืืจืืื ืื ืืืจื ืืึทืฉืืขืืืงื ืื SO_ATTACH_REUSEPORT_CBPF ืคืึธื ืืืขื ืงืจืืืืืื ื ืื ืืึธืืขื. ืฆื ืืื ืื ืงืืื ืคืื ืึทืืืืึธืืื ื ืคึผืึทืงืืฅ ืฆื ืื ืงืคึผื, ืื ืกืขืืืื ืืก /sys/class/net/eth0/queues/tx- ืืึธืื ืฉืืื ืืขืืืื /xps_cpus. ืื ืงืืืืขืืืืง ืคืึธืจืฉืืขืืื ื ืคืึทืจืืจืขืกืขืจื ืืื ืืขืืืขื 38%, ืืื ืืจืืคึผืื ืืขืืืืงืกื ืคืื 603 ืง ืจืขืง / s ืฆื 834 ืง ืจืขืง / s.
- ืึธืคึผืืืืืืึทืืืึธื ืคืื ืืืขืจืจืืึทืกื ืืึทื ืืืื ื ืืื ื ืืฆื ืคืื ืคึผืึธืืืื ื. ืขื ืืืืึทืืื ื ืื ืึทืืึทืคึผืืืื-ืจืงืก ืืึธืืข ืืื ืื ENA ืฉืึธืคืขืจ ืืื ืืึทื ืืคึผืืึทืืืืืื ื sysctl net.core.busy_read ืืขืืืืงืกื ืคืึธืจืฉืืขืืื ื ืืื 28% (ืืืจืืงืืื ืืขืืืืงืกื ืคืื 834 ืง ืจืขืง / s ืฆื 1.06 ื ืจืขืง / s, ืืื ืืืืืึทื ืกื ืืืงืจืืกื ืคืื 361ฮผs ืฆื 292ฮผs).
- ืืืกืืืืึทืืื ื ืกืืกืืขื ืืึทืืื ืื ืืก ืืืึธืก ืคืืจื ืฆื ืืื ืืืืืง ืืืึทืงืื ื ืืื ืื ื ืขืฅ ืึธื ืืืืื. ืืืกืืืืึทืืื ื dhclient ืืื ืืึทื ืืืึทืื ืืึทืฉืืขืืืงื ืื IP ืึทืืจืขืก ืจืืืึทืืืื ืืื ืึท 6% ืคืึธืจืฉืืขืืื ื ืคืึทืจืืจืขืกืขืจื ืืื ืืจืืคึผืื ืืขืืืืงืกื ืคืื 1.06M ืจืขืง / s ืฆื 1.12M ืจืขืง / s. ืื ืกืืื ืืืึธืก dhclient ืึทืคืขืงืฅ ืคืึธืจืฉืืขืืื ื ืืื ืืื ืคืึทืจืงืขืจ ืึทื ืึทืืืกืืก ื ืืฆื ืึท ืจืื ืืึธืืขื.
- ืคืืืืื ื ืกืคึผืื ืืึทืง. ืืึทืฉืืืืขื ืื ื ืขืฅ ืึธื ืืืืื ืฆื "ื ืึธืงืืืขื" ืืึธืืข ืืืจื ืกืืกืงืื "net.core.default_qdisc=noqueue" ืืื "tc qdisc replace dev eth0 root mq" ืืขืคืืจื ืฆื ืึท 2% ืคืึธืจืฉืืขืืื ื ืคืึทืจืืจืขืกืขืจื, ืืื ืืจืืคึผืื ืืขืืืืงืกื ืคืื 1.12M ืจืขืง / s ืฆื 1.15M ืจืขืง / s.
- ืืขืฆืืข ืืื ืขืจืืืขืจืืืง ืึทืคึผืืึทืืึทืืืืฉืึทื ื, ืึทืืึท ืืื ืืืกืืืืึทื GRO (ืืขื ืขืจืืง ืืึทืงืืืขื ืึธืคืืึธืึทื) ืืื ืื ืืึทืคึฟืขื "ethtool -K eth0 gro off" ืืื ืจืืคึผืืืืกืื ื ืื ืงืืืืง ืงืึทื ืืืฉืขืกืืฉืึทื ืงืึธื ืืจืึธื ืึทืืืขืจืืืึทื ืืื ืจืขื ืึธ ื ืืฆื sysctl "net.ipv4.tcp_congestion_control=reno". ืื ืงืืืืขืืืืง ืคึผืจืึธืืืึทืงืืืืืืื ืคืึทืจืืจืขืกืขืจื ืืื ืืขืืืขื 4%. ืื ืืจืืคึผืื ืืขืืืืงืกื ืคืื 1.15M ืจืขืง / s ืฆื 1.2M ืจืขืง / s.
ืืื ืึทืืืฉืึทื ืฆื ืื ืึทืคึผืืึทืืึทืืืืฉืึทื ื ืืืึธืก ืืขืืจืืขื, ืืขืจ ืึทืจืืืงื ืืืื ืืืกืงืืืืจื ืืขืืืึธืืก ืืืึธืก ืืึธืื ื ืืฉื ืืขืคึฟืืจื ืฆื ืืขืจ ืืขืจืืืึทืจื ืคืึธืจืฉืืขืืื ื ืคืึทืจืืจืขืกืขืจื. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืื ืคืืืืขื ืืข ืืื ืืขืืืขื ืื ืืคืขืงืืืื:
- ืคืืืกื ืืืง ืืืืขืจืึทืงืืึธืจ ืกืขืคึผืขืจืึทืืื ืืื ื ืืฉื ืึทื ืืขืจืฉ ืืื ืคืึธืจืฉืืขืืื ื ืคืื ืคืืืกื ืืืง ืขืก ืืื ืึท ืงืึทื ืืืื ืขืจ. ืจืืคึผืืืืกืื ื Writev ืืื ืฉืืงื, ืื ืงืจืืกืื ื ืืึทืงืกืืืื ืืขืฉืขืขื ืืฉื ืืื epoll_wait ืืื ืขืงืกืคึผืขืจืืืขื ืืื ื ืืื GCC ืืืขืจืกืืขืก ืืื ืคืืึทืืก ืืื ืงืืื ืืืืจืงืื ื (ืื ืืืืจืงืื ื ืืื ืืืืขืจืงื ืืืืื ืคึฟืึทืจ ืื "-O3" ืืื "-ืืึทืจืฅ-ืืขืืืืจื" ืคืืึทืืก).
- ืึทืคึผืืจืืืืื ื ืื ืืื ืืงืก ืงืขืจื ืฆื ืืืขืจืกืืขืก 4.19 ืืื 5.4, ื ืืฆื ืื SCHED_FIFO ืืื SCHED_RR ืกืงืขืืืฉืืืขืจื, ืืึทื ืืคึผืืึทืืืืืื ื sysctl kernel.sched_min_granularity_ns, kernel.sched_wakeup_granularity_ns, transparent_hugepages=never, skew_tick=1 and clock has notsource affected performance.
- ืืื ืื ENA ืฉืึธืคืขืจ, ืืขืื ืึธืคืืึธืึทื ืืึธืืขืก (ืกืขืืืขื ืืึทืืืึธื, ืฆืขืืืึธืจืคื-ืงืืืึทืื, ืจืงืก / ืืงืก ืืฉืขืงืงืกืื), ืื ืื ืืื ืื "-O3" ืคืึธื, ืืื ื ืืฆื ืื ืคึผืึทืจืึทืืขืืขืจืก ena.rx_queue_size ืืื ena.force_large_llq_header ืืื ืงืืื ืืืืจืงืื ื.
- ืขื ืืขืจืื ืืขื ืืื ืื ื ืขืฅ ืึธื ืืืืื ืืึธืื ื ืืฉื ืคึฟืึทืจืืขืกืขืจื ืคืึธืจืฉืืขืืื ื:
- ืืืกืืืืึทื IPv6: ipv6.disable=1
- ืืืกืืืืึทื ืืืืึทื: modprobe -rv 8021q
- ืืืกืืืืึทื ืคึผืขืงื ืืงืืจ ืงืึธื ืืจืึธืืืจืื ื
- net.ipv4.conf.all.rp_filter=0
- net.ipv4.conf.eth0.rp_filter=0
- net.ipv4.conf.all.accept_local=1 (ื ืขืืึทืืืื ืืืืจืงืื ื)
- net.ipv4.tcp_sack = 0
- net.ipv4.tcp_dsack=0
- net.ipv4.tcp_mem/tcp_wmem/tcp_rmem
- net.core.netdev_budget
- net.core.dev_weight
- net.core.netdev_max_backlog
- net.ipv4.tcp_slow_start_after_idle=0
- net.ipv4.tcp_moderate_rcvbuf=0
- net.ipv4.tcp_timestamps=0
- net.ipv4.tcp_low_latency = 1
- SO_PRIORITY
- TCP_NODELAY
ืืงืืจ: opennet.ru