Ajustando o Linux para Asterisk
Autor: Alexandre Cavalcante Alencar | Publicado: 2013-03-01T14:09:00-03:00


O Asterisk, assim como qualquer outro processo no Linux (e basicamente em qualquer Unix/Unix-like) estará limitado pelas definições de limites do sistema hospedeiro, sejam elas de nível global ou de usuário.


Um dado usuário, que para este artigo será asterisk, terá alguns limites definidos de forma global ao sistema (seja via builtin, seja via /etc/security/limits.conf, seja via /etc/sysctl.conf). Cabe ao proponente a administrador ou especialista conhecer estes limites e ajustá-los de acordo com a necessidade do sistema em questão.


Exemplo em um sistema Debian 6.0.7 sem tunning:



$ id asterisk


uid=111(asterisk) gid=116(asterisk) groups=20(dialout),29(audio),116(asterisk)




File Descriptors in Kernel Memory

$ /sbin/sysctl fs.file-nr

fs.file-nr = 1664 &nbsp; &nbsp; &nbsp; 0 &nbsp; &nbsp; &nbsp; 1646085 (alocados/pré-alocação/máximo)



Max Files

$ /sbin/syscrl fs.file-max

fs.file-max = 1646085



$ ulimit -Ha (hard limits)


core file size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(blocks, -c) unlimited

data seg size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (kbytes, -d) unlimited

scheduling priority &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (-e) 0

file size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (blocks, -f) unlimited

pending signals &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (-i) 16382

max locked memory &nbsp; &nbsp; &nbsp; (kbytes, -l) 64

max memory size &nbsp; &nbsp; &nbsp; &nbsp; (kbytes, -m) unlimited

open files &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(-n) 1024<!------><!------><!------>

pipe size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(512 bytes, -p) 8

POSIX message queues &nbsp; &nbsp; (bytes, -q) 819200

real-time priority &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(-r) 0

stack size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(kbytes, -s) unlimited

cpu time &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (seconds, -t) unlimited

max user processes &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(-u) unlimited

virtual memory &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(kbytes, -v) unlimited

file locks &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(-x) unlimited



O limite em open files é baixo para um sistema que planeja processar muitas chamadas, e deve ser ajustado.


$ ulimit -Sa (soft limits)

core file size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(blocks, -c) 0


data seg size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (kbytes, -d) unlimited

scheduling priority &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (-e) 0

file size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (blocks, -f) unlimited

pending signals &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (-i) 16382

max locked memory &nbsp; &nbsp; &nbsp; (kbytes, -l) 64

max memory size &nbsp; &nbsp; &nbsp; &nbsp; (kbytes, -m) unlimited

open files &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(-n) 1024<!------><!------><!------>

pipe size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(512 bytes, -p) 8

POSIX message queues &nbsp; &nbsp; (bytes, -q) 819200

real-time priority &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(-r) 0

stack size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(kbytes, -s) 8192

cpu time &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (seconds, -t) unlimited

max user processes &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(-u) unlimited

virtual memory &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(kbytes, -v) unlimited

file locks &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(-x) unlimited



O soft limite está igual ao hard limit para open files.&nbsp;Será que posso digitar o comando que me foi indicado como a solução dos meus problemas?



$ ulimit -n 32768

-bash: ulimit: open files: cannot modify limit: Operation not permitted



Não! Olhe no ulimit -Hn que você verá que o limite máximo está igual ao soft limit.&nbsp;O administrador de sistemas/especialista pode editar o /etc/security/limits.conf e acrescentar duas linhas que irão elevar os limites para o usuário em questão:




asterisk &nbsp; &nbsp; &nbsp; &nbsp;soft &nbsp; &nbsp;nofile &nbsp;1024

asterisk &nbsp; &nbsp; &nbsp; &nbsp;hard &nbsp; &nbsp;nofile &nbsp;32768




No Debian, é necessário editar o arquivo /etc/pam.d/common-session e&nbsp;/etc/pam.d/common-session-noninteractive e adicionar a linha abaixo, para que sejam carregados para o usuário quando este iniciar uma sessão no sistema (seja ela interativa ou não)



session required pam_limits.so



Iniciando uma nova sessão com o usuário asterisk, estes serão os resultados:




$ ulimit -Ha (hard limit, só o sys-admin muda)

core file size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(blocks, -c) unlimited

data seg size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (kbytes, -d) unlimited

scheduling priority &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (-e) 0

file size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (blocks, -f) unlimited

pending signals &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (-i) 16382

max locked memory &nbsp; &nbsp; &nbsp; (kbytes, -l) 64

max memory size &nbsp; &nbsp; &nbsp; &nbsp; (kbytes, -m) unlimited

open files &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(-n) 32768<!------><!------><!------><!------>

pipe size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(512 bytes, -p) 8

POSIX message queues &nbsp; &nbsp; (bytes, -q) 819200

real-time priority &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(-r) 0

stack size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(kbytes, -s) unlimited

cpu time &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (seconds, -t) unlimited

max user processes &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(-u) unlimited

virtual memory &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(kbytes, -v) unlimited

file locks &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(-x) unlimited


Veja que o limite a nível global agora é maior, mas como está o limite do usuário?


$ ulimit -Sa (soft limit, o próprio user muda)

core file size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(blocks, -c) 0

data seg size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (kbytes, -d) unlimited

scheduling priority &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (-e) 0

file size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (blocks, -f) unlimited

pending signals &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (-i) 16382

max locked memory &nbsp; &nbsp; &nbsp; (kbytes, -l) 64

max memory size &nbsp; &nbsp; &nbsp; &nbsp; (kbytes, -m) unlimited

open files &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(-n) 1024<!------><!------><!------><!------>

pipe size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(512 bytes, -p) 8

POSIX message queues &nbsp; &nbsp; (bytes, -q) 819200

real-time priority &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(-r) 0

stack size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(kbytes, -s) 8192

cpu time &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (seconds, -t) unlimited

max user processes &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(-u) unlimited

virtual memory &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(kbytes, -v) unlimited

file locks &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(-x) unlimited



Não atende às necessidades ainda, será que agora é possível alterar?


$ ulimit -n 10240


Sim! Pois o limite global foi alterado e o usuário pode mudar até aquele máximo global. Vamos ver como ficou:


$ ulimit -Sa



core file size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(blocks, -c) 0




data seg size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (kbytes, -d) unlimited




scheduling priority &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (-e) 0



file size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (blocks, -f) unlimited


pending signals &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (-i) 16382

max locked memory &nbsp; &nbsp; &nbsp; (kbytes, -l) 64

max memory size &nbsp; &nbsp; &nbsp; &nbsp; (kbytes, -m) unlimited

open files &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(-n) 10240<!------><!------><!------>

pipe size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(512 bytes, -p) 8

POSIX message queues &nbsp; &nbsp; (bytes, -q) 819200

real-time priority &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(-r) 0

stack size &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(kbytes, -s) 8192

cpu time &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (seconds, -t) unlimited

max user processes &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(-u) unlimited

virtual memory &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(kbytes, -v) unlimited

file locks &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(-x) unlimited
<!------>




Os exemplos acima são apenas algumas áreas que podem ser melhoradas. Vamos fazer algo relativo ao sistema agora, começando por checar o número máximo para fs.file-max:



$ /sbin/sysctl fs.file-max


fs.file-max = 1646085<!------><!------><!------><!------>



E como está o uso? O comando abaixo, retornará a quantidade em uso, a pré-alocada e a máxima, apresentada no comando anterior:


$ /sbin/sysctl fs.file-nr


fs.file-nr = 1568 &nbsp; &nbsp; &nbsp; 0 &nbsp; &nbsp; &nbsp; 1646085<!------><!------><!------><!------>




Experimente aumentar o número máximo de arquivos abertos:



# sysctl -w fs.file-max 



Quando chegar em um valor seguro, aplique editando o /etc/sysctl.conf&nbsp;e alterar/adicionar a linha com fs.file-max



fs.file-max = 



Execute em seguida:



# sysctl -p



E quanto a conexões de rede?



Experimente com a otimização da memória do TCP/IP a ser usada em setsockopt()



net.ipv4.tcp_rmem

net.ipv4.tcp_wmem



Portas para novas conexões:



net.ipv4.ip_local_port_range =  



Aumente os valores de auto-tune em:



net.core.rmem_max

net.core.wmem_max

net.core.netdev_max_backlog

net.ipv4.tcp_window_scaling = 1



Se for ter muitos processos:



kernel.pid_max



Posteriormente, novos pontos de melhoria serão apresentados.