reverse proxy - Varnish: performance impact large ban list -


We were thinking that someone has banned a large quantity of varnish. We consider the ban strategy, which can ban two hundred (smart) bills every night (X million cash objects).

Although I know that it is highly dependent on the environment variable, we were thinking that it has a significant performance effect. The restrictions are quite CPU intensive so that they are careful not to overuse them. If you do, then CPU usage will increase and you will see that regular expression matches in a large amount will be executed in every second.

Normally a restriction will match with each object in memory, so with one million objects each restriction will result in a million ban assessment. It's very like but modern servers are fast and today a modern server is able to match millions of regular expressions in every second. My four-year laptop makes some 15 million Reggae matches, which runs second on one core, only to give you an idea of ​​scale.

Also there is another feature of varnish that comes into play. Restricted restrictions Restriction restriction is a thread that goes to the cash and bans trying to kill an object before being evaluated, thereby reducing the size of the ban list. If your restriction does not use the Rick object, then they are candidates for evaluation by Lukar. If you plan to use some restrictions then you should take care to write your restrictions in a secret favorable fashion. So called "smart restriction", which starts to get familiar with you.

In everyone I think your setup looks sensible. Issuing a few hundred captives with some million objects in the cache might work fine. Of course, deployed and TTFB will increase somewhat, of course, the CPU will be a bit of weight, but I think you will be cured. You want to play with some extent to the parameters, which control control how the ban works, but try the first defaults, they are very sensible.


Comments