Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What is a possible scenario for exhausting the memory designated to a connection zone with limit_conn_zone directive and what are the implication in this case?

Suppose I have this in my configuration:

http {
  limit_conn_zone $binary_remote_addr zone=connzone:1m;
  ...
  server {
    limit_conn connzone 5;

which, according to the documentation, allocates 16000 states for connzone on a 64-bit server. It also says that

If the storage for a zone is exhausted, the server will return error 503 (Service Temporarily Unavailable) to all further requests.

Well, Ok. But what does it mean on practice? When does this happen? Who receives those 503s? Does it mean that if the number of IPs somehow associated with connzone hits 16000 everyone gets a 503 and it's all over? How does Nginx decide? The documentation is weirdly vague on this.

So, considering the example config, who would actually get a 503 and under which circumstances and how would things go from there? Same with request zones?

share|improve this question
add comment

1 Answer 1

up vote 1 down vote accepted

Practice? You can control the total amount of IPs connected to the server.

When? Well, if the zone is full.

Who? Yes, everybody who isn't already within the zone and as long as the zone is full.

If you're on a 64 bit system and set the zone to 1M, nginx can store up to 16,000 IPs. This means if 16,001 IPs have to be stored that +1 user will receive the first 503 error. The decision is pretty easy, if the B-tree is full, reject.

You can find out the exact implementation by reading the source code of the module: https://github.com/git-mirror/nginx/blob/master/src/http/modules/ngx_http_limit_conn_module.c

Request zones works pretty similar.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.