3

I started noticing very slow page loads on my Jira server. I figured out that this only happens when Jira is accessed through nginx, but if I use SSH port forwarding to the server and access the backend ports directly, page loads are instantaneous.

nginx config (/etc/nginx/sites-enabled/support.example.org.conf):

## Jira
##
## Modified from nginx http version
## Modified from https://confluence.atlassian.com/jirakb/integrating-jira-with-nginx-426115340.html
## Modified from https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
##

server {
  listen 192.168.118.32:443 ssl;
  server_name support.example.org;
  server_tokens off;

  ## Strong SSL Security
  ## https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html & https://cipherli.st/
  ssl on;
  ssl_certificate     /etc/letsencrypt/live/support.example.org/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/support.example.org/privkey.pem;

  ssl_protocols TLSv1.2;
  ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
  ssl_prefer_server_ciphers on;
  ssl_session_cache shared:SSL:10m;
  ssl_session_tickets off;
  ssl_session_timeout 1d;


  access_log  /var/log/nginx/support_access.log;
  error_log   /var/log/nginx/support_error.log;

  location /jira {
    gzip off;

    proxy_read_timeout      300;
    proxy_connect_timeout   300;
    # proxy_redirect          off;
    proxy_request_buffering off;
    proxy_buffering         off;

    proxy_set_header    X-Forwarded-Host    $host;
    proxy_set_header    X-Real-IP           $remote_addr;
    proxy_set_header    X-Forwarded-Ssl     on;
    proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
    proxy_set_header    X-Forwarded-Proto   $scheme;
    proxy_pass http://localhost:8081/jira;

    client_max_body_size 2G;
  }


  include snippets/letsencrypt.conf;
}

Some of the proxy settings are things I tried already and they ranged from minor improvements to no improvements, but the performance is still abysmal.

Jira config: (/opt/atlassian/jira/conf/server.xml)

<?xml version="1.0" encoding="utf-8"?>
<Server port="8005" shutdown="SHUTDOWN">
    <Listener className="org.apache.catalina.startup.VersionLoggerListener"/>
    <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on"/>
    <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener"/>
    <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener"/>
    <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener"/>

    <Service name="Catalina">
        <!--
         ==============================================================================================================
         HTTPS - Proxying Jira via Apache or Nginx over HTTPS

         If you're proxying traffic to Jira over HTTPS, uncomment the below connector and comment out the others.
         Ensure the proxyName and proxyPort are updated with the appropriate information if necessary as per the docs.

         See the following for more information:

            Apache - https://confluence.atlassian.com/x/PTT3MQ
            nginx  - https://confluence.atlassian.com/x/DAFmGQ
         ==============================================================================================================
        -->

        <Connector port="8081" relaxedPathChars="[]|" relaxedQueryChars="[]|{}^&#x5c;&#x60;&quot;&lt;&gt;"
                   maxThreads="150" minSpareThreads="25" connectionTimeout="20000" enableLookups="false"
                   maxHttpHeaderSize="8192" protocol="HTTP/1.1" useBodyEncodingForURI="true" redirectPort="8443"
                   acceptCount="100" disableUploadTimeout="true" bindOnInit="false" secure="true" scheme="https"
                   proxyName="support.example.org" proxyPort="443"/>

        <Engine name="Catalina" defaultHost="localhost">
            <Host name="localhost" appBase="webapps" unpackWARs="true" autoDeploy="true">

                <Context path="/jira" docBase="${catalina.home}/atlassian-jira" reloadable="false" useHttpOnly="true">
                    <Resource name="UserTransaction" auth="Container" type="javax.transaction.UserTransaction"
                              factory="org.objectweb.jotm.UserTransactionFactory" jotm.timeout="60"/>
                    <Manager pathname=""/>
                    <JarScanner scanManifest="false"/>
                    <Valve className="org.apache.catalina.valves.StuckThreadDetectionValve" threshold="120" />
                </Context>

            </Host>
            <Valve className="org.apache.catalina.valves.AccessLogValve"
                   pattern="%a %{jira.request.id}r %{jira.request.username}r %t &quot;%m %U%q %H&quot; %s %b %D &quot;%{Referer}i&quot; &quot;%{User-Agent}i&quot; &quot;%{jira.request.assession.id}r&quot;"/>
        </Engine>
    </Service>
</Server>

When I test directly, I enable the default connector:

<Connector port="8080" relaxedPathChars="[]|" relaxedQueryChars="[]|{}^&#x5c;&#x60;&quot;&lt;&gt;"
                   maxThreads="150" minSpareThreads="25" connectionTimeout="20000" enableLookups="false"
                   maxHttpHeaderSize="8192" protocol="HTTP/1.1" useBodyEncodingForURI="true" redirectPort="8443"
                   acceptCount="100" disableUploadTimeout="true" bindOnInit="false"/>

What am I doing wrong or how can I improve the performance?

8
  • What do you mean by "very slow"? Jun 19, 2020 at 2:09
  • To clarify, do you use a different connector when testing? Can you point nginx at the connector that you use for testing and see if that improves speed (i.e. point nginx at port 8080)? Alternatively, can you use the connector you actually use for nginx when you tunnel in (i.e. try accessing Jira on port 8081 instead of 8080)? Just trying to eliminate that variable... I noticed your nginx production backend (on port 8081) uses HTTPS, while your test backend (on port 8080) doesn't... maybe that's the issue?
    – Rouben
    Jun 19, 2020 at 4:19
  • @MichaelHampton Page load times measurable in tens of seconds to hundreds of seconds.
    – yakatz
    Jun 19, 2020 at 6:10
  • @Rouben It doesn't seem to matter which connector I use - although not all of the possible options produce usable configurations, I have tested as many as I can and I get the same results. - slow through nginx.
    – yakatz
    Jun 19, 2020 at 6:23
  • 1
    It seems like this is a common issue and has to do with the way Tomcat and nginx handle TCP connections. @yakatz maybe trying the HTTP11Apr connector? The symptoms described here seem relevant: forum.nginx.org/read.php?2,5540,5606
    – Rouben
    Jun 19, 2020 at 7:10

2 Answers 2

0

Your nginx config looks okay, but why you disable gzip?

Make sure your gzip compression from the JIRA -> 'Administration' -> 'Global Settings' -> 'General configuration' is set to 'on'. Then remove the config line from nginx vhost:

gzip off;

and add e.g. this sample config:

gzip on;
gzip_disable "msie6";
gzip_comp_level 6;
gzip_buffers 16 8k;
gzip_http_version 1.1;
gzip_types application/javascript application/rss+xml application/vnd.ms-fontobject application/x-font application/x-font-opentype application/x-font-otf application/x-font-truetype application/x-font-ttf application/x-javascript application/xhtml+xml application/xml font/opentype font/otf font/ttf image/svg+xml image/x-icon text/css text/javascript text/plain text/xml;
1
  • The performance is worse when gzip is on.
    – yakatz
    Jun 19, 2020 at 17:01
0

Switching to Apache HTTPD and mod_proxy_ajp following a different page in Jira's documentation seems to fix the issue. A comment on the question suggests this is a flaw in nginx.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .