Nginx中高并发崩溃的7大核心原因排查与解决方案

# 查看 nginx 主进程 PID
ps aux | grep "nginx: master" | grep -v grep

# 查看其所有 worker 进程的 FD 使用量（假设主进程 PID=12345）
ls -l /proc/12345/fd/ | wc -l   # 主进程自身 FD（通常 < 10）
ls -l /proc/$(pgrep -P 12345)/fd/ | wc -l  # 任一 worker 进程 FD 数

# 查看系统级限制
cat /proc/sys/fs/file-max
ulimit -n

# nginx.conf 全局块
user  nginx;
worker_processes  auto;  # 自动匹配 CPU 核心数，避免过多 worker 争抢 FD
worker_rlimit_nofile  65535;  # ⚠️ 此值必须 ≤ 系统 ulimit -n，且需配合 systemd 设置

# events 块
events {
    use epoll;           # Linux 必选
    worker_connections  16384;  # 单 worker 最大连接数，≤ worker_rlimit_nofile/2（预留 upstream FD）
    multi_accept on;    # 一次 accept 多个连接，降低 syscall 开销
}

# http 块内，针对 upstream 优化
upstream backend_java {
    server 10.0.1.10:8080 max_fails=3 fail_timeout=30s;
    server 10.0.1.11:8080 max_fails=3 fail_timeout=30s;
    
    # 🔑 关键：强制 HTTP/1.1 + 连接复用，大幅减少 upstream FD
    keepalive 32;  # 每个 worker 与 upstream 保持最多 32 个空闲连接
}

server {
    listen 80;
    location /api/ {
        proxy_pass http://backend_java;
        
        # 强制使用 HTTP/1.1 并复用连接
        proxy_http_version 1.1;
        proxy_set_header Connection '';  # 清除 Connection header，允许复用
        
        # 设置超时，避免连接长期挂起
        proxy_connect_timeout 5s;
        proxy_send_timeout 10s;
        proxy_read_timeout 10s;
        
        # 启用缓冲，减少对 upstream 的即时压力
        proxy_buffering on;
        proxy_buffer_size 4k;
        proxy_buffers 8 4k;
        proxy_busy_buffers_size 8k;
    }
}

[Service]
LimitNOFILE=65535
LimitCORE=infinity
TasksMax=infinity
# 防止 OOM Killer 误杀
OOMScoreAdjust=-100

http {
    # ✅ 启用 OpenSSL 硬件加速（需 CPU 支持 AES-NI, RDRAND）
    ssl_engine rdrand;  # Linux 5.4+ 内核自动启用
    
    # ✅ 强制 TLS 1.3（更快握手，0-RTT 可选）
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    
    # ✅ 会话复用：服务端缓存 Session ID / Session Ticket
    ssl_session_cache shared:SSL:10m;  # 10MB 共享缓存，约 40,000 个会话
    ssl_session_timeout 4h;
    ssl_session_tickets on;
    ssl_session_ticket_key /etc/nginx/ssl/ticket.key;  # 32字节随机密钥
    
    # ✅ OCSP Stapling（减少客户端证书验证延迟）
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 1.1.1.1 valid=300s;
    resolver_timeout 5s;
    
    server {
        listen 443 ssl http2;  # 启用 HTTP/2，多路复用降低连接数
        ssl_certificate /etc/nginx/ssl/fullchain.pem;
        ssl_certificate_key /etc/nginx/ssl/privkey.pem;
        
        # ✅ 启用 TLS 1.3 0-RTT（谨慎！仅幂等接口）
        ssl_early_data on;
        # 在 location 中控制 0-RTT（需应用层防重放）
        location /api/v1/order {
            if ($ssl_early_data = "1") {
                return 425; # Too Early，强制重试（Java 侧需处理）
            }
            proxy_pass http://backend_java;
        }
    }
}

@RestController
@RequestMapping("/api/v1/order")
public class OrderController {
    // 使用 Redis 实现简单防重放（生产需分布式锁 + 时间窗口）
    @Autowired
    private StringRedisTemplate redisTemplate;
    @PostMapping
    public ResponseEntity<OrderResult> createOrder(@RequestBody OrderRequest request,
                                                   HttpServletRequest httpRequest) {
        // 检查是否来自 TLS 0-RTT（Nginx 透传 $ssl_early_data）
        String earlyDataHeader = httpRequest.getHeader("X-Ssl-Early-Data");
        if ("1".equals(earlyDataHeader)) {
            // 生成业务唯一 ID（如订单号前缀 + 时间戳 + 随机数）
            String dedupKey = "dedup:" + request.getOrderNo() + ":" 
                            + System.currentTimeMillis() / 1000; // 1秒粒度
            // Redis SETNX + EXPIRE 原子操作
            Boolean isSet = redisTemplate.opsForValue()
                .setIfAbsent(dedupKey, "1", Duration.ofSeconds(60));
            if (Boolean.FALSE.equals(isSet)) {
                return ResponseEntity.status(425)
                    .header("Retry-After", "0")
                    .body(new OrderResult("DUPLICATE_REQUEST"));
            }
        }
        // 正常下单逻辑
        Order order = orderService.create(request);
        return ResponseEntity.ok(new OrderResult(order.getId()));
    }
}

http {
    # 全局安全基线
    client_max_body_size 100M;  # 防止恶意大 Body 耗尽内存
    client_body_timeout 12s;
    
    # ✅ 场景1：API 接口（JSON，小响应）→ 启用缓冲，提升吞吐
    map $uri $is_api {
        ~^/api/      1;
        default       0;
    }
    
    # ✅ 场景2：文件下载（大响应）→ 禁用缓冲，流式传输
    map $uri $is_download {
        ~^/download/  1;
        ~\.(xlsx|pdf|zip)$  1;
        default       0;
    }

    server {
        location / {
            # API 路径：启用智能缓冲
            if ($is_api) {
                proxy_buffering on;
                proxy_buffer_size 4k;
                proxy_buffers 16 4k;
                proxy_busy_buffers_size 16k;
                proxy_max_temp_file_size 0; # 禁用临时文件，全内存
            }
            
            # 下载路径：禁用缓冲，零拷贝传输
            if ($is_download) {
                proxy_buffering off;
                proxy_buffer_size 128k;
                proxy_buffers 4 256k;
                proxy_busy_buffers_size 512k;
                # 启用 sendfile 提升大文件性能
                sendfile on;
                tcp_nopush on;
                tcp_nodelay on;
            }
            
            proxy_pass http://backend_java;
        }
    }
}

@GetMapping("/download/{fileId}")
public void downloadFile(@PathVariable String fileId, 
                        HttpServletResponse response) throws IOException {
    Resource resource = fileService.loadAsResource(fileId);
    // ⚠️ 关键：不使用 ResponseEntity<Resource>（会加载全文件进内存）
    // 改用流式写入 + 正确 Header
    response.setContentType("application/octet-stream");
    response.setHeader("Content-Disposition", 
        "attachment; filename=\"" + resource.getFilename() + "\"");
    response.setHeader("Content-Transfer-Encoding", "binary");
    response.setContentLengthLong(resource.contentLength());
    try (InputStream is = resource.getInputStream();
         OutputStream os = response.getOutputStream()) {
        byte[] buffer = new byte[8192];
        int len;
        while ((len = is.read(buffer)) != -1) {
            os.write(buffer, 0, len);
        }
        os.flush(); // 确保立即发送
    }
}

http {
    # ✅ 全局熔断：基于 upstream 健康状态动态调整
    upstream backend_java {
        server 10.0.1.10:8080 max_fails=3 fail_timeout=10s slow_start=30s;
        server 10.0.1.11:8080 max_fails=3 fail_timeout=10s slow_start=30s;
        
        # ✅ 健康检查（主动探测）
        check interval=3 rise=2 fall=5 timeout=1;
        check_http_send "HEAD /actuator/health HTTP/1.1\r\nHost: localhost\r\n\r\n";
        check_http_expect_alive http_2xx http_3xx;
    }

    server {
        location /api/ {
            proxy_pass http://backend_java;
            
            # ✅ 分级超时（比 Java 熔断阈值小 20%）
            proxy_connect_timeout 3s;   # TCP 连接建立
            proxy_send_timeout 8s;      # 发送请求到 upstream
            proxy_read_timeout 8s;      # 读取 upstream 响应
            
            # ✅ 限流：每 IP 每秒最多 100 请求（防爬虫/攻击）
            limit_req zone=perip burst=200 nodelay;
            
            # ✅ 限流区域定义（需在 http 块）
            limit_req_zone $binary_remote_addr zone=perip:10m rate=100r/s;
        }
    }
}

<!-- pom.xml -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-actuator</artifactId>
</dependency>
<dependency>
    <groupId>io.micrometer</groupId>
    <artifactId>micrometer-registry-prometheus</artifactId>
</dependency>

# application.yml
management:
  endpoints:
    web:
      exposure:
        include: health,metrics,prometheus,threaddump
  endpoint:
    health:
      show-details: when_authorized
  metrics:
    export:
      prometheus:
        enabled: true

// 自定义熔断指标（供 Nginx check 或 Prometheus 抓取）
@Component
public class HealthIndicatorConfig {
    @Bean
    public HealthIndicator dbHealthIndicator(DataSource dataSource) {
        return () -> {
            try (Connection conn = dataSource.getConnection()) {
                conn.createStatement().execute("SELECT 1");
                return Health.up()
                    .withDetail("db_response_time_ms", System.currentTimeMillis())
                    .build();
            } catch (Exception e) {
                return Health.down()
                    .withDetail("error", e.getMessage())
                    .build();
            }
        };
    }
}

http {
    # ✅ 禁用 PCRE JIT（某些版本 JIT 反而更慢）
    pcre_jit off;
    
    # ✅ 用前缀匹配替代正则（推荐！）
    location /api/v1/users/ {
        proxy_pass http://backend_java;
    }
    location /api/v2/users/ {
        proxy_pass http://backend_java;
    }
    
    # ✅ 如必须正则，使用原子组和占有量词（PCRE 8.32+）
    # 原危险写法：location ~* "^/api/v(\d+)/users/(\d+)/orders/(.*)$" 
    # 改为安全写法：
    location ~* "^/api/v(?<version>\d+)/users/(?<uid>\d+)/orders/[^?]*" {
        # 使用命名捕获组，且末尾用 [^?]* 替代 .* 防止回溯
        proxy_pass http://backend_java;
        proxy_set_header X-API-Version $version;
        proxy_set_header X-User-ID $uid;
    }
    
    # ✅ 对 UA 等高危字段，用 map 替代 if + regex（map 是哈希查找 O(1)）
    map $http_user_agent $is_bot {
        "~*bot|crawl|spider" 1;
        "~*Chrome/120"       0; # 白名单
        default              0;
    }
    
    server {
        location / {
            if ($is_bot) {
                return 403;
            }
            proxy_pass http://backend_java;
        }
    }
}

http {
    # ✅ 异步日志（Nginx 1.11.13+）
    access_log /var/log/nginx/access.log main buffer=128k flush=5s;
    
    # ✅ 结构化 JSON 日志（便于 ELK 解析）
    log_format json '{"time": "$time_iso8601", '
                     '"remote_addr": "$remote_addr", '
                     '"status": "$status", '
                     '"body_bytes_sent": "$body_bytes_sent", '
                     '"request_time": "$request_time", '
                     '"upstream_response_time": "$upstream_response_time", '
                     '"http_user_agent": "$http_user_agent"}';
    
    # ✅ 采样日志：仅记录错误和慢请求（99% 日志丢弃）
    map $status $loggable {
        ~^[23]  0;   # 2xx/3xx 不记录
        ~^[45]  1;   # 4xx/5xx 记录
        default 0;
    }
    
    map $request_time $slow_request {
        >1.0    1;   # 超过 1s 记录
        default 0;
    }
    
    server {
        access_log /var/log/nginx/access.log json 
                   if=$loggable;  # 仅错误状态
        access_log /var/log/nginx/slow.log json 
                   if=$slow_request; # 仅慢请求
    }
}

http {
    # ✅ 共享字典严格设限（避免内存失控）
    lua_shared_dict auth_cache 128m;   # 最大 128MB
    lua_shared_dict rate_limit 64m;
    
    # ✅ Lua 代码中显式释放（示例：JWT 解析后清理）
    init_by_lua_block {
        -- 初始化 JWT 库
        local jwt = require "resty.jwt"
        _G.jwt_lib = jwt:new()
    }
    
    server {
        location /api/auth {
            # ✅ 使用 cosocket 替代阻塞 IO
            content_by_lua_block {
                local jwt_obj = _G.jwt_lib
                local token = ngx.var.arg_token
                
                -- 解析 JWT（不阻塞）
                local ok, err = pcall(function()
                    local res, err = jwt_obj:verify_jwt_obj(token)
                    if not res then
                        ngx.exit(401)
                    end
                    -- ✅ 解析后立即清理大对象
                    jwt_obj = nil
                    collectgarbage() -- 强制 GC
                end)
                
                if not ok then
                    ngx.log(ngx.ERR, "JWT parse error: ", err)
                    ngx.exit(500)
                end
            }
        }
    }
}

# /etc/nginx/nginx.conf
user  nginx;
worker_processes  auto;
worker_rlimit_nofile  65535;

# 全局日志与错误处理
error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

# 事件模型
events {
    use epoll;
    worker_connections  16384;
    multi_accept on;
    accept_mutex off;
}

http {
    # MIME 类型
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    # 日志格式（结构化 JSON）
    log_format json '{"@timestamp":"$time_iso8601",'
                     '"host":"$server_addr",'
                     '"client":"$remote_addr",'
                     '"method":"$request_method",'
                     '"uri":"$uri",'
                     '"status":$status,'
                     '"bytes":$body_bytes_sent,'
                     '"request_time":$request_time,'
                     '"upstream_time":"$upstream_response_time",'
                     '"upstream_addr":"$upstream_addr",'
                     '"http_user_agent":"$http_user_agent"}';

    # 异步日志
    access_log /var/log/nginx/access.log json buffer=128k flush=5s;
    # 错误日志采样
    map $status $log_error {
        ~^[45]  1;
        default 0;
    }
    access_log /var/log/nginx/error_access.log json if=$log_error;

    # 连接与超时
    sendfile        on;
    tcp_nopush      on;
    tcp_nodelay     on;
    keepalive_timeout  65;
    types_hash_max_size 2048;

    # 客户端限制
    client_max_body_size 100M;
    client_body_timeout 12s;
    client_header_timeout 12s;
    send_timeout 10s;

    # SSL 优化（TLS 1.3 优先）
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 4h;
    ssl_session_tickets on;
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 1.1.1.1 valid=300s;

    # Gzip
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

    # 上游定义
    upstream backend_java {
        least_conn;
        server 10.0.1.10:8080 max_fails=3 fail_timeout=10s;
        server 10.0.1.11:8080 max_fails=3 fail_timeout=10s;
        keepalive 32;
    }

    # 限流区域
    limit_req_zone $binary_remote_addr zone=perip:10m rate=100r/s;
    limit_req_zone $server_name zone=perserver:10m rate=5000r/s;

    include /etc/nginx/conf.d/*.conf;
}