本文介紹如何對HTTP AO進行故障排除。
HTTP加速器使用以下技術最佳化HTTP和HTTPS(4.3.1版及更高版本中)流量:
可以單獨配置HTTP後設資料快取、抑制伺服器編碼和DRE提示功能。啟用HTTP AO時,TCP連線重複使用功能始終處於活動狀態,且僅適用於HTTP流量。
您可以使用show accelerator和show license命令驗證常規AO配置和狀態,如應用程式加速故障排除一文中所述。HTTP加速器操作需要企業許可證。
接下來,使用show accelerator http命令驗證特定於HTTP AO的狀態,如圖1所示。您想看到HTTP AO已啟用、正在運行和已註冊,並且顯示連線限制。如果Config State為Enabled,但Operational State為Shutdown,則表示存在許可問題。對於每個HTTP功能,顯示當前模式(使用者/預設)以及值(啟用、禁用或配置值)。 在4.2.1版中新增了Suppress Server Encoding和Metadatacache項,在4.3.1版中新增了DRE Hints和HTTPS Metadatacache項。
對於要通過SSL和HTTP AO進行最佳化的HTTPS流量,請確保啟用以下可選功能之一:HTTPS後設資料快取、suppress-server-encoding或DRE提示。
使用show running-config命令以驗證HTTP/HTTPS流量策略是否正確配置以及啟用了哪些功能。您想要檢視加速http以執行Web應用程式操作,並且想要檢視HTTP分類器列出的相應匹配條件,如下所示:
WAE674# sh run | include HTTP
accelerator http suppress-server-encoding enable <----- in 4.2.1 and later
accelerator http metadatacache https enable <----- in 4.3.1 and later
accelerator http dre-hints enable <----- in 4.3.1 and later
at least one of these must be enabled
classifier HTTP
classifier HTTPS
name Web classifier HTTP action optimize full accelerate http <----- HTTP acceleration
name Web classifier HTTPS action optimize DRE no compression none <----- HTTPS static policy applies to traffic not
matching any SSL accelerated-services policy
WAE674# sh run | begin HTTP
...skipping
classifier HTTP
match dst port eq 80
match dst port eq 8080
match dst port eq 8000
match dst port eq 8001
match dst port eq 3128
WAE674# sh run | begin HTTPS
...skipping
classifier HTTPS
match dst port eq 443 <----- add here any nondefault HTTPS port
使用show statistics accelerator http命令檢視以下統計資訊:
WAE674# sh stat accel http HTTP: Global Statistics ----------------- Time Accelerator was started: Tue Apr 6 06:04:06 2010 Time Statistics were Last Reset/Cleared: Tue Apr 6 06:04:06 2010 Total Handled Connections: 3743984 Total Optimized Connections: 3743984 Total Connections Handed-off with Compression Policies Unchanged: 0 Total Dropped Connections: 0 Current Active Connections: 48 Current Pending Connections: 0 Maximum Active Connections: 176 Total Time Saved (ms): 35584437 <-----Should be incrementing Current Active Connections Free For Fast Connection Use: 2 Total Connections Handed-off: 0 Total Connections Handed-off with Compression Policies Disabled: 0 Total Connections Handed-off to SSL: 0 Total Connection Hand-off Failures: 0 Total Fast Connection Successes: 3617244 <-----Should be incrementing Total Fast Connection Failures: 0 Maximum Fast Connections on a Single Connection: 100 Total CONNECT Requests with Incomplete Message: 0 Percentage of Connection Time Saved: 37 Total Round Trip Time For All Connections (ms): 4922767377 Total Fast Connections Initiated by Peer: 0 Total SYN Timeouts: 0 Total Time for Metadata Cache Miss (ms): 2 <-----Output from here is in 4.2.1 and later only RTT saved by Redirect Metadata Cache (ms): 5988 <-----Should be incrementing RTT saved by Authorization Redirect Metadata Cache (ms): 345 <-----Should be incrementing RTT saved by Content Refresh Check Metadata Cache (ms): 44987 <-----Should be incrementing Total Time Saved by Fast Connection Use (ms): 456 Total Locally Served Redirect Responses: 453 <-----Should be incrementing Total Locally Served Unauthorized Responses: 56 <-----Should be incrementing Total Locally Served Conditional Responses: 4932 <-----Should be incrementing Total Remotely Served Redirect Responses: 0 Total Remotely Served Unauthorized Responses: 0 Total Remotely Served Conditional Responses: 1 Total Requests with URL Longer than 255 Characters: 0 Total Requests with HTTP Pipelining: 0 Total Transactions Handled: 2 <-----Total number of HTTP transactions processed Total Server Compression Suppression: 1 <-----Total number of Accept-Encoding removed Total Requests Requiring Server Content-Revalidation: 0 Total Responses not to be Cached: 0 Total Connections Expecting Authentication: 0 Total Connections with Unsupported HTTP Requests: 0 Total Connections with Unsupported HTTP Responses: 0 Total Hints Sent to DRE Layer to Flush Data: 2 Total Hints Sent to DRE Layer to Skip LZ: 0 Total Hints Sent to DRE Layer to Skip Header Information: 1
如果上述輸出中的Total Time Saved計數器沒有遞增或非常小,則表明HTTP AO未提供多少好處。如果三個後設資料快取中的一個所節省的總時間沒有增加或非常少,則表明相應的後設資料快取並沒有提供很多好處。
Total Server Compression Suppression計數器指示已刪除Accept-Encoding標頭的次數,以嘗試通過WAE裝置提供更好的壓縮。傳送到DRE層計數器的總提示指示每個DRE提示(刷新資料、跳過LZ、跳過報頭)已向DRE模組發出多少次,以嘗試更好地壓縮資料。
要在4.2.1及更高版本中檢視Central Manager中的類似資訊,請選擇WAE裝置,然後選擇Monitor > Acceleration > HTTP Acceleration Report,然後選擇Details頁籤以檢視以下圖表:
要檢視有關HTTP報頭分析和錯誤條件的調試資訊,請使用show statistics accelerator http debug命令(在4.3.1及更高版本中)確定以下內容:
使用show statistics connection optimized http命令檢查WAAS裝置是否正在建立最佳化的HTTP連線。驗證HTTP連線的「Accel」列中是否出現「H」,這表示已使用HTTP AO,如下所示:
WAE674# sh stat conn opt http Current Active Optimized Flows: 2 Current Active Optimized TCP Plus Flows: 2 Current Active Optimized TCP Only Flows: 0 Current Active Optimized TCP Preposition Flows: 0 Current Active Auto-Discovery Flows: 0 Current Active Pass-Through Flows: 0 Historical Flows: 100 D:DRE,L:LZ,T:TCP Optimization, A:AOIM,C:CIFS,E:EPM,G:GENERIC,H:HTTP,M:MAPI,N:NFS,S:SSL,V:VIDEO ConnID Source IP:Port Dest IP:Port PeerID Accel 5929 10.10.10.10:3446 10.10.100.100:80 00:14:5e:84:24:5f THDL <-------Look for "H"
可以使用show statistics connection closed http命令檢查已關閉連線的連線統計資訊。
要檢視Central Manager中的類似資訊,請選擇WAE裝置,然後選擇Monitor > Optimization > Connections Statistics。
在Connection Statistics報告中,Applied Policy列中的全域性圖示顯示HTTP AO用於連線。(將游標置於圖示上以檢視其含義。)
您可以使用show statistics connection optimized http detail命令檢視HTTP連線統計資訊。在輸出中查詢「Fast connections」計數器。此計數器的正值表示HTTP AO通過重複使用持久連線來使客戶端受益,從而減少延遲。
WAE674# show stat conn opt http detail
Connection Id: 1496
Peer Id: 00:14:5e:84:24:5f
Connection Type: EXTERNAL CLIENT
Start Time: Wed Jul 15 05:09:52 2009
Source IP Address: 10.10.10.10
Source Port Number: 1760
Destination IP Address: 10.10.100.100
Destination Port Number: 80
Application Name: Web <-----Should see Web
Classifier Name: HTTP <-----Should see HTTP
Map Name: basic
Directed Mode: FALSE
Preposition Flow: FALSE
Policy Details:
Configured: TCP_OPTIMIZE + DRE + LZ
Derived: TCP_OPTIMIZE + DRE + LZ
Peer: TCP_OPTIMIZE + DRE + LZ
Negotiated: TCP_OPTIMIZE + DRE + LZ
Applied: TCP_OPTIMIZE + DRE + LZ
Accelerator Details:
Configured: HTTP <-----Should see HTTP configured
Derived: HTTP
Applied: HTTP <-----Should see HTTP applied
Hist: None
Original Optimized
-------------------- --------------------
Bytes Read: 266 139160
Bytes Written: 82686 128
. . .
HTTP : 1496
Time Statistics were Last Reset/Cleared: Wed Jul 15
05:09:52 2009
Total Bytes Read: 3269
56367
Total Bytes Written: 3269
56367
Total Bytes Buffered: 0
0
Total Internal Bytes Read: 92
Total Internal Bytes Written: 92
Bit Flags for I/O state: 1040
Internal object pointer: 2046823200
Fast connections: 11 <-----Reused connections
. . .
(本節僅適用於4.3.1版及更高版本。)
使用show statistics accelerator http https命令檢視以下統計資訊:
WAE674# sh stat accel http https HTTPS Statistics ----------------- Total Optimized HTTPS Connections: 10 <-----Should be incrementing Total Handled HTTPS Connections: 10 <-----Should be incrementing Total Active HTTPS Connections: 2 Total Proxy-Connect HTTPS Connections: 0 Total Proxy-Connect HTTPS Insert Failures: 0 RTT saved by HTTPS Content Refresh Check Metadata Cache - (ms): 44 <-----Should be incrementing RTT saved by HTTPS Redirect Metadata Cache - (ms): 10 <-----Should be incrementing RTT saved by HTTPS Authorization Required Metadata Cache - (ms): 5 <-----Should be incrementing Total Locally Served HTTPS Conditional Responses: 44 <-----Should be incrementing Total Locally Served HTTPS Redirect Responses: 10 <-----Should be incrementing Total Locally Served HTTPS Unauthorized Responses: 5 <-----Should be incrementing Total Remotely Served HTTPS Conditional Responses: 32 Total Remotely Served HTTPS Redirect Responses: 2 Total Remotely Served HTTPS Unauthorized Responses: 1 Total Hints Sent to DRE Layer to Skip Header Information - HTTPS: 121 Total Hints Sent to DRE Layer to Flush Data - HTTPS: 121 Total Hints Sent to DRE Layer to Skip LZ - HTTPS: 0 Total Server Compression Suppression - HTTPS: 110 Total Time Saved from all HTTPS metadata cache hits: 59 <-----Should be incrementing Total Time HTTPS Cache Miss: 4 Total HTTPS Requests Requiring Server Content-Revalidation: 32 Total HTTPS Responses not to be Cached: 0 Total HTTPS Connections Bypassed due to URL Based Bypass List: 0 Total HTTPS Connections Bypassed due to IP Based Bypass List: 0
如果上述輸出中的Total Time Saved計數器沒有增加或非常小,則表明HTTP AO沒有為HTTPS流量提供太多好處。如果三個後設資料快取中的一個所節省的總時間沒有增加或非常少,則表明相應的後設資料快取並沒有提供很多好處。
Total Server Compression Suppression計數器指示從HTTPS請求中刪除接受編碼標頭的次數,以嘗試由WAE裝置提供更好的壓縮。傳送到DRE層計數器的總提示指示每個DRE提示(刷新資料、跳過LZ、跳過報頭)已向DRE模組發出多少次,以嘗試更好地壓縮資料。
要在4.3.1及更高版本中檢視Central Manager中的類似資訊,請選擇WAE裝置,然後選擇Monitor > Acceleration > HTTPS Acceleration Report,然後選擇Details頁籤以檢視以下圖表:
要檢視有關HTTPS報頭分析和錯誤條件的調試資訊,請使用show statistics accelerator http debug命令確定以下內容:
使用show statistics connection optimized http命令檢查WAAS裝置是否正在建立最佳化的HTTPS連線。驗證HTTPS連線的「Accel」列中是否同時顯示「H」和「S」,這表示已使用HTTP和SSL AO,如下所示:
WAE674# sh stat conn opt http Current Active Optimized Flows: 2 Current Active Optimized TCP Plus Flows: 2 Current Active Optimized TCP Only Flows: 0 Current Active Optimized TCP Preposition Flows: 0 Current Active Auto-Discovery Flows: 0 Current Active Pass-Through Flows: 0 Historical Flows: 100 D:DRE,L:LZ,T:TCP Optimization, A:AOIM,C:CIFS,E:EPM,G:GENERIC,H:HTTP,M:MAPI,N:NFS,S:SSL,V:VIDEO ConnID Source IP:Port Dest IP:Port PeerID Accel 5929 10.10.10.10:3446 10.10.100.100:80 00:14:5e:84:24:5f THSDL <-------Look for "H" and "S"
可以使用show statistics connection closed http或show statistics connection closed ssl命令檢查已關閉連線的連線統計資訊。
要檢視Central Manager中的類似資訊,請選擇WAE裝置,然後選擇Monitor > Optimization > Connections Statistics。
在Connection Statistics報告中,Applied Policy列中的全域性圖示顯示HTTP AO用於連線,鎖圖示表示已應用SSL AO。(將游標置於圖示上以檢視其含義。)
您可以使用show statistics connection optimized http detail和show statistics connection optimized ssl detail命令檢視HTTPS連線統計資訊。
WAE674# show stat conn opt http detail
Connection Id: 34
Peer Id: 00:14:5e:cd:9c:c9
Connection Type: EXTERNAL CLIENT
Start Time: Thu Oct 28 14:47:56 2010
Source IP Address: 10.3.2.1
Source Port Number: 40829
Destination IP Address: 110.1.1.100
Destination Port Number: 443
Application Name: SSL <-----Should see SSL
Classifier Name: HTTPS <-----Should see HTTPS
Map Name: basic
Directed Mode: FALSE
Preposition Flow: FALSE
Policy Details:
Configured: TCP_OPTIMIZE
Derived: TCP_OPTIMIZE
Peer: TCP_OPTIMIZE
Negotiated: TCP_OPTIMIZE + DRE + LZ
Applied: TCP_OPTIMIZE + DRE + LZ
Accelerator Details:
Configured: None
Derived: None
Applied: HTTP,SSL <-----Should see HTTP and SSL applied
Hist: None
Original Optimized
-------------------- --------------------
Bytes Read: 5162 21874
Bytes Written: 1977819 5108
Total Reduction Ratio: 98.639%
HTTP : 34
Time Statistics were Last Reset/Cleared: Thu Oct 28
14:47:56 2010
Total Bytes Read: 4620
1972570
Total Bytes Written: 4620
1972570
. . .
SSL : 34 Time Statistics were Last Reset/Cleared: Thu Oct 28 14:47:56 2010 Total Bytes Read: 0 0 Total Bytes Written: 0 0 . . . Hostname in HTTP CONNECT: <------ the last three counters apply only to IP Address in HTTP CONNECT: Proxy Connect type of HTTPS connections TCP Port in HTTP CONNECT:
要顯示三個HTTP後設資料快取(重定向、條件快取和未經授權)的內容,請使用show cache http-metadatacache all命令。僅顯示完整的URL和過期時間(以秒為單位)。您也可以使用以下命令分別顯示三個快取中的每一個快取的內容:
上述命令的典型輸出如下:
Redirect Cache Active entries: 1, Max Entries: 1500 URL: www.abcnews.com/, Expiration (sec): 3206 Conditional Cache Active entries: 6, Max Entries: 10500 URL: www.cisco.com/web/fw/i/quicklinks-rnd-corners.gif, Expiration (sec): 3594 URL: www.cisco.com/web/fw/i/hp-sprites.gif, Expiration (sec): 3594 URL: www.cisco.com/en/US/home/images/ba-actsGreen-logo.jpg, Expiration (sec): 3594 URL: www.cisco.com/en/US/home/images/fp-eos3.jpg, Expiration (sec): 3594 URL: www.cisco.com/en/US/home/images/fp-AP541n.jpg, Expiration (sec): 3594 URL: www.cisco.com/web/fw/c/home.min.css, Expiration (sec): 3592 Unauthorized Cache Active entries: 1, Max Entries: 3000 URL: l.yimg.com/index.html, Expiration (sec): 86393
您可以使用clear cache http-metadatacache all指令清除三個快取的內容。
如果要單獨清除每個快取記憶體的內容,可以使用以下命令:
如果要指定要刪除的URL,可以使用以下命令:
clear cache http-metadatacache {all|redirect|conditional|unauthorized} URL
要顯示三種HTTPS後設資料快取(重定向、條件性和未授權)中的條目數,請使用show cache http-metadatacache https命令。與HTTP後設資料快取的相應命令不同,URL和過期時間不會顯示。您也可以使用以下命令分別顯示三個快取記憶體的條目數:
上述命令的典型輸出如下:
HTTPS Redirect Cache Active HTTP entries: 0, Active HTTPS entries: 0 Max Entries: 3250 HTTPS Conditional Cache Active HTTP entries: 0, Active HTTPS entries: 11 Max Entries: 22750 HTTPS Unauthorized Cache Active HTTP entries: 0, Active HTTPS entries: 0 Max Entries: 6500
您可以使用clear cache http-metadatacache https指令清除三個快取的內容。
如果要單獨清除每個快取記憶體的內容,可以使用以下命令:
對於HTTP和HTTPS(4.3.1版)304響應,後設資料快取遵循所有快取控制指令(快取控制:no-cache、no-store、private、must-revalidate、proxy-revalidate、max-age=0、Pragma:無快取)。 有一個選項可以禁用此類快取控制檢查,這意味著所有304個包含指定不可快取性的快取控制標頭的響應都會被快取,並且所有包含指定不可快取性的快取控制標頭的請求都可以從本地快取中提供。
了解禁用快取控制檢查可能會增加後設資料快取的優點,因為某些瀏覽器或Web伺服器可能有一個預設選項,在所有響應中包括一個快取控制標頭,以便通過原始伺服器強制重新驗證對象。這將使後設資料快取對304個響應無效。
此選項可以獨立控制HTTP/S請求(快取查詢)和響應(快取插入)。
要禁用對HTTP/S 304請求的快取控制檢查,請使用以下命令:
WAE#accelerator http metadatacache request-ignore-no-cache enable
此命令強制後設資料快取忽略HTTP/S 304請求中的所有快取控制指令。(此命令的預設[no]形式強制後設資料快取執行HTTP/S 304請求中的所有快取控制指令。)
要禁用對HTTP/S 304響應的快取控制檢查,請使用以下命令:
WAE#accelerator http metadatacache response-ignore-no-cache enable
此命令強制後設資料快取忽略HTTP/S 304響應中的所有快取控制指令。(此命令的預設[no]形式強制後設資料快取執行HTTP/S 304響應中的所有快取控制指令。)
後設資料快取對301和401響應使用快取控制標頭。如果響應具有任何Cache-Control標頭(no-cache、no-store、private、must-revalidate、proxy-revalidate、max-age=0、Pragma:no-cache),則不對其進行快取。
快取的內容存在某些例外。當HTTP AO遇到正在處理的HTTP/S請求/響應中的以下條件之一時,不會發生快取記憶體插入或查詢:
以下日誌檔案可用於排除HTTP AO問題:
為了更輕鬆地進行調試,您應該首先設定ACL以限制資料包只訪問一台主機。
WAE674(config)# ip access-list extended 150 permit tcp host 10.10.10.10 any WAE674(config)# ip access-list extended 150 permit tcp any host 10.10.10.10
要啟用事務日誌記錄,請使用transaction-logs configuration命令,如下所示:
wae(config)# transaction-logs flow enable wae(config)# transaction-logs flow access-list 150
可以使用type-tail命令檢視事務日誌檔案的結尾,如下所示:
wae# type-tail tfo_log_10.10.11.230_20090715_130000.txt Wed Jul 15 13:37:00 2009 :1529 :10.10.10.10 :2004 :10.10.100.100 :80 :OT :END :EXTERNAL CLIENT :(HTTP) :0 :0 :107 :117 Wed Jul 15 13:37:00 2009 :1529 :10.10.10.10 :1880 :10.10.100.100 :80 :SODRE :END :14357 :8406 :2181 :2761 :0 Wed Jul 15 13:38:19 2009 :1533 :10.10.10.10 :2008 :10.10.100.101 :135 :OT :START :EXTERNAL CLIENT :00.14.5e.84.24.5f :basic :Other :MS-EndPointMapper :F :(TFO) (TFO) (TFO) (TFO) (TFO) :<None> :(EPM) (EPM) (EPM) :<None> :<None> :0 :120 Wed Jul 15 13:38:19 2009 :1534 :10.10.10.10 :2009 :10.10.100.101 :1025 :OT :START :EXTERNAL CLIENT :00.14.5e.84.24.5f :uuide3514235-4b06-11d1-ab04-00c04fc2dcd2
要設定和啟用HTTP AO的調試日誌記錄,請使用以下命令。
附註:調試日誌記錄是CPU密集型,可以生成大量輸出。在生產環境中慎重而謹慎地使用它。
您可以對磁碟啟用詳細日誌記錄:
WAE674(config)# logging disk enable WAE674(config)# logging disk priority detail
您可以在ACL中為連線啟用偵錯記錄:
WAE674# debug connection access-list 150
HTTP AO調試(4.2.1及更高版本)的選項如下:
WAE674# debug accelerator http ?
all enable all HTTP accelerator debugs
bypass-list enable HTTP bypass-list debugs
cli enable HTTP CLI debugs
conditional-response enable HTTP metadatacache conditional (304) response
debugs
connection enable HTTP connection debugs
dre-hints enable HTTP dre-hints debugs
metadatacache enable HTTP metadatacache debugs
prefetch enable HTTP prefetch debugs
redirect-response enable HTTP metadatacache redirect (301) response
debugs
shell enable HTTP shell debugs
suppress-server-encoding enable HTTP suppress-server-encoding debugs
transaction enable HTTP transaction debugs
unauthorized-response enable HTTP auth-optimization debugs bugs
您可以為HTTP連線啟用調試日誌記錄,然後按如下方式顯示調試錯誤日誌的結束:
WAE674# debug accelerator http connection WAE674# type-tail errorlog/httpao-errorlog.current follow