本文介绍如何排除HTTP AO故障。
HTTP加速器使用以下技术优化HTTP和HTTPS(版本4.3.1及更高版本)流量:
HTTP元数据缓存、抑制服务器编码和DRE提示功能可单独配置。当HTTP AO启用并仅应用于HTTP流量时,TCP连接重用功能始终处于活动状态。
您可以使用show accelerator和show license命令验证常规AO配置和状态,如排除应用加速故障文章中所述。HTTP加速器操作需要企业许可证。
接下来,使用图1所示的show accelerator http命令验证特定于HTTP AO的状态。您希望看到HTTP AO已启用、运行和注册,并且显示连接限制。如果配置状态为启用,但操作状态为关闭,则表示许可问题。对于每个HTTP功能,显示当前模式(用户/默认)以及值(启用、禁用或配置的值)。 在4.2.1版中添加了“抑制服务器编码”和“元数据缓存”项,在4.3.1版中添加了DRE提示和HTTPS元数据缓存项。
对于要由SSL和HTTP AO优化的HTTPS流量,请确保启用以下其中一项可选功能:HTTPS元数据缓存、suppress-server-encoding或DRE提示。
使用show running-config命令验证HTTP/HTTPS流量策略是否已正确配置,以及启用了哪些功能。您希望看到Web应用程序操作的加速http,并且希望看到为HTTP分类器列出的适当匹配条件,如下所示:
WAE674# sh run | include HTTP accelerator http suppress-server-encoding enable <----- in 4.2.1 and later accelerator http metadatacache https enable <----- in 4.3.1 and later accelerator http dre-hints enable <----- in 4.3.1 and later at least one of these must be enabled classifier HTTP classifier HTTPS name Web classifier HTTP action optimize full accelerate http <----- HTTP acceleration name Web classifier HTTPS action optimize DRE no compression none <----- HTTPS static policy applies to traffic not matching any SSL accelerated-services policy WAE674# sh run | begin HTTP ...skipping classifier HTTP match dst port eq 80 match dst port eq 8080 match dst port eq 8000 match dst port eq 8001 match dst port eq 3128 WAE674# sh run | begin HTTPS ...skipping classifier HTTPS match dst port eq 443 <----- add here any nondefault HTTPS port
使用show statistics accelerator http命令查看以下统计信息:
WAE674# sh stat accel http HTTP: Global Statistics ----------------- Time Accelerator was started: Tue Apr 6 06:04:06 2010 Time Statistics were Last Reset/Cleared: Tue Apr 6 06:04:06 2010 Total Handled Connections: 3743984 Total Optimized Connections: 3743984 Total Connections Handed-off with Compression Policies Unchanged: 0 Total Dropped Connections: 0 Current Active Connections: 48 Current Pending Connections: 0 Maximum Active Connections: 176 Total Time Saved (ms): 35584437 <-----Should be incrementing Current Active Connections Free For Fast Connection Use: 2 Total Connections Handed-off: 0 Total Connections Handed-off with Compression Policies Disabled: 0 Total Connections Handed-off to SSL: 0 Total Connection Hand-off Failures: 0 Total Fast Connection Successes: 3617244 <-----Should be incrementing Total Fast Connection Failures: 0 Maximum Fast Connections on a Single Connection: 100 Total CONNECT Requests with Incomplete Message: 0 Percentage of Connection Time Saved: 37 Total Round Trip Time For All Connections (ms): 4922767377 Total Fast Connections Initiated by Peer: 0 Total SYN Timeouts: 0 Total Time for Metadata Cache Miss (ms): 2 <-----Output from here is in 4.2.1 and later only RTT saved by Redirect Metadata Cache (ms): 5988 <-----Should be incrementing RTT saved by Authorization Redirect Metadata Cache (ms): 345 <-----Should be incrementing RTT saved by Content Refresh Check Metadata Cache (ms): 44987 <-----Should be incrementing Total Time Saved by Fast Connection Use (ms): 456 Total Locally Served Redirect Responses: 453 <-----Should be incrementing Total Locally Served Unauthorized Responses: 56 <-----Should be incrementing Total Locally Served Conditional Responses: 4932 <-----Should be incrementing Total Remotely Served Redirect Responses: 0 Total Remotely Served Unauthorized Responses: 0 Total Remotely Served Conditional Responses: 1 Total Requests with URL Longer than 255 Characters: 0 Total Requests with HTTP Pipelining: 0 Total Transactions Handled: 2 <-----Total number of HTTP transactions processed Total Server Compression Suppression: 1 <-----Total number of Accept-Encoding removed Total Requests Requiring Server Content-Revalidation: 0 Total Responses not to be Cached: 0 Total Connections Expecting Authentication: 0 Total Connections with Unsupported HTTP Requests: 0 Total Connections with Unsupported HTTP Responses: 0 Total Hints Sent to DRE Layer to Flush Data: 2 Total Hints Sent to DRE Layer to Skip LZ: 0 Total Hints Sent to DRE Layer to Skip Header Information: 1
如果上述输出中的Total Time Saved计数器未递增或很小,则表明HTTP AO没有提供太多好处。如果三个元数据缓存之一所节省的总时间没有递增或非常小,则表明相应的元数据缓存没有提供太多好处。
Total Server Compression Suppression计数器指示Accept-Encoding报头被删除的次数,以便WAE设备提供更好的压缩。“发送到DRE层的总提示”计数器指示已向DRE模块发出每个DRE提示(刷新数据、跳过LZ、跳过报头)的次数,以便更好地压缩数据。
要查看4.2.1版及更高版本中Central Manager中的类似信息,请选择WAE设备,然后选择Monitor > Acceleration > HTTP Acceleration Report,然后选择Details选项卡查看以下图表:
要查看有关HTTP报头解析和错误情况的调试信息,请使用show statistics accelerator http debug命令(在4.3.1及更高版本中)确定以下内容:
使用show statistics connection optimized http命令检查WAAS设备是否正在建立优化的HTTP连接。验证HTTP连接的Accel列中是否显示“H”,该列表示已使用HTTP AO,如下所示:
WAE674# sh stat conn opt http Current Active Optimized Flows: 2 Current Active Optimized TCP Plus Flows: 2 Current Active Optimized TCP Only Flows: 0 Current Active Optimized TCP Preposition Flows: 0 Current Active Auto-Discovery Flows: 0 Current Active Pass-Through Flows: 0 Historical Flows: 100 D:DRE,L:LZ,T:TCP Optimization, A:AOIM,C:CIFS,E:EPM,G:GENERIC,H:HTTP,M:MAPI,N:NFS,S:SSL,V:VIDEO ConnID Source IP:Port Dest IP:Port PeerID Accel 5929 10.10.10.10:3446 10.10.100.100:80 00:14:5e:84:24:5f THDL <-------Look for "H"
您可以使用show statistics connection closed http命令检查已关闭连接的连接统计信息。
要从Central Manager查看类似信息,请选择WAE设备,然后选择Monitor > Optimization > Connections Statistics。
在“连接统计信息”(Connection Statistics)报告中,“已应用策略”(Applied Policy)列中的全局图标显示HTTP AO用于连接。(将光标置于图标上以查看其含义。)
可以使用show statistics connection optimized http detail命令查看HTTP连接统计信息。在输出中查找“快速连接”计数器。此计数器的正值表示HTTP AO通过重用持久连接为客户端带来优势,从而减少延迟。
WAE674# show stat conn opt http detail Connection Id: 1496 Peer Id: 00:14:5e:84:24:5f Connection Type: EXTERNAL CLIENT Start Time: Wed Jul 15 05:09:52 2009 Source IP Address: 10.10.10.10 Source Port Number: 1760 Destination IP Address: 10.10.100.100 Destination Port Number: 80 Application Name: Web <-----Should see Web Classifier Name: HTTP <-----Should see HTTP Map Name: basic Directed Mode: FALSE Preposition Flow: FALSE Policy Details: Configured: TCP_OPTIMIZE + DRE + LZ Derived: TCP_OPTIMIZE + DRE + LZ Peer: TCP_OPTIMIZE + DRE + LZ Negotiated: TCP_OPTIMIZE + DRE + LZ Applied: TCP_OPTIMIZE + DRE + LZ Accelerator Details: Configured: HTTP <-----Should see HTTP configured Derived: HTTP Applied: HTTP <-----Should see HTTP applied Hist: None Original Optimized -------------------- -------------------- Bytes Read: 266 139160 Bytes Written: 82686 128 . . . HTTP : 1496 Time Statistics were Last Reset/Cleared: Wed Jul 15 05:09:52 2009 Total Bytes Read: 3269 56367 Total Bytes Written: 3269 56367 Total Bytes Buffered: 0 0 Total Internal Bytes Read: 92 Total Internal Bytes Written: 92 Bit Flags for I/O state: 1040 Internal object pointer: 2046823200 Fast connections: 11 <-----Reused connections . . .
(本节仅适用于4.3.1及更高版本。)
使用show statistics accelerator http https命令查看以下统计信息:
WAE674# sh stat accel http https HTTPS Statistics ----------------- Total Optimized HTTPS Connections: 10 <-----Should be incrementing Total Handled HTTPS Connections: 10 <-----Should be incrementing Total Active HTTPS Connections: 2 Total Proxy-Connect HTTPS Connections: 0 Total Proxy-Connect HTTPS Insert Failures: 0 RTT saved by HTTPS Content Refresh Check Metadata Cache - (ms): 44 <-----Should be incrementing RTT saved by HTTPS Redirect Metadata Cache - (ms): 10 <-----Should be incrementing RTT saved by HTTPS Authorization Required Metadata Cache - (ms): 5 <-----Should be incrementing Total Locally Served HTTPS Conditional Responses: 44 <-----Should be incrementing Total Locally Served HTTPS Redirect Responses: 10 <-----Should be incrementing Total Locally Served HTTPS Unauthorized Responses: 5 <-----Should be incrementing Total Remotely Served HTTPS Conditional Responses: 32 Total Remotely Served HTTPS Redirect Responses: 2 Total Remotely Served HTTPS Unauthorized Responses: 1 Total Hints Sent to DRE Layer to Skip Header Information - HTTPS: 121 Total Hints Sent to DRE Layer to Flush Data - HTTPS: 121 Total Hints Sent to DRE Layer to Skip LZ - HTTPS: 0 Total Server Compression Suppression - HTTPS: 110 Total Time Saved from all HTTPS metadata cache hits: 59 <-----Should be incrementing Total Time HTTPS Cache Miss: 4 Total HTTPS Requests Requiring Server Content-Revalidation: 32 Total HTTPS Responses not to be Cached: 0 Total HTTPS Connections Bypassed due to URL Based Bypass List: 0 Total HTTPS Connections Bypassed due to IP Based Bypass List: 0
如果上述输出中的Total Time Saved计数器未增加或很小,则表明HTTP AO对HTTPS流量没有太大益处。如果三个元数据缓存之一所节省的总时间没有递增或非常小,则表明相应的元数据缓存没有提供太多好处。
Total Server Compression Suppression计数器指示从HTTPS请求中删除Accept-Encoding报头的次数,以便WAE设备提供更好的压缩。“发送到DRE层的总提示”计数器指示已向DRE模块发出每个DRE提示(刷新数据、跳过LZ、跳过报头)的次数,以便更好地压缩数据。
要查看4.3.1版及更高版本中Central Manager中的类似信息,请选择WAE设备,然后选择Monitor > Acceleration > HTTPS Acceleration Report,然后选择Details选项卡查看以下图表:
要查看有关HTTPS报头解析和错误情况的调试信息,请使用show statistics accelerator http debug命令确定以下内容:
使用show statistics connection optimized http命令检查WAAS设备是否正在建立优化的HTTPS连接。验证HTTPS连接的Accel列中是否同时显示“H”和“S”,这表示同时使用了HTTP和SSL AO,如下所示:
WAE674# sh stat conn opt http Current Active Optimized Flows: 2 Current Active Optimized TCP Plus Flows: 2 Current Active Optimized TCP Only Flows: 0 Current Active Optimized TCP Preposition Flows: 0 Current Active Auto-Discovery Flows: 0 Current Active Pass-Through Flows: 0 Historical Flows: 100 D:DRE,L:LZ,T:TCP Optimization, A:AOIM,C:CIFS,E:EPM,G:GENERIC,H:HTTP,M:MAPI,N:NFS,S:SSL,V:VIDEO ConnID Source IP:Port Dest IP:Port PeerID Accel 5929 10.10.10.10:3446 10.10.100.100:80 00:14:5e:84:24:5f THSDL <-------Look for "H" and "S"
可以使用show statistics connection closed http或show statistics connection closed ssl命令检查关闭连接的连接统计信息,以查看关闭连接。
要从Central Manager查看类似信息,请选择WAE设备,然后选择Monitor > Optimization > Connections Statistics。
在“连接统计信息”(Connection Statistics)报告中,“已应用策略”(Applied Policy)列中的全局图标显示HTTP AO已用于连接,而锁图标表示已应用SSL AO。(将光标置于图标上以查看其含义。)
可以使用show statistics connection optimized http detail和show statistics connection optimized ssl detail命令查看HTTPS连接统计信息,以优化SSL详细信息。
WAE674# show stat conn opt http detail Connection Id: 34 Peer Id: 00:14:5e:cd:9c:c9 Connection Type: EXTERNAL CLIENT Start Time: Thu Oct 28 14:47:56 2010 Source IP Address: 10.3.2.1 Source Port Number: 40829 Destination IP Address: 110.1.1.100 Destination Port Number: 443 Application Name: SSL <-----Should see SSL Classifier Name: HTTPS <-----Should see HTTPS Map Name: basic Directed Mode: FALSE Preposition Flow: FALSE Policy Details: Configured: TCP_OPTIMIZE Derived: TCP_OPTIMIZE Peer: TCP_OPTIMIZE Negotiated: TCP_OPTIMIZE + DRE + LZ Applied: TCP_OPTIMIZE + DRE + LZ Accelerator Details: Configured: None Derived: None Applied: HTTP,SSL <-----Should see HTTP and SSL applied Hist: None Original Optimized -------------------- -------------------- Bytes Read: 5162 21874 Bytes Written: 1977819 5108 Total Reduction Ratio: 98.639% HTTP : 34 Time Statistics were Last Reset/Cleared: Thu Oct 28 14:47:56 2010 Total Bytes Read: 4620 1972570 Total Bytes Written: 4620 1972570 . . .
SSL : 34 Time Statistics were Last Reset/Cleared: Thu Oct 28 14:47:56 2010 Total Bytes Read: 0 0 Total Bytes Written: 0 0 . . . Hostname in HTTP CONNECT: <------ the last three counters apply only to IP Address in HTTP CONNECT: Proxy Connect type of HTTPS connections TCP Port in HTTP CONNECT:
要显示三个HTTP元数据缓存(重定向、条件和未授权)的内容,请使用show cache http-metadatacache all命令。仅显示完整URL和到期(以秒为单位)。您还可以使用以下命令分别显示三个缓存中每个缓存的内容:
上述命令的典型输出如下:
Redirect Cache Active entries: 1, Max Entries: 1500 URL: www.abcnews.com/, Expiration (sec): 3206 Conditional Cache Active entries: 6, Max Entries: 10500 URL: www.cisco.com/web/fw/i/quicklinks-rnd-corners.gif, Expiration (sec): 3594 URL: www.cisco.com/web/fw/i/hp-sprites.gif, Expiration (sec): 3594 URL: www.cisco.com/en/US/home/images/ba-actsGreen-logo.jpg, Expiration (sec): 3594 URL: www.cisco.com/en/US/home/images/fp-eos3.jpg, Expiration (sec): 3594 URL: www.cisco.com/en/US/home/images/fp-AP541n.jpg, Expiration (sec): 3594 URL: www.cisco.com/web/fw/c/home.min.css, Expiration (sec): 3592 Unauthorized Cache Active entries: 1, Max Entries: 3000 URL: l.yimg.com/index.html, Expiration (sec): 86393
可以使用clear cache http-metadatacache all命令清除三个缓存的内容。
如果要单独清除每个缓存的内容,可以使用以下命令:
如果要指定要删除的URL,可以使用以下命令:
clear cache http-metadatacache {all|redirect|conditional|unauthorized} URL
要显示三个HTTPS元数据缓存(重定向、条件和未授权)中的条目数,请使用show cache http-metadatacache https命令。与HTTP元数据缓存的对应命令不同,URL和过期时间不显示。您还可以使用以下命令分别显示三个缓存中每个缓存的条目数:
上述命令的典型输出如下:
HTTPS Redirect Cache Active HTTP entries: 0, Active HTTPS entries: 0 Max Entries: 3250 HTTPS Conditional Cache Active HTTP entries: 0, Active HTTPS entries: 11 Max Entries: 22750 HTTPS Unauthorized Cache Active HTTP entries: 0, Active HTTPS entries: 0 Max Entries: 6500
可以使用clear cache http-metadatacache https命令清除三个缓存的内容。
如果要单独清除每个缓存的内容,可以使用以下命令:
对于HTTP和HTTPS(版本4.3.1)304响应,元数据缓存支持所有缓存控制指令(缓存控制:no-cache、no-store、private、must-revalidate、proxy-revalidate、max-age=0、Pragma:无缓存)。 有一个选项可禁用此类缓存控制检查,这意味着所有304个具有指定不可缓存性的缓存控制报头的响应都被缓存,所有具有指定不可缓存性的缓存控制报头的请求都可以从本地缓存中提供。
了解禁用缓存控制检查可能会增加元数据缓存的优势,因为某些浏览器或Web服务器可能具有默认选项,将所有响应中包含一个缓存控制报头,以强制通过原始服务器对对象进行重新验证。这会使元数据缓存对304个响应无效。
该选项可以针对HTTP/S请求(缓存查找)和响应(缓存插入)独立控制。
要禁用对HTTP/S 304请求的缓存控制检查,请使用以下命令:
WAE#accelerator http metadatacache request-ignore-no-cache enable
此命令强制元数据缓存忽略HTTP/S 304请求中的所有缓存控制指令。(此命令的默认[no]形式强制元数据缓存执行HTTP/S 304请求中的所有Cache-Control指令。)
要禁用HTTP/S 304响应的缓存控制检查,请使用以下命令:
WAE#accelerator http metadatacache response-ignore-no-cache enable
此命令强制元数据缓存忽略HTTP/S 304响应中的所有缓存控制指令。(此命令的默认[no]形式强制元数据缓存执行HTTP/S 304响应中的所有Cache-Control指令。)
元数据缓存支持301和401响应的缓存控制报头。如果响应具有任何Cache-Control报头(no-cache、no-store、private、must-revalidate、proxy-revalidate、max-age=0、Pragma:no-cache),它不会缓存。
缓存的内容存在某些例外。当HTTP AO在正在处理的HTTP/S请求/响应中遇到以下条件之一时,缓存插入或查找不会发生:
以下日志文件可用于排除HTTP AO问题:
为便于调试,您应首先设置ACL,将数据包限制到一台主机。
WAE674(config)# ip access-list extended 150 permit tcp host 10.10.10.10 any WAE674(config)# ip access-list extended 150 permit tcp any host 10.10.10.10
要启用事务记录,请按如下方式使用transaction-logs配置命令:
wae(config)# transaction-logs flow enable wae(config)# transaction-logs flow access-list 150
您可以使用type-tail命令查看事务日志文件的结尾,如下所示:
wae# type-tail tfo_log_10.10.11.230_20090715_130000.txt Wed Jul 15 13:37:00 2009 :1529 :10.10.10.10 :2004 :10.10.100.100 :80 :OT :END :EXTERNAL CLIENT :(HTTP) :0 :0 :107 :117 Wed Jul 15 13:37:00 2009 :1529 :10.10.10.10 :1880 :10.10.100.100 :80 :SODRE :END :14357 :8406 :2181 :2761 :0 Wed Jul 15 13:38:19 2009 :1533 :10.10.10.10 :2008 :10.10.100.101 :135 :OT :START :EXTERNAL CLIENT :00.14.5e.84.24.5f :basic :Other :MS-EndPointMapper :F :(TFO) (TFO) (TFO) (TFO) (TFO) :<None> :(EPM) (EPM) (EPM) :<None> :<None> :0 :120 Wed Jul 15 13:38:19 2009 :1534 :10.10.10.10 :2009 :10.10.100.101 :1025 :OT :START :EXTERNAL CLIENT :00.14.5e.84.24.5f :uuide3514235-4b06-11d1-ab04-00c04fc2dcd2
要设置并启用HTTP AO的调试日志记录,请使用以下命令。
NOTE:调试日志记录占用大量CPU资源,并且可以生成大量输出。在生产环境中谨慎、谨慎地使用它。
您可以启用对磁盘的详细日志记录:
WAE674(config)# logging disk enable WAE674(config)# logging disk priority detail
您可以在ACL中为连接启用调试日志记录:
WAE674# debug connection access-list 150
HTTP AO调试(在4.2.1及更高版本上)的选项如下:
WAE674# debug accelerator http ? all enable all HTTP accelerator debugs bypass-list enable HTTP bypass-list debugs cli enable HTTP CLI debugs conditional-response enable HTTP metadatacache conditional (304) response debugs connection enable HTTP connection debugs dre-hints enable HTTP dre-hints debugs metadatacache enable HTTP metadatacache debugs prefetch enable HTTP prefetch debugs redirect-response enable HTTP metadatacache redirect (301) response debugs shell enable HTTP shell debugs suppress-server-encoding enable HTTP suppress-server-encoding debugs transaction enable HTTP transaction debugs unauthorized-response enable HTTP auth-optimization debugs bugs
您可以为HTTP连接启用调试日志记录,然后显示调试错误日志的结尾,如下所示:
WAE674# debug accelerator http connection WAE674# type-tail errorlog/httpao-errorlog.current follow