Web 服务器负载均衡深度解析：Nginx 配置实践

这是默认算法。请求按顺序逐一分配给后端服务器，直到循环结束。适合服务器配置相近且请求处理时间均匀的场景。

http {
    upstream backend {
        # 默认就是轮询算法
        server 192.168.1.101:8080;
        server 192.168.1.102:8080;
        server 192.168.1.103:8080;
    }

    server {
        listen 80;
        location / {
            proxy_pass http://backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_connect_timeout 5s;
            proxy_send_timeout 10s;
            proxy_read_timeout 30s;
            proxy_buffering on;
            proxy_buffer_size 4k;
            proxy_buffers 8 4k;
            proxy_busy_buffers_size 8k;
        }
    }
}

3.2 加权轮询算法（Weighted Round Robin）

如果后端服务器性能不一致，可以用权重控制流量分配。权重越高，分到的请求越多。

http {
    upstream backend {
        # 权重配置，数字越大分配的请求越多
        server 192.168.1.101:8080 weight=5; # 50% 的流量
        server 192.168.1.102:8080 weight=3; # 30% 的流量
        server 192.168.1.103:8080 weight=2; # 20% 的流量
    }

    server {
        listen 80;
        server_name app.example.com;

        log_format upstream_log '$remote_addr - $remote_user [$time_local] '
                                '"$request" $status $body_bytes_sent '
                                '"$http_referer" "$http_user_agent" '
                                'upstream: $upstream_addr '
                                'response_time: $upstream_response_time';
        access_log /var/log/nginx/access.log upstream_log;
        error_log /var/log/nginx/error.log warn;

        location / {
            proxy_pass http://backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host $host;
            proxy_set_header X-Forwarded-Port $server_port;
            proxy_cookie_path / "/; HttpOnly; Secure";
            proxy_set_header Cookie $http_cookie;
            proxy_buffer_size 128k;
            proxy_buffers 4 256k;
            proxy_busy_buffers_size 256k;
            proxy_connect_timeout 60s;
            proxy_send_timeout 60s;
            proxy_read_timeout 60s;
            proxy_redirect off;
            proxy_http_version 1.1;
            proxy_set_header Connection "";
        }

        location /health {
            access_log off;
            return 200 "healthy\n";
            add_header Content-Type text/plain;
        }
    }
}

3.3 IP 哈希算法（IP Hash）

基于客户端 IP 进行哈希，确保同一客户端总是访问同一后端服务器。这非常适合需要会话保持的应用。

http {
    upstream backend {
        ip_hash; # 启用 IP 哈希算法
        server 192.168.1.101:8080;
        server 192.168.1.102:8080;
        server 192.168.1.103:8080;
    }

    server {
        listen 80;
        location / {
            proxy_pass http://backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
        }
    }
}

如果需要一致性哈希（Nginx Plus 或第三方模块），可以使用 hash $remote_addr consistent;。

3.4 最少连接算法（Least Connections）

将新请求分配给当前连接数最少的服务器。这对长连接或处理时间差异大的场景特别有用。

http {
    upstream backend {
        least_conn; # 最少连接算法
        server 192.168.1.101:8080;
        server 192.168.1.102:8080;
        server 192.168.1.103:8080;
    }

    server {
        listen 80;
        location / {
            proxy_pass http://backend;
            proxy_set_header Host $host;
        }

        location /nginx_status {
            stub_status on;
            access_log off;
            allow 192.168.1.0/24;
            deny all;
        }
    }
}

4. 高级负载均衡配置

4.1 健康检查配置

被动健康检查通过 max_fails 和 fail_timeout 参数实现。当连续失败次数超过阈值，服务器会被暂时标记为不可用。

http {
    upstream backend {
        server 192.168.1.101:8080 max_fails=3 fail_timeout=30s;
        server 192.168.1.102:8080 max_fails=3 fail_timeout=30s;
        server 192.168.1.103:8080 max_fails=3 fail_timeout=30s;
        # 对于 Nginx Plus 或 OpenResty，支持主动健康检查
        # health_check interval=5s fails=3 passes=2;
    }

    server {
        listen 80;
        location / {
            proxy_pass http://backend;
            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
            proxy_next_upstream_tries 3;
            proxy_next_upstream_timeout 10s;
        }
    }
}

4.2 会话保持（Session Persistence）

除了 IP Hash，还可以利用 Cookie 实现更精确的会话保持。注意不同版本的 Nginx 支持程度不同。

http {
    # 方法 1：使用 IP 哈希
    upstream backend_ip_hash {
        ip_hash;
        server 192.168.1.101:8080;
        server 192.168.1.102:8080;
    }

    # 方法 2：使用 Cookie (需 nginx-sticky-module)
    upstream backend_sticky {
        sticky cookie srv_id expires=1h domain=.example.com path=/;
        server 192.168.1.101:8080;
        server 192.168.1.102:8080;
    }

    server {
        listen 80;
        location / {
            proxy_pass http://backend_app;
            proxy_set_header Cookie $http_cookie;
            proxy_cookie_path / "/; HttpOnly; Secure";
            proxy_set_header Authorization $http_authorization;
        }

        location ~* \.(jpg|jpeg|png|gif|ico|css|js)$ {
            expires 1y;
            add_header Cache-Control "public, immutable";
        }
    }
}

4.3 TCP/UDP 负载均衡

Nginx 的 stream 模块支持四层负载均衡，常用于数据库或 Redis 集群。

# TCP 负载均衡配置
stream {
    upstream backend_tcp {
        hash $remote_addr consistent;
        server 192.168.1.101:3306 weight=5;
        server 192.168.1.102:3306 weight=3;
        server 192.168.1.103:3306 weight=2;
    }

    server {
        listen 3307;
        proxy_pass backend_tcp;
        proxy_connect_timeout 5s;
        proxy_timeout 3600s;
        proxy_buffer_size 16k;
    }

    # UDP 负载均衡示例（DNS 服务器）
    upstream dns_servers {
        server 192.168.1.201:53;
        server 192.168.1.202:53;
    }

    server {
        listen 53 udp reuseport;
        proxy_pass dns_servers;
        proxy_timeout 1s;
        proxy_responses 1;
    }
}

5. 实战：完整的微服务负载均衡配置

5.1 多环境配置管理

生产环境建议将配置模块化，主配置文件引入子文件，便于维护。

# nginx.conf - 主配置文件
user nginx;
worker_processes auto;
worker_rlimit_nofile 65535;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
    worker_connections 4096;
    use epoll;
    multi_accept on;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for" '
                    'upstream_addr=$upstream_addr '
                    'upstream_status=$upstream_status '
                    'request_time=$request_time '
                    'upstream_response_time=$upstream_response_time';
    access_log /var/log/nginx/access.log main buffer=32k flush=5s;

    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    keepalive_requests 1000;
    client_max_body_size 10m;
    client_body_buffer_size 128k;

    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_comp_level 6;
    gzip_types text/plain text/css text/xml text/javascript application/json application/javascript application/xml+rss application/atom+xml image/svg+xml;

    include /etc/nginx/conf.d/upstreams/*.conf;
    include /etc/nginx/sites-enabled/*.conf;
}

5.2 上游服务器配置文件

针对不同服务定义独立的 upstream 块，并设置合理的权重和健康检查参数。

# /etc/nginx/conf.d/upstreams/backend.conf
# 用户服务集群
upstream user_service {
    zone user_service_zone 64k;
    least_conn;
    server 10.0.1.11:8080 weight=3 max_fails=2 fail_timeout=30s;
    server 10.0.1.12:8080 weight=3 max_fails=2 fail_timeout=30s;
    server 10.0.1.13:8080 weight=2 max_fails=2 fail_timeout=30s;
    server 10.0.1.14:8080 weight=2 max_fails=2 fail_timeout=30s;
    server 10.0.2.11:8080 backup;
}

# 订单服务集群
upstream order_service {
    zone order_service_zone 64k;
    ip_hash;
    server 10.0.1.21:8080;
    server 10.0.1.22:8080;
    server 10.0.1.23:8080;
}

# 支付服务集群
upstream payment_service {
    zone payment_service_zone 64k;
    server 10.0.1.31:8080 weight=5;
    server 10.0.1.32:8080 weight=5;
    server 10.0.1.33:8080 weight=3;
    server 10.0.1.34:8080 weight=3;
}

# API 网关配置
upstream api_gateway {
    zone api_gateway_zone 64k;
    hash $request_uri consistent;
    server 10.0.1.41:8080;
    server 10.0.1.42:8080;
    server 10.0.1.43:8080;
}

5.3 虚拟主机配置

结合 SSL、限流和安全头部的完整站点配置。

# /etc/nginx/sites-enabled/api.example.com.conf
server {
    listen 80;
    server_name api.example.com;

    listen 443 ssl http2;
    ssl_certificate /etc/ssl/certs/api.example.com.crt;
    ssl_certificate_key /etc/ssl/private/api.example.com.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    add_header X-Frame-Options SAMEORIGIN;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;

    location ~ ^/api/v1/users {
        limit_req zone=api_limit burst=20 nodelay;
        proxy_pass http://user_service;
        proxy_set_header X-API-Version v1;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_connect_timeout 5s;
        proxy_send_timeout 30s;
        proxy_read_timeout 30s;
        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
        proxy_next_upstream_tries 3;
    }

    location ~ ^/api/v1/orders {
        limit_req zone=api_limit burst=20 nodelay;
        proxy_pass http://order_service;
        proxy_set_header X-API-Version v1;
        proxy_set_header X-Session-ID $cookie_sessionid;
        proxy_cookie_path / "/; HttpOnly; Secure";
    }

    location ~ ^/api/v1/payments {
        limit_req zone=api_limit burst=10 nodelay;
        proxy_pass http://payment_service;
        proxy_set_header X-API-Version v1;
        proxy_connect_timeout 10s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }

    location = /auth {
        internal;
        proxy_pass http://auth_service;
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
        proxy_set_header X-Original-URI $request_uri;
    }

    location /health {
        access_log off;
        stub_status on;
        proxy_pass http://user_service/actuator/health;
        proxy_set_header Host $host;
    }

    location /metrics {
        access_log off;
        proxy_pass http://monitoring_service:9090;
        proxy_set_header Host $host;
        allow 10.0.0.0/8;
        deny all;
    }

    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        proxy_pass http://static_servers;
    }

    error_page 404 /404.html;
    error_page 500 502 503 504 /50x.html;
    location = /50x.html {
        root /usr/share/nginx/html;
    }
}

6. 性能优化与监控

6.1 Nginx 性能调优

针对高并发场景，调整 worker 进程、连接数和缓冲区是关键。

# /etc/nginx/nginx.conf - 优化版本
user nginx;
worker_processes auto;
worker_rlimit_nofile 100000;
error_log /var/log/nginx/error.log crit;
pid /run/nginx.pid;

events {
    worker_connections 65536;
    use epoll;
    multi_accept on;
    accept_mutex off;
}

http {
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    types_hash_max_size 2048;
    server_tokens off;

    keepalive_timeout 30;
    keepalive_requests 10000;
    reset_timedout_connection on;

    client_body_timeout 10;
    client_header_timeout 10;
    send_timeout 10;
    client_max_body_size 20m;
    client_body_buffer_size 256k;

    proxy_buffering on;
    proxy_buffer_size 32k;
    proxy_buffers 8 32k;
    proxy_busy_buffers_size 64k;
    proxy_temp_file_write_size 64k;

    gzip on;
    gzip_vary on;
    gzip_min_length 256;
    gzip_comp_level 5;
    gzip_types *;

    open_file_cache max=100000 inactive=20s;
    open_file_cache_valid 30s;
    open_file_cache_min_uses 2;
    open_file_cache_errors on;

    ssl_session_cache shared:SSL:50m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;

    limit_req_zone $binary_remote_addr zone=perip:10m rate=100r/s;
    limit_req_zone $server_name zone=perserver:10m rate=1000r/s;

    include /etc/nginx/conf.d/*.conf;
}

6.2 监控配置

编写简单的 Shell 脚本定期检查 Nginx 状态和错误日志，有助于快速发现问题。

#!/bin/bash
# monitor_nginx.sh - Nginx 监控脚本
NGINX_STATUS_URL="http://localhost/nginx_status"

check_nginx_process(){
    if pgrep -x "nginx"> /dev/null; then
        echo "✅ Nginx 进程运行正常"
        return 0
    else
        echo "❌ Nginx 进程未运行"
        return 1
    fi
}

get_nginx_status(){
    curl -s $NGINX_STATUS_URL | while read line; do
        case $line in
            Active*) echo "活跃连接：$(echo $line |awk '{print $3}')";;
            accepts*) echo "已接受连接：$(echo $line |awk '{print $2}')";;
            handled*) echo "已处理连接：$(echo $line |awk '{print $2}')";;
            requests*) echo "总请求数：$(echo $line |awk '{print $2}')";;
            Reading*) echo "正在读取的连接：$(echo $line |awk '{print $2}')"
                      echo "正在写入的连接：$(echo $line |awk '{print $4}')"
                      echo "空闲连接：$(echo $line |awk '{print $6}')";;
        esac
    done
}

main(){
    echo "Nginx 负载均衡监控报告"
    echo "======================"
    echo "时间：$(date)"
    echo ""
    check_nginx_process
    if [ $? -eq 0 ]; then
        echo ""
        get_nginx_status
    fi
}

main

6.3 Prometheus + Grafana 监控仪表板

集成 Prometheus 可以更方便地可视化指标和设置告警。

# prometheus.yml - Nginx 监控配置
global:
  scrape_interval: 15s
  evaluation_interval: 15s

scrape_configs:
  - job_name: 'nginx'
    static_configs:
      - targets: ['localhost:9113']
    metrics_path: /metrics
    scrape_interval: 10s

  - job_name: 'nginx_status'
    static_configs:
      - targets: ['nginx-host:80']
    metrics_path: /nginx_status
    params:
      format: [prometheus]

  - job_name: 'node_exporter'
    static_configs:
      - targets: ['nginx-host:9100']

# nginx_alerts.yml - 告警规则
groups:
  - name: nginx_alerts
    rules:
      - alert: NginxDown
        expr: nginx_up == 0
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "Nginx 实例下线"
          description: "{{ $labels.instance }} 上的 Nginx 已经下线超过 1 分钟"

      - alert: HighErrorRate
        expr: rate(nginx_http_requests_total{status=~"5.."}[5m]) / rate(nginx_http_requests_total[5m]) > 0.05
        for: 2m
        labels:
          severity: warning
        annotations:
          summary: "高错误率"
          description: "{{ $labels.instance }} 的 5xx 错误率超过 5%"

      - alert: HighRequestLatency
        expr: histogram_quantile(0.95, rate(nginx_http_request_duration_seconds_bucket[5m])) > 1
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "高请求延迟"
          description: "{{ $labels.instance }} 的 95% 请求延迟超过 1 秒"

7. 故障排除与最佳实践

7.1 常见问题排查

遇到异常时，先检查配置语法，再看进程状态和端口监听情况。

#!/bin/bash
# nginx_troubleshoot.sh - Nginx 故障排查工具
echo "=== Nginx 负载均衡故障排查工具 ==="
echo ""

# 1. 检查 Nginx 配置
echo "1. 检查 Nginx 配置语法..."
nginx -t
echo ""

# 2. 检查 Nginx 进程
echo "2. 检查 Nginx 进程状态..."
ps aux | grep nginx | grep -v grep
echo ""

# 3. 检查监听端口
echo "3. 检查 Nginx 监听端口..."
netstat -tlnp | grep nginx
echo ""

# 4. 检查上游服务器连通性
echo "4. 检查上游服务器连通性..."
UPSTREAM_FILE="/etc/nginx/conf.d/upstreams/backend.conf"
if [ -f "$UPSTREAM_FILE" ]; then
    echo "找到上游配置：$UPSTREAM_FILE"
    grep "server " $UPSTREAM_FILE | while read line; do
        host=$(echo $line |awk '{print $2}'|cut -d: -f1)
        port=$(echo $line |awk '{print $2}'|cut -d: -f2)
        echo -n "检查 $host:$port ... "
        nc -z -w 3 $host $port && echo "✅ 正常" || echo "❌ 失败"
    done
fi
echo ""

# 5. 检查负载均衡状态
echo "5. 检查负载均衡状态..."
if curl -s http://localhost/nginx_status > /dev/null; then
    echo "Nginx 状态页面可访问"
    curl -s http://localhost/nginx_status
else
    echo "Nginx 状态页面不可访问"
fi
echo ""

# 6. 检查日志文件
echo "6. 检查最近的错误日志..."
tail -20 /var/log/nginx/error.log
echo ""

# 7. 检查系统资源
echo "7. 检查系统资源使用情况..."
echo "内存使用:"
free -h
echo ""
echo "CPU 使用:"
top -bn1 | grep "Cpu(s)"
echo ""
echo "连接数统计:"
netstat -an | grep :80 | wc -l

7.2 最佳实践总结

• 配置管理：使用 include 指令模块化配置，配合版本控制系统。
• 安全加固：启用 HTTPS 和 HTTP/2，配置安全头部，限制访问频率。
• 性能优化：根据 CPU 核心数设置 worker_processes，调整文件描述符限制，启用 Gzip 压缩。
• 监控告警：集成 Prometheus，设置关键指标告警，定期分析日志。
• 高可用部署：多台 Nginx 组成集群，配置 Keepalived 实现 VIP 漂移。

8. 总结

Nginx 作为高性能的负载均衡器，在现代 Web 架构中扮演着至关重要的角色。通过合理的配置和优化，可以实现高并发处理、智能路由、故障容错以及灵活扩展。

实际应用中，建议从简单配置开始，逐步增加复杂度。充分测试各种负载均衡算法，建立完善的监控和告警体系，并定期进行性能压测和优化。根据具体业务需求进行调整，才能让负载均衡发挥最大价值。