{"action":"created","issue":{"url":"https://api.github.com/repos/SpiderLabs/ModSecurity-nginx/issues/35","repository_url":"https://api.github.com/repos/SpiderLabs/ModSecurity-nginx","labels_url":"https://api.github.com/repos/SpiderLabs/ModSecurity-nginx/issues/35/labels{/name}","comments_url":"https://api.github.com/repos/SpiderLabs/ModSecurity-nginx/issues/35/comments","events_url":"https://api.github.com/repos/SpiderLabs/ModSecurity-nginx/issues/35/events","html_url":"https://github.com/SpiderLabs/ModSecurity-nginx/issues/35","id":210292583,"number":35,"title":"Poor performance with modsecurity enabled","user":{"login":"mimugmail","id":20438689,"avatar_url":"https://avatars0.githubusercontent.com/u/20438689?v=3","gravatar_id":"","url":"https://api.github.com/users/mimugmail","html_url":"https://github.com/mimugmail","followers_url":"https://api.github.com/users/mimugmail/followers","following_url":"https://api.github.com/users/mimugmail/following{/other_user}","gists_url":"https://api.github.com/users/mimugmail/gists{/gist_id}","starred_url":"https://api.github.com/users/mimugmail/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mimugmail/subscriptions","organizations_url":"https://api.github.com/users/mimugmail/orgs","repos_url":"https://api.github.com/users/mimugmail/repos","events_url":"https://api.github.com/users/mimugmail/events{/privacy}","received_events_url":"https://api.github.com/users/mimugmail/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"zimmerle","id":428268,"avatar_url":"https://avatars0.githubusercontent.com/u/428268?v=3","gravatar_id":"","url":"https://api.github.com/users/zimmerle","html_url":"https://github.com/zimmerle","followers_url":"https://api.github.com/users/zimmerle/followers","following_url":"https://api.github.com/users/zimmerle/following{/other_user}","gists_url":"https://api.github.com/users/zimmerle/gists{/gist_id}","starred_url":"https://api.github.com/users/zimmerle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zimmerle/subscriptions","organizations_url":"https://api.github.com/users/zimmerle/orgs","repos_url":"https://api.github.com/users/zimmerle/repos","events_url":"https://api.github.com/users/zimmerle/events{/privacy}","received_events_url":"https://api.github.com/users/zimmerle/received_events","type":"User","site_admin":false},"assignees":[{"login":"zimmerle","id":428268,"avatar_url":"https://avatars0.githubusercontent.com/u/428268?v=3","gravatar_id":"","url":"https://api.github.com/users/zimmerle","html_url":"https://github.com/zimmerle","followers_url":"https://api.github.com/users/zimmerle/followers","following_url":"https://api.github.com/users/zimmerle/following{/other_user}","gists_url":"https://api.github.com/users/zimmerle/gists{/gist_id}","starred_url":"https://api.github.com/users/zimmerle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zimmerle/subscriptions","organizations_url":"https://api.github.com/users/zimmerle/orgs","repos_url":"https://api.github.com/users/zimmerle/repos","events_url":"https://api.github.com/users/zimmerle/events{/privacy}","received_events_url":"https://api.github.com/users/zimmerle/received_events","type":"User","site_admin":false}],"milestone":null,"comments":16,"created_at":"2017-02-26T06:51:17Z","updated_at":"2017-03-31T14:39:49Z","closed_at":null,"body":"As suggested within issues https://github.com/SpiderLabs/ModSecurity/issues/1318 I'll open a new one here. With MS enabled with the current codebase the performance test with \"ab\" from apache2-utils is not going over 300req/s.\r\n\r\nWith a virtual machine on Virtualbox with 4 cores and 4gb ram:\r\n```\r\nroot@nginx:~# ab -n 10000 -c 20 -k http://127.0.0.1:80/\r\nThis is ApacheBench, Version 2.3 <$Revision: 1604373 $>\r\nCopyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/\r\nLicensed to The Apache Software Foundation, http://www.apache.org/\r\n\r\nBenchmarking 127.0.0.1 (be patient)\r\nCompleted 1000 requests\r\nCompleted 2000 requests\r\nCompleted 3000 requests\r\nCompleted 4000 requests\r\nCompleted 5000 requests\r\nCompleted 6000 requests\r\nCompleted 7000 requests\r\nCompleted 8000 requests\r\nCompleted 9000 requests\r\nCompleted 10000 requests\r\nFinished 10000 requests\r\n\r\n\r\nServer Software:        nginx/1.11.9\r\nServer Hostname:        127.0.0.1\r\nServer Port:            80\r\n\r\nDocument Path:          /\r\nDocument Length:        612 bytes\r\n\r\nConcurrency Level:      20\r\nTime taken for tests:   73.444 seconds\r\nComplete requests:      10000\r\nFailed requests:        0\r\nKeep-Alive requests:    9909\r\nTotal transferred:      8499545 bytes\r\nHTML transferred:       6120000 bytes\r\nRequests per second:    136.16 [#/sec] (mean)\r\nTime per request:       146.889 [ms] (mean)\r\nTime per request:       7.344 [ms] (mean, across all concurrent requests)\r\nTransfer rate:          113.02 [Kbytes/sec] received\r\n\r\nConnection Times (ms)\r\n              min  mean[+/-sd] median   max\r\nConnect:        0    0   0.0      0       0\r\nProcessing:    14  147  31.7    141    1308\r\nWaiting:       14  147  31.7    141    1308\r\nTotal:         14  147  31.7    141    1308\r\n\r\nPercentage of the requests served within a certain time (ms)\r\n  50%    141\r\n  66%    147\r\n  75%    151\r\n  80%    154\r\n  90%    166\r\n  95%    188\r\n  98%    207\r\n  99%    232\r\n 100%   1308 (longest request)\r\n```\r\n\r\nAnd without:\r\n\r\n```\r\nroot@nginx:~# /opt/nginx/sbin/nginx\r\nroot@nginx:~# ab -n 10000 -c 20 -k http://127.0.0.1:80/\r\nThis is ApacheBench, Version 2.3 <$Revision: 1604373 $>\r\nCopyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/\r\nLicensed to The Apache Software Foundation, http://www.apache.org/\r\n\r\nBenchmarking 127.0.0.1 (be patient)\r\nCompleted 1000 requests\r\nCompleted 2000 requests\r\nCompleted 3000 requests\r\nCompleted 4000 requests\r\nCompleted 5000 requests\r\nCompleted 6000 requests\r\nCompleted 7000 requests\r\nCompleted 8000 requests\r\nCompleted 9000 requests\r\nCompleted 10000 requests\r\nFinished 10000 requests\r\n\r\n\r\nServer Software:        nginx/1.11.9\r\nServer Hostname:        127.0.0.1\r\nServer Port:            80\r\n\r\nDocument Path:          /\r\nDocument Length:        612 bytes\r\n\r\nConcurrency Level:      20\r\nTime taken for tests:   0.197 seconds\r\nComplete requests:      10000\r\nFailed requests:        0\r\nKeep-Alive requests:    9909\r\nTotal transferred:      8499545 bytes\r\nHTML transferred:       6120000 bytes\r\nRequests per second:    50755.75 [#/sec] (mean)\r\nTime per request:       0.394 [ms] (mean)\r\nTime per request:       0.020 [ms] (mean, across all concurrent requests)\r\nTransfer rate:          42128.99 [Kbytes/sec] received\r\n\r\nConnection Times (ms)\r\n              min  mean[+/-sd] median   max\r\nConnect:        0    0   0.0      0       0\r\nProcessing:     0    0   0.3      0       5\r\nWaiting:        0    0   0.3      0       5\r\nTotal:          0    0   0.3      0       5\r\n\r\nPercentage of the requests served within a certain time (ms)\r\n  50%      0\r\n  66%      0\r\n  75%      0\r\n  80%      0\r\n  90%      0\r\n  95%      1\r\n  98%      1\r\n  99%      2\r\n 100%      5 (longest request)\r\n```\r\n\r\nI tested this also with Nginx+ but then the tool stucks a 90%, no mather how many requests (20 cores and 64GB ram):\r\n\r\n```\r\nThis is ApacheBench, Version 2.3 <$Revision: 1604373 $>\r\nCopyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/\r\nLicensed to The Apache Software Foundation, http://www.apache.org/\r\n\r\nBenchmarking 127.0.0.1 (be patient)\r\nCompleted 100 requests\r\nCompleted 200 requests\r\nCompleted 300 requests\r\nCompleted 400 requests\r\nCompleted 500 requests\r\nCompleted 600 requests\r\nCompleted 700 requests\r\nCompleted 800 requests\r\nCompleted 900 requests\r\napr_pollset_poll: The timeout specified has expired (70007)\r\nTotal of 999 requests completed\r\n```\r\n\r\nBut with just 100 it's ok:\r\n\r\n```\r\nServer Software:        nginx\r\nServer Hostname:        127.0.0.1\r\nServer Port:            80\r\n\r\nDocument Path:          /\r\nDocument Length:        162 bytes\r\n\r\nConcurrency Level:      20\r\nTime taken for tests:   0.243 seconds\r\nComplete requests:      100\r\nFailed requests:        0\r\nNon-2xx responses:      100\r\nKeep-Alive requests:    100\r\nTotal transferred:      31000 bytes\r\nHTML transferred:       16200 bytes\r\nRequests per second:    410.71 [#/sec] (mean)\r\nTime per request:       48.696 [ms] (mean)\r\nTime per request:       2.435 [ms] (mean, across all concurrent requests)\r\nTransfer rate:          124.34 [Kbytes/sec] received\r\n\r\nConnection Times (ms)\r\n              min  mean[+/-sd] median   max\r\nConnect:        0    0   0.7      0       3\r\nProcessing:     3   42  34.6     58      99\r\nWaiting:        3   42  34.6     58      99\r\nTotal:          3   42  34.6     60      99\r\n\r\nPercentage of the requests served within a certain time (ms)\r\n  50%     60\r\n  66%     66\r\n  75%     70\r\n  80%     74\r\n  90%     86\r\n  95%     92\r\n  98%     97\r\n  99%     99\r\n 100%     99 (longest request)\r\n```\r\n\r\nPerhaps others can post their results too.\r\n\r\nAh, I also tried to disable logging but it doens't affect the performance at all."},"comment":{"url":"https://api.github.com/repos/SpiderLabs/ModSecurity-nginx/issues/comments/290730534","html_url":"https://github.com/SpiderLabs/ModSecurity-nginx/issues/35#issuecomment-290730534","issue_url":"https://api.github.com/repos/SpiderLabs/ModSecurity-nginx/issues/35","id":290730534,"user":{"login":"AnoopAlias","id":8059431,"avatar_url":"https://avatars0.githubusercontent.com/u/8059431?v=3","gravatar_id":"","url":"https://api.github.com/users/AnoopAlias","html_url":"https://github.com/AnoopAlias","followers_url":"https://api.github.com/users/AnoopAlias/followers","following_url":"https://api.github.com/users/AnoopAlias/following{/other_user}","gists_url":"https://api.github.com/users/AnoopAlias/gists{/gist_id}","starred_url":"https://api.github.com/users/AnoopAlias/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AnoopAlias/subscriptions","organizations_url":"https://api.github.com/users/AnoopAlias/orgs","repos_url":"https://api.github.com/users/AnoopAlias/repos","events_url":"https://api.github.com/users/AnoopAlias/events{/privacy}","received_events_url":"https://api.github.com/users/AnoopAlias/received_events","type":"User","site_admin":false},"created_at":"2017-03-31T14:39:49Z","updated_at":"2017-03-31T14:39:49Z","body":"2G KVM VPS  1vcore\r\n\r\n```\r\n ab -n 10000 -c 20 -k http://theo.in/\r\nThis is ApacheBench, Version 2.3 <$Revision: 1706008 $>\r\nCopyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/\r\nLicensed to The Apache Software Foundation, http://www.apache.org/\r\n\r\nBenchmarking theo.in (be patient)\r\nCompleted 1000 requests\r\nCompleted 2000 requests\r\nCompleted 3000 requests\r\nCompleted 4000 requests\r\nCompleted 5000 requests\r\nCompleted 6000 requests\r\nCompleted 7000 requests\r\nCompleted 8000 requests\r\nCompleted 9000 requests\r\nCompleted 10000 requests\r\nFinished 10000 requests\r\n\r\n\r\nServer Software:        XtendWeb-nginx\r\nServer Hostname:        theo.in\r\nServer Port:            80\r\n\r\nDocument Path:          /\r\nDocument Length:        623 bytes\r\n\r\nConcurrency Level:      20\r\nTime taken for tests:   156.437 seconds\r\nComplete requests:      10000\r\nFailed requests:        0\r\nKeep-Alive requests:    9908\r\nTotal transferred:      8149540 bytes\r\nHTML transferred:       6230000 bytes\r\nRequests per second:    63.92 [#/sec] (mean)\r\nTime per request:       312.873 [ms] (mean)\r\nTime per request:       15.644 [ms] (mean, across all concurrent requests)\r\nTransfer rate:          50.87 [Kbytes/sec] received\r\n\r\nConnection Times (ms)\r\n              min  mean[+/-sd] median   max\r\nConnect:        0    3  28.2      0     465\r\nProcessing:   190  310  74.8    297     688\r\nWaiting:      190  310  74.8    297     688\r\nTotal:        190  313  80.7    298     959\r\n\r\nPercentage of the requests served within a certain time (ms)\r\n  50%    298\r\n  66%    327\r\n  75%    346\r\n  80%    359\r\n  90%    401\r\n  95%    468\r\n  98%    556\r\n  99%    599\r\n 100%    959 (longest request)\r\n\r\n```\r\n\r\n\r\n```\r\n# nginx -V\r\nnginx version: nginx/1.11.12\r\nbuilt by gcc 4.8.5 20150623 (Red Hat 4.8.5-11) (GCC) \r\nbuilt with LibreSSL 2.5.1\r\nTLS SNI support enabled\r\nconfigure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/etc/nginx/modules --with-pcre=./pcre-8.40 --with-pcre-jit --with-zlib=./zlib-1.2.11 --with-openssl=./libressl-2.5.1 --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error_log --http-log-path=/var/log/nginx/access_log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nobody --group=nobody --with-http_ssl_module --with-http_realip_module --with-http_addition_module --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_stub_status_module --with-http_auth_request_module --add-dynamic-module=naxsi-http2/naxsi_src --with-file-aio --with-threads --with-stream --with-stream_ssl_module --with-http_slice_module --with-compat --with-http_v2_module --with-http_geoip_module=dynamic --add-dynamic-module=ngx_pagespeed-release-1.11.33.4-beta --add-dynamic-module=/usr/local/rvm/gems/ruby-2.3.1/gems/passenger-5.1.2/src/nginx_module --add-dynamic-module=ngx_brotli --add-dynamic-module=echo-nginx-module-0.60 --add-dynamic-module=headers-more-nginx-module-0.32 --add-dynamic-module=ngx_http_redis-0.3.8 --add-dynamic-module=redis2-nginx-module --add-dynamic-module=srcache-nginx-module-0.31 --add-dynamic-module=ngx_devel_kit-0.3.0 --add-dynamic-module=set-misc-nginx-module-0.31 --add-dynamic-module=ModSecurity-nginx --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic' --with-ld-opt=-Wl,-E\r\n```\r\n\r\n\r\n[nginx_conf.txt](https://github.com/SpiderLabs/ModSecurity-nginx/files/885984/nginx_conf.txt)\r\n"}}
{"actor":{"display_login":"AnoopAlias"}}