Module ngx_http_upstream_module

Example Configuration
Directives
     upstream
     server
     zone
     hash
     ip_hash
     keepalive
     least_conn
     health_check
     match
     queue
     sticky
     sticky_cookie_insert
     upstream_conf
Embedded Variables

The ngx_http_upstream_module module is used to define groups of servers that can be referenced by the proxy_pass, fastcgi_pass, uwsgi_pass, scgi_pass, and memcached_pass directives.

Example Configuration

upstream backend {
    server backend1.example.com       weight=5;
    server backend2.example.com:8080;
    server unix:/tmp/backend3;

    server backup1.example.com:8080   backup;
    server backup2.example.com:8080   backup;
}

server {
    location / {
        proxy_pass http://backend;
    }
}

Dynamically configurable group, available as part of our commercial subscription:

upstream dynamic {
    zone upstream_dynamic 64k;

    server backend1.example.com      weight=5;
    server backend2.example.com:8080 fail_timeout=5s slow_start=30s;
    server 192.0.2.1                 max_fails=3;

    server backup1.example.com:8080  backup;
    server backup2.example.com:8080  backup;
}

server {
    location / {
        proxy_pass http://dynamic;
        health_check;
    }

    location /upstream_conf {
        upstream_conf;
        allow 127.0.0.1;
        deny all;
    }
}

Directives

Syntax: upstream name { ... }
Default:
Context: http

Defines a group of servers. Servers can listen on different ports. In addition, servers listening on TCP and UNIX-domain sockets can be mixed.

Example:

upstream backend {
    server backend1.example.com weight=5;
    server 127.0.0.1:8080       max_fails=3 fail_timeout=30s;
    server unix:/tmp/backend3;

    server backup1.example.com  backup;
}

By default, requests are distributed between the servers using a weighted round-robin balancing method. In the above example, each 7 requests will be distributed as follows: 5 requests go to backend1.example.com and one request to each of the second and third servers. If an error occurs during communication with a server, the request will be passed to the next server, and so on until all of the functioning servers will be tried. If a successful response could not be obtained from any of the servers, the client will receive the result of the communication with the last server.

Syntax: server address [parameters];
Default:
Context: upstream

Defines the address and other parameters of a server. The address can be specified as a domain name or IP address, with an optional port, or as a UNIX-domain socket path specified after the “unix:” prefix. If a port is not specified, the port 80 is used. A domain name that resolves to several IP addresses defines multiple servers at once.

The following parameters can be defined:

weight=number
sets the weight of the server, by default, 1.
max_fails=number
sets the number of unsuccessful attempts to communicate with the server that should happen in the duration set by the fail_timeout parameter to consider the server unavailable for a duration also set by the fail_timeout parameter. By default, the number of unsuccessful attempts is set to 1. The zero value disables the accounting of attempts. What is considered an unsuccessful attempt is defined by the proxy_next_upstream, fastcgi_next_upstream, uwsgi_next_upstream, scgi_next_upstream, and memcached_next_upstream directives.
fail_timeout=time
sets
  • the time during which the specified number of unsuccessful attempts to communicate with the server should happen to consider the server unavailable;
  • and the period of time the server will be considered unavailable.
By default, the parameter is set to 10 seconds.
backup
marks the server as a backup server. It will be passed requests when the primary servers are unavailable.
down
marks the server as permanently unavailable; used along with the ip_hash directive.

Additionally, the following parameters are available as part of our commercial subscription:

max_conns=number
limits the maximum number of simultaneous connections to the proxied server (1.5.9). Default value is zero, meaning there is no limit.
resolve
monitors changes of the IP addresses that correspond to a domain name of the server, and automatically modifies the upstream configuration without the need of restarting nginx (1.5.12).

In order for this parameter to work, the resolver directive must be specified in the http block. Example:

http {
    resolver 10.0.0.1;

    upstream u {
        zone ...;
        ...
        server example.com resolve;
    }
}

route=string
sets the server route name.
slow_start=time
sets the time during which the server will recover its weight from zero to a nominal value, when unhealthy server becomes healthy, or when the server becomes available after a period of time it was considered unavailable. Default value is zero, i.e. slow start is disabled.

If there is only a single server in a group, max_fails, fail_timeout and slow_start parameters are ignored, and such a server will never be considered unavailable.

Syntax: zone name size;
Default:
Context: upstream

Defines the name and size of the shared memory zone that keeps the group’s configuration and run-time state that are shared between worker processes. Such groups allow changing the group membership or modifying the settings of a particular server without the need of restarting nginx. The configuration is accessible via a special location handled by upstream_conf.

This directive is available as part of our commercial subscription.

Syntax: hash key [consistent];
Default:
Context: upstream

This directive appeared in version 1.7.2.

Specifies a load balancing method for a server group where client-server mapping is based on the hashed key value. The key can contain text, variables, and their combinations. Note that adding or removing a server from the group may result in remapping most of the keys to different servers. The method is compatible with the Cache::Memcached Perl library.

The consistent parameter specifies that the ketama consistent hashing method should be used instead. The method ensures that only a few keys will be remapped to different servers when a server is added to or removed from the group. This helps to achieve a higher cache hit ratio for caching servers. The method is compatible with the Cache::Memcached::Fast Perl library with the ketama_points parameter set to 160.

Syntax: ip_hash;
Default:
Context: upstream

Specifies that a group should use a load balancing method where requests are distributed between servers based on client IP addresses. The first three octets of the client IPv4 address, or the entire IPv6 address, are used as a hashing key. The method ensures that requests from the same client will always be passed to the same server except when this server is unavailable. In the latter case client requests will be passed to another server. Most probably, it will always be the same server as well.

IPv6 addresses are supported starting from versions 1.3.2 and 1.2.2.

If one of the servers needs to be temporarily removed, it should be marked with the down parameter in order to preserve the current hashing of client IP addresses.

Example:

upstream backend {
    ip_hash;

    server backend1.example.com;
    server backend2.example.com;
    server backend3.example.com down;
    server backend4.example.com;
}

Until versions 1.3.1 and 1.2.2, it was not possible to specify a weight for servers using the ip_hash load balancing method.

Syntax: keepalive connections;
Default:
Context: upstream

This directive appeared in version 1.1.4.

Activates the cache for connections to upstream servers.

The connections parameter sets the maximum number of idle keepalive connections to upstream servers that are preserved in the cache of each worker process. When this number is exceeded, the least recently used connections are closed.

It should be particularly noted that the keepalive directive does not limit the total number of connections to upstream servers that an nginx worker process can open. The connections parameter should be set to a number small enough to let upstream servers process new incoming connections as well.

Example configuration of memcached upstream with keepalive connections:

upstream memcached_backend {
    server 127.0.0.1:11211;
    server 10.0.0.2:11211;

    keepalive 32;
}

server {
    ...

    location /memcached/ {
        set $memcached_key $uri;
        memcached_pass memcached_backend;
    }

}

For HTTP, the proxy_http_version directive should be set to “1.1” and the “Connection” header field should be cleared:

upstream http_backend {
    server 127.0.0.1:8080;

    keepalive 16;
}

server {
    ...

    location /http/ {
        proxy_pass http://http_backend;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        ...
    }
}

Alternatively, HTTP/1.0 persistent connections can be used by passing the “Connection: Keep-Alive” header field to an upstream server, though this method is not recommended.

For FastCGI servers, it is required to set fastcgi_keep_conn for keepalive connections to work:

upstream fastcgi_backend {
    server 127.0.0.1:9000;

    keepalive 8;
}

server {
    ...

    location /fastcgi/ {
        fastcgi_pass fastcgi_backend;
        fastcgi_keep_conn on;
        ...
    }
}

When using load balancer methods other than the default round-robin method, it is necessary to activate them before the keepalive directive.

SCGI and uwsgi protocols do not have a notion of keepalive connections.

Syntax: least_conn;
Default:
Context: upstream

This directive appeared in versions 1.3.1 and 1.2.2.

Specifies that a group should use a load balancing method where a request is passed to the server with the least number of active connections, taking into account weights of servers. If there are several such servers, they are tried in turn using a weighted round-robin balancing method.

Syntax: health_check [parameters];
Default:
Context: location

Enables periodic health checks of the servers in a group referenced in the surrounding location.

The following optional parameters are supported:

interval=time
sets the interval between two consecutive health checks, by default, 5 seconds;
fails=number
sets the number of consecutive failed health checks of a particular server after which this server will be considered unhealthy, by default, 1;
passes=number
sets the number of consecutive passed health checks of a particular server after which the server will be considered healthy, by default, 1;
uri=uri
defines the URI used in health check requests, by default, “/”;
match=name
specifies the match block configuring the tests that a response should pass in order for a health check to pass; by default, the response should have status code 2xx or 3xx.

For example,

location / {
    proxy_pass http://backend;
    health_check;
}

will send “/” requests to each server in the backend group every five seconds. If any communication error or timeout occurs, or a proxied server responds with the status code other than 2xx or 3xx, the health check will fail, and the server will be considered unhealthy. Client requests are not passed to unhealthy servers.

Health checks can be configured to test the status code of a response, presence of certain header fields and their values, and the body contents. Tests are configured separately using the match directive and referenced in the match parameter. For example:

http {
    server {
    ...
        location / {
            proxy_pass http://backend;
            health_check match=welcome;
        }
    }

    match welcome {
        status 200;
        header Content-Type = text/html;
        body ~ "Welcome to nginx!";
    }
}

This configuration tells that for a health check to pass, the response to a health check request should succeed, have status 200, content type “text/html”, and contain “Welcome to nginx!” in the body.

The server group must reside in the shared memory.

If several health checks are defined for the same group of servers, a single failure of any check will make the corresponding server be considered unhealthy.

This directive is available as part of our commercial subscription.

Syntax: match name { ... }
Default:
Context: http

Defines the named test set used to verify responses to health check requests.

The following items can be tested in a response:

status 200;
status is 200
status ! 500;
status is not 500
status 200 204;
status is 200 or 204
status ! 301 302;
status is neither 301 nor 302
status 200-399;
status is in the range from 200 to 399
status ! 400-599;
status is not in the range from 400 to 599
status 301-303 307;
status is either 301, 302, 303, or 307

header Content-Type = text/html;
header contains “Content-Type” with value text/html
header Content-Type != text/html;
header contains “Content-Type” with value other than text/html
header Connection ~ close;
header contains “Connection” with value matching regular expression close
header Connection !~ close;
header contains “Connection” with value not matching regular expression close
header Host;
header contains “Host”
header ! X-Accel-Redirect;
header lacks “X-Accel-Redirect”

body ~ "Welcome to nginx!";
body matches regular expression “Welcome to nginx!
body !~ "Welcome to nginx!";
body does not match regular expression “Welcome to nginx!

If several tests are specified, the response matches only if it matches all tests.

Only the first 256k of the response body are examined.

Examples:

# status is 200, content type is "text/html",
# and body contains "Welcome to nginx!"
match welcome {
    status 200;
    header Content-Type = text/html;
    body ~ "Welcome to nginx!";
}

# status is not one of 301, 302, 303, or 307, and header does not have "Refresh:"
match not_redirect {
    status ! 301-303 307;
    header ! Refresh;
}

# status ok and not in maintenance mode
match server_ok {
    status 200-399;
    body !~ "maintenance mode";
}

This directive is available as part of our commercial subscription.

Syntax: queue number [timeout=time];
Default:
Context: upstream

This directive appeared in version 1.5.12.

If an upstream server cannot be selected immediately while processing a request, and there are the servers in the group that have reached the max_conns limit, the request will be placed into the queue. The directive specifies the maximum number of requests that can be in the queue at the same time. If the queue is filled up, or the server to pass the request to cannot been selected within the time period specified in the timeout parameter, an error will be returned to the client.

The default value of the timeout parameter is 60 seconds.

This directive is available as part of our commercial subscription.

Syntax: sticky cookie name [expires=time] [domain=domain] [path=path];
sticky route $variable ...;
sticky learn create=$variable lookup=$variable zone=name:size [timeout=time];
Default:
Context: upstream

This directive appeared in version 1.5.7.

Enables session affinity, which causes requests from the same client to be passed to the same server in a group of servers. Three methods are available:

When the cookie method is used, information about the designated server is passed in an HTTP cookie generated by nginx:

upstream backend {
    server backend1.example.com;
    server backend2.example.com;

    sticky cookie srv_id expires=1h domain=.example.com path=/;
}

A request that comes from a client not yet bound to a particular server is passed to the server selected by the configured balancing method. Further requests with this cookie will be passed to the designated server. If the designated server cannot process a request, the new server is selected as if the client has not been bound yet.

The first parameter sets the name of the cookie to be set or inspected. Additional parameters may be as follows:

expires
Sets the time for which a browser should keep the cookie. The special value max will cause the cookie to expire on “31 Dec 2037 23:55:55 GMT”. If the parameter is not specified, it will cause the cookie to expire at the end of a browser session.
domain
Defines the domain for which the cookie is set.
path
Defines the path for which the cookie is set.

If any parameters are omitted, the corresponding cookie fields are not set.

route

When the route method is used, proxied server assigns client a route on receipt of the first request. All subsequent requests from this client will carry routing information in a cookie or URI. This information is compared with the “route” parameter of the server directive to identify the server to which the request should be proxied. If the designated server cannot process a request, the new server is selected by the configured balancing method as if there is no routing information in the request.

The parameters of the route method specify variables that may contain routing information. The first non-empty variable is used to find the matching server.

Example:

map $cookie_jsessionid $route_cookie {
    ~.+\.(?P<route>\w+)$ $route;
}

map $request_uri $route_uri {
    ~jsessionid=.+\.(?P<route>\w+)$ $route;
}

upstream backend {
    server backend1.example.com route=a;
    server backend2.example.com route=b;

    sticky route $route_cookie $route_uri;
}

Here, the route is taken from the “JSESSIONID” cookie if present in a request. Otherwise, the route from the URI is used.

learn

When the learn method (1.7.1) is used, nginx analyzes upstream server responses and learns server-initiated sessions usually passed in an HTTP cookie.

upstream backend {
   server backend1.example.com:8080;
   server backend2.example.com:8081;

   sticky learn
          create=$upstream_cookie_sessionid
          lookup=$cookie_sessionid
          zone=client_sessions:1m;
}

In the example, the upstream server creates a session by setting the cookie “SESSIONID” in the response. Further requests with this cookie will be passed to the same server. If the server cannot process the request, the new server is selected as if the client has not been bound yet.

The parameters create and lookup specify variables that indicate how new sessions are created and existing sessions are searched, respectively. Both parameters may be specified more than once, in which case the first non-empty variable is used.

Sessions are stored in a shared memory zone, whose name and size are configured by the zone parameter. One megabyte zone can store about 8000 sessions on the 64-bit platform. The sessions that are not accessed during the time specified by the timeout parameter get removed from the zone. By default, timeout is set to 10 minutes.

This directive is available as part of our commercial subscription.

Syntax: sticky_cookie_insert name [expires=time] [domain=domain] [path=path];
Default:
Context: upstream

This directive is obsolete since version 1.5.7. An equivalent sticky directive with a new syntax should be used instead:

sticky cookie name [expires=time] [domain=domain] [path=path];

Syntax: upstream_conf;
Default:
Context: location

Turns on the HTTP interface of upstream configuration in the surrounding location. Access to this location should be limited.

Configuration commands can be used to:

Since addresses in a group are not required to be unique, individual servers in a group are referenced by their IDs. IDs are assigned automatically and shown when adding a new server or viewing the group configuration.

A configuration command consists of parameters passed as request arguments, for example:

http://127.0.0.1/upstream_conf?upstream=dynamic

The following parameters are supported:

upstream=name
Selects a group to work with. This parameter is mandatory.
id=number
Selects an individual server for viewing, modifying, or removing.
remove=
Removes an individual server from the group.
add=
Adds a new server to the group.
backup=
Required to add a backup server.
Before version 1.7.2, backup= was also required to view, modify, or remove existing backup servers.
server=address
Same as the “address” parameter of the server directive.

When adding a server, it is possible to specify it as a domain name. In this case, changes of the IP addresses that correspond to a domain name will be monitored and automatically applied to the upstream configuration without the need of restarting nginx (1.7.2). This requires the resolver directive in the http block. See also the resolve parameter of the server directive.

weight=number
Same as the “weight” parameter of the server directive.
max_fails=number
Same as the “max_fails” parameter of the server directive.
fail_timeout=time
Same as the “fail_timeout” parameter of the server directive.
slow_start=time
Same as the “slow_start” parameter of the server directive.
down=
Same as the “down” parameter of the server directive.
up=
The opposite of the “down” parameter of the server directive.
route=string
Same as the “route” parameter of the server directive.

The first two parameters select an object. This can be either the whole group or an individual server. Without other parameters, the configuration of the selected group or server is shown.

For example, to view the configuration of the whole group, send:

http://127.0.0.1/upstream_conf?upstream=dynamic

To view the configuration of an individual server, also specify its ID:

http://127.0.0.1/upstream_conf?upstream=dynamic&id=42

To add a new server, specify its address in the “server=” parameter. Without other parameters specified, a server will be added with other parameters set to their default values (see the server directive).

For example, to add a new primary server, send:

http://127.0.0.1/upstream_conf?add=&upstream=dynamic&server=127.0.0.1:8080

To add a new backup server, send:

http://127.0.0.1/upstream_conf?add=&upstream=dynamic&backup=&server=127.0.0.1:8080

To add a new primary server, set its parameters to non-default values and mark it as “down”, send:

http://127.0.0.1/upstream_conf?add=&upstream=dynamic&server=127.0.0.1:8080&weight=2&down=

To remove a server, specify its ID:

http://127.0.0.1/upstream_conf?remove=&upstream=dynamic&id=42

To mark an existing server as “down”, send:

http://127.0.0.1/upstream_conf?upstream=dynamic&id=42&down=

To modify the address of an existing server, send:

http://127.0.0.1/upstream_conf?upstream=dynamic&id=42&server=192.0.2.3:8123

To modify other parameters of an existing server, send:

http://127.0.0.1/upstream_conf?upstream=dynamic&id=42&max_fails=3&weight=4

This directive is available as part of our commercial subscription.

Embedded Variables

The ngx_http_upstream_module module supports the following embedded variables:

$upstream_addr
keeps the IP address and port of the server, or the path to the UNIX-domain socket. If several servers were contacted during request processing, their addresses are separated by commas, e.g. “192.168.1.1:80, 192.168.1.2:80, unix:/tmp/sock”. If an internal redirect from one server group to another happens, initiated by “X-Accel-Redirect” or error_page, then the server addresses from different groups are separated by colons, e.g. “192.168.1.1:80, 192.168.1.2:80, unix:/tmp/sock : 192.168.10.1:80, 192.168.10.2:80”.
$upstream_cache_status
keeps the status of accessing a response cache (0.8.3). The status can be either “MISS”, “BYPASS”, “EXPIRED”, “STALE”, “UPDATING”, “REVALIDATED” or “HIT”.
cookie with the specified name sent by the upstream server in the “Set-Cookie” response header field (1.7.1). Only the last server’s response header fields are saved.
$upstream_response_length
keeps the lengths of responses obtained from the upstream servers (0.7.27); lengths are kept in bytes. Several response lengths are separated by commas and colons like addresses in the $upstream_addr variable.
$upstream_response_time
keeps times of responses obtained from upstream servers; times are kept in seconds with a milliseconds resolution. Several response times are separated by commas and colons like addresses in the $upstream_addr variable.
$upstream_status
keeps codes of responses obtained from upstream servers. Several response codes are separated by commas and colons like addresses in the $upstream_addr variable.
$upstream_http_name
keep server response header fields. For example, the “Server” response header field is available through the $upstream_http_server variable. The rules of converting header field names to variable names are the same as for the variables that start with the “$http_” prefix. Only the last server’s response header fields are saved.