Provided by: trafficserver_8.0.5+ds-3_amd64 
NAME
records.config - the records.config file (by default (proxy.config.config_dir), located in
/usr/local/etc/trafficserver/) is a list of configurable variables used by the Traffic Server software.
Many of the variables in records.config are set automatically when you set configuration options with
traffic_ctl config set. After you modify records.config, run the command traffic_ctl config reload to
apply the changes
FORMAT
Each variable has the following format:
CONFIG variable_name DATATYPE variable_value
Data Type
A variable's type is defined by the DATATYPE and must be one of:
┌────────┬───────────────────────────────────────┐
│ Type │ Description │
├────────┼───────────────────────────────────────┤
│ FLOAT │ Floating point, expressed as a │
│ │ decimal number without units or │
│ │ exponents. │
├────────┼───────────────────────────────────────┤
│ INT │ Integers, expressed with or without │
│ │ unit prefixes (as described below). │
├────────┼───────────────────────────────────────┤
│ STRING │ String of characters up to the first │
│ │ newline. No quoting necessary. │
└────────┴───────────────────────────────────────┘
Values
The variable_value must conform to the variable's type. For STRING, this is simply any character data
until the first newline.
For integer (INT) variables, values are expressed as any normal integer, e.g. 32768. They can also be
expressed using more human readable values using standard unit prefixes, e.g. 32K. The following prefixes
are supported for all INT type configurations:
┌────────┬─────────────┬──────────────────────────────┐
│ Prefix │ Description │ Equivalent in Bytes │
├────────┼─────────────┼──────────────────────────────┤
│ K │ Kilobytes │ 1,024 bytes │
├────────┼─────────────┼──────────────────────────────┤
│ M │ Megabytes │ 1,048,576 bytes (10242) │
├────────┼─────────────┼──────────────────────────────┤
│ G │ Gigabytes │ 1,073,741,824 bytes (10243) │
├────────┼─────────────┼──────────────────────────────┤
│ T │ Terabytes │ 1,099,511,627,776 bytes │
│ │ │ (10244) │
└────────┴─────────────┴──────────────────────────────┘
IMPORTANT:
Unless proxy.config.disable_configuration_modification is enabled, Traffic Server writes
configurations back to disk periodically. When doing so, the unit prefixes are not preserved.
Floating point variables (FLOAT) must be expressed as a regular decimal number. Unit prefixes are not
supported, nor are alternate notations (scientific, exponent, etc.).
Additional Attributes
Deprecated
A variable marked as Deprecated is still functional but should be avoided as it may be removed in a
future release without warning.
Reloadable
A variable marked as Reloadable can be updated via the command:
traffic_ctl config reload
This updates configuration parameters without restarting Traffic Server or interrupting the processing of
requests.
Overridable
A variable marked as Overridable can be changed on a per-remap basis using plugins (like the
admin-plugins-conf-remap), affecting operations within the current transaction only.
EXAMPLES
In the following example, the variable proxy.config.proxy_name is a STRING datatype with the value
my_server. This means that the name of the Traffic Server proxy is my_server.
CONFIG proxy.config.proxy_name STRING my_server
If the server name should be that_server the line would be
CONFIG proxy.config.proxy_name STRING that_server
In the following example, the variable proxy.config.arm.enabled is a yes/no flag. A value of 0 (zero)
disables the option; a value of 1 enables the option.
CONFIG proxy.config.arm.enabled INT 0
In the following example, the variable sets the time to wait for a DNS response to 10 seconds.
CONFIG proxy.config.hostdb.lookup_timeout INT 10
The last examples configures a 64GB RAM cache, using a human readable prefix.
CONFIG proxy.config.cache.ram_cache.size INT 64G
ENVIRONMENT OVERRIDES
Every records.config configuration variable can be overridden by a corresponding environment variable.
This can be useful in situations where you need a static records.config but still want to tweak one or
two settings. The override variable is formed by converting the records.config variable name to upper
case, and replacing any dot separators with an underscore.
Overriding a variable from the environment is permanent and will not be affected by future configuration
changes made in records.config or applied with traffic_ctl.
For example, we could override the proxy.config.product_company variable like this:
$ PROXY_CONFIG_PRODUCT_COMPANY=example traffic_manager &
$ traffic_ctl config get proxy.config.product_company
CONFIGURATION VARIABLES
The following list describes the configuration variables available in the records.config file.
System Variables
proxy.config.product_company
Scope CONFIG.TP Type STRING.TP Default Apache Software Foundation.UNINDENT The name of the organization
developing Traffic Server.
proxy.config.product_vendor
Scope CONFIG.TP Type STRING.TP Default Apache.UNINDENT The name of the vendor providing Traffic Server.
proxy.config.product_name
Scope CONFIG.TP Type STRING.TP Default Traffic Server.UNINDENT The name of the product.
proxy.config.proxy_name
Scope CONFIG.TP Type STRING.TP Default build_machine.TP Reloadable Yes.UNINDENT The name of the Traffic
Server node.
proxy.config.bin_path
Scope CONFIG.TP Type STRING.TP Default bin.UNINDENT The location of the Traffic Server bin directory.
proxy.config.proxy_binary
Scope CONFIG.TP Type STRING.TP Default traffic_server.UNINDENT The name of the executable that runs the
traffic_server process.
proxy.config.proxy_binary_opts
Scope CONFIG.TP Type STRING.TP Default -M.UNINDENT The command-line options for starting Traffic Server.
proxy.config.manager_binary
Scope CONFIG.TP Type STRING.TP Default traffic_manager.UNINDENT The name of the executable that runs the
traffic_manager process.
proxy.config.env_prep
Scope CONFIG.TP Type STRING.TP Default *NONE*.UNINDENT The script executed before the traffic_manager
process spawns the traffic_server process.
proxy.config.config_dir
Scope CONFIG.TP Type STRING.TP Default etc/trafficserver.UNINDENT The directory that contains Traffic
Server configuration files. This is a read-only configuration option that contains the SYSCONFDIR
value specified at build time relative to the installation prefix. The $TS_ROOT environment
variable can be used alter the installation prefix at run time. The directory must allow
read/write access for configuration reloads.
proxy.config.syslog_facility
Scope CONFIG.TP Type STRING.TP Default LOG_DAEMON.UNINDENT The facility used to record system log files.
Refer to admin-logging-understanding for more in-depth discussion of the contents and
interpretations of log files.
proxy.config.output.logfile
Scope CONFIG.TP Type STRING.TP Default traffic.out.UNINDENT The name and location of the file that
contains warnings, status messages, and error messages produced by the Traffic Server processes.
If no path is specified, then Traffic Server creates the file in its logging directory.
proxy.config.output.logfile_perm
Scope CONFIG.TP Type STRING.TP Default rw-r--r--.UNINDENT The log file permissions. The standard UNIX
file permissions are used (owner, group, other). Permissible values are:
┌───────┬─────────────────────┐
│ Value │ Description │
├───────┼─────────────────────┤
│ - │ No permissions. │
├───────┼─────────────────────┤
│ r │ Read permission. │
├───────┼─────────────────────┤
│ w │ Write permission. │
├───────┼─────────────────────┤
│ x │ Execute permission. │
└───────┴─────────────────────┘
Permissions are subject to the umask settings for the Traffic Server process. This means that a
umask setting of 002 will not allow write permission for others, even if specified in the
configuration file. Permissions for existing log files are not changed when the configuration is
modified.
proxy.config.output.logfile.rolling_enabled
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.UNINDENT Specifies how the output log is rolled.
You can specify the following values:
────────────────────────────────────────────────────────────
Value Description
────────────────────────────────────────────────────────────
0 Disables output log rolling.
────────────────────────────────────────────────────────────
1 Enables output log rolling at
specific intervals (specified with
the
proxy.config.output.logfile.rolling_interval_sec
variable). The clock starts ticking
on Traffic Server boot.
────────────────────────────────────────────────────────────
2 Enables output log rolling when the output log
reaches a specific size (specified with
proxy.config.output.logfile.rolling_size_mb).
────────────────────────────────────────────────────────────
3 Enables output log rolling at specific intervals
or when the output log reaches a specific size
(whichever occurs first).
┌───────┬──────────────────────────────────────────────────┐
│ │ │
--
NETWORK
proxy.config.net.connections_throttle
Scope CONFIG.TP Type INT.TP Default 30000.UNINDENT The total number of client and origin server
connections that the server can handle simultaneously. This is in fact the max number of file
descriptors that the traffic_server process can have open at any given time. Roughly 10% of these
connections are reserved for origin server connections, i.e. from the default, only ~9,000 client
connections can be handled. This should be tuned according to your memory size, and expected work
load. If this is set to 0, the throttling logic is disabled.
proxy.config.net.default_inactivity_timeout
Scope CONFIG.TP Type INT.TP Default 86400.TP Reloadable Yes.UNINDENT The connection inactivity timeout
(in seconds) to apply when Traffic Server detects that no inactivity timeout has been applied by
the HTTP state machine. When this timeout is applied, the
proxy.process.net.default_inactivity_timeout_applied metric is incremented.
See admin-performance-timeouts for more discussion on Traffic Server timeouts.
proxy.config.net.inactivity_check_frequency
Scope CONFIG.TP Type INT.TP Default 1.UNINDENT How frequent (in seconds) to check for inactive
connections. If you deal with a lot of concurrent connections, increasing this setting can reduce
pressure on the system.
proxy.local.incoming_ip_to_bind
Scope LOCAL.TP Type STRING.TP Default 0.0.0.0 [::].UNINDENT Controls the global default IP addresses to
which to bind proxy server ports. The value is a space separated list of IP addresses, one per
supported IP address family (currently IPv4 and IPv6).
Unless explicitly specified in proxy.config.http.server_ports, the server port will be bound to
one of these addresses, selected by IP address family. The built in default is any address. This
is used if no address for a family is specified. This setting is useful if most or all server
ports should be bound to the same address.
NOTE:
This is ignored for inbound transparent server ports because they must be able to accept connections
on arbitrary IP addresses.
Example
Set the global default for IPv4 to 192.168.101.18 and leave the global default for IPv6 as any address:
LOCAL proxy.local.incoming_ip_to_bind STRING 192.168.101.18
Example
Set the global default for IPv4 to 191.68.101.18 and the global default for IPv6 to fc07:192:168:101::17:
LOCAL proxy.local.incoming_ip_to_bind STRING 192.168.101.18 [fc07:192:168:101::17]
proxy.local.outgoing_ip_to_bind
Scope LOCAL.TP Type STRING.TP Default 0.0.0.0 [::].UNINDENT This controls the global default for the
local IP address for outbound connections to origin servers. The value is a list of space
separated IP addresses, one per supported IP address family (currently IPv4 and IPv6).
Unless explicitly specified in proxy.config.http.server_ports, one of these addresses, selected by
IP address family, will be used as the local address for outbound connections. This setting is
useful if most or all of the server ports should use the same outbound IP addresses.
NOTE:
This is ignored for outbound transparent ports as the local outbound address will be the same as the
client local address.
Example
Set the default local outbound IP address for IPv4 connections to 192.168.101.18.:
LOCAL proxy.local.outgoing_ip_to_bind STRING 192.168.101.18
Example
Set the default local outbound IP address to 192.168.101.17 for IPv4 and fc07:192:168:101::17 for IPv6.:
LOCAL proxy.local.outgoing_ip_to_bind STRING 192.168.101.17 [fc07:192:168:101::17]
proxy.config.net.event_period
Scope CONFIG.TP Type INT.TP Default 10.UNINDENT How often, in milli-seconds, to schedule IO event
processing. This is unlikely to be necessary to tune, and we discourage setting it to a value
smaller than 10ms (on Linux).
proxy.config.net.accept_period
Scope CONFIG.TP Type INT.TP Default 10.UNINDENT How often, in milli-seconds, to schedule accept()
processing. This is unlikely to be necessary to tune, and we discourage setting it to a value
smaller than 10ms (on Linux).
proxy.config.net.retry_delay
Scope CONFIG.TP Type INT.TP Default 10.TP Reloadable Yes.UNINDENT How long to wait until we retry
various events that would otherwise block the network processing threads (e.g. locks). We
discourage setting this to a value smaller than 10ms (on Linux).
proxy.config.net.throttle_delay
Scope CONFIG.TP Type INT.TP Default 50.TP Reloadable Yes.UNINDENT When we trigger a throttling scenario,
this how long our accept() are delayed.
LOCAL MANAGER
proxy.config.admin.number_config_bak
Scope CONFIG.TP Type INT.TP Default 3.UNINDENT The maximum number of copies of rolled configuration
files to keep.
proxy.config.admin.user_id
Scope CONFIG.TP Type STRING.TP Default nobody.UNINDENT Designates the non-privileged account to run the
traffic_server process as, which also has the effect of setting ownership of configuration and log
files.
As of version 2.1.1 if the user_id is prefixed with pound character (#) the remainder of the
string is considered to be a numeric user identifier. If the value is set to #-1 Traffic Server
will not change the user during startup.
IMPORTANT:
Attempting to set this option to root or #0 is now forbidden, as a measure to increase security. Doing
so will cause a fatal failure upon startup in traffic_server. However, there are two ways to bypass
this restriction:
• Specify -DBIG_SECURITY_HOLE in CXXFLAGS during compilation.
• Set the user_id=#-1 and start trafficserver as root.
proxy.config.admin.api.restricted
Scope CONFIG.TP Type INT.TP Default 0.UNINDENT This setting specifies whether the management API should
be restricted to root processes. If this is set to 0, then on platforms that support passing
process credentials, non-root processes will be allowed to make read-only management API calls.
Any management API calls that modify server state (eg. setting a configuration variable) will
still be restricted to root processes.
This setting is not reloadable, since it is must be applied when program:traffic_manager
initializes.
proxy.config.disable_configuration_modification
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.UNINDENT This setting prevents Traffic Server
from rewriting the records.config configuration file. Dynamic configuration changes can still be
made using traffic_ctl config set, but these changes will not be persisted on service restarts or
when traffic_ctl config reload is run.
ALARM CONFIGURATION
proxy.config.alarm_email
Scope CONFIG.TP Type STRING.TP Default *NONE*.TP Reloadable Yes.UNINDENT The address to which the alarm
script should send email.
proxy.config.alarm.bin
Scope CONFIG.TP Type STRING.TP Default example_alarm_bin.sh.TP Reloadable Yes.UNINDENT Name of the
script file that can execute certain actions when an alarm is signaled. The script is invoked with
up to 4 arguments:
• The alarm message.
• The value of proxy.config.product_name.
• The value of proxy.config.admin.user_id.
• The value of proxy.config.alarm_email.
proxy.config.alarm.abs_path
Scope CONFIG.TP Type STRING.TP Default NULL.TP Reloadable Yes.UNINDENT The absolute path to the
directory containing the alarm script. If this is not set, the script will be located relative to
proxy.config.bin_path.
proxy.config.alarm.script_runtime
Scope CONFIG.TP Type INT.TP Default 5.TP Reloadable Yes.UNINDENT The number of seconds that Traffic
Server allows the alarm script to run before aborting it.
HTTP ENGINE
proxy.config.http.server_ports
Scope CONFIG.TP Type STRING.TP Default 8080 8080:ipv6.UNINDENT Ports used for proxying HTTP traffic.
This is a list, separated by space or comma, of port descriptors. Each descriptor is a sequence
of keywords and values separated by colons. Not all keywords have values, those that do are
specifically noted. Keywords with values can have an optional = character separating the keyword
and value. The case of keywords is ignored. The order of keywords is irrelevant but unspecified
results may occur if incompatible options are used (noted below). Options without values are
idempotent. Options with values use the last (right most) value specified, except for ip-out as
detailed later.
Quick reference chart:
┌────────────┬─────────────────┬──────────────────────────────┐
│ Name │ Note │ Definition │
├────────────┼─────────────────┼──────────────────────────────┤
│ number │ Required │ The local port. │
├────────────┼─────────────────┼──────────────────────────────┤
│ blind │ │ Blind (CONNECT) port. │
├────────────┼─────────────────┼──────────────────────────────┤
│ compress │ Not Implemented │ Compressed. │
├────────────┼─────────────────┼──────────────────────────────┤
│ ipv4 │ Default │ Bind to IPv4 address family. │
├────────────┼─────────────────┼──────────────────────────────┤
│ ipv6 │ │ Bind to IPv6 address family. │
├────────────┼─────────────────┼──────────────────────────────┤
│ ip-in │ Value │ Local inbound IP address. │
├────────────┼─────────────────┼──────────────────────────────┤
│ ip-out │ Value │ Local outbound IP address. │
├────────────┼─────────────────┼──────────────────────────────┤
│ ip-resolve │ Value │ IP address resolution style. │
├────────────┼─────────────────┼──────────────────────────────┤
│ proto │ Value │ List of supported session │
│ │ │ protocols. │
├────────────┼─────────────────┼──────────────────────────────┤
│ pp │ │ Enable Proxy Protocol. │
├────────────┼─────────────────┼──────────────────────────────┤
│ ssl │ │ SSL terminated. │
├────────────┼─────────────────┼──────────────────────────────┤
│ tr-full │ │ Fully transparent (inbound │
│ │ │ and outbound) │
├────────────┼─────────────────┼──────────────────────────────┤
│ tr-in │ │ Inbound transparent. │
├────────────┼─────────────────┼──────────────────────────────┤
│ tr-out │ │ Outbound transparent. │
├────────────┼─────────────────┼──────────────────────────────┤
│ tr-pass │ │ Pass through enabled. │
└────────────┴─────────────────┴──────────────────────────────┘
number Local IP port to bind. This is the port to which ATS clients will connect.
blind Accept only the CONNECT method on this port.
Not compatible with: tr-in, ssl.
compress
Compress the connection. Retained only by inertia, should be considered "not implemented".
ipv4 Use IPv4. This is the default and is included primarily for completeness. This forced if the ip-in
option is used with an IPv4 address.
ipv6 Use IPv6. This is forced if the ip-in option is used with an IPv6 address.
ssl Require SSL termination for inbound connections. SSL must be configured for this option to provide
a functional server port.
Not compatible with: blind.
proto Specify the session level protocols supported. These should be separated by semi-colons. For TLS
proxy ports the default value is all available protocols. For non-TLS proxy ports the default is
HTTP only.
pp Enables Proxy Protocol on the port. If Proxy Protocol is enabled on the port, all incoming
requests must be prefaced with the PROXY header. See Proxy Protocol for more details on how to
configure this option properly.
tr-full
Fully transparent. This is a convenience option and is identical to specifying both tr-in and
tr-out.
Not compatible with: Any option not compatible with tr-in or tr-out.
tr-in Inbound transparent. The proxy port will accept connections to any IP address on the port. To have
IPv6 inbound transparent you must use this and the ipv6 option. This overrides
proxy.local.incoming_ip_to_bind for this port.
Not compatible with: ip-in, blind
tr-out Outbound transparent. If ATS connects to an origin server for a transaction on this port, it will
use the client's address as its local address. This overrides proxy.local.outgoing_ip_to_bind for
this port.
Not compatible with: ip-out, ip-resolve
tr-pass
Transparent pass through. This option is useful only for inbound transparent proxy ports. If the
parsing of the expected HTTP header fails, then the transaction is switched to a blind tunnel
instead of generating an error response to the client. It effectively enables
proxy.config.http.use_client_target_addr for the transaction as there is no other place to obtain
the origin server address.
ip-in Set the local IP address for the port. This is the address to which clients will connect. This
forces the IP address family for the port. The ipv4 or ipv6 can be used but it is optional and is
an error for it to disagree with the IP address family of this value. An IPv6 address must be
enclosed in square brackets. If this option is omitted proxy.local.incoming_ip_to_bind is used.
Not compatible with: tr-in.
ip-out Set the local IP address for outbound connections. This is the address used by ATS locally when it
connects to an origin server for transactions on this port. If this is omitted
proxy.local.outgoing_ip_to_bind is used.
This option can used multiple times, once for each IP address family. The address used is selected
by the IP address family of the origin server address.
Not compatible with: tr-out.
ip-resolve
Set the host resolution style for transactions on this proxy port.
Not compatible with: tr-out - this option requires a value of client;none which is forced and
should not be explicitly specified.
Example
Listen on port 80 on any address for IPv4 and IPv6.:
80 80:ipv6
Example
Listen transparently on any IPv4 address on port 8080, and transparently on port 8080 on local address
fc01:10:10:1::1 (which implies ipv6).:
IPv4:tr-FULL:8080 TR-full:IP-in=[fc02:10:10:1::1]:8080
Example
Listen on port 8080 for IPv6, fully transparent. Set up an SSL port on 443. These ports will use the IP
address from proxy.local.incoming_ip_to_bind. Listen on IP address 192.168.17.1, port 80, IPv4, and
connect to origin servers using the local address 10.10.10.1 for IPv4 and fc01:10:10:1::1 for IPv6.:
8080:ipv6:tr-full 443:ssl ip-in=192.168.17.1:80:ip-out=[fc01:10:10:1::1]:ip-out=10.10.10.1
Example
Listen on port 9090 for TSL enabled HTTP/2 or HTTP connections, accept no other session protocols.:
9090:proto=http2;http:ssl
Example
Listen on port 9090 for TSL disabled HTTP/2 and enabled HTTP connections, accept no other session
protocols.:
9090:proto=http:ssl
proxy.config.http.connect_ports
Scope CONFIG.TP Type STRING.TP Default 443.UNINDENT The range of origin server ports that can be used
for tunneling via CONNECT.
Traffic Server allows tunnels only to the specified ports. Supports both wildcards (*) and ranges
(e.g. 0-1023).
NOTE:
These are the ports on the origin server, not Traffic Server proxy ports.
proxy.config.http.forward_connect_method
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.TP Overridable Yes.UNINDENT The default, Traffic
Server behavior for handling a CONNECT method request is to establish a tunnel to the requested
destination. This configuration alters the behavior so that Traffic Server forwards the CONNECT
method to the next hop, and establishes the tunnel after receiving a positive response. This
behavior is useful in a proxy hierarchy, and is equivalent to setting
proxy.local.http.parent_proxy.disable_connect_tunneling to 0 when parent proxying is enabled.
proxy.config.http.insert_request_via_str
Scope CONFIG.TP Type INT.TP Default 1.TP Reloadable Yes.TP Overridable Yes.UNINDENT Set how the Via
field is handled on a request to the origin server.
┌───────┬───────────────────────────────────────┐
│ Value │ Effect │
├───────┼───────────────────────────────────────┤
│ 0 │ Do not modify or set this Via header. │
├───────┼───────────────────────────────────────┤
│ 1 │ Add the basic protocol and proxy │
│ │ identifier. │
├───────┼───────────────────────────────────────┤
│ 2 │ Add basic transaction codes. │
├───────┼───────────────────────────────────────┤
│ 3 │ Add detailed transaction codes. │
├───────┼───────────────────────────────────────┤
│ 4 │ Add full user agent connection │
│ │ protocol tags. │
└───────┴───────────────────────────────────────┘
NOTE:
The Via transaction codes can be decoded with the Via Decoder Ring.
proxy.config.http.request_via_str
Scope CONFIG.TP Type STRING.TP Default ApacheTrafficServer/${PACKAGE_VERSION}.TP Reloadable Yes.TP
Overridable Yes.UNINDENT Set the server and version string in the Via request header to the origin
server which is inserted when the value of proxy.config.http.insert_request_via_str is not 0.
Note that the actual default value is defined with "ApacheTrafficServer/" PACKAGE_VERSION in a C++
source code, and you must write such as ApacheTrafficServer/6.0.0 if you really set a value with
the version in records.config file. If you want to hide the version, you can set this value to
ApacheTrafficServer.
proxy.config.http.insert_response_via_str
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.TP Overridable Yes.UNINDENT Set how the Via
field is handled on the response to the client.
┌───────┬───────────────────────────────────────┐
│ Value │ Effect │
├───────┼───────────────────────────────────────┤
│ 0 │ Do not modify or set this Via header. │
├───────┼───────────────────────────────────────┤
│ 1 │ Add the basic protocol and proxy │
│ │ identifier. │
├───────┼───────────────────────────────────────┤
│ 2 │ Add basic transaction codes. │
├───────┼───────────────────────────────────────┤
│ 3 │ Add detailed transaction codes. │
├───────┼───────────────────────────────────────┤
│ 4 │ Add full upstream connection protocol │
│ │ tags. │
└───────┴───────────────────────────────────────┘
NOTE:
The Via transaction acode can be decoded with the Via Decoder Ring.
proxy.config.http.response_via_str
Scope CONFIG.TP Type STRING.TP Default ApacheTrafficServer/${PACKAGE_VERSION}.TP Reloadable Yes.TP
Overridable Yes.UNINDENT Set the server and version string in the Via response header to the
client which is inserted when the value of proxy.config.http.insert_response_via_str is not 0.
Note that the actual default value is defined with "ApacheTrafficServer/" PACKAGE_VERSION in a C++
source code, and you must write such as ApacheTrafficServer/6.0.0 if you really set a value with
the version in records.config file. If you want to hide the version, you can set this value to
ApacheTrafficServer.
proxy.config.http.send_100_continue_response
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.UNINDENT You can specify one of the following:
┌───────┬───────────────────────────────────────┐
│ Value │ Description │
├───────┼───────────────────────────────────────┤
│ 0 │ Traffic Server will buffer the │
│ │ request until the post body has been │
│ │ received and then send the request to │
│ │ the origin server. │
├───────┼───────────────────────────────────────┤
│ 1 │ Immediately return a 100 Continue │
│ │ from Traffic Server without waiting │
│ │ for the post body. │
└───────┴───────────────────────────────────────┘
proxy.config.http.response_server_enabled
Scope CONFIG.TP Type INT.TP Default 1.TP Reloadable Yes.TP Overridable Yes.UNINDENT You can specify one
of the following:
┌───────┬────────────────────────────────────────┐
│ Value │ Description │
├───────┼────────────────────────────────────────┤
│ 0 │ No Server header is added to the │
│ │ response. │
├───────┼────────────────────────────────────────┤
│ 1 │ The Server header is added according │
│ │ to │
│ │ proxy.config.http.response_server_str. │
├───────┼────────────────────────────────────────┤
│ 2 │ The Server header is added only if the │
│ │ response from origin does not have one │
│ │ already. │
└───────┴────────────────────────────────────────┘
proxy.config.http.response_server_str
Scope CONFIG.TP Type STRING.TP Default ATS/${PACKAGE_VERSION}.TP Reloadable Yes.TP Overridable
Yes.UNINDENT The Server string that Traffic Server will insert in a response header (if requested,
see above). Note that the actual default value is defined with "ATS/" PACKAGE_VERSION in the C++
source, and you must write such as ATS/6.0.0 if you really set a value with the version in
records.config. If you want to hide the version, you can set this value to ATS.
proxy.config.http.insert_age_in_response
Scope CONFIG.TP Type INT.TP Default 1.TP Reloadable Yes.TP Overridable Yes.UNINDENT This option
specifies whether Traffic Server should insert an Age header in the response. The value is the
cache's estimate of the amount of time since the response was generated or revalidated by the
origin server.
┌───────┬─────────────────────────┐
│ Value │ Description │
├───────┼─────────────────────────┤
│ 0 │ No Age header is added. │
├───────┼─────────────────────────┤
│ 1 │ Age header is added. │
└───────┴─────────────────────────┘
proxy.config.http.chunking_enabled
Scope CONFIG.TP Type INT.TP Default 1.TP Reloadable Yes.TP Overridable Yes.UNINDENT Specifies whether
Traffic Server can generate a chunked response:
─────────────────────────────────────────────────
Value Description
─────────────────────────────────────────────────
0 Never respond with chunked encoding.
─────────────────────────────────────────────────
1 Always respond with chunked encoding.
─────────────────────────────────────────────────
2 Generate a chunked response if the
origin server has previously returned
HTTP/1.1.
─────────────────────────────────────────────────
3 Generate a chunked response if the
client request is HTTP/1.1 and the
origin server has previously returned
HTTP/1.1.
┌───────┬───────────────────────────────────────┐
│ │ │
NOTE: │ │ │
--
PARENT PROXY CONFIGURATION
proxy.config.http.parent_proxy_routing_enable
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.UNINDENT Enables (1) or disables (0) the parent
caching option. Refer to admin-hierarchical-caching.
proxy.config.http.parent_proxy.retry_time
Scope CONFIG.TP Type INT.TP Default 300.TP Reloadable Yes.TP Overridable Yes.UNINDENT The amount of time
allowed between connection retries to a parent cache that is unavailable.
proxy.config.http.parent_proxy.fail_threshold
Scope CONFIG.TP Type INT.TP Default 10.TP Reloadable Yes.TP Overridable Yes.UNINDENT The number of times
the connection to the parent cache can fail before Traffic Server considers the parent
unavailable.
proxy.config.http.parent_proxy.total_connect_attempts
Scope CONFIG.TP Type INT.TP Default 4.TP Reloadable Yes.TP Overridable Yes.UNINDENT The total number of
connection attempts for a specific transaction allowed to a parent cache before Traffic Server
bypasses the parent or fails the request (depending on the go_direct option in the parent.config
file). The number of parents tried is proxy.config.http.parent_proxy.fail_threshold /
proxy.config.http.parent_proxy.total_connect_attempts
proxy.config.http.parent_proxy.per_parent_connect_attempts
Scope CONFIG.TP Type INT.TP Default 2.TP Reloadable Yes.TP Overridable Yes.UNINDENT The total number of
connection attempts allowed per parent for a specific transaction, if multiple parents are used.
proxy.config.http.parent_proxy.connect_attempts_timeout
Scope CONFIG.TP Type INT.TP Default 30.TP Reloadable Yes.TP Overridable Yes.UNINDENT The timeout value
(in seconds) for parent cache connection attempts.
See admin-performance-timeouts for more discussion on Traffic Server timeouts.
proxy.config.http.parent_proxy.mark_down_hostdb
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.TP Overridable Yes.UNINDENT Enables (1) or
disables (0) marking parent proxies down in hostdb when a connection error is detected. Normally
parent selection manages parent proxies and will mark them as unavailable as needed. But when
parents are defined in dns with multiple ip addresses, it may be useful to mark the failing ip
down in hostdb. In this case you would enable these updates.
proxy.config.http.forward.proxy_auth_to_parent
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.TP Overridable Yes.UNINDENT Configures Traffic
Server to send proxy authentication headers on to the parent cache.
proxy.config.http.no_dns_just_forward_to_parent
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.UNINDENT Don't try to resolve DNS, forward all
DNS requests to the parent. This is off (0) by default.
proxy.local.http.parent_proxy.disable_connect_tunneling
Scope CONFIG.TP Type INT.TP Default 0.UNINDENT
proxy.config.http.parent_proxy.self_detect
Scope CONFIG.TP Type INT.TP Default 2.UNINDENT For each host that has been specified in a parent or
secondary_parent list in the parent.config file, determine if the host is the same as the current
host. Obvious examples include localhost and 127.0.0.1. If a match is found, take an action
depending upon the value below.
┌───────┬───────────────────────────────────────┐
│ Value │ Description │
├───────┼───────────────────────────────────────┤
│ 0 │ Disables the feature by not checking │
│ │ for matches. │
├───────┼───────────────────────────────────────┤
│ 1 │ Remove the matching host from the │
│ │ list. │
├───────┼───────────────────────────────────────┤
│ 2 │ Mark the host down. This is the │
│ │ default. │
└───────┴───────────────────────────────────────┘
HTTP CONNECTION TIMEOUTS
proxy.config.http.keep_alive_no_activity_timeout_in
Scope CONFIG.TP Type INT.TP Default 120.TP Reloadable Yes.TP Overridable Yes.UNINDENT Specifies how long
Traffic Server keeps connections to clients open for a subsequent request after a transaction
ends. A value of 0 will disable the no activity timeout.
See admin-performance-timeouts for more discussion on Traffic Server timeouts.
proxy.config.http.keep_alive_no_activity_timeout_out
Scope CONFIG.TP Type INT.TP Default 120.TP Reloadable Yes.TP Overridable Yes.UNINDENT Specifies how long
Traffic Server keeps connections to origin servers open for a subsequent transfer of data after a
transaction ends. A value of 0 will disable the no activity timeout.
See admin-performance-timeouts for more discussion on Traffic Server timeouts.
proxy.config.http.transaction_no_activity_timeout_in
Scope CONFIG.TP Type INT.TP Default 30.TP Reloadable Yes.TP Overridable Yes.UNINDENT Specifies how long
Traffic Server keeps connections to clients open if a transaction stalls.
See admin-performance-timeouts for more discussion on Traffic Server timeouts.
proxy.config.http.transaction_no_activity_timeout_out
Scope CONFIG.TP Type INT.TP Default 30.TP Reloadable Yes.TP Overridable Yes.UNINDENT Specifies how long
Traffic Server keeps connections to origin servers open if the transaction stalls.
See admin-performance-timeouts for more discussion on Traffic Server timeouts.
proxy.config.websocket.no_activity_timeout
Scope CONFIG.TP Type INT.TP Default 600.TP Reloadable Yes.TP Overridable Yes.UNINDENT Specifies how long
Traffic Server keeps connections open if a websocket stalls.
See admin-performance-timeouts for more discussion on Traffic Server timeouts.
proxy.config.websocket.active_timeout
Scope CONFIG.TP Type INT.TP Default 3600.TP Reloadable Yes.TP Overridable Yes.UNINDENT The maximum
amount of time Traffic Server keeps websocket connections open.
See admin-performance-timeouts for more discussion on Traffic Server timeouts.
proxy.config.http.transaction_active_timeout_in
Scope CONFIG.TP Type INT.TP Default 900.TP Reloadable Yes.TP Overridable Yes.UNINDENT The maximum amount
of time Traffic Server can remain connected to a client. If the transfer to the client is not
complete before this timeout expires, then Traffic Server closes the connection.
The value of 0 specifies that there is no timeout.
See admin-performance-timeouts for more discussion on Traffic Server timeouts.
proxy.config.http.transaction_active_timeout_out
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.TP Overridable Yes.UNINDENT The maximum amount
of time Traffic Server waits for fulfillment of a connection request to an origin server. If
Traffic Server does not complete the transfer to the origin server before this timeout expires,
then Traffic Server terminates the connection request.
The default value of 0 specifies that there is no timeout.
See admin-performance-timeouts for more discussion on Traffic Server timeouts.
proxy.config.http.accept_no_activity_timeout
Scope CONFIG.TP Type INT.TP Default 120.TP Reloadable Yes.UNINDENT The timeout interval in seconds
before Traffic Server closes a connection that has no activity.
See admin-performance-timeouts for more discussion on Traffic Server timeouts.
proxy.config.http.background_fill_active_timeout
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.TP Overridable Yes.UNINDENT Specifies how long
Traffic Server continues a background fill before giving up and dropping the origin server
connection.
See admin-performance-timeouts for more discussion on Traffic Server timeouts.
proxy.config.http.background_fill_completed_threshold
Scope CONFIG.TP Type FLOAT.TP Default 0.0.TP Reloadable Yes.TP Overridable Yes.UNINDENT The proportion
of total document size already transferred when a client aborts at which the proxy continues
fetching the document from the origin server to get it into the cache (a background fill).
HTTP REDIRECTION
proxy.config.http.number_of_redirections
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.TP Overridable Yes.UNINDENT This setting
determines the maximum number of times Trafficserver does a redirect follow location on receiving
a 3XX Redirect response for a given client request.
proxy.config.http.redirect_host_no_port
Scope CONFIG.TP Type INT.TP Default 1.UNINDENT This setting enables Trafficserver to not include the
port in the Host header in the redirect follow request for default/standard ports (e.g. 80 for
HTTP and 443 for HTTPS). Note that the port is still included in the Host header if it's
non-default.
proxy.config.http.redirect_use_orig_cache_key
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.TP Overridable Yes.UNINDENT This setting enables
Trafficserver to allow using original request cache key (for example, set using a TS API) during a
3xx redirect follow. The default behavior (0) is to use the URL specified by Location header in
the 3xx response as the cache key.
ORIGIN SERVER CONNECT ATTEMPTS
proxy.config.http.connect_attempts_max_retries
Scope CONFIG.TP Type INT.TP Default 3.TP Reloadable Yes.TP Overridable Yes.UNINDENT The maximum number
of connection retries Traffic Server can make when the origin server is not responding. Each
retry attempt lasts for proxy.config.http.connect_attempts_timeout seconds. Once the maximum
number of retries is reached, the origin is marked dead. After this, the setting
proxy.config.http.connect_attempts_max_retries_dead_server is used to limit the number of retry
attempts to the known dead origin.
proxy.config.http.connect_attempts_max_retries_dead_server
Scope CONFIG.TP Type INT.TP Default 1.TP Reloadable Yes.TP Overridable Yes.UNINDENT Maximum number of
connection retries Traffic Server can make while an origin is marked dead. Typically this value
is smaller than proxy.config.http.connect_attempts_max_retries so an error is returned to the
client faster and also to reduce the load on the dead origin. The timeout interval
proxy.config.http.connect_attempts_timeout in seconds is used with this setting.
proxy.config.http.server_max_connections
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.UNINDENT Limits the number of socket connections
across all origin servers to the value specified. To disable, set to zero (0).
This value is used in determining when and if to prune active origin sessions. Without this value
set, connections to origins can consume all the way up to
ts:cv:proxy.config.net.connections_throttle connections, which in turn can starve incoming
requests from available connections.
proxy.config.http.origin_max_connections
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.TP Overridable Yes.UNINDENT Limits the number of
socket connections per origin server to the value specified. To disable, set to zero (0).
proxy.config.http.origin_max_connections_queue
Scope CONFIG.TP Type INT.TP Default -1.TP Reloadable Yes.TP Overridable Yes.UNINDENT Limits the number
of requests to be queued when the proxy.config.http.origin_max_connections is reached. When
disabled (-1) requests are will wait indefinitely for an available connection. When set to 0 all
requests past the proxy.config.http.origin_max_connections will immediately fail. When set to >0
ATS will queue that many requests to go to the origin, any additional requests past the limit will
immediately fail.
proxy.config.http.origin_min_keep_alive_connections
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.UNINDENT As connection to an origin server are
opened, keep at least 'n' number of connections open to that origin, even if the connection isn't
used for a long time period. Useful when the origin supports keep-alive, removing the time needed
to set up a new connection from the next request at the expense of added (inactive) connections.
To enable, set to one (1).
proxy.config.http.connect_attempts_rr_retries
Scope CONFIG.TP Type INT.TP Default 3.TP Reloadable Yes.TP Overridable Yes.UNINDENT The maximum number
of failed connection attempts allowed before a round-robin entry is marked as 'down' if a server
has round-robin DNS entries.
proxy.config.http.connect_attempts_timeout
Scope CONFIG.TP Type INT.TP Default 30.TP Reloadable Yes.TP Overridable Yes.UNINDENT The timeout value
(in seconds) for time to first byte for an origin server connection.
See admin-performance-timeouts for more discussion on Traffic Server timeouts.
proxy.config.http.post_connect_attempts_timeout
Scope CONFIG.TP Type INT.TP Default 1800.TP Reloadable Yes.TP Overridable Yes.UNINDENT The timeout value
(in seconds) for an origin server connection when the client request is a POST or PUT request.
See admin-performance-timeouts for more discussion on Traffic Server timeouts.
proxy.config.http.post.check.content_length.enabled
Scope CONFIG.TP Type INT.TP Default 1.UNINDENT Enables (1) or disables (0) checking the Content-Length:
Header for a POST request.
proxy.config.http.down_server.cache_time
Scope CONFIG.TP Type INT.TP Default 60.TP Reloadable Yes.TP Overridable Yes.UNINDENT Specifies how long
(in seconds) Traffic Server remembers that an origin server was unreachable.
proxy.config.http.down_server.abort_threshold
Scope CONFIG.TP Type INT.TP Default 10.TP Reloadable Yes.TP Overridable Yes.UNINDENT The number of
seconds before Traffic Server marks an origin server as unavailable after a client abandons a
request because the origin server was too slow in sending the response header.
proxy.config.http.uncacheable_requests_bypass_parent
Scope CONFIG.TP Type INT.TP Default 1.TP Reloadable Yes.TP Overridable Yes.UNINDENT When enabled (1),
Traffic Server bypasses the parent proxy for a request that is not cacheable.
CONGESTION CONTROL
proxy.config.http.flow_control.enabled
Scope CONFIG.TP Type INT.TP Default 0.TP Overridable Yes.UNINDENT Transaction buffering / flow control
is enabled if this is set to a non-zero value. Otherwise no flow control is done.
proxy.config.http.flow_control.high_water
Scope CONFIG.TP Type INT.TP Default 0.TP Units bytes.TP Overridable Yes.UNINDENT The high water mark for
transaction buffer control. External source I/O is halted when the total buffer space in use by
the transaction exceeds this value.
proxy.config.http.flow_control.low_water
Scope CONFIG.TP Type INT.TP Default 0.TP Units bytes.TP Overridable Yes.UNINDENT The low water mark for
transaction buffer control. External source I/O is resumed when the total buffer space in use by
the transaction is no more than this value.
proxy.config.http.websocket.max_number_of_connections
Scope CONFIG.TP Type INT.TP Default -1.TP Reloadable Yes.UNINDENT When enabled >= (0), Traffic Server
will enforce a maximum number of simultaneous websocket connections.
NEGATIVE RESPONSE CACHING
proxy.config.http.negative_caching_enabled
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.TP Overridable Yes.UNINDENT When enabled (1),
Traffic Server caches negative responses (such as 404 Not Found) when a requested page does not
exist. The next time a client requests the same page, Traffic Server serves the negative response
directly from cache.
When disabled (0), Traffic Server will only cache the response if the response has Cache-Control
headers.
The following negative responses are cached by Traffic Server by default:
┌────────────────────┬───────────────────────┐
│ HTTP Response Code │ Description │
├────────────────────┼───────────────────────┤
│ 204 │ No Content │
├────────────────────┼───────────────────────┤
│ 305 │ Use Proxy │
├────────────────────┼───────────────────────┤
│ 400 │ Bad Request │
├────────────────────┼───────────────────────┤
│ 403 │ Forbidden │
├────────────────────┼───────────────────────┤
│ 404 │ Not Found │
├────────────────────┼───────────────────────┤
│ 414 │ URI Too Long │
├────────────────────┼───────────────────────┤
│ 405 │ Method Not Allowed │
├────────────────────┼───────────────────────┤
│ 500 │ Internal Server Error │
├────────────────────┼───────────────────────┤
│ 501 │ Not Implemented │
├────────────────────┼───────────────────────┤
│ 502 │ Bad Gateway │
├────────────────────┼───────────────────────┤
│ 503 │ Service Unavailable │
├────────────────────┼───────────────────────┤
│ 504 │ Gateway Timeout │
└────────────────────┴───────────────────────┘
The cache lifetime for objects cached from this setting is controlled via
proxy.config.http.negative_caching_lifetime.
proxy.config.http.negative_caching_lifetime
Scope CONFIG.TP Type INT.TP Default 1800.TP Reloadable Yes.TP Overridable Yes.UNINDENT How long (in
seconds) Traffic Server keeps the negative responses valid in cache. This value only affects
negative responses that do NOT have explicit Expires: or Cache-Control: lifetimes set by the
server.
proxy.config.http.negative_caching_list
Scope CONFIG.TP Type STRING.TP Default 204 305 403 404 405 414 500 501 502 503 504.TP Reloadable
Yes.UNINDENT The HTTP status code for negative caching. Default values are mentioned above. The
unwanted status codes can be taken out from the list. Other status codes can be added. The
variable is a list but parsed as STRING.
proxy.config.http.negative_revalidating_enabled
Scope CONFIG.TP Type INT.TP Default 1.TP Reloadable Yes.TP Overridable Yes.UNINDENT Negative
revalidating allows Traffic Server to return stale content if revalidation to the origin fails due
to network or HTTP errors. If it is enabled, rather than caching the negative response, the
current stale content is preserved and served. Note this is considered only on a revalidation of
already cached content. A revalidation failure means a connection failure or a 50x response code.
A value of 0 disables serving stale content and a value of 1 enables keeping and serving stale
content if revalidation fails.
proxy.config.http.negative_revalidating_lifetime
Scope CONFIG.TP Type INT.TP Default 1800.UNINDENT How long, in seconds, to consider a stale cached
document valid if If proxy.config.http.negative_revalidating_enabled is enabled and Traffic Server
receives a negative (5xx only) response from the origin server during revalidation.
PROXY USER VARIABLES
proxy.config.http.anonymize_remove_from
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.TP Overridable Yes.UNINDENT When enabled (1),
Traffic Server removes the From header to protect the privacy of your users.
proxy.config.http.anonymize_remove_referer
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.UNINDENT When enabled (1), Traffic Server
removes the Referrer header to protect the privacy of your site and users.
proxy.config.http.anonymize_remove_user_agent
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.TP Overridable Yes.UNINDENT When enabled (1),
Traffic Server removes the User-agent header to protect the privacy of your site and users.
proxy.config.http.anonymize_remove_cookie
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.TP Overridable Yes.UNINDENT When enabled (1),
Traffic Server removes the Cookie header to protect the privacy of your site and users.
proxy.config.http.anonymize_remove_client_ip
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.TP Overridable Yes.UNINDENT When enabled (1),
Traffic Server removes Client-IP headers for more privacy.
proxy.config.http.insert_client_ip
Scope CONFIG.TP Type INT.TP Default 1.TP Reloadable Yes.TP Overridable Yes.UNINDENT Specifies whether
Traffic Server inserts Client-IP headers to retain the client IP address:
┌───────┬───────────────────────────────────────┐
│ Value │ Description │
├───────┼───────────────────────────────────────┤
│ 0 │ Don't insert the Client-ip header │
├───────┼───────────────────────────────────────┤
│ 1 │ Insert the Client-ip header, but only │
│ │ if the UA did not send one │
├───────┼───────────────────────────────────────┤
│ 2 │ Always insert the Client-ip header │
└───────┴───────────────────────────────────────┘
proxy.config.http.anonymize_other_header_list
Scope CONFIG.TP Type STRING.TP Default NULL.TP Reloadable Yes.UNINDENT Comma separated list of headers
Traffic Server should remove from outgoing requests.
proxy.config.http.insert_squid_x_forwarded_for
Scope CONFIG.TP Type INT.TP Default 1.TP Reloadable Yes.TP Overridable Yes.UNINDENT When enabled (1),
Traffic Server adds the client IP address to the X-Forwarded-For header.
proxy.config.http.insert_forwarded
Scope CONFIG.TP Type STRING.TP Default none.TP Reloadable Yes.TP Overridable Yes.UNINDENT The default
value (none) means that Traffic Server does not insert or append information to any Forwarded
header (described in IETF RFC 7239) in the request message. To put information into a Forwarded
header in the request, the value of this variable must be a list of the Forwarded parameters to be
inserted.
┌────────────────────┬───────────────────────────────────────┐
│ Parameter │ Value of parameter place in outgoing │
│ │ Forwarded header │
├────────────────────┼───────────────────────────────────────┤
│ for │ Client IP address │
├────────────────────┼───────────────────────────────────────┤
│ by=ip │ Proxy IP address │
├────────────────────┼───────────────────────────────────────┤
│ by=unknown │ The literal string unknown │
├────────────────────┼───────────────────────────────────────┤
│ by=servername │ Proxy server name │
├────────────────────┼───────────────────────────────────────┤
│ by=uuid │ Server UUID prefixed with _ │
├────────────────────┼───────────────────────────────────────┤
│ proto │ Protocol of incoming request │
├────────────────────┼───────────────────────────────────────┤
│ host │ The host specified in the incoming │
│ │ request │
├────────────────────┼───────────────────────────────────────┤
│ connection=compact │ Connection with basic transaction │
│ │ codes. │
├────────────────────┼───────────────────────────────────────┤
│ connection=std │ Connection with detailed transaction │
│ │ codes. │
├────────────────────┼───────────────────────────────────────┤
│ connection=full │ Full user agent connection protocol │
│ │ tags │
└────────────────────┴───────────────────────────────────────┘
Each parameter in the list must be separated by | or :. For example, for|by=uuid|proto is a valid
value for this variable. Note that the connection parameter is a non-standard extension to RFC
7239. Also note that, while Traffic Server allows multiple by parameters for the same proxy, this
is prohibited by RFC 7239. Currently, for the host parameter to provide the original host from the
incoming client request, proxy.config.url_remap.pristine_host_hdr must be enabled.
proxy.config.http.proxy_protocol_whitelist
Scope CONFIG.TP Type STRING.TP Default ```<ip list>```.UNINDENT This defines a whitelist of server IPs
that are trusted to provide connections with Proxy Protocol information. This is a comma
delimited list of IP addresses. Addressed may be listed individually, in a range separated by a
dash or by using CIDR notation.
IMPORTANT:
If Proxy Protocol is enabled on the port, but this directive is not defined any server may initiate a
connection with Proxy Protocol information. See proxy.config.http.server_ports for information on how
to enable Proxy Protocol on a port.
See proxy-protocol for more discussion on how Traffic Server transforms the
`
Forwarded: header.
proxy.config.http.normalize_ae
Scope CONFIG.TP Type INT.TP Default 1.TP Reloadable Yes.TP Overridable Yes.UNINDENT Specifies
normalization, if any, of Accept-Encoding: headers.
─────────────────────────────────────────────────
Value Description
─────────────────────────────────────────────────
0 No normalization.
─────────────────────────────────────────────────
1 Accept-Encoding: gzip (if the header
has gzip or x-gzip with any q) OR
blank (for any header that does not
include gzip)
─────────────────────────────────────────────────
2 Accept-Encoding: br if the header has
br (with any q) ELSE normalize as for
value 1
┌───────┬───────────────────────────────────────┐
│ │ │
--
SECURITY │ │ │
--
CACHE CONTROL │ │ │
--
RAM CACHE
proxy.config.cache.ram_cache.size
Scope CONFIG.TP Type INT.TP Default -1.UNINDENT By default the RAM cache size is automatically
determined, based on disk cache size; approximately 10 MB of RAM cache per GB of disk cache.
Alternatively, it can be set to a fixed value such as 20GB (21474836480)
proxy.config.cache.ram_cache_cutoff
Scope CONFIG.TP Type INT.TP Default 4194304.UNINDENT Objects greater than this size will not be kept in
the RAM cache. This should be set high enough to keep objects accessed frequently in memory in
order to improve performance. 4MB (4194304)
proxy.config.cache.ram_cache.algorithm
Scope CONFIG.TP Type INT.TP Default 1.UNINDENT Two distinct RAM caches are supported, the default (0)
being the CLFUS (Clocked Least Frequently Used by Size). As an alternative, a simpler LRU (Least
Recently Used) cache is also available, by changing this configuration to 1.
proxy.config.cache.ram_cache.use_seen_filter
Scope CONFIG.TP Type INT.TP Default 1.UNINDENT Enabling this option will filter inserts into the RAM
cache to ensure that they have been seen at least once. For the LRU, this provides scan
resistance. Note that CLFUS already requires that a document have history before it is inserted,
so for CLFUS, setting this option means that a document must be seen three times before it is
added to the RAM cache.
proxy.config.cache.ram_cache.compress
Scope CONFIG.TP Type INT.TP Default 0.UNINDENT The CLFUS RAM cache also supports an optional in-memory
compression. This is not to be confused with Content-Encoding: gzip compression. The RAM cache
compression is intended to try to save space in the RAM, and is not visible to the User-Agent
(client).
Possible values are:
┌───────┬───────────────────────────────────────┐
│ Value │ Description │
├───────┼───────────────────────────────────────┤
│ 0 │ No compression │
├───────┼───────────────────────────────────────┤
│ 1 │ Fastlz (extremely fast, relatively │
│ │ low compression) │
├───────┼───────────────────────────────────────┤
│ 2 │ Libz (moderate speed, reasonable │
│ │ compression) │
├───────┼───────────────────────────────────────┤
│ 3 │ Liblzma (very slow, high compression) │
└───────┴───────────────────────────────────────┘
Compression runs on task threads. To use more cores for RAM cache compression, increase
proxy.config.task_threads.
HEURISTIC EXPIRATION
proxy.config.http.cache.heuristic_min_lifetime
Scope CONFIG.TP Type INT.TP Default 3600.TP Reloadable Yes.TP Overridable Yes.UNINDENT The minimum
amount of time, in seconds, an HTTP object without an expiration date can remain fresh in the
cache before is considered to be stale.
proxy.config.http.cache.heuristic_max_lifetime
Scope CONFIG.TP Type INT.TP Default 86400.TP Reloadable Yes.TP Overridable Yes.UNINDENT The maximum
amount of time, in seconds, an HTTP object without an expiration date can remain fresh in the
cache before is considered to be stale.
proxy.config.http.cache.heuristic_lm_factor
Scope CONFIG.TP Type FLOAT.TP Default 0.10.TP Reloadable Yes.TP Overridable Yes.UNINDENT The aging
factor for freshness computations. Traffic Server stores an object for this percentage of the time
that elapsed since it last changed.
proxy.config.http.cache.guaranteed_min_lifetime
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.TP Overridable Yes.UNINDENT Establishes a
guaranteed minimum lifetime boundary for freshness heuristics. When heuristics are used, and the
proxy.config.http.cache.heuristic_lm_factor aging factor is applied, the final minimum age
calculated will never be lower than the value in this variable.
proxy.config.http.cache.guaranteed_max_lifetime
Scope CONFIG.TP Type INT.TP Default 31536000.TP Reloadable Yes.TP Overridable Yes.UNINDENT Establishes a
guaranteed maximum lifetime boundary for freshness heuristics. When heuristics are used, and the
proxy.config.http.cache.heuristic_lm_factor aging factor is applied, the final maximum age
calculated will never be higher than the value in this variable.
DYNAMIC CONTENT & CONTENT NEGOTIATION
proxy.config.http.cache.vary_default_text
Scope CONFIG.TP Type STRING.TP Default NULL.TP Reloadable Yes.TP Overridable Yes.UNINDENT The header on
which Traffic Server varies for text documents.
For example: if you specify User-agent, then Traffic Server caches all the different user-agent
versions of documents it encounters.
proxy.config.http.cache.vary_default_images
Scope CONFIG.TP Type STRING.TP Default NULL.TP Reloadable Yes.TP Overridable Yes.UNINDENT The header on
which Traffic Server varies for images.
proxy.config.http.cache.vary_default_other
Scope CONFIG.TP Type STRING.TP Default NULL.TP Reloadable Yes.TP Overridable Yes.UNINDENT The header on
which Traffic Server varies for anything other than text and images.
proxy.config.http.cache.open_read_retry_time
Scope CONFIG.TP Type INT.TP Default 10.TP Reloadable Yes.UNINDENT
The number of milliseconds a cacheable request will wait before requesting the object from cache if an
equivalent request is in flight.
proxy.config.http.cache.max_open_read_retries
Scope CONFIG.TP Type INT.TP Default -1.TP Reloadable Yes.TP Overridable Yes.UNINDENT
The number of times to attempt fetching an object from cache if there was an equivalent request in
flight.
proxy.config.http.cache.max_open_write_retries
Scope CONFIG.TP Type INT.TP Default 1.TP Reloadable Yes.TP Overridable Yes.UNINDENT
The number of times to attempt a cache open write upon failure to get a write lock.
proxy.config.http.cache.open_write_fail_action
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.TP Overridable Yes.UNINDENT
This setting indicates the action taken on failing to obtain the cache open write lock on either a
cache miss or a cache hit stale. This typically happens when there is more than one request to the
same cache object simultaneously. During such a scenario, all but one (which goes to the origin)
request is served either a stale copy or an error depending on this setting.
┌───────┬────────────────────────────────────────┐
│ Value │ Description │
├───────┼────────────────────────────────────────┤
│ 0 │ Default. Disable cache and go to │
│ │ origin server. │
├───────┼────────────────────────────────────────┤
│ 1 │ Return a 502 error on a cache miss. │
├───────┼────────────────────────────────────────┤
│ 2 │ Serve stale if object's age is under │
│ │ proxy.config.http.cache.max_stale_age. │
│ │ Otherwise, go to origin server. │
├───────┼────────────────────────────────────────┤
│ 3 │ Return a 502 error on a cache miss or │
│ │ serve stale on a cache revalidate if │
│ │ object's age is under │
│ │ proxy.config.http.cache.max_stale_age. │
│ │ Otherwise, go to origin server. │
├───────┼────────────────────────────────────────┤
│ 4 │ Return a 502 error on either a cache │
│ │ miss or on a revalidation. │
└───────┴────────────────────────────────────────┘
CUSTOMIZABLE USER RESPONSE PAGES
proxy.config.body_factory.enable_customizations
Scope CONFIG.TP Type INT.TP Default 1.UNINDENT Specifies whether customizable response pages are
language specific or not:
─────────────────────────────────────────────────
│ Value │ Description │
├───────┼───────────────────────────────────────┤
│ 1 │ Enable customizable user response │
│ │ pages in the default directory only. │
├───────┼───────────────────────────────────────┤
│ 2 │ Enable language-targeted user │
│ │ response pages. │
├───────┼───────────────────────────────────────┤
│ 3 │ Enable host-targeted user response │
│ │ pages. │
└───────┴───────────────────────────────────────┘
proxy.config.body_factory.enable_logging
Scope CONFIG.TP Type INT.TP Default 0.UNINDENT Enables (1) or disables (0) logging for customizable
response pages. When enabled, Traffic Server records a message in the error log each time a
customized response page is used or modified.
proxy.config.body_factory.template_sets_dir
Scope CONFIG.TP Type STRING.TP Default etc/trafficserver/body_factory.UNINDENT The customizable response
page default directory. If this is a relative path, Traffic Server resolves it relative to the
PREFIX directory.
proxy.config.body_factory.template_base
Scope CONFIG.TP Type STRING.TP Default "".TP Reloadable Yes.TP Overridable Yes.UNINDENT A prefix for the
file name to use to find an error template file. If set (not the empty string) this value and an
underscore are predended to the file name to find in the template sets directory. See
body-factory.
proxy.config.body_factory.response_max_size
Scope CONFIG.TP Type INT.TP Default 8192.TP Reloadable Yes.UNINDENT Maximum size of the error template
response page.
proxy.config.body_factory.response_suppression_mode
Scope CONFIG.TP Type INT.TP Default 0.UNINDENT Specifies when Traffic Server suppresses generated
response pages:
┌───────┬───────────────────────────────────────┐
│ Value │ Description │
├───────┼───────────────────────────────────────┤
│ 0 │ Never suppress generated response │
│ │ pages. │
├───────┼───────────────────────────────────────┤
│ 1 │ Always suppress generated response │
│ │ pages. │
├───────┼───────────────────────────────────────┤
│ 2 │ Suppress response pages only for │
│ │ intercepted traffic. │
└───────┴───────────────────────────────────────┘
proxy.config.http_ui_enabled
Scope CONFIG.TP Type INT.TP Default 0.UNINDENT Specifies which http Inspector UI endpoints to allow
within remap.config:
┌───────┬───────────────────────────────────────┐
│ Value │ Description │
├───────┼───────────────────────────────────────┤
│ 0 │ Disable all http UI endpoints. │
├───────┼───────────────────────────────────────┤
│ 1 │ Enable only Cache Inspector │
│ │ endpoints. │
├───────┼───────────────────────────────────────┤
│ 2 │ Enable only stats endpoints. │
├───────┼───────────────────────────────────────┤
│ 3 │ Enable all http UI endpoints. │
└───────┴───────────────────────────────────────┘
To enable any enpoint there needs to be an entry in remap.config which specifically enables it.
Such a line would look like:
map / http://{cache}
The following are the cache endpoints:
┌───────┬────────────────────────────────┐
│ Name │ Description │
├───────┼────────────────────────────────┤
│ cache │ UI to interact with the cache. │
└───────┴────────────────────────────────┘
The following are the stats endpoints:
──────────────────────────────────────────────────────────
Name Description
──────────────────────────────────────────────────────────
cache-internal Statistics about cache evacuation and
volumes.
──────────────────────────────────────────────────────────
hostdb Lookups against the hostdb.
──────────────────────────────────────────────────────────
http HTTPSM details, this endpoint is also
gated by
proxy.config.http.enable_http_info.
──────────────────────────────────────────────────────────
net Lookup and listing of open
connections.
┌────────────────┬───────────────────────────────────────┐
│ │ │
--
DNS │ │ │
--
HOSTDB
proxy.config.hostdb.lookup_timeout
Scope CONFIG.TP Type INT.TP Default 30.TP Units seconds.TP Reloadable Yes.UNINDENT Time to wait for a
DNS response in seconds.
See admin-performance-timeouts for more discussion on Traffic Server timeouts.
proxy.config.hostdb.serve_stale_for
Scope CONFIG.TP Type INT.TP Default *NONE*.TP Units seconds.TP Reloadable Yes.UNINDENT The number of
seconds for which to use a stale NS record while initiating a background fetch for the new data.
If not set then stale records are not served.
proxy.config.hostdb.max_size
Scope CONFIG.TP Type INT.TP Default 10737418240.TP Units bytes.UNINDENT The maximum amount of space (in
bytes) allocated to hostdb. Setting this value to -1 will disable size limit enforcement.
proxy.config.hostdb.max_count
Scope CONFIG.TP Type INT.TP Default -1.UNINDENT The maximum number of entries that can be stored in
hostdb. A value of -1 disables item count limit enforcement.
NOTE:
For values above 200000, you must increase proxy.config.hostdb.max_size by at least 44 bytes per
entry.
proxy.config.hostdb.round_robin_max_count
Scope CONFIG.TP Type INT.TP Default 16.UNINDENT The maximum count of DNS answers per round robin hostdb
record. The default variable is 16.
proxy.config.hostdb.ttl_mode
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.UNINDENT A host entry will eventually time out
and be discarded. This variable controls how that time is calculated. A DNS request will return a
TTL value and an internal value can be set with proxy.config.hostdb.timeout. This variable
determines which value will be used.
┌───────┬───────────────────────────────────────┐
│ Value │ TTL │
├───────┼───────────────────────────────────────┤
│ 0 │ The TTL from the DNS response. │
├───────┼───────────────────────────────────────┤
│ 1 │ The internal timeout value. │
├───────┼───────────────────────────────────────┤
│ 2 │ The smaller of the DNS and internal │
│ │ TTL values. The internal timeout │
│ │ value becomes a maximum TTL. │
├───────┼───────────────────────────────────────┤
│ 3 │ The larger of the DNS and internal │
│ │ TTL values. The internal timeout │
│ │ value become a minimum TTL. │
└───────┴───────────────────────────────────────┘
proxy.config.hostdb.timeout
Scope CONFIG.TP Type INT.TP Default 1440.TP Units seconds.TP Reloadable Yes.UNINDENT Internal time to
live value for host DB entries in seconds.
See proxy.config.hostdb.ttl_mode for when this value is used. See admin-performance-timeouts for
more discussion on Traffic Server timeouts.
proxy.config.hostdb.fail.timeout
Scope CONFIG.TP Type INT.TP Default 0.UNINDENT Time to live value for "failed" hostdb lookups.
NOTE:
HostDB considers any response that does not contain a response to the query a failure. This means
"failure" responses (such as SOA) are subject to this timeout
proxy.config.hostdb.strict_round_robin
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.UNINDENT Set host resolution to use strict round
robin.
When this and proxy.config.hostdb.timed_round_robin are both disabled (set to 0), Traffic Server
always uses the same origin server for the same client, for as long as the origin server is
available. Otherwise if this is set then IP address is rotated on every request. This setting
takes precedence over proxy.config.hostdb.timed_round_robin.
proxy.config.hostdb.timed_round_robin
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.UNINDENT Set host resolution to use timed round
robin.
When this and proxy.config.hostdb.strict_round_robin are both disabled (set to 0), Traffic Server
always uses the same origin server for the same client, for as long as the origin server is
available. Otherwise if this is set to N the IP address is rotated if more than N seconds have
passed since the first time the current address was used.
proxy.config.hostdb.host_file.path
Scope CONFIG.TP Type STRING.TP Default NULL.UNINDENT Set the file path for an external host file.
If this is set (non-empty) then the file is presumed to be a hosts file in the standard . It is
read and the entries there added to the HostDB. The file is periodically checked for a more recent
modification date in which case it is reloaded. The interval is set with
proxy.config.hostdb.host_file.interval.
While not technically reloadable, the value is read every time the file is to be checked so that
if changed the new value will be used on the next check and the file will be treated as modified.
proxy.config.hostdb.host_file.interval
Scope CONFIG.TP Type INT.TP Default 86400.TP Units seconds.TP Reloadable Yes.UNINDENT Set the file
changed check timer for proxy.config.hostdb.host_file.path.
The file is checked every this many seconds to see if it has changed. If so the HostDB is updated
with the new values in the file.
proxy.config.hostdb.partitions
Scope CONFIG.TP Type INT.TP Default 64.UNINDENT The number of partitions for hostdb. If you are seeing
lock contention within hostdb's cache (due to a large number of records) you can increase the
number of partitions
proxy.config.hostdb.ip_resolve
Scope CONFIG.TP Type STRING.TP Default NULL.UNINDENT Set the host resolution style.
This is an ordered list of keywords separated by semicolons that specify how a host name is to be
resolved to an IP address. The keywords are case insensitive.
┌─────────┬───────────────────────────────────────┐
│ Keyword │ Description │
├─────────┼───────────────────────────────────────┤
│ ipv4 │ Resolve to an IPv4 address. │
├─────────┼───────────────────────────────────────┤
│ ipv6 │ Resolve to an IPv6 address. │
├─────────┼───────────────────────────────────────┤
│ client │ Resolve to the same family as the │
│ │ client IP address. │
├─────────┼───────────────────────────────────────┤
│ only │ Stop resolving. │
└─────────┴───────────────────────────────────────┘
The order of the keywords is critical. When a host name needs to be resolved it is resolved in
same order as the keywords. If a resolution fails, the next option in the list is tried. The
keyword only means to give up resolution entirely. The keyword list has a maximum length of three
keywords, more are never needed. By default there is an implicit ipv4;ipv6 attached to the end of
the string unless the keyword only appears.
Example
Use the incoming client family, then try IPv4 and IPv6.
client;ipv4;ipv6
Because of the implicit resolution this can also be expressed as just
client
Example
Resolve only to IPv4.
ipv4;only
Example
Resolve only to the same family as the client (do not permit cross family transactions).
client;only
This value is a global default that can be overridden by proxy.config.http.server_ports.
NOTE:
This style is used as a convenience for the administrator. During a resolution the resolution order
will be one family, then possibly the other. This is determined by changing client to ipv4 or ipv6
based on the client IP address and then removing duplicates.
IMPORTANT:
This option has no effect on outbound transparent connections The local IP address used in the
connection to the origin server is determined by the client, which forces the IP address family of the
address used for the origin server. In effect, outbound transparent connections always use a
resolution style of "client".
proxy.config.hostdb.verify_after
Scope CONFIG.TP Type INT.TP Default 720.UNINDENT Set the interval (in seconds) in which to re-query DNS
regardless of TTL status.
proxy.config.hostdb.filename
Scope CONFIG.TP Type STRING.TP Default "host.db".UNINDENT The filename to persist hostdb to on disk.
proxy.config.cache.hostdb.sync_frequency
Scope CONFIG.TP Type INT.TP Default 120.UNINDENT Set the frequency (in seconds) to sync hostdb to disk.
Note: hostdb is syncd to disk on a per-partition basis (of which there are 64). This means that
the minimum time to sync all data to disk is proxy.config.cache.hostdb.sync_frequency * 64
LOGGING CONFIGURATION
proxy.config.log.logging_enabled
Scope CONFIG.TP Type INT.TP Default 3.TP Reloadable Yes.UNINDENT Enables and disables event logging:
┌───────┬───────────────────────────────────────┐
│ Value │ Effect │
├───────┼───────────────────────────────────────┤
│ 0 │ Logging disabled. │
├───────┼───────────────────────────────────────┤
│ 1 │ Log errors only. │
├───────┼───────────────────────────────────────┤
│ 2 │ Log transactions only. │
├───────┼───────────────────────────────────────┤
│ 3 │ Dual logging (errors and │
│ │ transactions). │
└───────┴───────────────────────────────────────┘
Refer to admin-logging for more information on event logging.
proxy.config.log.max_secs_per_buffer
Scope CONFIG.TP Type INT.TP Default 5.TP Reloadable Yes.UNINDENT The maximum amount of time before data
in the buffer is flushed to disk.
NOTE:
The effective lower bound to this config is whatever proxy.config.log.periodic_tasks_interval is set
to.
proxy.config.log.max_space_mb_for_logs
Scope CONFIG.TP Type INT.TP Default 25000.TP Units megabytes.TP Reloadable Yes.UNINDENT The amount of
space allocated to the logging directory (in MB). The headroom amount specified by
proxy.config.log.max_space_mb_headroom is taken from this space allocation.
NOTE:
All files in the logging directory contribute to the space used, even if they are not log files. In
collation client mode, if there is no local disk logging, or
proxy.config.log.max_space_mb_for_orphan_logs is set to a higher value than
proxy.config.log.max_space_mb_for_logs, Traffic Server will take
proxy.config.log.max_space_mb_for_orphan_logs for maximum allowed log space.
proxy.config.log.max_space_mb_for_orphan_logs
Scope CONFIG.TP Type INT.TP Default 25.TP Units megabytes.TP Reloadable Yes.UNINDENT The amount of space
allocated to the logging directory (in MB) if this node is acting as a collation client.
NOTE:
When max_space_mb_for_orphan_logs is take as the maximum allowed log space in the logging system, the
same rule apply to proxy.config.log.max_space_mb_for_logs also apply to
proxy.config.log.max_space_mb_for_orphan_logs, ie: All files in the logging directory contribute to
the space used, even if they are not log files. you may need to consider this when you enable full
remote logging, and bump to the same size as proxy.config.log.max_space_mb_for_logs.
proxy.config.log.max_space_mb_headroom
Scope CONFIG.TP Type INT.TP Default 1000.TP Units megabytes.TP Reloadable Yes.UNINDENT The tolerance for
the log space limit (in megabytes). If the variable proxy.config.log.auto_delete_rolled_files is
set to 1 (enabled), then autodeletion of log files is triggered when the amount of free space
available in the logging directory is less than the value specified here.
proxy.config.log.hostname
Scope CONFIG.TP Type STRING.TP Default localhost.TP Reloadable Yes.UNINDENT The hostname of the machine
running Traffic Server.
proxy.config.log.logfile_dir
Scope CONFIG.TP Type STRING.TP Default var/log/trafficserver.TP Reloadable Yes.UNINDENT The path to the
logging directory. This can be an absolute path or a path relative to the PREFIX directory in
which Traffic Server is installed.
NOTE:
The directory you specify must already exist.
proxy.config.log.logfile_perm
Scope CONFIG.TP Type STRING.TP Default rw-r--r--.TP Reloadable Yes.UNINDENT The log file permissions.
The standard UNIX file permissions are used (owner, group, other). Permissible values are:
┌───────┬─────────────────────┐
│ Value │ Description │
├───────┼─────────────────────┤
│ - │ No permissions. │
├───────┼─────────────────────┤
│ r │ Read permission. │
├───────┼─────────────────────┤
│ w │ Write permission. │
├───────┼─────────────────────┤
│ x │ Execute permission. │
└───────┴─────────────────────┘
Permissions are subject to the umask settings for the Traffic Server process. This means that a
umask setting of 002 will not allow write permission for others, even if specified in the
configuration file. Permissions for existing log files are not changed when the configuration is
modified.
proxy.local.log.collation_mode
Scope LOCAL.TP Type INT.TP Default 0.TP Reloadable Yes.TP Deprecated Yes.UNINDENT Set the log collation
mode.
┌───────┬───────────────────────────────────────┐
│ Value │ Effect │
├───────┼───────────────────────────────────────┤
│ 0 │ Log collation is disabled. │
├───────┼───────────────────────────────────────┤
│ 1 │ This host is a log collation server. │
├───────┼───────────────────────────────────────┤
│ 2 │ This host is a collation client and │
│ │ sends entries using standard formats │
│ │ to the collation server. │
├───────┼───────────────────────────────────────┤
│ 3 │ This host is a collation client and │
│ │ sends entries using the traditional │
│ │ custom formats to the collation │
│ │ server. │
├───────┼───────────────────────────────────────┤
│ 4 │ This host is a collation client and │
│ │ sends entries that use both the │
│ │ standard and traditional custom │
│ │ formats to the collation server. │
└───────┴───────────────────────────────────────┘
For information on sending custom formats to the collation server, refer to
admin-logging-collating-custom-formats and logging.yaml.
NOTE:
Log collation is a deprecated feature as of ATS v8.0.0, and will be removed in ATS v9.0.0. Our
recommendation is to use one of the many existing log collection tools, such as Kafka, LogStash,
FileBeat, Fluentd or even syslog / syslog-ng.
proxy.config.log.collation_host
Scope CONFIG.TP Type STRING.TP Default NULL.TP Deprecated Yes.UNINDENT The hostname of the log collation
server.
proxy.config.log.collation_port
Scope CONFIG.TP Type INT.TP Default 8085.TP Reloadable Yes.TP Deprecated Yes.UNINDENT The port used for
communication between the collation server and client.
proxy.config.log.collation_secret
Scope CONFIG.TP Type STRING.TP Default foobar.TP Reloadable Yes.TP Deprecated Yes.UNINDENT The password
used to validate logging data and prevent the exchange of unauthorized information when a
collation server is being used.
proxy.config.log.collation_host_tagged
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.TP Deprecated Yes.UNINDENT When enabled (1),
configures Traffic Server to include the hostname of the collation client that generated the log
entry in each entry.
proxy.config.log.collation_retry_sec
Scope CONFIG.TP Type INT.TP Default 5.TP Reloadable Yes.TP Deprecated Yes.UNINDENT The number of seconds
between collation server connection retries.
proxy.config.log.collation_host_timeout
Scope CONFIG.TP Type INT.TP Default 86390.TP Deprecated Yes.UNINDENT The number of seconds before
inactivity time-out events for the host side. This setting over-rides the default set with
proxy.config.net.default_inactivity_timeout for log collation connections.
The default is set for 10s less on the host side to help prevent any possible race conditions. If
the host disconnects first, the client will see the disconnect before its own time-out and
re-connect automatically. If the client does not see the disconnect, i.e., connection is
"locked-up" for some reason, it will disconnect when it reaches its own time-out and then
re-connect automatically.
proxy.config.log.collation_client_timeout
Scope CONFIG.TP Type INT.TP Default 86400.TP Deprecated Yes.UNINDENT The number of seconds before
inactivity time-out events for the client side. This setting over-rides the default set with
proxy.config.net.default_inactivity_timeout for log collation connections.
proxy.config.log.rolling_enabled
Scope CONFIG.TP Type INT.TP Default 1.TP Reloadable Yes.UNINDENT Specifies how log files are rolled. You
can specify the following values:
─────────────────────────────────────────────────
Value Description
─────────────────────────────────────────────────
0 Disables log file rolling.
─────────────────────────────────────────────────
1 Enables log file rolling at specific
intervals during the day (specified
with the
proxy.config.log.rolling_interval_sec
and
proxy.config.log.rolling_offset_hr
variables).
─────────────────────────────────────────────────
2 Enables log file rolling when log
files reach a specific size
(specified with
proxy.config.log.rolling_size_mb).
─────────────────────────────────────────────────
3 Enables log file rolling at specific
intervals during the day or when log
files reach a specific size
(whichever occurs first).
─────────────────────────────────────────────────
4 Enables log file rolling at specific
intervals during the day when log
files reach a specific size (i.e. at
a specified time if the file is of
the specified size).
┌───────┬───────────────────────────────────────┐
│ │ │
--
DIAGNOSTIC LOGGING CONFIGURATION │ │ │
proxy.config.diags.output.diag │ │ │
│ │ │
Scope CONFIG.TP Type STRING.TP│Default│E.UNINDENT │
proxy.config.diags.output.debug
Scope CONFIG.TP Type STRING.TP Default E.UNINDENT
proxy.config.diags.output.status
Scope CONFIG.TP Type STRING.TP Default L.UNINDENT
proxy.config.diags.output.note
Scope CONFIG.TP Type STRING.TP Default L.UNINDENT
proxy.config.diags.output.warning
Scope CONFIG.TP Type STRING.TP Default L.UNINDENT
proxy.config.diags.output.error
Scope CONFIG.TP Type STRING.TP Default SL.UNINDENT
proxy.config.diags.output.fatal
Scope CONFIG.TP Type STRING.TP Default SL.UNINDENT
proxy.config.diags.output.alert
Scope CONFIG.TP Type STRING.TP Default L.UNINDENT
proxy.config.diags.output.emergency
Scope CONFIG.TP Type STRING.TP Default SL.UNINDENT The diagnosic output configuration variables control
where Traffic Server should log diagnostic output. Messages at each diagnostic level can be
directed to any combination of diagnostic destinations. Valid diagnostic message destinations
are:
┌───────┬─────────────────────────┐
│ Value │ Description │
├───────┼─────────────────────────┤
│ O │ Log to standard output. │
├───────┼─────────────────────────┤
│ E │ Log to standard error. │
├───────┼─────────────────────────┤
│ S │ Log to syslog. │
├───────┼─────────────────────────┤
│ L │ Log to diags.log. │
└───────┴─────────────────────────┘
Example
To log debug diagnostics to both syslog and diags.log:
CONFIG proxy.config.diags.output.debug STRING SL
proxy.config.diags.show_location
Scope CONFIG.TP Type INT.TP Default 1.UNINDENT Annotates diagnostic messages with the source code
location. Set to 1 to enable for Debug() messages only. Set to 2 to enable for all messages.
proxy.config.diags.debug.enabled
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.UNINDENT When set to 1, enables logging for
diagnostic messages whose log level is diag or debug.
When set to 2, interprets the proxy.config.diags.debug.client_ip setting determine whether
diagnostic messages are logged.
proxy.config.diags.debug.client_ip
Scope CONFIG.TP Type STRING.TP Default NULL.UNINDENT if proxy.config.diags.debug.enabled is set to 2,
this value is tested against the source IP of the incoming connection. If there is a match, all
the diagnostic messages for that connection and the related outgoing connection will be logged.
proxy.config.diags.debug.tags
Scope CONFIG.TP Type STRING.TP Default http|dns.UNINDENT Each Traffic Server diag and debug level
message is annotated with a subsystem tag. This configuration contains an anchored regular
expression that filters the messages based on the tag. The expressions are prefix matched which
creates an implicit .* at the end. Therefore the default value http|dns will match tags such as
http, http_hdrs, dns, and dns_recv.
Some commonly used debug tags are:
┌────────────┬───────────────────────────────────────┐
│ Tag │ Subsystem usage │
├────────────┼───────────────────────────────────────┤
│ dns │ DNS query resolution │
├────────────┼───────────────────────────────────────┤
│ http_hdrs │ Logs the headers for HTTP requests │
│ │ and responses │
├────────────┼───────────────────────────────────────┤
│ privileges │ Privilege elevation │
├────────────┼───────────────────────────────────────┤
│ ssl │ TLS termination and certificate │
│ │ processing │
└────────────┴───────────────────────────────────────┘
Traffic Server plugins will typically log debug messages using the TSDebug() API, passing the
plugin name as the debug tag.
proxy.config.diags.logfile_perm
Scope CONFIG.TP Type STRING.TP Default rw-r--r--.UNINDENT The log file permissions. The standard UNIX
file permissions are used (owner, group, other). Permissible values are:
┌───────┬─────────────────────┐
│ Value │ Description │
├───────┼─────────────────────┤
│ - │ No permissions. │
├───────┼─────────────────────┤
│ r │ Read permission. │
├───────┼─────────────────────┤
│ w │ Write permission. │
├───────┼─────────────────────┤
│ x │ Execute permission. │
└───────┴─────────────────────┘
Permissions are subject to the umask settings for the Traffic Server process. This means that a
umask setting of 002 will not allow write permission for others, even if specified in the
configuration file. Permissions for existing log files are not changed when the configuration is
modified.
proxy.config.diags.logfile.rolling_enabled
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.UNINDENT Specifies how the diagnostics log is
rolled. You can specify the following values:
┌───────┬───────────────────────────────────────────────────┐
│ Value │ Description │
├───────┼───────────────────────────────────────────────────┤
│ 0 │ Disables diagnostics log rolling. │
├───────┼───────────────────────────────────────────────────┤
│ 1 │ Enables diagnostics log rolling at │
│ │ specific intervals (specified with │
│ │ proxy.config.diags.logfile.rolling_interval_sec). │
│ │ The "clock" starts ticking on Traffic │
│ │ Server startup. │
├───────┼───────────────────────────────────────────────────┤
│ 2 │ Enables diagnostics log rolling when the │
│ │ diagnostics log reaches a specific size │
│ │ (specified with │
│ │ proxy.config.diags.logfile.rolling_size_mb). │
├───────┼───────────────────────────────────────────────────┤
│ 3 │ Enables diagnostics log rolling at specific │
│ │ intervals or when the diagnostics log reaches a │
│ │ specific size (whichever occurs first). │
└───────┴───────────────────────────────────────────────────┘
proxy.config.diags.logfile.rolling_interval_sec
Scope CONFIG.TP Type INT.TP Default 3600.TP Units seconds.TP Reloadable Yes.UNINDENT Specifies how often
the diagnostics log is rolled, in seconds. The timer starts on Traffic Server bootup.
proxy.config.diags.logfile.rolling_size_mb
Scope CONFIG.TP Type INT.TP Default 100.TP Units megabytes.TP Reloadable Yes.UNINDENT Specifies at what
size to roll the diagnostics log at.
REVERSE PROXY
proxy.config.reverse_proxy.enabled
Scope CONFIG.TP Type INT.TP Default 1.TP Reloadable Yes.UNINDENT Enables (1) or disables (0) HTTP
reverse proxy.
proxy.config.header.parse.no_host_url_redirect
Scope CONFIG.TP Type STRING.TP Default NULL.TP Reloadable Yes.UNINDENT The URL to which to redirect
requests with no host headers (reverse proxy).
URL REMAP RULES
proxy.config.url_remap.filename
Scope CONFIG.TP Type STRING.TP Default remap.config.UNINDENT Sets the name of the remap.config file.
proxy.config.url_remap.remap_required
Scope CONFIG.TP Type INT.TP Default 1.TP Reloadable Yes.UNINDENT Set this variable to 1 if you want
Traffic Server to serve requests only from origin servers listed in the mapping rules of the
remap.config file. If a request does not match, then the browser will receive an error.
proxy.config.url_remap.pristine_host_hdr
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.TP Overridable Yes.UNINDENT Set this variable to
1 if you want to retain the client host header in a request during remapping.
SSL TERMINATION
proxy.config.ssl.server.cipher_suite
Scope CONFIG.TP Type STRING.TP Default <see notes>.UNINDENT Configures the set of encryption, digest,
authentication, and key exchange algorithms provided by OpenSSL which Traffic Server will use for
SSL connections. For the list of algorithms and instructions on constructing an appropriately
formatting cipher_suite string, see OpenSSL Ciphers.
The current default, included in the records.config.default example configuration is:
ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
proxy.config.ssl.client.cipher_suite
Scope CONFIG.TP Type STRING.TP Default <See notes under proxy.config.ssl.server.cipher_suite.>.UNINDENT
Configures the cipher_suite which Traffic Server will use for SSL connections to origin or next
hop.
proxy.config.ssl.server.TLSv1_3.cipher_suites
Scope CONFIG.TP Type STRING.TP Default <See notes>.UNINDENT Configures the pair of the AEAD algorithm
and hash algorithm to be used with HKDF provided by OpenSSL which Traffic Server will use for
TLSv1.3 connections. For the list of algorithms and instructions, see The -ciphersuites section of
OpenSSL Ciphers.
The current default value with OpenSSL is:
TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
This configuration works with OpenSSL v1.1.1 and above.
proxy.config.ssl.client.TLSv1_3.cipher_suites
Scope CONFIG.TP Type STRING.TP Default <See notes under
proxy.config.ssl.server.tls.cipher_suites>.UNINDENT Configures the cipher_suites which Traffic
Server will use for TLSv1.3 connections to origin or next hop. This configuration works with
OpenSSL v1.1.1 and above.
proxy.config.ssl.server.groups_list
Scope CONFIG.TP Type STRING.TP Default <See notes>.UNINDENT Configures the list of supported groups
provided by OpenSSL which Traffic Server will be used to determine the set of shared groups. The
value is a colon separated list of group NIDs or names, for example "P-521:P-384:P-256". For
instructions, see "Groups" section of TLS1.3 - OpenSSLWiki.
The current default value with OpenSSL is:
X25519:P-256:X448:P-521:P-384
This configuration works with OpenSSL v1.1.1 and above.
proxy.config.ssl.client.groups_list
Scope CONFIG.TP Type STRING.TP Default <See notes under proxy.config.ssl.server.groups_list.>.UNINDENT
Configures the list of supported groups provided by OpenSSL which Traffic Server will use for the
"key_share" and "supported groups" extension of TLSv1.3 connections. The value is a colon
separated list of group NIDs or names, for example "P-521:P-384:P-256". For instructions, see
"Groups" section of TLS1.3 - OpenSSLWiki.
This configuration works with OpenSSL v1.1.1 and above.
proxy.config.ssl.TLSv1
Scope CONFIG.TP Type INT.TP Default 1.UNINDENT Enables (1) or disables (0) TLSv1.
proxy.config.ssl.TLSv1_1
Scope CONFIG.TP Type INT.TP Default 1.UNINDENT Enables (1) or disables (0) TLS v1.1. If not specified,
enabled by default. [Requires OpenSSL v1.0.1 and higher]
proxy.config.ssl.TLSv1_2
Scope CONFIG.TP Type INT.TP Default 1.UNINDENT Enables (1) or disables (0) TLS v1.2. If not specified,
enabled by default. [Requires OpenSSL v1.0.1 and higher]
proxy.config.ssl.TLSv1_3
Scope CONFIG.TP Type INT.TP Default 1.UNINDENT Enables (1) or disables (0) TLS v1.3. If not specified,
enabled by default. [Requires OpenSSL v1.1.1 and higher]
proxy.config.ssl.client.certification_level
Scope CONFIG.TP Type INT.TP Default 0.UNINDENT Sets the client certification level:
─────────────────────────────────────────────────
Value Description
─────────────────────────────────────────────────
0 Client certificates are ignored.
Traffic Server does not verify client
certificates during the SSL
handshake. Access to Traffic Server
depends on Traffic Server
configuration options (such as access
control lists).
─────────────────────────────────────────────────
1 Client certificates are optional. If
a client has a certificate, then the
certificate is validated. If the
client does not have a certificate,
then the client is still allowed
access to Traffic Server unless
access is denied through other
Traffic Server configuration options.
─────────────────────────────────────────────────
2 Client certificates are required. The
client must be authenticated during
the SSL handshake. Clients without a
certificate are not allowed to access
Traffic Server.
┌───────┬───────────────────────────────────────┐
│ │ │
--
OCSP STAPLING CONFIGURATION
proxy.config.ssl.ocsp.enabled
Scope CONFIG.TP Type INT.TP Default 0.UNINDENT Enable OCSP stapling.
┌───────┬───────────────────────────────────────┐
│ Value │ Description │
├───────┼───────────────────────────────────────┤
│ 0 │ Disables OCSP Stapling. │
├───────┼───────────────────────────────────────┤
│ 1 │ Allows Traffic Server to request SSL │
│ │ certificate revocation status from an │
│ │ OCSP responder. │
└───────┴───────────────────────────────────────┘
proxy.config.ssl.ocsp.cache_timeout
Scope CONFIG.TP Type INT.TP Default 3600.UNINDENT Number of seconds before an OCSP response expires in
the stapling cache.
See admin-performance-timeouts for more discussion on Traffic Server timeouts.
proxy.config.ssl.ocsp.request_timeout
Scope CONFIG.TP Type INT.TP Default 10.UNINDENT Timeout (in seconds) for queries to OCSP responders.
See admin-performance-timeouts for more discussion on Traffic Server timeouts.
proxy.config.ssl.ocsp.update_period
Scope CONFIG.TP Type INT.TP Default 60.UNINDENT Update period (in seconds) for stapling caches.
HTTP/2 CONFIGURATION
proxy.config.http2.max_concurrent_streams_in
Scope CONFIG.TP Type INT.TP Default 100.TP Reloadable Yes.UNINDENT The maximum number of concurrent
streams per inbound connection.
NOTE:
Reloading this value affects only new HTTP/2 connections, not the ones already established.
proxy.config.http2.min_concurrent_streams_in
Scope CONFIG.TP Type INT.TP Default 10.TP Reloadable Yes.UNINDENT The minimum number of concurrent
streams per inbound connection. This is used when proxy.config.http2.max_active_streams_in is set
larger than 0.
proxy.config.http2.max_active_streams_in
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.UNINDENT Limits the maximum number of connection
wide active streams. When connection wide active streams are larger than this value,
SETTINGS_MAX_CONCURRENT_STREAMS will be reduced to proxy.config.http2.min_concurrent_streams_in.
To disable, set to zero (0).
proxy.config.http2.initial_window_size_in
Scope CONFIG.TP Type INT.TP Default 1048576.TP Reloadable Yes.UNINDENT The initial window size for
inbound connections.
proxy.config.http2.max_frame_size
Scope CONFIG.TP Type INT.TP Default 16384.TP Reloadable Yes.UNINDENT Indicates the size of the largest
frame payload that the sender is willing to receive.
proxy.config.http2.header_table_size
Scope CONFIG.TP Type INT.TP Default 4096.TP Reloadable Yes.UNINDENT The maximum size of the header
compression table used to decode header blocks.
proxy.config.http2.max_header_list_size
Scope CONFIG.TP Type INT.TP Default 4294967295.TP Reloadable Yes.UNINDENT This advisory setting informs
a peer of the maximum size of header list that the sender is prepared to accept blocks. The
default value, which is the unsigned int maximum value in Traffic Server, implies unlimited size.
proxy.config.http2.stream_priority_enabled
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.UNINDENT Enable the experimental HTTP/2 Stream
Priority feature.
proxy.config.http2.active_timeout_in
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.UNINDENT This is the active timeout of the http2
connection. It is set when the connection is opened and keeps ticking regardless of activity
level.
The value of 0 specifies that there is no timeout.
proxy.config.http2.accept_no_activity_timeout
Scope CONFIG.TP Type INT.TP Default 120.TP Reloadable Yes.TP Overridable Yes.UNINDENT Specifies how long
Traffic Server keeps connections to clients open if no activity is received on the connection.
Lowering this timeout can ease pressure on the proxy if misconfigured or misbehaving clients are
opening a large number of connections without submitting requests.
proxy.config.http2.no_activity_timeout_in
Scope CONFIG.TP Type INT.TP Default 120.TP Reloadable Yes.TP Overridable Yes.UNINDENT Specifies how long
Traffic Server keeps connections to clients open if a transaction stalls. Lowering this timeout
can ease pressure on the proxy if misconfigured or misbehaving clients are opening a large number
of connections without submitting requests.
proxy.config.http2.zombie_debug_timeout_in
Scope CONFIG.TP Type INT.TP Default 0.TP Reloadable Yes.UNINDENT This timeout enables the zombie
debugging feature. If it is non-zero, it sets a zombie event to go off that many seconds in the
future when the HTTP2 session reaches one but not both of the terminating events, i.e received a
close event (via client goaway or timeout) and the number of active streams has gone to zero. If
the event is executed, the Traffic Server process will assert. This mechanism is useful to debug
potential leaks in the HTTP2 Stream and Session processing.
proxy.config.http2.push_diary_size
Scope CONFIG.TP Type INT.TP Default 256.TP Reloadable Yes.UNINDENT Indicates the maximum number of
HTTP/2 server pushes that are remembered per HTTP/2 connection to avoid duplicate pushes on the
same connection. If the maximum number is reached, new entries are not remembered.
proxy.config.http2.stream_error_rate_threshold
Scope CONFIG.TP Type FLOAT.TP Default 0.1.TP Reloadable Yes.UNINDENT This is the maximum stream error
rate Traffic Server allows on an HTTP/2 connection. Traffic Server gracefully closes connections
that have stream error rates above this setting by sending GOAWAY frames.
proxy.config.http2.max_settings_per_frame
Scope CONFIG.TP Type INT.TP Default 7.TP Reloadable Yes.UNINDENT Specifies how many settings in an
HTTP/2 SETTINGS frame Traffic Server accepts. Clients exceeded this limit will be immediately
disconnected with an error code of ENHANCE_YOUR_CALM.
proxy.config.http2.max_settings_per_minute
Scope CONFIG.TP Type INT.TP Default 14.TP Reloadable Yes.UNINDENT Specifies how many settings in HTTP/2
SETTINGS frames Traffic Server accept for a minute. Clients exceeded this limit will be
immediately disconnected with an error code of ENHANCE_YOUR_CALM.
proxy.config.http2.max_settings_frames_per_minute
Scope CONFIG.TP Type INT.TP Default 14.TP Reloadable Yes.UNINDENT Specifies how many SETTINGS frames
Traffic Server receives for a minute at maximum. Clients exceeded this limit will be immediately
disconnected with an error code of ENHANCE_YOUR_CALM.
proxy.config.http2.max_ping_frames_per_minute
Scope CONFIG.TP Type INT.TP Default 60.TP Reloadable Yes.UNINDENT Specifies how many number of PING
frames Traffic Server receives for a minute at maximum. Clients exceeded this limit will be
immediately disconnected with an error code of ENHANCE_YOUR_CALM.
proxy.config.http2.max_priority_frames_per_minute
Scope CONFIG.TP Type INT.TP Default 120.TP Reloadable Yes.UNINDENT Specifies how many number of PRIORITY
frames Traffic Server receives for a minute at maximum. Clients exceeded this limit will be
immediately disconnected with an error code of ENHANCE_YOUR_CALM.
proxy.config.http2.min_avg_window_update
Scope CONFIG.TP Type FLOAT.TP Default 2560.0.TP Reloadable Yes.UNINDENT Specifies the minimum average
window increment Traffic Server allows. The average will be calculated based on the last 5
WINDOW_UPDATE frames. Clients that send smaller window increments lower than this limit will be
immediately disconnected with an error code of ENHANCE_YOUR_CALM.
PLUG-IN CONFIGURATION
proxy.config.plugin.plugin_dir
Scope CONFIG.TP Type STRING.TP Default config/plugins.UNINDENT Specifies the location of Traffic Server
plugins.
proxy.config.remap.num_remap_threads
Scope CONFIG.TP Type INT.TP Default 0.UNINDENT When this variable is set to 0, plugin remap callbacks
are executed in line on network threads. If remap processing takes significant time, this can be
cause additional request latency. Setting this variable to causes remap processing to take place
on a dedicated thread pool, freeing the network threads to service additional requests.
SOCKS PROCESSOR
proxy.config.socks.socks_needed
Scope CONFIG.TP Type INT.TP Default 0.UNINDENT Enables (1) or disables (0) the SOCKS processor
proxy.config.socks.socks_version
Scope CONFIG.TP Type INT.TP Default 4.UNINDENT Specifies the SOCKS version (4) or (5)
proxy.config.socks.socks_config_file
Scope CONFIG.TP Type STRING.TP Default socks.config.UNINDENT The socks_onfig file allows you to specify
ranges of IP addresses that will not be relayed to the SOCKS server. It can also be used to
configure AUTH information for SOCKSv5 servers.
proxy.config.socks.socks_timeout
Scope CONFIG.TP Type INT.TP Default 100.UNINDENT The activity timeout value (in seconds) for SOCKS
server connections.
See admin-performance-timeouts for more discussion on Traffic Server timeouts.
proxy.config.socks.server_connect_timeout
Scope CONFIG.TP Type INT.TP Default 10.UNINDENT The timeout value (in seconds) for SOCKS server
connection attempts.
See admin-performance-timeouts for more discussion on Traffic Server timeouts.
proxy.config.socks.per_server_connection_attempts
Scope CONFIG.TP Type INT.TP Default 1.UNINDENT The total number of connection attempts allowed per SOCKS
server, if multiple servers are used.
proxy.config.socks.connection_attempts
Scope CONFIG.TP Type INT.TP Default 4.UNINDENT The total number of connection attempts allowed to a
SOCKS server Traffic Server bypasses the server or fails the request
proxy.config.socks.server_retry_timeout
Scope CONFIG.TP Type INT.TP Default 300.UNINDENT The timeout value (in seconds) for SOCKS server
connection retry attempts.
See admin-performance-timeouts for more discussion on Traffic Server timeouts.
proxy.config.socks.default_servers
Scope CONFIG.TP Type STRING.TP Default *NONE*.UNINDENT Default list of SOCKS servers and their ports.
proxy.config.socks.server_retry_time
Scope CONFIG.TP Type INT.TP Default 300.UNINDENT The amount of time allowed between connection retries
to a SOCKS server that is unavailable.
proxy.config.socks.server_fail_threshold
Scope CONFIG.TP Type INT.TP Default 2.UNINDENT The number of times the connection to the SOCKS server
can fail before Traffic Server considers the server unavailable.
proxy.config.socks.accept_enabled
Scope CONFIG.TP Type INT.TP Default 0.UNINDENT Enables (1) or disables (0) the SOCKS proxy option. As a
SOCKS proxy, Traffic Server receives SOCKS traffic (usually on port 1080) and forwards all
requests directly to the SOCKS server.
proxy.config.socks.accept_port
Scope CONFIG.TP Type INT.TP Default 1080.UNINDENT Specifies the port on which Traffic Server accepts
SOCKS traffic.
proxy.config.socks.http_port
Scope CONFIG.TP Type INT.TP Default 80.UNINDENT Specifies the port on which Traffic Server accepts HTTP
proxy requests over SOCKS connections..
SOCKETS
proxy.config.net.defer_accept
Scope CONFIG.TP Type INT.TP Default 1.UNINDENT default: 1 meaning on all Platforms except Linux: 45
seconds
This directive enables operating system specific optimizations for a listening socket.
defer_accept holds a call to accept(2) back until data has arrived. In Linux' special case this is
up to a maximum of 45 seconds.
proxy.config.net.listen_backlog
Scope CONFIG.TP Type INT.TP Default -1
:reloadable:.UNINDENT This directive sets the maximum number of pending connections. If it is
set to -1, Traffic Server will automatically set this to a platform-specific maximum.
proxy.config.net.tcp_congestion_control_in
Scope CONFIG.TP Type STRING.TP Default "".UNINDENT This directive will override the congestion control
algorithm for incoming connections (accept sockets). On linux the allowed values are typically
specified in a space separated list in /proc/sys/net/ipv4/tcp_allowed_congestion_control
proxy.config.net.tcp_congestion_control_out
Scope CONFIG.TP Type STRING.TP Default "".UNINDENT This directive will override the congestion control
algorithm for outgoing connections (connect sockets). On linux the allowed values are typically
specified in a space separated list in /proc/sys/net/ipv4/tcp_allowed_congestion_control
proxy.config.net.sock_send_buffer_size_in
Scope CONFIG.TP Type INT.TP Default 0.UNINDENT Sets the send buffer size for connections from the client
to Traffic Server.
proxy.config.net.sock_recv_buffer_size_in
Scope CONFIG.TP Type INT.TP Default 0.UNINDENT Sets the receive buffer size for connections from the
client to Traffic Server.
proxy.config.net.sock_option_flag_in
Scope CONFIG.TP Type INT.TP Default 0x5.UNINDENT Turns different options "on" for the socket handling
client connections::
TCP_NODELAY (1)
SO_KEEPALIVE (2)
SO_LINGER (4) - with a timeout of 0 seconds
TCP_FASTOPEN (8)
NOTE:
This is a bitmask and you need to decide what bits to set. Therefore, you must set the value to 3 if
you want to enable nodelay and keepalive options above.
NOTE:
To allow TCP Fast Open for client sockets on Linux, bit 2 of the net.ipv4.tcp_fastopen sysctl must be
set.
proxy.config.net.sock_send_buffer_size_out
Scope CONFIG.TP Type INT.TP Default 0.TP Overridable Yes.UNINDENT Sets the send buffer size for
connections from Traffic Server to the origin server.
proxy.config.net.sock_recv_buffer_size_out
Scope CONFIG.TP Type INT.TP Default 0.TP Overridable Yes.UNINDENT Sets the receive buffer size for
connections from Traffic Server to the origin server.
proxy.config.net.sock_option_flag_out
Scope CONFIG.TP Type INT.TP Default 0x1.TP Overridable Yes.UNINDENT Turns different options "on" for the
origin server socket::
TCP_NODELAY (1)
SO_KEEPALIVE (2)
SO_LINGER (4) - with a timeout of 0 seconds
TCP_FASTOPEN (8)
NOTE:
This is a bitmask and you need to decide what bits to set. Therefore, you must set the value to 3 if
you want to enable nodelay and keepalive options above.
When SO_LINGER is enabled, the linger timeout time is set to 0. This is useful when Traffic Server and
the origin server are co-located and large numbers of sockets are retained in the TIME_WAIT state.
NOTE:
To allow TCP Fast Open for server sockets on Linux, bit 1 of the net.ipv4.tcp_fastopen sysctl must be
set.
proxy.config.net.sock_mss_in
Scope CONFIG.TP Type INT.TP Default 0.UNINDENT Same as the command line option --accept_mss that sets
the MSS for all incoming requests.
proxy.config.net.sock_packet_mark_in
Scope CONFIG.TP Type INT.TP Default 0x0.UNINDENT Set the packet mark on traffic destined for the client
(the packets that make up a client response).
SEE ALSO:
Traffic Shaping
proxy.config.net.sock_packet_mark_out
Scope CONFIG.TP Type INT.TP Default 0x0.TP Overridable Yes.UNINDENT Set the packet mark on traffic
destined for the origin (the packets that make up an origin request).
SEE ALSO:
Traffic Shaping
proxy.config.net.sock_packet_tos_in
Scope CONFIG.TP Type INT.TP Default 0x0.UNINDENT Set the ToS/DiffServ Field on packets sent to the
client (the packets that make up a client response).
SEE ALSO:
Traffic Shaping
proxy.config.net.sock_packet_tos_out
Scope CONFIG.TP Type INT.TP Default 0x0.TP Overridable Yes.UNINDENT Set the ToS/DiffServ Field on
packets sent to the origin (the packets that make up an origin request).
SEE ALSO:
Traffic Shaping
proxy.config.net.poll_timeout
Scope CONFIG.TP Type INT.TP Default 10 (or 30 on Solaris).UNINDENT Same as the command line option
--poll_timeout, or -t, which specifies the timeout used for the polling mechanism used. This
timeout is always in milliseconds (ms). This is the timeout to epoll_wait() on Linux platforms,
and to kevent() on BSD type OSs. The default value is 10 on all platforms.
Changing this configuration can reduce CPU usage on an idle system, since periodic tasks gets
processed at these intervals. On busy servers, this overhead is diminished, since polled events
triggers morefrequently. However, increasing the setting can also introduce additional latency
for certain operations, and timed events. It's recommended not to touch this setting unless your
CPU usage is unacceptable at idle workload. Some alternatives to this could be:
Reduce the number of worker threads (net-threads)
Reduce the number of disk (AIO) threads
Make sure accept threads are enabled
The relevant configurations for this are:
CONFIG proxy.config.exec_thread.autoconfig INT 0
CONFIG proxy.config.exec_thread.limit INT 2
CONFIG proxy.config.accept_threads INT 1
CONFIG proxy.config.cache.threads_per_disk INT 8
See admin-performance-timeouts for more discussion on Traffic Server timeouts.
proxy.config.task_threads
Scope CONFIG.TP Type INT.TP Default 2.UNINDENT Specifies the number of task threads to run. These
threads are used for various tasks that should be off-loaded from the normal network threads. You
must have at least one task thread available.
proxy.config.allocator.thread_freelist_size
Scope CONFIG.TP Type INT.TP Default 512.UNINDENT Sets the maximum number of elements that can be
contained in a ProxyAllocator (per-thread) before returning the objects to the global pool
proxy.config.allocator.thread_freelist_low_watermark
Scope CONFIG.TP Type INT.TP Default 32.UNINDENT Sets the minimum number of items a ProxyAllocator
(per-thread) will guarantee to be holding at any one time.
proxy.config.allocator.hugepages
Scope CONFIG.TP Type INT.TP Default 0.UNINDENT Enable (1) the use of huge pages on supported platforms.
(Currently only Linux)
You must also enable hugepages at the OS level. In a modern linux Kernel this can be done by
setting /proc/sys/vm/nr_overcommit_hugepages to a sufficiently large value. It is reasonable to
use (system memory/hugepage size) because these pages are only created on demand.
For more information on the implications of enabling huge pages, see Wikipedia
<http://en.wikipedia.org/wiki/Page_%28computer_memory%29#Page_size_trade-off>_.
proxy.config.allocator.dontdump_iobuffers
Scope CONFIG.TP Type INT.TP Default 1.UNINDENT Enable (1) the exclusion of IO buffers from core files
when ATS crashes on supported platforms. (Currently only linux). IO buffers are allocated with
the MADV_DONTDUMP with madvise() on linux platforms that support MADV_DONTDUMP. Enabled by
default.
proxy.config.http.enabled
Scope CONFIG.TP Type INT.TP Default 1.UNINDENT Turn on or off support for HTTP proxying. This is rarely
used, the one exception being if you run Traffic Server with a protocol plugin, and would like for
it to not support HTTP requests at all.
proxy.config.http.allow_half_open
Scope CONFIG.TP Type INT.TP Default 1.TP Reloadable Yes.TP Overridable Yes.UNINDENT Turn on or off
support for connection half open for client side. Default is on, so after client sends FIN, the
connection is still there.
proxy.config.http.wait_for_cache
Scope CONFIG.TP Type INT.TP Default 0.UNINDENT Accepting inbound connections and starting the cache are
independent operations in Traffic Server. This variable controls the relative timing of these
operations and Traffic Server dependency on cache because if cache is required then inbound
connection accepts should be deferred until the validity of the cache requirement is determined.
Cache initialization failure will be logged in diags.log.
─────────────────────────────────────────────────
Value Description
─────────────────────────────────────────────────
0 Decouple inbound connections and
cache initialization. Connections
will be accepted as soon as possible
and Traffic Server will run
regardless of the results of cache
initialization.
─────────────────────────────────────────────────
1 Do not accept inbound connections
until cache initialization has
finished. Traffic Server will run
regardless of the results of cache
initialization.
─────────────────────────────────────────────────
2 Do not accept inbound connections
until cache initialization has
finished and been sufficiently
successful that cache is enabled.
This means at least one cache span is
usable. If there are no spans in
storage.config or none of the spans
can be successfully parsed and
initialized then Traffic Server will
shut down.
─────────────────────────────────────────────────
3 Do not accept inbound connections
until cache initialization has
finished and been completely
successful. This requires at least
one cache span in storage.config and
that every span specified is valid
and successfully initialized. Any
error will cause Traffic Server to
shut down.
┌───────┬───────────────────────────────────────┐
│ │ │
COPYRIGHT │ │ │