What initial optimizations do you perform on a newly deployed TiDB?

Translated
1

Note:
This topic has been translated from a Chinese forum by GPT and might contain errors.

Original topic: 大家对新部署的TiDB会做哪些初始化的优化呢？

| username: 江湖故人

In terms of performance and security, the more comprehensive, the better.

2
| username: Miracle | Original post link

Running naked…

3
| username: Fly-bird | Original post link

For security, all servers are on the internal network, port 4000 is exposed, others are not exposed.
Set up alert notifications for monitoring.
Not much adjustment on performance.

If there is a compliance requirement, it is recommended to enable SSL.

4
| username: 普罗米修斯 | Original post link

10 Gigabit intranet isolated from other network segments, user permission restrictions

5
| username: 春风十里 | Original post link

Regarding operating system security:
Linux:

  1. Configure “minlen=8, dcredit=-1, ucredit=-1, ocredit=-2, lcredit=-1, enforce_for_root” in system-auth for Linux servers. File path: /etc/pam.d/system-auth. Additionally, assign different passwords for different devices to prevent a single compromised password from affecting the security of all devices.
  2. Modify the maximum usage days to 90 and the minimum password length to 8 in the login.defs file for Linux servers. File path: /etc/login.defs.
  3. Configure “deny=5 unlock_time=300 even_deny_root root_unlock_time=300” in the system-auth file for Linux servers. File path: /etc/pam.d/system-auth. Configure “TMOUT=300” in the profile file for Linux servers. File path: /etc/profile.
  4. Use “systemctl status rsyslog.service” and “systemctl status auditd.service” to check the status of rsyslog and audit, and enable rsyslog and audit logging.
  5. Use “cat /etc/passwd” and “cat /etc/shadow” to view the user list, and delete or disable unnecessary or expired accounts to avoid the existence of shared accounts.
  6. Close unnecessary high-risk ports.
  7. Disable unnecessary services.
6
| username: liyuepeng123 | Original post link

TiDB Environment and System Configuration Check

7
| username: 像风一样的男子 | Original post link

No optimization is needed for the new cluster, just use it directly. When the data volume increases and there are monitoring anomalies, address them accordingly.

8
| username: zhanggame1 | Original post link

My personal research mainly focuses on the following points:

  1. The default GC time is 10 minutes. Consider extending it to allow data recovery within the GC time.

  2. Modify the log retention period; otherwise, too many logs might fill up the hard drive.

  3. The tidb_ddl_reorg_worker_cnt parameter can be increased to speed up index addition.

  4. TiDB’s transaction isolation level is Repeatable Read by default. You can choose to use Read Committed.

  5. Set the time period for statistical analysis.

    You can schedule this statistical analysis to be executed during database idle times:

    SET GLOBAL tidb_auto_analyze_start_time='23:00 +0800';
SET GLOBAL tidb_auto_analyze_end_time='00:00 +0800';

  6. Adjust TiDB memory parameters.
    If memory is sufficient, the default 1G tidb_mem_quota_query can be increased.

  7. Modify the MySQL version number displayed by TiDB to address vulnerability scanning issues.

  8. Set the session connection timeout for TiDB.

  9. Check the permissions and size settings of the temporary space.

9
| username: Kongdom | Original post link

:yum: I choose the default; the standard configuration is the best.

10
| username: dba远航 | Original post link

Initially, it’s best to use the default settings, and then adjust based on the actual production runtime situation.

11
| username: system | Original post link

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.