HTTP load testing tool and library. It's over 9000!
Vegeta is a versatile HTTP load testing tool built out of a need to drill HTTP services with a constant request rate. It's over 9000!
Get them here.
You can install Vegeta using the Homebrew:
$ brew update && brew install vegetaOr with MacPorts:
$ port install vegeta$ pacman -S vegetaOn FreeBSD you can install Vegeta with the built in package manager because there is a Vegeta Package available.
$ pkg install vegetagit clone https://github.com/tsenart/vegeta
cd vegeta
make vegeta
mv vegeta ~/bin # Or elsewhere, up to you.Both the library and the CLI are versioned with SemVer v2.0.0.
After v8.0.0, the two components are versioned separately to better isolate breaking changes to each.
CLI releases are tagged with cli/vMAJOR.MINOR.PATCH and published on the GitHub releases page.
As for the library, new versions are tagged with both lib/vMAJOR.MINOR.PATCH and vMAJOR.MINOR.PATCH.
The latter tag is required for compatibility with go mod.
See CONTRIBUTING.md.
…-cpusSpecifies the number of CPUs to be used internally. It defaults to the amount of CPUs available in the system.
-profileSpecifies which profiler to enable during execution. Both cpu and heap profiles are supported. It defaults to none.
-versionPrints the version and exits.
attack command-bodySpecifies the file whose content will be set as the body of every
request unless overridden per attack target, see -targets.
-certSpecifies the PEM encoded TLS client certificate file to be used with HTTPS requests.
If -key isn't specified, it will be set to the value of this flag.
-chunkedSpecifies whether to send request bodies with the chunked transfer encoding.
-connectionsSpecifies the maximum number of idle open connections per target host.
-dns-ttlSpecifies the duration to cache DNS lookups for. A zero value caches forever. A negative value disables caching altogether.
-max-connectionsSpecifies the maximum number of connections per target host.
-durationSpecifies the amount of time to issue request to the targets. The internal concurrency structure's setup has this value as a variable. The actual run time of the test can be longer than specified due to the responses delay. Use 0 for an infinite attack.
-formatSpecifies the targets format to decode.
json formatThe JSON format makes integration with programs that produce targets dynamically easier. Each target is one JSON object in its own line. The method and url fields are required. If present, the body field must be base64 encoded. The generated JSON Schema defines the format in detail.
jq -ncM '{method: "GET", url: "http://goku", body: "Punch!" | @base64, header: {"Content-Type": ["text/plain"]}}' |
vegeta attack -format=json -rate=100 | vegeta encodehttp formatThe http format almost resembles the plain-text HTTP message format defined in RFC 2616 but it doesn't support in-line HTTP bodies, only references to files that are loaded and used as request bodies (as exemplified below).
Although targets in this format can be produced by other programs, it was originally meant to be used by people writing targets by hand for simple use cases.
Here are a few examples of valid targets files in the http format:
GET http://goku:9090/path/to/dragon?item=ball
GET http://user:password@goku:9090/path/to
HEAD http://goku:9090/path/to/successGET http://user:password@goku:9090/path/to
X-Account-ID: 8675309
DELETE http://goku:9090/path/to/remove
Confirmation-Token: 90215
Authorization: Token DEADBEEFPOST http://goku:9090/things
@/path/to/newthing.json
PATCH http://goku:9090/thing/71988591
@/path/to/thing-71988591.jsonPOST http://goku:9090/things
X-Account-ID: 99
@/path/to/newthing.jsonLines starting with # are ignored.
# get a dragon ball
GET http://goku:9090/path/to/dragon?item=ball
# specify a test account
X-Account-ID: 99-h2cSpecifies that HTTP2 requests are to be sent over TCP without TLS encryption.
-headerSpecifies a request header to be used in all targets defined, see -targets.
You can specify as many as needed by repeating the flag.
-http2Specifies whether to enable HTTP/2 requests to servers which support it.
-insecureSpecifies whether to ignore invalid server TLS certificates.
-keepaliveSpecifies whether to reuse TCP connections between HTTP requests.
-keySpecifies the PEM encoded TLS client certificate private key file to be used with HTTPS requests.
-laddrSpecifies the local IP address to be used.
-lazySpecifies whether to read the input targets lazily instead of eagerly. This allows streaming targets into the attack command and reduces memory footprint. The trade-off is one of added latency in each hit against the targets.
-max-bodySpecifies the maximum number of bytes to capture from the body of each response. Remaining unread bytes will be fully read but discarded. Set to -1 for no limit. It knows how to interpret values like these:
"10 MB" -> 10MB"10240 g" -> 10TB"2000" -> 2000B"1tB" -> 1TB"5 peta" -> 5PB"28 kilobytes" -> 28KB"1 gigabyte" -> 1GB-nameSpecifies the name of the attack to be recorded in responses.
-outputSpecifies the output file to which the binary results will be written to. Made to be piped to the report command input. Defaults to stdout.
-rateSpecifies the request rate per time unit to issue against the targets. The actual request rate can vary slightly due to things like garbage collection, but overall it should stay very close to the specified. If no time unit is provided, 1s is used.
A -rate of 0 or infinity means vegeta will send requests as fast as possible.
Use together with -max-workers to model a fixed set of concurrent users sending
requests serially (i.e. waiting for a response before sending the next request).
Setting -max-workers to a very high number while setting -rate=0 can result in
vegeta consuming too many resources and crashing. Use with care.
-redirectsSpecifies the max number of redirects followed on each request. The default is 10. When the value is -1, redirects are not followed but the response is marked as successful.
-resolversSpecifies custom DNS resolver addresses to use for name resolution instead of the ones configured by the operating system. Works only on non Windows systems.
-root-certsSpecifies the trusted TLS root CAs certificate files as a comma separated list. If unspecified, the default system CAs certificates will be used.
-session-ticketsSpecifies whether to support TLS session resumption using session tickets.
-targetsSpecifies the file from which to read targets, defaulting to stdin.
See the -format section to learn about the different target formats.
-timeoutSpecifies the timeout for each request. A value of 0 disables timeouts.
-workersSpecifies the initial number of workers used in the attack. The actual
number of workers will increase if necessary in order to sustain the
requested rate, unless it'd go beyond -max-workers.
-max-workersSpecifies the maximum number of workers used in the attack. It can be used to control the concurrency level used by an attack.
report command…report -type=text…The Requests row shows:
total number of issued requests.rate sustained during the attack period.throughput of successful requests over the total period.The Duration row shows:
attack time taken issuing all requests (total - wait)wait time waiting for the response to the last issued request (total - attack)total time taken in the attack (attack + wait)Latency is the amount of time taken for a response to a request to be read (including the -max-body bytes from the response body).
min is the minimum latency of all requests in an attack.mean is the arithmetic mean / average of the latencies of all requests in an attack.50, 90, 95, 99 are the 50th, 90th, 95th and 99th percentiles, respectively, of the latencies of all requests in an attack. To understand more about why these are useful, I recommend this article from @tylertreat.max is the maximum latency of all requests in an attack.The Bytes In and Bytes Out rows shows:
total number of bytes sent (out) or received (in) with the request or response bodies.mean number of bytes sent (out) or received (in) with the request or response bodies.The Success ratio shows the percentage of requests whose responses didn't error and had status codes between 200 and 400 (non-inclusive).
The Status Codes row shows a histogram of status codes. 0 status codes mean a request failed to be sent.
The Error Set shows a unique set of errors returned by all issued requests. These include requests that got non-successful response status code.
report -type=jsonAll duration like fields are in nanoseconds.
…In the buckets field, each key is a nanosecond value representing the lower bound of a bucket.
The upper bound is implied by the next higher bucket.
Upper bounds are non-inclusive.
The highest bucket is the overflow bucket; it has no upper bound.
The values are counts of how many requests fell into that particular bucket.
If the -buckets parameter is not present, the buckets field is omitted.
report -type=histComputes and prints a text based histogram for the given buckets. Each bucket upper bound is non-inclusive.
cat results.bin | vegeta report -type='hist[0,2ms,4ms,6ms]'
Bucket # % Histogram
[0, 2ms] 6007 32.65% ########################
[2ms, 4ms] 5505 29.92% ######################
[4ms, 6ms] 2117 11.51% ########
[6ms, +Inf] 4771 25.93% ##################Checksum mismatch error
Connection leak in DNSCaching dual-stack happy-eyeballs dialing
NewHistogramReporter swallows write errors (return nil instead of return err)
Data races in DNSCaching: shared cache slice mutation and unsafe rand.Rand
Data race in ConnectTo round-robin address selection
Prometheus request_fail_count counter never incremented
GRPC and HTTP/3?
socks5h support
Add Custom Pacer for CSV-Based Traffic Patterns
Support for dynamic request chaining and response-based target generation