Re: [users@httpd] Controlling access to web site based on domain name

[Rose, John B]

Unknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C=whBJuu6xgOhfdhKyiZ8JBMq5Q59DXiLUHi4TrOLYEXA%3D=0>

On Fri, Dec 16, 2022 at 4:01 PM Rose, John B  wrote:
We would like to control access to a web site based on a listed domain and 
redirect any accesses from domains not
listed to a particular web page.

We need to be able to use the domain names and not IP addresses.

Is this something we should be able to do within .htaccess and using Rewrite 
for the redirect or do we need to use something else?

Thanks




--
Thanks,
Brian Wolfe
https://www.linkedin.com/in/brian-wolfe-3136425a/<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linkedin.com%2Fin%2Fbrian-wolfe-3136425a%2F=05%7C01%7Cjbrose%40utk.edu%7Cdf01786b3ed14f0ed24608dadfad377b%7C515813d9717d45dd9eca9aa19c09d6f9%7C0%7C0%7C638068232297166282%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C=rVMxtC7A3yKNztZAi4t8Hn0pPzgxlh7%2FusOApzY9t5c%3D=0>

Re: [users@httpd] Controlling access to web site based on domain name

[Rose, John B]

"you can require the traffic to match a certain rDNS value"

rDNS means Reverse DNS

I am not sure they want to do something like reverse DNS lookup.



From: Frank Gingras 
Sent: Friday, December 16, 2022 4:33 PM
To: users@httpd.apache.org 
Subject: Re: [users@httpd] Controlling access to web site based on domain name

You're referring to controlling access via the referrer, which is trivial to 
spoof; I strongly recommend not using that approach.

The other concept to understand here is that you can require the traffic to 
match a certain rDNS value.

If you still want to match the referrer, you can do so with  wrote:
Brain

Thanks for replying.

I think I may not have worded my question clearly...'

If I have web site ...
mysite.abc.com<https://nam11.safelinks.protection.outlook.com/?url=http%3A%2F%2Fmysite.abc.com%2F=05%7C01%7Cjbrose%40utk.edu%7Cdf01786b3ed14f0ed24608dadfad377b%7C515813d9717d45dd9eca9aa19c09d6f9%7C0%7C0%7C638068232297166282%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C=Mvr4gSjeagVJ3pmQXc0gpxDeo%2Fa1fvqlU45yHtE%2FOTI%3D=0>

In the htaccess on that page I put something like ... Require 
def.com<https://nam11.safelinks.protection.outlook.com/?url=http%3A%2F%2Fdef.com%2F=05%7C01%7Cjbrose%40utk.edu%7Cdf01786b3ed14f0ed24608dadfad377b%7C515813d9717d45dd9eca9aa19c09d6f9%7C0%7C0%7C638068232297166282%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C=MI6XVBSza0FCavAfVhO7wjZjykMU9vIWZjSq5AshmWM%3D=0>

And I want users from a link on the page 
somesite.def.com<https://nam11.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsomesite.def.com%2F=05%7C01%7Cjbrose%40utk.edu%7Cdf01786b3ed14f0ed24608dadfad377b%7C515813d9717d45dd9eca9aa19c09d6f9%7C0%7C0%7C638068232297166282%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C=N4HTKqPbanV5Fvu0i85ayEFdzSwccBBVeRANlWt5ic0%3D=0>
 to be able to access 
mysite.abc.com<https://nam11.safelinks.protection.outlook.com/?url=http%3A%2F%2Fmysite.abc.com%2F=05%7C01%7Cjbrose%40utk.edu%7Cdf01786b3ed14f0ed24608dadfad377b%7C515813d9717d45dd9eca9aa19c09d6f9%7C0%7C0%7C638068232297166282%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C=Mvr4gSjeagVJ3pmQXc0gpxDeo%2Fa1fvqlU45yHtE%2FOTI%3D=0>
 by clicking on that link

But I dont want anyone from a link on a site named 
somesite.xyz.com<https://nam11.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsomesite.xyz.com%2F=05%7C01%7Cjbrose%40utk.edu%7Cdf01786b3ed14f0ed24608dadfad377b%7C515813d9717d45dd9eca9aa19c09d6f9%7C0%7C0%7C638068232297166282%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C=NgM0v6amOxrgs%2FnrHbIYWXRmPkTPNPPLOHDWBrYsU%2BI%3D=0>
 to be able to access the homepaage on 
mysite.abc.com<https://nam11.safelinks.protection.outlook.com/?url=http%3A%2F%2Fmysite.abc.com%2F=05%7C01%7Cjbrose%40utk.edu%7Cdf01786b3ed14f0ed24608dadfad377b%7C515813d9717d45dd9eca9aa19c09d6f9%7C0%7C0%7C638068232297166282%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C=Mvr4gSjeagVJ3pmQXc0gpxDeo%2Fa1fvqlU45yHtE%2FOTI%3D=0>.
 I want to redirect them to 
mysite.abc.com/info.html<https://nam11.safelinks.protection.outlook.com/?url=http%3A%2F%2Fmysite.abc.com%2Finfo.html=05%7C01%7Cjbrose%40utk.edu%7Cdf01786b3ed14f0ed24608dadfad377b%7C515813d9717d45dd9eca9aa19c09d6f9%7C0%7C0%7C638068232297166282%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C=E%2BNoDuJgMMNw2vfidhXAdmqh42oFm1fnZ%2FcmaVl0urE%3D=0>

So any domain not explicitly listed in htaccess file will get redirected.



From: Brian Wolfe mailto:wolfebrian2...@gmail.com>>
Sent: Friday, December 16, 2022 4:08 PM
To: jbr...@utk.edu.invalid 
Cc: users@httpd.apache.org<mailto:users@httpd.apache.org> 
mailto:users@httpd.apache.org>>
Subject: Re: [users@httpd] Controlling access to web site based on domain name

You don't often get email from 
wolfebrian2...@gmail.com<mailto:wolfebrian2...@gmail.com>. Learn why this is 
important<https://aka.ms/LearnAboutSenderIdentification>
Have you looked into virtual hosts configurations?

https://httpd.apache.org/docs/2.4/vhosts/examples.html<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fhttpd.apache.org%2Fdocs%2F2.4%2Fvhosts%2Fexamples.html=05%7C01%7Cjbrose%40utk.edu%7Cdf01786b3ed14f0ed24608dadfad377b%7C515813d9717d45dd9eca9aa19c09d6f9%7C0%7C0%7C638068232297166282%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C=whBJuu6xgOhfdhKyiZ8JBMq5Q59DXiLUHi4TrOLYEXA%3D=0>

On Fri, Dec 16, 2022 at 4:01 PM Rose, John B  wrote:
We would like to contr

Re: [users@httpd] Controlling access to web site based on domain name

[Rose, John B]

Brain

Thanks for replying.

I think I may not have worded my question clearly...'

If I have web site ...
mysite.abc.com

In the htaccess on that page I put something like ... Require def.com

And I want users from a link on the page somesite.def.com to be able to access 
mysite.abc.com by clicking on that link

But I dont want anyone from a link on a site named somesite.xyz.com to be able 
to access the homepaage on mysite.abc.com. I want to redirect them to 
mysite.abc.com/info.html

So any domain not explicitly listed in htaccess file will get redirected.



From: Brian Wolfe 
Sent: Friday, December 16, 2022 4:08 PM
To: jbr...@utk.edu.invalid 
Cc: users@httpd.apache.org 
Subject: Re: [users@httpd] Controlling access to web site based on domain name

You don't often get email from wolfebrian2...@gmail.com. Learn why this is 
important<https://aka.ms/LearnAboutSenderIdentification>
Have you looked into virtual hosts configurations?

https://httpd.apache.org/docs/2.4/vhosts/examples.html<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fhttpd.apache.org%2Fdocs%2F2.4%2Fvhosts%2Fexamples.html=05%7C01%7Cjbrose%40utk.edu%7C8c53f584788a4c5ffd3108dadfa9c6ce%7C515813d9717d45dd9eca9aa19c09d6f9%7C0%7C0%7C638068217538638429%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C=%2FRKjCoB6a%2Fr5D8m9NzJUgpHn7nXv9n1zPpQFV68Wzz8%3D=0>

On Fri, Dec 16, 2022 at 4:01 PM Rose, John B  wrote:
We would like to control access to a web site based on a listed domain and 
redirect any accesses from domains not
listed to a particular web page.

We need to be able to use the domain names and not IP addresses.

Is this something we should be able to do within .htaccess and using Rewrite 
for the redirect or do we need to use something else?

Thanks




--
Thanks,
Brian Wolfe
https://www.linkedin.com/in/brian-wolfe-3136425a/<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linkedin.com%2Fin%2Fbrian-wolfe-3136425a%2F=05%7C01%7Cjbrose%40utk.edu%7C8c53f584788a4c5ffd3108dadfa9c6ce%7C515813d9717d45dd9eca9aa19c09d6f9%7C0%7C0%7C638068217538638429%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C=Vymgo6BPWgHQmHjYfLGxTQJiMIDyuI1Z3JgwSnNT0jM%3D=0>

[users@httpd] Controlling access to web site based on domain name

[Rose, John B]

We would like to control access to a web site based on a listed domain and 
redirect any accesses from domains not
listed to a particular web page.

We need to be able to use the domain names and not IP addresses.

Is this something we should be able to do within .htaccess and using Rewrite 
for the redirect or do we need to use something else?

Thanks

Re: [users@httpd] Is NGINX faster than Apache?

[Rose, John B]

We did some testing of Apache and nGinx head to head for something a few years 
ago.

We also did a bit of testing of Apache, nGinx, haproxy and lighthttpd a couple 
years ago for something else, and ended up picking Apache after whittling it 
down to Apache and HAProxy.

Apache was as fast as nGinx once we configured it properly. In both instances.



From: Rich Bowen 
Sent: Thursday, March 11, 2021 2:57 PM
To: users@httpd.apache.org ; Jason Long 

Subject: Re: [users@httpd] Is NGINX faster than Apache?



On 3/11/21 12:33 PM, Jason Long wrote:
> Hello,
> Is it true that NGINX is faster than Apache?
>
> https://www.hostingadvice.com/how-to/nginx-vs-apache/
>
> In which environment, Apache must use?


No, it is not true.

However, it is also not false.

It depends on so many factors that it's disingenuous to answer your
question either way. To simplify, it depends on what your content is,
and how you've configured each server, but even that is too simplistic
an answer.

The real answer, as we say on the #httpd IRC channel, is TIAS - Try It
And See. Test them for your content and see which one is best.

It's also a good rule that any time you see an article that says X is
faster/better/stronger than Y, you can rest assured that the person
running it is an expert on X and not on Y, and that an expert on Y (and
not X) could probably configure things such that the reverse was true.

Use the one you're more comfortable with, more experienced with. If you
choose Apache httpd, we'll be here to help you configure it.

--
Rich Bowen - rbo...@rcbowen.com
@rbowen

-
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org

[users@httpd] fcgi unix domain socket/TCP socket question

[Rose, John B]

Couple of questions ...

Reading this Apache httpd document ...
https://httpd.apache.org/docs/2.4/mod/mod_proxy_fcgi.html

Does the below mean if the max children for a PHP-FPM pool using Unix Domain 
Sockets is reached then any subsequent PHP-FPM requests for that virtual host 
utilize a TCP socket? If we have the base www.conf pool 
configured to use TCP as opposed to Unix Domain Sockets?

SetHandler 
"proxy:unix:/var/run/php-fpm/something.com.sock|fcgi://something.com/"

What would be the impact of NOT defining a matching worker for the above 
config? Like is done in this line on the apache.org documentation page 
referenced above ..


Occasionally, typically when someone is doing a Wordpress core or plugin 
upgrade, all PHP-FPM sites cease to load their content. And a reboot is needed 
to get back to normal. But a large number of PHP-FPM processes get started
seemingly maxing out the "Sethandler" connections. then we see "fcgi" timeouts 
in log.

Our goal is to avoid the perceived problem the results from this php-fpm/TCP 
bug by using Domain Sockets. Any suggestions?
https://blog.cloudflare.com/this-is-strictly-a-violation-of-the-tcp-specification/


Thanks for everyones work on Apache

Re: [users@httpd] ProxyTimeOut value question

[Rose, John B]

Thanks Suvendu


From: Suvendu Sekhar Mondal 
Sent: Thursday, April 11, 2019 1:58:19 PM
To: users@httpd.apache.org
Subject: Re: [users@httpd] ProxyTimeOut value question

John,

On Tue, Apr 9, 2019, 11:31 PM Rose, John B 
mailto:jbr...@utk.edu> wrote:

Any likely problems with setting ProxyTimeOut to 120?


Or is that a Directive whose value is commonly increased?

In my opinion, proxy timeout or any other time out limits should be little bit 
higher than the longest running transaction in your application. For example, 
if you see some file import takes three minutes to complete under loaded system 
and if that is your longest running transaction, I will suggest to set all 
timeout limits to accommodate that process.

If you set this value too high, thread pool exhaustion can happen if you have a 
very slow performing backend server.

[users@httpd] 443 section of name based virtual host conf file being ignored

[Rose, John B]

It seems my Port 80 settings are functioning properly, but the





section contents are being ignored


Any ideas why that would be happening?


this is the original, or base virtual host .conf


Thanks

[users@httpd] Ssl certificate ignored in virtual host

[Rose, John B]

Why would ssl.conf certificate settings override the certificate settings in a 
specific virtual host config file?

Sent from my iPad
-
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org

[users@httpd] ProxyTimeOut value question

[Rose, John B]

Any likely problems with setting ProxyTimeOut to 120?


Or is that a Directive whose value is commonly increased?

Re: [users@httpd] Apache Timeouts, fastcgi, etc settings recommendations for Wordpress site servers?

[Rose, John B]

Yann


httpd-2.4.6-88.el7.x86_64



Thanks


From: Yann Ylavic 
Sent: Tuesday, April 2, 2019 4:29:04 PM
To: users@httpd.apache.org
Subject: Re: [users@httpd] Apache Timeouts, fastcgi, etc settings 
recommendations for Wordpress site servers?

Or better, the httpd-2.4.6 rpm version.

On Tue, Apr 2, 2019 at 10:25 PM Yann Ylavic  wrote:
>
> Well, possibly, but then I need the Redhat version..
>
> On Tue, Apr 2, 2019 at 10:09 PM Rose, John B  wrote:
> >
> > 2.4.6 but that can be a bit misleading from what I understand if it is Red 
> > Hat. Apparently they piecemeal add the functionality of later versions of 
> > Apache if you can guess what it is
> >
> > 
> > From: Yann Ylavic 
> > Sent: Tuesday, April 2, 2019 4:02:15 PM
> > To: users@httpd.apache.org
> > Subject: Re: [users@httpd] Apache Timeouts, fastcgi, etc settings 
> > recommendations for Wordpress site servers?
> >
> > Hi,
> >
> > On Tue, Apr 2, 2019 at 8:38 PM Rose, John B  wrote:
> > >
> > > The result afterwards are a bunch of this type, until we reboot …
> > >
> > > [Mon Apr 01 14:26:45.998971 2019] [proxy_fcgi:error] [pid 26422:tid 
> > > 139964645857024] (70007)The timeout specified has expired: [client 
> > > xxx.xxx.xxx.xxx:63031] AH01075: Error dispatching request to :, referer: 
> > > https://somesite.com/sub1/sub2/
> > >
> > >
> > > Linux
> > >
> > > Apache
> >
> > Which version of httpd are you running?
> >
> > Regards,
> > Yann.
> >
> > -
> > To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
> > For additional commands, e-mail: users-h...@httpd.apache.org
> >

-
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org

Re: [users@httpd] Apache Timeouts, fastcgi, etc settings recommendations for Wordpress site servers?

[Rose, John B]

Red Hat 7

Sent from my iPad

> On Apr 2, 2019, at 4:26 PM, Yann Ylavic  wrote:
> 
> Well, possibly, but then I need the Redhat version..
> 
>> On Tue, Apr 2, 2019 at 10:09 PM Rose, John B  wrote:
>> 
>> 2.4.6 but that can be a bit misleading from what I understand if it is Red 
>> Hat. Apparently they piecemeal add the functionality of later versions of 
>> Apache if you can guess what it is
>> 
>> 
>> From: Yann Ylavic 
>> Sent: Tuesday, April 2, 2019 4:02:15 PM
>> To: users@httpd.apache.org
>> Subject: Re: [users@httpd] Apache Timeouts, fastcgi, etc settings 
>> recommendations for Wordpress site servers?
>> 
>> Hi,
>> 
>>> On Tue, Apr 2, 2019 at 8:38 PM Rose, John B  wrote:
>>> 
>>> The result afterwards are a bunch of this type, until we reboot …
>>> 
>>> [Mon Apr 01 14:26:45.998971 2019] [proxy_fcgi:error] [pid 26422:tid 
>>> 139964645857024] (70007)The timeout specified has expired: [client 
>>> xxx.xxx.xxx.xxx:63031] AH01075: Error dispatching request to :, referer: 
>>> https://somesite.com/sub1/sub2/
>>> 
>>> 
>>> Linux
>>> 
>>> Apache
>> 
>> Which version of httpd are you running?
>> 
>> Regards,
>> Yann.
>> 
>> -
>> To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
>> For additional commands, e-mail: users-h...@httpd.apache.org
>> 
> 
> -
> To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
> For additional commands, e-mail: users-h...@httpd.apache.org
> 

-
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org

Re: [users@httpd] Apache Timeouts, fastcgi, etc settings recommendations for Wordpress site servers?

[Rose, John B]

2.4.6 but that can be a bit misleading from what I understand if it is Red Hat. 
Apparently they piecemeal add the functionality of later versions of Apache if 
you can guess what it is


From: Yann Ylavic 
Sent: Tuesday, April 2, 2019 4:02:15 PM
To: users@httpd.apache.org
Subject: Re: [users@httpd] Apache Timeouts, fastcgi, etc settings 
recommendations for Wordpress site servers?

Hi,

On Tue, Apr 2, 2019 at 8:38 PM Rose, John B  wrote:
>
> The result afterwards are a bunch of this type, until we reboot …
>
> [Mon Apr 01 14:26:45.998971 2019] [proxy_fcgi:error] [pid 26422:tid 
> 139964645857024] (70007)The timeout specified has expired: [client 
> xxx.xxx.xxx.xxx:63031] AH01075: Error dispatching request to :, referer: 
> https://somesite.com/sub1/sub2/
>
>
> Linux
>
> Apache

Which version of httpd are you running?

Regards,
Yann.

-
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org

[users@httpd] Apache Timeouts, fastcgi, etc settings recommendations for Wordpress site servers?

[Rose, John B]

Hello


If you have servers with dozens of standalone installations of Wordpress, what 
settings are typically changed from the Apache/Fastcgi/PHP defaults with 
regards to timeouts, execution time, etc.


On occasion when users are updating the application, we get a timeout error in 
Apache, and no one can access any PHP driven content. Regular html works ok. 
Only a reboot of the server seems to remedy it.  Restarting Apache and/or 
PHP-FPM does not seem to correct it.


This seems to be the first error entry tied to problems ….

“The timeout specified has expired: [client xxx.xxx.xxx.xxx:x] AH01075: 
Error dispatching request to :, referer: 
https://somesite.com/wp-admin/update-core.php?action=do-core-upgrade

The result afterwards are a bunch of this type, until we reboot …

[Mon Apr 01 14:26:45.998971 2019] [proxy_fcgi:error] [pid 26422:tid 
139964645857024] (70007)The timeout specified has expired: [client 
xxx.xxx.xxx.xxx:63031] AH01075: Error dispatching request to :, referer: 
https://somesite.com/sub1/sub2/


Linux

Apache

FastCGI

PHP-FPM

Mysql

Re: [users@httpd] Re: Apache web server devouring resources

[Rose, John B]

I don't think the TCP buffer would be clear if there was a continuing flow of 
http requests during that time, whether the web server software was down, or 
maxed out


But maybe I am wrong.




From: Darryl Philip Baker 
Sent: Thursday, March 28, 2019 1:22:59 PM
To: users@httpd.apache.org
Subject: Re: [users@httpd] Re: Apache web server devouring resources


No PHP on the system at all. The web server was down for 15-20 minutes so 
anything in the queue should have cleared, right?



Darryl Baker  (he/him/his)

Sr. System Administrator

Distributed Application Platform Services

Northwestern University

1800 Sherman Ave.

Suite 6-600 – Box #39

Evanston, IL  60201-3715

darryl.ba...@northwestern.edu<mailto:darryl.ba...@northwestern.edu>

(847) 467-6674





From: "Rose, John B" 
Reply-To: "users@httpd.apache.org" 
Date: Thursday, March 28, 2019 at 11:32 AM
To: "users@httpd.apache.org" 
Subject: [users@httpd] Re: Apache web server devouring resources



Regarding the "load increasing quickly after restarting the daemons" ...



I do not believe just restarting the daemons clears the TCP queue. Nor does it 
prevent new TCP requests. If it is an attack, then the load would ramp back up 
immediately. That is why you have to reboot I am guessing.

Do you utilize PHP? PHP-FPM? Do you use TCP or Unix Domain sockets?



Are there a preponderance of http connections or PHP-FPM processes, or both?



If PHP-FPM do you use "static" "dynamic" or "ondemand"?



From: Darryl Philip Baker 
Sent: Thursday, March 28, 2019 12:11:27 PM
To: users@httpd.apache.org
Subject: [users@httpd] Apache web server devouring resources



Gentlefolk,

I had an incident yesterday where the Apache web server host had a load average 
of over 170 and was performing very slowly. Stopping the web server did fix the 
issue but when I restarted the daemons the load started to increase very 
quickly. I ended up having to reboot the system to fix the issue. I don’t like 
that one bit, this is a Linux system not a Windows server. (Editorial remark: I 
have found that systems need reboots to fix stuff much more frequently since 
the adoption of systemd) I have been asked to do a root cause analysis, but I 
have not found anything as of yet. I am reaching out for help in this matter.



The system is a RHEL7 ESX VM with the Red Hat’s main line distribution of 
Apache 2.4 as opposed to the RHSCL version. The configuration is quite complex 
and a bit sensitive so I cannot share all of that. What I’m looking for is 
technics to look at what happened rather than being given the answer anyway.



Darryl Baker  (he/him/his)

Sr. System Administrator

Distributed Application Platform Services

Northwestern University

1800 Sherman Ave.

Suite 6-600 – Box #39

Evanston, IL  60201-3715

darryl.ba...@northwestern.edu<mailto:darryl.ba...@northwestern.edu>

(847) 467-6674

[users@httpd] Re: Apache web server devouring resources

[Rose, John B]

Regarding the "load increasing quickly after restarting the daemons" ...


I do not believe just restarting the daemons clears the TCP queue. Nor does it 
prevent new TCP requests. If it is an attack, then the load would ramp back up 
immediately. That is why you have to reboot I am guessing.


Do you utilize PHP? PHP-FPM? Do you use TCP or Unix Domain sockets?


Are there a preponderance of http connections or PHP-FPM processes, or both?


If PHP-FPM do you use "static" "dynamic" or "ondemand"?


From: Darryl Philip Baker 
Sent: Thursday, March 28, 2019 12:11:27 PM
To: users@httpd.apache.org
Subject: [users@httpd] Apache web server devouring resources


Gentlefolk,

I had an incident yesterday where the Apache web server host had a load average 
of over 170 and was performing very slowly. Stopping the web server did fix the 
issue but when I restarted the daemons the load started to increase very 
quickly. I ended up having to reboot the system to fix the issue. I don’t like 
that one bit, this is a Linux system not a Windows server. (Editorial remark: I 
have found that systems need reboots to fix stuff much more frequently since 
the adoption of systemd) I have been asked to do a root cause analysis, but I 
have not found anything as of yet. I am reaching out for help in this matter.



The system is a RHEL7 ESX VM with the Red Hat’s main line distribution of 
Apache 2.4 as opposed to the RHSCL version. The configuration is quite complex 
and a bit sensitive so I cannot share all of that. What I’m looking for is 
technics to look at what happened rather than being given the answer anyway.



Darryl Baker  (he/him/his)

Sr. System Administrator

Distributed Application Platform Services

Northwestern University

1800 Sherman Ave.

Suite 6-600 – Box #39

Evanston, IL  60201-3715

darryl.ba...@northwestern.edu

(847) 467-6674

Re: [users@httpd] Does Apache do a "graceful" automatically over time?

[Rose, John B]

Eric, as always, thanks for replying.

I think logrotate is the likely culprit.

Looking at apachectl status it doesn’t do a stop start, since no indication of 
an overnight restart. So I assume a “graceful” on Linux

Thanks again for the help

Sent from my iPad

On Mar 27, 2019, at 5:21 PM, Eric Covener  wrote:

>> Does Apache do a "graceful" restart automatically over time?
> 
> No. Some likely culprits: logrotate (not to be confused with
> rotatelogs) or third-party control panels that manage your webserver
> config.  Or an unplanned reboot which would not really be a graceful
> restart but a stop/start.
> 
> -
> To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
> For additional commands, e-mail: users-h...@httpd.apache.org
> 

-
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org

[users@httpd] Does Apache do a "graceful" automatically over time?

[Rose, John B]

As always, a "thank you" to everyone that works on Apache.


Some background and resultant question ...


We had made some changes in the afternoon to some virtual host configs that we 
intended to implement the next morning with a graceful restart of Apache.


That was going to be coordinated with a restart of php-fm which had to be done 
before the graceful of Apache


Anyway, the next morning the sites utilizing PHP were getting a 503 error 
before we restarted anything. It seems as though Apache must have implemented 
the virtual host config changes sometime between the previous afternoon and the 
next morning. But no one had manually done the graceful.


Does Apache do a "graceful" restart automatically over time?

[users@httpd] mod_userdir and php-fpm individual pools

[Rose, John B]

Is it possible to set mod_userdir web sites PHP processes to run as an 
individual pool in PHP-FPM?


Ideally using Unix Domain Sockets instead of TCP.


We see how to do it for virtual hosts, but have not seen how to do so for 
userdir sites, i.e. somedomain.com/~someuser


Has anyone done this?


Thanks

[users@httpd] Remove .php extension but still pass it to PHP-FPM

[Rose, John B]

We would like to strip select .php extensions within a web site but still have 
them passed to PHP-FPM when they are clicked on.


Any help would be appreciated

[users@httpd] Apache PHP-FPM unix domain sockets questions

[Rose, John B]

After looking at the documentation on httpd.apache.org and wiki.apache.org I 
have a few questions ...


  1.  I have seen examples of both "ProxyPassMatch" and "SetHandler" used to 
implement Unix Domain Sockets. Which is better?


   2. On the wiki page it says "Using too many sockets will cause apache to 
give a (99)Cannot assign requested address: error"


  If PHP-FPM is configured to use "ondemand" does this help avoid that 
problem?


  3. If "ondemand" is used in PHP-FPM, is it still advisable to tweak 
/proc/sys/net/ipv4/tcp_tw_reuse?


  4. What are some advisable ways to determine an ideal value for "ulimit" 
if using Unix Domain Sockets?




Thanks

[users@httpd] mod_macro, unix domain sockets, php-fpm pool config files

[Rose, John B]

mod_macro and unix domain socket functionality in Apache are nice features, 
thanks to whomever put in the time and effort developing/maintaining.


We have looked for an equivalent of Apache mod_macro for php-fpm in order  
avoid having to create a php-fpm pool conf for each Apache virtual host using 
unix domain sockets.


No luck thus far.


Does anyone have techniques they use for generating large number of php-fpm 
pool config's utilized by Apache virtual hosts using unix domain sockets within 
mod_macro, instead of creating them one by one by hand?


Thanks

Re: [users@httpd] Apache Will Not Start

[Rose, John B]

Do you have a /var/run/httpd directory?

Sent from my iPad

On Aug 28, 2018, at 9:48 PM, Alex Nyamweya 
mailto:animesoni...@gmail.com>> wrote:

Hi,

I am running an Apache server with CentOS 7 installed. I'm having issues 
starting apache using the command systemctl status httpd.service as I would get 
the following message:

Job for httpd.service failed because the control process exited with error 
code. See "systemctl status httpd.service" and "journalctl -xe" for details.

Here is the output of systemctl status httpd:

httpd.service - The Apache HTTP Server
   Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor 
preset: disabled)
   Active: failed (Result: exit-code) since Wed 2018-08-29 02:46:48 CEST; 42s 
ago
 Docs: man:httpd(8)
   man:apachectl(8)
  Process: 9599 ExecStop=/bin/kill -WINCH ${MAINPID} (code=exited, 
status=1/FAILURE)
  Process: 9597 ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND (code=exited, 
status=1/FAILURE)
 Main PID: 9597 (code=exited, status=1/FAILURE)

Aug 29 02:46:48 [server-name] systemd[1]: Starting The Apache HTTP Server...
Aug 29 02:46:48 [server-name] httpd[9597]: (98)Address already in use: AH00072: 
make_sock: could not bind to address [my-ip-address]:443
Aug 29 02:46:48 [server-name] httpd[9597]: no listening sockets available, 
shutting down
Aug 29 02:46:48 [server-name] httpd[9597]: AH00015: Unable to open logs
Aug 29 02:46:48 [server-name] systemd[1]: httpd.service: main process exited, 
code=exited, status=1/FAILURE
Aug 29 02:46:48  [server-name] kill[9599]: kill: cannot find process ""
Aug 29 02:46:48  [server-name] systemd[1]: httpd.service: control process 
exited, code=exited status=1
Aug 29 02:46:48 [server-name] systemd[1]: Failed to start The Apache HTTP 
Server.
Aug 29 02:46:48 [server-name] systemd[1]: Unit httpd.service entered failed 
state.
Aug 29 02:46:48 [server-name] systemd[1]: httpd.service failed.

Here is what I tried so far. I tried checking if any process is running on port 
443 using the command netstat -an | grep 443, but it showed nothing.

I tried checking the httpd.conf and ssl.conf files and see if there is a 
'Listen 443' on both but there isn't. It is only in ssl.conf.

That's all I've tried so far but I'm open to any suggestions you may have.

Re: [users@httpd] problem when move https site to 2.4 from 2.2 Apache

[Rose, John B]

It seems to be because of this line in ssl.conf 




When it is changed to ...




we no longer have the "Too many redirects" loop issue in https access to 
Wordpress sites







From: Daniel 
Sent: Monday, August 20, 2018 6:27:32 PM
To: 
Subject: Re: [users@httpd] problem when move https site to 2.4 from 2.2 Apache

With that amount of information there isn't much I can say about your
loop issues.
El sáb., 18 ago. 2018 a las 18:49, Rose, John B () escribió:
>
> For each Wordpress site  ...
>
>
> Wordpress Address (URL)
>
> Site Address (URL)
>
>
> contain "https" addresses
>
>
> within Apache each of the sites has a virtual host config, which are 
> basically identical except for the naming differences for the sites.
>
>
> The 2.4 Apache config was built basically identical to 2.2 except for using 
> php-fpm instead of mod_php, and "event" MPM instead of "prefork", Require 
> instead of Allow/Deny, etc.
>
>
> No redirecting within Apache except for the sites that my have done it 
> themselves within htaccess.
>
> 
> From: Daniel 
> Sent: Saturday, August 18, 2018 11:51:30 AM
> To: 
> Subject: Re: [users@httpd] problem when move https site to 2.4 from 2.2 Apache
>
> depends entirely in the config and context,making assumptions and speculate 
> based on generalizations will take you nowhere.
>
> So you should start sharing the relevant bits of config and the queries and 
> responses, including headers etc.
>
> El vie., 17 ago. 2018 17:28, Rose, John B  escribió:
>
> Encountered problems moving web sites from Apache 2.2 to 2.4 for https
>
> When moving web sites from an Apache 2.2 environment to to 2.4 the ones that 
> are .html and self written .php seem to work fine via both http and https
>
> When moving Wordpress sites to 2.4, they work fine via http, but go into 
> endless redirects when accessed via https
>
> Has anyone encountered this problem?
>
> Have done some googling, switched back and forth between php-fpm and mod_php, 
> removed .htaccess redirects, turned off plugins, etc. Nothing seems to remedy 
> it so far.
>
> Thanks
>
>


--
Daniel Ferradal
IT Specialist

email dferradal at gmail.com
linkedin es.linkedin.com/in/danielferradal

-
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org

Re: [users@httpd] problem when move https site to 2.4 from 2.2 Apache

[Rose, John B]

For each Wordpress site  ...


Wordpress Address (URL)

Site Address (URL)


contain "https" addresses


within Apache each of the sites has a virtual host config, which are basically 
identical except for the naming differences for the sites.


The 2.4 Apache config was built basically identical to 2.2 except for using 
php-fpm instead of mod_php, and "event" MPM instead of "prefork", Require 
instead of Allow/Deny, etc.


No redirecting within Apache except for the sites that my have done it 
themselves within htaccess.


From: Daniel 
Sent: Saturday, August 18, 2018 11:51:30 AM
To: 
Subject: Re: [users@httpd] problem when move https site to 2.4 from 2.2 Apache

depends entirely in the config and context,making assumptions and speculate 
based on generalizations will take you nowhere.

So you should start sharing the relevant bits of config and the queries and 
responses, including headers etc.

El vie., 17 ago. 2018 17:28, Rose, John B 
mailto:jbr...@utk.edu>> escribió:
Encountered problems moving web sites from Apache 2.2 to 2.4 for https

When moving web sites from an Apache 2.2 environment to to 2.4 the ones that 
are .html and self written .php seem to work fine via both http and https

When moving Wordpress sites to 2.4, they work fine via http, but go into 
endless redirects when accessed via https

Has anyone encountered this problem?

Have done some googling, switched back and forth between php-fpm and mod_php, 
removed .htaccess redirects, turned off plugins, etc. Nothing seems to remedy 
it so far.

Thanks

[users@httpd] problem when move https site to 2.4 from 2.2 Apache

[Rose, John B]

Encountered problems moving web sites from Apache 2.2 to 2.4 for https

When moving web sites from an Apache 2.2 environment to to 2.4 the ones that 
are .html and self written .php seem to work fine via both http and https

When moving Wordpress sites to 2.4, they work fine via http, but go into 
endless redirects when accessed via https

Has anyone encountered this problem?

Have done some googling, switched back and forth between php-fpm and mod_php, 
removed .htaccess redirects, turned off plugins, etc. Nothing seems to remedy 
it so far.

Thanks

[users@httpd] access control and Apache load balancing

[Rose, John B]

Any suggestions on how to implement access control for ip address ranges to 
specific files on back end hosts when going thru Apache load balancer?


For example, you do not want external IPs to access "filename.php" on your 
backend hosts thru load balancer

Re: [users@httpd] Apache load balancer, etc

[Rose, John B]

We are using 2.4. However we were not using "Event MPM" and were on a 
different, much less robust, system than the other load balancers we tested.


We moved Apache to system equivalent to test environment of other load 
balancers we tested, implemented "Event MPM" set MaxRequestWorkers to a high 
number and Apache performed as well as any of the other load balancers.


Summary ...


nGinx is ok, but our understanding is you have to buy nGinx+ to get persistent 
connection capability

Lighthttpd was ok but we had some trouble finding documentation on some things 
and we read the developer may have slowed down on development

HAProxy looks pretty good, we still had to dig a bit to get information and it 
looked to us that we would have to do some log file conversion in order to use 
with something that needs to parse logs

Apache performed as well as any of the others, differentiating less than +/- 
100 ms or less in performance with repeated tests compared to the best 
performing of other options, we already have some familiarity with Apache as a 
web server, there is a lot of documentation/examples/mailinglists/etc. 
available, it seems to be able to do anything we might want to do from a load 
balancer perspective


I would rate Apache,HAProxy as 1st and 2nd, then the other two.


Questions 


When calculating "MaxRequestWorkers" is it better to have "ServerLimit" or 
"ThreadPerChild" as the larger multiplier?


What happens to http requests thru the Apache load balancer if the backend 
hosts get maxed out on current TCP connections and there are still requests 
coming into the load balancer?


Thanks







From: Jim Jagielski 
Sent: Wednesday, July 4, 2018 7:51:28 AM
To: users@httpd.apache.org
Subject: Re: [users@httpd] Apache load balancer, etc

Are you using the latest Apache httpd 2.4.x? Are you using the Event MPM? Both 
our and independent 3rd party benchmarks show Apache as fast and, at times, 
even faster, than those solutions you mentioned.

> On Jul 2, 2018, at 1:24 PM, Rose, John B  wrote:
>
> Have been comparing  Apache load balancing with some other possibilities
>
> As expected can do just about anything you want with Apache but the 
> performance testing between Apache load balancing and nginx, haproxy, 
> lighthttpd has Apache noticeably slower.
>
> Any tips on config tuning to optimize Apache load balancing performance?
>
> Any comments on open source software load balancers you folks have used that 
> you recommend?
>
> Thanks
>
> Sent from my iPad
> -
> To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
> For additional commands, e-mail: users-h...@httpd.apache.org
>


-
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org

Re: [users@httpd] Apache load balancer, etc

[Rose, John B]

At this point nGinx, HAProxy, Lighthttpd seemed ~equivalent in speed. Apache 
was slower however, read repose to Jim's comment and questions 





Apache


Nginx


HAProxy


Lighttpd


Alter Ratio of Traffic to Hosts


Yes


Yes


Yes


?


Send to 2 Hosts


Yes


Yes


Yes


Yes


Implement Persistent Connection


Yes


Paid Only


Yes


Not Working


Handle HTTPS Connection


Yes


Yes


Yes


Yes


Terminate SSL at Load Balancer


Yes


Yes


Yes


Yes


Pass thru SSL Connection


Yes


Yes


Yes


Yes


Fail2Ban Compatibility


Yes


Yes


Yes


Yes


Pass X-Forwarded-For Value


Yes


Yes


Yes


?




From: knobis...@gmail.com  on behalf of Martin Knoblauch 

Sent: Tuesday, July 3, 2018 9:27:47 AM
To: users@httpd.apache.org
Subject: Re: [users@httpd] Apache load balancer, etc

Hi John,

 care to share pointers to those comparisons? Curious myself ...

Thanks
Martin

On Mon, Jul 2, 2018 at 7:24 PM, Rose, John B 
mailto:jbr...@utk.edu>> wrote:
Have been comparing  Apache load balancing with some other possibilities

As expected can do just about anything you want with Apache but the performance 
testing between Apache load balancing and nginx, haproxy, lighthttpd has Apache 
noticeably slower.

Any tips on config tuning to optimize Apache load balancing performance?

Any comments on open source software load balancers you folks have used that 
you recommend?

Thanks

Sent from my iPad
-
To unsubscribe, e-mail: 
users-unsubscr...@httpd.apache.org<mailto:users-unsubscr...@httpd.apache.org>
For additional commands, e-mail: 
users-h...@httpd.apache.org<mailto:users-h...@httpd.apache.org>




--
--
Martin Knoblauch
email: k n o b i AT knobisoft DOT de
www: http://www.knobisoft.de

[users@httpd] Apache load balancer, etc

[Rose, John B]

Have been comparing  Apache load balancing with some other possibilities

As expected can do just about anything you want with Apache but the performance 
testing between Apache load balancing and nginx, haproxy, lighthttpd has Apache 
noticeably slower.  

Any tips on config tuning to optimize Apache load balancing performance?

Any comments on open source software load balancers you folks have used that 
you recommend?

Thanks

Sent from my iPad
-
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org

[users@httpd] When should someone use TCP socket vs Unix socket vs Websocket for PHP execution

[Rose, John B]

If you have php-fpm running on same server as Apache, and you have a lot of 
virtual hosts (hundreds+) using PHP.  Which is the best approach for executing 
PHP as the owner of each virtual host (web directory)?


Looking thru this page at the moment for guidance 


https://httpd.apache.org/docs/2.4/mod/mod_proxy_fcgi.html



Thanks

[users@httpd] How to route userdir requests to different hosts?

[Rose, John B]

Looking for a way to route requests for different users to different back end 
hosts behind a proxy of some sort


For example ...


http request to ...


http://abc.com/~user1


always goes to one specific host



an http requests to ...


http://abc.com/~user2



always goes to a another specific host



Any suggestions appreciated


Thanks

John

[users@httpd] mod_proxy_fcgi unix domain socket syntax question on Apache documentation

[Rose, John B]

Looking at the documentation on this page  ...


https://httpd.apache.org/docs/2.4/mod/mod_proxy_fcgi.html


The documentation 
says "With this syntax, the hostname and optional port following fcgi:// are 
ignored." regarding this example ...


ProxyPassMatch "^/(.*\.php(/.*)?)$" 
"unix:/var/run/php5-fpm.sock|fcgi://localhost/var/www/"

Why are they in the example if they are ignored?


Are they also ignored here?


SetHandler  "proxy:unix:/path/to/app.sock|fcgi://localhost/"


Thanks

John

[users@httpd] CPU usage in server-status and top not matching

[Rose, John B]

Hello


Trying to match high %cpu httpd processes from "top" with what they are 
requesting and ip addresses


Any suggestions?


Thanks

[users@httpd] "apachectl -S" and DocumentRoot

[Rose, John B]

Hello


apachectl -S


is a nice command. We are looking for something that outputs the "DocumentRoot" 
for all virtual hosts


Is there some way to do that with a single command?


Thanks

Re: [users@httpd] yum update puts back removed Apache modules

[Rose, John B]

Thanks  John

On 11/10/17, 4:38 PM, "John Iliffe" <john.ili...@iliffe.ca> wrote:

yum doesn't know when you install a programme by compiling it that it is 
there unless you update the package history database, so it goes by it's 
previous record (the apache version that you superseded).

There is a yum option to exclude specific packages from a yum update.  I 
seem to recall that it is --exclude  but you can find it in the 
man 
file.

The newer version of yum, dnf, is a bit more flexible if you have the 
option 
to update, and the command for dnf is -x 

Regards,

John
=
On Friday 10 November 2017 16:24:35 Rose, John B wrote:
> It seems as though “yum” update has replaced Apache modules installed in
> the default installation, that we had removed after the initial install
> because they weren’t used.
> 
> Is there some way to prevent that from happening?
> 
> thanks

-
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org




-
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org

[users@httpd] yum update puts back removed Apache modules

[Rose, John B]

It seems as though “yum” update has replaced Apache modules installed in the 
default installation, that we had removed after the initial install because 
they weren’t used.

Is there some way to prevent that from happening?

thanks

[users@httpd] SSLEngine on and mod_macro

[Rose, John B]

When setting “SSLEngine on” in a mod_macro config file for virtual hosts we are 
not able to start Apache.

When it is commented out, Apache will start. On the same server “SSLEngine on” 
is in another self-contained virtual host config file, and also in ssl.conf. 
Those do not cause any problems with starting Apache. Only when it is in the 
mod_macro config file.

The above, "SSLEngine on”  in the mod_marco config file worked fine on a Apache 
2.2 system. But on an Apache 2.4.6, it is having the above problem.

Any ideas?

Thanks

Re: [users@httpd] AH00894: declining URL fcgi

[Rose, John B]

Thanks Daniel




On 8/24/17, 2:48 PM, "Daniel" <dferra...@gmail.com> wrote:

>if you refer to "execution" you should look in your php-fpm server. As
>you know mod_proxy_fcgi just reverse proxies specific requests to your
>fcgi backend.
>
>All I see is in this debug, the request reaches the server and
>mod_proxy_ajp (which does not handle fcgi requests and it is made for
>tomcat ajp protocol) declines to handle the request and this is
>probably passed along to the appropiate mod_proxy submodule, which is
>mod_proxy_fcgi, which then does what is meant to do, connect to
>127.0.0.1:9000 and pass the request to the backend.
>
>Next time, you could share the exact related modules and directives
>you have, so the context of the situation is clear. But as I see it,
>it is proceeding fine choosing the appropiate module to handle the
>fcgi request.
>
>2017-08-24 15:56 GMT+02:00 Rose, John B <jbr...@utk.edu>:
>> Not sure if this is our problem, but after setting log level to debug we
>> noticed this in the error_log. Not sure how to interpret what is happening.
>> It looks like the fcgi connection to php-fpm is being declined initially,
>> then it is successful. But I am not sure. Is this refusing to execute the
>> php command? Thanks
>>
>> [Thu Aug 24 08:47:04.688410 2017] [proxy:debug] [pid 1:tid
>> 140240136169216] mod_proxy.c(1123): [client xx.xx.xx.xx:52527] AH01143:
>> Running scheme fcgi handler (attempt 0), referer:
>> http://abc.com/wp-admin/media-new.php
>>
>> [Thu Aug 24 08:47:04.688416 2017] [proxy_ajp:debug] [pid 1:tid
>> 140240136169216] mod_proxy_ajp.c(722): [client xx.xx.xx.xx:52527] AH00894:
>> declining URL
>> fcgi://127.0.0.1:9000/home/user/public_html/wp-admin/async-upload.php,
>> referer: http://abc.com/wp-admin/media-new.php
>>
>> [Thu Aug 24 08:47:04.688419 2017] [proxy_fcgi:debug] [pid 1:tid
>> 140240136169216] mod_proxy_fcgi.c(972): [client xx.xx.xx.xx:52527] AH01076:
>> url: fcgi://127.0.0.1:9000/home/user/public_html/wp-admin/async-upload.php
>> proxyname: (null) proxyport: 0, referer:
>> http://abc.com/wp-admin/media-new.php
>>
>> [Thu Aug 24 08:47:04.688421 2017] [proxy_fcgi:debug] [pid 1:tid
>> 140240136169216] mod_proxy_fcgi.c(979): [client xx.xx.xx.xx:52527] AH01078:
>> serving URL
>> fcgi://127.0.0.1:9000/home/user/public_html/wp-admin/async-upload.php,
>> referer: http://abc.com/wp-admin/media-new.php
>>
>> [Thu Aug 24 08:47:04.688424 2017] [proxy:debug] [pid 1:tid
>> 140240136169216] proxy_util.c(2203): AH00942: FCGI: has acquired connection
>> for (*)
>>
>> [Thu Aug 24 08:47:04.688427 2017] [proxy:debug] [pid 1:tid
>> 140240136169216] proxy_util.c(2256): [client xx.xx.xx.xx:52527] AH00944:
>> connecting
>> fcgi://127.0.0.1:9000/home/user/public_html/wp-admin/async-upload.php to
>> 127.0.0.1:9000, referer: http://abc.com/wp-admin/media-new.php
>>
>> [Thu Aug 24 08:47:04.688436 2017] [proxy:debug] [pid 1:tid
>> 140240136169216] proxy_util.c(2422): [client xx.xx.xx.xx:52527] AH00947:
>> connected /home/user/public_html/wp-admin/async-upload.php to
>> 127.0.0.1:9000, referer: http://abc.com/wp-admin/media-new.php
>>
>>
>>
>>
>
>
>
>-- 
>Daniel Ferradal
>IT Specialist
>
>email dferradal at gmail.com
>linkedin es.linkedin.com/in/danielferradal
>
>-
>To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
>For additional commands, e-mail: users-h...@httpd.apache.org
>

[users@httpd] AH00894: declining URL fcgi

[Rose, John B]

Not sure if this is our problem, but after setting log level to debug we 
noticed this in the error_log. Not sure how to interpret what is happening. It 
looks like the fcgi connection to php-fpm is being declined initially, then it 
is successful. But I am not sure. Is this refusing to execute the php command? 
Thanks


[Thu Aug 24 08:47:04.688410 2017] [proxy:debug] [pid 1:tid 140240136169216] 
mod_proxy.c(1123): [client xx.xx.xx.xx:52527] AH01143: Running scheme fcgi 
handler (attempt 0), referer: http://abc.com/wp-admin/media-new.php

[Thu Aug 24 08:47:04.688416 2017] [proxy_ajp:debug] [pid 1:tid 
140240136169216] mod_proxy_ajp.c(722): [client xx.xx.xx.xx:52527] AH00894: 
declining URL 
fcgi://127.0.0.1:9000/home/user/public_html/wp-admin/async-upload.php, referer: 
http://abc.com/wp-admin/media-new.php

[Thu Aug 24 08:47:04.688419 2017] [proxy_fcgi:debug] [pid 1:tid 
140240136169216] mod_proxy_fcgi.c(972): [client xx.xx.xx.xx:52527] AH01076: 
url: fcgi://127.0.0.1:9000/home/user/public_html/wp-admin/async-upload.php 
proxyname: (null) proxyport: 0, referer: http://abc.com/wp-admin/media-new.php

[Thu Aug 24 08:47:04.688421 2017] [proxy_fcgi:debug] [pid 1:tid 
140240136169216] mod_proxy_fcgi.c(979): [client xx.xx.xx.xx:52527] AH01078: 
serving URL 
fcgi://127.0.0.1:9000/home/user/public_html/wp-admin/async-upload.php, referer: 
http://abc.com/wp-admin/media-new.php

[Thu Aug 24 08:47:04.688424 2017] [proxy:debug] [pid 1:tid 140240136169216] 
proxy_util.c(2203): AH00942: FCGI: has acquired connection for (*)

[Thu Aug 24 08:47:04.688427 2017] [proxy:debug] [pid 1:tid 140240136169216] 
proxy_util.c(2256): [client xx.xx.xx.xx:52527] AH00944: connecting 
fcgi://127.0.0.1:9000/home/user/public_html/wp-admin/async-upload.php to 
127.0.0.1:9000, referer: http://abc.com/wp-admin/media-new.php

[Thu Aug 24 08:47:04.688436 2017] [proxy:debug] [pid 1:tid 140240136169216] 
proxy_util.c(2422): [client xx.xx.xx.xx:52527] AH00947: connected 
/home/user/public_html/wp-admin/async-upload.php to 127.0.0.1:9000, referer: 
http://abc.com/wp-admin/media-new.php

Re: [users@httpd] Access Control in 2.4 question

[Rose, John B]

Eric

Thanks for those tips, they helped us out. 

j




On 8/9/17, 4:31 PM, "Eric Covener" <cove...@gmail.com> wrote:

>On Wed, Aug 9, 2017 at 4:19 PM, Rose, John B <jbr...@utk.edu> wrote:
>> Thanks for the reply Eric.
>>
>> 1. Regarding "Proxied so it never hit the filesystem and never matched” if 
>> ProxyPassMatch is being used for php-fpm and blocking access to a .php file 
>> is goal, how can that be accomplished? Or maybe I am not understanding how 
>> that works.
>
>You can use the SetHandler method of configuration for mod_proxy_fcgi,
> which allows the normal mapping to occur first.
>
>> 2. As for "Overridden by section with higher precedence like Location or 
>> htaccess” is there some way to determine that besides culling thru lines of 
>> config files line by line?
>
>Not really, but you're looking specifically for a section w/ 'require'
>directives.
>
>-
>To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
>For additional commands, e-mail: users-h...@httpd.apache.org
>

Re: [users@httpd] Access Control in 2.4 question

[Rose, John B]

Thanks for the reply Eric.

1. Regarding "Proxied so it never hit the filesystem and never matched” if 
ProxyPassMatch is being used for php-fpm and blocking access to a .php file is 
goal, how can that be accomplished? Or maybe I am not understanding how that 
works.

2. As for "Overridden by section with higher precedence like Location or 
htaccess” is there some way to determine that besides culling thru lines of 
config files line by line?




On 8/9/17, 3:33 PM, "Eric Covener" <cove...@gmail.com> wrote:

>On Wed, Aug 9, 2017 at 3:03 PM, Rose, John B <jbr...@utk.edu> wrote:
>> If all the necessary modules are installed, what would prevent this from
>> working?
>>
>> 
>> Require all denied
>> 
>
>Not in a config file being read
>Proxied so it never hit the filesystem and never matched
>Overridden by section with higher precedence like Location or htaccess
>Browser cache
>
>-
>To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
>For additional commands, e-mail: users-h...@httpd.apache.org
>

[users@httpd] Access Control in 2.4 question

[Rose, John B]

If all the necessary modules are installed, what would prevent this from 
working?



Require all denied

[users@httpd] Apache + virtual hosts + php-fpm?

[Rose, John B]

Looking at the php-fpm homepage …

https://php-fpm.org

it says this …

It was not designed with virtual hosting in mind (large amounts of pools) 
however it can be adapted for any usage model.

Are folks using Apache with numerous virtual hosts, still using mod_php as the 
preferred approach? With I assume prefork MPM?

[users@httpd] access_log and split-logfile, vlogger, something else?

[Rose, John B]

Is there a most frequently used tool for culling virtual host log files out of 
a single access_log file?

split-logfile? vlogger? Something else?

Thanks

Re: [users@httpd] memory

[Rose, John B]

We found we did not need several modules that were loaded by default. So we 
removed those.  

Using php-fpm instead of mod_php 

If your folks are using a cms, are they using unnecessary plugins?

Sent from my iPad

> On Jul 3, 2017, at 1:01 PM, Doug Maurer  wrote:
> 
> Is there a way to limit the amount of RAM being used without reducing the 
> number of servers/processes? Or is apache designed to just take as must 
> memory as it can and hold on to it?
> 
> 
> -
> To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
> For additional commands, e-mail: users-h...@httpd.apache.org
> 

-
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org

[users@httpd] RAM output in server-status?

[Rose, John B]

Apache 2.2.15

We have ExtendedStatus on

We have to toggle to “top” to try and catch RAM per httpd process. Is there 
some way to output RAM per process in server-status output?

Thanks

[users@httpd] forensic logs with virtual hosts

[Rose, John B]

Is there some global way to utilize mod_log_forensic with virtual hosts without 
having to add “ForensicLog logfilepathname” to every virtual host config?

Re: [users@httpd] adding footer to all web pages

[Rose, John B]

Thanks for reply.

SSI seemed to only work if an “include” was added to pages.

Using php_value in Apache or the file append in php.ini seemed the best options.

Also briefly looked at AddOutputFilter/Substitute and the cgi options. Did not 
explore mod_layout very closely.

From: Adam Powell <a...@adaminfinitum.com<mailto:a...@adaminfinitum.com>>
Reply-To: "users@httpd.apache.org<mailto:users@httpd.apache.org>" 
<users@httpd.apache.org<mailto:users@httpd.apache.org>>
Date: Thursday, May 25, 2017 at 11:04 PM
To: "users@httpd.apache.org<mailto:users@httpd.apache.org>" 
<users@httpd.apache.org<mailto:users@httpd.apache.org>>
Subject: Re: [users@httpd] adding footer to all web pages

Google Analytics, by default, only tracks pages by path.

Meaning if you add a Google Analytics snippet to all virtual hosts visitors to 
the home page of each site will be almost impossible to distinguish from each 
other in the reports...there are ways around this but you should be aware of it.

I believe you'll want to review the documentation for server side includes 
(SSI).

Adam Powell
http://www.adaminfinitum.com


On Thu, May 25, 2017 at 9:32 PM, Rose, John B 
<jbr...@utk.edu<mailto:jbr...@utk.edu>> wrote:

If we wanted to add a Google Analytics footer to all pages on our server, 
meaning all virtual hosts, what is the best way to do that via Apache without 
having to touch the individual web sites?

[users@httpd] check_forensic script on Red Hat?

[Rose, John B]

Does check_forensic still exist?

I am not finding it.

[users@httpd] allow deny file and multiple .conf question

[Rose, John B]

When controlling access to specific files via Allow/Deny, and not using 
 or , and putting in different .conf files, does the order 
of the conf files matter?

In other words …

aaa-block.conf has …

  Order Deny,Allow
  Deny from All

…

zzz-block.conf has …

  Order Deny, Allow
  Deny from all
  Allow from your domain.com



Would the .conf files similar to one above controlling access previous be 
negated by the last zzz-block.conf above? In other words “Allow from 
yourdomain.com" would apply to all the previous  statements? Are the 
.conf files in the same directory loaded alphabetically by Apache?

Thanks

[users@httpd] Analog log file analyzer for Apache logs

[Rose, John B]

Has anyone used these more recent versions (C:Amie) for Apache logs?

http://www.c-amie.co.uk/analog/

Comments?

[users@httpd] Server Side Includes question

[Rose, John B]

1)   Is it possible to auto add a footer to all web pages on a server, 
including all virtual hosts sites pages, with a Server Sides Includes, without 
editing any of the pages?



2)   Is it possible to accomplish adding a javascript to the bottom of all 
pages on a server, including virtual hosts, automatically via Apache, without 
touching any of the sites pages?
If so, how?


Thanks

[users@httpd] adding footer to all web pages

[Rose, John B]

If we wanted to add a Google Analytics footer to all pages on our server, 
meaning all virtual hosts, what is the best way to do that via Apache without 
having to touch the individual web sites?

Re: [users@httpd] Apache log analyzer?

[Rose, John B]

We have analog and awstats installed. But maybe we didn’t look close enough at 
of what they are capable.

We would like to parse multiple virtual host log files find the ip’s accessing 
a particular URL’s within a given time range and be able to separate out which 
virtual host the log entry came from.


On 4/28/17, 11:59 AM, "Jim Jagielski" <j...@jagunet.com> wrote:

>It would be nice to reboot Analog, which has always been my goto. In
>fact, I even booted up a Github repo (https://github.com/jimjag/analog)
>where I was going to start fixing and adding things.
>
>> On Apr 28, 2017, at 11:38 AM, Scott Birl <sb...@temple.edu> wrote:
>> 
>>> From: Rose, John B [mailto:jbr...@utk.edu] 
>>> Sent: Friday, April 28, 2017 11:18 AM
>>> To: users@httpd.apache.org
>>> Subject: [users@httpd] Apache log analyzer?
>>> 
>>> Any suggestions for an Apache log analyzer?
>>> 
>>> Thanks
>>> 
>> 
>> 
>> John:
>> 
>> I have found that different analyzers interpret the data differently.
>> Ive used AWStats, Analog for my co-workers who want hit results,
>> and a home-grown PERL script catered to what I wanted to see from a
>> back-end perspective.
>> 
>> I guess it really depends on what you're looking for.
>> 
>> http://www.awstats.org/
>> http://mirror.reverse.net/pub/analog/
>> 
>> HTH
>> 
>> Mr. S.A. Birl
>> 
>> -
>> To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
>> For additional commands, e-mail: users-h...@httpd.apache.org
>
>
>-
>To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
>For additional commands, e-mail: users-h...@httpd.apache.org
>

[users@httpd] Apache log analyzer?

[Rose, John B]

Any suggestions for an Apache log analyzer?

Thanks

Re: [users@httpd] What is preferred PHP interface?

[Rose, John B]

What are some troubleshooting methods that utilize this config to “helps to 
determine when the issue is php and when the issue is Apache.”

Thanks

From: Daniel 
Reply-To: "users@httpd.apache.org" 
Date: Friday, April 7, 2017 at 9:18 AM
To: "" 
Subject: Re: [users@httpd] What is preferred PHP interface?

Unless you recompile mod_php and all its extensions to be thread-safety, the 
most manegeable and performant solution will always be:

Apache w/ mpm_event + mox_proxy_fcgi -> php-fpm

Besides php-fpm is a very complete daemon/service to serve php, it allows for 
different pools with pretty different configurations/users/permissions/paths, 
etc. and to have a separate service for php content helps much.

For example, an added benefit from this setup is, for the not too experienced, 
it helps to determine when the issue is php and when the issue is Apache.

I see lots of folks in stackoverflow or asking for help in the #httpd channel 
at Freenode who confuse their problems as Apache being the source of them 
instead of PHP scripts or the php configuration itself.

2017-04-07 2:45 GMT+02:00 William A Rowe Jr 
>:
There is little activity on mod_fcgid because it works. There has been talk of 
tagging 2.3.10 at some point for very minor fixes.

Mod_proxy_fcgi is a viable alternative, and offers the ability to load balance, 
but managing the process pool of available fcgi workers is offloaded from httpd 
and becomes a distinct ops responsibility. It too has changed little since 2013.



--
Daniel Ferradal
IT Specialist

email dferradal at gmail.com
linkedin 
es.linkedin.com/in/danielferradal

[users@httpd] Causes httpd processes spiraling out of control with memory usage?

[Rose, John B]

Are there some common causes for a single httpd process to use inordinate 
amounts of RAM?

I have read about one person having a loop in their mod_rewrite rules. If 
someone hit the particular URL, the offending Rewrite rule would
cause memory consumption to go out of control

Thanks

[users@httpd] apache.org server-status interface

[Rose, John B]

What is the new interface on this page?

http://httpd.apache.org/server-status

Is all the previous interface information available?

Re: [users@httpd] ServerAlias limit and conflicts?

[Rose, John B]

Thanks for replying, regarding question 1 let me reword the question …

In one virtual host block could you have hundreds of ServerAlias lines with no 
negative impact.

As in …

ServerName abc.com
ServerAlias one.abc.com
ServerAlias two.abc.com
ServerAlias three.abc.com
…
ServerAlias fourhundred.abc.com


Thanks

From: Mitchell Krog Photography <mitchellk...@gmail.com>
Date: Friday, March 17, 2017 at 2:27 AM
To: John Rose <jbr...@utk.edu>, "users@httpd.apache.org" 
<users@httpd.apache.org>
Subject: Re: [users@httpd] ServerAlias limit and conflicts?

1. I have always stuck to one ServerAlias line but for fun I tested this config 
this morning and it works just fine

ServerName centos.local
ServerAlias centos2.local centos3.local
ServerAlias centos4.local
ServerAlias centos5.local centos6.local centos7.local


2. Not that I am aware of, I have had Apache hosts in the past with well over 
200 domains on a ServerAlias line

3. No tested that for you too got … [warn] _default_ VirtualHost overlap on 
port 80, the first has precedence



From: Rose, John B <jbr...@utk.edu><mailto:jbr...@utk.edu>
Reply: users@httpd.apache.org<mailto:users@httpd.apache.org> 
<users@httpd.apache.org><mailto:users@httpd.apache.org>
Date: 16 March 2017 at 11:31:17 PM
To: users@httpd.apache.org<mailto:users@httpd.apache.org> 
<users@httpd.apache.org><mailto:users@httpd.apache.org>
Subject:  [users@httpd] ServerAlias limit and conflicts?



1.   Is there a limit on how many  “ServerAlias” lines can be in a virtual 
host block?


2.   Is there a limit on how many hostnames can be in one “ServerAlias” 
line?


3.   If you used “ServerAlias *.abc.com<http://abc.com>” in one virtual 
host conf file, would that cause any conflict with existing virtual host conf 
files using the same abc.com<http://abc.com> domain?


Thanks

[users@httpd] ServerAlias limit and conflicts?

[Rose, John B]

1.   Is there a limit on how many  “ServerAlias” lines can be in a virtual 
host block?


2.   Is there a limit on how many hostnames can be in one “ServerAlias” 
line?


3.   If you used “ServerAlias *.abc.com” in one virtual host conf file, 
would that cause any conflict with existing virtual host conf files using the 
same abc.com domain?


Thanks

Re: [users@httpd] How to calculate maxclients for Apache mpm event module?

[Rose, John B]

Are you using PHP-FPM or mod_php?

From: Krunal Patel 
Reply-To: "users@httpd.apache.org" 
Date: Tuesday, November 29, 2016 at 12:25 PM
To: users 
Subject: [users@httpd] How to calculate maxclients for Apache mpm event module?


What are parameters we can tune for Apache mpm event module?

Regards,

Krunal Patel.

Re: [users@httpd] RE: Thread ratios

[Rose, John B]

I think that is Apache 2.4.6

If using PHP-FPM I think you may need to coordinate some settings in PHP-FPM 
(pm.max_children, etc.) with your config settings (MaxRequestWorkers, etc) in 
Apache.

If you do rewrites you may want to be aware of this …
https://bz.apache.org/bugzilla/show_bug.cgi?id=53929



From: Darryl Philip Baker 
Reply-To: "users@httpd.apache.org" 
Date: Friday, November 18, 2016 at 10:28 AM
To: "users@httpd.apache.org" 
Subject: [users@httpd] RE: Thread ratios

I forgot to mention, just in case this has any effect on the numbers, the OS is 
RHEL7 using the distributed version of Apache HTTPD.

Darryl Baker
PMOET -DAPS
X76674

From: Darryl Philip Baker
Sent: November 18, 2016 9:12 AM
To: users@httpd.apache.org
Subject: [users@httpd] Thread ratios

I am converting an older system Apache 2.2 using mpm_prefork to Apache 2.4. I 
think we would have better performance with mpm_worker or possibly  mpm_event. 
My problem is trying to figure out what is the best ratio of threads per 
process, the correct way to set that value, and the best value for the total 
number of threads which I think is set by MaxRequestWorkers. I am tuning my 
cluster of systems for a sudden heavy load of page requests but not a lot of 
CGI or other complex operations. These are dual processor VM systems. Any 
suggestions or pointers?

Darryl Baker
Sr. System Administrator
Distributed Application Platform Services
Project Management Office and Enabling Technologies
Northwestern | Information Technology
1800 Sherman Ave., Suite 600
Evanston, IL  60201-3715
(847) 467-6674
www.it.northwestern.edu

Re: [users@httpd] Question about configuring apache to use php via fpm

[Rose, John B]

You may also want to be aware of …

ProxyErrorOverride

In case you want to use Custom error pages from Apache when using php-fpm

From: Jason Brooks 
Reply-To: "users@httpd.apache.org" 
Date: Thursday, November 3, 2016 at 3:07 PM
To: "users@httpd.apache.org" 
Subject: Re: [users@httpd] Question about configuring apache to use php via fpm

This does help, thank you!

Jason Brooks

Systems Administrator

eROI

Performance is Art.




m:

505 nw couch #300

w:

eroi.com

t:

503.290.3105

f:

503.228.4249


fb:

fb.com/eROI






On Nov 3, 2016, at 11:30 AM, Luca Toscano 
> wrote:

Hello Jason,




mod-proxy-fcgi is the only one actively supported and developed in the httpd 
project at the moment, it is definitely the best choice for the php-fpm use 
case (standalone daemon that does not need more than a proxy in front of it).

https://httpd.apache.org/docs/2.4/mod/mod_proxy_fcgi.html#examples contains 
also good references.

Hope that helps!

Luca

[users@httpd] mod_rewrite bug fix question

[Rose, John B]

It looks like this bug was fixed in Apache 2.4.9

https://bz.apache.org/bugzilla/show_bug.cgi?id=53929

Red Hat 7 latest yum repository version is Apache 2.4.6

What are the options, if any, to address this bug in Red Hat 7 utilizing the 
repository provided Apache

Thanks for your time

[users@httpd] SSL config and virtual hosts

[Rose, John B]

Question regarding SSL settings and virtual hosts

If the settings SSLProtocol,  etc are set in ssl.conf  and you have a virtual 
host(s), you still have to duplicate the desired SSL settings explicitly in the 
first virtual host in order for any of the virtual hosts to be configured for 
SSL?

In other words, the settings within ssl.conf are meaningless to name based 
virtual hosts?

My interpretation of this documentation …

https://wiki.apache.org/httpd/NameBasedSSLVHosts

Re: [users@httpd] RE: Apache default page shows up periodically

[Rose, John B]

Single host.

Sent from my iPad

On Jun 30, 2016, at 5:19 PM, Darryl Philip Baker 
<darryl.ba...@northwestern.edu<mailto:darryl.ba...@northwestern.edu>> wrote:

Is this a single host or some kind of cluster?

Darryl Baker

From: Rose, John B [mailto:jbr...@utk.edu]
Sent: June 30, 2016 1:14 PM
To: users@httpd.apache.org<mailto:users@httpd.apache.org>
Subject: [users@httpd] Apache default page shows up periodically

We have a group that has the default Red Hat Apache page show up occasionally 
instead of their regular home page. Usually their correct home page loads. The 
page will load properly for a couple weeks, then the default Red Hat page shows 
up for some users, but not all.

Their site is set up as a virtual host

Suggestions?

[users@httpd] Apache default page shows up periodically

[Rose, John B]

We have a group that has the default Red Hat Apache page show up occasionally 
instead of their regular home page. Usually their correct home page loads. The 
page will load properly for a couple weeks, then the default Red Hat page shows 
up for some users, but not all.

Their site is set up as a virtual host

Suggestions?

[users@httpd] event MPM documentation

[Rose, John B]

Looking at the event MPM and MaxRequestWorkers documentation it looks like it 
has been updated a bit to me.  More informative.

Thanks for doing that

[users@httpd] Apache::ASP question

[Rose, John B]

Some users are wanting to access a Microsoft Access database from Apache.

They want to use this ...

Apache::ASP

Is that possible within Apache on a linux server?

What are the options for accessing Access databases from Apache?

Thanks

Re: [users@httpd] Apache virus scanning

[Rose, John B]

What about if your web sites allow for uploading files? Would you not want
to scan those on upload before they got on your filesystem?

On 3/9/16 9:49 AM, "Christopher Schultz" <ch...@christopherschultz.net>
wrote:

>John,
>
>On 3/8/16 6:02 PM, Rose, John B wrote:
>> I am interested in both
>> 
>> Thanks
>> 
>> Sent from my iPad
>> 
>>> On Mar 8, 2016, at 3:27 PM, Christopher Schultz
>>><ch...@christopherschultz.net> wrote:
>>>
>> John
>> 
>>>>> On 3/8/16 2:43 PM, Rose, John B wrote:
>>>>> Looking for comments on mod_clamav, and any other alternative
>>>>> antivirus software for Apache on linux
>> 
>> Are you trying to protect your clients or your servers?
>
>I would imagine that running any AV software that monitors the
>filesystem for changes would be sufficient. Why do you think you need an
>httpd module for this?
>
>-chris
>
>-
>To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
>For additional commands, e-mail: users-h...@httpd.apache.org
>


-
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org

Re: [users@httpd] Apache virus scanning

[Rose, John B]

I am interested in both

Thanks

Sent from my iPad

> On Mar 8, 2016, at 3:27 PM, Christopher Schultz 
> <ch...@christopherschultz.net> wrote:
> 
> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA1
> 
> John
> 
>> On 3/8/16 2:43 PM, Rose, John B wrote:
>> Looking for comments on mod_clamav, and any other alternative
>> antivirus software for Apache on linux
> 
> Are you trying to protect your clients or your servers?
> 
> - -chris
> -BEGIN PGP SIGNATURE-
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
> 
> iEYEARECAAYFAlbfNWYACgkQ9CaO5/Lv0PCtKACfUSwfFmm3iAXMmljzRhwaw6NZ
> yj0Anjxz5oIgdOm6hiV0LOs4jr3n5uLK
> =8ynF
> -END PGP SIGNATURE-
> 
> -
> To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
> For additional commands, e-mail: users-h...@httpd.apache.org
> 

-
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org

[users@httpd] Apache virus scanning

[Rose, John B]

Looking for comments on mod_clamav, and any other alternative antivirus 
software for Apache on linux

[users@httpd] How to prevent upload of specific filetype in Apache

[Rose, John B]

Looking for ways to prevent upload of specific filetypes into a specific 
directory. PHP for example.

It looks like there may be a method in mod_security

Any alternative ways?

Thanks

[users@httpd] mpm-itk questions

[Rose, John B]

Curious about any experience using mpm-itk. Pros and cons? 

Would you recommend it?

Thanks

Sent from my iPad

-
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org

Re: [users@httpd] Second apache as fallback server

[Rose, John B]

What is your preferred approach to keeping content in sync?

Sent from my iPad

On Feb 14, 2016, at 3:47 PM, Daniel 
> wrote:

with a reverse proxy in front of both, you use balancer setup specifying the 
second web server as hot standby

El dom., 14 feb. 2016 a las 16:49, Bob 
(>) escribió:
Hello list,

I have two servers. One is already up with apache, mysql etc..
Now I wonder if I can configure the second server as a fallback web server.
The idea is.. if first web server is down , the second one will serve
the requests.

Any suggestion / idea is very much welcome.

Thanks and regards,
Bob

-
To unsubscribe, e-mail: 
users-unsubscr...@httpd.apache.org
For additional commands, e-mail: 
users-h...@httpd.apache.org

[users@httpd] Options for setting up Apache server cluster ...

[Rose, John B]

Looking for recommendations for a good guide for setting up an Apache web 
server cluster

Thanks

[users@httpd] AsyncRequestWorkerFactor

[Rose, John B]

What is an example circumstance where setting "AsyncRequestWorkerFactor" to a 
value other the the default value of 2, would be preferred?

Thanks

Re: [users@httpd] Command line method to get virtual hosts and DocumentRoot?

[Rose, John B]

Thanks Yehuda and Pete

On 1/28/16 1:31 PM, "Pete Houston" <p...@openstrike.co.uk> wrote:

>On Thu, Jan 28, 2016 at 05:03:41PM +, Rose, John B wrote:
>> Is there a command line method to list all the virtual hosts and each
>>DocumentRoot?
>
>Should be pretty simple to construct with Apache::ConfigParser.
>https://metacpan.org/pod/Apache::ConfigParser
>
>Pete
>-- 
>Openstrike - improving business through open source
>http://www.openstrike.co.uk/ or call 01722 770036


-
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org

[users@httpd] Command line method to get virtual hosts and DocumentRoot?

[Rose, John B]

Is there a command line method to list all the virtual hosts and each 
DocumentRoot?

Httpd -S

Just gives the name and the .conf file.

Thanks

Re: [users@httpd] proxying content to another server

[Rose, John B]

It seems to be working ...

RequestHeader set always HOST="whatever.com"

Thanks Daniel and Eric

From: Daniel <dferra...@gmail.com<mailto:dferra...@gmail.com>>
Reply-To: "users@httpd.apache.org<mailto:users@httpd.apache.org>" 
<users@httpd.apache.org<mailto:users@httpd.apache.org>>
Date: Tuesday, January 26, 2016 6:59 AM
To: "users@httpd.apache.org<mailto:users@httpd.apache.org>" 
<users@httpd.apache.org<mailto:users@httpd.apache.org>>
Subject: Re: [users@httpd] proxying content to another server


Try with "always" Requestheader always...

El lun., 25 de ene. de 2016 19:36, Rose, John B 
<jbr...@utk.edu<mailto:jbr...@utk.edu>> escribió:
We tried this, but does not seem to be working. We do have mod_header
installed and loaded Š

RequestHeader set Host "www.newurl.com<http://www.newurl.com>"


Is something else required?

Thanks


On 1/22/16 3:50 PM, "Eric Covener" 
<cove...@gmail.com<mailto:cove...@gmail.com>> wrote:

>On Fri, Jan 22, 2016 at 3:40 PM, Rose, John B 
><jbr...@utk.edu<mailto:jbr...@utk.edu>> wrote:
>> We found ProxyPassReverse cannot reside in an htaccess file
>
>You can probably accomplish similar in htaccess with Header always
>edit Location ...
>
>-
>To unsubscribe, e-mail: 
>users-unsubscr...@httpd.apache.org<mailto:users-unsubscr...@httpd.apache.org>
>For additional commands, e-mail: 
>users-h...@httpd.apache.org<mailto:users-h...@httpd.apache.org>
>


-
To unsubscribe, e-mail: 
users-unsubscr...@httpd.apache.org<mailto:users-unsubscr...@httpd.apache.org>
For additional commands, e-mail: 
users-h...@httpd.apache.org<mailto:users-h...@httpd.apache.org>

Re: [users@httpd] proxying content to another server

[Rose, John B]

Is there any reason this would not work in Apache 2.0?

RequestHeader set always HOST="whatever.com"


From: John Rose <jbr...@utk.edu<mailto:jbr...@utk.edu>>
Reply-To: "users@httpd.apache.org<mailto:users@httpd.apache.org>" 
<users@httpd.apache.org<mailto:users@httpd.apache.org>>
Date: Tuesday, January 26, 2016 11:07 AM
To: "users@httpd.apache.org<mailto:users@httpd.apache.org>" 
<users@httpd.apache.org<mailto:users@httpd.apache.org>>
Subject: Re: [users@httpd] proxying content to another server

It seems to be working ...

RequestHeader set always HOST="whatever.com"

Thanks Daniel and Eric

From: Daniel <dferra...@gmail.com<mailto:dferra...@gmail.com>>
Reply-To: "users@httpd.apache.org<mailto:users@httpd.apache.org>" 
<users@httpd.apache.org<mailto:users@httpd.apache.org>>
Date: Tuesday, January 26, 2016 6:59 AM
To: "users@httpd.apache.org<mailto:users@httpd.apache.org>" 
<users@httpd.apache.org<mailto:users@httpd.apache.org>>
Subject: Re: [users@httpd] proxying content to another server


Try with "always" Requestheader always...

El lun., 25 de ene. de 2016 19:36, Rose, John B 
<jbr...@utk.edu<mailto:jbr...@utk.edu>> escribió:
We tried this, but does not seem to be working. We do have mod_header
installed and loaded Š

RequestHeader set Host "www.newurl.com<http://www.newurl.com>"


Is something else required?

Thanks


On 1/22/16 3:50 PM, "Eric Covener" 
<cove...@gmail.com<mailto:cove...@gmail.com>> wrote:

>On Fri, Jan 22, 2016 at 3:40 PM, Rose, John B 
><jbr...@utk.edu<mailto:jbr...@utk.edu>> wrote:
>> We found ProxyPassReverse cannot reside in an htaccess file
>
>You can probably accomplish similar in htaccess with Header always
>edit Location ...
>
>-
>To unsubscribe, e-mail: 
>users-unsubscr...@httpd.apache.org<mailto:users-unsubscr...@httpd.apache.org>
>For additional commands, e-mail: 
>users-h...@httpd.apache.org<mailto:users-h...@httpd.apache.org>
>


-
To unsubscribe, e-mail: 
users-unsubscr...@httpd.apache.org<mailto:users-unsubscr...@httpd.apache.org>
For additional commands, e-mail: 
users-h...@httpd.apache.org<mailto:users-h...@httpd.apache.org>

Re: [users@httpd] proxying content to another server

[Rose, John B]

We tried this, but does not seem to be working. We do have mod_header
installed and loaded Š

RequestHeader set Host "www.newurl.com"


Is something else required?

Thanks


On 1/22/16 3:50 PM, "Eric Covener" <cove...@gmail.com> wrote:

>On Fri, Jan 22, 2016 at 3:40 PM, Rose, John B <jbr...@utk.edu> wrote:
>> We found ProxyPassReverse cannot reside in an htaccess file
>
>You can probably accomplish similar in htaccess with Header always
>edit Location ...
>
>-
>To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
>For additional commands, e-mail: users-h...@httpd.apache.org
>


-
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org

[users@httpd] proxying content to another server

[Rose, John B]

Is there a way to proxy content to another server via htaccess?

After experimenting with this  ...

https://httpd.apache.org/docs/trunk/rewrite/proxy.html

We found ProxyPassReverse cannot reside in an htaccess file

Thanks

Re: [users@httpd] proxying content to another server

[Rose, John B]

"Header always edit Location"?


Not clear what that means.



Just removing "ProxyPassReverse" seems to work. What should removing it
impact?



On 1/22/16 3:50 PM, "Eric Covener" <cove...@gmail.com> wrote:

>On Fri, Jan 22, 2016 at 3:40 PM, Rose, John B <jbr...@utk.edu> wrote:
>> We found ProxyPassReverse cannot reside in an htaccess file
>
>You can probably accomplish similar in htaccess with Header always
>edit Location ...
>
>-
>To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
>For additional commands, e-mail: users-h...@httpd.apache.org
>


-
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org

Re: [users@httpd] Circumstances when mod_php would run faster than PHP-FPM?

[Rose, John B]

On 1/14/16 5:44 PM, "Eric Covener" <cove...@gmail.com> wrote:

>On Thu, Jan 14, 2016 at 4:28 PM, Rose, John B <jbr...@utk.edu> wrote:
>> StartServers ? -> pm.start_servers = ?
>> MinSpareThreads ? -> pm.min_spare_servers = ?
>> MaxSpareThreads ? -> pm.max_spare_servers = ?
>> MaxRequestWorkers ? -> pm.max_children = ?
>>
>> No Apache equivalent -> pm.max_requests = ?
>
>pm.max_requests is similar to MaxRequestsPerChild.


Thanks for the reply.

Question: Looking at that PHP-FPM provided config file inline comments I
see this (which may me view pm.max_children as the equiv of
MaxRequestWorkers) ...


; The number of child processes to be created when pm is set to 'static'
and the
; maximum number of child processes to be created when pm is set to
'dynamic'.
; This value sets the limit on the number of simultaneous requests that
will be
; served. Equivalent to the ApacheMaxClients directive with mpm_prefork.
; Equivalent to the PHP_FCGI_CHILDREN environment variable in the original
PHP
; CGI.
; Note: Used when pm is set to either 'static' or 'dynamic'
; Note: This value is mandatory.
pm.max_children = 50


Š

; The number of requests each child process should execute before
respawning.
; This can be useful to work around memory leaks in 3rd party libraries.
For
; endless request processing specify '0'. Equivalent to
PHP_FCGI_MAX_REQUESTS.
; Default Value: 0
;pm.max_requests = 50






>
>But these are not really things that you'd expext to necessarily
>balance on each side of an equation. The moral of this
>thread is that you likely had queueing because your HTTP server
>accepted more parallel requests then your backend
>scripts would accept based on the FPM settings.
>
>But how that pool grows on the backend maybe different from how you
>wan it to grow on the frontend -- the cost may be very different,
>and the http server might serice requests that don't go to FPM.
>
>
>-- 
>Eric Covener
>cove...@gmail.com
>
>-
>To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
>For additional commands, e-mail: users-h...@httpd.apache.org
>


-
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org

Re: [users@httpd] Circumstances when mod_php would run faster than PHP-FPM?

[Rose, John B]

The defaults for php-fpm. So none match and are set lower in PHP-FPM.
Except of start servers
 pm.start_servers = 5
 pm.min_spare_servers = 5
 pm.max_spare_servers = 35
 pm.max_children = 50

 
What would this match to in Apache?
 ?  ->  pm.max_requests = 0

These do not seem to have a matching setting in php-fpm from what I have
seen
ServerLimit 16
ThreadsPerChild 16
MaxConnectionsPerChild   0


Not sure how prevalent Apache/Event/PHP-FPM is, but a table correlating
the Apache config settings and PHP-FPM config settings would be useful. At
least for initial setup.

So, is this accurate ...

StartServers ? -> pm.start_servers = ?
MinSpareThreads ? -> pm.min_spare_servers = ?
MaxSpareThreads ? -> pm.max_spare_servers = ?
MaxRequestWorkers ? -> pm.max_children = ?

No Apache equivalent -> pm.max_requests = ?


ServerLimit ?-> no PHP-FPM equivalent
ThreadsPerChild ?-> no PHP-FPM equivalent
MaxConnectionsPerChild ?-> no PHP-FPM equivalent



On 1/14/16 3:24 PM, "Rich Bowen" <rbo...@rcbowen.com> wrote:

>
>
>On 01/12/2016 04:21 PM, Rose, John B wrote:
>> So for example using the default "event" mpm values
>> 
>>(http://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/conf/extra/httpd-
>>mp
>> m.conf.in) below in Apache then PHP-FPM would be the same ...
>> 
>> StartServers 3 -> pm.start_servers = 3
>> MinSpareThreads 75 -> pm.min_spare_servers = 75
>> MaxSpareThreads 250 -> pm.max_spare_servers = 250
>> MaxRequestWorkers 400 -> pm.max_requests = 400
>> 
>> I am not seeing any PHP-FPM equiv settings for ...
>> 
>> ThreadsPerChild 25
>> 
>> MaxConnectionsPerChild   0
>> 
>> 
>> 
>> Correct?
>> 
>
>
>Seems reasonable. What was it set to before?
>
>
>> 
>> On 1/12/16 3:41 PM, "Rich Bowen" <rbo...@rcbowen.com> wrote:
>> 
>>>
>>>
>>> On 01/12/2016 02:26 PM, Rose, John B wrote:
>>>> Is there a guide to properly matching your apache and PHP-FPM configs?
>>>>
>>>> Looking here Š
>>>>
>>>> https://wiki.apache.org/httpd/PHP-FPM
>>>>
>>>>
>>> I am not seeing that information
>>>>
>>>
>>> php-fpm is documented in the PHP docs at
>>> http://php.net/manual/en/install.fpm.php  I'm far from an expert on it,
>>> but the rule would be that if you're proxing from A to B, then B needs
>>> to be able to handle as much traffic as A is forwarding to it. So I'd
>>> expect that what you want is at least as many servers/workers/threads
>>>on
>>> the php-fpm end as you are likely to proxy from the httpd end.
>>>
>>> --Rich
>>>
>>>> On 1/12/16 2:03 PM, "Rich Bowen" <rbo...@rcbowen.com> wrote:
>>>>
>>>>>
>>>>>
>>>>> On 01/12/2016 01:58 PM, Rose, John B wrote:
>>>>>> Can you elaborate on this a bit?
>>>>>>
>>>>>> "..the server pool is smaller than Apache's server pool, causing
>>>>>> too much thrashing. (See the pm.min_spare_servers and so on)"
>>>>>
>>>>>
>>>>> Sure. The way that php-fpm works is that there's a php-fpm daemon,
>>>>>and
>>>>> requests for whatever.php are proxypass'ed over to it. So there must
>>>>>be
>>>>> at least as many threads over on the php-fpm side as you have active
>>>>> over on the httpd side, or there will be thrash in creating those
>>>>> threads when the time comes.
>>>>>
>>>>> So basically you need to line up the php-fpm config with your httpd
>>>>> config, or at least have more threads on the fpm side.
>>>>>
>>>>> pm.min_spare_servers (and max_spare and start_servers) are php-fpm
>>>>> configurations, which you'll find somewhere in /etc/php-fpm.d or
>>>>> whatever your particular distro calls it.
>>>>>
>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>> On 1/12/16 12:20 PM, "Rich Bowen" <rbo...@rcbowen.com> wrote:
>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> On 01/11/2016 04:51 PM, Rose, John B wrote:
>>>>>>>> After switching to mod_php from php-fpm we are told the site is
>>>>>>>> working
>>>>>>>> 4x faster using mod_php instead of ph

Re: [users@httpd] Circumstances when mod_php would run faster than PHP-FPM?

[Rose, John B]

Is there a guide to properly matching your apache and PHP-FPM configs?

Looking here Š

https://wiki.apache.org/httpd/PHP-FPM

I am not seeing that information

On 1/12/16 2:03 PM, "Rich Bowen" <rbo...@rcbowen.com> wrote:

>
>
>On 01/12/2016 01:58 PM, Rose, John B wrote:
>> Can you elaborate on this a bit?
>> 
>> "..the server pool is smaller than Apache's server pool, causing
>> too much thrashing. (See the pm.min_spare_servers and so on)"
>
>
>Sure. The way that php-fpm works is that there's a php-fpm daemon, and
>requests for whatever.php are proxypass'ed over to it. So there must be
>at least as many threads over on the php-fpm side as you have active
>over on the httpd side, or there will be thrash in creating those
>threads when the time comes.
>
>So basically you need to line up the php-fpm config with your httpd
>config, or at least have more threads on the fpm side.
>
>pm.min_spare_servers (and max_spare and start_servers) are php-fpm
>configurations, which you'll find somewhere in /etc/php-fpm.d or
>whatever your particular distro calls it.
>
>
>> 
>> 
>> 
>> On 1/12/16 12:20 PM, "Rich Bowen" <rbo...@rcbowen.com> wrote:
>> 
>>>
>>>
>>> On 01/11/2016 04:51 PM, Rose, John B wrote:
>>>> After switching to mod_php from php-fpm we are told the site is
>>>>working
>>>> 4x faster using mod_php instead of php-fpm.
>>>>
>>>> Any explanation?
>>>
>>>
>>>
>>>
>>>
>>> The cynic in me things that this is a case of old dogs being unwilling
>>> to learn new tricks.
>>>
>>> Other things that come to mind is that fpm is grossly misconfigured -
>>> perhaps they allocated insufficient memory to it? Or are running it on
>>> another machine that has a faulty network connection between them? Or
>>> possibly the server pool is smaller than Apache's server pool, causing
>>> too much thrashing. (See the pm.min_spare_servers and so on)
>>>
>>>
>>>
>>>
>>>> Thanks
>>>>
>>>> From: William A Rowe Jr <wr...@rowe-clan.net
>>>> <mailto:wr...@rowe-clan.net>>
>>>> Reply-To: "users@httpd.apache.org <mailto:users@httpd.apache.org>"
>>>> <users@httpd.apache.org <mailto:users@httpd.apache.org>>
>>>> Date: Saturday, January 9, 2016 1:58 PM
>>>> To: "users@httpd.apache.org <mailto:users@httpd.apache.org>"
>>>> <users@httpd.apache.org <mailto:users@httpd.apache.org>>
>>>> Subject: Re: [users@httpd] Circumstances when mod_php would run faster
>>>> than PHP-FPM?
>>>>
>>>> Mod_proxy_fcgi + php-fpm or mod_fcgid with php fcgi sapi should both
>>>>be
>>>> equivalent when tuned correctly.
>>>>
>>>> Your only option for running php in process efficiently is to use the
>>>> non-threadsafe php in the httpd preform module.  Your only option for
>>>> running httpd efficiently is the event, or at least the worker mpm.
>>>>
>>>> Since usually only a subset of the http requests are to a php
>>>>resource,
>>>> the answer is almost always 'no'.
>>>>
>>>> On Jan 8, 2016 16:48, "Rose, John B" <jbr...@utk.edu
>>>> <mailto:jbr...@utk.edu>> wrote:
>>>>
>>>> Apache 2.4
>>>>
>>>> On the same system, same web site, are there circumstances when
>>>> Apache using mod_php would run faster than Apache using PHP-FPM?
>>>>
>>>> Thanks
>>>>
>>>
>>>
>>> -- 
>>> Rich Bowen - rbo...@rcbowen.com - @rbowen
>>> http://apachecon.com/ - @apachecon
>>>
>>> -
>>> To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
>>> For additional commands, e-mail: users-h...@httpd.apache.org
>>>
>> 
>> 
>> -
>> To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
>> For additional commands, e-mail: users-h...@httpd.apache.org
>> 
>
>
>-- 
>Rich Bowen - rbo...@rcbowen.com - @rbowen
>http://apachecon.com/ - @apachecon
>
>-
>To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
>For additional commands, e-mail: users-h...@httpd.apache.org
>


-
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org

Re: [users@httpd] Circumstances when mod_php would run faster than PHP-FPM?

[Rose, John B]

The default settings were used for php-fpm.

For event ...


StartServers3
MinSpareThreads 20
MaxSpareThreads 25
ServerLimit 16
ThreadsPerChild 16
MaxRequestWorkers   256
MaxConnectionsPerChild   0



From: Daniel <dferra...@gmail.com<mailto:dferra...@gmail.com>>
Reply-To: "users@httpd.apache.org<mailto:users@httpd.apache.org>" 
<users@httpd.apache.org<mailto:users@httpd.apache.org>>
Date: Tuesday, January 12, 2016 12:00 PM
To: "users@httpd.apache.org<mailto:users@httpd.apache.org>" 
<users@httpd.apache.org<mailto:users@httpd.apache.org>>
Subject: Re: [users@httpd] Circumstances when mod_php would run faster than 
PHP-FPM?

What is the configuration in both cases? php-fpm pool included. How did you 
measure?

El lun., 11 ene. 2016 a las 22:52, Rose, John B 
(<jbr...@utk.edu<mailto:jbr...@utk.edu>>) escribió:
After switching to mod_php from php-fpm we are told the site is working 4x 
faster using mod_php instead of php-fpm.

Any explanation?

Thanks

From: William A Rowe Jr <wr...@rowe-clan.net<mailto:wr...@rowe-clan.net>>
Reply-To: "users@httpd.apache.org<mailto:users@httpd.apache.org>" 
<users@httpd.apache.org<mailto:users@httpd.apache.org>>
Date: Saturday, January 9, 2016 1:58 PM
To: "users@httpd.apache.org<mailto:users@httpd.apache.org>" 
<users@httpd.apache.org<mailto:users@httpd.apache.org>>
Subject: Re: [users@httpd] Circumstances when mod_php would run faster than 
PHP-FPM?


Mod_proxy_fcgi + php-fpm or mod_fcgid with php fcgi sapi should both be 
equivalent when tuned correctly.

Your only option for running php in process efficiently is to use the 
non-threadsafe php in the httpd preform module.  Your only option for running 
httpd efficiently is the event, or at least the worker mpm.

Since usually only a subset of the http requests are to a php resource, the 
answer is almost always 'no'.

On Jan 8, 2016 16:48, "Rose, John B" <jbr...@utk.edu<mailto:jbr...@utk.edu>> 
wrote:
Apache 2.4

On the same system, same web site, are there circumstances when Apache using 
mod_php would run faster than Apache using PHP-FPM?

Thanks

Re: [users@httpd] Circumstances when mod_php would run faster than PHP-FPM?

[Rose, John B]

Can you elaborate on this a bit?

"..the server pool is smaller than Apache's server pool, causing
too much thrashing. (See the pm.min_spare_servers and so on)"



On 1/12/16 12:20 PM, "Rich Bowen" <rbo...@rcbowen.com> wrote:

>
>
>On 01/11/2016 04:51 PM, Rose, John B wrote:
>> After switching to mod_php from php-fpm we are told the site is working
>> 4x faster using mod_php instead of php-fpm.
>> 
>> Any explanation?
>
>
>
>
>
>The cynic in me things that this is a case of old dogs being unwilling
>to learn new tricks.
>
>Other things that come to mind is that fpm is grossly misconfigured -
>perhaps they allocated insufficient memory to it? Or are running it on
>another machine that has a faulty network connection between them? Or
>possibly the server pool is smaller than Apache's server pool, causing
>too much thrashing. (See the pm.min_spare_servers and so on)
>
>
>
>
>> Thanks
>> 
>> From: William A Rowe Jr <wr...@rowe-clan.net
>><mailto:wr...@rowe-clan.net>>
>> Reply-To: "users@httpd.apache.org <mailto:users@httpd.apache.org>"
>> <users@httpd.apache.org <mailto:users@httpd.apache.org>>
>> Date: Saturday, January 9, 2016 1:58 PM
>> To: "users@httpd.apache.org <mailto:users@httpd.apache.org>"
>> <users@httpd.apache.org <mailto:users@httpd.apache.org>>
>> Subject: Re: [users@httpd] Circumstances when mod_php would run faster
>> than PHP-FPM?
>> 
>> Mod_proxy_fcgi + php-fpm or mod_fcgid with php fcgi sapi should both be
>> equivalent when tuned correctly.
>> 
>> Your only option for running php in process efficiently is to use the
>> non-threadsafe php in the httpd preform module.  Your only option for
>> running httpd efficiently is the event, or at least the worker mpm.
>> 
>> Since usually only a subset of the http requests are to a php resource,
>> the answer is almost always 'no'.
>> 
>> On Jan 8, 2016 16:48, "Rose, John B" <jbr...@utk.edu
>> <mailto:jbr...@utk.edu>> wrote:
>> 
>> Apache 2.4
>> 
>> On the same system, same web site, are there circumstances when
>> Apache using mod_php would run faster than Apache using PHP-FPM?
>> 
>> Thanks
>> 
>
>
>-- 
>Rich Bowen - rbo...@rcbowen.com - @rbowen
>http://apachecon.com/ - @apachecon
>
>-
>To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
>For additional commands, e-mail: users-h...@httpd.apache.org
>


-
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org

Re: [users@httpd] Circumstances when mod_php would run faster than PHP-FPM?

[Rose, John B]

So for example using the default "event" mpm values
(http://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/conf/extra/httpd-mp
m.conf.in) below in Apache then PHP-FPM would be the same ...

StartServers 3 -> pm.start_servers = 3
MinSpareThreads 75 -> pm.min_spare_servers = 75
MaxSpareThreads 250 -> pm.max_spare_servers = 250
MaxRequestWorkers 400 -> pm.max_requests = 400

I am not seeing any PHP-FPM equiv settings for ...

ThreadsPerChild 25

MaxConnectionsPerChild   0



Correct?


On 1/12/16 3:41 PM, "Rich Bowen" <rbo...@rcbowen.com> wrote:

>
>
>On 01/12/2016 02:26 PM, Rose, John B wrote:
>> Is there a guide to properly matching your apache and PHP-FPM configs?
>> 
>> Looking here Š
>> 
>> https://wiki.apache.org/httpd/PHP-FPM
>> 
>> 
>I am not seeing that information
>> 
>
>php-fpm is documented in the PHP docs at
>http://php.net/manual/en/install.fpm.php  I'm far from an expert on it,
>but the rule would be that if you're proxing from A to B, then B needs
>to be able to handle as much traffic as A is forwarding to it. So I'd
>expect that what you want is at least as many servers/workers/threads on
>the php-fpm end as you are likely to proxy from the httpd end.
>
>--Rich
>
>> On 1/12/16 2:03 PM, "Rich Bowen" <rbo...@rcbowen.com> wrote:
>> 
>>>
>>>
>>> On 01/12/2016 01:58 PM, Rose, John B wrote:
>>>> Can you elaborate on this a bit?
>>>>
>>>> "..the server pool is smaller than Apache's server pool, causing
>>>> too much thrashing. (See the pm.min_spare_servers and so on)"
>>>
>>>
>>> Sure. The way that php-fpm works is that there's a php-fpm daemon, and
>>> requests for whatever.php are proxypass'ed over to it. So there must be
>>> at least as many threads over on the php-fpm side as you have active
>>> over on the httpd side, or there will be thrash in creating those
>>> threads when the time comes.
>>>
>>> So basically you need to line up the php-fpm config with your httpd
>>> config, or at least have more threads on the fpm side.
>>>
>>> pm.min_spare_servers (and max_spare and start_servers) are php-fpm
>>> configurations, which you'll find somewhere in /etc/php-fpm.d or
>>> whatever your particular distro calls it.
>>>
>>>
>>>>
>>>>
>>>>
>>>> On 1/12/16 12:20 PM, "Rich Bowen" <rbo...@rcbowen.com> wrote:
>>>>
>>>>>
>>>>>
>>>>> On 01/11/2016 04:51 PM, Rose, John B wrote:
>>>>>> After switching to mod_php from php-fpm we are told the site is
>>>>>> working
>>>>>> 4x faster using mod_php instead of php-fpm.
>>>>>>
>>>>>> Any explanation?
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> The cynic in me things that this is a case of old dogs being
>>>>>unwilling
>>>>> to learn new tricks.
>>>>>
>>>>> Other things that come to mind is that fpm is grossly misconfigured -
>>>>> perhaps they allocated insufficient memory to it? Or are running it
>>>>>on
>>>>> another machine that has a faulty network connection between them? Or
>>>>> possibly the server pool is smaller than Apache's server pool,
>>>>>causing
>>>>> too much thrashing. (See the pm.min_spare_servers and so on)
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>> Thanks
>>>>>>
>>>>>> From: William A Rowe Jr <wr...@rowe-clan.net
>>>>>> <mailto:wr...@rowe-clan.net>>
>>>>>> Reply-To: "users@httpd.apache.org <mailto:users@httpd.apache.org>"
>>>>>> <users@httpd.apache.org <mailto:users@httpd.apache.org>>
>>>>>> Date: Saturday, January 9, 2016 1:58 PM
>>>>>> To: "users@httpd.apache.org <mailto:users@httpd.apache.org>"
>>>>>> <users@httpd.apache.org <mailto:users@httpd.apache.org>>
>>>>>> Subject: Re: [users@httpd] Circumstances when mod_php would run
>>>>>>faster
>>>>>> than PHP-FPM?
>>>>>>
>>>>>> Mod_proxy_fcgi + php-fpm or mod_fcgid with php fcgi sapi should both
>>>>>> be
>>>>>> equivalent when tuned correctly.
>>>>>>
>&

Re: [users@httpd] Circumstances when mod_php would run faster than PHP-FPM?

[Rose, John B]

After switching to mod_php from php-fpm we are told the site is working 4x 
faster using mod_php instead of php-fpm.

Any explanation?

Thanks

From: William A Rowe Jr <wr...@rowe-clan.net<mailto:wr...@rowe-clan.net>>
Reply-To: "users@httpd.apache.org<mailto:users@httpd.apache.org>" 
<users@httpd.apache.org<mailto:users@httpd.apache.org>>
Date: Saturday, January 9, 2016 1:58 PM
To: "users@httpd.apache.org<mailto:users@httpd.apache.org>" 
<users@httpd.apache.org<mailto:users@httpd.apache.org>>
Subject: Re: [users@httpd] Circumstances when mod_php would run faster than 
PHP-FPM?


Mod_proxy_fcgi + php-fpm or mod_fcgid with php fcgi sapi should both be 
equivalent when tuned correctly.

Your only option for running php in process efficiently is to use the 
non-threadsafe php in the httpd preform module.  Your only option for running 
httpd efficiently is the event, or at least the worker mpm.

Since usually only a subset of the http requests are to a php resource, the 
answer is almost always 'no'.

On Jan 8, 2016 16:48, "Rose, John B" <jbr...@utk.edu<mailto:jbr...@utk.edu>> 
wrote:
Apache 2.4

On the same system, same web site, are there circumstances when Apache using 
mod_php would run faster than Apache using PHP-FPM?

Thanks

[users@httpd] Circumstances when mod_php would run faster than PHP-FPM?

[Rose, John B]

Apache 2.4

On the same system, same web site, are there circumstances when Apache using 
mod_php would run faster than Apache using PHP-FPM?

Thanks

[users@httpd] proper MPM and mod_php

[Rose, John B]

Apache 2.4
Red Hat Linux

Is using "event" MPM and mod_php ok, or should "prefork" always be used with 
mod_php?

Thanks

Re: [users@httpd] ErrorDocument not read with fcgid

[Rose, John B]

You may want to look at ...

ProxyErrorOverride On


Sent from my iPad

> On Dec 24, 2015, at 11:17 AM, Xavier  wrote:
> 
>> On 24/12/2015 14:12, Luca Toscano wrote:
>> Hi Xavier,
>> 
>> mod_proxy shows a similar behaviour for HTTP error status codes
>> (corrected
>> by https://httpd.apache.org/docs/2.4/mod/mod_proxy.html#proxyerroroverride). 
>> 
>> I believe that when the 403 is generated by fcgi and not by Apache
>> itself then the ErrorDocument is not used to avoid interfering with the
>> response payload. In the mod-proxy case for example you might want to
>> let the backend to return an ad hoc response rather than using Apache's
>> ErrorDocuments, so the "standard" configuration try not to be too
>> invasive (unless explicitly told otherwise by proxyerroroverride). I
>> didn't find any mod_fcgid directive that can help, but you could resolve
>> the issue in two ways:
>> 
>> 1) instructing the fcgi application to return the redirect that you want
>> in case of 403/404 
>> 2) using https://httpd.apache.org/docs/2.4/mod/mod_proxy_fcgi.html and
>> proxyerroroverride
> 
> Thanks Luca,
> 
> (it's for LemonLDAP::NG project). Using the first case, Apache logs may
> store a bad information since we'd like to keep 403 in logs. I will
> propose to the project community to produce a 403 page containing a
> little javascript to redirect, so we'll keep logs and be compatible with
> all FastCGI servers.
> 
> Merry Christmas !!
> 
>> I might be really wrong so if anybody has a better explanation please
>> correct me :)
>> It would be also great to update the documentation of mod_fcgid to
>> include a solution to this problem! (/me is going to do it right after
>> the correct answer is given).
>> 
>> Luca
>> 
>> 
>> 
>> 
>> 
>> 2015-12-23 20:06 GMT+01:00 Xavier > >:
>> 
>>Hi,
>> 
>>When fcgi file returns a 403 error, the error is displayed by Apache
>>without redirection. When an error is detected on other files (missing
>>file in static for example), the redirection acts perfectly.
>> 
>>>On 23/12/2015 17:06, Luca Toscano wrote:
>>> Hi Xavier,
>>> 
>>> what is the exact problem that you are seeing and what are you trying to
>>> achieve? The two error document directives should issue an HTTP redirect
>>> (to auth.example.com 
>>) according
>>> to https://httpd.apache.org/docs/2.4/custom-error.html#configuration,
>>> but given the port number I guess that it is not probably what you want.
>>> 
>>> Luca
>>> 
>>> 
>>> 2015-12-23 8:52 GMT+01:00 Xavier >> 
>>> >>:
>>> 
>>>Hi all,
>>> 
>>>I'm trying to use ErrorDocument directive with mod_fcgid but it is not
>>>interpreted as it works fine for static documents. Here is my
>>>virtualhost conf:
>>> 
>>>
>>>  ErrorDocument 403 http://auth.example.com:19876/?lmError=403
>>>  ErrorDocument 404 http://auth.example.com:19876/?lmError=404
>>>  ServerName manager.example.com 
>>
>>>  LogLevel debug
>>> 
>>>  # Redirect REST request to fcgi
>>>  RewriteEngine on
>>>  RewriteRule "^/$" "/psgi/manager-server.fcgi" [PT]
>>>  RewriteCond "%{REQUEST_FILENAME}"
>>"!^/(?:static|doc|fr-doc|lib).*"
>>>  RewriteRule "^/(.+)$" "/psgi/manager-server.fcgi/$1" [PT]
>>> 
>>>  Alias /psgi/ /home/xavier/dev/lemonldap/e2e-tests/
>>>  
>>>SetHandler fcgid-script
>>>Options +ExecCGI
>>>  
>>>  DocumentRoot
>>/home/xavier/dev/lemonldap/lemonldap-ng-manager/site/
>>>  
>>>Require all granted
>>>Options +FollowSymLinks
>>>  
>>>  >>/home/xavier/dev/lemonldap/lemonldap-ng-manager/site/static/>
>>>Require all granted
>>>Options +FollowSymLinks
>>>  
>>>
>>> 
>>>Regards,
>>>Xavier
>> -
>>>To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
>>
>>>>>
>>>For additional commands, e-mail: users-h...@httpd.apache.org 
>>> 
>>>>>
>> 
>>-
>>To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
>>
>>For additional commands, e-mail: users-h...@httpd.apache.org
>>
> 
> -
> To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
> For additional commands, e-mail: 

[users@httpd] Service Unavailable - proxy_fcgi:error

[Rose, John B]

Apache 2.4
PHP-FPM

It looks like we need to increase the proxy timeout before the ProxyPassMatch 
statement within a virtual host. If I understand correctly, if not specified, 
the proxy timeout is set to the TimeOut value

Is one of these the preferred method?

ProxyTimeOut  somevalue

Or ...


 ProxySet min=0
 ProxySet timeout=somevalue


Or ...

Some other method?

Thanks

Re: [users@httpd] Multiple SSL virtual host PHP translation not working on only one via SSL

[Rose, John B]

We are just trying to load a "hello.php" file at the moment.

We took the virtual host config from vhost2 that works with https and php and 
copied it into vhost1 config. We changed the DocumentRoot to the default, 
restarted Apache and got the same behavior(WSOD) when using ssl, but php 
translation works fine with plain http.

Thanks

From: Daniel <dferra...@gmail.com<mailto:dferra...@gmail.com>>
Reply-To: "users@httpd.apache.org<mailto:users@httpd.apache.org>" 
<users@httpd.apache.org<mailto:users@httpd.apache.org>>
Date: Thursday, December 3, 2015 7:39 AM
To: "<users@httpd.apache.org<mailto:users@httpd.apache.org>>" 
<users@httpd.apache.org<mailto:users@httpd.apache.org>>
Subject: Re: [users@httpd] Multiple SSL virtual host PHP translation not 
working on only one via SSL

wrong path somewhere or invoking an incorrect script.

WSOD:
White Screen Of Death, one of PHP's specialties. It is produced when an error 
has occurred in a PHP script and the error reporting goes either to the error 
log or to nowhere. To solve it, look for the error reporting settings in 
php.ini (or use ini_set()) of fpm pool.. Look or increase logging at the errors 
from the php-fpm.

2015-12-03 1:24 GMT+01:00 Rose, John B <jbr...@utk.edu<mailto:jbr...@utk.edu>>:
Apache 2.4

I have 2 virtual hosts .conf files. Each has a port 80 and port 443 section. 
The config files are identical in every way except for the DocumentRoot.
Both use ProxyPassMatch for PHP-FPM

In vhost1 I can go to http://.../ index.html and index.php successfully. If I 
use SSL I can go to http://  index.html successfully, but when accessing via 
SSL https:/<https://.../index.php>/ index.php the screen is blank

In vhost2 I can go to http:// index.html and index.php successfully, and when I 
go to https:// index.html and index.php come up successfully

I did try changing so they did not have identical ports in ProxyPassMatch

Any ideas why PHP translation would work via regular http but not be executed 
in the first virtual host via SSL connection?

Thanks






--
Daniel Ferradal
IT Specialist

email dferradal at gmail.com<http://gmail.com>
linkedin 
es.linkedin.com/in/danielferradal<http://es.linkedin.com/in/danielferradal>

Re: [users@httpd] Multiple SSL virtual host PHP translation not working on only one via SSL

[Rose, John B]

It looks like the order in which we loaded a couple of config directories in 
httpd.conf was the culprit

Things seem to be working. Thanks for taking the time to read and help

From: georg chambert <georg.chamb...@telia.com<mailto:georg.chamb...@telia.com>>
Reply-To: "users@httpd.apache.org<mailto:users@httpd.apache.org>" 
<users@httpd.apache.org<mailto:users@httpd.apache.org>>
Date: Thursday, December 3, 2015 1:15 PM
To: "users@httpd.apache.org<mailto:users@httpd.apache.org>" 
<users@httpd.apache.org<mailto:users@httpd.apache.org>>
Subject: Re: [users@httpd] Multiple SSL virtual host PHP translation not 
working on only one via SSL


- Original Message -
From:Daniel<mailto:dferra...@gmail.com>
To: <users@httpd.apache.org><mailto:users@httpd.apache.org>>
Sent: Thursday, December 03, 2015 1:39 PM
Subject: Re: [users@httpd] Multiple SSL virtual host PHP translation not 
working on only one via SSL

wrong path somewhere or invoking an incorrect script.

WSOD:
White Screen Of Death, one of PHP's specialties. It is produced when an error 
has occurred in a PHP script and the error reporting goes either to the error 
log or to nowhere. To solve it, look for the error reporting settings in 
php.ini (or use ini_set()) of fpm pool.. Look or increase logging at the errors 
from the php-fpm.

2015-12-03 1:24 GMT+01:00 Rose, John B <jbr...@utk.edu<mailto:jbr...@utk.edu>>:
Apache 2.4

I have 2 virtual hosts .conf files. Each has a port 80 and port 443 section. 
The config files are identical in every way except for the DocumentRoot.
Both use ProxyPassMatch for PHP-FPM

In vhost1 I can go to http://.../ index.html and index.php successfully. If I 
use SSL I can go to http://  index.html successfully, but when accessing via 
SSL https:/<https://.../index.php>/ index.php the screen is blank

In vhost2 I can go to http:// index.html and index.php successfully, and when I 
go to https:// index.html and index.php come up successfully

I did try changing so they did not have identical ports in ProxyPassMatch

Any ideas why PHP translation would work via regular http but not be executed 
in the first virtual host via SSL connection?

Thanks






--
Daniel Ferradal
IT Specialist

email dferradal at gmail.com<http://gmail.com>
linkedin 
es.linkedin.com/in/danielferradal<http://es.linkedin.com/in/danielferradal>

Re: [users@httpd] Multiple SSL virtual host PHP translation not working on only one via SSL

[Rose, John B]

We reversed the order of the "Include" statements

Not clear on the details of why that impacts it in this case but will keep 
looking until we understand

From: John Rose <jbr...@utk.edu<mailto:jbr...@utk.edu>>
Reply-To: "users@httpd.apache.org<mailto:users@httpd.apache.org>" 
<users@httpd.apache.org<mailto:users@httpd.apache.org>>
Date: Thursday, December 3, 2015 2:38 PM
To: "users@httpd.apache.org<mailto:users@httpd.apache.org>" 
<users@httpd.apache.org<mailto:users@httpd.apache.org>>
Subject: Re: [users@httpd] Multiple SSL virtual host PHP translation not 
working on only one via SSL

It looks like the order in which we loaded a couple of config directories in 
httpd.conf was the culprit

Things seem to be working. Thanks for taking the time to read and help

From: georg chambert <georg.chamb...@telia.com<mailto:georg.chamb...@telia.com>>
Reply-To: "users@httpd.apache.org<mailto:users@httpd.apache.org>" 
<users@httpd.apache.org<mailto:users@httpd.apache.org>>
Date: Thursday, December 3, 2015 1:15 PM
To: "users@httpd.apache.org<mailto:users@httpd.apache.org>" 
<users@httpd.apache.org<mailto:users@httpd.apache.org>>
Subject: Re: [users@httpd] Multiple SSL virtual host PHP translation not 
working on only one via SSL


- Original Message -
From:Daniel<mailto:dferra...@gmail.com>
To: <users@httpd.apache.org><mailto:users@httpd.apache.org>>
Sent: Thursday, December 03, 2015 1:39 PM
Subject: Re: [users@httpd] Multiple SSL virtual host PHP translation not 
working on only one via SSL

wrong path somewhere or invoking an incorrect script.

WSOD:
White Screen Of Death, one of PHP's specialties. It is produced when an error 
has occurred in a PHP script and the error reporting goes either to the error 
log or to nowhere. To solve it, look for the error reporting settings in 
php.ini (or use ini_set()) of fpm pool.. Look or increase logging at the errors 
from the php-fpm.

2015-12-03 1:24 GMT+01:00 Rose, John B <jbr...@utk.edu<mailto:jbr...@utk.edu>>:
Apache 2.4

I have 2 virtual hosts .conf files. Each has a port 80 and port 443 section. 
The config files are identical in every way except for the DocumentRoot.
Both use ProxyPassMatch for PHP-FPM

In vhost1 I can go to http://.../ index.html and index.php successfully. If I 
use SSL I can go to http://  index.html successfully, but when accessing via 
SSL https:/<https://.../index.php>/ index.php the screen is blank

In vhost2 I can go to http:// index.html and index.php successfully, and when I 
go to https:// index.html and index.php come up successfully

I did try changing so they did not have identical ports in ProxyPassMatch

Any ideas why PHP translation would work via regular http but not be executed 
in the first virtual host via SSL connection?

Thanks






--
Daniel Ferradal
IT Specialist

email dferradal at gmail.com<http://gmail.com>
linkedin 
es.linkedin.com/in/danielferradal<http://es.linkedin.com/in/danielferradal>

[users@httpd] Multiple SSL virtual host PHP translation not working on only one via SSL

[Rose, John B]

Apache 2.4

I have 2 virtual hosts .conf files. Each has a port 80 and port 443 section. 
The config files are identical in every way except for the DocumentRoot.
Both use ProxyPassMatch for PHP-FPM

In vhost1 I can go to http://.../ index.html and index.php successfully. If I 
use SSL I can go to http://  index.html successfully, but when accessing via 
SSL https:// index.php the screen is blank

In vhost2 I can go to http:// index.html and index.php successfully, and when I 
go to https:// index.html and index.php come up successfully

I did try changing so they did not have identical ports in ProxyPassMatch

Any ideas why PHP translation would work via regular http but not be executed 
in the first virtual host via SSL connection?

Thanks