Add virtualhost name to apache logfile

If you have many ServerAlias in some apache VirtualHost and You want to see name of virtualhost in lofgile add  %{host}i to logformat direcive,

for example,

LogFormat "%h %{host}i %l %u %D %T %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined

php performance

strace huge lstat try:
php.ini


; ...
; Determines the size of the realpath cache to be used by PHP. This value should
; be increased on systems where PHP opens many files to reflect the quantity of
; the file operations performed.
realpath_cache_size=1M

; Duration of time, in seconds for which to cache realpath information for a given
; file or directory. For systems with rarely changing files, consider increasing this
; value.
realpath_cache_ttl=300
; ...

[alert] [client 192.168.1.2] /home/www/domains/domain.com/htdocs/.htaccess: AuthType not allowed here


to fix add to config AuthConfig option to AllowOverride directive:




    AllowOverride ....... AuthConfig     ......
     ......

install mod_rpaf with apache-2.4

Apache-2.4 has own module mod_remoteip

"This module is used to treat the useragent which initiated the request as the originating useragent as identified by httpd for the purposes of authorization and logging, even where that useragent is behind a load balancer, front end server, or proxy server."

you may use it with nginx such:


....
    RemoteIPHeader X-Forwarded-For
....

but I found 2 issues for me:

1. I must change LogFormat ( replace %h with %a) to show original IP in logs
2.  /server-status/ page show nginx ip address instead original

So, i deside to use mod_rpaf. Defaut veriosn does not compile with aapche-2.4.
To solve the issue:


 replace  “remote_” with “client_” in “mod_rpaf-2.0.c” 


make it:

apxs -c -n mod_rpaf-2.0.so mod_rpaf-2.0.c

or install

apxs -i  -c -n mod_rpaf-2.0.so mod_rpaf-2.0.c

and use it with apache



    RPAFenable On
    RPAFproxy_ips 127.0.0.1 
    RPAFsethostname On
    RPAFheader X-Forwarded-For

libtool: link: cannot find the library `/usr/local/apr/lib/libexpat.la'

I got this error, when install apache on gentoo linux, rather emere app-admin/apache-tools ends with error:

libtool: link: cannot find the library `/usr/lib64/libexpat.la' or unhandled argument `/usr/lib64/libexpat.la'
make[1]: *** [htpasswd] Помилка 1
make[1]: *** Очікування завершення завдань...
libtool: link: cannot find the library `/usr/lib64/libexpat.la' or unhandled argument `/usr/lib64/libexpat.la'
make[1]: *** [htdigest] Помилка 1
libtool: link: cannot find the library `/usr/lib64/libexpat.la' or unhandled argument `/usr/lib64/libexpat.la'
make[1]: *** [rotatelogs] Помилка 1
make[1]: Залишаю каталог "/var/tmp/portage/app-admin/apache-tools-2.2.22/work/httpd-2.2.22/support"
make: *** [all-recursive] Помилка 1

I found such way to solve this issue:

cd /var/tmp/portage/www-servers/apache-2.2.22-r1/work/httpd-2.2.22/srclib/apr-util/xml/expat/
./configure
# make
# cp libexpat.la /usr/lib/

than, I can emerge apache without problem and errors.

emerg] (28)No space left on device: Couldn't create accept lock (/var/lock/apache2/accept.lock)

if you can't start apache and see this error in apache error.log:

[emerg] (28)No space left on device: Couldn't create accept lock (/var/lock/apache2/accept.lock.11955) (5)

may be several ways making:

• you exceeded your disk limit.. see df -h to watch free space on disk ( /var partiotion )

if you out of disk space free some space in /var  to start apace

• Check for semaphore-arrays owned by your apache-user ( www-data  or  apache ...)

# ipcs -s | grep www-data  

( where, www-data - apace user )

if you see there some process, you should remove  the semaphores. It  should immediately solve the problem.

# for semid in `ipcs -s | grep www-data | cut -f2 -d” “`; do ipcrm -s $semid; doneipcs -s | grep www-data | awk '{ print $2 }' | xrags ipcrm sem

•  you can increase sysctl paramert kernel.sem 

kernel.sem  = 250 32000 100 256 

find apache slow query

if you have troubles with apache web server  you can try to find slow http-query. it can  be done using apace logs.
first, you must create specail log format (we  name it 'debug')


in you config file add such line (in debian /etc/apache2/httpd.conf):

LogFormat "%h %D %T %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" debug

where,

Format String	Description
%T	The time taken to serve the request, in seconds.
%D	The time taken to serve the request, in microseconds.

then you can use it format in your www.site config file , for example:

CustomLog /var/log/apache2/www.site-access.log debug

and now apache will write to log file the time taken to serve the request, in microseconds. So you can using cat, awk, tail and other shell command find "slow" query...

for example, find query than take more than 2 second:

# cat /var/log/apache2/www.site-access.log  | awk ' { if($3 > 2)  print $_ }'

Also useful:

The characteristics of the request itself are logged by placing "%" directives in the format string, which are replaced in the log file by the values as follows:

Format String	Description
%%	The percent sign
%a	Remote IP-address
%A	Local IP-address
%B	Size of response in bytes, excluding HTTP headers.
%b	Size of response in bytes, excluding HTTP headers. In CLF format, i.e. a '-' rather than a 0 when no bytes are sent.
%{Foobar}C	The contents of cookie Foobar in the request sent to the server. Only version 0 cookies are fully supported.
%D	The time taken to serve the request, in microseconds.
%{FOOBAR}e	The contents of the environment variable FOOBAR
%f	Filename
%h	Remote host
%H	The request protocol
%{Foobar}i	The contents of Foobar: header line(s) in the request sent to the server. Changes made by other modules (e.g. mod_headers) affect this.
%k	Number of keepalive requests handled on this connection. Interesting if KeepAlive is being used, so that, for example, a '1' means the first keepalive request after the initial one, '2' the second, etc...; otherwise this is always 0 (indicating the initial request). Available in versions 2.2.11 and later.
%l	Remote logname (from identd, if supplied). This will return a dash unless mod_ident is present and IdentityCheck is set On.
%m	The request method
%{Foobar}n	The contents of note Foobar from another module.
%{Foobar}o	The contents of Foobar: header line(s) in the reply.
%p	The canonical port of the server serving the request
%{format}p	The canonical port of the server serving the request or the server's actual port or the client's actual port. Valid formats are canonical, local, or remote.
%P	The process ID of the child that serviced the request.
%{format}P	The process ID or thread id of the child that serviced the request. Valid formats are pid, tid, and hextid. hextid requires APR 1.2.0 or higher.
%q	The query string (prepended with a ? if a query string exists, otherwise an empty string)
%r	First line of request
%R	The handler generating the response (if any).
%s	Status. For requests that got internally redirected, this is the status of the *original* request --- %>s for the last.
%t	Time the request was received (standard english format)
%{format}t	The time, in the form given by format, which should be in strftime(3) format. (potentially localized)
%T	The time taken to serve the request, in seconds.
%u	Remote user (from auth; may be bogus if return status (%s) is 401)
%U	The URL path requested, not including any query string.
%v	The canonical ServerName of the server serving the request.
%V	The server name according to the UseCanonicalName setting.
%X	Connection status when response is completed: X = connection aborted before the response completed. + = connection may be kept alive after the response is sent. - = connection will be closed after the response is sent. (This directive was %c in late versions of Apache 1.3, but this conflicted with the historical ssl %{var}c syntax.)
%I	Bytes received, including request and headers, cannot be zero. You need to enable mod_logio to use this.
%O	Bytes sent, including headers, cannot be zero. You need to enable mod_logio to use this.

apache mod_performance

модуль для apache, який допомагає оцінити навантаження
http://www.opennet.ru/base/sys/apache_mod_performance.txt.html


http://lexvit.dn.ua/articles/?art_id=mod_performance117_mht201104302312

ALERT - configured request variable limit exceeded - dropped variable

ALERT - configured request variable limit exceeded - dropped variable

треба збільшими ліміти, а саме

php_admin_value suhosin.request.max_vars
php_admin_value suhosin.post.max_vars

an unknown filter was not added: includes

Пісял встановлення apache на ubuntu-10.04 в логах an unknown filter was not added: includes почали сипатися сповіщення про пимилку:

[Sun Sep 19 06:32:15 2010] [error] an unknown filter was not added: includes
[Sun Sep 19 06:32:16 2010] [error] an unknown filter was not added: includes
[Sun Sep 19 06:32:16 2010] [error] an unknown filter was not added: includes

як виявилося по замовчуванню був відключений модуль include
для того, щоб його включити виконуємо команду

a2enmod include 

і рестрартуєм apache:
/etc/init.d/apache2 restart (або reload)

how to generate ssl sertificate for apache or nginx

How do I create a self-signed SSL Certificate for testing purposes?

1. Make sure OpenSSL is installed and in your PATH.

2. Run the following command, to create server.key and server.crt files:
$ openssl req -new -x509 -nodes -out server.crt -keyout server.key
These can be used as follows in your httpd.conf file:

SSLCertificateFile /path/to/this/server.crt
SSLCertificateKeyFile /path/to/this/server.key


3. It is important that you are aware that this server.key does not have any passphrase. To add a passphrase to the key, you should run the following command, and enter & verify the passphrase as requested.

$ openssl rsa -des3 -in server.key -out server.key.new
$ mv server.key.new server.key

Please backup the server.key file, and the passphrase you entered, in a secure location.


2-nd method:

Generate a private key:

openssl genrsa -des3 -out www.domain.com.ssl.key 1024

Create a CSR:

openssl req -new -key www.domain.com.ssl.key -out www.domain.com.ssl.csr
*note: enter full domain (www.domain.com) for CN (common name)*

Remove password from private key (optional):

openssl rsa -in www.domain.com.ssl.key -out www.domain.com.ssl.key.nopass

Generate self-signed cert:

openssl x509 -req -days 365 -in www.domain.com.ssl.csr -signkey
www.domain.com.ssl.key -out www.domain.com.ssl.crt
*note: use .nopass if you removed the password from the private key*

Hope that helps. I'm not sure about generating a wildcard cert.

коды в HTTP-ответе веб-сервера

Что означают коды в HTTP-ответе веб-сервера

Коды ответа четко сгруппированы по нескольким основным разделам:

* Информационныe 100 — Продолжить
* 101 — Переключение протоколов

* Запрос клиента успешен 200 — OK
* 201 — Создан
* 202 — Принято
* 203 — Не авторская информация
* 204 — Нет содержимого
* 205 — Сбросить содержимое
* 206 — Частичное содержимое

* Запрос клиента переадресован, необходимы дальнейшие действия 300 — Множественный выбор
* 301 — Перемещен навсегда
* 302 — Найден
* 303 — Смотреть другой
* 304 — Не модифицирован
* 305 — Использовать прокси-сервер
* 307 — Временно переадресован

* Запрос клиента является неполным 400 — Неправильный запрос
* 401 — Несанкционированно
* 402 — Требуется оплата
* 403 — Запрещено
* 404 — Не найдено
* 405 — Метод запрещен
* 406 — Не приемлем
* 407 — Требуется аутентификация через прокси-сервер
* 408 — Истекло время ожидания запроса
* 409 — Конфликт
* 410 — Недоступен
* 411 — Требуется длина
* 412 — Предусловие неверно
* 413 — Объект запроса слишком большой
* 414 — URI запроса слишком длинный
* 415 — Неподдерживаемый тип медиа
* 416 — Диапазон запроса неудовлетворителен
* 417 — Ожидание неуспешно

* Ошибки сервера 500 - Внутреннняя ошибка веб-сервера
* 501 - Not Implemented
* 502 - Bad Gateway
* 503 - Сервис недоступен
* 504 - Таймаут, Gateway Timeout
* 505 - Версия протокола HTTP не поддерживается