Tuning the Apache Server: Getting the Most Out of Your httpd

Chris Uriarte <chrisjur@cju.co !

The first line of the Apache Perfomance Notes (http://www.apache.org/docs/misc/perf-tuning.html) says it all: Apache is a general web server, which is designed to be correct first, and fast second . Far too often have I come across busy pache web environments that to use !out of the bo"# configurations. I usually as$ this %uestion to system admins and &I' managers: "uestion: !(hen you install a copy of 'olaris or (indows )T 'erver* do you assume that it+s secure and twea$ed for optimum performance right out of the bo",#. T#pica$ Ans%er: !-f course not.# (ell* then why should pache be any different, In an environment that revolves around the web server* li$e a corporate intranet or a web-hosting networ$* administrators should give as much attention to tuning their web server as they do the operating system it runs on. In this paper* we+ll e"amine some of the tric$s and tips you can ta$e advantage of to get the most out of pache. .efore we get into details* it may be helpful to give a simple overview of how pache wor$s. pache/s startup method is $now as the 0pre-for$0 model* since it spawns* or for$s* a pool of child processes when it starts up (the term for$ is ta$en from the 1)I2 system call* for$()* that is used to create identical child processes of a specific program). If the StartServers directive in your httpd.conf file is set to 34* pache will create 34 child processes upon startup. 5ach child process is used to handle simultaneous client connections to your website. If you have more simultaneous connections than child processes running* pache will spawn additional child servers as needed* up to a limit that you can specify via the MaxClients directive in your httpd.conf. It is important to reali6e that the more 0for$ing0 a server has to do* the greater performance hit the server ta$es* which is why we create spare servers* or children* upon startup. It+s also important to reali6e that the more child servers you have activated* the more memory pache eats up. (e/re going to address how this model re%uires some twea$ing to get the ma"imum performance out of your pache server. Start With Your Hardware It+s no secret that if you want your applications on your wor$station to run faster and more efficiently* the %uic$est and most effective solution is to upgrade your 7 &. 8eople are often wrongly concerned with the speed of their processor* rather than the amount of 7 & they have. fter all* if you have a 8entium III processor running at 944 &:6* but only have ;< &egs or 7 &* your applications are going to slow down very %uic$ly. The same concept applies to pache = if you don+t have enough 7 &* its performance is going to %uic$ly ta$e a nosedive. (hen your 1)I2 system runs out of physical 7 &* it starts to utili6e the system+s swap space. The more and more swap space your system uses* the slower pache will perform. >our overall goal should be to eliminate swapping all together. >ou can accomplish this in a couple of ways. First* and most obvious of all* ma$e sure you have enough 7 & in your system. ?etermining how much 7 & you re%uire may ta$e a little !guestimation#. >ou can start by finding out @ust how much memory each separate pache child process re%uires. >ou can determine this by using a utility li$e top. )ow* determine the amount of MaxClients that are set in your httpd.conf file. The MaxClients directive sets the ma"imum amount of servers that pache can run at one time. If you receive enough hits that re%uire MaxClients servers to be spawned* all additional clients will effectively be loc$ed out of your site until a server process is freed up. 'o* if the number of MaxClients is set to 94 and each httpd child re%uires < &. or memory* they you should have at least 344&. of memory available to pache. 7unning ABI applications also re%uires additional memory each time the ABI is e"ecuted. 'o if you/re running ABIs* it/s probably a good idea to ma$e sure you have an ample amount of memory* above and beyond what the core pache server re%uires.

Tuning the Apache Server: Getting the Most Out of Your httpd Chris Uriarte <chrisjur@cju.co ! & 'ece (er )***

Make Sure Your MaxClients Is Not Set Too High Upgrade or Distribute i You !un "ut o #reathing !oo$ If the MaxClients directive in your httpd.conf is set too high* pache may spawn too many child servers. If pache spawns too many children* your sever may run out of 7 & and start to swap. If you don+t have a terribly busy website* pache+s default setting of 394 is fine. :owever if you set your MaxClients to the ma"imum amount of servers that pache can spawn without swapping and you reach that limit* it+s an indicator that it+s time to upgrade your 7 & or distribute your load across multiple servers. "n %arger Sites& Tweak so$e o the " ten'Ignored Ser(er Settings -+7eilly+s Apache: The Definitive G ide and pache+s Performance T ning Notes both note how MinSpareServers, MaxSpareServers and the StartServers settings used to have a drastic effect on pache performance before version 3.;. :owever* since version 3.; was released* we don+t need to be too concerned with these values. .en and 8eter Caurie note that websites which handle 3 million hits a day wor$ well when MaxSpareServers set to DE* MinSpareServers set to ;< and 'tart'ervers set somewhere in between those two values. If you are running a smaller website* you need not be too concerned with these values. )et !id o *hta++ess ,iles If you have something li$e AllowOverride all in your configuration files* pache will loo$ for a .htaccess file every time a re%uest is made. 1se AllowOverride None in your configuration file and specify your .htaccess directives in your server configuration files* instead. >ou can add something li$e this to your httpd.conf file instead of the usual .htaccess file: <Directory /members> AuthType Basic AuthName members area !e"uire vali# user Auth$ser%iles /usr/local/user&ile </Directory> Turn o DNS Hostna$e %ookups (ith the 3.; release of pache* the 'ostName(oo)ups directive is now turned off by default. If this directive is turned on* pache must do a reverse ?)' loo$up for every client re%uest. This can ta$e a great amount of time* especially on networ$s with slow ?)' servers. The only purpose this feature serves is to record a client/s hostname in your log files* rather than a simple I8 address. .ut if you are really interested in who/s visiting your website* even the free log analysis tools available on the web will do the hostname resolution for you when it comes time to analy6e your log files. Don-t Use ,ollowS.$%inks and S.$%inksI "wnerMat+h If you enable the %ollo*Sym(in)s and Sym(in)s+&,*nerMatch directives* pache will have to do some additional file chec$ing each time a re%uest is made. &any administrators are hesitant to use these directives anyway* since they may open security holes by allowing users to lin$ to files of the web document tree (.i.e. lin$ing to /etc/passwd). Make Your Negotiation More Spe+i i+ The Directory+n#ex directive in your configuration files sets the name of the default file that the server will return for each re%uest to a directory (i.e. a re%uest to http://server.com may return inde".html from the root web directory). >ou have the option of adding a line li$e this to your config files: Directory+n#ex in#ex

This is $now as a 0wildcard0 directive. (hen you specify a wildcard directive* pache has to perform content negotiation on the inde" file it finds. Instead of using wildcard directives you should specify a list of specific file names li$e:
Tuning the Apache Server: Getting the Most Out of Your httpd Chris Uriarte <chrisjur@cju.co ! & 'ece (er )***

Directory+n#ex

in#ex-html in#ex-htm in#ex-c.i in#ex-shtml

To s%uee6e the last bit of performance out of your system* place your most commonly used inde" file first in the list and your least used inde" file last. Trash the /bitHa+k The 2bit:ac$ is an obsolete facility that only e"ists for bac$ward compatibility. 1sing this hac$* a file is parsed for 'erver 'ide Includes if its group e"ecution bit is set. If you+re still using this hac$* get rid of it because it re%uires additional file chec$ing to be e"ecuted on each re%uest. "nl. use the Modules You Need Don-t Use DS" Unless You Ha(e To The more modules you compile into pache* the more memory each server re%uires. (ith the release of version 3.;* you can compile in ?ynamic 'hared -b@ect support* which allows you to add modules without re-compiling the server. ?'- support re%uires significant overhead and increases the amount of memory each child server re%uires. :ere/s a list of some modules that you can get rid of: If you are not familiar with reading the pache status report and don/t thin$ you would use it for debugging or performance evaluations* you can get rid of mo#/status and mo#/in&o. If you don/t want to allow automatic spelling correction* get rid of mo#/spelin. (no* 0speling0 is not misspelled). Ahances are you/ve lived without this feature most of your life on the web* and you can do without it. If you don/t need pro"y support* don/t use compile in libproxy-a. If you are @ust doing straight serving of web pages* or if you don/t $now what a pro"y is* chances are you don/t need this feature. mo#/auth/anon enables anonymous ftp-li$e authentication and is not widely used. Ahances are you don/t need this feature. mo#/auth/#bm and mo#/auth/#b let you use .er$eley ?. files to hold user authentication information. If you don/t plan to use these types of files or if you system does not support ?.& files* you won/t need these modules. mo#/#i.est implements ?igest authentication* which is more secure than .asic authentication* where usernames and passwords are sent to the server in clear te"t. The concept behind ?igest authentication is great* but unfortunately* many versions of popular browsers do not support it. If you are in an environment where you can control the browser being used (corporate intranet,)* you may want to e"plore using ?igest authentication. :owever* it is pretty useless when serving pages over the web. If you/d li$e to chec$ if your browser has ?igest support* chec$ out http://digest-test.agranat.com/testFlist.html. (ithout getting into too much detail* mo#/cern/meta and mo#/example are often not used. Ahances are* you won/t need them. mo#/usertrac) used to be mo#/coo)ies- This module uses )etscape coo$ies to trac$ clic$ trails on your site. >ou may find this option interesting if you are interested in trac$ing a user/s @ourney throughout your website. If you/re not interested in user trac$ing* then this module is not re%uired. It/s important to note that you do not need to compile in this module if you wish to use :TT8 Aoo$ies throughout your site.

Tuning the Apache Server: Getting the Most Out of Your httpd Chris Uriarte <chrisjur@cju.co ! & 'ece (er )***

mo#/uni"ue/i# does not wor$ on all 1)I2 distributions* but may be helpful if you/re using a web application that needs to trac$ user sessions. If this does not sound appealing to you* you don/t need to compile it in. mo#/so is what enables ?'- support. If you are not going to be e"perimenting with modules that need to be added or removed on the fly* you don/t need to enable ?'- support. mo#/hea#ers let/s you set your own custom :TT8 headers in your configuration files. If you/re not interested in this feature* don/t compile it in.

The #ig "ne0 Stop Using C)I ' ,ind a #etter wa. If your site relies on a lot of ABI applications* you/re server is ta$ing a big performance hit. 5very time an e"ternal ABI program is called* the server has to for$ another process. (hen using 8erl for your ABI scripts* your 8erl script and its associated modules have to be compiled and re-compiled every time the ABI program is called. If your site needs to connect to a database* your ABI application must log into the database and create a TA8 session ever! time the ABI program is called. The solution is to crac$ right into the pache 8I by using programs written in A* or programs written in 8erl using modFperl (http://perl.apache.org). >ou can also use Gava servlets in con@unction with pache Gserve (http://@ava.apache.org). 1sing a language li$e 8:8 also helps improve performance because the 8:8 engine is built right into the pache binary (although 8:8 re%uires line-by-line parsing of every .php file). >ou can also get a performance boost by getting rid of server-parsed html files that use 'erver 'ide Includes (''I). 'o how much boost in performance can you get by using an program that ta$es advantage of the pache 8I, (ell* some people have reported a performance boost of E44H - yes E44H. ctually* in our own tests using a script that utili6es the 8erl ?.I database interface pac$age* we saw some performance boosts as high as D44H ll in all* you/ll find that by using some of these easy-to-implement tric$s* you can get the most out of pache/s performance* minimi6e the amount of 7 & pache eats and drastically improve the performance of your web applications.

Tuning the Apache Server: Getting the Most Out of Your httpd Chris Uriarte <chrisjur@cju.co ! & 'ece (er )***