httpd -DNOHTTPACCEPT

[starbuck]

Hey all,

I'm running several apache/php jails and they seem to be working fine, but when I run ps -auwx I see this weird flag next to httpd:

[root@cardoffice /]# ps -aux 
USER    PID %CPU %MEM   VSZ   RSS  TT  STAT STARTED      TIME COMMAND
root   2982  0.0  0.0  3156  1196  ??  IsJ  Thu05PM   0:00.26 /usr/sbin/syslogd -s
root   3045  0.0  0.4 55212 14280  ??  SsJ  Thu05PM   0:02.32 /usr/local/sbin/httpd -DNOHTTPACCEPT
root   3053  0.0  0.1  5616  3436  ??  IsJ  Thu05PM   0:00.00 /usr/sbin/sshd
root   3059  0.0  0.1  5848  3504  ??  SsJ  Thu05PM   0:01.53 sendmail: accepting connections (sendmail)
smmsp  3063  0.0  0.1  5848  3268  ??  IsJ  Thu05PM   0:00.04 sendmail: Queue runner@00:30:00 for /var/spool/clientm
root   3069  0.0  0.0  3184  1256  ??  IsJ  Thu05PM   0:00.38 /usr/sbin/cron -s
www    3176  0.0  0.4 55212 14928  ??  IJ   Thu05PM   0:00.01 /usr/local/sbin/httpd -DNOHTTPACCEPT
www    3178  0.0  0.4 55212 14948  ??  IJ   Thu05PM   0:00.01 /usr/local/sbin/httpd -DNOHTTPACCEPT
www    3179  0.0  0.4 55212 14824  ??  IJ   Thu05PM   0:00.01 /usr/local/sbin/httpd -DNOHTTPACCEPT
www    3180  0.0  0.4 55212 14868  ??  IJ   Thu05PM   0:00.01 /usr/local/sbin/httpd -DNOHTTPACCEPT
www    3182  0.0  0.4 55212 14980  ??  IJ   Thu05PM   0:00.01 /usr/local/sbin/httpd -DNOHTTPACCEPT
www   44145  0.0  0.4 55212 14900  ??  IJ   Fri03PM   0:00.01 /usr/local/sbin/httpd -DNOHTTPACCEPT
www   44146  0.0  0.4 55212 14976  ??  IJ   Fri03PM   0:00.01 /usr/local/sbin/httpd -DNOHTTPACCEPT
www   44147  0.0  0.4 55212 14872  ??  IJ   Fri03PM   0:00.01 /usr/local/sbin/httpd -DNOHTTPACCEPT
root  11835  0.0  0.1  4388  2264  p0  SJ    5:35PM   0:00.01 /usr/local/bin/bash
root  11914  0.0  0.0  3220   992  p0  R+J   5:41PM   0:00.00 ps -aux

I did some googling, but didn't find a solid answer. Anyone have a good idea what this might mean?

[Carpetsmoker]

Anything in the error log?

[starbuck]

Originally Posted by Carpetsmoker

Anything in the error log?

Hrmm... This is interesting. There is a ton of these warnings in the log:

[Mon Aug 11 01:34:13 2008] [warn] (61)Connection refused: connect to listener on 0.0.0.0:80

I'm not sure what Apache's hinting at there.

Here is the tail of the log:

[Mon Aug 11 14:16:29 2008] [notice] SIGHUP received.  Attempting to restart
[Mon Aug 11 14:16:30 2008] [notice] Digest: generating secret for digest authentication ...
[Mon Aug 11 14:16:30 2008] [notice] Digest: done
[Mon Aug 11 14:16:30 2008] [notice] Apache/2.2.9 (FreeBSD) mod_ssl/2.2.9 OpenSSL/0.9.8e DAV/2 PHP/5.2.6 with Suhosin-Patch configured -- resuming normal operations
[Mon Aug 11 14:23:30 2008] [error] [client 10.0.0.1] File does not exist: /usr/local/www/apache22/data/robots.txt
[Mon Aug 11 14:29:26 2008] [notice] SIGHUP received.  Attempting to restart
(48)Address already in use: make_sock: could not bind to address 10.0.0.102:80
no listening sockets available, shutting down
Unable to open logs
[Mon Aug 11 14:29:44 2008] [warn] Init: Session Cache is not configured [hint: SSLSessionCache]
[Mon Aug 11 14:29:44 2008] [notice] Digest: generating secret for digest authentication ...
[Mon Aug 11 14:29:44 2008] [notice] Digest: done
[Mon Aug 11 14:29:44 2008] [warn] pid file /var/run/httpd.pid overwritten -- Unclean shutdown of previous Apache run?
[Mon Aug 11 14:29:44 2008] [notice] Apache/2.2.9 (FreeBSD) mod_ssl/2.2.9 OpenSSL/0.9.8e DAV/2 PHP/5.2.6 with Suhosin-Patch configured -- resuming normal operations
[Mon Aug 11 14:30:24 2008] [notice] SIGHUP received.  Attempting to restart
(48)Address already in use: make_sock: could not bind to address 0.0.0.0:80
no listening sockets available, shutting down
Unable to open logs
[Mon Aug 11 14:31:31 2008] [warn] Init: Session Cache is not configured [hint: SSLSessionCache]
[Mon Aug 11 14:31:31 2008] [notice] Digest: generating secret for digest authentication ...
[Mon Aug 11 14:31:31 2008] [notice] Digest: done
[Mon Aug 11 14:31:31 2008] [warn] pid file /var/run/httpd.pid overwritten -- Unclean shutdown of previous Apache run?
[Mon Aug 11 14:31:31 2008] [notice] Apache/2.2.9 (FreeBSD) mod_ssl/2.2.9 OpenSSL/0.9.8e DAV/2 PHP/5.2.6 with Suhosin-Patch configured -- r
esuming normal operations
[Mon Aug 11 14:32:25 2008] [notice] caught SIGTERM, shutting down
[Mon Aug 11 14:32:31 2008] [warn] Init: Session Cache is not configured [hint: SSLSessionCache]
[Mon Aug 11 14:32:31 2008] [notice] Digest: generating secret for digest authentication ...
[Mon Aug 11 14:32:31 2008] [notice] Digest: done
[Mon Aug 11 14:32:31 2008] [notice] Apache/2.2.9 (FreeBSD) mod_ssl/2.2.9 OpenSSL/0.9.8e DAV/2 PHP/5.2.6 with Suhosin-Patch configured -- r
esuming normal operations
[Mon Aug 11 17:35:59 2008] [error] [client 10.0.0.1] File does not exist: /usr/local/www/apache22/data/favicon.ico

[Carpetsmoker]

Looks like some other programs already bind to port 80 ... You can check with:
% sockstat -4

[starbuck]

Here is my sockstat -4 output:

[tristan@emulan ~]$ sockstat -4
USER     COMMAND    PID   FD PROTO  LOCAL ADDRESS         FOREIGN ADDRESS      
tristan  sshd       14431 3  tcp4   10.0.0.102:22         10.0.0.1:63349
root     sshd       14428 3  tcp4   10.0.0.102:22         10.0.0.1:63349
www      httpd      6626  3  tcp4   10.0.0.102:80         *:*
www      httpd      6625  3  tcp4   10.0.0.102:80         *:*
www      httpd      6624  3  tcp4   10.0.0.102:80         *:*
www      httpd      6620  3  tcp4   10.0.0.102:80         *:*
www      httpd      6351  3  tcp4   10.0.0.102:80         *:*
www      httpd      6348  3  tcp4   10.0.0.102:80         *:*
www      httpd      6347  3  tcp4   10.0.0.102:80         *:*
www      httpd      6346  3  tcp4   10.0.0.102:80         *:*
www      httpd      6345  3  tcp4   10.0.0.102:80         *:*
www      httpd      6344  3  tcp4   10.0.0.102:80         *:*
root     sendmail   6313  3  tcp4   10.0.0.102:25         *:*
root     sshd       6307  3  tcp4   10.0.0.102:22         *:*
root     httpd      6299  3  tcp4   10.0.0.102:80         *:*
root     syslogd    6241  6  udp4   10.0.0.102:514        *:*

The only thing I see is an httpd process from root and www. Is it possible that two apache processes are trying to bind to the same port?

[Weaseal]

-DNOHTTPACCEPT is, as far as I know, normal and standard. Mine has said that for years and everything is working fine.
Edit:Here's the first hit from googling that flag:

http://lists.svlug.org/archives/svlu...ch/028303.html

As soon as I looked at the error_log file I saw a
mis-config in an .htaccess file they had copied
from another directory without looking in it to
see what password file it was using, hence the
server error.

Interestingly, correcting that alone got rid of
-DNOHTTPACCEPT from the httpd instances, and all
is working well again.

[ddekok]

The -DNOHTTPACCEPT disables an AcceptFilter. It is a kernel module for, IIRC, having the kernel accept the connection before handing it off to Apache (a speed optimization).

http://wiki.finger.dk/index.php/Apache/Install and the article linked to in the last sentence may give you a bit more information.

[starbuck]

Originally Posted by ddekok

The -DNOHTTPACCEPT disables an AcceptFilter. It is a kernel module for, IIRC, having the kernel accept the connection before handing it off to Apache (a speed optimization).

http://wiki.finger.dk/index.php/Apache/Install and the article linked to in the last sentence may give you a bit more information.

Okay, so I'm guessing that when I first built our jails the host system wasn't configured to load the accf_http module:

[root@HOST/usr/home/tristan]# kldload accf_http
kldload: can't load accf_http: File exists

[root@HOST/usr/home/tristan]# locate accf_http
/boot/kernel/accf_http.ko
/boot/kernel/accf_http.ko.symbols
/usr/obj/usr/src/share/man/man9/accf_http.9.gz
/usr/share/man/man9/accf_http.9.gz
/usr/src/share/man/man9/accf_http.9
/usr/src/sys/modules/accf_http
/usr/src/sys/modules/accf_http/Makefile
/usr/src/sys/netinet/accf_http.c

As you can see it looks like it's loaded on the host system now but it's not in any of the jails.

[root@JAIL /]# kldload accf_http
kldload: can't load accf_http: Operation not permitted

So, I'm using ezjail. If I'm on the right track, then I just need to run ezjail-admin update to run make world and update the basejail?

What do you guys think? Thanks for all the help too!

Here's some more references on accf_http:

http://httpd.apache.org/docs/2.2/mod/core.html
http://www.freebsd.org/cgi/man.cgi?q...http&sektion=9

[coppermine]

I've had similar problem until I came up to good book "Building a server with FreeBSD 7". I found there a line to be included in rc.conf:

apache22_http_accept_enable="YES"

And at least for me, the -DNOHTTPACCEPT flag went away from htop output...

[windependence]

The conflict with :80 looks like a misconfigured virtual host directive to me.

-Tim