You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@httpd.apache.org by Mike -- EMAIL IGNORED <m_...@yahoo.com> on 2009/08/04 17:05:25 UTC

[users@httpd] Re: excessive dns slows httpd

On Tue, 04 Aug 2009 08:22:14 +0200, André Warnier wrote:

[...]
>> 
> You could first check the obvious, such as whether in your Apache/Centos
> config, you are not *asking* the server to do these DNS lookups. Look
> here for instance :
> http://httpd.apache.org/docs/2.2/mod/mod_log_config.html#formats (I mean
> that if your are asking Apache to log the *name* of the client in the
> access log for instance, then it has to do a lookup) Any time, anywhere,
> where Apache, for whatever reason, has to translate an IP address into a
> name or vice-versa, may result in this behaviour.
> 
[...]

In LogFormat, I changed %h to %a, which hat no effect.  I did "solve"
the problem by completely blocking DNS in iptables.  As it happens,
in my present configuration, this is not a problem, but I would hardly
call it a satisfactory solution.  Remember, the httpd.config works
without problem on a neighboring box (with a different OS).

Mike.


---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: [users@httpd] Re: excessive dns slows httpd

Posted by André Warnier <aw...@ice-sa.com>.

André Warnier wrote:
> Mark H. Wood wrote:
>> Local DNS cache of some sort on the Fedora box?  Some of my hosts run
>> 'nscd' (which comes with glibc) and some run BIND in cache-only mode.
>>
> That's also, I believe, what a local "dnsmasq" would do.  But in order 
> for the local Apache to use it, you'd have to set 127.0.0.1 as a 
> resolver in /etc/resolv.conf, which apparently is not the case here.
> 
> To get back to the basic issue..
> We seem to have, on the same host
> - an "old" Apache configuration, which does not trigger client DNS names 
> lookups
> - a "new" Apache configuration, which does
> Yes ?
> 
> So I guess we can exclude for the time being the possibility that it 
> might be something else than Apache which does the lookups (I was 
> thinking of denyhosts or the like).
> 
> Next obvious question : what's the difference between the old and new 
> configurations ? (sorry if that was explained before, I did not get back 
> to the archives).
> Do I vaguely remember it had something to do with SSL, or was that 
> another thread ?
> 

Add-on : I guess something else that could trigger lookups, are 
Allow/Deny directives, if you have things like "Allow from .domain.com".
Or, let's be fancy : some nice little thingy that displays in shapes and 
colors the accesses by domains, or some sophisticated SSI include which 
somehow does a lookup of the client...
As someone else mentioned, without having a real peek at your full 
configuration, its a bit tedious to make guesses.

If it is about SSL - not my domain at all - then maybe someone else 
could tell us what kind of SSL configuration could trigger a client name 
lookup ? (I would imagine that the use of client certs does).

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: [users@httpd] Re: excessive dns slows httpd

Posted by André Warnier <aw...@ice-sa.com>.

Mark H. Wood wrote:
> Local DNS cache of some sort on the Fedora box?  Some of my hosts run
> 'nscd' (which comes with glibc) and some run BIND in cache-only mode.
> 
That's also, I believe, what a local "dnsmasq" would do.  But in order 
for the local Apache to use it, you'd have to set 127.0.0.1 as a 
resolver in /etc/resolv.conf, which apparently is not the case here.

To get back to the basic issue..
We seem to have, on the same host
- an "old" Apache configuration, which does not trigger client DNS names 
lookups
- a "new" Apache configuration, which does
Yes ?

So I guess we can exclude for the time being the possibility that it 
might be something else than Apache which does the lookups (I was 
thinking of denyhosts or the like).

Next obvious question : what's the difference between the old and new 
configurations ? (sorry if that was explained before, I did not get back 
to the archives).
Do I vaguely remember it had something to do with SSL, or was that 
another thread ?

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org