深海游弋的鱼 – 默默的点滴

ubuntu 18.04 Apache2启用HTTP/2

HTTP/2 可以让我们的应用更快、更简单、更稳定 – 这几词凑到一块是很罕见的！HTTP/2 将很多以前我们在应用中针对 HTTP/1.1 想出来的“歪招儿”一笔勾销，把解决那些问题的方案内置在了传输层中。不仅如此，它还为我们进一步优化应用和提升性能提供了全新的机会！

——《Web 性能权威指南》

Ubuntu18.04 官方源已经包含带有HTTP2模块的 Apache/2.4.29 ，所以我们可以很简单的启用 HTTP2。

$ sudo a2enmod http2

1	$ sudo a2enmod http2

首先启用 http2 模块，然后在虚拟主机的配置文件中或者在Apache2的全局配置文件中加入：

Protocols h2 http/1.1

1	Protocols h2 http/1.1

当客户端支持时优先使用 HTTP2 ，其次是 http/1.1，表明了一种优先顺序。目前为止就已经启用完成了，但如果你是使用的 Apache2+PHP 架构的应用程序，由于 mpm_prefork 模块不支持 mod_http2，所以我们需要切换 mpm_prefork、mod_php 到 mpm_event 和 php-fpm 来解决这个问题。

# Install php-fpm and enable
$ sudo apt install php-fpm

$ sudo systemctl enable php7.2-fpm

# To enable PHP 7.2 FPM in Apache2
$ sudo a2enmod proxy_fcgi setenvif

$ sudo a2enconf php7.2-fpm

# First to disable PHP 7.2/ mpm_prefork to avoid conflicts,then enable.
$ sudo a2dismod php7.2 mpm_prefork

$ sudo a2enmod mpm_event

# Install php-fpm and enable

$ sudo apt install php-fpm

$ sudo systemctl enable php7.2-fpm

# To enable PHP 7.2 FPM in Apache2

$ sudo a2enmod proxy_fcgi setenvif

$ sudo a2enconf php7.2-fpm

# First to disable PHP 7.2/ mpm_prefork to avoid conflicts,then enable.

$ sudo a2dismod php7.2 mpm_prefork

$ sudo a2enmod mpm_event

继续阅读ubuntu 18.04 Apache2启用HTTP/2

Indicate whether to send a cookie in a cross-site request by specifying its SameSite attribute

最近在浏览器（Chrome 85.0.4183.121）调试网页的时候，出现如下警告信息:

Indicate whether to send a cookie in a cross-site request by specifying its SameSite attribute
Because a cookie's SameSite attribute was not set or is invalid, it defaults to SameSite=Lax, which prevents the cookie from being sent in a cross-site request. This behavior protects user data from accidentally leaking to third parties and cross-site request forgery.

Resolve this issue by updating the attributes of the cookie:
Specify SameSite=None and Secure if the cookie should be sent in cross-site requests. This enables third-party use.
Specify SameSite=Strict or SameSite=Lax if the cookie should not be sent in cross-site requests

22 cookies
3 requests
Learn more: SameSite cookies explained

Indicate whether to send a cookie in a cross-site request by specifying its SameSite attribute

Because a cookie's SameSite attribute was not set or is invalid, it defaults to SameSite=Lax, which prevents the cookie from being sent in a cross-site request. This behavior protects user data from accidentally leaking to third parties and cross-site request forgery.

Resolve this issue by updating the attributes of the cookie:

Specify SameSite=None and Secure if the cookie should be sent in cross-site requests. This enables third-party use.

Specify SameSite=Strict or SameSite=Lax if the cookie should not be sent in cross-site requests

22 cookies

3 requests

Learn more: SameSite cookies explained

继续阅读Indicate whether to send a cookie in a cross-site request by specifying its SameSite attribute

apache日志中的中文如何显示？

apache日志记录的中文，是内码如下：

\xb6\xd4\xb6\xc0\xc1\xa2\xd1\xa7\xd4\xba\xbf\xc9\xb3\xd6\xd0\xf8\xb7\xa2\xd5\xb9\xce\xca\xcc\xe2

1	\xb6\xd4\xb6\xc0\xc1\xa2\xd1\xa7\xd4\xba\xbf\xc9\xb3\xd6\xd0\xf8\xb7\xa2\xd5\xb9\xce\xca\xcc\xe2

编码后中文是：

对独立学院可持续发展问题

1	对独立学院可持续发展问题

完全看不懂是什么意思，如何解析出里面的中文出来呢？

php参考如下代码：

<?php
  $str="\xb6\xd4\xb6\xc0\xc1\xa2\xd1\xa7\xd4\xba\xbf\xc9\xb3\xd6\xd0\xf8\xb7\xa2\xd5\xb9\xce\xca\xcc\xe2";
  eval("\$str = \"$str\";");
  echo iconv('GB2312','UTF-8',$str."\n");
?>

<?php

$str="\xb6\xd4\xb6\xc0\xc1\xa2\xd1\xa7\xd4\xba\xbf\xc9\xb3\xd6\xd0\xf8\xb7\xa2\xd5\xb9\xce\xca\xcc\xe2";

eval("\$str = \"$str\";");

echo iconv('GB2312','UTF-8',$str."\n");

golang参考如下代码：

import (
    "fmt"
    "log"
    "os"
    "code.google.com/p/mahonia"
)
func main() {
    var use_logfile bool
    use_logfile = true
    f, err := os.OpenFile("testlogfile", os.O_RDWR|os.O_CREATE|os.O_APPEND, 0666)
    if err != nil {
        log.Fatalf("error opening file: %v", err)
    }
    defer f.Close()
    if use_logfile {
        log.SetOutput(f)
    }
    s := "\xb6\xd4\xb6\xc0\xc1\xa2\xd1\xa7\xd4\xba\xbf\xc9\xb3\xd6\xd0\xf8\xb7\xa2\xd5\xb9\xce\xca\xcc\xe2"
    enc := mahonia.NewDecoder("UTF-8")
    x := enc.ConvertString(s)
    gbk := mahonia.NewDecoder("gbk")
    n := gbk.ConvertString(s)
    log.Printf("file:", x, n)
    fmt.Println(x, n)
}

import (

"fmt"

"log"

"os"

"code.google.com/p/mahonia"

)

func main() {

var use_logfile bool

use_logfile = true

f, err := os.OpenFile("testlogfile", os.O_RDWR|os.O_CREATE|os.O_APPEND, 0666)

if err != nil {

log.Fatalf("error opening file: %v", err)

}

defer f.Close()

if use_logfile {

log.SetOutput(f)

}

s := "\xb6\xd4\xb6\xc0\xc1\xa2\xd1\xa7\xd4\xba\xbf\xc9\xb3\xd6\xd0\xf8\xb7\xa2\xd5\xb9\xce\xca\xcc\xe2"

enc := mahonia.NewDecoder("UTF-8")

x := enc.ConvertString(s)

gbk := mahonia.NewDecoder("gbk")

n := gbk.ConvertString(s)

log.Printf("file:", x, n)

fmt.Println(x, n)

}

java参考如下代码：

import java.io.UnsupportedEncodingException;
import java.net.URLDecoder;
import java.nio.ByteBuffer;
import java.nio.CharBuffer;
import java.nio.charset.StandardCharsets;


public class HelloWorld {
    private static String unescapeGBK(final String s) {
        final StringBuilder buf = new StringBuilder();
        int i = 0;
        int len = s.length();
        while (i < len) {
            int ch = s.charAt(i);
            if (ch == '\\') {
                // \xXX\xXX : map to unicode(XXXX)
                int c = (char) ((Character.digit(s.charAt(i + 2), 16) << 4)
                        + Character.digit(s.charAt(i + 3), 16));
                c = c << 8;
                c += (char) ((Character.digit(s.charAt(i + 6), 16) << 4)
                        + Character.digit(s.charAt(i + 7), 16));

                buf.append((char) c);
                i += 7;
            } else {
                buf.append((char) ch);
            }
            i++;
        }
        return buf.toString();
    }

    public static void main(String args[]) throws UnsupportedEncodingException {
        // UTF-8
        String coderStr = "\\x22\\xE5\\x93\\x88\\xE5\\x93\\x88\\x22";
        String str = coderStr.replaceAll("\\\\x", "%");
        str = URLDecoder.decode(str, StandardCharsets.UTF_8.toString());
        System.out.println(str);
        // GBK
        coderStr = "\\xb6\\xd4\\xb6\\xc0\\xc1\\xa2\\xd1\\xa7\\xd4\\xba\\xbf\\xc9\\xb3\\xd6\\xd0\\xf8\\xb7\\xa2\\xd5\\xb9\\xce\\xca\\xcc\\xe2";
        str = getApacheChineseGBK(coderStr);
        System.out.println(str);
    }

    public static String getApacheChineseGBK(String str) throws UnsupportedEncodingException {
        str = str.trim().toLowerCase();
        str = unescapeGBK(str);
        final ByteBuffer byteBuffer = ByteBuffer.allocate(str.length() * Character.SIZE / Byte.SIZE);
        final CharBuffer converter = byteBuffer.asCharBuffer();
        converter.append(CharBuffer.wrap(str));
        str = new String(byteBuffer.array(), "GBK");
        return str;
    }
}

import java.io.UnsupportedEncodingException;

import java.net.URLDecoder;

import java.nio.ByteBuffer;

import java.nio.CharBuffer;

import java.nio.charset.StandardCharsets;

public class HelloWorld {

private static String unescapeGBK(final String s) {

final StringBuilder buf = new StringBuilder();

int i = 0;

int len = s.length();

while (i < len) {

int ch = s.charAt(i);

if (ch == '\\') {

// \xXX\xXX : map to unicode(XXXX)

int c = (char) ((Character.digit(s.charAt(i + 2), 16) << 4)

+ Character.digit(s.charAt(i + 3), 16));

c = c << 8;

c += (char) ((Character.digit(s.charAt(i + 6), 16) << 4)

+ Character.digit(s.charAt(i + 7), 16));

buf.append((char) c);

i += 7;

} else {

buf.append((char) ch);

}

i++;

}

return buf.toString();

}

public static void main(String args[]) throws UnsupportedEncodingException {

// UTF-8

String coderStr = "\\x22\\xE5\\x93\\x88\\xE5\\x93\\x88\\x22";

String str = coderStr.replaceAll("\\\\x", "%");

str = URLDecoder.decode(str, StandardCharsets.UTF_8.toString());

System.out.println(str);

// GBK

coderStr = "\\xb6\\xd4\\xb6\\xc0\\xc1\\xa2\\xd1\\xa7\\xd4\\xba\\xbf\\xc9\\xb3\\xd6\\xd0\\xf8\\xb7\\xa2\\xd5\\xb9\\xce\\xca\\xcc\\xe2";

str = getApacheChineseGBK(coderStr);

System.out.println(str);

}

public static String getApacheChineseGBK(String str) throws UnsupportedEncodingException {

str = str.trim().toLowerCase();

str = unescapeGBK(str);

final ByteBuffer byteBuffer = ByteBuffer.allocate(str.length() * Character.SIZE / Byte.SIZE);

final CharBuffer converter = byteBuffer.asCharBuffer();

converter.append(CharBuffer.wrap(str));

str = new String(byteBuffer.array(), "GBK");

return str;

}

参考链接

Apache2.4中通过.htaccess配置解决Chrome 68之后的浏览器报告网站不安全的问题

在2018年7月24日发布的Chrome 68中，Google有一项重大举措就是宣布所有HTTP网站都会被标识为not secure，也就是不安全，并计划在Google搜索结果里降低HTTP网站的权重和排名。

实际的效果如下图：

继续阅读Apache2.4中通过.htaccess配置解决Chrome 68之后的浏览器报告网站不安全的问题

Apache中设置来自移动端的请求强制重定向到HTTPS规避运营商的页面劫持

最近中国移动的流量劫持到了令人发指的地步，凡是没有使用HTTPS的网址都会被劫持，非常影响用户体验。如下图所示（右下角）:

继续阅读Apache中设置来自移动端的请求强制重定向到HTTPS规避运营商的页面劫持

ubuntu 16.04.3上apache 2.4.18通过HTTP_REFERER阻止图片盗链

最近偶尔碰到网站的流量被消耗尽的情况，已经影响到自己的使用了。怀疑网站图片，数据等被盗链，导致流量被消耗。

ubuntu 16.04.3上apache 2.4.18防止网站图片被盗链的方法如下：

首先是在根目录下创建一个.htaccess，如果已经有了，直接把下面的代码添加到.htaccess尾部即可。

#阻止盗链
<IfModule mod_rewrite.c>
        RewriteEngine on
        RewriteCond %{HTTP_REFERER} !^$ [NC]
        RewriteCond %{HTTP_REFERER} !google.com [NC]
        RewriteCond %{HTTP_REFERER} !baidu.com [NC]
#       微软必应
        RewriteCond %{HTTP_REFERER} !bing.com [NC]
#       谷歌翻译
        RewriteCond %{HTTP_REFERER} !translate.googleusercontent.com [NC]
 
        RewriteCond %{HTTP_REFERER} !mobibrw.com [NC]
        RewriteCond %{HTTP_REFERER} !miniab.com [NC]
#       跳转到服务器首页
        RewriteRule .*.(gif|jpg|png|zip|gz|tar|pdf)$ mobibrw.com [R,NC,L]
#       服务器返回403禁止访问
#       RewriteRule .*.(gif|jpg|png|zip|gz|tar|pdf)$ - [F]
</IfModule>

#阻止盗链

RewriteEngine on

RewriteCond %{HTTP_REFERER} !^$ [NC]

RewriteCond %{HTTP_REFERER} !google.com [NC]

RewriteCond %{HTTP_REFERER} !baidu.com [NC]

# 微软必应

RewriteCond %{HTTP_REFERER} !bing.com [NC]

# 谷歌翻译

RewriteCond %{HTTP_REFERER} !translate.googleusercontent.com [NC]

RewriteCond %{HTTP_REFERER} !mobibrw.com [NC]

RewriteCond %{HTTP_REFERER} !miniab.com [NC]

# 跳转到服务器首页

RewriteRule .*.(gif|jpg|png|zip|gz|tar|pdf)$ mobibrw.com [R,NC,L]

# 服务器返回403禁止访问

# RewriteRule .*.(gif|jpg|png|zip|gz|tar|pdf)$ - [F]

</IfModule>

简单的解释下每条语句：

RewriteCond %{HTTP_REFERER} !^$ [NC]

1	RewriteCond %{HTTP_REFERER} !^$ [NC]

允许空“HTTP_REFERER”的访问，即允许用户在浏览器地址栏中直接输入图片地址时图片文件的显示。一般而言，这是可选的，不过，建议这么设置，如果强迫必须具有“HTTP_REFERER”才能访问，可能会带来某些问题，比如说在用户通过代理服务器访问时。

RewriteCond %{HTTP_REFERER} !google.com [NC]

1	RewriteCond %{HTTP_REFERER} !google.com [NC]

设置允许访问的HTTP来源，包括我们的站点自身、Google、Baidu等。这个可以添加多条，目前我们配置只有自身还有谷歌百度等常用的搜索引擎的访问权限。

RewriteRule .*.(gif|jpg|png|zip|gz|tar|pdf)$ mobibrw.com[R,NC,L]

1	RewriteRule .*.(gif\|jpg\|png\|zip\|gz\|tar\|pdf)$ mobibrw.com[R,NC,L]

定义被盗链时替代的链接，可以是图片，也可以是404错误页，目前我们定义的是首页，所以就是mobibrw.com，如果是要定义在404页面，可以把404页面的路径加上。当然替换的页面文件体积越小越好。你也可以不设置替换图片，而是使用下面的语句即可(服务器返回403禁止访问）：

RewriteRule .*\.(gif|jpg|png|zip|gz|tar|pdf)$ – [F]

1	RewriteRule .*\.(gif\|jpg\|png\|zip\|gz\|tar\|pdf)$ – [F]

参考链接

网站如何防止图片被盗链！怎么样让网站的图片不被其他网站调用

ubuntu 16.04.3上apache2服务器报告错误“script not found or unable to stat: /usr/lib/cgi-bin/php*”

最近在查看服务器上的apache2的错误日志的时候，发现如下错误信息：

[Sun Jan 28 19:06:13.794012 2018] [cgi:error] [pid 3382:tid 139940209870592] [client 149.56.130.214:39    474] AH02811: script not found or unable to stat: /usr/lib/cgi-bin/php
[Sun Jan 28 19:06:14.238284 2018] [cgi:error] [pid 3382:tid 139940117550848] [client 149.56.130.214:39    474] AH02811: script not found or unable to stat: /usr/lib/cgi-bin/php5
[Sun Jan 28 19:06:15.550249 2018] [cgi:error] [pid 3382:tid 139940226656000] [client 149.56.130.214:39    474] AH02811: script not found or unable to stat: /usr/lib/cgi-bin/php-cgi
[Sun Jan 28 19:06:15.983952 2018] [cgi:error] [pid 3382:tid 139940125943552] [client 149.56.130.214:39    474] AH02811: script not found or unable to stat: /usr/lib/cgi-bin/php.cgi
[Sun Jan 28 19:06:16.422075 2018] [cgi:error] [pid 3382:tid 139940033623808] [client 149.56.130.214:39    474] AH02811: script not found or unable to stat: /usr/lib/cgi-bin/php4

[Sun Jan 28 19:06:13.794012 2018] [cgi:error] [pid 3382:tid 139940209870592] [client 149.56.130.214:39 474] AH02811: script not found or unable to stat: /usr/lib/cgi-bin/php

[Sun Jan 28 19:06:14.238284 2018] [cgi:error] [pid 3382:tid 139940117550848] [client 149.56.130.214:39 474] AH02811: script not found or unable to stat: /usr/lib/cgi-bin/php5

[Sun Jan 28 19:06:15.550249 2018] [cgi:error] [pid 3382:tid 139940226656000] [client 149.56.130.214:39 474] AH02811: script not found or unable to stat: /usr/lib/cgi-bin/php-cgi

[Sun Jan 28 19:06:15.983952 2018] [cgi:error] [pid 3382:tid 139940125943552] [client 149.56.130.214:39 474] AH02811: script not found or unable to stat: /usr/lib/cgi-bin/php.cgi

[Sun Jan 28 19:06:16.422075 2018] [cgi:error] [pid 3382:tid 139940033623808] [client 149.56.130.214:39 474] AH02811: script not found or unable to stat: /usr/lib/cgi-bin/php4

刚刚开始感觉莫名其妙，因为PHP的解析已经通过PHP-FPM模式进行处理，服务器上的配置已经不需要cgi进行处理了。

网上搜索了一下，发现这个是由于ubuntu上apache2的默认配置模版导致的，尤其是从ubuntu 12.04一路升级上来的系统,在配置模版中有指出/usr/lib/cgi-bin/这个路径，可是这个路径已经不再使用了。

修改方式如下：

$ sudo vim /etc/apache2/sites-enabled/000-default.conf

1	$ sudo vim /etc/apache2/sites-enabled/000-default.conf

向下查找，会发现如下内容：

ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
<Directory "/usr/lib/cgi-bin/">
	AllowOverride None
	Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
	Order allow,deny
	Allow from all
</Directory>

ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/

AllowOverride None

Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch

Order allow,deny

Allow from all

</Directory>

如果确实网站已经不再使用任何cgi相关的东西了，可以直接注释掉这段代码。
另外如果开启了HTTPS,同理需要修改HTTPS对应的配置文件。

修改完成后，重启服务器：

$ sudo service apache2 restart

1	$ sudo service apache2 restart

参考链接

script not found or unable to stat: /usr/lib/cgi-bin/php-cgi

ubuntu 16.04执行letsencrypt的时候报告错误“ImportError: No module named datetime”

网站一直使用letsencrypt提供的HTTPS证书,这个证书的问题在于每隔三个月就必须更新一次，本次更新证书的时候，提示如下错误：

Error: couldn't get currently installed version for /root/.local/share/letsencrypt/bin/letsencrypt:
Traceback (most recent call last):
  File "/root/.local/share/letsencrypt/bin/letsencrypt", line 7, in <module>
    from certbot.main import main
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/certbot/main.py", line 9, in 

<module>
    from acme import jose
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/acme/jose/__init__.py", line 

37, in <module>
    from acme.jose.interfaces import JSONDeSerializable
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/acme/jose/interfaces.py", line 

9, in <module>
    from acme.jose import util
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/acme/jose/util.py", line 4, in 

<module>
    from cryptography.hazmat.primitives.asymmetric import rsa
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-

packages/cryptography/hazmat/primitives/asymmetric/rsa.py", line 14, in <module>
    from cryptography.hazmat.backends.interfaces import RSABackend
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-

packages/cryptography/hazmat/backends/__init__.py", line 7, in <module>
    import pkg_resources
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/pkg_resources/__init__.py", 

line 36, in <module>
    import plistlib
  File "/usr/lib/python2.7/plistlib.py", line 62, in <module>
    import datetime
ImportError: No module named datetime

Error: couldn't get currently installed version for /root/.local/share/letsencrypt/bin/letsencrypt:

Traceback (most recent call last):

File "/root/.local/share/letsencrypt/bin/letsencrypt", line 7, in <module>

from certbot.main import main

File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/certbot/main.py", line 9, in

from acme import jose

File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/acme/jose/__init__.py", line

37, in <module>

from acme.jose.interfaces import JSONDeSerializable

File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/acme/jose/interfaces.py", line

9, in <module>

from acme.jose import util

File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/acme/jose/util.py", line 4, in

from cryptography.hazmat.primitives.asymmetric import rsa

File "/root/.local/share/letsencrypt/local/lib/python2.7/site-

packages/cryptography/hazmat/primitives/asymmetric/rsa.py", line 14, in <module>

from cryptography.hazmat.backends.interfaces import RSABackend

File "/root/.local/share/letsencrypt/local/lib/python2.7/site-

packages/cryptography/hazmat/backends/__init__.py", line 7, in <module>

import pkg_resources

File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/pkg_resources/__init__.py",

line 36, in <module>

import plistlib

File "/usr/lib/python2.7/plistlib.py", line 62, in <module>

import datetime

ImportError: No module named datetime

错误发生的原因在于letsencrypt自己构建了一个Python的虚拟环境来隔离，但是早期建立的虚拟环境中是缺少部分软件包的，而自身的BUG导致也没有重新更新虚拟环境，导致出现异常。

解决方法就是删除letsencrypt自己构建的Python的虚拟环境，然后继续执行脚本让他重建即可。

$ rm -rf ~/.local/share/letsencrypt

1	$ rm -rf ~/.local/share/letsencrypt

参考链接

Ubuntu 14.04.5版本上安装并启用Apache 2.4.10版本的Event MPM模块

Apache 2.4版本开始已经尝试借鉴Nginx的实现方式来处理网络连接。但是到目前（2017.2.22）为止，实现的并不彻底，只是在处理HTTP协议的时候使用异步模式，而处理HTTPS协议的时候，依旧使用每个连接一个线程的模式。据说完整的支持HTTPS异步，要到Apache 3.x版本了。

目前的Apache MPM event本质上还是Apache MPM worker的优化版本，并不是一个完整的独立模式。

尽管支持的不是太完善，但是这部分的实现，已经能比较好的改善Apache 2.4的网络处理性能了，尤其是对于我这种访问压力不是太大的网站来说，目前应该是够用了的。暂时可以缓解一下迁移到Nginx的急迫性，并且比较好的减少访问网站时候的延迟比较高的问题。

到目前（2017.2.22）为止在Ubuntu 14.04.5版本上Apache Event MPM还不属于正式版本，而是被部署到了backports(待发布)分支上，处于候选发布状态，因此我们安装的时候，需要执行指定backports，具体执行命令如下：

$ sudo apt-get -t trusty-backports install apache2-mpm-event

1	$ sudo apt-get -t trusty-backports install apache2-mpm-event

模块的配置文件在/etc/apache2/mods-available/mpm_event.conf,目前我这边用默认配置已经足够了（足见访问量是多么的少，呵呵）。

启用Apache MPM event模块

$ sudo a2dismod mpm_worker

$ sudo a2dismod mpm_prefork

$ sudo a2enmod mpm_event

$ sudo service apache2 restart

$ sudo a2dismod mpm_worker

$ sudo a2dismod mpm_prefork

$ sudo a2enmod mpm_event

$ sudo service apache2 restart

查询Apache 2.4当前正在使用的模块

$ a2query -M

1	$ a2query -M

返回值会是event, prefork, worker中的一个，如果返回了event，则说明我们已经成功启用了Apache MPM event模块。

目前实际测试来看，确实能非常明显的加快网站的访问速度，访问延迟明显变短。

参考链接

Ubuntu 14.04系统上使用Apache2.4.10+PHP5+FastCGI的WordPress网站大量php5-cgi defunct引起网站访问异常缓慢

最近网站访问异常缓慢，网站响应时间明显延迟很多，观察系统的处理器占用，一点都不高，带宽也在合理范围之内，因此分析Apache-2.4.10的错误日志

$ cat /var/log/apache2/error.log

1	$ cat /var/log/apache2/error.log

发现大量的出现

[Tue Feb 21 21:16:12.012511 2017] [fcgid:warn] [pid 19442:tid 140638402033408] [client 54.147.162.12:50579] mod_fcgid: can't apply process slot for /usr/bin/php5-cgi, referer: https://www.google.com/

1	[Tue Feb 21 21:16:12.012511 2017] [fcgid:warn] [pid 19442:tid 140638402033408] [client 54.147.162.12:50579] mod_fcgid: can't apply process slot for /usr/bin/php5-cgi, referer: https://www.google.com/

如下图：

感觉很奇怪，于是看了一下php相关的进程，执行命令

$ ps -A | grep php

1	$ ps -A \| grep php

执行结果如下图：

发现大量的php5-cgi进程处于defunct状态（僵尸状态），导致达到了进程数量的限制上限，无法继续提供服务。

但是上面的日志，是已经出现问题的时候的日志，既然进程不足了，自然无法提供服务了，继续向上追踪，发现大量的进程崩溃日志

[Mon Feb 20 18:07:12.857016 2017] [core:warn] [pid 15284:tid 139855916136320] AH00045: child process 15291 still did not exit, sending a SIGTERM
[Mon Feb 20 18:07:12.857024 2017] [core:warn] [pid 15284:tid 139855916136320] AH00045: child process 15408 still did not exit, sending a SIGTERM
[Mon Feb 20 18:07:12.857031 2017] [core:warn] [pid 15284:tid 139855916136320] AH00045: child process 17723 still did not exit, sending a SIGTERM
[Mon Feb 20 18:07:14.859108 2017] [core:warn] [pid 15284:tid 139855916136320] AH00045: child process 16387 still did not exit, sending a SIGTERM
[Mon Feb 20 18:07:14.859170 2017] [core:warn] [pid 15284:tid 139855916136320] AH00045: child process 15291 still did not exit, sending a SIGTERM
[Mon Feb 20 18:07:14.859178 2017] [core:warn] [pid 15284:tid 139855916136320] AH00045: child process 15408 still did not exit, sending a SIGTERM
[Mon Feb 20 18:07:14.859185 2017] [core:warn] [pid 15284:tid 139855916136320] AH00045: child process 17723 still did not exit, sending a SIGTERM

[Mon Feb 20 18:07:12.857016 2017] [core:warn] [pid 15284:tid 139855916136320] AH00045: child process 15291 still did not exit, sending a SIGTERM

[Mon Feb 20 18:07:12.857024 2017] [core:warn] [pid 15284:tid 139855916136320] AH00045: child process 15408 still did not exit, sending a SIGTERM

[Mon Feb 20 18:07:12.857031 2017] [core:warn] [pid 15284:tid 139855916136320] AH00045: child process 17723 still did not exit, sending a SIGTERM

[Mon Feb 20 18:07:14.859108 2017] [core:warn] [pid 15284:tid 139855916136320] AH00045: child process 16387 still did not exit, sending a SIGTERM

[Mon Feb 20 18:07:14.859170 2017] [core:warn] [pid 15284:tid 139855916136320] AH00045: child process 15291 still did not exit, sending a SIGTERM

[Mon Feb 20 18:07:14.859178 2017] [core:warn] [pid 15284:tid 139855916136320] AH00045: child process 15408 still did not exit, sending a SIGTERM

[Mon Feb 20 18:07:14.859185 2017] [core:warn] [pid 15284:tid 139855916136320] AH00045: child process 17723 still did not exit, sending a SIGTERM

感觉很奇怪，最初以为是由于调整Apache-2.4.10服务器，多次在正常运行中重启服务器，导致正在服务的php5-cgi进程变成了僵尸进程。但是重启服务器之后，过了几天后，问题依旧发生了。

于是网上搜索了一下，感觉应该更像是PHP-CGI进程本身存在内存泄漏问题，导致进程长时间执行之后，由于资源开销问题导致进程崩溃。

目前我的服务器上启用的是Apache2的Event MPM模块,查看其中的配置文件：

$ cat /etc/apache2/mods-enabled/mpm_event.conf

1	$ cat /etc/apache2/mods-enabled/mpm_event.conf

可以看到里面的内容如下：

# event MPM
# StartServers: initial number of server processes to start
# MinSpareThreads: minimum number of worker threads which are kept spare
# MaxSpareThreads: maximum number of worker threads which are kept spare
# ThreadsPerChild: constant number of worker threads in each server process
# MaxRequestWorkers: maximum number of worker threads
# MaxConnectionsPerChild: maximum number of requests a server process serves
<IfModule mpm_event_module>
	StartServers			 2
	MinSpareThreads		 25
	MaxSpareThreads		 75
	ThreadLimit			 64
	ThreadsPerChild		 25
	MaxRequestWorkers	  150
	MaxConnectionsPerChild   0
</IfModule>

# event MPM

# StartServers: initial number of server processes to start

# MinSpareThreads: minimum number of worker threads which are kept spare

# MaxSpareThreads: maximum number of worker threads which are kept spare

# ThreadsPerChild: constant number of worker threads in each server process

# MaxRequestWorkers: maximum number of worker threads

# MaxConnectionsPerChild: maximum number of requests a server process serves

StartServers 2

MinSpareThreads 25

MaxSpareThreads 75

ThreadLimit 64

ThreadsPerChild 25

MaxRequestWorkers 150

MaxConnectionsPerChild 0

</IfModule>

发现，设置MaxConnectionsPerChild参数为0,根据 Apache MPM Common Directives 里面的介绍，这个参数的作用就是一个进程处理多少个请求后就退出。而如果设置了 0 则代表，除非出现了异常，否则进程会一直存在。这样的话，一旦资源泄漏，进程就会各种异常了。因此需要设置一下这个参数，一般这个参数设置为1000-5000左右，根据实际情况自己调整一下参数。注意：这个参数的设置是会影响到网站的访问速度的，尤其是当服务器的连接次数到达限制的时候，此时大量的服务器进程都在重启，导致此时的访问要么被重置要么耗时变的非常长。因此，如果没有资源泄漏的话，可以不设置这个限制。

注意一下这个介绍的最后一句话，讲的就是这个参数可以修正资源泄漏问题，如下：

Setting MaxConnectionsPerChild to a non-zero value limits the amount of memory that process can consume by (accidental) memory leakage.

1	Setting MaxConnectionsPerChild to a non-zero value limits the amount of memory that process can consume by (accidental) memory leakage.

修改参数后，需要重启服务生效。

按照上面的方法实现后，过了一个礼拜后，这个现象再次发生了。

观察了一下Apache2当前已经启用的模块

$ ls /etc/apache2/mods-enabled/

1	$ ls /etc/apache2/mods-enabled/

发现，由于是从Apache2.2升级到的Apache2.4，或许是某次的配置，导致fastcgi与fcgi两个模块同时被启用了。

是不是两个相同功能的模块同时启用导致功能冲突了呢？

先尝试禁用fastcgi(这个模块已经被fcgi替换了).

$ a2dismod fastcgi

$ service apache2 restart

$ a2dismod fastcgi

$ service apache2 restart

目前看来，问题依旧发生了！！！

查看Apache2中的FastCGI的配置信息

$ vim /etc/apache2/mods-enabled/fcgid.conf

1	$ vim /etc/apache2/mods-enabled/fcgid.conf

可以看到如下内容

<IfModule mod_fcgid.c>
  AddHandler    fcgid-script .fcgi .php
  FcgidConnectTimeout 120
  DefaultMaxClassProcessCount 10
  MaxRequestLen  157286400
  IPCCommTimeout 300
</IfModule>

AddHandler fcgid-script .fcgi .php

FcgidConnectTimeout 120

DefaultMaxClassProcessCount 10

MaxRequestLen 157286400

IPCCommTimeout 300

</IfModule>

其中的AddHandler中的.php引起了注意，因为在日志中出现问题之前一直会出现如下的错误日志：

[Tue Feb 21 01:56:12.876460 2017] [fcgid:warn] [pid 21582:tid 140134271887104] [client 114.82.132.78:2410] mod_fcgid: can't apply process slot for /usr/bin/php5-cgi, referer: http://www.mobibrw.com/plus/90sec.php
[Tue Feb 21 01:56:16.727715 2017] [fcgid:warn] [pid 20546:tid 140134255101696] [client 114.82.132.78:2647] mod_fcgid: can't apply process slot for /usr/bin/php5-cgi, referer: http://www.mobibrw.com/plus/spider.php
[Tue Feb 21 01:56:20.434429 2017] [fcgid:warn] [pid 21582:tid 140134263494400] [client 114.82.132.78:3049] mod_fcgid: can't apply process slot for /usr/bin/php5-cgi, referer: http://www.mobibrw.com/plus/e7xue.php
[Tue Feb 21 01:56:35.130495 2017] [fcgid:warn] [pid 20546:tid 140134297065216] [client 114.82.132.78:3446] mod_fcgid: can't apply process slot for /usr/bin/php5-cgi, referer: http://www.mobibrw.com/plus/x.php
[Tue Feb 21 01:56:38.668792 2017] [fcgid:warn] [pid 20546:tid 140134238316288] [client 114.82.132.78:3985] mod_fcgid: can't apply process slot for /usr/bin/php5-cgi, referer: http://www.mobibrw.com/plus/service.php
[Tue Feb 21 01:56:42.247574 2017] [fcgid:warn] [pid 22275:tid 140134263494400] [client 114.82.132.78:4368] mod_fcgid: can't apply process slot for /usr/bin/php5-cgi, referer: http://www.mobibrw.com/plus/av.php

[Tue Feb 21 01:56:12.876460 2017] [fcgid:warn] [pid 21582:tid 140134271887104] [client 114.82.132.78:2410] mod_fcgid: can't apply process slot for /usr/bin/php5-cgi, referer: http://www.mobibrw.com/plus/90sec.php

[Tue Feb 21 01:56:16.727715 2017] [fcgid:warn] [pid 20546:tid 140134255101696] [client 114.82.132.78:2647] mod_fcgid: can't apply process slot for /usr/bin/php5-cgi, referer: http://www.mobibrw.com/plus/spider.php

[Tue Feb 21 01:56:20.434429 2017] [fcgid:warn] [pid 21582:tid 140134263494400] [client 114.82.132.78:3049] mod_fcgid: can't apply process slot for /usr/bin/php5-cgi, referer: http://www.mobibrw.com/plus/e7xue.php

[Tue Feb 21 01:56:35.130495 2017] [fcgid:warn] [pid 20546:tid 140134297065216] [client 114.82.132.78:3446] mod_fcgid: can't apply process slot for /usr/bin/php5-cgi, referer: http://www.mobibrw.com/plus/x.php

[Tue Feb 21 01:56:38.668792 2017] [fcgid:warn] [pid 20546:tid 140134238316288] [client 114.82.132.78:3985] mod_fcgid: can't apply process slot for /usr/bin/php5-cgi, referer: http://www.mobibrw.com/plus/service.php

[Tue Feb 21 01:56:42.247574 2017] [fcgid:warn] [pid 22275:tid 140134263494400] [client 114.82.132.78:4368] mod_fcgid: can't apply process slot for /usr/bin/php5-cgi, referer: http://www.mobibrw.com/plus/av.php

而这个配置项是从Ubuntu 12.04中手工引入的，我们尝试去掉这个。另外，可以看到

DefaultMaxClassProcessCount 10

1	DefaultMaxClassProcessCount 10

也就是FastCGI的最大进程数是被设置成了10,但是，我这边限制PHP-FPM的最大进程数为5，是不是FastCGI的进程数如果大于PHP-FPM能够提供服务的数量的时候，会导致FastCGI进程出现僵尸状态呢？是不是这个原因导致的呢？于是修改后的结果如下：

<IfModule mod_fcgid.c>
  AddHandler    fcgid-script .fcgi
  FcgidConnectTimeout 120
  DefaultMaxClassProcessCount 5
  MaxRequestLen  157286400
  IPCCommTimeout 300
</IfModule>

AddHandler fcgid-script .fcgi

FcgidConnectTimeout 120

DefaultMaxClassProcessCount 5

MaxRequestLen 157286400

IPCCommTimeout 300

</IfModule>

经过这几天的观察，貌似现象不再出现了，这个应该是Apache 2.4版本引入的BUG,以前的配置的Apache 2.2版本上是没有任何问题的，究竟原因是mod_fcgid无法处理.php格式的脚本导致，还是由于mod_fcgid进程数高于php-fpm的进程数导致mod_fcgid进程长时间无法获取到可用的php-fpm连接，导致进程被饿死，这个暂时不详细追究了。

今天在修改配置的时候，由于配置错误，导致PHP-FPM服务无法正常启动，但是整个服务器竟然一直可以正常访问，那么结论就是Apache 2.4在当前的配置下，根本就没有使用PHP-FPM模式进行通信，而是使用标准的FastCGI的方式调度的。
于是网上搜索半天，结合自己的尝试，找到了根本原因：

<Directory /var/www/wordpress>
		#Options Indexes FollowSymLinks MultiViews
		Options FollowSymLinks MultiViews
		AllowOverride All
		FCGIWrapper /usr/bin/php5-cgi .php
		AddHandler fcgid-script .php
		Options ExecCGI SymLinksIfOwnerMatch
		Order allow,deny
		allow from all
</Directory>

#Options Indexes FollowSymLinks MultiViews

Options FollowSymLinks MultiViews

AllowOverride All

FCGIWrapper /usr/bin/php5-cgi .php

AddHandler fcgid-script .php

Options ExecCGI SymLinksIfOwnerMatch

Order allow,deny

allow from all

</Directory>

上面的配置在Apache 2.2版本上是不影响后面启用的PHP-FPM配置的，对于PHP的请求，最终都是定向到PHP-FPM的。但是相同的配置在Apache 2.4上面，则被定向到了FastCGI上面。因此修改方式如下(至少要高于2.4.10，否则配置无效)：

<Directory /var/www/wordpress>
		#Options Indexes FollowSymLinks MultiViews
		Options FollowSymLinks MultiViews
		AllowOverride All
#		Apache 2.2/2.4.9
#		FCGIWrapper /usr/bin/php5-cgi .php
#		AddHandler fcgid-script .php
#		Options ExecCGI SymLinksIfOwnerMatch
#		Apache 2.4.10
		<FilesMatch \.php$>
			SetHandler "proxy:unix:/var/run/php5-fpm.sock|fcgi://localhost"
		</FilesMatch>	
		Order allow,deny
		allow from all
</Directory>

#Options Indexes FollowSymLinks MultiViews

Options FollowSymLinks MultiViews

AllowOverride All

# Apache 2.2/2.4.9

# FCGIWrapper /usr/bin/php5-cgi .php

# AddHandler fcgid-script .php

# Options ExecCGI SymLinksIfOwnerMatch

# Apache 2.4.10

SetHandler "proxy:unix:/var/run/php5-fpm.sock|fcgi://localhost"

</FilesMatch>

Order allow,deny

allow from all

</Directory>

至此，应该才是从根本上解决了服务器上的问题。

开始的时候忽略了一个基础的问题，那就是php5-cgi跟php5-fpm进程本身就不应该同时存在，如果服务器使用php5-fpm，那么php5-cgi的进程就不应该被调用，这个问题没有重视，导致了整个问题分析时间冗长，反复。

本质上是服务器的配置错误导致问题。

2023年 5月
一	二	三	四	五	六	日
1	2	3	4	5	6	7
8	9	10	11	12	13	14
15	16	17	18	19	20	21
22	23	24	25	26	27	28
29	30	31