Out of Control®

The more I know how my server is feeling, the better off I am. Using apache’s built in Server Status is just one such tool that will let you see how apache is handling it’s load. The server status will tell you the server load, uptime, requests per second, total workers, available workers, and every connection to your apache server with who is connecting and to what page and on what site they are connecting. All very useful information especially if you are experiencing a problem.

This little tutorial will show you how one might setup their server status.
Little warning before you start, setting up server status can be insecure and give bad people access to critical information if done wrong. I am not liable for any problems that result from you following my tutorial, or any tutorial on this site. You break your server, that is your problem and yours alone.

Here is how I set it up:

First, let’s install a configuration file in /etc/httpd/conf.d. We will call it serverstatus.conf. Be sure it ends in conf or apache won’t see it.


<Location>
SetHandler server-status
Order Deny,Allow
Deny from all
Allow from XXX.XXX.XXX.XXX
</Location>


Location
Tells you what to enter in your browser. To be extra safe change it from server-status to something obscure. For this example I am going to use . To see the status you would then enter this into your browser: http://www.yourdomainname.com/st994576BB76.

SetHandler
Tells the server to apply the server status handler to this location

Order Deny,Allow
tells the server to Deny first and then Allow. Deny from all tells the server that first we will deny access to everyone. So no one can access the server status URL.

Allow from XXX.XXX.XXX.XXX
tells the server to allow access only from the IP address XXX.XXX.XXX.XXX. Be sure to change it to your own IP address. If you have a dynamic IP that changes quickly then this won’t work for you. Whatever you do, don’t let the world see your server status. It is insecure to let that info out.

So we now have a secure method to access the server status. Next we will turn on extended status in apache.

The file we are going to edit is /etc/httpd/conf/httpd.conf. First make a backup of that file. If you screw up this file your web server will NOT work anymore. So make sure you have a backup before proceeding.

Using your favourite editor, add this line–ExtendedStatus On–right after the Include conf.d/*.conf line. Mine looks like this after the change:


Include conf.d/*.conf
ExtendedStatus On


Now check that Apache still likes the config file by typing this at the command line:


/etc/init.d/httpd configtest


If the server comes back with ‘Syntax OK’ then you are set to reload apache. If any errors or warnings show up, be sure to fix them right away, and before restarting or reloading apache. If you cannot figure out why you are getting errors or warnings, you can always replace the modified version with the backup you made a few minutes ago.

Assuming all is safe, now you can enter


/etc/init.d/httpd reload


We use reload so it won’t kick anyone off the server and it is just nicer than restart, which kicks everyone off the server and then restarts.

Now you should be able to go to your URL http://www.yourdomainname.com/st994576BB76 and see the stats.

Pretty cool eh? Now you can see why you don’t want just anyone to see your server status.

If you don’t plan on using server status for awhile, be sure to disable it in the config files by turn ExtendedStatus Off in /etc/httpd/httpd.conf and removing the ‘Allow from’ line in the serverstatus.conf file. Or simply remove the serverstatus.conf file altogether.

Come back next week and I will show you how you can get a nice machine readable format of the stats.