Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My ELB keeps taking my instances out of service, because the HTTP health check is failing.

We have a DNS wildcard, and redirect everything to www:

vhost.conf:

ServerName www.example.com
ServerAlias *.example.com
RewriteEngine on
RewriteCond %{HTTP_HOST} !^www\.example\.com$ [NC]
RewriteRule ^ http://www.example.com/$1 [R=301,L]

This works fine for actual browsers, but the HTTP health check to / fails, presumably because it's getting a 302.

Is the best option to use a TCP health check, or is there a way to get HTTP to work?

share|improve this question
add comment

2 Answers

up vote 4 down vote accepted

This question has been asked on the AWS forums and the answer was to set up a default vhost that handles traffic on the bare IP address and doesn't do any redirects. This will mean that normal users who hit your IP address will not be redirected either.

You could alternatively specify the path part of the URL that you want the ELB to request and ignore that path by adding another RewriteCond:

RewriteCond %{HTTP_HOST} !^www\.example\.com$ [NC]
RewriteCond %{REQUEST_URI} !^/health-check$
RewriteRule ^ http://www.example.com/$1 [R=301,L]

Normal users who hit that URL will not be redirected.

You could also use the same technique to detect the User-Agent of the ELB.

RewriteCond %{HTTP_HOST} !^www\.example\.com$ [NC]
RewriteCond %{HTTP_USER_AGENT} !^ELB-HealthChecker
RewriteRule ^ http://www.example.com/$1 [R=301,L]

Normal users who spoof their User-Agent will not be redirected.

Or the internal IP address of the ELB.

RewriteCond %{HTTP_HOST} !^www\.example\.com$ [NC]
RewriteCond %{REMOTE_ADDR} !^10\.
RewriteRule ^ http://www.example.com/$1 [R=301,L]

For this option to work, you will require either mod_rpaf (for Apache 2.2) or mod_remoteip (for Apache 2.4) to modify the REMOTE_ADDR variable to contain the correct part of the contents of the X-Forwarded-For header. As long as you set that up correctly, it shouldn't be possible for a normal user to avoid the redirect response.

share|improve this answer
    
The problem with setting up a default vhost is that the IP address is going to change each time a new instance is spun up or rebooted, and I would like my default AMI to include support for the health check. I'll look into the other options. –  chris Jan 17 '13 at 15:37
    
The IP address check I included only checks that the IP address starts with 10.. The rest of the parts of the IP address can change as much as they want and they will still be matched. The 10.*.*.* (or 10.0.0.0/8) range of IP addresses are not routable over the internet. –  Ladadadada Jan 17 '13 at 15:46
    
I am already using the remote IP to log the requestors IP address (as opposed to the ELB IP) so the 3rd option worked - thanks! –  chris Jan 17 '13 at 17:01
add comment

Adding virtual hosts is not a good idea, since one has to restart httpd service for virtual hosts to get reflected. There is an alternative way of doing this

  1. Ignore the ELB Health Check path in .htaccess file
    separate all four parts of the dns name like follows
    elb_dns_name: elb-name.subnet_zone.elb.amazonaws.com
  2. For all the remaining urls have internal rewrite rules
    directory_scructure: code_folder/website

    RewriteEngine On
    RewriteCond %{HTTP_HOST} !$ [NC]
    RewriteCond %{REQUEST_URI} !^/index.php$
    RewriteRule ^(.*)$ /$1 [L,QSA]

This worked very well for me. Please suggest if there are better methods cheers!

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.