We have 2 Apache webserver behind a load balancer wich are connected to 2 (JBoss) application servers via mod ajp.
To those webservers, mobile devices connect via a REST API.
In our performance test we rather quickly ran into a lot of NonHttpResponse: errors which we identified to be coming from mod_reqtimeout:
[Mon Mar 16 14:42:49.324705 2015] [reqtimeout:info] [pid 27914:tid 140628428449536] [client 18.104.22.168:48280] AH01382: Request header read timeout
... which is configured as follows:
<IfModule reqtimeout_module> RequestReadTimeout header=10-20,minrate=500 RequestReadTimeout body=10,minrate=500 </IfModule>
I was able to get rid of those errors by increasing those values to
But this can't be the solution, since with some more simultaneous users the problem occured again (There is a requirement to be able to serve 300 concurrent users - 100 worked quite ok, with 300 we had over 10,000 of those Request header read timeout errors). I suspect it's the interaction of apaches KeepAlive, our mod_ajp configuration and mod_reqtimeout that leads mod_reqtimeout to the conclusion that there is a slowloris attack ongoing (to many open connections that do nothing) and I kindly ask for your help in tweaking those parameters.
Additional problem is a firewall between webserver and application server, which I suspect to kill open idle connections. I read about deactivating KeepAlive completely to solve this, but as I said, all our clients are mobile devices, so that's probably not an option (?).
Here are the other configs (parts of):
worker.list=server worker.maintain=60 worker.server.type=ajp13 worker.server.host=server worker.server.port=15869 worker.server.socket_keepalive=True worker.server.connection_pool_timeout=600 worker.server.ping_mode=A worker.server.connection_ping_interval=60
<IfModule prefork.c> StartServers 5 MinSpareServers 5 MaxSpareServers 10 #MaxClients 256 MaxClients 300 MaxRequestsPerChild 0 </IfModule>
Timeout 300 KeepAlive On MaxKeepAliveRequests 100 KeepAliveTimeout 15
ssl.conf (mobile devices connect via ssl):
Timeout 1200 KeepAlive On MaxKeepAliveRequests 0 KeepAliveTimeout 10