We have 2 Apache webserver behind a load balancer wich are connected to 2 (JBoss) application servers via mod ajp.
To those webservers, mobile devices connect via a REST API.
In our performance test we rather quickly ran into a lot of NonHttpResponse: errors which we identified to be coming from mod_reqtimeout:
[Mon Mar 16 14:42:49.324705 2015] [reqtimeout:info] [pid 27914:tid 140628428449536] [client 1.2.3.4:48280] AH01382: Request header read timeout
... which is configured as follows:
<IfModule reqtimeout_module>
RequestReadTimeout header=10-20,minrate=500
RequestReadTimeout body=10,minrate=500
</IfModule>
I was able to get rid of those errors by increasing those values to
RequestReadTimeout header=20-60,minrate=100
But this can't be the solution, since with some more simultaneous users the problem occured again (There is a requirement to be able to serve 300 concurrent users - 100 worked quite ok, with 300 we had over 10,000 of those Request header read timeout errors). I suspect it's the interaction of apaches KeepAlive, our mod_ajp configuration and mod_reqtimeout that leads mod_reqtimeout to the conclusion that there is a slowloris attack ongoing (to many open connections that do nothing) and I kindly ask for your help in tweaking those parameters.
Additional problem is a firewall between webserver and application server, which I suspect to kill open idle connections. I read about deactivating KeepAlive completely to solve this, but as I said, all our clients are mobile devices, so that's probably not an option (?).
Here are the other configs (parts of):
workers.properties:
worker.list=server
worker.maintain=60
worker.server.type=ajp13
worker.server.host=server
worker.server.port=15869
worker.server.socket_keepalive=True
worker.server.connection_pool_timeout=600
worker.server.ping_mode=A
worker.server.connection_ping_interval=60
mod_prefork:
<IfModule prefork.c>
StartServers 5
MinSpareServers 5
MaxSpareServers 10
#MaxClients 256
MaxClients 300
MaxRequestsPerChild 0
</IfModule>
mainserver.conf:
Timeout 300
KeepAlive On
MaxKeepAliveRequests 100
KeepAliveTimeout 15
ssl.conf (mobile devices connect via ssl):
Timeout 1200
KeepAlive On
MaxKeepAliveRequests 0
KeepAliveTimeout 10