Apache日志出现internal dummy connection信息

 群集里多个web站点的Apache日志合并出现问题。
  将原来分散的web应用整合成群集后,同一个站点产生的多个日志需要进行合并。其中一个站点在合并apache日志的时候总是报错,为了搞清楚原因仔细看了该站点和其他站点日志有何不同,结果发现在不能合并的日志中发现大量的internal dummy connection信息。

::1 – - [01/Nov/2008:00:01:04 +0800] “GET / HTTP/1.0″ 200 95536 “-” “Apache/2.2.0 (Unix) PHP/5.2.3 (internal dummy connection)”
::1 – - [01/Nov/2008:00:01:05 +0800] “GET / HTTP/1.0″ 200 95536 “-” “Apache/2.2.0 (Unix) PHP/5.2.3 (internal dummy connection)”
::1 – - [01/Nov/2008:00:01:06 +0800] “GET / HTTP/1.0″ 200 95536 “-” “Apache/2.2.0 (Unix) PHP/5.2.3 (internal dummy connection)”
::1 – - [01/Nov/2008:00:01:07 +0800] “GET / HTTP/1.0″ 200 95536 “-” “Apache/2.2.0 (Unix) PHP/5.2.3 (internal dummy connection)”
::1 – - [01/Nov/2008:00:01:08 +0800] “GET / HTTP/1.0″ 200 95536 “-” “Apache/2.2.0 (Unix) PHP/5.2.3 (internal dummy connection)”
::1 – - [01/Nov/2008:00:01:09 +0800] “GET / HTTP/1.0″ 200 95536 “-” “Apache/2.2.0 (Unix) PHP/5.2.3 (internal dummy connection)”
::1 – - [01/Nov/2008:00:01:10 +0800] “GET / HTTP/1.0″ 200 95536 “-” “Apache/2.2.0 (Unix) PHP/5.2.3 (internal dummy connection)”
::1 – - [01/Nov/2008:00:01:11 +0800] “GET / HTTP/1.0″ 200 95536 “-” “Apache/2.2.0 (Unix) PHP/5.2.3 (internal dummy connection)”

  把这些包含internal dummy connection的行从日志中清除后日志可以正常合并,看来问题就出在这些被记录在Apache日志中的internal dummy connection信息了。但是这些信息总不能每个都要手工清除吧,分析日志总归还是要做成自动化。要在日志中屏蔽这些信息可以通过修改Apache配置文件实现,

SetEnvIf Remote_Addr “::1″ dontlog
CustomLog “|/usr/local/sbin/cronolog /www/logs/XXX/access%Y%m%d.log” combined env=!dontlog

  修改配置文件之后产生的Apache日志屏蔽了这些信息,表面上日志中不再记录这些内部进程的通信,但是这并不代表问题不存在。那深究一下同样的环境下,为什么这些信息只出现在一个站点上而其他站点没有类似的问题?又为什么会产生这些信息呢?
这些信息是为了方便管理员在日志中查找出错误的请求

/* Create the request string. We include a User-Agent so that
* adminstrators can track down the cause of the odd-looking
* requests in their logs.
*/
srequest = apr_pstrcat(p, “GET / HTTP/1.0\r\nUser-Agent: “,
ap_get_server_version(),
” (internal dummy connection)\r\n\r\n”, NULL);

internal dummy connection的产生是因为apache的MPM模块用prefork方式工作,而用worker MPM则不会使用pipe of death在进程间通信,也就不会有internal dummy connections的问题。

It’s defined in /server/mpm_common.c:

| This function connects to the server, then immediately closes the
| connection.
| This permits the MPM to skip the poll when there is only one listening
| socket, because it provides a alternate way to unblock an accept()
| when the pod is used.

pod=pipe of death.

| The pipe of death is used to tell all child processes that it is time
| to die gracefully.

So if you use the worker MPM which doesn’t use a pod, there are no
internal dummy connections anymore.

现在搞不清楚为什么只有N多站点中只有一个站点出现这样的问题,如果找到原因我会续上。有朋友知道也请指点。

Del.icio.us Google书签 Digg Live Bookmark Technorati Furl Yahoo书签 Facebook 百度搜藏 新浪 ViVi 365Key 网摘 天极网摘 和讯网摘 博拉网 POCO 网摘 饭否 QQ 书签 Digbuzz 我挖网 Mister Wong
目前还没有任何评论.