Welcome!

Python Authors: Donald Meyer, AppDynamics Blog, Elizabeth White, XebiaLabs Blog, Hovhannes Avoyan

Blog Feed Post

How to Proxyfy Apache

INTRODUCTION

There are a variety of ways to implement proxying capabilities for web servers. As Apache is the most popular web server, we will try to implement proxying on it. Everyone who knows Apache well, probably knows that Apache implements proxying capability for AJP13 , FTP, CONNECT , HTTP/1.x.

The choice of reverse proxy server is fully dependent on what is actually trying to be hidden behind it. Each proxy mechanism has its own benefits and bottlenecks. Only for Apache, there are several ways to hide application servers (mod_proxy, mod_passenger, mod_wsgi, mod_jk). While mod_passenger and mod_wsgi are good for ruby and python servers respectively, these are a little bit outside the proxying idea. In this article I would like to discuss mod_proxy and mod_jk.

HOW TO

Now let’s think about what we have and what we want to put under proxy. The most common case is to put a pool of Tomcat servers behind Apache. Tomcat servers by default listen to 8080 for HTTP and 8009 for AJP. Now, we want to have Apache listen to 80 for incoming HTTP requests and 443 for HTTPS. People who have configured Tomcat for SSL will undoubtedly agree with me that SSL on Tomcat is quite annoying, so it’s better to implement SSL on the Apache side rather than playing with Tomcat’s keystores.

 

Okay, now we have two Tomcat servers on 2 different servers with our application installed, and both are on 8080 and an 8009 HTTP/AJP respectively. And one Apache on a third which will do HTTP on 80 , HTTPS on 443 for us and process requests to downstream Tomcat servers.

Situation 1 with mod_proxy and mod_proxy_http:

 

OK, here’s what this means:

 

User opens http://www.yourdomain.com in their browser

  1. Request comes to Apache
  2. Apache proxies it via HTTP to downstream Tomcat to port 8080
  3. Tomcat sends response to Apache via HTTP
  4. Apache delivers content to User’s browser

Well, so what are the pros and cons of this situation? We will provide some comparison tables below, but in general:

Pros:

  1. Easy and quick to configure
  2. Works for all downstream application servers

Cons:

  1. We do not have sticky sessions: if a user logs in to Tomcat1 and sends another request it will most likely go to Tomcat2 and the user will get a session expired error.
  2. mod_proxy does not support failover detection, so it will continue to send requests to downstream Tomcat even if it is down.
  3. Some Java applications exhibit unpredictable behavior when they are under a proxy environment. (From my experience, Atlassian Bamboo and Fisheye server’s progress bars stalled on several pages, but this was corrected by moving to JK; I have heard about other strange problems as well. )

Now let’s see Situation 2, where we use JK for downstream servers:

A REAL LIFE EXAMPLE

At first sight we can see that nothing has been changed, but this is only at first sight. The main difference here is that now Apache is talking to the Tomcats via AJP 13 and not HTTP protocol. So the process of opening the web site is the following:

  1. User opens http://www.yourdomain.com in their browser
  2. Request comes to Apache
  3. Apache proxies it via AJP 13 to downstream Tomcat to the port 8009
  4. Tomcat sends response to Apache via AJP
  5. Apache receives AJP and delivers content to Users browser via HTTP

It seems there is a little overhead with jumping around on HTTP and AJP, but there are benefits as well. Let’s see the Good and Bad sides of JK balancing:

Pros:

  1. After a little tweaking we can have sticky sessions just by adding sticky_session=True on Apache and jvmRoute=”NODENAME” on the Tomcat sides. After this, users who are logged in to Tomcat1 will never be dropped to Tomcat2 until Tomcat1 is alive. (Actually you can Use Membase or Memcached as session store so users will never lose their session until it expires normally)
  2. We have node failure detection, so if Tomcat1 fails, Apache will not send requests to it until it detects that it is back.
  3. JK configuration is much more advanced than that of mod_proxy and allows lots of tweaking, which will result in better performance and make the environment work just as you need it to.
  4. JK has a web admin tool that allows you to decommission, suspend and play with the LB factor in real time.

Cons:

  1. So far I have found only one bad thing: it is a little harder to configure, so it required some administrator skills.

At this moment you may be asking “Why do I need this? I have a single Tomcat server and it’s working fine”.  As a matter of fact, you need to build a network which can handle your current load, be scalable and which will not affect the normal behavior of your websites. From this point of view, the choice of reverse proxy solution is quite reasonable.

Here is a real life example of one of our client server architectures, which I think is a good one :)

 

In general, the process is as follows:

  1. User does DNS request, gets ip address of one of the Varnish servers and the Static content server/s (NGINX).
  2. NGINX delivers content directly.
  3. Varnish caches whatever needs to be cached and sends request downstream to one of the Apaches.
  4. Apache gets JSESSIONID and forwards request via JK to the required Tomcat server or does balance if user does not have cookie.
  5. Tomcat servers keep sessions in local RAM and copy in Membase cluster (so even if one Tomcat fails another can retrieve its session from Membase ). Membase is clustered memcache so it is fault tolerant by nature (we will have a closer look at Membase in another article).
  6. Tomcat does needed application logic, (retrieves information from Hadoop/HBase database, etc.) and responds to Apache.
  7. Apache sends response back to Varnish.
  8. Varnish updates cache if needed and does delivery to client.

This is a real live working scenario, and it proved itself to be fault tolerant and extremely fast.

I know that after reading this article a lot of people will ask, “why is Apache needed when Varnish can do session stickiness, etc. …”

But the idea here is to use the best possible software for each particular role, software which has real and approved redundancy and reasonable layers of architecture which can help us to easily and quickly detect problems and fix them as they appear. Also, if we keep in mind that the client uses not only HTTP, but also HTTPS, I did not see any webserver which worked with SSL as smoothly as Apache did. Even if we do not have SSL initially, we will have it soon, and I do not believe that any web project can go far without SSL.

Following is a little comparison of JK and mod_proxy, so you can see more closely what these tools are.

 

Features mod_proxy Weight mod_jk Weight
Load balancing Basic 5 Advanced 10
Node failure detection mod_proxy_balancer has to be present in the server 7 Advanced 10
Backend SSL supported (mod_ssl required) 5 not supported 0
Session stickiness not supported 0 Supported via JVM Route 10
Protocols HTTP, HTTPS 10 AJP 13 8
Node decommissioning Manual needs Apache reload 3 Online via web admin 10
Web admin interface Not present 0 Advanced with RO and RW support 10
Large AJP packet sizes 8K 5 Larger than 8K 10
Compatibility with other app. servers Works with all HTTP application servers 10 AJP Compatible (Tomcat, Glassfish, etc. …) 5
Configuration Compatible with Apache Httpd configuration file 10 Need separate JK Workers file in .properties format 8
Summary 55 81

 

So now let’s do some stress tests on both mod_jk and mod_proxy. The Installation schema is as described above (one load balancer, two application servers.) On both Apache server hosts, monitoring software from Monitis.com is installed which will check the servers’ health in real time.

We have used Amazon EC2 medium instances for this test. Here are the load test results in both graphical and plain text mode.

Monitoring is implemented using Monitis M3 monitors.

There are 2 monitors used:

apache_monitor – used for apache server’s health check.

http_load monitor - used to check the load time difference during Apache benchmarking.

 

The mentioned monitors provide useful information which helps to find relationships between various metrics.

mod_proxy:

The graphic below depicts Apache worker’s status while busy (upper line) and idle (lower line) while benchmarking using

mod_proxy balancer.

This graph shows Apache busy and idle worker processes on the Apache web server, so we can see that of 150 enabled processes, almost all are busy during the stress test.

 

Http content load time (time connect, time transfer, time total)

Following is data provided by siege after benchmarking 7 times (using mod_proxy), each time increasing the concurrent users’ number by 100:

 

Concurrent conns. Trans Elap Time Data Trans Resp Time Trans Rate Throughput Concurrent Failed
100 112173 359.18 206 0.32 312.30 0.57 99.93 0
200 181578 360.01 333 0.40 504.37 0.92 199.72 3
300 179025 360.00 329 0.60 497.29 0.91 299.37 5
400 177681 360.00 326 0.81 493.56 0.91 397.44 40
500 166401 359.99 305 1.07 462.24 0.85 494.52 130
600 160853 359.99 295 1.31 446.83 0.82 584.32 444

 

mod_jk:

The graphic below represents Apache worker’s busy (upper line) and idle (lower line) status while benchmarking using

mod_jk.


This graph shows Apache busy and idle worker processes on the Apache webserver, so we can see that of 150 enabled processes, almost all are busy during the stress test.

Http content load time (time connect, time transfer, time total)

Following is data provided by siege after benchmarking 7 times (using mod_jk), each time increasing the concurrent users number by 100:

 

Concurrent conns. Trans Elap time Data Trans Resp Time Trans time Throughput Concurrent Failed
100 106919 359.60 198 0.34 297.33 0.55 99.93 0
200 186123 360.01 345 0.39 516.99 0.96 199.76 0
300 183017 360.00 339 0.59 508.38 0.94 299.29 8
400 179891 360.00 333 0.80 499.70 0.93 397.34 49
500 169284 359.99 313 1.05 470.25 0.87 494.55 124
600 182954 359.99 339 1.16 508.22 0.94 590.32 258

 

 

CONCLUSION

Both mentioned modules, mod_proxy and mod_jk, are used as balancers for backend application servers such as Tomcat and GlassFish. What are the most important features in load balancing? I assumed node failure detection at first, and ease of session stability and load balancing configuration, without requiring any other extra tools or packages. Do not forget about performance, as well.

So what do we have? The resulting tables show that when advanced load balancing or node failure detection is needed, mod_jk is preferable. However, it cannot provide flexibility such as mod_proxy does when configuring (mod_proxy configuration is as easy as Apache configuration and there is no need for separate files like workers.properties) nor for compatibility needs with servers, other than AJP compatibility.

Now a little bit about performance. While the concurrent users count is not so high (in our case: 400), both servers’ behavior is similar, and it seems mod_proxy is able to provide better performance, but things changed as the number of concurrent users grew.

Take a look at this table:

 

Concurrent users Failed requests(10 Seconds Timeout)
mod_jk 590.32 258
mod_proxy 584.32 444

As you see, with an almost equal number of connections, mod_proxy fails approximately 59% more often.

If you have a small project, or need to hide a variety of application servers (Tomcat+Rails+Django), and if you need an easily configurable and fast SSL solution and your server load is not heavy, then use mod_proxy.

But if your goal is to loadbalance Java applications servers, then JK is definitely the better solution.

Share Now:del.icio.usDiggFacebookLinkedInBlinkListDZoneGoogle BookmarksRedditStumbleUponTwitterRSS

Read the original blog entry...

More Stories By Hovhannes Avoyan

Hovhannes Avoyan is the CEO of PicsArt, Inc.,

@ThingsExpo Stories
Internet of @ThingsExpo, taking place November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with the 19th International Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world and ThingsExpo Silicon Valley Call for Papers is now open.
It is one thing to build single industrial IoT applications, but what will it take to build the Smart Cities and truly society changing applications of the future? The technology won’t be the problem, it will be the number of parties that need to work together and be aligned in their motivation to succeed. In his Day 2 Keynote at @ThingsExpo, Henrik Kenani Dahlgren, Portfolio Marketing Manager at Ericsson, discussed how to plan to cooperate, partner, and form lasting all-star teams to change t...
Connected devices and the industrial internet are growing exponentially every year with Cisco expecting 50 billion devices to be in operation by 2020. In this period of growth, location-based insights are becoming invaluable to many businesses as they adopt new connected technologies. Knowing when and where these devices connect from is critical for a number of scenarios in supply chain management, disaster management, emergency response, M2M, location marketing and more. In his session at @Th...
Machine Learning helps make complex systems more efficient. By applying advanced Machine Learning techniques such as Cognitive Fingerprinting, wind project operators can utilize these tools to learn from collected data, detect regular patterns, and optimize their own operations. In his session at 18th Cloud Expo, Stuart Gillen, Director of Business Development at SparkCognition, discussed how research has demonstrated the value of Machine Learning in delivering next generation analytics to imp...
SYS-CON Events announced today that ReadyTalk, a leading provider of online conferencing and webinar services, has been named Vendor Presentation Sponsor at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. ReadyTalk delivers audio and web conferencing services that inspire collaboration and enable the Future of Work for today’s increasingly digital and mobile workforce. By combining intuitive, innovative tec...
Amazon has gradually rolled out parts of its IoT offerings, but these are just the tip of the iceberg. In addition to optimizing their backend AWS offerings, Amazon is laying the ground work to be a major force in IoT - especially in the connected home and office. In his session at @ThingsExpo, Chris Kocher, founder and managing director of Grey Heron, explained how Amazon is extending its reach to become a major force in IoT by building on its dominant cloud IoT platform, its Dash Button strat...
The cloud market growth today is largely in public clouds. While there is a lot of spend in IT departments in virtualization, these aren’t yet translating into a true “cloud” experience within the enterprise. What is stopping the growth of the “private cloud” market? In his general session at 18th Cloud Expo, Nara Rajagopalan, CEO of Accelerite, explored the challenges in deploying, managing, and getting adoption for a private cloud within an enterprise. What are the key differences between wh...
In his keynote at 18th Cloud Expo, Andrew Keys, Co-Founder of ConsenSys Enterprise, provided an overview of the evolution of the Internet and the Database and the future of their combination – the Blockchain. Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life sett...
19th Cloud Expo, taking place November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy. Meanwhile, 94% of enterpri...
SYS-CON Events announced today that Bsquare has been named “Silver Sponsor” of SYS-CON's @ThingsExpo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. For more than two decades, Bsquare has helped its customers extract business value from a broad array of physical assets by making them intelligent, connecting them, and using the data they generate to optimize business processes.
There are several IoTs: the Industrial Internet, Consumer Wearables, Wearables and Healthcare, Supply Chains, and the movement toward Smart Grids, Cities, Regions, and Nations. There are competing communications standards every step of the way, a bewildering array of sensors and devices, and an entire world of competing data analytics platforms. To some this appears to be chaos. In this power panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, Bradley Holt, Developer Advocate a...
Internet of @ThingsExpo, taking place November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 19th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The Internet of Things (IoT) is the most profound change in personal and enterprise IT since the creation of the Worldwide Web more than 20 years ago. All major researchers estimate there will be tens of billions devices - comp...
There is little doubt that Big Data solutions will have an increasing role in the Enterprise IT mainstream over time. Big Data at Cloud Expo - to be held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA - has announced its Call for Papers is open. Cloud computing is being adopted in one form or another by 94% of enterprises today. Tens of billions of new devices are being connected to The Internet of Things. And Big Data is driving this bus. An exponential increase is...
A strange thing is happening along the way to the Internet of Things, namely far too many devices to work with and manage. It has become clear that we'll need much higher efficiency user experiences that can allow us to more easily and scalably work with the thousands of devices that will soon be in each of our lives. Enter the conversational interface revolution, combining bots we can literally talk with, gesture to, and even direct with our thoughts, with embedded artificial intelligence, wh...
Cloud computing is being adopted in one form or another by 94% of enterprises today. Tens of billions of new devices are being connected to The Internet of Things. And Big Data is driving this bus. An exponential increase is expected in the amount of information being processed, managed, analyzed, and acted upon by enterprise IT. This amazing is not part of some distant future - it is happening today. One report shows a 650% increase in enterprise data by 2020. Other estimates are even higher....
Cognitive Computing is becoming the foundation for a new generation of solutions that have the potential to transform business. Unlike traditional approaches to building solutions, a cognitive computing approach allows the data to help determine the way applications are designed. This contrasts with conventional software development that begins with defining logic based on the current way a business operates. In her session at 18th Cloud Expo, Judith S. Hurwitz, President and CEO of Hurwitz & ...
In his general session at 18th Cloud Expo, Lee Atchison, Principal Cloud Architect and Advocate at New Relic, discussed cloud as a ‘better data center’ and how it adds new capacity (faster) and improves application availability (redundancy). The cloud is a ‘Dynamic Tool for Dynamic Apps’ and resource allocation is an integral part of your application architecture, so use only the resources you need and allocate /de-allocate resources on the fly.
The 19th International Cloud Expo has announced that its Call for Papers is open. Cloud Expo, to be held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA, brings together Cloud Computing, Big Data, Internet of Things, DevOps, Digital Transformation, Microservices and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding business opportuni...
industrial company for a multi-year contract initially valued at over $4.0 million. In addition to DataV software, Bsquare will also provide comprehensive systems integration, support and maintenance services. DataV leverages advanced data analytics, predictive reasoning, data-driven diagnostics, and automated orchestration of remediation actions in order to improve asset uptime while reducing service and warranty costs.
Vidyo, Inc., has joined the Alliance for Open Media. The Alliance for Open Media is a non-profit organization working to define and develop media technologies that address the need for an open standard for video compression and delivery over the web. As a member of the Alliance, Vidyo will collaborate with industry leaders in pursuit of an open and royalty-free AOMedia Video codec, AV1. Vidyo’s contributions to the organization will bring to bear its long history of expertise in codec technolo...