Performance tuning for web servers

Purging Modules

Apache HTTP comes with approximately 120 modules and has the capability to integrate many more third-party provider modules [6]. When operating a web server you should always keep in mind that additional modules usually consume additional RAM. For performance and security reasons, it makes sense to check activated modules (Listing 3) and deactivate unnecessary ones.

root@debian:~# apache2ctl -M
Loaded Modules:
 core_module (static)
 so_module (static)
 watchdog_module (static)
 http_module (static)
 log_config_module (static)
 logio_module (static)
 version_module (static)
 unixd_module (static)
 access_compat_module (shared)
 alias_module (shared)
 auth_basic_module (shared)
 authn_core_module (shared)
 authn_file_module (shared)
 authz_core_module (shared)
 authz_host_module (shared)
 authz_user_module (shared)
 autoindex_module (shared)
 deflate_module (shared)
 dir_module (shared)
 env_module (shared)
 filter_module (shared)
 mime_module (shared)
 mpm_prefork_module (shared)
 negotiation_module (shared)
 php5_module (shared)
 setenvif_module (shared)

Debian and Ubuntu users can activate and deactivate modules very easily with the a2enmod and a2dismod commands. Apache 2.4 is relatively uncluttered in a standard configuration. Another good thing is that Apache provides a warning if you try to turn off an essential module (Listing 4). When using CentOS and RHEL, modules are usually administered via the /etc/httpd/conf.d file.

root@debian:~# a2dismod mime
WARNING: The following essential module will be disabled.
This might result in unexpected behavior and should NOT be done
unless you know exactly what you are doing!
 mime
To continue type in the phrase 'Yes, do as I say!' or retry by \
  passing '-f':

DNS Lookups and KeepAlive

The HostnameLookups directive should definitely be set to No . This has been the default setting since Apache version 1.3. When this directive is activated, Apache will start a DNS reverse lookup for each web server connection, thereby causing unnecessary delay in the connection. Alternative means for resolving a DNS would be to use a piece of log analysis software or the Apache tool logresolve .

A similar situation arises with the Allow/Deny example.org directive or with Require host example.org , which is the syntax recommended by version 2.4. These directives also cause unnecessary DNS lookups. As a result, you should directly use an IP address for the directives, for example, Allow/Deny from 192.0.2.0 and Require ip 192.0.2.100 .

If you would like to keep host name lookups for specific files or directories, you can do so as follows.

HostnameLookups off
<Files ~ "\.(cgi)$">
  HostnameLookups on
</Files>

The KeepAlive directive activates keep alive connections by default. This allows a single TCP connection to process several requests. Problems can occur with this approach when the value for KeepAliveTimeout is too high, thereby generating too many queued processes and threads.