Kladskull's questions

I have been using HAProxy for about two years with the same working configuration. I've installed HaProxy multiple times over the last week on Ubuntu 14.04, 15.10 and I am getting out of Memory crashes in HaProxy. It no longer works. I have attached the configuration I have been using as well as the errors I am seeing in syslog below.

I do have some ubuntu servers that I created a couple months ago that run the same version of HAProxy that do work with the exact configuration, but not sure the best way to pinpoint the issue.

Version information:

HA-Proxy version 1.5.14 2015/07/02
Copyright 2000-2015 Willy Tarreau <[email protected]>

You can substitute www.mywebsite.com with anything such as www.cnn.com if you want to try it.

haproxy.cfg

global
    daemon
    maxconn 256000
    user haproxy
    group haproxy
    stats socket /var/run/haproxy.sock mode 0600 level admin
    pidfile /var/run/haproxy.pid
    spread-checks 5

defaults
    maxconn 256000
    log global
    option redispatch
    option allbackups
    option abortonclose
    option http-server-close
    timeout connect  5000
    timeout client   5000
    timeout server   5000
    timeout queue    5000
    timeout check    5000
    retries 2

# Statistics
listen stats :1936
    mode http
    stats enable
    stats hide-version
    stats realm Haproxy\ Statistics
    stats uri /
    stats auth myuser:mypass

# Front-end HTTP Rules
frontend f_http
    bind *:80
    mode http
    default_backend b_http_us

# Frontend HTTPS Rules
frontend f_https
    bind *:443
    mode tcp
    default_backend b_https_us

backend b_http_us
    mode http
    option accept-invalid-http-response
    balance roundrobin
    server www.mywebsite.com www.mywebsite.com:80 maxconn 100000 check inter 2s fastinter 2s downinter 2s

backend b_https_us
    mode tcp
    balance roundrobin
    server www.mywebsite.com www.mywebsite.com:443 maxconn 100000 check inter 2s fastinter 2s downinter 2s

Here is my syslog

Mar  8 10:42:05 www kernel: [  263.005325] gmain invoked oom-killer: gfp_mask=0x201da, order=0, oom_score_adj=0
Mar  8 10:42:05 www kernel: [  263.005331] gmain cpuset=/ mems_allowed=0
Mar  8 10:42:05 www kernel: [  263.005340] CPU: 0 PID: 581 Comm: gmain Not tainted 4.2.0-27-generic #32-Ubuntu
Mar  8 10:42:05 www kernel: [  263.005341] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
Mar  8 10:42:05 www kernel: [  263.005344]  0000000000000000 000000001c9253e8 ffff8800399bf958 ffffffff817eae99
Mar  8 10:42:05 www kernel: [  263.005347]  0000000000000000 ffff88003da1e040 ffff8800399bf9e8 ffffffff817e8c8f
Mar  8 10:42:05 www kernel: [  263.005349]  ffffffff810c43f1 0000000000000000 0000000000000001 0000000000000000
Mar  8 10:42:05 www kernel: [  263.005352] Call Trace:
Mar  8 10:42:05 www kernel: [  263.005364]  [<ffffffff817eae99>] dump_stack+0x45/0x57
Mar  8 10:42:05 www kernel: [  263.005367]  [<ffffffff817e8c8f>] dump_header+0x8c/0x214
Mar  8 10:42:05 www kernel: [  263.005374]  [<ffffffff810c43f1>] ? __raw_callee_save___pv_queued_spin_unlock+0x11/0x20
Mar  8 10:42:05 www kernel: [  263.005381]  [<ffffffff81185fa1>] oom_kill_process+0x1e1/0x3b0
Mar  8 10:42:05 www kernel: [  263.005383]  [<ffffffff81186726>] out_of_memory+0x556/0x5b0
Mar  8 10:42:05 www kernel: [  263.005399]  [<ffffffff8118c3c1>] __alloc_pages_nodemask+0x8c1/0xa10
Mar  8 10:42:05 www kernel: [  263.005406]  [<ffffffff811d37c1>] alloc_pages_current+0x91/0x100
Mar  8 10:42:05 www kernel: [  263.005409]  [<ffffffff81182510>] __page_cache_alloc+0xa0/0xc0
Mar  8 10:42:05 www kernel: [  263.005419]  [<ffffffff81211d90>] ? poll_select_copy_remaining+0x140/0x140
Mar  8 10:42:05 www kernel: [  263.005422]  [<ffffffff81184a4a>] filemap_fault+0x14a/0x3f0
Mar  8 10:42:05 www kernel: [  263.005425]  [<ffffffff81211d90>] ? poll_select_copy_remaining+0x140/0x140
Mar  8 10:42:05 www kernel: [  263.005430]  [<ffffffff811b0a80>] __do_fault+0x50/0xe0
Mar  8 10:42:05 www kernel: [  263.005433]  [<ffffffff811b5aab>] handle_mm_fault+0xf5b/0x17e0
Mar  8 10:42:05 www kernel: [  263.005440]  [<ffffffff81067a87>] __do_page_fault+0x197/0x400
Mar  8 10:42:05 www kernel: [  263.005442]  [<ffffffff81067d57>] trace_do_page_fault+0x37/0xa0
Mar  8 10:42:05 www kernel: [  263.005446]  [<ffffffff8105fe19>] do_async_page_fault+0x19/0x70
Mar  8 10:42:05 www kernel: [  263.005451]  [<ffffffff817f3bf8>] async_page_fault+0x28/0x30
Mar  8 10:42:05 www kernel: [  263.005453] Mem-Info:
Mar  8 10:42:05 www kernel: [  263.005457] active_anon:203766 inactive_anon:36 isolated_anon:0
Mar  8 10:42:05 www kernel: [  263.005457]  active_file:25 inactive_file:22 isolated_file:0
Mar  8 10:42:05 www kernel: [  263.005457]  unevictable:0 dirty:1 writeback:0 unstable:0
Mar  8 10:42:05 www kernel: [  263.005457]  slab_reclaimable:11917 slab_unreclaimable:32447
Mar  8 10:42:05 www kernel: [  263.005457]  mapped:31 shmem:138 pagetables:849 bounce:0
Mar  8 10:42:05 www kernel: [  263.005457]  free:1947 free_pcp:96 free_cma:0
Mar  8 10:42:05 www kernel: [  263.005461] Node 0 DMA free:3960kB min:60kB low:72kB high:88kB active_anon:10040kB inactive_anon:4kB active_file:0kB inactive_file:4kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:15992kB managed:15908kB mlocked:0kB dirty:0kB writeback:0kB mapped:4kB shmem:20kB slab_reclaimable:432kB slab_unreclaimable:1188kB kernel_stack:0kB pagetables:96kB unstable:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB writeback_tmp:0kB pages_scanned:28 all_unreclaimable? yes
Mar  8 10:42:05 www kernel: [  263.005466] lowmem_reserve[]: 0 975 975 975
Mar  8 10:42:05 www kernel: [  263.005468] Node 0 DMA32 free:3828kB min:3828kB low:4784kB high:5740kB active_anon:805024kB inactive_anon:140kB active_file:100kB inactive_file:84kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:1032184kB managed:1000836kB mlocked:0kB dirty:4kB writeback:0kB mapped:120kB shmem:532kB slab_reclaimable:47236kB slab_unreclaimable:128600kB kernel_stack:1248kB pagetables:3300kB unstable:0kB bounce:0kB free_pcp:384kB local_pcp:384kB free_cma:0kB writeback_tmp:0kB pages_scanned:1116 all_unreclaimable? yes
Mar  8 10:42:05 www kernel: [  263.005473] lowmem_reserve[]: 0 0 0 0
Mar  8 10:42:05 www kernel: [  263.005475] Node 0 DMA: 2*4kB (EM) 11*8kB (UM) 4*16kB (UEM) 1*32kB (E) 1*64kB (U) 1*128kB (U) 0*256kB 1*512kB (E) 1*1024kB (E) 1*2048kB (M) 0*4096kB = 3968kB
Mar  8 10:42:05 www kernel: [  263.005485] Node 0 DMA32: 9*4kB (UE) 2*8kB (EM) 66*16kB (M) 85*32kB (UEM) 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 3828kB
Mar  8 10:42:05 www kernel: [  263.005493] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
Mar  8 10:42:05 www kernel: [  263.005494] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB
Mar  8 10:42:05 www kernel: [  263.005495] 182 total pagecache pages
Mar  8 10:42:05 www kernel: [  263.005497] 0 pages in swap cache
Mar  8 10:42:05 www kernel: [  263.005499] Swap cache stats: add 0, delete 0, find 0/0
Mar  8 10:42:05 www kernel: [  263.005499] Free swap  = 0kB
Mar  8 10:42:05 www kernel: [  263.005500] Total swap = 0kB
Mar  8 10:42:05 www kernel: [  263.005501] 262044 pages RAM
Mar  8 10:42:05 www kernel: [  263.005502] 0 pages HighMem/MovableOnly
Mar  8 10:42:05 www kernel: [  263.005503] 7858 pages reserved
Mar  8 10:42:05 www kernel: [  263.005503] 0 pages cma reserved
Mar  8 10:42:05 www kernel: [  263.005504] 0 pages hwpoisoned
Mar  8 10:42:05 www kernel: [  263.005505] [ pid ]   uid  tgid total_vm      rss nr_ptes nr_pmds swapents oom_score_adj name
Mar  8 10:42:05 www kernel: [  263.005510] [  204]     0   204     8826       85      23       3        0             0 systemd-journal
Mar  8 10:42:05 www kernel: [  263.005512] [  210]     0   210    10945      148      24       3        0         -1000 systemd-udevd
Mar  8 10:42:05 www kernel: [  263.005514] [  334]   100   334    25074       64      20       3        0             0 systemd-timesyn
Mar  8 10:42:05 www kernel: [  263.005516] [  542]     0   542     7286       56      20       3        0             0 cron
Mar  8 10:42:05 www kernel: [  263.005518] [  564]     0   564    70809      187      43       3        0             0 accounts-daemon
Mar  8 10:42:05 www kernel: [  263.005520] [  575]     0   575     7155       77      18       3        0             0 systemd-logind
Mar  8 10:42:05 www kernel: [  263.005521] [  577]   104   577    64093      161      28       3        0             0 rsyslogd
Mar  8 10:42:05 www kernel: [  263.005523] [  585]   105   585    10712      112      26       3        0          -900 dbus-daemon
Mar  8 10:42:05 www kernel: [  263.005534] [  658]     0   658    17482      187      37       3        0         -1000 sshd
Mar  8 10:42:05 www kernel: [  263.005537] [  662]     0   662     4024       37      13       3        0             0 agetty
Mar  8 10:42:05 www kernel: [  263.005539] [  713]     0   713     1056       19       7       3        0             0 haproxy-systemd
Mar  8 10:42:05 www kernel: [  263.005540] [  716]   108   716    15492     1223      26       3        0             0 haproxy
Mar  8 10:42:05 www kernel: [  263.005542] [  717]   108   717   212748   200030     411       3        0             0 haproxy
Mar  8 10:42:05 www kernel: [  263.005544] [  718]     0   718    24943      244      49       3        0             0 sshd
Mar  8 10:42:05 www kernel: [  263.005546] [  720]     0   720     9184      202      23       3        0             0 systemd
Mar  8 10:42:05 www kernel: [  263.005547] [  721]     0   721    14719      419      33       3        0             0 (sd-pam)
Mar  8 10:42:05 www kernel: [  263.005549] [  740]     0   740     5615      402      15       3        0             0 bash
Mar  8 10:42:05 www kernel: [  263.005551] [  761]     0   761     1876       19       9       3        0             0 tail
Mar  8 10:42:05 www kernel: [  263.005552] Out of memory: Kill process 717 (haproxy) score 788 or sacrifice child
Mar  8 10:42:05 www kernel: [  263.005612] Killed process 717 (haproxy) total-vm:850992kB, anon-rss:800120kB, file-rss:0kB
Mar  8 10:42:06 www systemd[1]: haproxy.service: Service hold-off time over, scheduling restart.
Mar  8 10:42:06 www systemd[1]: Stopped HAProxy Load Balancer.
Mar  8 10:42:06 www systemd[1]: Starting HAProxy Load Balancer...
Mar  8 10:42:06 www systemd[1]: Started HAProxy Load Balancer.

We're running a private recursive DNS (bind 9.10.3) for a small group of people outside our network to speed-up their browsing speed. I've noticed recently that our server is answering queries with ".local" or ".home" attached to some of the inbound queries as well as some queries coming in for "local" or even "home" without any other data, here is an example from our logs (1.2.3.4 is our DNS)

Oct 20 09:36:28 dns1 named[3080]: client X.X.X.X#50315 (somethingrandom.local): view someview: query: somethingrandom.local IN A + (1.2.3.4)
Oct 20 09:36:38 dns1 named[3080]: client X.X.X.X#50315 (somethingrandom.local): view someview: query: somethingrandom.home IN A + (1.2.3.4)
Oct 20 09:36:55 dns1 named[3080]: client X.X.X.X#57750 (local): view someview: query: local IN SOA + (1.2.3.4)
Oct 20 09:36:59 dns1 named[3080]: client X.X.X.X#49441 (local): view someview: query: local IN SOA + (1.2.3.4)
Oct 20 09:37:01 dns1 named[3080]: client X.X.X.X#53231 (local): view someview: query: local IN SOA + (1.2.3.4)

I did a dig to the server to see what response is being returned, and am pretty sure the response below is exactly correct, however I am not 100% sure. The dig is below, just need someone to confirm it looks the way it should - we don't want to answer anything on localhost or localnet (which is in place now).

> dig @ourdns local

Answer:

; <<>> DiG 9.10.3 <<>> @dns1 local
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 4495
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;local.             IN  A

;; AUTHORITY SECTION:
.           85530   IN  SOA a.root-servers.net. nstld.verisign-grs.com. 2015102000 1800 900 604800 86400

;; Query time: 17 msec
;; SERVER: 1.2.3.4#53(1.2.3.4)
;; WHEN: Tue Oct 20 13:00:17 EDT 2015
;; MSG SIZE  rcvd: 109

How would I go about setting up an A record for in Bind9 for any negative queries? I want to forward our staff to an informational page if they were to visit a non existent domain. We have an internal caching server.

I have two bind9 servers that are not setup with duplicate settings and know nothing about each other. Our CPU usage is sitting around 7% - 10%: mostly bind, which I believe is perfectly in range for our load. However, CPU usage is slowly growing increasing every week and I estimate that I have at least 4-5 months before this becomes an issue. Just want a clarification - would a Master/Slave setup reduce CPU on the slave?

We are using the service as a forwarding server allowing IP ACL based recursive look-ups. The only fail over is the fact that our DNS users input both DNS addresses in their setup. It doesn't do dynamic updates, we have a small list of DNS records that get changed maybe once or twice a quarter.

We have two DNS servers that are restarted frequently to update ACL lists. The two servers are independent, and we have the second DNS server set to update its ACL lists 5 seconds after the first one restarts. These servers are setup completely independent and we have them using the same data without issues. This is most definitely not the way to do things, but having two independent DNS Servers with the same settings/records seems to work fine. With the 5 seconds delay, we never see any outages. I included my reboot script below for an opinion as well - I fold all the TCP packets while it restarts... but with a second DNS server, do I need to even do this?

I am wondering if it would perform better if we made the second DNS server a slave and have it take its settings from the Master.

#!/bin/sh
/sbin/iptables -I INPUT -p tcp --dport 53 --syn -j DROP
/bin/sleep 1

# gracefully restart haproxy
/usr/sbin/service bind9 restart

# allow new requests to come in again
/sbin/iptables -D INPUT -p tcp --dport 53 --syn -j DROP

I put this script together from various places. What I am hoping is that it will do the following once run:

1. Pause all "NEW" http traffic for ports 80 and 443 - just "pause" them, don't give any error
2. gracefully restart haproxy when all "in process" requests are completed
3. Un pause the http traffic and continue business as usual.

Is this how it will run? Have i missed anything? We have thousands of acl rules based on ip, stored in a file that haproxy references and we need to reload it several times a minute.

#!/bin/sh

# hold/pause new requests
iptables -I INPUT -p tcp --dport 80 --syn -j DROP
iptables -I INPUT -p tcp --dport 443 --syn -j DROP
sleep 1

# gracefully restart haproxy
/usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg -p /var/run/haproxy.pid -sf $(cat /var/run/haproxy.pid)

# allow new requests to come in again
iptables -D INPUT -p tcp --dport 80 --syn -j DROP
iptables -D INPUT -p tcp --dport 443 --syn -j DROP

Edit: I'd love to somehow test it, but we don't have any traffic as of yet (with the exception of me testing).

Sources:

http://www.forouzani.com/reload-haproxy-cfg-without-restarting.html

https://github.com/Mirantis/openstack-lbaas/issues/3

HAProxy graceful reload with zero packet loss

I will be adding and removing entries to the script below automatically (adding ports 80/443 with different IP addresses). If I run this script, I am "assuming" that connections will be uninterrupted, unless however I remove an IP. Am I correct in this thought?

Here is my script:

iptables --flush
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -p tcp --dport ssh -j ACCEPT

iptables -A INPUT -p tcp --dport  80 -s 1.2.3.4 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 1.2.3.4 -j ACCEP

iptables -A INPUT -p tcp --dport 80 -j DROPT
iptables -A INPUT -p tcp --dport 443 -j DROP

iptables -A INPUT -j DROP
iptables -A OUTPUT -j ACCEPT
iptables -A INPUT -j LOG
iptables -A INPUT -j REJECT

We are using Dnsmasq, we have several entries that are working well. What we are looking for is to return a different config file for specific ip addresses.

i.e: When ever ip 1.2.3.4 connects, it will use this table:

address=/widgits.com/2.2.2.2
address=/x.widgits.com/2.2.2.22

When ever ip 2.3.4.5 connects, it will use this table:

address=/widgits.com/3.3.3.3
address=/x.widgits.com/3.3.3.33

Other than modifying dnsmasq, are there any options out there?

Update: Just wanted to add that we have over 10,000 ip addresses (on the asme interface) that would be split into two groups, and we have up to 300 changes a day that need to be done in real time.

I'm guessing there has to be a reasonable way to solve my issue but I'm trying to get some advice on a best practice to implement.

I have recently moved to a Web Design company and we need to be able to spoof DNS entries for websites we're working on. However we want to only override certain A records, but keep the others so the site seems to work.

i.e: We want to make "support.abcd.com" resolve locally, but everything else go to the real site. This would allow us to design/demo a fully functioning site with only the work in progress locally.

We have an internal BIND DNS server (9.9.5.dfsg-3).

What should my zone file look for "abcd.com" based on the example above?

Edit: Would this work?

          IN ns1
abcd.com. IN NS ns1
support.abcd.com. IN A 192.168.1.1
faq.abcd.com.     IN A 192.168.1.1
*.abcd.com.       IN NS abcd.com     <- External?

Just finished a Nessus scan and the only thing that came back was "TCP/IP Sequence Prediction Blind Reset Spoofing DoS" - It may be possible to send spoofed RST packets to the remote system.

Description: The remote host might be affected by a sequence number approximation vulnerability that may allow an attacker to send spoofed RST packets to the remote host and close established connections. This may cause problems for some dedicated services (BGP, a VPN over TCP, etc).

I am using ubuntu 12.04, how can I patch or prevent this issue?

Followed these instructions to install s3fs on Amazon Linux.

It worked fine on one of my systems, however on a different system (following the same instructions) I am getting the following errors when running /bin/mount

[root@ip-10-99-1-35 lib64]# mount
mount: /lib64/libmount.so.1: version `MOUNT_2.21' not found (required by mount)
mount: /lib64/libmount.so.1: version `MOUNT_2.22' not found (required by mount)
mount: /lib64/libmount.so.1: version `MOUNT_2.20' not found (required by mount)

EDIT: I should mention, it was only getting one of the errors above (the 2.20), however, I tried installing the util-linux source package for versions v2.21, and v2.22 when I started running into problems.

Running ldd on mount, I get this

[root@ip-10-99-1-35 lib64]# ldd /bin/mount
/bin/mount: /lib64/libmount.so.1: version `MOUNT_2.21' not found (required by /bin/mount)
/bin/mount: /lib64/libmount.so.1: version `MOUNT_2.22' not found (required by /bin/mount)
/bin/mount: /lib64/libmount.so.1: version `MOUNT_2.20' not found (required by /bin/mount)
    linux-vdso.so.1 =>  (0x00007fff507ff000)
    libmount.so.1 => /lib64/libmount.so.1 (0x00007f5e9331a000)
    libblkid.so.1 => /lib64/libblkid.so.1 (0x00007f5e930f9000)
    libuuid.so.1 => /lib64/libuuid.so.1 (0x00007f5e92ef4000)
    libc.so.6 => /lib64/libc.so.6 (0x00007f5e92b62000)
    /lib64/ld-linux-x86-64.so.2 (0x00007f5e93533000)

The appropriate files in /lib64

lrwxrwxrwx 1 root root     17 Jul 30 15:25 /lib64/libmount.so.1 -> libmount.so.1.1.0
-rwxr-xr-x 1 root root  61728 Jul 28  2011 /lib64/libmount.so.1.1.0

Distro Info

[ec2-user@ip-10-99-1-35 ~]$ cat /etc/issue
Amazon Linux AMI release 2012.03
Kernel \r on an \m

[ec2-user@ip-10-99-1-35 ~]$ uname -a
Linux ip-10-99-1-35 3.2.20-1.29.6.amzn1.x86_64 #1 SMP Tue Jun 12 01:19:28 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux

We are trying to mirror a volumes over a geographical zone using DRBD (and Ubuntu 11.10). We are using elastic IP's - however there is no local interface for Elastic IP's - only an interface for a local IP. Thus, DRBD will not work as it needs an interface.

I've thought about using VIP or VPN to be able to use local IP's, but that would degrade the connection as its another layer.

Any thoughts or ideas?

          [US EAST 1]                             [US WEST 1]
[EC2-INSTANCE] -> [ELASTIC-IP] -> DRBD <- [ELASTIC-IP] <- [EC2-INSTANCE]
       *no eth interface*                     *no eth interface*

Edit: Alternative solutions (to DRBD/Clustering/Replciating) are more than welcome!

Edit 2:

Client connecting to address.com, TCP port 5001

TCP window size: 16.0 KByte (default)

[ 3] local 10.160.27.107 port 59254 connected with 107.21.118.27 port 5001 [ ID] Interval Transfer Bandwidth [ 3] 0.0-10.0 sec 44.1 MBytes 36.9 Mbits/sec

(Mbits/sec was 25 to 36)

Some version info:

Operating system is Ubuntu 11.10, on EC2, kernel is 3.0.0-16-virtual and the application info is:

Version: 8.3.11 (api:88)
GIT-hash: 0de839cee13a4160eed6037c4bddd066645e23c5 build by buildd@allspice, 2011-07-05 19:51:07

Getting some strange errors in dmesg (seen below) as well, there is no replication happening. I have made my first node primary and its showing:

drbd driver loaded OK; device status:
version: 8.3.11 (api:88/proto:86-96)
srcversion: DA5A13F16DE6553FC7CE9B2 
m:res  cs          ro               ds                 p       mounted  fstype
0:r0   StandAlone  Primary/Unknown  UpToDate/DUnknown  r----s  ext3

my secondary node is showing:

drbd driver loaded OK; device status:
version: 8.3.11 (api:88/proto:86-96)
srcversion: DA5A13F16DE6553FC7CE9B2 
m:res  cs          ro                 ds                     p       mounted  fstype
0:r0   StandAlone  Secondary/Unknown  Inconsistent/DUnknown  r----s

Showing /proc/drbd on the master shows:

version: 8.3.11 (api:88/proto:86-96)
srcversion: DA5A13F16DE6553FC7CE9B2 
 0: cs:StandAlone ro:Primary/Unknown ds:UpToDate/DUnknown   r----s
    ns:0 nr:0 dw:4 dr:1073 al:0 bm:0 lo:0 pe:0 ua:0 ap:0 ep:1 wo:f oos:262135964

Showing /proc/drbd on the slave shows that there is nothing being transfered...

version: 8.3.11 (api:88/proto:86-96)
srcversion: DA5A13F16DE6553FC7CE9B2 
 0: cs:StandAlone ro:Secondary/Unknown ds:Inconsistent/DUnknown   r----s
    ns:0 nr:0 dw:0 dr:0 al:0 bm:0 lo:0 pe:0 ua:0 ap:0 ep:1 wo:f oos:262135964

Here is my config...

resource r0 {
    protocol C;
    startup {
        wfc-timeout  15;
        degr-wfc-timeout 60;
    }
    net {
        cram-hmac-alg sha1;
        shared-secret "test123;
    }
    on drbd01 {
        device /dev/drbd0;
        disk /dev/xvdm;
        address 23.XX.XX.XX:7788; # blocked out ip
        meta-disk internal;
    }
    on drbd02 {
        device /dev/drbd0;
        disk /dev/xvdm;
        address 184.XX.XX.XX:7788; #blocked out ip
        meta-disk internal;
    }
} 

I have run the following on the master:

sudo drbdadm -- --overwrite-data-of-peer primary all

There is no firewall between the systems.

Here is the dmesg with some errors:

[2285172.969955] drbd: initialized. Version: 8.3.11 (api:88/proto:86-96)
[2285172.969960] drbd: srcversion: DA5A13F16DE6553FC7CE9B2 
[2285172.969962] drbd: registered as block device major 147
[2285172.969965] drbd: minor_table @ 0xffff88000276ea00
[2285173.000952] block drbd0: Starting worker thread (from drbdsetup [1300])
[2285173.003971] block drbd0: disk( Diskless -> Attaching ) 
[2285173.006150] block drbd0: No usable activity log found.
[2285173.006154] block drbd0: Method to ensure write ordering: flush
[2285173.006158] block drbd0: max BIO size = 4096
[2285173.006165] block drbd0: drbd_bm_resize called with capacity == 524271928
[2285173.008512] block drbd0: resync bitmap: bits=65533991 words=1023969 pages=2000
[2285173.008518] block drbd0: size = 250 GB (262135964 KB)
[2285173.079566] block drbd0: bitmap READ of 2000 pages took 17 jiffies
[2285173.081189] block drbd0: recounting of set bits took additional 1 jiffies
[2285173.081194] block drbd0: 250 GB (65533991 bits) marked out-of-sync by on disk bit-map.
[2285173.081203] block drbd0: Suspended AL updates
[2285173.081210] block drbd0: disk( Attaching -> UpToDate ) 
[2285173.081214] block drbd0: attached to UUIDs 1C1291D39584C1D1:0000000000000004:0000000000000000:0000000000000000
[2285173.095016] block drbd0: conn( StandAlone -> Unconnected ) 
[2285173.095046] block drbd0: Starting receiver thread (from drbd0_worker [1301])
[2285173.099297] block drbd0: receiver (re)started
[2285173.099304] block drbd0: conn( Unconnected -> WFConnection ) 
[2285173.099330] block drbd0: bind before connect failed, err = -99
[2285173.099346] block drbd0: conn( WFConnection -> Disconnecting ) 
[2285173.295788] block drbd0: Discarding network configuration.
[2285173.295815] block drbd0: Connection closed
[2285173.295826] block drbd0: conn( Disconnecting -> StandAlone ) 
[2285173.295840] block drbd0: receiver terminated
[2285173.295844] block drbd0: Terminating drbd0_receiver

Edit:

Reading some other similar issues, it was suggested to do a 'drbdadm dump all', so I figured it couldn't hurt.

ubuntu@drbd01:~$ drbdadm dump all
/etc/drbd.conf:19: in resource r0, on drbd01:
    IP 23.XX.XX.XX not found on this host.

and on slave:

root@drbd02:~# drbdadm dump all
/etc/drbd.conf:25: in resource r0, on drbd02:
    IP 184.XX.XX.XX not found on this host.

Strange it doesn't find its own ip, however, this is an Amazon EC2 system using an elastic IP... here are my ipconfigs for both...

master:

ubuntu@drbd01:~$ ifconfig
eth0      Link encap:Ethernet  HWaddr 22:00:0a:1c:27:11  
          inet addr:10.28.39.17  Bcast:10.28.39.63  Mask:255.255.255.192
          inet6 addr: fe80::2000:aff:fe1c:2711/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1569 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1169 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:124409 (124.4 KB)  TX bytes:213601 (213.6 KB)
          Interrupt:26 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

slave:

root@drbd02:~# ifconfig
eth0      Link encap:Ethernet  HWaddr 12:31:3f:00:14:9d  
          inet addr:10.160.27.107  Bcast:10.160.27.255  Mask:255.255.254.0
          inet6 addr: fe80::1031:3fff:fe00:149d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:915 errors:0 dropped:0 overruns:0 frame:0
          TX packets:774 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:75381 (75.3 KB)  TX bytes:109673 (109.6 KB)
          Interrupt:26 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

I followed these instructions precisely (I've done this from scratch using 11.04 and 11.10 with the same results using AMI's )

(using 11.04) Community AMI: ami-e016ca89 https://help.ubuntu.com/11.04/serverguide/C/drbd.html and (using 11.10) Community AMI: ami-baba68d3 https://help.ubuntu.com/11.10/serverguide/C/drbd.html

I am getting the following error when starting the process:

root@drbd01:~# sudo /etc/init.d/drbd start
 * Starting DRBD resources                                                                                            Can not load the drbd module.

Created a volume (on both versions) 250gb Volume, attached as /dev/xvdm

Here is my config file:

global { usage-count no; }
common { syncer { rate 100M; } }
resource r0 {
        protocol C;
        startup {
                wfc-timeout  15;
                degr-wfc-timeout 60;
        }
        net {
                cram-hmac-alg sha1;
                shared-secret "secret";
        }
        on drbd01 {
                device /dev/drbd0;
                disk xvdm;
                address -MY AWS PUBLIC ELASTIC IP WAS HERE-:7788;
                meta-disk internal;
        }
        on drbd02 {
                device /dev/drbd0;
                disk /dev/xvdm;
                address -MY AWS PUBLIC ELASTIC IP WAS HERE-:7788;
                meta-disk internal;
        }
} 

Here is my iptables, how can I make it so that I can allow a range of ip's on ETH1 (10.51.x.x)

# Generated by iptables-save v1.4.4 on Thu Jul  8 13:00:14 2010
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:fail2ban-ssh - [0:0]
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh 
-A INPUT -i lo -j ACCEPT 
-A INPUT -d 127.0.0.0/8 ! -i lo -j REJECT --reject-with icmp-port-unreachable 
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT 
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT 
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT 
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7 
-A INPUT -j REJECT --reject-with icmp-port-unreachable 
-A FORWARD -j REJECT --reject-with icmp-port-unreachable 
-A OUTPUT -j ACCEPT 
-A fail2ban-ssh -j RETURN 
COMMIT

We're Looking at creating a large fax farm via T.38 (Fax over Voip - hundreds of incoming and outgoing faxes) on linux servers, anyone have any suggestions on what is available? All my searches return using Asterisk 1.6.x with a commercial product from Digium called "Fax for Asterisk" (with required purchase of "channels" at $38.00 per channel). There must be an open source project out there I can't seem to find.

Suggestions welcome!

Here is some additional info: We're using Ubuntu 9.10, and planning to use T.38

If I have missed anything, let me know.

So I have 2 IP Addresses, and running apache on ipaddress #1 (www.server.com). What I was thinking, was pointing static.server.om to ipaddress #2, and running lighthttpd for images and javascript.

Does this sound normal? I want to make sure my images and javascript are served quickly and cookieless.

I am using CentOS 5 with Plesk 9 (64-bit), I am running a site where users will be uploading pictures. With a 64 bit os, are there any limits to how many files I can store? All I care about is performance, and serving up the files. I'd prefer not to have 4 directories deep of scattered files. However, I am hoping, that at some point I could have 200-300 thousand images.

I am almost completed on my website, its similar to facebook. I am expecting to have perhaps 500-600 people my first month. It's a LAMP Setup. the users images aren't too big (<20kb after I compress them, and its just really blogs and member searches)

Looking for some advice:

1) Should I use my 2 Dell Poweredge servers one a Mysql server, and the other the Apache server (specs: dual pentium III 800mhz, 1gb ram, Raid 5 and 2 Network cards, 130gb space) and host my site from my house until I get enough traffic to justify $100/month on co-location hosting. (I have cable internet) (Free, but typical cable bandwidth 65ms ping, 3megabits down, 0.7 megabits up)

2) Use my VPS III account at 1 & 1 (quad core amd (faster than my piii's), etc.. 1gb ram, 4gb burstable, 50gb space, can handle the traffice if needed, and never down) $60.00/month

3) Get a dedicated server with similar specs to #2, though there would be about 100gb space. $300?month.

My budget is less than $80.00 a month until I have money coming in from it.

Edit: I am pretty sure my .htaccess file is NOT being executed, and the problem is NOT with my rewrite rules.

I have not having any luck getting my .htaccess with mod_rewrite working. Basically all I am trying to do is remove 'www' from "http://www.site.com" and "https://www.site.com".

If there is anything I am missing (conf files, etc let me know I willl update this)

I jsut can't see whats wrong here... I am using a 1&1 VPS III Virtual private server... anyone ever have this issue?

I am using Ubuntu 8.04 Server LTS.

Here is my .htaccess file (located @ /var/www/site/trunk/html/)

Options +FollowSymLinks
RewriteEngine on
RewriteCond %{HTTP_HOST} ^www\.(.*) [NC]
RewriteRule (.*) //%1/$1 [L,R=301]

My mod_rewrite is enabled:

The auto regenerated sym link is there in mods-available and /usr/lib/apache2/modules/ contains mod_rewrite.so

root@s15348441:/etc/apache2/mods-available# more rewrite.load
LoadModule rewrite_module /usr/lib/apache2/modules/mod_rewrite.so


root@s15348441:/var/log# apache2ctl -t -D DUMP_MODULES
Loaded Modules:
 core_module (static)
 log_config_module (static)
 logio_module (static)
 mpm_prefork_module (static)
 http_module (static)
 so_module (static)
 alias_module (shared)
 auth_basic_module (shared)
 authn_file_module (shared)
 authz_default_module (shared)
 authz_groupfile_module (shared)
 authz_host_module (shared)
 authz_user_module (shared)
 autoindex_module (shared)
 cgi_module (shared)
 dir_module (shared)
 env_module (shared)
 mime_module (shared)
 negotiation_module (shared)
 php5_module (shared)
 rewrite_module (shared)
 setenvif_module (shared)
 ssl_module (shared)
 status_module (shared)
Syntax OK

My apache config files:

apache2.conf

#
# Based upon the NCSA server configuration files originally by Rob McCool.
#
# This is the main Apache server configuration file.  It contains the
# configuration directives that give the server its instructions.
# See http://httpd.apache.org/docs/2.2/ for detailed information about
# the directives.
#
# Do NOT simply read the instructions in here without understanding
# what they do.  They're here only as hints or reminders.  If you are unsure
# consult the online docs. You have been warned.  
#
# The configuration directives are grouped into three basic sections:
#  1. Directives that control the operation of the Apache server process as a
#     whole (the 'global environment').
#  2. Directives that define the parameters of the 'main' or 'default' server,
#     which responds to requests that aren't handled by a virtual host.
#     These directives also provide default values for the settings
#     of all virtual hosts.
#  3. Settings for virtual hosts, which allow Web requests to be sent to
#     different IP addresses or hostnames and have them handled by the
#     same Apache server process.
#
# Configuration and logfile names: If the filenames you specify for many
# of the server's control files begin with "/" (or "drive:/" for Win32), the
# server will use that explicit path.  If the filenames do *not* begin
# with "/", the value of ServerRoot is prepended -- so "/var/log/apache2/foo.log"
# with ServerRoot set to "" will be interpreted by the
# server as "//var/log/apache2/foo.log".
#

### Section 1: Global Environment
#
# The directives in this section affect the overall operation of Apache,
# such as the number of concurrent requests it can handle or where it
# can find its configuration files.
#

#
# ServerRoot: The top of the directory tree under which the server's
# configuration, error, and log files are kept.
#
# NOTE!  If you intend to place this on an NFS (or otherwise network)
# mounted filesystem then please read the LockFile documentation (available
# at <URL:http://httpd.apache.org/docs-2.1/mod/mpm_common.html#lockfile>);
# you will save yourself a lot of trouble.
#
# Do NOT add a slash at the end of the directory path.
#
ServerRoot "/etc/apache2"

#
# The accept serialization lock file MUST BE STORED ON A LOCAL DISK.
#
#<IfModule !mpm_winnt.c>
#<IfModule !mpm_netware.c>
LockFile /var/lock/apache2/accept.lock
#</IfModule>
#</IfModule>

#
# PidFile: The file in which the server should record its process
# identification number when it starts.
# This needs to be set in /etc/apache2/envvars
#
PidFile ${APACHE_PID_FILE}

#
# Timeout: The number of seconds before receives and sends time out.
#
Timeout 300

#
# KeepAlive: Whether or not to allow persistent connections (more than
# one request per connection). Set to "Off" to deactivate.
#
KeepAlive On

#
# MaxKeepAliveRequests: The maximum number of requests to allow
# during a persistent connection. Set to 0 to allow an unlimited amount.
# We recommend you leave this number high, for maximum performance.
#
MaxKeepAliveRequests 100

#
# KeepAliveTimeout: Number of seconds to wait for the next request from the
# same client on the same connection.
#
KeepAliveTimeout 15

##
## Server-Pool Size Regulation (MPM specific)
## 

# prefork MPM
# StartServers: number of server processes to start
# MinSpareServers: minimum number of server processes which are kept spare
# MaxSpareServers: maximum number of server processes which are kept spare
# MaxClients: maximum number of server processes allowed to start
# MaxRequestsPerChild: maximum number of requests a server process serves
<IfModule mpm_prefork_module>
    StartServers          5
    MinSpareServers       5
    MaxSpareServers      10
    MaxClients          150
    MaxRequestsPerChild   0
</IfModule>

# worker MPM
# StartServers: initial number of server processes to start
# MaxClients: maximum number of simultaneous client connections
# MinSpareThreads: minimum number of worker threads which are kept spare
# MaxSpareThreads: maximum number of worker threads which are kept spare
# ThreadsPerChild: constant number of worker threads in each server process
# MaxRequestsPerChild: maximum number of requests a server process serves
<IfModule mpm_worker_module>
    StartServers          2
    MaxClients          150
    MinSpareThreads      25
    MaxSpareThreads      75 
    ThreadsPerChild      25
    MaxRequestsPerChild   0
</IfModule>

# These need to be set in /etc/apache2/envvars
User ${APACHE_RUN_USER}
Group ${APACHE_RUN_GROUP}

#
# AccessFileName: The name of the file to look for in each directory
# for additional configuration directives.  See also the AllowOverride
# directive.
#

AccessFileName .htaccess

#
# The following lines prevent .htaccess and .htpasswd files from being 
# viewed by Web clients. 
#
<Files ~ "^\.ht">
    Order allow,deny
    Deny from all
</Files>

#
# DefaultType is the default MIME type the server will use for a document
# if it cannot otherwise determine one, such as from filename extensions.
# If your server contains mostly text or HTML documents, "text/plain" is
# a good value.  If most of your content is binary, such as applications
# or images, you may want to use "application/octet-stream" instead to
# keep browsers from trying to display binary files as though they are
# text.
#
DefaultType text/plain


#
# HostnameLookups: Log the names of clients or just their IP addresses
# e.g., www.apache.org (on) or 204.62.129.132 (off).
# The default is off because it'd be overall better for the net if people
# had to knowingly turn this feature on, since enabling it means that
# each client request will result in AT LEAST one lookup request to the
# nameserver.
#
HostnameLookups Off

# ErrorLog: The location of the error log file.
# If you do not specify an ErrorLog directive within a <VirtualHost>
# container, error messages relating to that virtual host will be
# logged here.  If you *do* define an error logfile for a <VirtualHost>
# container, that host's errors will be logged there and not here.
#
ErrorLog /var/log/apache2/error.log

#
# LogLevel: Control the number of messages logged to the error_log.
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
#
LogLevel warn

# Include module configuration:
Include /etc/apache2/mods-enabled/*.load
Include /etc/apache2/mods-enabled/*.conf

# Include all the user configurations:
Include /etc/apache2/httpd.conf

# Include ports listing
Include /etc/apache2/ports.conf

#
# The following directives define some format nicknames for use with
# a CustomLog directive (see below).
# If you are behind a reverse proxy, you might want to change %h into %{X-Forwarded-For}i
#
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent

#
# ServerTokens
# This directive configures what you return as the Server HTTP response
# Header. The default is 'Full' which sends information about the OS-Type
# and compiled in modules.
# Set to one of:  Full | OS | Minor | Minimal | Major | Prod
# where Full conveys the most information, and Prod the least.
#
ServerTokens Full

#
# Optionally add a line containing the server version and virtual host
# name to server-generated pages (internal error documents, FTP directory 
# listings, mod_status and mod_info output etc., but not CGI generated 
# documents or custom error documents).
# Set to "EMail" to also include a mailto: link to the ServerAdmin.
# Set to one of:  On | Off | EMail
#
ServerSignature On


#
# Customizable error responses come in three flavors:
# 1) plain text 2) local redirects 3) external redirects
#
# Some examples:
#ErrorDocument 500 "The server made a boo boo."
#ErrorDocument 404 /missing.html
#ErrorDocument 404 "/cgi-bin/missing_handler.pl"
#ErrorDocument 402 http://www.example.com/subscription_info.html
#

#
# Putting this all together, we can internationalize error responses.
#
# We use Alias to redirect any /error/HTTP_<error>.html.var response to
# our collection of by-error message multi-language collections.  We use 
# includes to substitute the appropriate text.
#
# You can modify the messages' appearance without changing any of the
# default HTTP_<error>.html.var files by adding the line:
#
#   Alias /error/include/ "/your/include/path/"
#
# which allows you to create your own set of files by starting with the
# /usr/share/apache2/error/include/ files and copying them to /your/include/path/, 
# even on a per-VirtualHost basis.  The default include files will display
# your Apache version number and your ServerAdmin email address regardless
# of the setting of ServerSignature.
#
# The internationalized error documents require mod_alias, mod_include
# and mod_negotiation.  To activate them, uncomment the following 30 lines.

#    Alias /error/ "/usr/share/apache2/error/"
#
#    <Directory "/usr/share/apache2/error">
#        AllowOverride None
#        Options IncludesNoExec
#        AddOutputFilter Includes html
#        AddHandler type-map var
#        Order allow,deny
#        Allow from all
#        LanguagePriority en cs de es fr it nl sv pt-br ro
#        ForceLanguagePriority Prefer Fallback
#    </Directory>
#
#    ErrorDocument 400 /error/HTTP_BAD_REQUEST.html.var
#    ErrorDocument 401 /error/HTTP_UNAUTHORIZED.html.var
#    ErrorDocument 403 /error/HTTP_FORBIDDEN.html.var
#    ErrorDocument 404 /error/HTTP_NOT_FOUND.html.var
#    ErrorDocument 405 /error/HTTP_METHOD_NOT_ALLOWED.html.var
#    ErrorDocument 408 /error/HTTP_REQUEST_TIME_OUT.html.var
#    ErrorDocument 410 /error/HTTP_GONE.html.var
#    ErrorDocument 411 /error/HTTP_LENGTH_REQUIRED.html.var
#    ErrorDocument 412 /error/HTTP_PRECONDITION_FAILED.html.var
#    ErrorDocument 413 /error/HTTP_REQUEST_ENTITY_TOO_LARGE.html.var
#    ErrorDocument 414 /error/HTTP_REQUEST_URI_TOO_LARGE.html.var
#    ErrorDocument 415 /error/HTTP_UNSUPPORTED_MEDIA_TYPE.html.var
#    ErrorDocument 500 /error/HTTP_INTERNAL_SERVER_ERROR.html.var
#    ErrorDocument 501 /error/HTTP_NOT_IMPLEMENTED.html.var
#    ErrorDocument 502 /error/HTTP_BAD_GATEWAY.html.var
#    ErrorDocument 503 /error/HTTP_SERVICE_UNAVAILABLE.html.var
#    ErrorDocument 506 /error/HTTP_VARIANT_ALSO_VARIES.html.var



# Include of directories ignores editors' and dpkg's backup files,
# see README.Debian for details.

# Include generic snippets of statements
Include /etc/apache2/conf.d/

# Include the virtual host configurations:
Include /etc/apache2/sites-enabled/

My default config file for www on apache

NameVirtualHost *:80
<VirtualHost *:80>
    ServerAdmin [email protected]

    #SSLEnable
    #SSLVerifyClient none
    #SSLCertificateFile /usr/local/ssl/crt/public.crt  
    #SSLCertificateKeyFile /usr/local/ssl/private/private.key  

    DocumentRoot /var/www/site/trunk/html
    <Directory />
        Options FollowSymLinks
        AllowOverride all
    </Directory>
    <Directory /var/www/site/trunk/html>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride all
        Order allow,deny
        allow from all
    </Directory>

    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    <Directory "/usr/lib/cgi-bin">
        AllowOverride None
        Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
        Order allow,deny
        Allow from all
    </Directory>

    ErrorLog /var/log/apache2/error.log

    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn

    CustomLog /var/log/apache2/access.log combined
    ServerSignature On

    Alias /doc/ "/usr/share/doc/"
    <Directory "/usr/share/doc/">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
        Order deny,allow
        Deny from all
        Allow from 127.0.0.0/255.0.0.0 ::1/128
    </Directory>

</VirtualHost>

My ssl config file

NameVirtualHost *:443
<VirtualHost *:443>
    ServerAdmin [email protected]

    #SSLEnable
    #SSLVerifyClient none
    #SSLCertificateFile /usr/local/ssl/crt/public.crt  
    #SSLCertificateKeyFile /usr/local/ssl/private/private.key  

    DocumentRoot /var/www/site/trunk/html
    <Directory />
        Options FollowSymLinks
        AllowOverride all
    </Directory>
    <Directory /var/www/site/trunk/html>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride all
        Order allow,deny
        allow from all
    </Directory>

    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    <Directory "/usr/lib/cgi-bin">
        AllowOverride None
        Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
        Order allow,deny
        Allow from all
    </Directory>

    ErrorLog /var/log/apache2/error.log

    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn

    SSLEngine On
        SSLCertificateFile /usr/local/ssl/crt/public.crt
        SSLCertificateKeyFile /usr/local/ssl/private/private.key


    CustomLog /var/log/apache2/access.log combined
    ServerSignature On

    Alias /doc/ "/usr/share/doc/"
    <Directory "/usr/share/doc/">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
        Order deny,allow
        Deny from all
        Allow from 127.0.0.0/255.0.0.0 ::1/128
    </Directory>

</VirtualHost>

My /etc/apache2/httpd.conf is blank

The directory /etc/apache2/conf.d has nothing in it but one file (charset)

contents of /etc/apache2/conf.dcharset

# Read the documentation before enabling AddDefaultCharset.
# In general, it is only a good idea if you know that all your files
# have this encoding. It will override any encoding given in the files
# in meta http-equiv or xml encoding tags.

#AddDefaultCharset UTF-8

My apache error.log

[Wed Jun 03 00:12:31 2009] [error] [client 216.168.43.234] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): /w00tw00t.at.ISC.SANS.DFind:)
[Wed Jun 03 05:03:51 2009] [error] [client 99.247.237.46] File does not exist: /var/www/site/trunk/html/favicon.ico
[Wed Jun 03 05:03:54 2009] [error] [client 99.247.237.46] File does not exist: /var/www/site/trunk/html/favicon.ico
[Wed Jun 03 05:13:48 2009] [error] [client 99.247.237.46] File does not exist: /var/www/site/trunk/html/favicon.ico
[Wed Jun 03 05:13:51 2009] [error] [client 99.247.237.46] File does not exist: /var/www/site/trunk/html/favicon.ico
[Wed Jun 03 05:13:54 2009] [error] [client 99.247.237.46] File does not exist: /var/www/site/trunk/html/favicon.ico
[Wed Jun 03 05:13:57 2009] [error] [client 99.247.237.46] File does not exist: /var/www/site/trunk/html/favicon.ico
[Wed Jun 03 05:17:28 2009] [error] [client 99.247.237.46] File does not exist: /var/www/site/trunk/html/favicon.ico
[Wed Jun 03 05:26:23 2009] [notice] caught SIGWINCH, shutting down gracefully
[Wed Jun 03 05:26:34 2009] [notice] Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch mod_ssl/2.2.8 OpenSSL/0.9.8g configured -- resuming normal operations
[Wed Jun 03 06:03:41 2009] [notice] caught SIGWINCH, shutting down gracefully
[Wed Jun 03 06:03:51 2009] [notice] Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch mod_ssl/2.2.8 OpenSSL/0.9.8g configured -- resuming normal operations
[Wed Jun 03 06:25:07 2009] [notice] caught SIGWINCH, shutting down gracefully
[Wed Jun 03 06:25:17 2009] [notice] Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch mod_ssl/2.2.8 OpenSSL/0.9.8g configured -- resuming normal operations
[Wed Jun 03 12:09:25 2009] [error] [client 61.139.105.163] File does not exist: /var/www/site/trunk/html/fastenv
[Wed Jun 03 15:04:42 2009] [notice] Graceful restart requested, doing restart
[Wed Jun 03 15:04:43 2009] [notice] Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch mod_ssl/2.2.8 OpenSSL/0.9.8g configured -- resuming normal operations
[Wed Jun 03 15:29:51 2009] [error] [client 99.247.237.46] File does not exist: /var/www/site/trunk/html/favicon.ico
[Wed Jun 03 15:29:54 2009] [error] [client 99.247.237.46] File does not exist: /var/www/site/trunk/html/favicon.ico
[Wed Jun 03 15:30:32 2009] [error] [client 99.247.237.46] File does not exist: /var/www/site/trunk/html/favicon.ico
[Wed Jun 03 15:45:54 2009] [notice] caught SIGWINCH, shutting down gracefully
[Wed Jun 03 15:46:05 2009] [notice] Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch mod_ssl/2.2.8 OpenSSL/0.9.8g configured -- resuming normal operations