Apache

​

Supported telemetry types

​

Prerequisites

• Enable the mod_status module. To confirm that the module is loaded, run:
  httpd -M | grep status_module
  
• Make the Apache HTTP Server status endpoint reachable from the Collector.

​

Configure

1. Configure Apache HTTP Server to expose status information at /server-status. Restrict access because the status endpoint can include information about active requests and clients. For example:
   ExtendedStatus On
   
   <Location "/server-status">
       SetHandler server-status
       Require all granted
   </Location>
   
   On Kubernetes, the node Collector is a separate pod on hostNetwork, so Apache sees the node IP, not loopback. Require local returns 403 even when the Collector runs on the same node, and the integration health metric reads 0. Use Require all granted, or an explicit Require ip rule for the Collector, on the documented Kubernetes path. On hosts where the Collector runs on the same machine, you can use a tighter Apache authorization rule instead.
2. Choose how the Collector finds your Apache HTTP Server instances:
   • For pods that expose port 80, add the app.kubernetes.io/name: apache label to the pod template.
   • For pods or Services that use another port or status URL, provide the status URL through autodiscovery annotations.
   For more information, see autodiscovery.
3. Optional: Configure static targets as an alternative to autodiscovery. For example, add the following to the values.yaml for your CXDOT Collector Helm chart:
   config:
     integrations:
       apache:
         endpoints:
           - endpoint: 10.0.0.5:80
   
   A nonempty endpoints list disables label and annotation discovery for that integration instance. The Collector scrapes only the listed targets.
4. Optional: Configure a second integration instance to collect from both discovered and static targets. For example:
   config:
     integrations:
       apache: {}
       apache/static:
         endpoints:
           - endpoint: 10.0.0.5:80
   
   The apache/static key defines a named instance for the static targets. The bare apache key continues to use autodiscovery.

​

Validate

1. In the Live Telemetry Analyzer, add the following label filters:
   • Set Label to __name__ and Value to cxdot.integration.target.health.
   • Set Label to cxdot.integration.name and Value to apache.
   Confirm that the metric reports 1 for each cxdot.integration.target.
2. In Metrics Explorer, run the following query while the Apache HTTP Server instances receive traffic:
   sum by ("server.address", "server.port") (rate({"apache.requests"}[$__rate_interval]))
   
   Confirm that the query returns a value greater than 0 for each target.

​

Disable the Apache integration

config:
  integrations:
    apache:
      enabled: false

​

Configuration reference

​

Optional settings

• enabled Type: boolean. Optional. Default: true. Whether to enable this Apache integration instance. If true, the Collector runs the instance. If false, the Collector doesn’t run it.
• endpoints Type: array of object. Optional. Default: []. Static Apache targets. A nonempty list disables automatic discovery for this integration instance, and the Collector collects metrics from only the listed targets. Specify a target as host:port to request http://<host>:<port>/server-status?auto. Specify a full HTTP or HTTPS URL to use a different status path or transport security. The Collector appends ?auto when the URL doesn’t include it.
• endpoints[].endpoint Type: string. Required. Apache target as either host:port or a full HTTP or HTTPS status URL.
• collection_interval Type: duration. Optional. Default: 10s. How often the Collector collects metrics from each Apache target.
• timeout Type: duration. Optional. Default: 10s. Maximum time allowed to collect metrics from one Apache target. The value must not exceed collection_interval.
• disable_keep_alives Type: boolean. Optional. Default: true. Close the scrape connection after each collection instead of holding it open with keep-alive. A held keep-alive connection is parked by the event Multi-Processing Module (MPM) and counted in apache.connections.async{connection_state="keepalive"}, so a persistent scrape connection inflates that value. Set false to reuse one connection across collections. Annotation-discovered endpoints instead take connection persistence from the annotation’s persist_connections, tls_use_host_header, headers, and extra_headers fields.
• tls Type: object. Optional. Transport layer security (TLS) settings for static HTTPS targets. Certificate verification is enabled unless insecure_skip_verify is true. These settings don’t apply to HTTP targets. Discovery annotations can provide target-specific TLS settings.
• tls.ca_file Type: string. Optional. Path to the CA cert. For a client this verifies the server certificate. For a server this verifies client certificates. If empty uses system root CA. (optional)
• tls.ca_pem Type: string. Optional. In memory PEM encoded cert. (optional)
• tls.cert_file Type: string. Optional. Path to the TLS cert to use for TLS required connections. (optional)
• tls.cert_pem Type: string. Optional. In memory PEM encoded TLS cert to use for TLS required connections. (optional)
• tls.cipher_suites Type: array of string. Optional. CipherSuites is a list of TLS cipher suites that the TLS transport can use. If left blank, a safe default list is used. See https://go.dev/src/crypto/tls/cipher_suites.go for a list of supported cipher suites.
• tls.curve_preferences Type: array of string. Optional. contains the elliptic curves that will be used in an ECDHE handshake, in preference order Defaults to empty list and “crypto/tls” defaults are used, internally.
• tls.include_system_ca_certs_pool Type: boolean. Optional. If true, load system CA certificates pool in addition to the certificates configured in this struct.
• tls.insecure Type: boolean. Optional. In gRPC and HTTP when set to true, this is used to disable the client transport security. See https://godoc.org/google.golang.org/grpc#WithInsecure for gRPC. Please refer to https://godoc.org/crypto/tls#Config for more information. (optional, default false)
• tls.insecure_skip_verify Type: boolean. Optional. InsecureSkipVerify will enable TLS but not verify the certificate.
• tls.key_file Type: string. Optional. Path to the TLS key to use for TLS required connections. (optional)
• tls.key_pem Type: string. Optional. In memory PEM encoded TLS key to use for TLS required connections. (optional)
• tls.max_version Type: string. Optional. MaxVersion sets the maximum TLS version that is acceptable. If not set, refer to crypto/tls for defaults. (optional)
• tls.min_version Type: string. Optional. MinVersion sets the minimum TLS version that is acceptable. If not set, TLS 1.2 will be used. (optional)
• tls.reload_interval Type: duration. Optional. ReloadInterval specifies the duration after which the certificate will be reloaded If not set, it will never be reloaded (optional)
• tls.server_name_override Type: string. Optional. ServerName requested by client for virtual hosting. This sets the ServerName in the TLSConfig. Please refer to https://godoc.org/crypto/tls#Config for more information. (optional)
• tls.tpm Type: object. Optional. Trusted platform module configuration
• tls.tpm.auth Type: string. Optional. Authorization value for the trusted platform module key.
• tls.tpm.enabled Type: boolean. Optional. Whether to use a trusted platform module for the TLS private key. If true, the Collector loads the key from the configured device or socket. If false, the Collector uses the configured key file or in-memory key.
• tls.tpm.owner_auth Type: string. Optional. Owner authorization value for the trusted platform module.
• tls.tpm.path Type: string. Optional. The path to the TPM device or Unix domain socket. For instance /dev/tpm0 or /dev/tpmrm0.