> ## Documentation Index
> Fetch the complete documentation index at: https://docs-xcor.paloaltonetworks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Apache

> Apache HTTP Server connection, request, traffic, and worker metrics.

The Apache integration requires CXDOT Collector 1.4.0 or greater.

[Apache HTTP Server](https://httpd.apache.org/) is an open source web server. Use the
Apache CXDOT Collector integration to collect connection, request, traffic, and worker metrics
from Apache HTTP Server instances running in your environment.

The Apache integration supports Apache HTTP Server 2.4.13 or greater.

## Supported telemetry types

The Apache integration supports these telemetry types:

| Type | Supported |
| - | - |
| Logs | No |
| Metrics | Yes |
| Traces | No |
| Events | No |

## Prerequisites

The Apache integration has the following prerequisites:

* Enable the
  [`mod_status` module](https://httpd.apache.org/docs/2.4/mod/mod_status.html). To
  confirm that the module is loaded, run:

  ```shell theme={null}
  httpd -M | grep status_module
  ```

* Make the Apache HTTP Server status endpoint reachable from the Collector.

## Configure

To configure the Apache integration, follow these steps:

1. Configure Apache HTTP Server to expose status information at `/server-status`.
   Restrict access because the status endpoint can include information about active
   requests and clients. For example:

   ```apache theme={null}
   ExtendedStatus On

   <Location "/server-status">
       SetHandler server-status
       Require all granted
   </Location>
   ```

   On Kubernetes, the node Collector is a separate pod on `hostNetwork`, so Apache
   sees the node IP, not loopback. `Require local` returns `403` even when the
   Collector runs on the same node, and the integration health metric reads `0`. Use
   `Require all granted`, or an explicit `Require ip` rule for the Collector, on
   the documented Kubernetes path. On hosts where the Collector runs on the same
   machine, you can use a tighter
   [Apache authorization rule](https://httpd.apache.org/docs/2.4/howto/access.html)
   instead.

2. Choose how the Collector finds your Apache HTTP Server instances:

   * For pods that expose port `80`, add the `app.kubernetes.io/name: apache` label to
     the pod template.
   * For pods or Services that use another port or status URL, provide the status URL
     through autodiscovery annotations.

   For more information, see
   [autodiscovery](https://docs.chronosphere.io/ingest/cxdot-collector/autodiscovery).

3. Optional: Configure static targets as an alternative to autodiscovery. For example,
   add the following to the `values.yaml` for your CXDOT Collector Helm chart:

   ```yaml theme={null}
   config:
     integrations:
       apache:
         endpoints:
           - endpoint: 10.0.0.5:80
   ```

   A nonempty `endpoints` list disables label and annotation discovery for that
   integration instance. The Collector scrapes only the listed targets.

4. Optional: Configure a second integration instance to collect from both discovered
   and static targets. For example:

   ```yaml theme={null}
   config:
     integrations:
       apache: {}
       apache/static:
         endpoints:
           - endpoint: 10.0.0.5:80
   ```

   The `apache/static` key defines a named instance for the static targets. The bare
   `apache` key continues to use autodiscovery.

### Validate

To validate the Apache integration, follow these steps:

1. In the
   [Live Telemetry Analyzer](https://docs.chronosphere.io/investigate/analyze/telemetry-analyzer),
   add the following label filters:

   * Set **Label** to `__name__` and **Value** to
     `cxdot.integration.target.health`.
   * Set **Label** to `cxdot.integration.name` and **Value** to `apache`.

   Confirm that the metric reports `1` for each `cxdot.integration.target`.

2. In
   [Metrics Explorer](https://docs.chronosphere.io/investigate/querying/metrics/explorer),
   run the following query while the Apache HTTP Server instances receive traffic:

   ```text theme={null}
   sum by ("server.address", "server.port") (rate({"apache.requests"}[$__rate_interval]))
   ```

   Confirm that the query returns a value greater than `0` for each target.

## Disable the Apache integration

To disable the Apache integration, set `enabled` to `false` in the `values.yaml` file:

```yaml theme={null}
config:
  integrations:
    apache:
      enabled: false
```

For more information about diagnosing a failing integration, see
[Troubleshooting](https://docs.chronosphere.io/ingest/cxdot-collector/troubleshooting).

## Configuration reference

Configure one Apache integration instance with the following settings. In Helm values, place
these settings under `config.integrations.apache`. In a Collector configuration file, place them
under `cxdot.integrations.apache`.

### Optional settings

* **`enabled`**
  Type: `boolean`. Optional. Default: `true`.
  Whether to enable this Apache integration instance. If true, the Collector runs the instance.
  If false, the Collector doesn't run it.

* **`endpoints`**
  Type: `array of object`. Optional. Default: `[]`.
  Static Apache targets. A nonempty list disables automatic discovery for this integration
  instance, and the Collector collects metrics from only the listed targets. Specify a target as
  `host:port` to request `http://<host>:<port>/server-status?auto`. Specify a full HTTP or HTTPS
  URL to use a different status path or transport security. The Collector appends `?auto` when
  the URL doesn't include it.

* **`endpoints[].endpoint`**
  Type: `string`. Required.
  Apache target as either `host:port` or a full HTTP or HTTPS status URL.

* **`collection_interval`**
  Type: `duration`. Optional. Default: `10s`.
  How often the Collector collects metrics from each Apache target.

* **`timeout`**
  Type: `duration`. Optional. Default: `10s`.
  Maximum time allowed to collect metrics from one Apache target. The value must not exceed
  `collection_interval`.

* **`disable_keep_alives`**
  Type: `boolean`. Optional. Default: `true`.
  Close the scrape connection after each collection instead of holding it open with keep-alive.
  A held keep-alive connection is parked by the event Multi-Processing Module (MPM) and counted
  in `apache.connections.async{connection_state="keepalive"}`, so a persistent scrape connection
  inflates that value. Set false to reuse one connection across collections.
  Annotation-discovered endpoints instead take connection persistence from the annotation's
  `persist_connections`, `tls_use_host_header`, `headers`, and `extra_headers` fields.

* **`tls`**
  Type: `object`. Optional.
  Transport layer security (TLS) settings for static HTTPS targets. Certificate verification is
  enabled unless `insecure_skip_verify` is true. These settings don't apply to HTTP targets.
  Discovery annotations can provide target-specific TLS settings.

* **`tls.ca_file`**
  Type: `string`. Optional.
  Path to the CA cert. For a client this verifies the server certificate. For a server this
  verifies client certificates. If empty uses system root CA. (optional)

* **`tls.ca_pem`**
  Type: `string`. Optional.
  In memory PEM encoded cert. (optional)

* **`tls.cert_file`**
  Type: `string`. Optional.
  Path to the TLS cert to use for TLS required connections. (optional)

* **`tls.cert_pem`**
  Type: `string`. Optional.
  In memory PEM encoded TLS cert to use for TLS required connections. (optional)

* **`tls.cipher_suites`**
  Type: `array of string`. Optional.
  CipherSuites is a list of TLS cipher suites that the TLS transport can use. If left blank, a
  safe default list is used. See
  [https://go.dev/src/crypto/tls/cipher\_suites.go](https://go.dev/src/crypto/tls/cipher_suites.go)
  for a list of supported cipher suites.

* **`tls.curve_preferences`**
  Type: `array of string`. Optional.
  contains the elliptic curves that will be used in an ECDHE handshake, in preference order
  Defaults to empty list and "crypto/tls" defaults are used, internally.

* **`tls.include_system_ca_certs_pool`**
  Type: `boolean`. Optional.
  If true, load system CA certificates pool in addition to the certificates configured in this
  struct.

* **`tls.insecure`**
  Type: `boolean`. Optional.
  In gRPC and HTTP when set to true, this is used to disable the client transport security. See
  [https://godoc.org/google.golang.org/grpc#WithInsecure](https://godoc.org/google.golang.org/grpc#WithInsecure)
  for gRPC. Please refer to
  [https://godoc.org/crypto/tls#Config](https://godoc.org/crypto/tls#Config) for more
  information. (optional, default false)

* **`tls.insecure_skip_verify`**
  Type: `boolean`. Optional.
  InsecureSkipVerify will enable TLS but not verify the certificate.

* **`tls.key_file`**
  Type: `string`. Optional.
  Path to the TLS key to use for TLS required connections. (optional)

* **`tls.key_pem`**
  Type: `string`. Optional.
  In memory PEM encoded TLS key to use for TLS required connections. (optional)

* **`tls.max_version`**
  Type: `string`. Optional.
  MaxVersion sets the maximum TLS version that is acceptable. If not set, refer to crypto/tls
  for defaults. (optional)

* **`tls.min_version`**
  Type: `string`. Optional.
  MinVersion sets the minimum TLS version that is acceptable. If not set, TLS 1.2 will be used.
  (optional)

* **`tls.reload_interval`**
  Type: `duration`. Optional.
  ReloadInterval specifies the duration after which the certificate will be reloaded If not set,
  it will never be reloaded (optional)

* **`tls.server_name_override`**
  Type: `string`. Optional.
  ServerName requested by client for virtual hosting. This sets the ServerName in the TLSConfig.
  Please refer to [https://godoc.org/crypto/tls#Config](https://godoc.org/crypto/tls#Config) for
  more information. (optional)

* **`tls.tpm`**
  Type: `object`. Optional.
  Trusted platform module configuration

* **`tls.tpm.auth`**
  Type: `string`. Optional.
  Authorization value for the trusted platform module key.

* **`tls.tpm.enabled`**
  Type: `boolean`. Optional.
  Whether to use a trusted platform module for the TLS private key. If true, the Collector loads
  the key from the configured device or socket. If false, the Collector uses the configured key
  file or in-memory key.

* **`tls.tpm.owner_auth`**
  Type: `string`. Optional.
  Owner authorization value for the trusted platform module.

* **`tls.tpm.path`**
  Type: `string`. Optional.
  The path to the TPM device or Unix domain socket. For instance /dev/tpm0 or /dev/tpmrm0.


## Related topics

- [Apache Tomcat](/ingest/xcor/integrations/collector/tomcat.md)
- [Apache Spark](/ingest/xcor/integrations/collector/spark.md)
- [CXDOT Collector integrations](/ingest/xcor/integrations/collector.md)
- [Datagen source plugin](/ingest/pipeline/plugins/source-plugins/datagen.md)
- [Kafka destination plugin](/ingest/pipeline/plugins/destination-plugins/kafka.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.