March 20, 2006 Archives

Mon Mar 20 11:18:09 NZST 2006

OSX Tiger fails poll()

Here's an example problem: you have Apache 2 running under OSX, you upgrade to OSX 10.4 (Tiger) … and suddenly you notice that "all your PDFs are broken".

Your actual problem might be that files sent by Apache are being truncated at 64K (plus a few bytes). Those few extra bytes worry you – if there was a 64K limit being triggered, how do those extra bytes get through?

OK – it's the router, firewall, or ISP, isn't it? No – tcpdump the server while it fails to send a file, and look at what you see. You'll see the data packets being sent … then stop. The client will continue sending ACKs until it has caught up with the outgoing flow … then after a few seconds the server actively closes the connection with FIN,ACK.

If a router had killed the traffic flow, you wouldn't see the correct ACKs, and you wouldn't see a tidy shutdown. So what's happened? Apache has decided to stop sending data, that's what.

To confirm this, stop your webserver for a while, and use nc to pump one of your PDFs out (OK, that's not a perfect test, because your problem might be HTTP inspection, not just plain data transfer). nc succeeds in sending the file. So it's not a basic inability to transfer more than 64K out of the machine.

Apache can send PDFs onto a localhost interface fine – I'm not quite sure why this works, but it complicates things a little :-) If that had failed, it would have been more definately Apache's problem – but as it works, it seems to be an Ethernet interface problem.

Hitting google with a more precise set of symptoms eventually turns up a bug, logged by Apple, on the Apache Portable Runtime project bugtracker. This has been fixed in APR 0.9.7, which is the version used in Apache 2.0.55

Complications for fixing this problem – ServerLogistics.com are only shipping a Pre-packaged Apache 2.0.52 at the moment, which needs to be updated. Installing from Fink or DarwinPorts would get the latest version, as would compiling from source – if you have XCode installed (if you're replacing a ServerLogic bundle with a from-source build, make sure you get the layout and config options the same!). But at least you'll know what the problem is now :-)

The instructions at Richard5's blog have been successfully used by a non-source-code OSX admin I know with only one small problem – if you're keeping your old httpd.conf (and of course, you are!) and you have the auth_ldap_module selected (that's the default in ServerLogistics.com 2.0.48 at least) you will need to add an extra LoadModule line …

LoadModule ldap_module modules/mod_ldap.so
LoadModule auth_ldap_module modules/mod_auth_ldap.so

If you don't, your shiny new Apache2 won't start – but at least you'll be able to see the reason in your errors_log

[Mon Mar 20 16:04:41 2006] [error] \
   Module mod_ldap missing. Mod_ldap \
   (aka. util_ldap) must be loaded in \
   order for mod_auth_ldap to function properly
Configuration Failed

Posted by Jim Cheetham | Permanent Link