Subject: Stop mod_ssl from writing errors to the general Apache error logfile

From: "Bert Courtin" <[email-masked]>
Date: Tue, 05 Feb 2002 18:33:47 +0100

Hi,

I wonder how I can stop mod_ssl from writing errors to the general
Apache error logfile.

Problem:
---------
I set the "SSLLogLevel" directive to none but as documented at

http://httpd.apache.org/docs-2.0/mod/mod_ssl.html#ssllog

this only means that no dedicated SSL logging is done, but messages of
level ``error'' are still written to the general Apache error logfile.

What I'm struggling with is that we use a load balancer which does a
ssl-connect to the apache server on port 443 to see whether there is
someone listening. It does this in a not very smart way (just looks
whether it gets a connect) which leads to a log entry as follows:
...
[Tue Feb  5 18:03:40 2002] [error] mod_ssl: SSL handshake interrupted by
system [Hint: Stop button pressed in browser?!] (System error follows)
[Tue Feb  5 18:03:40 2002] [error] System: Connection reset by peer
(errno: 131)
...

I already disabled to SSLLog but I also don't want SSL-related stuff in
my general Apache error logfile and though looking for a way from
stopping mod_ssl from writing errors to the general Apache error
logfile.

Thanks for any help in advance -

kind regards,
Bert Courtin

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Owen Boyle <[email-masked]>
Date: Wed, 06 Feb 2002 09:43:53 +0100

> I wonder how I can stop mod_ssl from writing errors to the general

Since your SSL site is defined by a virtualhost, simply put a separate
ErrorLog directive in the SSL VH. Errors generated by that VH will go
there instead of the global error_log. If you really don't want to see
SSL errors at all, just do:

< in SSL VH>
 ErrorLog /dev/null

Rgds,

Owen Boyle.

---

From: "Bert Courtin" <[email-masked]>
Date: Wed, 06 Feb 2002 19:20:35 +0100

Hi Owen,

thank you for your reply:-)

... but - when sending the output for the ErrorLog to /dev/null I don't
have an ErrorLog at all, and that's not really what I needed..

I dont what no ErrorLog at all but just no SSL errors in my ErrorLog (even
inside the virtual host!). I don't see the point that if I set SSLLogLevel
to none that this only means that no dedicated SSL logging is done, but
messages of level ``error'' are still written to the general Apache error
logfile.
In my opinion there should be an option "quite" or "disabled" available
which turns off this behaviour.

For me meanwhile I now playing around with piped logging using a statemend
like:

ErrorLog    "| /usr/bin/fgrep -v 'errno: 131' | /usr/bin/fgrep -v 'SSL
handshake interrupted by system' >> /var/log/apache_1.3.23/logs/error_log"

Kind regards,
Bert Courtin

--
T-Online International AG
DCM
Waldstrasse 3
64331 Weiterstadt
Tel.: +49 (0)6151 680 7512

---

From: Owen Boyle <[email-masked]>
Date: Thu, 07 Feb 2002 12:33:29 +0100

> handshake interrupted by system' >> /var/log/apache_1.3.23/logs/error_log"

I think you're missing a crucial point - you can have SEVERAL
error_logs... You do not need to have just one ErrorLog directive, you
can also have an ErrorLog inside a VH and it will receive log messages
only from that VH. Since you need a separate VH for SSL, it is easy to
put an extra ErrorLog directive inside the SSL VH and it will trap all
the error messages generated by requests to that VH. So your config
would look like:

# Define default server-wide error_log
ErrorLog logs/main_error_log

# Declare SSL VH
<VirtualHost ip-addr:433>
  ...
  # Define special SSL_only error_log
  ErrorLog logs/SSL_error_log
  ...
</VirtualHost>

Then you will get TWO error_logs... and the main_error_log will not have
any SSL errors in it. The thing about /dev/null was just if you wanted
to ignore the logging - obviously you can replace /dev/null with a real
file.

NB - the same is true of TransferLog...

Rgds,

Owen Boyle

PS If you haven't already done so, you might like to sign up for the
Official Apache Users List: http://httpd.apache.org/userslist.html It is
more appropriate for general config issues like this.
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Owen Boyle <[email-masked]>
Date: Thu, 07 Feb 2002 12:33:29 +0100

# Declare SSL VH

Rgds,

Owen Boyle

---

From: "Bert Courtin" <[email-masked]>
Date: Thu, 07 Feb 2002 16:29:45 +0100

Hi,

I'd like the httpd-configuration options SSLMutex 'sem' and SSLSessionCache
'shm:/...' getting to work on my Solaris 8/SPARC.

Currently they are not supported/available by my apache build: httpd -L:
-----------------------------------------
SSLMutex (mod_ssl.c)
        SSL lock for handling internal mutual exclusions (`none',
`file:/path/to/file')
        Allowed in *.conf only outside <Directory>, <Files> or <Location>
SSLSessionCache (mod_ssl.c)
        SSL Session Cache storage (`none', `dbm:/path/to/file')
        Allowed in *.conf only outside <Directory>, <Files> or <Location>
-------------------------------------------

Questions:
----------
- Are these Options for SSLMutex (sem) / SSLSessionCache (shm) available on
Solaris 8/SPARC?
- How do I have to build mod_ssl / apache to get it work as I cannot find infos
related to this anywhere
 (all I found was "supports xyz if the underlaying platform supports it" - does
Solaris8/SPARC not support this?)

Please find my current build/coinfiguration options at the end of this mail.

Thanks in advance & kind regards,

Bert Courtin

Build-details:
-------------
This is how I build my apache:
#Preinstall APACHE
#
cd ${APACHE}
./configure --prefix=/${TARGET_DIR}/${APACHE}/${PROJEKT}
cd ..

# lib_mcrypt
...

# mm-1.1.3
#
cd ${MM}
./configure --prefix=/${TARGET_DIR}/${MM} \
        --with-gcc \
        --disable-shared \
        --with-sem=IPCSEM \
        --with-shm=IPCSHM

make
make install | tee -a "${THIS_LOGFILE}"
cd ..

# openSSL
...

# imap support
...

# openLDAP
...

# mod_SSL
#
cd ${MODSSL}
CPFLAGS="-I/${TARGET_DIR}/${OPENSSL}/include -I/${TARGET_DIR}/${MM}/include" \
LDFLAGS="-L/${TARGET_DIR}/${OPENSSL}/lib -L/${TARGET_DIR}/${MM}/lib" \
./configure --prefix=/${TARGET_DIR}/${APACHE}/${PROJEKT} \
            --with-apache=../${APACHE} \
            --with-ssl=../${OPENSSL} \
            --with-mm=../${MM} \
            --disable-rule=SSL_COMPAT

cd ..

# MODPERL
...

# APACHE
#
cd ${APACHE}
EAPI_MM="../${MM}" \
CPFLAGS="-I/${TARGET_DIR}/${OPENSSL}/include -I/${TARGET_DIR}/${MM}/include" \
LDFLAGS="-L/${TARGET_DIR}/${OPENSSL}/lib -L/${TARGET_DIR}/${MM}/lib" \
INCLUDE="-I/${TARGET_DIR}/${OPENSSL}/include -I/${TARGET_DIR}/${MM}/include" \
./configure --prefix=/${TARGET_DIR}/${APACHE}/${PROJEKT} \
            --sysconfdir=/etc/${APACHE}/${PROJEKT} \
            --disable-rule=EXPAT \
            --disable-rule=SSL_COMPAT \
            --activate-module=src/modules/php4/libphp4.a \
            --enable-module=php4 \
            --activate-module=src/modules/perl/libperl.a \
            --enable-module=perl \
            --enable-module=ssl \
            --disable-module=status \
            --disable-module=info \
            --disable-module=example \
            --disable-module=speling \
            --disable-module=userdir \

make
make install | tee -a "${THIS_LOGFILE}"
cd ..

---

From: Mads Toftum <[email-masked]>
Date: Thu, 7 Feb 2002 19:30:09 +0100

> Questions:

yes. I never build mod_ssl on Solaris without it.

> - How do I have to build mod_ssl / apache to get it work as I cannot find infos

It is in the INSTALL document - basically you enable them by compiling the MM-
library and configuring mod_ssl with the --with-mm option. The only difference
between what you're doing with mm and my default build is that you add three
options that I don't use: 
--with-gcc  --with-sem=IPCSEM --with-shm=IPCSHM

vh

Mads Toftum
-- 
With a rubber duck, one's never alone.
              -- "The Hitchhiker's Guide to the Galaxy"
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]