SUPERCHARGING€¦ · SUPERCHARGING. PHP pages with mod_lsapi . in CloudLinux OS. Hi all.\爀䴀礀...

$: SUPERCHARGING€¦ · SUPERCHARGING. PHP pages with mod_lsapi . in CloudLinux OS. Hi all.\爀䴀礀渀愀洀攀椀猀䈀漀最搀愀渀愀渀搀䤀愀洀最漀椀渀最琀漀$
SUPERCHARGINGPHP pages with mod_lsapi in CloudLinux OS

Выступающий

Заметки для презентации

Hi all. My name is Bogdan and I am going to describe what is mod_lsapi, why it is good, how it works and how to tune it up. Recently we released mod_lsapi to production, after a year of testing we are positive it is doing great job now. Presentation will last twenty five minutes, then we will take your questions at the end. Let start

Why it was needed?

suPHP / CGI• slow• doesn’t support .htaccess

mod_php • insecure• requires MPM prefork

mod_fcgid• hard to keep stable / requires tuning • sub-optimal caching• no support for .htaccess• hard to do multi-versions / customers

FPM• sub-optimal security due to the way sockets used• no support for .htaccess• hard to do multi-versions• separate pool per customer / sub-optimal memory usage



Why mod_lsapi was needed? Existing PHP handlers and modes are slow, unsafe or uncomfortable in use. - suPHP is slow as every new request requires forking new thread - Mod_php is insecure and requires MPM prefork mode. It works as apache user and requires RUID2 module to switch to user permissions. - Mod_fcgi is fast but usually unstable or require hard tuning depending on server specifications. It has sub-optimal caching. But does not support htaccess rules. It is hard to do multi-version per users - FPM has sub-optimal security due to the way sockets used. It does not support htaccess rules and it is hard to implement multi-versions. It requires separate config to make a pool per customer and it has sub-optimal memory usage.

• Blazing fast

• Outperforms any other Apache PHP handler

• Supports mod_php options format<Directory /usr/local/www/phpMyAdmin>

php_admin_value open_basedir none

</Directory>

• Full opcode caching

• No tuning required and easy to install

• Supports .htaccess PHP directivesphp_value include_path ".:/usr/local/lib/php"

php_flag display_errors Off

php_value upload_max_filesize 2M

• Supports CageFS and PHP selector

o opens possibility of multiple PHP versions per client

• Secure, based on suexec mechanism

• Potential for even better performance

Why mod_lsapi?



Why mod_lsapi was engaged?�- it is blazing fast, it outperforms any other apache PHP handler It fully supports opcode caching It does not require any tuning and is easy to install It supports mod_php options format in virtualhosts It supports .htaccess PHP directives, so regular users who are familiar with them can easily use them. Or use google to find needed directives It fully supports CageFS and PHP-Selector including possibility to use multiple PHP per single user, even PHP version per directory inside single domain It is secure as based on suexec mechanism It has potential for even better performance for high loaded sites

OPCODE CACHE

FULLY SUPPORTS:

APC

xCache

Zend OPcache

Opcode cache uses shared memory, that shares code across requests for end

user. mod_lsapi configured not to reset cache on Apache restarts. Something

impossible to do with mod_php



Mod_lsapi fully supports popular opcode caches like APC xCache or Zend OPCache. Opcode cache is a tool that is keeping PHP pages in memory so php processor do not need to read and compile php code from scratch. Opcache uses shared memory and share code across requests for individual user. Mod_lsapi is configured NOT to reset cache on apache restarts, something impossible to do with mod_php.

What is lsphp

lsphp - PHP + LSAPI

What is LSAPI?

LiteSpeed Server Application Programming Interface (LSAPI) is designed specifically for seamless, optimized communication between LiteSpeed Web Server and third party web applications. Now this protocol is available for Apache 2.2/2.4.

Using LSAPI, we have seen greater performance than Apache with

mod_php, easy installation than php-fpm, easy integration with

control panel. LSAPI means faster, more stable dynamic web pages.



Lsphp is a build of PHP sources with LSAPI provided by litespeed technology. Litespeed Server Application Programming Interface is designed specifically for seamless, optimized communication between LiteSpeed Web Server and third party web applications. Now this protocol is available for Apache. Using LSAPI we have seen greater performance than Apache with mod_php, more easy installation and configuration then php-fpm, and easy integration with control panels

apache passes handling for PHPrequest to mod_lsapi

mod_lsapi uses liblsapi to transfersrequest lsphp daemon

lsphp processes request and returnsdata to mod_lsapi.

If no lsphp processes available whennew request comes, new lsphp processcreated.

HOW IT WORKS

VH2

VH1

HTTPD - root (1)

HTTPD - nobody - request (2)



child of HTTPDnobody - lsphp starter (3)

lsphp - user1 (4)

lsphp - user2 (4)

1. apache module handle requests (2) -mod_lsapi.so;

2. starter daemon - starts lsphp ondemand (3) - from mod_lsapi.so, childof HTTPD - block (1);

3. lsphp - executes php file and sendsresults back to (2) (4) - native lsphp orlsphp from alt-php)



Here is a schema which describes how it works. Mod_lsapi is like a frontend. Lsphp process is a backend. Apache accept request from visitor and pass handling PHP request to mod_lsapi – a regular apache module Mod_lsapi uses liblsapi to transfer request to lsphp daemon Lsphp starter check if lsphp process for needed user exists, if NO – it start one. If process exists – will use it. Lsphp receive request, process it and returns data to mod_lsapi Each user has own lsphp process in separate CageFS and LVE. If there are no requests to this lsphp process it is terminated. By default timeout is set to thirty seconds but It could be changed with lsphp config file.

INSTALLATION1. Install common packages:

yum install liblsapi liblsapi-devel

2. Install mod_lsapi sources and hooks:

yum install mod_lsapi

3. Prepare environment for work

/usr/bin/switch_mod_lsapi --setup

Next steps for cPanel with EasyApache3 only

4. Detect native php version and build correct lsphp binary file:

/usr/bin/switch_mod_lsapi --build-native-lsphp

5. Enable mod_lsapi:

/usr/bin/switch_mod_lsapi --enable-global

6. Restart apache:

service httpd restart



Installation process contains few steps and is different depending on control panel used. First we install common liblsapi packages Next we install mod_lsapi itself We have to prepare environment using switch_mod_lsapi utility. It creates directories with proper permissions and make native lsphp as php5.6 For cPanel with EasyApache 3 we detect native PHP version and build correct lshp binary file. Then we enable mod_lsapi globally and restart apache.

INSTALLATION EasyApache 4 1. Install common packages:

yum install liblsapi liblsapi-devel

2. Install mod_lsapi package:

wget http://repo.cloudlinux.com/cloudlinux/sources/cloudlinux_ea3_to_ea4

sh cloudlinux_ea3_to_ea4 --convert --mod_lsapi

3. Prepare environment for work (creating directory with correct rights

for socket and make native lsphp as php 5.6 version):

/usr/bin/switch_mod_lsapi –setup

4. Enable mod_lsapi:


5. Restart apache:

service httpd restart



Some additional steps are needed for EasyApache 4 as it is still in beta stage. We have made conversion script for it to do the job. You have just to download script, pass mod_lsapi parameter and then continue with SAME steps as for EasyAapche 3.

DirectAdmin custombuild has full support of

mod_lsapi. lsphp native builds during custombuild

rebuilding process.

1. cd /usr/local/directadmin/custombuild

2. ./build update

3. ./build set php1_release lsphp

4. ./build php n

5. ./build apache

DirectAdmin INSTALLATION



DirectAdmn installation is totally different due to custombuild tool used. DirectAdmin company takes our sources, build needed packages and place to their location. You do not need to install packages with yum, just use custombuild like:�- update - set lsphp as target PHP release Build php and build apache Due to the nature they takes our package there could be a small delay between our release and DirectAdmin update with custombuilld.

ISPManager and mod_lsapi cooperation

How to enable mod_lsapi on ISPManager:1. yum install liblsapi liblsapi-devel --enablerepo=cloudlinux-updates-testing2. yum install mod_lsapi --enablerepo=cloudlinux-updates-testing3. /usr/bin/switch_mod_lsapi --setup4. uncomment string LoadModule lsapi_module modules/mod_lsapi.so from file /etc/httpd/conf.d/mod_lsapi.conf5. disable php support for needed domain (this action comment out AddHandler or AddType for VirtualHost) orfor all domains.6. remove from /etc/httpd/conf/httpd.conf strings:<Directory /var/www/*/data/>php_admin_flag engine off</Directory>

or6. add to needed (where mod_lsapi should be enabled) VirtualHost such strings:<Directory /var/www/[username]/data/www/[domain]>Options -ExecCGI -Includesphp_admin_flag engine on</Directory>7. uncomment string AddType application/x-httpd-lsphp .php5 .php4 .php .php3 .php2 .phtml in file/etc/httpd/conf.d/mod_lsapi.conf8. service httpd restart



It is not trivial to install mod_lsapi for ISPManager, is quite similar for non-panel rpm based install. The main goal is to disable initial PHP support provided by ISPManager. First steps are same – install packages and prepare environment. Next we modify mod_lsapi.conf file to load lsapi_module. Then disable php support for needed domain or for all virtualhosts. Uncomment AddType lsphp string in mod_lsapi.conf file and restart apache

/usr/bin/switch_mod_lsapi and control panels

What commands are available for different control panels

No CP cPanel DirectAdmin Plesk InterWorx ISPManager

install + + + (no need inmanual calling) + + +

uninstall + + - + + +

enable-domain - + - - - -

disable-domain - + - - - -

enable-global - + +/- (custombuild) - - -

disable-global - + - - - -

build-native-lsphp - + +/- (custombuild) - - -



For more easy mod_lsapi installation we developed an utility switch_mod_lsapi It has a lot of options and this table shows what are supported by different control panels. cPanel is leading here supporting all of them. Most panels support install and uninstall only.

Additional notes about native php installation

*Native php - php installed and used before alt-php packages was installed. lsphp binary usuallynot present on server without LiteSpeed and this means that it should be created (build from phpsources with such options as usual php binary file but with LSAPI protocol built-in)

There are two ways to make native lsphp:

1. QUICK - supports all type of panels - native lsphp makes from alt-php56 (switch_mod_lsapi --setup)

cp /opt/alt/php56/usr/bin/lsphp /usr/local/bin/

2. SLOW - detects version of native php and build needed sources according to installed php (cPanel only):

switch_mod_lsapi --build-native-lsphp

! DirectAdmin has own native lsphp builder

/usr/local/directadmin/custombuild/build set php1_release lsphp/usr/local/directadmin/custombuild/build php n



Lsphp binary usually is absent on servers without litespeed or without alternate php, but it is needed for proper lsapi functionality. When “switch_mod_lsapi setup” script is run it check if lsphp binary exists, if not – it simiply copy lsphp binary from alt-php56 package. It is recommended to run “switch_mod_lsapi build-native-lsphp” on servers with cpanel and easyapache 3 as it detects currenly used version, takes needed config options and pathes for modules and then build lsphp binary DirectAdmin has own native lsphp builder handled by custombuild

mod_lsapi as suPHP replacement (cPanel)

mod_lsapi is a drop in replacement for suPHP. No configuration changes need to be done.

RECOMMENDED PROCEDURE:

1. Install mod_lsapi and call

/usr/bin/switch_mod_lsapi --setup

2. Switch individual domain to check how it goes:

/usr/bin/switch_mod_lsapi --enable-domain example.com

3. Switch whole server globally so all domains start working on mod_lsapi:




Mod_lsapi is a drop replacement for suphp, it fully supports all directives and will not cause issues when you switch suphp to lsapi. Recommended and safe procedure setting up lsapi on cPanel server is following: Install and configure mod_lsapi Enable mod_lsapi for single domain with switch_mod_lsapi utility. Open website in browser and browse it, be sure it works properly Switch php engine to mod_lsapi globally using same tool

Config file location on different servers

All mod_lsapi configuration options are placed in single config file. The file will not be

changed or updated by any package reinstalls, easyapache builds on cPanel or

custombuild on DirectAdmin.

/etc/httpd/conf.d/mod_lsapi.conf

cPanel with EasyApache 3

cPanel with EasyApache 4

DirectAdmin

RPM based

/usr/local/apache/conf/conf.d/lsapi.conf

/etc/apache2/conf.d/mod_lsapi.conf

/etc/httpd/conf/extra/mod_lsapi.conf



All mod_lsapi configuration options are placed in single config file. That file will not be changed by any package reinstalls, easyapache builds on cpanel or custombuild on directadmin. It is safe to modify it according to your needs. The location is pretty standart to main config files on panels. For cPanel with easyapache 3 it is /usr/local/apache/conf/conf.d For cPanel with easyapache 4 it is /etc/apache2/con.d For directadmin it is /etc/httpd/conf/extra For RPM based installs same as other panels, it is /etc/httpd/conf.d

mod_lsapi errors will be located in regular

apache error_log and own sulsphp_log.

Errors from clients like PHP notices, code

errors are written to error_log file.

Errors from PHP starter are written to

sulsphp_log file, they are related running

lsphp as service and are mostly helpful in

getting error 500 in browser.

WHERE TO FIND ERRORS



Mod_lsapi errors are located in regular apache error_log file and in his own sulsphp_log. Errors from clients like PHP notices, code errors are written to error_log. Depending on server configuration this could be single error_log in apache logs directory, or individual error_logs per customers. Errors from PHP starter are written to sulsphp_log file, they are related to running lsphp as service and are mostly helpful when you are getting error 500 in browser.

Different PHP versions (without PHP Selector)

mod_lsapi allow to use different handlers for different php versions. For example file with extension .php53 can be handled by php5.3 and file with extension .php handled by php5.5 without PHP Selector.

This is done seting handlers and php binaries for them in /etc/container/php.handler file

EXAMPLE:

# cat /etc/container/php.handlerapplication/x-lsphp53 /opt/alt/php53/usr/bin/lsphpapplication/x-lsphp55 /opt/alt/php55/usr/bin/lsphp

Default handler for lsphp is - application/x-httpd-lsphp . Setting following options in domain .htaccess file :

AddType application/x-httpd-lsphp .php .php5 .php4.php3 .php2 .phtmlAddType application/x-lsphp53 .php53

Means that file index.php53 will be processed by php5.3, but index.php processed by native lsphp



Mod_lsapi allow to use different handlers for different php versions. For example file with extention .php53 can be handled by php version 5.3 . And file with extension .php handled by php5.5 This is done setting handlers and php binaries for them in /etc/container/php.handler file. For example – let create two applications for lsphp5.3 and 5.5 and restart apache. Now with .htaccess file we can point which php to use depending on extension. In this example index.php53 will be processed by php53 while index.php will be processed by native lsphp. Even more – you may use this functionality for PHP per directory if used website engine depends on PHP versions.

Example mod_lsapi configuration

LoadModule lsapi_module modules/mod_lsapi.so

<IfModule lsapi_module>

<FilesMatch "\.(php|php4|php5|php53|php54|php55|php56|php6|phtml)$">AddType application/x-httpd-lsphp .php .php4 .php5 .php53 .php54 .php55 .php56 .phtmlAddHandler application/x-httpd-lsphp .php .php4 .php5 .php53 .php54 .php55 .php56 .phtml</FilesMatch>

lsapi_debug Offlsapi_set_env TEMP "/tmp"lsapi_set_env TMP "/tmp"lsapi_set_env TMPDIR "/tmp"

</IfModule>

Most of php file extensions are covered by AddType option. If you wants to use

additional handlers for directory for existing extension, you should remove

conflicting extension from main lsapi.conf file



Here is example mod_lsapi configuration file if lsapi has been enabled globally --- pause for 5 seconds --- Most of php file extensions are covered by AddType option. If you want to use additional handlers fo rdirectory for existing extensions you should remove conflicting extensions from this main lsapi.conf file.

Useful mod_lsapi directives to tune it up

lsapi_backend_children# Maximum number of simultaneously running child backend processes.# How many requests in parallel it can process# Optional, default value is 120

lsapi_backend_pgrp_max_idle# How long a control backend process will wait for a new request before it exits, in sec. Default value is 30# Decrease to minimize memory usage. Increase to make faster response from sites# 0 stands for infinite.

lsapi_backend_max_process_time# The maximum processing time allowed when processing a request, in sec.# Optional, default value is 300.



Here are most useful mod_lsapi directives that allow you to tune it up. - lsapi_backend_children is the maximum number of simultaneously running child backend processes, same sa how many requests lsphp could process at once - lsapi_backend_pgrp_max_idle is how long a control backend process will wait for a new requests before it exits. You may want to decrease it to minimize memory usage or increase to make faster websites response time - lsapi_backend_max_process_time is the maximum time allowed when processing a request

Useful mod_lsapi directives to tune it up

lsapi_backend_max_idle# How long a backend child process will wait for a new request before it exits, in sec

# Optional, default value is 300. 0 stands for infinite.

# Decrease to minimize memory usage

lsapi_backend_max_reqs# How many requests each child process will handle before it exits automatically.

# Optional, default value is 10000.



Lsapi_backend_max_idle is how long a backend child process will wait for new requests, they can stay alive without parent process and has own idle time Lsapi_backend_max_reqs is how many requests each child process will handle before it exits

More things about mod_lsapi

Q: Is it compatible with EasyApache3/4?

Q: Is it compatible with PHP directives in .htaccess?

Q: I have httpd.conf with SuExecUserGroup options. Do I need to add mod_lsapi related options?

Q: How do I install mod_lsapi on Plesk panel?

Q: Can mod_lsapi work without CageFS?

Q: How many servers are running mod_lsapi now?



Most common questions about mod_lsapi Is it compatible with EasyApache 3 and 4? Yes it is, both easyapache versions works properly with mod_lsapi -- Is it compatible with PHP directives in htaccess ? Yes, mod_lsapi can read php_ and php_admin directives, it fully support htaccess directives -- I have httpd.conf with SuExecUserGroup options, do I need to add mod_lsapi options to VirtualHost? You do not need to change anything, mod_lsapi can read suPHP_UserGroup, RUIDGid, SuexecUserGroup or AssignUserID parameters to determine user ID under which site is running. -- How to install mod_lsapi on Plesk As of today plesk installation means manual processing like for ISPManager however we are working with Plesk developers to provide more easy integration -- Can mod_lsapi work without cagefs? Yes it works without cagefs, just alt-php is needed. -- How many servers are running mod_lsapi now? It’s hard to be sure, however there were almost two thousand lsapi installs under CloudLinux 5, 6 and 7

FUTURE IMPROVEMENTS

Connection pool mod_lsapi tries to use pool of persistent connections to lsphp

processes. Persistent connections to backends significantly increase

module performance. mod_lsapi can keep up to 50 persistent

connections for every socket name. In the case when the number of

connections used at the same time exceeds the maximum, the module

will process the next request in conventional, non-persistent mode.

Random socket nameMod_lsapi will be use for communication with lsphp socket with

random name

lsphp cold start improvementWill be added notification mechanism for detection if lsphp was

started

mod_lsapi+criuWill be added criu support to speed up lsphp startup time

https://criu.org/Main_Page



Now a bit more about future improvements mod_lsapi will try to use persistent connections to backend process which will significally increase module performance For better security mod_lsapi will use random named lsphp sockets Will be added notification mechanism for detection if lsphp was started Will be added criu support to speed up lsphp startup time

cPanel Servers$ /usr/bin/switch_mod_lsapi –uninstall

DirectAdmin servers$ cd /usr/local/directadmin/custombuild$ ./build update$ ./build set php1_release [any other php type]$ ./build php n$ ./build apache

RPM:$ yum erase mod_lsapi$ rm [path to mod_lsapi.conf]# restore standard php handler$ service httpd restart

UNINSTALL mod_lsapi



Uninstall process depends form control panel used. For cpanel it is single command to switch_mod_lsapi utility. On directadmin server you have to choose other type of PHP handler with custombuild utility, then rebuild php and apache On rpm based install you will have to erase mod_lsapi package and restore original php handler with apache configs.

Performance tests

TEST SERVER CONFIGURATION:

Test consists of hitting sites powered by php installed different ways (suphp, itk+mod_php, mod_ruid2 +

mod_php etc).

Tested site: wordpress (for checking opcache effect), simple script for checking environment effects, more

complex php script for checking environment and opcahce effects.

Environment effects - fork, connect, poll and other algorithms in php, which can affect response time.

• Intel(R) Core(TM) i5-2300 CPU @ 2.80GHz

• 8Gb memory

• CloudLinux Server release 6.6 (Leonid Kizim)

• php 5.3+no cagefs+no LVE(unlimited)

• apache 2.2



We have done a bunch of performance tests to compare mod_lsapi with most popular PHP setups. We were testing simple and complex php scripts including environment effects like fork, connect, poll which can affect reponse time. As well precisely tested wordpress based sites.

Performance tests (wordpress)

wordpress test opcache (req per second) no opcache (req per second)

suphp 23.86 41.36

mod_fcgid 112.21 5.42

itk 180.49 45.36

php-fpm 277.42 52.71

mod_ruid2 322.14 53.77

mod_lsapi 325.56 54.12

Wordpress test

400

300

200

100

0

opcacheno opcache

Req

uest

s pe

r sec

ond

suphp mod_fcgid itk php-fpm mod_ruid2 mod_lsapi

php type



Without using opCache almost all engines show same results, shown as green bars on a chart. With opCache we see significant improvements using lsapi, almost same results when mod_ruid2 used. PHP-FPM goes third, but if we are talking about setting it up and configuring per user – it will loose a lot of points Widely used suphp do not support opcode cache so it goes last. Mod_lsapi is fourteen times better then suphp.

Questions?

Twitter.com/CloudLinuxOS Visit CloudLinux.com



Thanks for watching, now it’s time for questions which you can ask using a form in gotowebinar software. ----- READ QUESTION BEFORE ANSWERING -- -- if do not know answer: I am not ready to answer this question, will have to talk to developers first. Better to ask it on our forum -- -- ------ Since we do not have any more questions I wanna thank averyone for attending, we will have a recorded version sent to you by email as well. Have a nice day. --- FINISH WEBINAR

SUPERCHARGING€¦ · SUPERCHARGING. PHP pages with mod_lsapi . in CloudLinux OS. Hi all.\爀䴀礀...

Documents

Transcript of SUPERCHARGING€¦ · SUPERCHARGING. PHP pages with mod_lsapi . in CloudLinux OS. Hi all.\爀䴀礀...