Skip to main content

Monitoring Apache

Apache is recognised the moment the agent sees its process, and everything below starts on its own within a minute. No mod_status, no exporter, no edits to your configuration. The agent asks the server for its virtual host list, finds the log files the configuration declares, and turns every virtual host into a monitored site.

How Apache is recognised​

Two definitions cover the two package families. A process named apache2 (Debian, Ubuntu and their derivatives) matches the apache definition; a process named httpd (RHEL, Rocky, Alma, Fedora, CentOS Stream) matches httpd. They collect the same things, but the metric names follow the binary: svc.apache.* on the first family, svc.httpd.* on the second. Each family also brings a log-shipping definition (logs-apache, logs-httpd) and an APM definition for mod_php (apm-php-apache, apm-php-httpd).

Once matched, the agent runs apache2ctl -v (or httpd -v) for the version, and every 5 minutes apache2ctl -S (or httpd -S) for the virtual host dump. In the same pass it walks /etc/apache2 (or /etc/httpd) for CustomLog and ErrorLog directives, resolving ${APACHE_LOG_DIR} from envvars, so per-site logs under custom directories are found rather than assumed. The access-log counters run every 60 seconds, log shipping every 30. An Apache that is installed but not running does not match.

What is collected​

Request rates. The agent tails every discovered access log from a saved offset and counts lines into three per-second rates: requests, 4xx responses and 5xx responses. The counters key on the request line and the status code as written by the common and combined formats. Nothing about individual requests leaves the host.

Sites. Every name the -S dump lists (named virtual hosts and the default server on each port) becomes a site with its own HTTP check through the Host header, TLS certificate days-left and trust verdict, DNS liveness of the domain, a CDN verdict, and the domain's registration age and expiry where the registry publishes them. The document root from the site's config file tells whether it runs WordPress. Per-site details live on Websites and domains.

Facts shown on the host page: version, access and error log paths, and per site whether it runs WordPress.

SignalMetric
Requests per secondsvc.apache.req_rate, or svc.httpd.req_rate on the RHEL family
4xx per secondsvc.apache.client_error_rate / svc.httpd.client_error_rate
5xx per secondsvc.apache.server_error_rate / svc.httpd.server_error_rate
Per-site latency, certificate, DNS, domainsvc.apache.vhost.* or svc.httpd.vhost.*, tagged by vhost

Names, tags and units are in the metrics reference.

Logs. The error log ships by default at notice level and above, with the level read from the [module:level] tag of each line; when the configuration names no path the agent falls back to /var/log/apache2/error.log or /var/log/httpd/error_log. Access lines are collected only when you switch the service to full depth in the console.

Alerts out of the box​

RuleFires whenSeverityShips
Site downevery local probe of a site failed for 10 minuteswarningauto
Certificate expired / expiringa site's certificate is past its end, or within 14 days of itcritical / warningon
Origin certificate expiredthe certificate is expired but the domain points at a CDN, so visitors see the edge certificatewarningon
Domain does not resolvethe site's domain answers NXDOMAIN for 10 minuteswarningon
Domain expiring / expiredregistration ends within 14 days, or has lapsedwarning / criticalon
Domain recently re-registeredthe registration is younger than 30 days on an existing sitewarningon
Service floods error logs50 or more error lines in 15 minuteswarningauto
Apache serves 5xx at a high ratemore than one 5xx per second sustained 10 minuteswarningoff

The site, certificate and domain rules are written against svc.%.vhost.*, so they cover both families. The 5xx-rate rule ships off because the rate that means trouble depends on how much traffic the site gets, and it watches svc.apache.server_error_rate: on an httpd host, create the same rule against svc.httpd.server_error_rate once you know your baseline. Site down needs every probe in the window to fail, so one slow response never raises it. Thresholds and hysteresis are in the rules catalog.

Going deeper​

  • mod_php sites get method-level traces through the apm-php-apache and apm-php-httpd definitions: the agent fingerprints the PHP build, provisions the signed extension, places the staged ini in the Apache SAPI's own conf.d, and reports the exact graceful reload for a human to run. See APM: how it works.
  • PHP-FPM behind Apache is covered from the pool side, see Monitoring PHP-FPM.
  • Logs at full depth include the access log, see Logs.
  • Outside-in checks on the same sites, see Synthetics.

When a path is not where Apache says it is​

The agent follows the paths in your CustomLog and ErrorLog lines. If a log lands elsewhere, set it yourself and the override takes precedence:

sudo wakora --set apache.access-log=/www/logs/access.log

On the RHEL family the section is httpd (httpd.access-log, httpd.error-log). Keys and the mechanism are in Agent configuration.

Limitations​

  • Rates need the request line and status code in the log format. A custom LogFormat without them, or a CustomLog piped into a program such as rotatelogs, produces no counts.
  • Request timing on the wire (the eBPF layer) is wired for nginx and Node.js, not for Apache; Apache rates come from the access log only.
  • Redirect-only virtual hosts are probed like any other site; the redirect recognition described on the websites page applies to nginx server blocks.
  • The per-site PHP version and the missing-PHP-backend check are read from nginx configurations and do not exist for Apache sites.
  • Only names printed as namevhost or default server are probed; ServerAlias names are not checked individually.
  • Log discovery walks /etc/apache2 or /etc/httpd; a configuration tree kept elsewhere needs the override above.
  • The site probe runs on the host against 127.0.0.1, so a CDN, a firewall or a broken DNS record between visitors and the box is invisible to it. That view comes from synthetics.