APM with Apache proxy

[tflorac (Thierry Florac)]

Elasticsearch version: 6.6.2 (Free license)

APM Server version: 6.6.2

APM Agent language and version: Java 1.4.0

Original install method (e.g. download page, yum, deb, from source, etc.) and version: deb

Fresh install or upgraded from other version?: Fresh install

Is there anything special in your setup? Apache proxy frontend

I'm trying to configure an Apache proxy in front of my APM server to filter IP addresses which are allowed to connect to my APM server and add authentication.
With the Java agent, and simple Apache ProxyPass/ProxyPassReverse configuration, I always get 408 proxy timeout errors (which I don't get while using the Python agent, or when connecting directly to APM server).
I tried to increase ProxyTimeout but this doesn't seems to work!
So which Apache configuration should I use to be able to use Java agent this way?
Best regards,
Thierry

[digitalron (Ronald Tumulak)]

Hi Thierry,

Can you share your Apache config please?
Also, to clarify your question, is this correct:

BAD:  JavaAgent ----------- Apache ---------> APM
GOOD: JavaAgent ----------------------------> APM
GOOD: PythonAgent ---------- Apache --------> APM
GOOD: PythonAgent --------------------------> APM

Is it possibly a firewall issue between the JavaAgent and Apache?

Regards,

Ronald

[felixbarny (Felix Barnsteiner)]

Hi

Unlike the Python agent, the Java agent uses chunked-encoding to stream the tracing data to the APM Server. By default, it keeps the HTTP request open for 10 seconds. This interval is configurable via api_request_time.

That means that your proxy has to have a timeout which is higher than 10 seconds. You should also set the proxy-sendchunked flag, so that Apache does not buffer the chunks but directly sends them to the APM Server. This is not strictly required but recommended for efficiency.

See also this blog for more information about the protocol: https://www.elastic.co/blog/increasing-memory-efficiency-with-an-improved-elastic-apm-internal-intake-protocol

Cheers,
Felix

[tflorac (Thierry Florac)]

Yes Ronald, your diagram is correct!

This is the main sample of my Apache configuration:

ProxyPass               /       [http://127.0.0.1:8200/](http://127.0.0.1:8200/)

ProxyPassReverse        /       [http://127.0.0.1:8200/](http://127.0.0.1:8200/)

Timeout                 600

<Location />

    AuthType                Basic

    AuthName                "APM server authentication"

    AuthBasicProvider       file

    AuthUserFile            "/etc/apache2/users.conf"

    Require user  apm

    # Local access

    Require ip      127.0.0.1

    # Remote access

    Require ip      172.22.201.21

</Location>

Best regards,

Thierry

Le mer. 20 mars 2019 à 08:55, Ronald Tumulak via Discuss the Elastic Stack elastic@discoursemail.com a écrit :