axelhahn/pimped-apache-status

Pimped Apache status page; PHP web application that renders server-status page and makes it readable; even for load balanced websites

Hi there 👋

I am a system administrator with former jobs as webmaster, webdeveloper and CAD support.

• I’m currently working at University of Bern (Switzerland) - Institute for Medical Education.
• I love to code in Bash and PHP to automate my sysadmin's daily life
• private projects are around
  • PHP stuff for Website analytics, monitoring, caching
  • Javascript: 5.1 surround player, password check
  • Docs: https://www.axel-hahn.de/docs/
• My website: https://www.axel-hahn.de/ (German only)

pimped-apache-status's Issues

bad slot stats with apache 2.4 (event)

I configured several servers with apache 2.2, and works without problem
then addes one with apache 2.4 ( Multi processing module: event ) and there is some problem with reporting and than in visualisation

250 Slots
Active: 12
Idle: 338
Unused: -100

apache config

StartServers 1
MinSpareThreads 25
MaxSpareThreads 75
ThreadsPerChild 25
MaxRequestWorkers 250
MaxConnectionsPerChild 10000

Problem with routes

Hi!

First, thanks for your great job. It's amazing!

But I have a problem with my installation.

I've installed it on /opt/apaches folder, but the URL is http://IP/apaches (is an "Alias" tag in the apache configuration).

So all the links are changed to http://IP/opt/apaches/.... becouse the file get the DIR value.

I've changed in the inc_config.php. I forced in this way:

//$sSelfURL=str_replace('\','/',str_replace(realpath($_SERVER['DOCUMENT_ROOT']), '', DIR));
$sSelfURL='/apaches';

But, it's possible a value for URL in next versions?

Thanks in advance.

After Upgrade unable to migrate configuration

Hy after upgrading from 1.x to the latest I was unable to migrate te configuration with the following issue:

AH01071: Got error 'PHP message: PHP Fatal error: Uncaught Error: Class 'confighandler' not found in /var/www/apache-status/upgrade.php:10\nStack trace:\n#0 {main}\n thrown in /var/www/apache-status/upgrade.php on line 10',

The php file exists and is readable:
/var/www/apache-status # ls -la classes/confighandler.class.php
-rw-r--r-- 1 www-data www-data 8753 Aug 16 17:17 classes/confighandler.class.php

Any suggestion ?
Thanks
Regards
C. Brassel

Exclude request from collection server.

The server-status request on the collection server is also aggregated.
I wish there was an option to exclude requests from the collection server from all aggregations.
For example, if the client is a collection server, it will be excluded from the aggregate, and information will not appear in all tables.

user_config file not working

Hi,
I am trying it set a password to secure it but it's not just working I tried normal text (password) and MD5 it but still not accepting my password so I have to set it false (I mean password). then it's public what should I do?

Installation wizard creates wrongly formatted auth file

There's a installation wizard, when visiting the unzipped software for the first time. When giving a username + password, it will create the following non-working config file as "config/config_user.json":

{
  "auth": "5ebe2294ecd0e0f08eab7690d2a6ee69"
}

Instead, the following output (+format) is expected:

{
  "auth": {
    "user": "my_chosen_username",
    "password": "5ebe2294ecd0e0f08eab7690d2a6ee69"
  }
}

With the result of the installation wizard, auth will not be activated + you will get PHP notices as following:

Warning: array_key_exists() expects parameter 2 to be array, string given in /var/www/html/status/inc_functions.php on line 79

Error when creating and updating 'checkupdate_*.tmp' file

PHP throws an error when creating and updating the checkupdate_*.tmp file. This happens since the inc_functions.php file is attempting to R/W this file in the systems default tmp folder (usually /tmp/) which is not accessible to PHP in hosts with safe_mode and open_basedir enabled.

$sSelfURL should be set by default to a URL not local path

After extract te setup and open the webpage, I found that many things like css and js files are loaded from /var/www/.... local path, which are for sure are not accessible from internet.

After some search I found, that this value is loaded from the environment var DOCUMENT_ROOT which is a bad idea.

pimped-apache-status/inc_config.php

Line 55 in 5a2037c

$sSelfURL=$aCfg['selfurl'] ? $aCfg['selfurl'] : str_replace('\\','/',str_replace(realpath($_SERVER['DOCUMENT_ROOT']), '', __DIR__));

is always the best idea, to use relative paths in your template, so that you dont need such a construct with fixed paths.

pimped-apache-status/classes/html.tpl.php

Line 12 in 5a2037c

<script src="{{APPDIR}}/javascript/functions.min.js" type="text/javascript"></script>

pimped-apache-status/classes/html.tpl.php

Line 13 in 5a2037c

<script src="{{APPDIR}}/javascript/counterhistory.class.min.js" type="text/javascript"></script>

pimped-apache-status/templates/default/out_html.php

Line 14 in 5a2037c

$sHead = '<link rel="stylesheet" type="text/css" href="' . $sSelfURL . '/templates/' . basename(dirname(__FILE__)) . '/style.min.css" media="screen">'

There you should just use the relative paths.

Vulnerabilities, how to proceed

I found some security issues, several vulnerabilities, how do I report them formally, so they can be fixed?

PHP error DivisionByZeroError

Hi,

i did only this:

• unpacked it
• opened in browser
• set the password

Now it is showing this PHP error:

PHP Fatal error:  Uncaught DivisionByZeroError: Division by zero in /home/.../apache.....sk/classes/datarenderer.class.php:1454
Stack trace:
#0 /home/.../apache.....sk/classes/datarenderer.class.php(1274): Datarenderer->renderWorkersBar(Array, 'localhost', 'px')
#1 /home/.../apache.....sk/classes/datarenderer.class.php(1342): Datarenderer->_getWorkersData(Array, true, 175)
#2 /home/.../apache.....sk/views/serverinfos.php(11): Datarenderer->renderGroupAndServers(Array)
#3 /home/.../apache.....sk/index.php(83): include('/home/.../apa...')
#4 {main}
 thrown in /home/.../apache.....sk/classes/datarenderer.class.php on line 1454

Downloaded vendor requests get 404 if running in root directory / subdomain

When downloading vendor libraries (to fetch from the local server), it will work fine across all pages, if pimped-apache-status is running in a sub-directory. Example:

# Example base installation URL
https://foo.bar.com/status/

# Example URL for admin:
https://foo.bar.com/status/admin/?&action=settings

# Example GET request to vendor resource 
https://foo.bar.com/status/vendor//jquery/3.3.1/jquery.min.js

When running pimped-apache-status on a subdomain, vendor downloads will not work inside "sub-folders", e.g. in admin settings and throw a 404. Example of this setup:

https://status.foo.com/

# Example URL for admin:
https://status.foo.com/admin/?&action=settings

# GET request to vendor resource:
https://status.foo.com/admin/vendor//jquery/3.3.1/jquery.min.js

Looks like, the URL creation for resources will not properly strip the first leading directory, even if needed so.

Record history

Is possible to record realtime data to database? So we can see the history of apache monitoring data in future, sort by date/time.

Thank you