Apache by default will build on Unix with "pre-fork" mode for its worker threads, this does not use threads, and creates an inefficient interface to the policy server.
The better solution is to select the "worker" mode for the Apache build, which will then use a threading module. However often people are stuck using the "pre-fork" mode, since they cannot upgrade immediately. This article includes some methods for minimizing the impact.
Overview of Problem
With regards to working better with Apache pre-fork connections, as Apache themselves recommend:
The server can be better customized for the needs of the particular site.
For example, sites that need a great deal of scalability can choose to
use a threaded MPM like worker, while sites requiring stability or
compatibility with older software can use a prefork. In addition, special
features like serving different hosts under different userids (perchild) can be provided.
So it would be a good goal to change a setup from the pre-fork, or no-threaded module, to the worker threaded processing module.
However with SiteMinder the pre-fork module also causes several additional issues, mainly :
Why is worker mode better
Apache using "worker" mode still uses process, but each process also has about 20 worker threads. The thread pool can go up and down, but the number of process is both smaller and from a SiteMinder viewpoint, there is only one handshake per process, and all the threads in a pool share the connections to the policy server so they actually get re-used, and also load balanced between policy servers.
Why is Apache pre-fork the default
Unfortunately the out of the box, will compile on any Unix platform setting for an Apache build is pre-fork. It works on all Unix platforms because it does not use any threads. Threads are however now fairly consistent across most platforms so hopefully the default will be changed in the near future.
I am stuck with pre-fork for now what can I do?
The best solution is to use Apache worker mode, not pre-fork however that usually requires a re-build of the Apache executable.
If you are stuck with pre-fork mode for a while there are two major setting that will help reduce the problems that it causes:
hostname=''. maxsocketsperport='20'.minsocketsperport='2'. newsocketstep='2'.policyserver='policyserver1,44441,44442,44443'.policyserver='policyserver2,44441,44442,44443'.requesttimeout='60'The minsocketperport and newsocketstep should be reduced to 1.
minsocketsperport='1'.newsocketstep='1'.This will ensure that for your 100 Apache child process each will initially only establish 1 connection to each policy server, rather than two, since each process is only handling one request at a time, there is no advantage of having more than one connection to each policy server. That will halve your connections.