Originally posted by: deesk

  I recently updated my version of Apache on my AIX 7.2 system and when I attempt to start it I get:

 /opt/freeware/apache/sbin/apachectl restart
/opt/freeware/apache/sbin/apachectl restart: httpd not running, trying to start
httpd: Syntax error on line 513 of /opt/freeware/etc/httpd/conf/httpd.conf: Syntax error on line 17 of /opt/freeware/etc/httpd/conf/extra/httpd-ssl.conf: Cannot load /opt/freeware/lib/httpd/modules/mod_ssl.so into server: \t0509-022 Cannot load module /opt/freeware/lib/httpd/modules/mod_ssl.so.\n\t0509-150   Dependent module /opt/freeware/lib/libssl.a(libssl.so) could not be loaded.\n\t0509-152   Member libssl.so is not found in archive \n\t0509-022 Cannot load module /opt/freeware/lib/httpd/modules/mod_ssl.so.\n\t0509-150   Dependent module /opt/freeware/lib/httpd/modules/mod_ssl.so could not be loaded.
/opt/freeware/apache/sbin/apachectl restart: httpd could not be started
 

This server also functions as my lpar2rrd server so it is very important to get this back in working order. I had to update it from an earlier version due to a security finding, the version I am trying to get started is:

httpd -v
Server version: Apache/2.4.18 (Unix)
Server built:   May 11 2016 06:37:40
 

Originally posted by: AyappanP

Two things here.

First, The httpd version you have is pretty much old. You need to upgrade to 2.4.41 level. 

Second, you have openssl rpm also installed. AIX Toolbox packages are built against openssl lpp fileset. 

I would recommend to upgrade the packages to the latest level. That will fix this issue.

Originally posted by: deesk

I do have the openssl lpp fileset installed:

lslpp -l |grep -i openssl
  openssl.base            1.0.2.2001  COMMITTED  Open Secure Socket Layer
  openssl.man.en_US       1.0.2.2001  COMMITTED  Open Secure Socket Layer
  openssl.base            1.0.2.2001  COMMITTED  Open Secure Socket Layer
 

Originally posted by: AyappanP

Even though you have openssl lpp fileset, /opt/freewarelib/libssl libraries will be given higher priority because of library search path.

So either you have to upgrade to the latest httpd or remove the openssl rpm. 

Originally posted by: deesk

Well I cannot remove it because the rrdtool needs it:

 rpm -e openssl-1.0.1g-1.ppc
error: Failed dependencies:
        openssl >= 1.0.1 is needed by (installed) rrdtool-1.4.8-2.ppc
 

Also is this best way to verify what version of apache I have running:

httpd -v
Server version: Apache/2.4.18 (Unix)
Server built:   May 11 2016 06:37:40

Originally posted by: deesk

I was able to update, I think, because when I try to restart apache it appears something is on the port:

/opt/bin/apachectl -t && /opt/bin/apachectl start
Syntax OK
(67)Address already in use: AH00072: make_sock: could not bind to address [::]:80
(67)Address already in use: AH00072: make_sock: could not bind to address 0.0.0.0:80
no listening sockets available, shutting down
AH00015: Unable to open logs
 

Originally posted by: deesk

I downloaded the latest httpd as you stated and attempted to start apache, now I get:

 ./apachectl restart
./apachectl restart: httpd not running, trying to start
httpd: Syntax error on line 78 of /opt/freeware/etc/httpd/conf/httpd.conf: Cannot load /opt/freeware/lib/httpd/modules/mod_authz_host.so into server: rtld: 0712-001 Symbol ap_get_useragent_host was referenced\n      from module /opt/freeware/lib/httpd/modules/mod_authz_host.so(), but a runtime definition\n      of the symbol was not found.
./apachectl restart: httpd could not be started
 

Originally posted by: AyappanP

I hope you are not modifying apachectl script to point some other httpd binary.

From apachectl script.,

     44 # the path to your httpd binary, including options if necessary
     45 HTTPD='/opt/freeware/sbin/httpd'
 

Compare these outputs with yours.

# ls -l /opt/freeware/sbin/httpd
-rwxr-xr-x 1 root system 1336295 Sep 26 00:34 /opt/freeware/sbin/httpd
 

# dump -Tov /opt/freeware/sbin/httpd | grep ap_get_useragent_host
[1407]  0x20005cf8    .data      EXP     DS   Ldef        [noIMid] ap_get_useragent_host
 

Originally posted by: deesk

No I am not modifying anything, there is an older version of apache on the server, but not running, not sure if that would cause issues.

Here is my output:

ls -l /opt/freeware/sbin/httpd
-rwxr-xr-x    1 root     system      1336295 Sep 26 01:34AM /opt/freeware/sbin/httpd
 

dump -Tov /opt/freeware/sbin/httpd | grep ap_get_useragent_host
[1407]  0x20005cf8    .data      EXP     DS   Ldef        [noIMid] ap_get_useragent_host

Also here is the entry from the apache start:

# |||||||||||||||||||| START CONFIGURATION SECTION  ||||||||||||||||||||
# --------------------                              --------------------
#
# the path to your PID file
PIDFILE=/var/opt/freeware/apache/run/httpd.pid
#
# the path to your httpd binary, including options if necessary
HTTPD=/opt/freeware/apache/sbin/httpd
#
# a command that outputs a formatted text version of the HTML at the
# url given on the command line.  Designed for lynx, however other
# programs may work.
LYNX="lynx -dump"
#
# the URL to your server's mod_status status page.  If you do not
# have one, then status and fullstatus will not work.
STATUSURL="http://localhost/server-status"
 

Originally posted by: deesk

Just for clarity this is the 1.3 apache config that will start and run:

# |||||||||||||||||||| START CONFIGURATION SECTION  ||||||||||||||||||||
# --------------------                              --------------------
#
# the path to your httpd binary, including options if necessary
HTTPD='/opt/IBM/HTTPServer/bin/httpd -d /opt/IBM/HTTPServer'
#
# pick up any necessary environment variables
if test -f /opt/IBM/HTTPServer/bin/envvars; then
  . /opt/IBM/HTTPServer/bin/envvars
fi
#
# a command that outputs a formatted text version of the HTML at the
# url given on the command line.  Designed for lynx, however other
# programs may work.
LYNX="lynx -dump"
#
# the URL to your server's mod_status status page.  If you do not
# have one, then status and fullstatus will not work.
STATUSURL="http://localhost:80/server-status"
 

Originally posted by: AyappanP

Your apachectl has wrong entry for httpd.

It should point to /opt/ freeware/sbin/httpd. Are you sure using the apachetl supplied by httpd rpm?

Originally posted by: deesk

I am pretty sure I am, kind of new territory for me, have been an AIX/Unix admin, still learning some about Linux and RPM's. 

How would be the easiest way to show this? 

rpm -qa |grep -i httpd
httpd-2.4.41-1.ppc
 

Also I added this to the /opt/freeware/sbin/httpd file and attempting to restart it new error:

./apachectl restart
httpd: Syntax error on line 513 of /opt/freeware/etc/httpd/conf/httpd.conf: Syntax error on line 17 of /opt/freeware/etc/httpd/conf/extra/httpd-ssl.conf: Cannot load /opt/freeware/lib/httpd/modules/mod_ssl.so into server: \t0509-022 Cannot load module /opt/freeware/lib/httpd/modules/mod_ssl.so.\n\t0509-150   Dependent module /opt/freeware/lib/libssl.a(libssl.so.1.0.2) could not be loaded.\n\t0509-152   Member libssl.so.1.0.2 is not found in archive \n\t0509-022 Cannot load module /opt/freeware/lib/httpd/modules/mod_ssl.so.\n\t0509-150   Dependent module /opt/freeware/lib/httpd/modules/mod_ssl.so could not be loaded.

Now I know you had mentioned about removing this RPM?

 rpm -qa |grep -i openssl
openssl-1.0.1g-1.ppc
 

Originally posted by: AyappanP

Your openssl is very old. Update it and try again.

Originally posted by: deesk

 Okay, I am going to wait until I attempt this again, every time I perform this it breaks my lpar2rrd tool, and I need to have it for this upcoming weekend for an Lpar migration. 

Again running the httpd -v command does not guarantee you are on the correct version of apache? I think it just looks at the entry in the /usr/sbin file for httpd?

httpd -v
Server version: Apache/2.4.18 (Unix)
Server built:   May 11 2016 06:37:40
 

Originally posted by: AyappanP

AIX Toolbox httpd rpm don't ship the binary in /usr/sbin. It ships only in /opt/freeware/sbin. 

So you are invoking a different one. 

Originally posted by: deesk

Okay, I did run the command from that path:

# /opt/freeware/sbin/httpd -v
Server version: Apache/2.4.18 (Unix)
Server built:   May 11 2016 06:37:40
 

Originally posted by: AyappanP

Can you try reinstalling httpd rpm once again and then try invoking "/opt/freeware/sbin/httpd -v" again ? 

Originally posted by: deesk

Okay, I will try this probably first part of next week, I am currently running on the older version and that is supporting my lpar2rrd application.

I have attempted to reinstall it a few times and again(not sounding like a broken record) and get same error:

./apachectl start
httpd: Syntax error on line 513 of /opt/freeware/etc/httpd/conf/httpd.conf: Syntax error on line 17 of /opt/freeware/etc/httpd/conf/extra/httpd-ssl.conf: Cannot load /opt/freeware/lib/httpd/modules/mod_ssl.so into server: \t0509-022 Cannot load module /opt/freeware/lib/httpd/modules/mod_ssl.so.\n\t0509-150   Dependent module /opt/freeware/lib/libssl.a(libssl.so) could not be loaded.\n\t0509-152   Member libssl.so is not found in archive \n\t0509-022 Cannot load module /opt/freeware/lib/httpd/modules/mod_ssl.so.\n\t0509-150   Dependent module /opt/freeware/lib/httpd/modules/mod_ssl.so could not be loaded.
./apachectl start: httpd could not be started
 

Originally posted by: AyappanP

Updating the httpd rpm is the best solution for this. 

One temporary workaround will be to extract libssl.so & libcrypto.so from /usr/lib/libssl.a & /usr/lib/libcrypto.a  and put them inside /opt/freeware/lib/libssl.a & /opt/freeware/lib/libcrypto.a

mkdir temp ; cd temp

/usr/bin/ar -x /usr/lib/libssl.a

/usr/bin/ar -q /opt/freeware/lib/libssl.a  libssl.so

Need to do the same for libcrypto

Originally posted by: deesk

So these examples are how you extract it?   I assuming this will not break the other apache version I have running?

mkdir temp ; cd temp

/usr/bin/ar -x /usr/lib/libssl.a

/usr/bin/ar -q /opt/freeware/lib/libssl.a  libssl.so

Originally posted by: AyappanP

Yes. It won't break anything.

Originally posted by: deesk

Okay, did not get the error but it did break the lpar2rrd application, after I started it I got this message:

It Works!  For the URL.

I started the older Apache version and the lpar2rrrd stuff is working. I will do some more investigation of what that app needs, of course I do not have support for that product..