Excessive processing time for PROPFIND requests

Question

hi,
i'm running web server 7.0U3 on Solaris 10 U5 (64-bit x86). in the 'perfdump' output, i see many PROPFIND requests for various files. for example, there are currently 324 'active sessions', of which about a third are PROPFIND - and many of these have been running for 60 seconds or more. according to the server error log, these are denied by the ACL:
[03/Nov/2008:17:10:54] security (18304): for host x.x.x.x trying to PROPFIND <URL to file>, acl-state reports: HTTP5191: access of <path to file> denied by ACL default directive 2
we don't use DAV and i have no interest in these requests, so being denied is not a problem. however, it seems to me the server is taking an excessive amount of time to deny them; i would assume, if they're denied by the ACL in PathCheck, that the response should be quick.
(the number of active PROPFINDs varies; after reloading perfdump, there are 154 active sessions, of which only four are PROPFINDs; but all have been running at least 4 seconds.)
how can i work out what's going on here - and more importantly, fix it (if there's a problem)?

Answer 1

mv,
here is the obj.conf for the virtual server:
<Object name="default">
        NameTrans fn="assign-name" from="/scripts/*" name="scripts"
        NameTrans fn="pfx2dir" from="/private" dir="/export/upload/fake-private"
        PathCheck fn="uri-clean"
        PathCheck fn="check-acl" acl="default"
        ObjectType fn="type-by-extension"
        ObjectType fn="force-type" type="text/plain"
        NameTrans fn="assign-name" from="/.perfdump" name="perfdump"
        <Client uri="*(.inc|\\~)$">
                Service fn="deny-existence"
        </Client>
        <Client uri="/.zfs/*">
                Service fn="deny-existence"
        </Client>
        Service method="POST" type="*~magnus-internal/*" fn="send-file" bucket="file-bucket"
        <If -f $path>
                Service method="(HEAD|GET)" type="*~magnus-internal/*" fn="send-file" bucket="file-bucket"
        </If>
        <Else>
                Service fn="restart" uri="/scripts/thumb-handler.php" bucket="missing-file-bucket"
        </Else>
</Object>
<Object name="es-internal">
        PathCheck fn="check-acl" acl="es-internal"
</Object>
<Object name="scripts">
        Service fn="responder-fastcgi" type="application/x-php" app-path="/opt/php/bin/php-cgi" min-procs="25" bucket="php-bucket"
</Object>
<Object name="perfdump">
Service fn="service-dump"
</Object>and here is the ACL:
version 3.0;
acl "es-internal";
allow (read,execute,info)
    user = "anyone";
deny (list,write,delete)
    user = "anyone";
acl "default";
authenticate (user,group) {
        method = "basic";
        prompt = "Sun Java System Web Server";
allow (read,execute,info)
    user = "anyone";
deny (list,write,delete)
        user = "anyone";server.xml:
<?xml version="1.0" encoding="UTF-8"?>
<!--
  Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  Use is subject to license terms.
-->
<server>
  <cluster>
    <local-host>ms1</local-host>
    <instance>
      <host>ms1</host>
    </instance>
  </cluster>
  <log>
    <log-file>/var/log/http/errors</log-file>
    <log-stdout>false</log-stdout>
    <log-level>info</log-level>
  </log>
  <temp-path>/tmp/https-ms1-5351d5c9</temp-path>
  <user>apache</user>
  <file-cache>
    <enabled>false</enabled>
    <sendfile>true</sendfile>
    <cache-content>false</cache-content>
  </file-cache>
  <default-auth-db-name>keyfile</default-auth-db-name>
  <auth-db>
    <name>keyfile</name>
    <url>file</url>
    <property>
      <name>syntax</name>
      <value>keyfile</value>
    </property>
    <property>
      <name>keyfile</name>
      <value>keyfile</value>
    </property>
  </auth-db>
  <acl-file>default.acl</acl-file>
  <mime-file>mime.types</mime-file>
  <access-log>
    <enabled>false</enabled>
    <file>/var/log/http/access</file>
  </access-log>
  <http-listener>
    <name>http-listener-1</name>
    <port>80</port>
    <server-name>ms1</server-name>
    <default-virtual-server-name>ms1</default-virtual-server-name>
  </http-listener>
  <virtual-server>
    <name>ms1</name>
    <http-listener-name>http-listener-1</http-listener-name>
    <host>ms1</host>
    <object-file>ms1-obj.conf</object-file>
    <document-root>/export/upload</document-root>
  </virtual-server>
  <event>
    <time>
      <time-of-day>03:00</time-of-day>
    </time>
    <rotate-access-log>false</rotate-access-log>
    <rotate-log>true</rotate-log>
  </event>
  <dav>
    <enabled>false</enabled>
  </dav>
  <thread-pool>
    <min-threads>64</min-threads>
    <max-threads>512</max-threads>
  </thread-pool>
</server>i wrote a small C program to send a PROPFIND request then immediately drop the connection. i ran it a few times, but i couldn't get a 'stuck' entry in perfdump. however, the server is currently fairly idle; i'll try this again at a busier time, which is when i saw the problem originally.