Last checked and updated on 03 Jun 2026
What Is New in Apache HTTP Server 2.2
| Category | Highlights |
|---|---|
| New Features | mod_proxy_balancer for load balancing; mod_proxy_ajp for Apache Tomcat (AJP 1.3); mod_filter for smart dynamic output filtering; Event MPM for efficient Keep-Alive handling; mod_dbd / apr_dbd SQL database abstraction layer; Large File Support (>2GB) on 32-bit Unix; mod_authn_alias for simplified auth configs; mod_authz_owner for filesystem-owner-based authorization; mod_version for version-conditional config blocks; httxt2dbm utility for RewriteMap dbm generation |
| Improvements | Refactored and renamed Authn/Authz module hierarchy (mod_auth_*, mod_authn_*, mod_authz_*); mod_cache / mod_disk_cache / mod_mem_cache promoted to production quality with htcacheclean tool; mod_authnz_ldap ported to new 2.2 auth framework with richer Require directive support; mod_ssl adds RFC 2817 TLS upgrade (cleartext-to-TLS in same connection); PCRE updated to version 5.0; graceful-stop signal support across prefork, worker, and event MPMs; GracefulShutdownTimeout directive added; mod_info gains ?config diagnostic argument; httpd -M flag lists all loaded DSO and static modules; default config layout simplified and modularised |
| Breaking Changes | APR 1.0 API adopted -- all deprecated APR/APR-Util symbols removed; Authentication modules renamed (mod_auth split, mod_access becomes mod_authz_host, etc.); pcreposix.h replaced by ap_regex.h -- regex calls must use ap_regcomp / ap_regexec; mod_imap renamed to mod_imagemap |
| Deprecations | Old-style monolithic mod_auth and mod_auth_dbm module names superseded by new naming scheme; Per-module ad-hoc SQL database management patterns replaced by ap_dbd / apr_dbd APIs |
What changed in the Apache 2.2 authentication and authorization system?
Apache 2.2 completely restructured its authentication and authorization modules, splitting the previously monolithic system into clearly scoped, composable units. In practice this means every module you loaded under 2.0 probably has a different name in 2.2, and your configuration will need updating.
The new naming convention follows a strict taxonomy:
- mod_auth_* -- implements an HTTP authentication mechanism (e.g., Basic, Digest)
- mod_authn_* -- provides a backend authentication provider (file, DBM, LDAP, alias)
- mod_authz_* -- implements authorization / access control (host, owner, groupfile)
- mod_authnz_* -- combined authentication and authorization in one module (LDAP)
Key renames to update in every vhost config:
# Apache 2.0 -> Apache 2.2
mod_auth -> mod_auth_basic + mod_authn_file
mod_auth_dbm -> mod_authn_dbm
mod_access -> mod_authz_host
mod_auth_ldap -> mod_authnz_ldap
The new mod_authn_alias module lets you define a named authentication provider once and reference it from multiple directory blocks -- a significant simplification for sites that repeat the same LDAP or DBM configuration across dozens of virtualhost definitions. Watch out for any AuthType directives that relied on the old combined module; they will silently fail if you enable 2.2 without renaming the LoadModule lines.
How does the Event MPM improve Keep-Alive performance in Apache 2.2?
The Event MPM solves one of the most well-known scalability bottlenecks in Apache: idle Keep-Alive connections tying up worker threads. In Apache 2.0 and earlier, a worker that accepted a Keep-Alive connection had to remain dedicated to that connection through the entire timeout period, even when there was no data in flight.
Apache 2.2 introduces the Event MPM, which offloads Keep-Alive management to a separate thread. Active worker threads are only allocated when data is actually being processed, freeing them immediately once a request completes. The result is a much higher connection-to-thread ratio under typical browser traffic.
This matters if your site serves many concurrent users with modern browsers, which open multiple Keep-Alive connections per page load. Most teams running high-traffic sites on 2.0 with inflated MaxClients to compensate for Keep-Alive blocking can drop that value considerably under the Event MPM.
# httpd.conf -- switch MPM to event (compile-time or with mod_so on some distros)
# On prefork/worker builds you must recompile; on distro packages:
# Ubuntu/Debian: a2dismod mpm_prefork && a2enmod mpm_event
# Then tune worker limits appropriately:
<IfModule mpm_event_module>
StartServers 2
MinSpareThreads 25
MaxSpareThreads 75
ThreadLimit 64
ThreadsPerChild 25
MaxRequestWorkers 150
MaxConnectionsPerChild 0
</IfModule>
What does Apache 2.2 offer for reverse proxying and load balancing?
Apache 2.2 ships two new proxy modules that close the gap between Apache and dedicated load balancers for most mid-scale deployments. mod_proxy_balancer provides software load balancing directly in Apache, while mod_proxy_ajp adds native support for the AJP 1.3 protocol used by Apache Tomcat.
mod_proxy_balancer supports multiple scheduling algorithms (byrequests, bytraffic, bybusyness) and exposes a web-based balancer manager at a configurable URL. In practice, this replaces external tools like HAProxy for simple Java app-tier balancing scenarios, and it integrates naturally with Apache's existing SSL termination, header rewriting, and access control layers.
<Proxy "balancer://mycluster">
BalancerMember "ajp://app1.internal:8009"
BalancerMember "ajp://app2.internal:8009"
ProxySet lbmethod=byrequests
</Proxy>
<Location "/app">
ProxyPass "balancer://mycluster/app"
ProxyPassReverse "balancer://mycluster/app"
</Location>
# Optional: expose balancer manager UI (restrict with IP access control)
<Location "/balancer-manager">
SetHandler balancer-manager
Require ip 192.168.1.0/24
</Location>
mod_proxy_ajp replaces the older and less robust mod_jk connector for many teams. It carries session state, SSL metadata, and remote IP information to Tomcat over the binary AJP wire protocol without the additional maintenance surface of a separate connector library.
How does mod_cache change in Apache 2.2 and is it ready for production?
Yes -- Apache 2.2 is the first release where the caching subsystem is officially considered production quality. In 2.0, mod_cache, mod_disk_cache, and mod_mem_cache all carried an experimental label; 2.2 removes that caveat following extensive stability work.
The most operationally important addition is htcacheclean, a standalone daemon that manages the on-disk cache used by mod_disk_cache. Without it, a busy server would grow the cache directory indefinitely. htcacheclean can be run on a schedule or as a long-running daemon that enforces a size limit, pruning the least-recently-used entries.
# Enable disk-based caching for backend proxy responses
CacheEnable disk /
CacheRoot /var/cache/apache2/mod_cache_disk
CacheDefaultExpire 3600
CacheMaxExpire 86400
CacheLastModifiedFactor 0.5
# Run htcacheclean as daemon, enforce 500MB limit, check every 120s
# htcacheclean -d120 -p/var/cache/apache2/mod_cache_disk -l500M
This matters if you are fronting dynamic application servers with Apache. Caching even short-TTL responses for high-cardinality URLs can eliminate a significant fraction of backend load without any application changes.
What breaking changes do module developers face when porting to Apache 2.2?
Third-party and in-house modules written against the Apache 2.0 APR API will require source changes before they compile against 2.2. Apache 2.2 adopts APR 1.0, which removes all symbols and function signatures that were previously marked deprecated.
The two most common code-level changes are:
- Regular expression API: Replace
#include "pcreposix.h"with#include "ap_regex.h". All calls to POSIX regex functions (regcomp,regexec,regfree) must be prefixed to theirap_counterparts (ap_regcomp,ap_regexec,ap_regfree). - SQL database management: Modules that managed their own database connections should migrate to the new
ap_dbd/apr_dbdAPIs. These provide pooled connection management across all modules, including optimised strategies for threaded MPMs, replacing the duplicated and often incompatible per-module connection logic that existed in 2.0.
Two smaller but useful additions for module authors: a test_config hook lets modules run setup code exclusively during httpd -t config tests, and the new ap_log_cerror function logs errors with the client's IP address attached -- something that was previously only available by carrying the connection record manually through every error path.
Frequently Asked Questions about Apache HTTP Server 2.2
Do I need to rename my authentication directives when upgrading from Apache 2.0 to 2.2?
Yes. The authentication modules were renamed as part of the Authn/Authz refactor, so LoadModule lines and any AuthType or AuthUserFile directives that reference old module names like mod_auth or mod_access must be updated to the new names such as mod_auth_basic, mod_authn_file, and mod_authz_host before the server will start correctly.
Is the Event MPM stable enough to use in production with Apache 2.2?
The Event MPM in 2.2 is suitable for production use but is best treated as an improved alternative to the Worker MPM rather than a drop-in replacement for Prefork. Sites that rely on non-thread-safe third-party modules or certain older PHP setups should continue using Prefork until those dependencies are resolved, since Event shares the threading model of Worker.
How do I run htcacheclean to prevent the disk cache from growing without bound?
Run htcacheclean as a daemon with a command like htcacheclean -d120 -p/var/cache/apache2/mod_cache_disk -l500M, where -d sets the interval in seconds between sweeps, -p is the cache root directory, and -l caps total cache size. Most production setups add this to a system init script alongside the main httpd service so both start and stop together.
What is mod_proxy_ajp and how does it differ from mod_jk?
mod_proxy_ajp is a built-in Apache module that speaks the AJP 1.3 protocol to backend servlet containers like Tomcat, eliminating the need to compile and maintain the separate mod_jk connector. It integrates with the standard mod_proxy configuration model and the mod_proxy_balancer load balancer, which means you configure it with the same ProxyPass and BalancerMember directives used for HTTP backends rather than a separate workers.properties file.
Can Apache 2.2 serve files larger than 2GB?
Yes, Apache 2.2 adds Large File Support for files exceeding 2GB on modern 32-bit Unix systems, along with support for request bodies larger than 2GB. No special directive is required; the capability is compiled in by default on supported platforms.
What does the httpd -M flag do that httpd -l did not?
The -l flag only lists modules that were statically compiled into the httpd binary. The new -M flag lists every loaded module, including those loaded dynamically at runtime via mod_so LoadModule directives, making it the definitive way to verify which modules are actually active for a given configuration without parsing the config file manually.