Re: Tomcat was shutdown by self

2008-05-06 Thread Ronny Sisworo

Chris,
Tomcat version 5.5.20.
No body to do that, but in log file of Tomcat, I can see process shutdown 
and no body login OS admin.

Setting parameter Tomcat: not start and shutdown automatically.

Regards,
Ronny


- Original Message - 
From: Christopher Schultz [EMAIL PROTECTED]

To: Tomcat Users List users@tomcat.apache.org
Sent: Tuesday, May 06, 2008 10:18 AM
Subject: Re: Tomcat was shutdown by self



-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Ronny,

Ronny Sisworo wrote:
| I have a problem with Tomcat on Solaris 10.

What version of Tomcat?

| 2-4 times in a week (24x7) - random, Tomcat was shutdown by self.

Why do you think Tomcat shuts itself down? What is in the log files?

- -chris

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkgfzeoACgkQ9CaO5/Lv0PCH6QCgpO7Rn+ZWfov5eQVwfpgQqDmS
fWsAoJm0r8hMPnxv0S2kKQI37JLjZFPX
=Usmz
-END PGP SIGNATURE-

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]




-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Tomcat problem on a multiple CPU system

2008-05-06 Thread Leon Rosenberg
just 2 cents, if your 8 IEs are running in one process, which is
default to my knowledge, they are sharing the same urlhelper/toolkit
which default to 4 max parallel connections.
I suggest you write a small java programm that tests it for you (with
commons-httpclient) or use jmeter or at least wget/curl.

regards
Leon


On Mon, May 5, 2008 at 1:10 PM, Gilbert, Antoine [EMAIL PROTECTED] wrote:
 I open 8 IE on a remote computer, basically once a JSP is called, the
  browser is just waiting the process to be done.



  -Original Message-
  From: David Smith [mailto:[EMAIL PROTECTED]
  Sent: 4 mai 2008 23:00
  To: Tomcat Users List
  Subject: Re: Tomcat problem on a multiple CPU system

  Can you describe how you open the 8 browser windows and what browser you

  are using?  I ask because those 8 browser windows may be coming from one

  process and using at most 2 connections, hence the slower processing.
  Firefox normally only has one process no matter how you open the new
  windows.  IE can be 8 separate processes if you launch each separately
  from Explorer (ie the Start button or desktop shortcut) and not use the
  new window menu option or ctrl-n.

  --David

  Gilbert, Antoine wrote:
   Well, each process is a image rendering process.
  
   But my point is, if I launch 8 threads directly in a JVM outside of
   tomcat, it run faster and use 100% of the 8 CPU...
  
   If I make a Servlet (or a JSP) who will start a process each time I
  call
   it (I call it 8 times).
  
   So, the big question is, why It's fast directly on the JVM and it's
  slow
   on Tomcat ? Why with Tomcat It's not possible to use 100% of all the 8
   CPU ? There is no data transfer between client and server, in both
  case
   the images are rendered on the disk.
  
   I just made this rendering test to expose the fact that I'm unable to
   make my tomcat use efficiently all my CPU.
  
   So the big question, why these 8 processes run betters than these 8
   process within Tomcat ?
  
  
  
   -Original Message-
   From: Alan Chaney [mailto:[EMAIL PROTECTED]
   Sent: 4 mai 2008 17:33
   To: Tomcat Users List
   Subject: Re: Tomcat problem on a multiple CPU system
  
   Hi Antoine
  
   The thing to remember is that this is a system which has (at least)
  four
  
   main parts:
  
   1. Tomcat
   2. The operating system
   3. A network connection
   4. Your application
  
   (and potentially)
  
   5. A database (but you didn't mention that)
  
   Here are some questions.
  
   1. How do you make the connection to the servlet. Does the browser run

   on the same machine as the application?
  
   2. Does you application create network traffic? If so, how many bytes
   are transferred to the browser? Each servlet thread will have to wait
   until the application has transferred all the data out.
  
   3. What kind of disk activity does your application generate? Is it
   different when the app is running from the servlet?
  
   Probably somewhere your servlet threads are sleeping waiting for a
   resource. You could do a thread dump to see what is happening (I don't

   use Windows so I can't remember how you do that with the Win setup)
  
   In the end, you'll need to profile the system to work out where the
   bottlenecks are. You'll need to use network analysers and probably
  Java
   profilers to track down what's happening such as when packets are
   received, when the replies are generated and maybe profile what your
   app. is doing.
  
   HTH
  
   Alan Chaney
  
  
  
  
   Gilbert, Antoine wrote:
  
   Hi
  
  
  
   I have a 2x quad core (8 cpu units) server.
  
  
  
   If I start a java program and this one is launching (at the same
  time)
  
   8
  
   thread doing some CPU intensive jobs, all the CPU are used at 100%,
  
   and
  
   that's what I'm expecting..
  
  
  
   But, if I am using tomcat, and I call a servlet 8 times to process
  
   these
  
   8 jobs, it take longer to execute these same 8 jobs and all the CPU
  
   are
  
   not used at 100%, it's more like 30%...
  
  
  
   Any idea about this problem or behavior ? I'm using Tomcat 5.5.17,
   windows, JDK 1.6
  
  
  
   Antoine
  
  
  
   !DSPAM:481e1bf27941527717022!
  
  
  
   -
   To start a new topic, e-mail: users@tomcat.apache.org
   To unsubscribe, e-mail: [EMAIL PROTECTED]
   For additional commands, e-mail: [EMAIL PROTECTED]
  
  
  
   -
   To start a new topic, e-mail: users@tomcat.apache.org
   To unsubscribe, e-mail: [EMAIL PROTECTED]
   For additional commands, e-mail: [EMAIL PROTECTED]
  
  


  --
  David Smith
  Network Operations Supervisor
  Department of Entomology
  Cornell University
  2132 Comstock Hall
  Ithaca, NY 14853
  Phone: (607) 255-9571
  Fax: (607) 255-0940


  -
  To start a new topic, e-mail: 

Re: CPU usage quirk with multiple tomcat instances

2008-05-06 Thread Lists
Yes, same webapp load - i.e. they're both handling the same number of
transactions per second.

I guess the only advantage of multiple JVM's is reliability - if one
instance goes down the other can still handle load on that machine.

Also; I guess someone thought originally that 2 instances doing less work
would be easier for the VM to handle and therefore more performant than one
instance doing it all - clearly not!  ( I didnt set this architecture up -
If it's best practice to use one VM on each app server then fair enough -
i'd like to read up why tho! )

Thanks!
Dan

- Original Message 
From: Tomcat Users List users@tomcat.apache.org
To: Tomcat Users List users@tomcat.apache.org
Subject: Re: CPU usage quirk with multiple tomcat instances
Date: 04/05/08 12:49

 -BEGIN PGP SIGNED MESSAGE-
 Hash: SHA1
 
 Da,
 
 Lists wrote:
 |gt; My guess (and that's all it is) is that you have eliminated much of
the
 |gt; context-switching overhead that two instances would have compared to
one.
 |
 | Ah I see.  I guess i can look at that with mpstat and look at things
like
 | thread migrations etc.  Important because if we install more CPU's i
guess
 | that may mitigate the context switching overhead.  Or maybe we can gain
 | performance by tying zones to one or two cpu's.
 
 Is there any advantage to running multiple JVMs on a single machine? Why
 not just give your single JVM a big chunk of memory and let it do its
thing?
 
 | Opteron 254 vs 252.  So 0.2ghz less but afaik no other difference.  Not
 | enough of a difference to account for the additional cpu.  so this box
 uses
 | 80% cpu vs 30% on the other one for the same load.
 
 Do you mean quot;same webapp loadquot;? Obviously, that addition load is
coming
 from /somewhere/. What about other services running on the same machine?
 
 - -chris
 -BEGIN PGP SIGNATURE-
 Version: GnuPG v1.4.9 (MingW32)
 Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
 
 iEYEARECAAYFAkgdrqkACgkQ9CaO5/Lv0PCgqACfRxKediPbJyxkYpcBA0z1Qslt
 5M8An1t6VYvyOh3+tMThcXqIZcHQFGVc
 =y2AR
 -END PGP SIGNATURE-
 
 -
 To start a new topic, e-mail: users@tomcat.apache.org
 To unsubscribe, e-mail: [EMAIL PROTECTED]
 For additional commands, e-mail: [EMAIL PROTECTED]
 
 
 


Message sent using UebiMiau 2.7.10



-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: CPU usage quirk with multiple tomcat instances

2008-05-06 Thread Leon Rosenberg
Hello Dan,

what also may happening is that you have unneeded or errorneous
synchronisation somewhere in your code. Two instances : less code in
same block and vm, effectively less synchronization.

try to profile whether some use cases take longer on the single tomcat
per machine.

We once tried to run multiple tomcats on one machine and the results
where opposed to yours: less performance, so i think your app behaves
funny :-)

regards
Leon


On Fri, May 2, 2008 at 2:42 PM, Lists [EMAIL PROTECTED] wrote:
 Hi,

  We have a Tomcat app that is loadbalanced by hardware.  I have 4 boxes
  available in our test env, all of which vary slightly but not massively in
  spec.

  Anyway I moved from 2 tomcat instances on each machine ( listening on
  different ports ) down to 1 and I noticed for the same load the cpu
  utilisation dropped by 20%.  Interesting, how can this be explained?  Is
  this the extra effort in tomcat or something?  Or is it memory related? the
  2 instances had 1gb each, and the single one has been given 4gb.  However I
  have jprofiled the instance and it has never seemed memory hungry.  Anyway I
  suspect even at 2gb for 1 instance it would still be 20% less cpu - i can
  always do a run to prove this if people think that necessary..

  Another thing i've found is that on one server I have abnormally high CPU
  utilisation for the same load.  I've checked the logging levels are all the
  same as are the java VM and the VM config settings.  I wonder what else
  could cause this?  All i can think is some sort of OS or hardware
  malfunction! maybe the CPU cache is duff or something.

  Many thanks to any input to my Friday weird-ness!
  Dan

  
  Message sent using UebiMiau 2.7.10



  -
  To start a new topic, e-mail: users@tomcat.apache.org
  To unsubscribe, e-mail: [EMAIL PROTECTED]
  For additional commands, e-mail: [EMAIL PROTECTED]



-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Tomcat Production Configuration

2008-05-06 Thread Peter Stavrinides
Hi All

My question concerns optimizing Tomcat.

Our setup is roughly this:
- Dual Quad Core with 8 gigs memory (4 gigs dedicated for Tomcat)
- Single instance of Tomcat6 
- Single web application (Java Servlet)
- AJP connector

A little about the application:
The site is relatively low volume, however traffic spikes when our newsletter 
is sent out. The application is complex and connects to a large research 
database serving a number large pages with reports, charts, data tables etc, 
which are generated dynamically from live data... sessions tend to get quite 
large. My thinking is that I should be supporting in the region of 200 to 300 
sessions as a minimum.

So given this setup, how should I configure the connector with regards to: 
maxThreads and any other relevant attributes. I am thinking of about 300 
threads? I would be grateful for your advice.

Thanks for your help,

Peter



-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Tomcat Production Configuration

2008-05-06 Thread Peter Stavrinides
Sorry I forgot to add:

 Connector port=8009 protocol=AJP/1.3 
connectionTimeout=2
enableLookups=false 
redirectPort=8443 maxThreads=300/

We also run under SSL, which is taken care of by Apache.


- Original Message -
From: Peter Stavrinides [EMAIL PROTECTED]
To: Tomcat Users List users@tomcat.apache.org
Sent: Tuesday, 6 May, 2008 12:16:17 PM GMT +02:00 Athens, Beirut, Bucharest, 
Istanbul
Subject: Tomcat Production Configuration

Hi All

My question concerns optimizing Tomcat.

Our setup is roughly this:
- Dual Quad Core with 8 gigs memory (4 gigs dedicated for Tomcat)
- Single instance of Tomcat6 
- Single web application (Java Servlet)
- AJP connector

A little about the application:
The site is relatively low volume, however traffic spikes when our newsletter 
is sent out. The application is complex and connects to a large research 
database serving a number large pages with reports, charts, data tables etc, 
which are generated dynamically from live data... sessions tend to get quite 
large. My thinking is that I should be supporting in the region of 200 to 300 
sessions as a minimum.

So given this setup, how should I configure the connector with regards to: 
maxThreads and any other relevant attributes. I am thinking of about 300 
threads? I would be grateful for your advice.

Thanks for your help,

Peter



-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



JkMount Syntax for complete directory mounting

2008-05-06 Thread Stephanie Wullbieter
Hello, 

if I want the whole apache directory tree /servlet/ and all the files and 
directories within to be routed to Tomcat worker1, what of the following is 
correct in mod_jk.conf?

JkMount /servlet/ worker1


JkMount /servlet worker1


JkMount /servlet/* worker1


JkMount /servlet worker1
JkMount /servlet/* worker1
(both together)

?

Many Thanks!
-- 
GMX startet ShortView.de. Hier findest Du Leute mit Deinen Interessen!
Jetzt dabei sein: http://www.shortview.de/[EMAIL PROTECTED]

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



How to use a custom formater for org.apache.juli.FileHandler

2008-05-06 Thread Zlatan Kadragić
I have
changed logging.properties file in conf directory so that i have
different log files for different web apps.
This is what i have changed/added to that file:

handlers = 1catalina.org.apache.juli.FileHandler,
2localhost.org.apache.juli.FileHandler,
3manager.org.apache.juli.FileHandler, 4admin.org.apache.juli.FileHandler,
5host-manager.org.apache.juli.FileHandler, java.util.logging.ConsoleHandler,
6nomad.org.apache.juli.FileHandler
...

6nomad.org.apache.juli.FileHandler.level = FINE
6nomad.org.apache.juli.FileHandler.directory = ${catalina.base}/logs
6nomad.org.apache.juli.FileHandler.formatter =
biz.zviz.util.logging.NomadLogFormatter
6nomad.org.apache.juli.FileHandler.prefix = nomad.

...

org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/Nomad].level
= INFO
org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/Nomad].handlers
= 6nomad.org.apache.juli.FileHandler

Everything works O.K. if I do not set my custom formatter or if I set
java.util.logging.SimpleFormatter. But with custom formatter I loose all
LogRecords from /Nomad.

My formatter implementation is:
public class NomadLogFormatter extends java.util.logging.Formatter {
public NomadLogFormatter() {
super();
}

@Override
public String format(LogRecord logRec) {
long time = logRec.getMillis();
String msg = logRec.getMessage() == null ? no message :
logRec.getMessage();
return String.format(FORMAT_STRING, time, msg);
}
public static final String FORMAT_STRING = %1$tF %1$tT - %2$s%n;

}

I tried to put this class to common/classes, i have tried to put
NomadLogFormatter.jar to common/lib, also to include it to my web app, but I
always get this exception as first message when do restart Tomcat:

java.util.logging.ErrorManager: 4
java.lang.NullPointerException
at org.apache.juli.FileHandler.open(FileHandler.java:257)
at org.apache.juli.FileHandler.init(FileHandler.java:50)
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at
sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:39)
at
sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:27)
at java.lang.reflect.Constructor.newInstance(Constructor.java:494)
at java.lang.Class.newInstance0(Class.java:350)
at java.lang.Class.newInstance(Class.java:303)
at
org.apache.juli.ClassLoaderLogManager.readConfiguration(ClassLoaderLogManager.java:396)
at
org.apache.juli.ClassLoaderLogManager.readConfiguration(ClassLoaderLogManager.java:341)
at
org.apache.juli.ClassLoaderLogManager.readConfiguration(ClassLoaderLogManager.java:236)
at java.util.logging.LogManager$2.run(LogManager.java:254)
at java.security.AccessController.doPrivileged(Native Method)
at
java.util.logging.LogManager.readPrimordialConfiguration(LogManager.java:252)
at java.util.logging.LogManager.getLogManager(LogManager.java:235)
at java.util.logging.Logger.init(Logger.java:201)
at java.util.logging.LogManager$RootLogger.init(LogManager.java:969)
at java.util.logging.LogManager$RootLogger.init(LogManager.java:966)
at java.util.logging.LogManager$1.run(LogManager.java:179)
at java.security.AccessController.doPrivileged(Native Method)
at java.util.logging.LogManager.clinit(LogManager.java:156)
at java.util.logging.Logger.getLogger(Logger.java:254)
at
org.apache.commons.logging.impl.Jdk14Logger.getLogger(Jdk14Logger.java:152)
at org.apache.commons.logging.impl.Jdk14Logger.init(Jdk14Logger.java:53)
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at
sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:39)
at
sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:27)
at java.lang.reflect.Constructor.newInstance(Constructor.java:494)
at
org.apache.commons.logging.impl.LogFactoryImpl.newInstance(LogFactoryImpl.java:529)
at
org.apache.commons.logging.impl.LogFactoryImpl.getInstance(LogFactoryImpl.java:235)
at
org.apache.commons.logging.impl.LogFactoryImpl.getInstance(LogFactoryImpl.java:209)
at org.apache.commons.logging.LogFactory.getLog(LogFactory.java:351)
at org.apache.catalina.startup.Bootstrap.clinit(Bootstrap.java:53)


What is the problem? Please help me.


How to add tomcat messages and System.out to log

2008-05-06 Thread Michal Singer

Hi.
I am using tomcat 6  log4j configuration.
I can't see the tomcat source files log messages in the log.
and also i can't see the System.out in the log.

I tried using: swallowOutput=true in the context file
I also configured in the log4j.properties:
log4j.logger.org.apache=DEBUG, FILE
log4j.logger.org.apache.catalina=DEBUG, FILE
log4j.logger.org.apache.catalina.core.ContainerBase.[Catalina].[localhost]=DEBUG,
FILE 
log4j.logger.org.apache.catalina.core=DEBUG, FILE 
log4j.logger.org.apache.catalina.session=DEBUG, FILE 

But nothing seems to work.

Does any one know how to do this?

Thanks, Michal
-- 
View this message in context: 
http://www.nabble.com/How-to-add-tomcat-messages-and-System.out-to-log-tp17080363p17080363.html
Sent from the Tomcat - User mailing list archive at Nabble.com.


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: JkMount Syntax for complete directory mounting

2008-05-06 Thread Mladen Turk

Stephanie Wullbieter wrote:

if I want the whole apache directory tree /servlet/ and all the files and 
directories within to be routed to Tomcat worker1, what of the following is 
correct in mod_jk.conf?

JkMount /servlet worker1
JkMount /servlet/* worker1
(both together)



Both

You can even use short notion:
JkMount /servlet|/* worker1
that will basically produce two
mappings; /servlet and /servlet/*

Regards
--
^(TM)

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Tomcat Service Stops in XP

2008-05-06 Thread Marcos
Hi people

I have installed tomcat 5.5 in many pc with windows xp and never had a problem..
but now i have one that when i start tomcat the server stops but it self
in few seconds...
i tried to start with right click in icon on taskbar - start
and going to xp services - Apache Tomcat - Run.. service start but in 2 o
3 seconds stops...
what can i do?
thanks for any help.

Marcos



-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



RE: Tomcat Service Stops in XP

2008-05-06 Thread Peter Crowther
 From: Marcos [mailto:[EMAIL PROTECTED]
 I have installed tomcat 5.5 in many pc with windows xp and
 never had a problem..
 but now i have one that when i start tomcat the server stops
 but it self
 in few seconds...
 i tried to start with right click in icon on taskbar - start
 and going to xp services - Apache Tomcat - Run.. service
 start but in 2 o
 3 seconds stops...
 what can i do?
 thanks for any help.

Anything in the Windows event log?  Anything in the Tomcat logs?  If you run 
netstat -n from a command prompt soon after the service stops, is there any TCP 
socket in TIME_WAIT to the shutdown port (usually port 8005) on the local 
machine?

- Peter

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Installing tomcat on multiple cpu X_86 64 bit machine

2008-05-06 Thread sur_1805

i m very new to tomcat. Now i have to install the tomcat 5.5 and jdk 1.5 on a
multiple cpu( 4 dual core processors) 64 bit machine.
i m confused with first step. how i tune the tomcat and do load balancing
such that tomcat servlet make use of all the 4 processors when i perform
multiple request.
whether tomcat uses all the cpu or not?
please help me for the same.
-- 
View this message in context: 
http://www.nabble.com/Installing-tomcat-on-multiple-cpu-X_86-64-bit-machine-tp17082098p17082098.html
Sent from the Tomcat - User mailing list archive at Nabble.com.


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



RE: Installing tomcat on multiple cpu X_86 64 bit machine

2008-05-06 Thread Peter Crowther
 From: sur_1805 [mailto:[EMAIL PROTECTED]
 i m very new to tomcat. Now i have to install the tomcat 5.5
 and jdk 1.5 on a
 multiple cpu( 4 dual core processors) 64 bit machine.
 i m confused with first step. how i tune the tomcat and do
 load balancing
 such that tomcat servlet make use of all the 4 processors
 when i perform multiple request.
 whether tomcat uses all the cpu or not?
 please help me for the same.

Tomcat uses one Java thread for each concurrent connection, up to the 
maxThreads setting in conf/server.xml.  If the load is high enough, and 
assuming your operating system recognises all the CPUs (you don't say which OS 
you are using), Java and hence Tomcat will use all cores on all processors 
automatically; you do not need to do anything to enable this.

- Peter

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



RE: JAAS authenticated user fails authorization check

2008-05-06 Thread Robin Coe
Problem is, the GenericPrincipal class is in the Catalina jar, which is 
available to Tomcat as a native library but for me to make use of it, I'd have 
to include it in my web-app lib.

I was hoping to be container-agnostic and avoid any proprietary libraries, 
which is why I used JNDI and JAAS.  I want to be able to hook into my security 
wrapper without necessarily going through Tomcat's security realm.

So, my options are to include the Catalina jar in my context or create my own 
mappings between resources and roles.  In the former case, I'll have a 
maintenance issue, because I'll have to ensure that the developers know that 
the jar needs to be kept in sync with the Tomcat environment.  In the latter 
case, I'll be manually doing what Tomcat can do.  However, if I am to be truly 
agnostic, that is what I should do anyway.

Thanks for your help, Chris, it's been very valuable.

Robin.

-Original Message-
From: Christopher Schultz [mailto:[EMAIL PROTECTED]
Sent: Monday, May 05, 2008 11:16 PM
To: Tomcat Users List
Subject: Re: JAAS authenticated user fails authorization check

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Robin,

Robin Coe wrote:
| Thanks Chris, that must be it. Can't believe I missed that.
| Unfortunately, this class is part of the Catalina codebase, which makes
| it necessary to use a runtime check and invoking a GenericPrincipal
| subclass when running inside Tomcat. I don't want to include the
| Catalina jar or be dependent on running Tomcat exclusively.

I don't understand. You shouldn't have to do any of that stuff... just
extend GenericPrincipal and you should be good to go.

| I find it strange that the code works by calling
| request.isUserInRole(), when using a class that implements the Principal
| interface, but fails when using declared roles. It's annoying that the
| Tomcat docs don't mention the necessity of extending GenericPrincipal
| when rolling your own implementation.

That's because you generally don't roll your own half-implementation,
which is what you've done, here.

Tomcat expects its own implementation not to be subverted. Principal
does not have an isInRole method, so it's got to come from somewhere
else. Sorry!

If you want complete control over authentication and authorization, you
can check out securityfilter (http://securityfilter.sourceforge.net/),
although you may find that you have to implement a lot of your own stuff
if you really want a lot of control. You should be able to use Tomcat
realms (including JAASRealm) along with it, though.

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkgfzXYACgkQ9CaO5/Lv0PCpmwCfUDA0PVnkAgDZCoQLnj8OLG8t
6HUAn1h8EgQthejlUtsaedZHjl4ajKwB
=dqgf
-END PGP SIGNATURE-

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Hide Users password when using JMX

2008-05-06 Thread Gunnar.Bostrom
Hi,
I'm using JMX to monitor Tomcat 5.5.25 and it works fine.

But I don't like that password of Users are revealed.
Is it possible to configure Tomcat/JMX so that passwords are not shown?

Regards
Gunnar

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



RE: Installing tomcat on multiple cpu X_86 64 bit machine

2008-05-06 Thread sur_1805



Peter Crowther wrote:
 
 From: sur_1805 [mailto:[EMAIL PROTECTED]
 i m very new to tomcat. Now i have to install the tomcat 5.5
 and jdk 1.5 on a
 multiple cpu( 4 dual core processors) 64 bit machine.
 i m confused with first step. how i tune the tomcat and do
 load balancing
 such that tomcat servlet make use of all the 4 processors
 when i perform multiple request.
 whether tomcat uses all the cpu or not?
 please help me for the same.
 
 Tomcat uses one Java thread for each concurrent connection, up to the
 maxThreads setting in conf/server.xml.  If the load is high enough, and
 assuming your operating system recognises all the CPUs (you don't say
 which OS you are using), Java and hence Tomcat will use all cores on all
 processors automatically; you do not need to do anything to enable this.
 
 - Peter
 
 -
 To start a new topic, e-mail: users@tomcat.apache.org
 To unsubscribe, e-mail: [EMAIL PROTECTED]
 For additional commands, e-mail: [EMAIL PROTECTED]
 
 
 

thanks peter for you information. i m using linux(RHEL 5) with 16 GB RAM.Is
it possible to split the JVM off into multiple processes for the hundreds of
threads we end up running?
How much memory i have to allocate to heap memory that is sufficient and do
not become the major performance bottleneck.?


-- 
View this message in context: 
http://www.nabble.com/Installing-tomcat-on-multiple-cpu-X_86-64-bit-machine-tp17082098p17083155.html
Sent from the Tomcat - User mailing list archive at Nabble.com.


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Hide Users password when using JMX

2008-05-06 Thread Mark Thomas

[EMAIL PROTECTED] wrote:

Hi,
I'm using JMX to monitor Tomcat 5.5.25 and it works fine.

But I don't like that password of Users are revealed.
Is it possible to configure Tomcat/JMX so that passwords are not shown?


Use digested passwords.

Mark


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: TOMCAT CLUSTERING HOWTO

2008-05-06 Thread karthikn

Hi

How to test TOMCAT CLUSTERING with out Load balancer

As Per the Tomcat 5.5.23 Cluster HowTo Documents

I have only tried to Cluster 2 TOMCATS on SAME Machine , Sharing same JVM.

but not able to SAMPLE TEST the clustering


Am i on doing some thing wrong in here.?



Please Some body suggest me  . :(

with regards
Karthik




karthikn wrote:

Hi

How to test TOMCAT CLUSTERING with out Load balancer

As Per the Tomcat 5.5.23 Cluster HowTo Documents

I have only tried to Cluster 2 TOMCATS on SAME Machine , Sharing same JVM.

but not able to test the clustering


Am i on doing some thing wrong in here.?




with regards
Karthik









Landon Fabbricino wrote:
  

I honestly have not tried clustering tomcat without Apache before.

Just recently I set up a server farm with apache on one server and tomcat on 
two other servers (so 3 physical machines)

Apache contains the logic to handle the load balancing between the two 
tomcats:

jk.conf
JkWorkersFile   conf/workers.properties
JkLogFile   logs/jk_conn.log
JkLogLevel  error

JkMount /loadbalance-test*  loadbalancer

workers.properties
### Load Balancer Instances 
  worker.tomcat1.type=ajp13
  worker.tomcat1.host=server1.domain.com
  worker.tomcat1.port=8009  #AJP Port
  worker.tomcat1.lbfactor=1

  worker.tomcat4.type=ajp13
  worker.tomcat4.host=server2.domain.com
  worker.tomcat4.port=8010#AJP Port
  worker.tomcat4.lbfactor=1


### Define Mount Points 

  # Load Balance #
  worker.loadbalancer.type=lb
  worker.loadbalancer.balance_workers=tomcat1,tomcat2
  worker.loadbalancer.sticky_session=False
  worker.loadbalancer.method=B

### Load Mount Points   
  worker.list=loadbalancer








karthikn [EMAIL PROTECTED] 4/30/2008 10:57:51 PM 

  

Hi

As Per the Tomcat 5.5.23 Cluster HowTo Documents

I have only tried to Cluster 2 TOMCATS on SAME Machine , Sharing same JVM.

  Could you provide your apache's worker.properties file?

I have so far not used any APACHE Http Server for Load Balancing




with regards
Karthik





Landon Fabbricino wrote:



Could you provide your apache's worker.properties file?




  

karthikn [EMAIL PROTECTED] 4/30/2008 8:05:02 AM 




Hi

Any more suggestions ?


with regards
Karthik

karthikn wrote:


  

Hi

 distributable/

I have already added the same in my application's web.xml,
but still no improvement.




with regards
Karthik



Landon Fabbricino wrote:





If I am not mistaken, you will need to add the following tag to your web.xml

CATALINA_HOME/webapps/your_app_name/WEB-INF/web.xml
  !-- Required for session-replication in clustering mode  --
  distributable/



Landon Fabbricino
IT Applications

Phone: 403.225.7515
Fax: 403.225.7604
[EMAIL PROTECTED]





  

karthikn [EMAIL PROTECTED] 4/28/2008 11:34:43 PM 






Hi

The Following was done for the Clustering  (2 tomcats )

Values  TOMCAT5523_ITOMCAT5523_II



Startup 80818082
ShutDown80078008



APJ 80098010
TCP Listener40014002
tcpListenAddressautoauto
jvmRoutenode01  node02



Delpoyment of a war file on TOMCAT5523_I  displays in console as

   INFO: Starting clustering manager at /DATAGRID
Apr 29, 2008 10:17:59 AM
org.apache.catalina.cluster.session.DeltaManager getAll
ClusterSessions
WARNING: Manager [/DATAGRID], requesting session state from
org.apache.catalina.
cluster.mcast.McastMember[tcp://10.10.16.63:4002,catalina,10.10.16.63,4002,
aliv
e=17593]. This operation will timeout if no session state has been
received with
in 60 seconds.
Apr 29, 2008 10:18:59 AM
org.apache.catalina.cluster.session.DeltaManager waitFo
rSendAllSessions
SEVERE: Manager [/DATAGRID]: No session state send at 4/29/08 10:17 AM
received,
 timing out after 60,109 ms.


TOMCAT5523_II displays on console as

 INFO: Replication member
added:org.apache.catalina.cluster.mcast.McastMember[tcp
://10.10.16.63:4001,catalina,10.10.16.63,4001, alive=16]
Apr 29, 2008 10:17:59 AM
org.apache.catalina.cluster.session.ClusterSessionListe
ner messageReceived
SEVERE: Context manager doesn't exist:/DATAGRID


Am i missing something while clustering

with regards
Karthik



karthikn wrote:




  

Hi

I have few Questions which i was not able to get TOMCAT CLUSTERING HOWTO
and form.




a) Clustering

1) Do we need to deploy the war files  on each individual Tomcat
when joined the clustering.
   deploy your apps only to one server, and the cluster will
distribute  the deployments across the entire cluster.

This does not seems to work, after following the steps for 2
Tomcats (or am i missing some thing in here.)

2) Is this a must do configuration

  Make sure that all nodes have the same time and sync with
  

RE: Hide Users password when using JMX

2008-05-06 Thread Caldarale, Charles R
 From: [EMAIL PROTECTED] 
 [mailto:[EMAIL PROTECTED] 
 Subject: Hide Users password when using JMX
 
 But I don't like that password of Users are revealed.

To quote from the Tomcat doc:

MemoryRealm is a simple demonstration implementation of the Tomcat 6
Realm interface. It is not designed for production use.

You shouldn't be using the tomcat-users.xml file for any serious work.
Configure a real Realm with a real authentication mechanism.

 - Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
MATERIAL and is thus for use only by the intended recipient. If you
received this in error, please contact the sender and delete the e-mail
and its attachments from all computers.

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



RE: Installing tomcat on multiple cpu X_86 64 bit machine

2008-05-06 Thread Peter Crowther
 From: sur_1805 [mailto:[EMAIL PROTECTED]
 i m using linux(RHEL 5) with 16 GB RAM.

OK.

 Is
 it possible to split the JVM off into multiple processes for
 the hundreds of threads we end up running?

Sort-of, but think: why would you want to?  Modern Linuxes can handle hundreds 
of threads per process without worrying.

If you want to do this, you could run multiple JVMs with some kind of 
load-balancer in front of them.  Some sites do this for reliability - losing 
one JVM doesn't kill the site.  There's another thread on the list at the 
moment that shows that some people find it slower, others find it faster.  It 
seems to depend on the application.

There is no way of splitting a *single* JVM into multiple processes.

 How much memory i have to allocate to heap memory that is
 sufficient and do
 not become the major performance bottleneck.?

As much as your application needs - and that depends almost entirely on your 
app, as I suspect under 1% of the load will be Tomcat's overhead!  Your only 
way to find that out is to profile your application, on your hardware, with 
your database, under your realistic load.  Nobody on this list will be able to 
offer further advice except on profiling tools (we all have our favourites) and 
monitoring applications.

- Peter

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Hide Users password when using JMX

2008-05-06 Thread Gunnar.Bostrom
Hi,
Thanks for answering.
All regular users are in a database with passwords MD5 encoded, but not 
handled by Tomcat.
The concern I have is the users tomcat and manager that must be in the 
tomcat-users.xml file or don't they?

Regards
Gunnar

 

 -Ursprungligt meddelande-
 Från: Caldarale, Charles R [mailto:[EMAIL PROTECTED] 
 Skickat: den 6 maj 2008 16:03
 Till: Tomcat Users List
 Ämne: RE: Hide Users password when using JMX
 
  From: [EMAIL PROTECTED]
  [mailto:[EMAIL PROTECTED]
  Subject: Hide Users password when using JMX
  
  But I don't like that password of Users are revealed.
 
 To quote from the Tomcat doc:
 
 MemoryRealm is a simple demonstration implementation of the 
 Tomcat 6 Realm interface. It is not designed for production use.
 
 You shouldn't be using the tomcat-users.xml file for any serious work.
 Configure a real Realm with a real authentication mechanism.
 
  - Chuck
 
 
 THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE 
 PROPRIETARY MATERIAL and is thus for use only by the intended 
 recipient. If you received this in error, please contact the 
 sender and delete the e-mail and its attachments from all computers.
 
 -
 To start a new topic, e-mail: users@tomcat.apache.org To 
 unsubscribe, e-mail: [EMAIL PROTECTED]
 For additional commands, e-mail: [EMAIL PROTECTED]
 
 

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Hide Users password when using JMX

2008-05-06 Thread Mark Thomas

[EMAIL PROTECTED] wrote:

Hi,
Thanks for answering.
All regular users are in a database with passwords MD5 encoded, but not 
handled by Tomcat.
The concern I have is the users tomcat and manager that must be in the 
tomcat-users.xml file or don't they?


Nope.
You can use any realm with any webapp. This includes admin and manager.
You can digest passwords all realms.

Mark


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



RE: url-pattern not working with AxisServlet

2008-05-06 Thread Kurt Kavanaugh

That would be a correct. :) Perhaps an interesting annotation in the
Axis 2 documentation as I am sure we are not the only ones using the
connector.

Straight forward once detected, but with all the setup that goes on
introducting a new SOAP stack to a legacy development environment in can
be overlooked. Case in point.

Kurt

-Original Message-
From: Christopher Schultz [mailto:[EMAIL PROTECTED] 
Sent: Monday, May 05, 2008 11:22 PM
To: Tomcat Users List
Subject: Re: url-pattern not working with AxisServlet

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Kurt,

Kurt Kavanaugh wrote:
| Not seeing the AxisServlet being invoked for /services/*
url-pattern...

[snip]

| servlet-mapping
| servlet-nameAxisServlet/servlet-name
| url-pattern/services/*/url-pattern
| /servlet-mapping

[snip]

| Apache [httpd] access INFO
|
| 127.0.0.1 - - [05/May/2008:12:05:30 -0400] GET /services/TestService
| HTTP/1.1 404 306

404, eh?

| Note there is no corresponding entry in the TOMCAT access log.

No corresponding Tomcat access log entry, eh?

| http://localhost//test/foo.do?SERIALNUMBER=XXXSTATUS=2
| the appropriate struts action gets called... however If I do this

Other URLs work, eh?

Sounds like you are missing a JkMount /services/* myWorker in your
Apache httpd config file.

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkgfzvIACgkQ9CaO5/Lv0PBM0QCgqzbtnTkMl7HyPSdtZNhcRRU7
QBcAn1KulzOgCD0iisSLtwLcjsfaOD2D
=yqJ/
-END PGP SIGNATURE-

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: JAAS authenticated user fails authorization check

2008-05-06 Thread Christopher Schultz

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Robin,

Robin Coe wrote:
| Problem is, the GenericPrincipal class is in the Catalina jar, which
| is available to Tomcat as a native library but for me to make use of
| it, I'd have to include it in my web-app lib.

Actually, no. GenericPrincipal as loaded by Tomcat's ClassLoader would
be incompatible with the GenericPrincipal class as loaded by your
webapp's ClassLoader. You'd need to put your authentication code into
Tomcat's lib directory in order to use it properly.

| I was hoping to be container-agnostic and avoid any proprietary
| libraries, which is why I used JNDI and JAAS.

But, you did use your own Principal implementation. Forgive my ignorance
regarding JAAS, but I was under the impression that it is atypical to
implement your own Principal object.

| I want to be able to hook into my security wrapper without
| necessarily going through Tomcat's security realm.

Container-managed security is pretty much intended to be self-contained.
You can't get Tomcat-managed authentication and authorization and yet
avoid Tomcat's security classes. Sorry.

| So, my options are to include the Catalina jar in my context or
| create my own mappings between resources and roles.  In the former
| case, I'll have a maintenance issue, because I'll have to ensure that
| the developers know that the jar needs to be kept in sync with the
| Tomcat environment.  In the latter case, I'll be manually doing what
| Tomcat can do.  However, if I am to be truly agnostic, that is what I
| should do anyway.

Maintaining a Tomcat-compatible security library will be much easier
than implementing your own authentication and authorization framework
(but feel free to do so!).

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkggrBQACgkQ9CaO5/Lv0PBgHgCgr62b+5TvN4YHA3uiyz/stkDv
njAAnjXnytJQvxWGRjDbq1lDxkWiUHvc
=Fi6E
-END PGP SIGNATURE-

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: url-pattern not working with AxisServlet

2008-05-06 Thread Christopher Schultz

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Kurt,

Kurt Kavanaugh wrote:
| That would be a correct. :) Perhaps an interesting annotation in the
| Axis 2 documentation as I am sure we are not the only ones using the
| connector.
|
| Straight forward once detected, but with all the setup that goes on
| introducting a new SOAP stack to a legacy development environment in can
| be overlooked. Case in point.

I disagree that Axis should document this requirement. Axis has no
requirements necessitating the use of Apache httpd. If your own
environment has such requirements, it is up to you to appropriately
configure it. There is plenty of documentation on using mod_jk to
connect httpd to Tomcat.

- -chris

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkggrJoACgkQ9CaO5/Lv0PApfQCePT7N9MEscpnbLGyeqdHaDYPS
ir4AoLUDqCheYCZR8JIXl3mlAkLLf6dq
=jG9A
-END PGP SIGNATURE-

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Tomcat was shutdown by self

2008-05-06 Thread Christopher Schultz

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Ronny,

Ronny Sisworo wrote:
| No body to do that, but in log file of Tomcat, I can see process
| shutdown and no body login OS admin.

So, what is in the log files? Does Tomcat emit standard shutdown log
messages, or does the JVM crash?

| Setting parameter Tomcat: not start and shutdown automatically.

I do not understand.

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkggrPwACgkQ9CaO5/Lv0PBaGACeJv3vjxLQNQH5lkzC0jtqq/SK
JQIAniUhRtQMJHbi7gMea26gRwAB4ij5
=R0xS
-END PGP SIGNATURE-

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Web server and tomcat - firewall

2008-05-06 Thread Andrew Hole
Hi all|



Maybe you could help me to solve a problem with your experience.

My company has implemented a solution of 3 layers (Apache web server, Tomcat
Container and Database). There is a firewall between the web server and the
tomcat.

We get the following errors in mod_jk log:



These errors are caused by loss of TCP packages in firewall (???).

[Tue May 06 16:24:03 2008] [2704:3128] [error] jk_ajp_common.c (951): (p11)
can't receive the response message from tomcat, network problems or tomcat (
10.202.131.130:8009) is down (errno=54)

[Tue May 06 16:24:03 2008] [2704:3128] [error] jk_ajp_common.c (1592): (p11)
Tomcat is down or refused connection. No response has been sent to the
client (yet)

(is not true when log says that tomcat is down because some requests get the
correct response)



Setting JkOptions + DisableReuse in httpd.conf does not solve the problem.
Any suggestions?



Thank you and I apologise for the inconvenience.



Greetings


RE: JAAS authenticated user fails authorization check

2008-05-06 Thread Robin Coe
Chris,

You are quite correct about the classpath contention.  I should have been 
clear; to make use of the libraries in my IDE, I'd have to include the jar in 
my lib folder for development, not deploy the jar with the web-app.  That, or 
use introspection to avoid the IDE compile problems and then rely on Tomcat to 
create the necessary objects at runtime.  I'm not a fan of programming around 
exceptions, though, which I'd need to allow the security wrapper to be deployed 
to another container.

As for JAAS and creating your own Principals, I think that's pretty much a 
requirement, if you're doing something other than using the java.security file 
and using a GUI app.  There aren't too many Principal types, for any 
customizations you may need to make.  For example, Tomcat has its own 
GenericPrincipal class, as well as security principal, whos type I forget at 
the moment.

The JAAS login method uses a callback handler, which normally puts up a dialog 
when login() is called without credentials in the handler.  Obviously, that's 
not really an option with a web-app, so you have to roll your own login() and 
commit() implementations, using the callback handler as the data source to 
populate your Principals.  So, if you want to use JNDI and JAAS, you have no 
choice but to write your own JAAS module that hooks into your own JNDI module, 
since Tomcat handles one but not both.

Basically, I really don't like having to specify LDAP account information in 
clear text in a tomcat config file.  As well, with my own implementation, I'm 
not reliant on securing access to my resources via HTTP requests.  It is 
definitely more work but is a lot more flexible in the end.

-Robin.

-Original Message-
From: Christopher Schultz [mailto:[EMAIL PROTECTED]
Sent: Tuesday, May 06, 2008 3:06 PM
To: Tomcat Users List
Subject: Re: JAAS authenticated user fails authorization check

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Robin,

Robin Coe wrote:
| Problem is, the GenericPrincipal class is in the Catalina jar, which
| is available to Tomcat as a native library but for me to make use of
| it, I'd have to include it in my web-app lib.

Actually, no. GenericPrincipal as loaded by Tomcat's ClassLoader would
be incompatible with the GenericPrincipal class as loaded by your
webapp's ClassLoader. You'd need to put your authentication code into
Tomcat's lib directory in order to use it properly.

| I was hoping to be container-agnostic and avoid any proprietary
| libraries, which is why I used JNDI and JAAS.

But, you did use your own Principal implementation. Forgive my ignorance
regarding JAAS, but I was under the impression that it is atypical to
implement your own Principal object.

| I want to be able to hook into my security wrapper without
| necessarily going through Tomcat's security realm.

Container-managed security is pretty much intended to be self-contained.
You can't get Tomcat-managed authentication and authorization and yet
avoid Tomcat's security classes. Sorry.

| So, my options are to include the Catalina jar in my context or
| create my own mappings between resources and roles.  In the former
| case, I'll have a maintenance issue, because I'll have to ensure that
| the developers know that the jar needs to be kept in sync with the
| Tomcat environment.  In the latter case, I'll be manually doing what
| Tomcat can do.  However, if I am to be truly agnostic, that is what I
| should do anyway.

Maintaining a Tomcat-compatible security library will be much easier
than implementing your own authentication and authorization framework
(but feel free to do so!).

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkggrBQACgkQ9CaO5/Lv0PBgHgCgr62b+5TvN4YHA3uiyz/stkDv
njAAnjXnytJQvxWGRjDbq1lDxkWiUHvc
=Fi6E
-END PGP SIGNATURE-

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



RE: url-pattern not working with AxisServlet

2008-05-06 Thread Kurt Kavanaugh

Respectfully disagree

Then why document Tomcat/Axis? Where is the line drawn? Axis has no
business level requirements to run in a given container technology. Or
do they?

If a given set of elements, Apache,connector,Tomcat make up a common
model of deployment why not facilitate?

Anyway just an opinion, as stated I take full blame for not picking this
up earlier.

However, documentation is good. I see no downside, other than the time
it takes to do so, and time is everything...

:)

Kurt


-Original Message-
From: Christopher Schultz [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, May 06, 2008 3:08 PM
To: Tomcat Users List
Subject: Re: url-pattern not working with AxisServlet

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Kurt,

Kurt Kavanaugh wrote:
| That would be a correct. :) Perhaps an interesting annotation in the
| Axis 2 documentation as I am sure we are not the only ones using the
| connector.
|
| Straight forward once detected, but with all the setup that goes on
| introducting a new SOAP stack to a legacy development environment in
can
| be overlooked. Case in point.

I disagree that Axis should document this requirement. Axis has no
requirements necessitating the use of Apache httpd. If your own
environment has such requirements, it is up to you to appropriately
configure it. There is plenty of documentation on using mod_jk to
connect httpd to Tomcat.

- -chris

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkggrJoACgkQ9CaO5/Lv0PApfQCePT7N9MEscpnbLGyeqdHaDYPS
ir4AoLUDqCheYCZR8JIXl3mlAkLLf6dq
=jG9A
-END PGP SIGNATURE-

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



RE: JAAS authenticated user fails authorization check

2008-05-06 Thread Caldarale, Charles R
 From: Christopher Schultz [mailto:[EMAIL PROTECTED] 
 Subject: Re: JAAS authenticated user fails authorization check
 
 but I was under the impression that it is atypical to
 implement your own Principal object.

Actually, it's pretty much required to implement your own, unless you're
using Kerberos or LDAP, for which the JRE supplies somewhat adequate
implementations.

 - Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
MATERIAL and is thus for use only by the intended recipient. If you
received this in error, please contact the sender and delete the e-mail
and its attachments from all computers.

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Tomcat Production Configuration

2008-05-06 Thread Pid

Hi,

I'm not sure if this will apply in your case, but I found that 
offloading the mail to a second (relatively low spec as it happens) 
local machine improved the mail output rate considerably - mailouts went 
in about 1/4 of the previous time.


The local mail server was using CPU cycles and the servlet app using 
lots of memory in our case - combined on one machine the overall load 
rocketed and the web app seemed to suffer most.


Not exactly the answer you were looking for I guess, but tinkering with 
the connector attributes didn't actually seem to make a great deal of 
difference to us.



p


Peter Stavrinides wrote:

Sorry I forgot to add:

 Connector port=8009 protocol=AJP/1.3 
 	connectionTimeout=2
 	enableLookups=false 
 	redirectPort=8443 maxThreads=300/


We also run under SSL, which is taken care of by Apache.


- Original Message -
From: Peter Stavrinides [EMAIL PROTECTED]
To: Tomcat Users List users@tomcat.apache.org
Sent: Tuesday, 6 May, 2008 12:16:17 PM GMT +02:00 Athens, Beirut, Bucharest, 
Istanbul
Subject: Tomcat Production Configuration

Hi All

My question concerns optimizing Tomcat.

Our setup is roughly this:
- Dual Quad Core with 8 gigs memory (4 gigs dedicated for Tomcat)
- Single instance of Tomcat6 
- Single web application (Java Servlet)

- AJP connector

A little about the application:
The site is relatively low volume, however traffic spikes when our newsletter 
is sent out. The application is complex and connects to a large research 
database serving a number large pages with reports, charts, data tables etc, 
which are generated dynamically from live data... sessions tend to get quite 
large. My thinking is that I should be supporting in the region of 200 to 300 
sessions as a minimum.

So given this setup, how should I configure the connector with regards to: 
maxThreads and any other relevant attributes. I am thinking of about 300 
threads? I would be grateful for your advice.

Thanks for your help,

Peter



-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]





-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: url-pattern not working with AxisServlet

2008-05-06 Thread Christopher Schultz

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Kurt,

Kurt Kavanaugh wrote:
| Then why document Tomcat/Axis?

Because Axis needs to be installed on a Java application server. Tomcat
is a free one (and also under the Apache umbrella), so they go out of
their way to tell you how to get it going. Apache httpd has nothing to
do with it.

| Where is the line drawn? Axis has no
| business level requirements to run in a given container technology. Or
| do they?

Only that it supports a certain servlet specification (probably). The
ASF is not known for giving free advertising to commercial containers.

I checked, and there are no installation instructions for any container.
There are only two gotchas listed on their website: one for Tomcat 4.x
with Java 1.4 and one for weblogic.

| If a given set of elements, Apache,connector,Tomcat make up a common
| model of deployment why not facilitate?

For the most part, that model is falling out of favor.

| However, documentation is good.

Fair enough. My opinion is irrelevant, anyway, as I am not a committer
on the Asix project and have no part of any decision to update their
documentation. Feel free to petition them to update their documentation.

- -chris

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkgg0ZcACgkQ9CaO5/Lv0PAUbACgkJ4LJttBoEl+X6G+BnAlHSca
CqAAoIlRFD7dm2gg7jm+Zk1d1QgajJQP
=PpYK
-END PGP SIGNATURE-

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Web server and tomcat - firewall

2008-05-06 Thread Filip Hanik - Dev Lists


could be the extra space

JkOptions + DisableReuse

should be

JkOptions +DisableReuse

someone will correct me if I am wrong :)

if you are not using disable reuse, one has to match up the max clients on the 
httpd side with the maxThreads on the tomcat side, so that you don't leave 
connections hanging.

do a netstat -na |grep ajp port number
on both the httpd machine and the tomcat machine, to see the state of 
the AJP connections


Filip

Andrew Hole wrote:

Hi all|



Maybe you could help me to solve a problem with your experience.

My company has implemented a solution of 3 layers (Apache web server, Tomcat
Container and Database). There is a firewall between the web server and the
tomcat.

We get the following errors in mod_jk log:



These errors are caused by loss of TCP packages in firewall (???).

[Tue May 06 16:24:03 2008] [2704:3128] [error] jk_ajp_common.c (951): (p11)
can't receive the response message from tomcat, network problems or tomcat (
10.202.131.130:8009) is down (errno=54)

[Tue May 06 16:24:03 2008] [2704:3128] [error] jk_ajp_common.c (1592): (p11)
Tomcat is down or refused connection. No response has been sent to the
client (yet)

(is not true when log says that tomcat is down because some requests get the
correct response)



Setting JkOptions + DisableReuse in httpd.conf does not solve the problem.
Any suggestions?



Thank you and I apologise for the inconvenience.



Greetings

  



No virus found in this incoming message.
Checked by AVG. 
Version: 7.5.524 / Virus Database: 269.23.9/1417 - Release Date: 5/6/2008 8:07 AM
  



-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



RE: Installing tomcat on multiple cpu X_86 64 bit machine

2008-05-06 Thread sur_1805

thanks peter for your information, i m very new to this situation.

now. can i install the tomcat5.5 and jdk1.5 on machine(4 processor with 64
bit on RHEL 5) without need to worry about load balancing and tuning at the
time of installation?






Peter Crowther wrote:
 
 From: sur_1805 [mailto:[EMAIL PROTECTED]
 i m using linux(RHEL 5) with 16 GB RAM.
 
 OK.
 
 Is
 it possible to split the JVM off into multiple processes for
 the hundreds of threads we end up running?
 
 Sort-of, but think: why would you want to?  Modern Linuxes can handle
 hundreds of threads per process without worrying.
 
 If you want to do this, you could run multiple JVMs with some kind of
 load-balancer in front of them.  Some sites do this for reliability -
 losing one JVM doesn't kill the site.  There's another thread on the list
 at the moment that shows that some people find it slower, others find it
 faster.  It seems to depend on the application.
 
 There is no way of splitting a *single* JVM into multiple processes.
 
 How much memory i have to allocate to heap memory that is
 sufficient and do
 not become the major performance bottleneck.?
 
 As much as your application needs - and that depends almost entirely on
 your app, as I suspect under 1% of the load will be Tomcat's overhead! 
 Your only way to find that out is to profile your application, on your
 hardware, with your database, under your realistic load.  Nobody on this
 list will be able to offer further advice except on profiling tools (we
 all have our favourites) and monitoring applications.
 
 - Peter
 
 -
 To start a new topic, e-mail: users@tomcat.apache.org
 To unsubscribe, e-mail: [EMAIL PROTECTED]
 For additional commands, e-mail: [EMAIL PROTECTED]
 
 
 

-- 
View this message in context: 
http://www.nabble.com/Installing-tomcat-on-multiple-cpu-X_86-64-bit-machine-tp17082098p17097403.html
Sent from the Tomcat - User mailing list archive at Nabble.com.


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]