mod_jk Problem

2009-04-15 Thread Munkhbold.B
Hi

 

I have a problem with tomcat connector mod_jk.

From time to time the connector completely hangs apache. 

Tomcat alone is still alive, but apache no longer replies to requests, and I
need to restart both

 

In mod_jk logs file I have a lot of lines like

 

[info] init_jk::mod_jk.c (3183): mod_jk/1.2.28 initialized

 [info] jk_handler::mod_jk.c (2608): Aborting connection for worker=node1

 [info] ajp_process_callback::jk_ajp_common.c (1788): Writing to client
aborted or client network problems

 [info] ajp_service::jk_ajp_common.c (2447): (node1) sending request to
tomcat failed (unrecoverable), because of client write error (attempt=1)

 [info] jk_handler::mod_jk.c (2608): Aborting connection for worker=node1

 [info] ajp_process_callback::jk_ajp_common.c (1788): Writing to client
aborted or client network problems

 [info] ajp_service::jk_ajp_common.c (2447): (node1) sending request to
tomcat failed (unrecoverable), because of client write error (attempt=1)

 [info] jk_handler::mod_jk.c (2608): Aborting connection for worker=node1

 [info] ajp_process_callback::jk_ajp_common.c (1788): Writing to client
aborted or client network problems

 [info] ajp_service::jk_ajp_common.c (2447): (node1) sending request to
tomcat failed (unrecoverable), because of client write error (attempt=1)

 [info] jk_handler::mod_jk.c (2608): Aborting connection for worker=node1

 [info] ajp_process_callback::jk_ajp_common.c (1788): Writing to client
aborted or client network problems

 [info] ajp_service::jk_ajp_common.c (2447): (node1) sending request to
tomcat failed (unrecoverable), because of client write error (attempt=1)

 [info] jk_handler::mod_jk.c (2608): Aborting connection for worker=node1

 

 

I'm using versions

mod_jk/1.2.28 

Apache/2.2.8 

tomcat/6.0.14

 

I googled and found this:

http://mail-archives.apache.org/mod_mbox/tomcat-users/200611.mbox/%3C456042F
5.4070...@kippdata.de%3e

 

But this error still on mod_jk/1.2.28? 

 

 

Any help appreciated.

 

thanks,

 

Muugii



Re: mod_jk Problem

2009-04-15 Thread André Warnier

Munkhbold.B wrote:

Hi

 


I have a problem with tomcat connector mod_jk.

From time to time the connector completely hangs apache. 


Tomcat alone is still alive, but apache no longer replies to requests, and I
need to restart both

 


In mod_jk logs file I have a lot of lines like

 


[info] init_jk::mod_jk.c (3183): mod_jk/1.2.28 initialized

 [info] jk_handler::mod_jk.c (2608): Aborting connection for worker=node1

 [info] ajp_process_callback::jk_ajp_common.c (1788): Writing to client
aborted or client network problems

 [info] ajp_service::jk_ajp_common.c (2447): (node1) sending request to
tomcat failed (unrecoverable), because of client write error (attempt=1)

 [info] jk_handler::mod_jk.c (2608): Aborting connection for worker=node1

 [info] ajp_process_callback::jk_ajp_common.c (1788): Writing to client
aborted or client network problems

 [info] ajp_service::jk_ajp_common.c (2447): (node1) sending request to
tomcat failed (unrecoverable), because of client write error (attempt=1)

 [info] jk_handler::mod_jk.c (2608): Aborting connection for worker=node1

 [info] ajp_process_callback::jk_ajp_common.c (1788): Writing to client
aborted or client network problems

 [info] ajp_service::jk_ajp_common.c (2447): (node1) sending request to
tomcat failed (unrecoverable), because of client write error (attempt=1)

 [info] jk_handler::mod_jk.c (2608): Aborting connection for worker=node1

 [info] ajp_process_callback::jk_ajp_common.c (1788): Writing to client
aborted or client network problems

 [info] ajp_service::jk_ajp_common.c (2447): (node1) sending request to
tomcat failed (unrecoverable), because of client write error (attempt=1)

 [info] jk_handler::mod_jk.c (2608): Aborting connection for worker=node1

 

 


I'm using versions

mod_jk/1.2.28 

Apache/2.2.8 


tomcat/6.0.14

 


I googled and found this:

http://mail-archives.apache.org/mod_mbox/tomcat-users/200611.mbox/%3C456042F
5.4070...@kippdata.de%3e

 

But this error still on mod_jk/1.2.28? 

 

Hi.
If you read that response carefully (and the same subject has come up 
several times on this list since then), you will see that this is not an 
error in mod_jk, nor in Apache or Tomcat.

Errors like

  [info] ajp_process_callback::jk_ajp_common.c (1788): Writing to client
 aborted or client network problems

  [info] ajp_service::jk_ajp_common.c (2447): (node1) sending request to
 tomcat failed (unrecoverable), because of client write error (attempt=1)

happen for the reason given in the response : Apache/mod_jk/Tomcat 
cannot send the response to the client anymore, because basically the 
client is not there anymore.

Re-read the response for more details.

Now why Apache is not responding anymore, may or may not have a 
connection (sic) with these messages.
(But it is most probably not because of the above log messages, nor 
because of a bug in mod_jk).


When Apache is in that condition, you should try to collect some 
additional data, to see why it is unresponsive.


For example, try netstat -an (works under Windows and Linux) to check 
if your server might be under some attack.  If you are under Unix/Linux, 
try top or ps to see what Apache processes are doing. You could also 
look at the Apache access and error logs to see if there is anything 
going on. There are also several Apache modules that may help 
(mod_status, mod_log_forensic,..).


Next time, also try to be a bit more specific about what you mean by 
apache no longer replies to requests.  Do you get connection 
refused, or does the browser connect and then times out after a couple 
of minutes, or what error do you see ?


Also, presumably some requests should go to Tomcat via mod_jk, but maybe 
some requests are being handled directly by Apache.  If so, do both 
kinds of requests not work anymore ?


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: mod_jk Problem

2009-04-15 Thread WenDong Zhang
I've the same problem too, and I found that if the tomcat response time is
long, you need to set connection_pool in your workers.properties.

## my properties

worker.node65.port=8009
worker.node65.host=9.186.10.65
worker.node65.type=ajp13
worker.node65.connection_pool_size=100
worker.node65.connection_pool_minsize=50
worker.node65.connection_pool_timeout=500
worker.node65.lbfactor=2



On Wed, Apr 15, 2009 at 2:19 PM, Munkhbold.B munkhb...@mongolcontent.mnwrote:

 Hi



 I have a problem with tomcat connector mod_jk.

 From time to time the connector completely hangs apache.

 Tomcat alone is still alive, but apache no longer replies to requests, and
 I
 need to restart both



 In mod_jk logs file I have a lot of lines like



 [info] init_jk::mod_jk.c (3183): mod_jk/1.2.28 initialized

  [info] jk_handler::mod_jk.c (2608): Aborting connection for worker=node1

  [info] ajp_process_callback::jk_ajp_common.c (1788): Writing to client
 aborted or client network problems

  [info] ajp_service::jk_ajp_common.c (2447): (node1) sending request to
 tomcat failed (unrecoverable), because of client write error (attempt=1)

  [info] jk_handler::mod_jk.c (2608): Aborting connection for worker=node1

  [info] ajp_process_callback::jk_ajp_common.c (1788): Writing to client
 aborted or client network problems

  [info] ajp_service::jk_ajp_common.c (2447): (node1) sending request to
 tomcat failed (unrecoverable), because of client write error (attempt=1)

  [info] jk_handler::mod_jk.c (2608): Aborting connection for worker=node1

  [info] ajp_process_callback::jk_ajp_common.c (1788): Writing to client
 aborted or client network problems

  [info] ajp_service::jk_ajp_common.c (2447): (node1) sending request to
 tomcat failed (unrecoverable), because of client write error (attempt=1)

  [info] jk_handler::mod_jk.c (2608): Aborting connection for worker=node1

  [info] ajp_process_callback::jk_ajp_common.c (1788): Writing to client
 aborted or client network problems

  [info] ajp_service::jk_ajp_common.c (2447): (node1) sending request to
 tomcat failed (unrecoverable), because of client write error (attempt=1)

  [info] jk_handler::mod_jk.c (2608): Aborting connection for worker=node1





 I'm using versions

 mod_jk/1.2.28

 Apache/2.2.8

 tomcat/6.0.14



 I googled and found this:


 http://mail-archives.apache.org/mod_mbox/tomcat-users/200611.mbox/%3C456042F
 5.4070...@kippdata.de%3e



 But this error still on mod_jk/1.2.28?





 Any help appreciated.



 thanks,



 Muugii




-- 
Best Regards!
Wen Dong


Re: mod_jk Problem

2009-04-15 Thread André Warnier

WenDong Zhang wrote:

I've the same problem too, and I found that if the tomcat response time is
long, you need to set connection_pool in your workers.properties.


Ok, let me be more explicit.
What you suggest above may work, /if/ the underlying reason for the 
problem meets certain criteria.  But is is not a generic solution to 
what the OP indicates.  We have no idea if Tomcat's response is slow or 
not, or if it is even requests to Tomcat that are involved. (The OP 
indicated that Tomcat itself was still fine, it was Apache which was not 
responding anymore; I don't know exactly what he meant by Tomcat is 
still fine, but let's take this at face value).


If you start from the beginning (and simplifying a bit):
- the browser sends a HTTP request to Apache
- if the network is OK, and the host is not overloaded, Apache receives 
this request.
- if Apache has a child or thread free to handle this request, it passes 
the request to it
- if mod_jk in the child/thread determines that this request should be 
handled by Tomcat, it opens a connection to Tomcat to pass the request 
(or it re-uses an existing connection if it still has one, for 
efficiency). (If the request is not for Tomcat, mod_jk declines it and 
it is handled locally by something in Apache.)
- if the Connector at the Tomcat side is not overloaded, it accepts the 
request, and if it still has threads to spare, it starts a thread to 
handle the request
- the thread takes a while (short/long) to process the request and 
generate a response

- during that time, mod_jk waits for the response
- when the response starts arriving back from Tomcat, mod_jk starts 
writing it back to the pipe that is ultimately connected to the client 
browser.
- when the response has been entirely produced by the Tomcat thread, it 
is done and can rejoin the pool of available threads
- similarly, when mod_jk has received the entire response, it can return 
this connection (to Tomcat) to the pool
- similarly, the Apache thread/child that was processing this request 
can go back to the available pool

- etc...

Now at any time during the above, a number of things can happen :
- the user may get impatient because it takes a long time for Tomcat to 
produce the response. So he clicks on the cancel or refresh icon, or 
clicks on another link.  So when mod_jk receives a piece of the response 
from Tomcat and tries to forward it to the client, it finds a closed 
socket, and it prints a warning.
- the request may not be handled by Tomcat, but instead by a buggy 
application in Apache itself, which gradually paralises Apache.
- between the browser and the server, there is some equipment that 
decides that nothing has happened on this connection for a long time, 
and closes it down.  The browser gets an error, and so does mod_jk when 
it tries to write to the client.
- mod_jk tries to connect to Tomcat, and gets refused because the Tomcat 
connector has no more queued-up connection slots available on that port.
- Tomcat accepts the connection and puts it in the queued-up 
connections, waiting for an available thread to process the request.
But other previous requests take a long time to process, so after 2-3 
minutes, the browser decides that the server is not responding, closes 
the connection and displays an error page to the user.
And mod_jk finds a closed client socket when ultimately it wants to send 
the Tomcat response to the client.
- there are genuine network problems between the client and the server, 
causing connections to drop
- the sysadmin has played around with the setup of Apache and mod_jk and 
the JVM and Tomcat to the point that Apache accepts 10,000 requests per 
second, but the backend Tomcat can only handle 100 at any one time.
- there is a bug in a webapp that causes it to leak resources over time, 
gradually slowing down Tomcat


And so on...
The point is, there are many situations that are possible, and there is 
not one magic fix for them all.
You have to know what exactly is the problem (or at least have a clue), 
before you start modifying parameters left and right blindly, and 
possibly making the situation even worse.




-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: mod_jk Problem

2009-04-15 Thread WenDong Zhang
yes. my configuration is just a suggestion. if you just need to fix the
problem quickly, maybe you need to try some solutions. But the main idea to
solve this problem is you need to do some tests to find out where the
bottleneck is.

I did a lots of tests, because my server chain is too long httpd load
balancer - tomcat - activeMQ - db.
now my problem of load balancer is solved (in fact I just need the default
configuration).
My Problem is caused by my program. the servlet on tomcat process the
request for a long time (1s more), and not very stable.
I think you'd better make sure your program is ok. You can test just a
static html page, and find out whether the tomcat server will down.

there are something you need to know: (these results are passed by my tests)
the httpd + mod_jk load balancer is powerful, my test case shows that it can
hold more than 6000 request per second!! and tomcat is also powerful 500
request per second is ok.



On Wed, Apr 15, 2009 at 4:57 PM, André Warnier a...@ice-sa.com wrote:

 WenDong Zhang wrote:

 I've the same problem too, and I found that if the tomcat response time is
 long, you need to set connection_pool in your workers.properties.

  Ok, let me be more explicit.
 What you suggest above may work, /if/ the underlying reason for the problem
 meets certain criteria.  But is is not a generic solution to what the OP
 indicates.  We have no idea if Tomcat's response is slow or not, or if it is
 even requests to Tomcat that are involved. (The OP indicated that Tomcat
 itself was still fine, it was Apache which was not responding anymore; I
 don't know exactly what he meant by Tomcat is still fine, but let's take
 this at face value).

 If you start from the beginning (and simplifying a bit):
 - the browser sends a HTTP request to Apache
 - if the network is OK, and the host is not overloaded, Apache receives
 this request.
 - if Apache has a child or thread free to handle this request, it passes
 the request to it
 - if mod_jk in the child/thread determines that this request should be
 handled by Tomcat, it opens a connection to Tomcat to pass the request (or
 it re-uses an existing connection if it still has one, for efficiency). (If
 the request is not for Tomcat, mod_jk declines it and it is handled locally
 by something in Apache.)
 - if the Connector at the Tomcat side is not overloaded, it accepts the
 request, and if it still has threads to spare, it starts a thread to handle
 the request
 - the thread takes a while (short/long) to process the request and generate
 a response
 - during that time, mod_jk waits for the response
 - when the response starts arriving back from Tomcat, mod_jk starts writing
 it back to the pipe that is ultimately connected to the client browser.
 - when the response has been entirely produced by the Tomcat thread, it is
 done and can rejoin the pool of available threads
 - similarly, when mod_jk has received the entire response, it can return
 this connection (to Tomcat) to the pool
 - similarly, the Apache thread/child that was processing this request can
 go back to the available pool
 - etc...

 Now at any time during the above, a number of things can happen :
 - the user may get impatient because it takes a long time for Tomcat to
 produce the response. So he clicks on the cancel or refresh icon, or
 clicks on another link.  So when mod_jk receives a piece of the response
 from Tomcat and tries to forward it to the client, it finds a closed socket,
 and it prints a warning.
 - the request may not be handled by Tomcat, but instead by a buggy
 application in Apache itself, which gradually paralises Apache.
 - between the browser and the server, there is some equipment that decides
 that nothing has happened on this connection for a long time, and closes it
 down.  The browser gets an error, and so does mod_jk when it tries to write
 to the client.
 - mod_jk tries to connect to Tomcat, and gets refused because the Tomcat
 connector has no more queued-up connection slots available on that port.
 - Tomcat accepts the connection and puts it in the queued-up connections,
 waiting for an available thread to process the request.
 But other previous requests take a long time to process, so after 2-3
 minutes, the browser decides that the server is not responding, closes the
 connection and displays an error page to the user.
 And mod_jk finds a closed client socket when ultimately it wants to send
 the Tomcat response to the client.
 - there are genuine network problems between the client and the server,
 causing connections to drop
 - the sysadmin has played around with the setup of Apache and mod_jk and
 the JVM and Tomcat to the point that Apache accepts 10,000 requests per
 second, but the backend Tomcat can only handle 100 at any one time.
 - there is a bug in a webapp that causes it to leak resources over time,
 gradually slowing down Tomcat

 And so on...
 The point is, there are many situations that are possible, and there is not
 one 

Securing jkmanager in IIS 5. Am I doing it right?

2009-04-15 Thread abaader

Hi

Im trying to find a practial example on how to secure the /jkmanager url so
that can only be accessed from the iis-server (version 5) locally

After googling around and not finding any example about this I created a
virtual directory called jkmanager in Internet Services Manger and set
directory security for it so that it may only be accessed from 127.0.0.1.
Local path is set to point at folder containing the isapi_redirect.dll -file
but this setting does not seem to make a difference. 
After doing all this everything seems to work properly?! I can now only
access /jkmanager -page from the server running the IIS and not from any
other computer. The actual webpage seem to work properly also and I can
change load balancer settings etc...

Is there something else I need to think about (read /write access etc) or is
there any other way to make this work, more like by the book?
-- 
View this message in context: 
http://www.nabble.com/Securing-jkmanager-in-IIS-5.-Am-I-doing-it-right--tp23056049p23056049.html
Sent from the Tomcat - User mailing list archive at Nabble.com.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: Help with mod_jk and Apache 2.2

2009-04-15 Thread Security Management
Andre,

I removed the deprecated lines from the workers.properties, and added the
JkMountCopy that you indicated.

Things work now.

The strange thing is, I'm not using a virtual host (name or IP based), it's
the canned apache installation for Fedora.

Maybe this is what did it??

I created a mod_jk.conf in /etc/httpd/conf.d, which on Fedora, all files in
this directory get loaded at the start of the service, and in the main
configuration (not in the Directory /var/www/html element of the config
file).  Was that the problem, adding all the configuration in the global
section, so it was not being seen in that site directive of httpd?

If so, the documentation was not clear to me what has to go in the global
config and what has to go in the specific site configuration.  I did
actually read the note about virtual hosts, but it did not indicate I need
to add the mount copy.  If I have time, I'll do some more testing and see
exactly what needs to go where to not need the copy, but I don't have time
at the moment.

Thanks,
Mike.


-Original Message-
From: André Warnier [mailto:a...@ice-sa.com] 
Sent: Tuesday, April 14, 2009 6:06 PM
To: Tomcat Users List
Subject: Re: Help with mod_jk and Apache 2.2

Security Management wrote:
 OK, here is the error (note that I have renamed it, I was just making sure
I
 was seeing what I thought I was).  Webapp works on 8080, apache restarts
 without complaining, I verified the port is the default for the worker
type
 in server.xml, and I am stumped.  Thanks for looking!
 
 Server.xml bit:
 
 Connector port=8009 
enableLookups=false redirectPort=8443
protocol=AJP/1.3
 /
 
 The error in the mod_jk logs:
 
 [Tue Apr 14 16:57:03 2009] [16766:3085969952] [debug]
jk_translate::mod_jk.c
 (3419): missing uri map for sirrus.smc:/smc-appsuite/index
 [Tue Apr 14 16:57:03 2009] [16766:3085969952] [debug]
 jk_map_to_storage::mod_jk.c (3579): missing uri map for
 sirrus.smc:/smc-appsuite/index
 [Tue Apr 14 16:57:34 2009] [16767:3085969952] [debug]
jk_translate::mod_jk.c
 (3419): missing uri map for sirrus.smc:/smc-appsuite
 [Tue Apr 14 16:57:34 2009] [16767:3085969952] [debug]
 jk_map_to_storage::mod_jk.c (3579): missing uri map for
 sirrus.smc:/smc-appsuite
 


 Here is the mod_jk.conf bit:
 
 LoadModule jk_module modules/mod_jk.so
 
 JkWorkersFile /etc/httpd/conf.d/workers.properties
 
 #JkMountFile /etc/httpd/conf.d/uriworkermap.properties
 JkMount /smc-appsuite worker1
 JkMount /smc-appsuite/* worker1
 
 JkLogFile /var/log/httpd/mod_jk.log
 JkLogLevel debug
 JkLogStampFormat [%a %b %d %H:%M:%S %Y] 
 JkOptions +ForwardKeySize +ForwardURICompat -ForwardDirectories
 JkRequestLogFormat %w %V %T
 JkShmFile /var/log/httpd/JkShmFile

I think I get it.
Are you by any chance using this within a VirtualHost in Apache ?
(I mean, are your browser HTTP calls directed to a VirtualHost ?)

If yes, then try adding a line
JkMountCopy All
to the lines above (in the main Apache server configuration), and retry.

If it now works, make sure you read this :
http://tomcat.apache.org/connectors-doc/reference/apache.html
and specifically the part about JkMountCopy.

You would only be one among many to get bitten by this..


 
 Here is the workers.properties:
 
 workers.tomcat_home=/var/www/apache-tomcat-5.5.27/
 
 workers.java_home=/usr/java/latest

Note: As far as I know, the above two properties are deprecated, and 
should no  longer be used.

 
 ps=/
 
 worker.list=worker1
 
 worker.worker1.type=ajp13
 worker.worker1.host=localhost

I would still add
worker.worker1.port=8009

 
 
 -Original Message-
 From: André Warnier [mailto:a...@ice-sa.com] 
 Sent: Tuesday, April 14, 2009 4:32 PM
 To: Security Management
 Subject: Re: Help with mod_jk and Apache 2.2
 
 Antonio, ya me has perdido.
 
 Would you mind re-posting the content of your 3 files, as they are now ?
 
 Alternatively :
 - comment the line JkMountFile
 - add instead the two following lines
 JkMount /appsuite worker1
 JkMount /appsuite/* worker1
 
 and tell us if that works.
 (That is, assuming that your webapp is still at /appsuite in Tomcat)
 
 
 
 Security Management wrote:
 OK, I was switching the name to make sure the logs switched the name and
 stuff.

 It's consistent in the file.

 -Original Message-
 From: André Warnier [mailto:a...@ice-sa.com] 
 Sent: Tuesday, April 14, 2009 4:19 PM
 To: Tomcat Users List
 Subject: Re: Help with mod_jk and Apache 2.2

 Security Management wrote:
 Yeah, I saw that, and it's now:

 /smc-appsuite|/*=worker1

 Which should match /appsuite/ and /appsuite/*
 Now wait a minute.  Why did this suddenly become /smc-appsuite, and 
 not like before, /appsuite ?
 If you keep changing the data between questions, it becomes hard to
 follow.
 Still not working, though.  Same problem.  Any more ideas?

 Thanks for the help,
 Mike.

 -Original Message-
 From: André Warnier [mailto:a...@ice-sa.com] 
 Sent: Tuesday, April 14, 2009 10:03 AM
 To: Tomcat Users List
 Subject: Re: Help 

RE: Need to share JVM for both tomcat and RMI server

2009-04-15 Thread Jorge Medina
I guess you can start one from the other no matter what direction you
choose.

If you can package your RMI server as a  webapp, just could start your
RMI server from a context listener.

If you prefer to start Tomcat from your RMI server, just look at the
catalina.sh script, starting Tomcat is just a matter of calling the
bootstraping class. Use the same class within your code.


-Original Message-
From: siranjeevi krishnan [mailto:siranjee...@gmail.com] 
Sent: Wednesday, April 15, 2009 1:49 AM
To: users@tomcat.apache.org
Subject: Need to share JVM for both tomcat and RMI server

Hi
I want to know about the possibility of sharing JVM for both tomcat and
RMI server.
Any ways to start tomcat from my RMI server.
How to programatically start tomcat like how startup.sh is doing?
Is it possible to start my RMI server inside tomcat?


Regards
Siranjeevi

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Help with mod_jk and Apache 2.2

2009-04-15 Thread André Warnier

Security Management wrote:

Andre,

I removed the deprecated lines from the workers.properties, and added the
JkMountCopy that you indicated.

Things work now.

The strange thing is, I'm not using a virtual host (name or IP based), it's
the canned apache installation for Fedora.

Maybe this is what did it??

[...]


Hi.
This now being more of an Apache configuration issue, it is getting a 
bit off-topic on this list.
So since your urgent issue with mod_jk seems solved, let me just give a 
couple of suggestions, and if you want to explore this further later on, 
feel free to contact me off-list, or post on the Apache httpd user list.


I don't know Fedora per se, so what follows is a bit tentative.

What I suspect is that, unknown to you, the Fedora Apache installation 
may be defining a Virtual Host anyway, although only a default one.
There is an easy way to find out.  At the command line, type 
/usr/sbin/apache2ctl -S (you may need to adjust the path to that 
command).  If you get an output somewhat like this :


VirtualHost configuration:
wildcard NameVirtualHosts and _default_ servers:
*:80   is a NameVirtualHost
 default server evm2.mycompany.com 
(/etc/apache2/sites-enabled/.default:1)


then it means you do have virtual hosts.


I created a mod_jk.conf in /etc/httpd/conf.d, which on Fedora, all files in
this directory get loaded at the start of the service, and in the main
configuration (not in the Directory /var/www/html element of the config
file).  Was that the problem, adding all the configuration in the global
section, so it was not being seen in that site directive of httpd?


No, it is fairly logical to add it in the global section.
I explain below.


If so, the documentation was not clear to me what has to go in the global
config and what has to go in the specific site configuration.
There are some things that could be improved in the mod_jk 
documentation.  The mod_jk developers are aware of this, and would 
welcome some help.  I'm in the early stages of trying to do that. If you 
can point to what wasn't clear to you (the specific page/section), I 
could start around there.


  I did

actually read the note about virtual hosts, but it did not indicate I need
to add the mount copy.  If I have time, I'll do some more testing and see
exactly what needs to go where to not need the copy, but I don't have time
at the moment.

There is nothing wrong with the JkMountCopy per se, and you should 
probably not try to remove it. It can be very practical.


Maybe the first aspect you should be aware of - if you aren't already - 
is that just about every OS, and every distribution of Linux, has its 
own schema for dicing up and laying out the Apache configuration files, 
and adding its own specific scripts and configuration methods.
The standard Apache configuration has all of Apache installed under a 
top directory like /usr/local/apache2, with a single configuration file 
/usr/local/apache2/conf/httpd.conf, and does not explicitly define 
VirtualHost's (an example exists in the standard httpd.conf, but it is 
not activated).
The packagers of Linux distributions of Apache on the other hand (and 
for a whole series of good reasons, this is no critic), seem to have a 
great deal of fun splitting up Apache and its configuration in a maze of 
subdirectories and files all over the filesystem.
It is usually quite practical on the one specific platform this is 
written for (because it makes it easier to update the software, 
load/unload additional modules, create additional virtual hosts etc..), 
but makes it a bit harder for someone who is jumping from one system to 
another to find where things are.
You generally end up with various schemes and bits under /etc/init.d, 
/etc/apache2, /etc/apache2/*, /etc/sysconfig, /var/lib/apache2, 
/usr/local/lib/apache2, /usr/share/www, /var/www, /srv/www, and so on, 
plus a spaghetti-bowl of symbolic links.


All of this to say that it is just not possible for the mod_jk 
documentation to describe in detail where you are likely to find what in 
the real world, and what will be included from where to where and in 
what order.
The same situation exists for Apache itself and for Tomcat, which is why 
you'll often see on this forum exhortations to de-install the 
platform-specific version and re-install a real Tomcat like ${deity} 
mandated (and which is also for me a devious way of keeping this 
rambling post on-topic).


Let's get back to mod_jk though.
But first let's talk about Virtual Hosts.

When an Apache server is configured with name-based virtual hosts, the 
basic configuration should be seen as merely a set of default values 
for the virtual hosts.
Then the first defined virtual host is the default virtual host, the 
one which inherits all these default values, and responds to all 
requests that arrive here, but have no well-defined DNS-name to which 
they are addressed (this being only a figure of speech).
Then usually, you start 

Virtual Hosts

2009-04-15 Thread gisrob

Can anybody offer any guidance or advice on how I can set up some virtual
hosts for my application that has multiple skins.

I want to be able to go to http://flavour1 instead of having to type in
http://longhostname/service/program.jsp?skins=flavour1, and similar for
flavour2, flavour3, etc..

All the documentation seems to point to virtual directories, and when I have
tried to use the syntax detailed here
http://tomcat.apache.org/tomcat-5.5-doc/virtual-hosting-howto.html
http://gandhim.wordpress.com/2008/01/31/tomcat-55-virtual-directory/
http://www.experts-exchange.com/Web/Web_Servers/Apache/Q_21242062.html

Tomcat tries to open a directory called /service/program.jsp?skins=flavour1/

How do I phrase the context syntax correctly?

MTIA

Rob

-- 
View this message in context: 
http://www.nabble.com/Virtual-Hosts-tp23060292p23060292.html
Sent from the Tomcat - User mailing list archive at Nabble.com.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Help with mod_jk and Apache 2.2

2009-04-15 Thread Rainer Jung
Hi André,

+1 to your forthcoming documentation contributions.

Great explanation.

Regards,

Rainer

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: mod_jk Problem

2009-04-15 Thread Rainer Jung
On 15.04.2009 08:19, Munkhbold.B wrote:
 Hi
 
  
 
 I have a problem with tomcat connector mod_jk.
 
 From time to time the connector completely hangs apache. 
 
 Tomcat alone is still alive, but apache no longer replies to requests, and I
 need to restart both
 
  
 
 In mod_jk logs file I have a lot of lines like
 
  
 
 [info] init_jk::mod_jk.c (3183): mod_jk/1.2.28 initialized
 
  [info] jk_handler::mod_jk.c (2608): Aborting connection for worker=node1
 
  [info] ajp_process_callback::jk_ajp_common.c (1788): Writing to client
 aborted or client network problems
 
  [info] ajp_service::jk_ajp_common.c (2447): (node1) sending request to
 tomcat failed (unrecoverable), because of client write error (attempt=1)
 
  [info] jk_handler::mod_jk.c (2608): Aborting connection for worker=node1
 
  [info] ajp_process_callback::jk_ajp_common.c (1788): Writing to client
 aborted or client network problems
 
  [info] ajp_service::jk_ajp_common.c (2447): (node1) sending request to
 tomcat failed (unrecoverable), because of client write error (attempt=1)
 
  [info] jk_handler::mod_jk.c (2608): Aborting connection for worker=node1
 
  [info] ajp_process_callback::jk_ajp_common.c (1788): Writing to client
 aborted or client network problems
 
  [info] ajp_service::jk_ajp_common.c (2447): (node1) sending request to
 tomcat failed (unrecoverable), because of client write error (attempt=1)
 
  [info] jk_handler::mod_jk.c (2608): Aborting connection for worker=node1
 
  [info] ajp_process_callback::jk_ajp_common.c (1788): Writing to client
 aborted or client network problems
 
  [info] ajp_service::jk_ajp_common.c (2447): (node1) sending request to
 tomcat failed (unrecoverable), because of client write error (attempt=1)
 
  [info] jk_handler::mod_jk.c (2608): Aborting connection for worker=node1

What the other list members were answering is correct. I myself would
expect you have a performance or stability problem in your webapp, so
that requests queue up in front of Tomcat, fill up Apache httpd and thus
you get that httpd is no longer available and requests making it to the
web server take a long time.

Whether this is correct or not you can check by doing thread dumps of
Tomcat during this situation and before doing the restarts. Google for
java thread dump (I hope this is a good search term).

A roughly correct formula is:

Concurrency = Throughput * ResponseTime

I expect your Response time in the webapp inctases a lot, e.g. because
some other system (DB, Mainframe, ...) is slow or your webapp even
deadlocks, and as a consequence the concurrency inreases until all
available threads in Tomcat and Apache get exhausted.

Regards,

Rainer

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: Help with mod_jk and Apache 2.2

2009-04-15 Thread Security Management
Well, I'll be damned, I do have virtual hosts:

VirtualHost configuration:
wildcard NameVirtualHosts and _default_ servers:
_default_:443  sirrus.smc (/etc/httpd/conf.d/ssl.conf:81)
*:*sirrus.smc
(/etc/httpd/conf.d/system-config-httpd.conf:314)
Syntax OK

Andre, I don't know how long that would have taken me without the help, but
it would have been a lot longer.

Thanks a bunch.  I will investigate further, but it's definitely OT for this
list at this point.

Mike.

-Original Message-
From: André Warnier [mailto:a...@ice-sa.com] 
Sent: Wednesday, April 15, 2009 10:36 AM
To: 'Tomcat Users List'
Subject: Re: Help with mod_jk and Apache 2.2

Security Management wrote:
 Andre,
 
 I removed the deprecated lines from the workers.properties, and added the
 JkMountCopy that you indicated.
 
 Things work now.
 
 The strange thing is, I'm not using a virtual host (name or IP based),
it's
 the canned apache installation for Fedora.
 
 Maybe this is what did it??
[...]


Hi.
This now being more of an Apache configuration issue, it is getting a 
bit off-topic on this list.
So since your urgent issue with mod_jk seems solved, let me just give a 
couple of suggestions, and if you want to explore this further later on, 
feel free to contact me off-list, or post on the Apache httpd user list.

I don't know Fedora per se, so what follows is a bit tentative.

What I suspect is that, unknown to you, the Fedora Apache installation 
may be defining a Virtual Host anyway, although only a default one.
There is an easy way to find out.  At the command line, type 
/usr/sbin/apache2ctl -S (you may need to adjust the path to that 
command).  If you get an output somewhat like this :

VirtualHost configuration:
wildcard NameVirtualHosts and _default_ servers:
*:80   is a NameVirtualHost
  default server evm2.mycompany.com 
(/etc/apache2/sites-enabled/.default:1)

then it means you do have virtual hosts.

 I created a mod_jk.conf in /etc/httpd/conf.d, which on Fedora, all files
in
 this directory get loaded at the start of the service, and in the main
 configuration (not in the Directory /var/www/html element of the
config
 file).  Was that the problem, adding all the configuration in the global
 section, so it was not being seen in that site directive of httpd?
 
No, it is fairly logical to add it in the global section.
I explain below.

 If so, the documentation was not clear to me what has to go in the global
 config and what has to go in the specific site configuration.
There are some things that could be improved in the mod_jk 
documentation.  The mod_jk developers are aware of this, and would 
welcome some help.  I'm in the early stages of trying to do that. If you 
can point to what wasn't clear to you (the specific page/section), I 
could start around there.

   I did
 actually read the note about virtual hosts, but it did not indicate I need
 to add the mount copy.  If I have time, I'll do some more testing and see
 exactly what needs to go where to not need the copy, but I don't have time
 at the moment.
 
There is nothing wrong with the JkMountCopy per se, and you should 
probably not try to remove it. It can be very practical.

Maybe the first aspect you should be aware of - if you aren't already - 
is that just about every OS, and every distribution of Linux, has its 
own schema for dicing up and laying out the Apache configuration files, 
and adding its own specific scripts and configuration methods.
The standard Apache configuration has all of Apache installed under a 
top directory like /usr/local/apache2, with a single configuration file 
/usr/local/apache2/conf/httpd.conf, and does not explicitly define 
VirtualHost's (an example exists in the standard httpd.conf, but it is 
not activated).
The packagers of Linux distributions of Apache on the other hand (and 
for a whole series of good reasons, this is no critic), seem to have a 
great deal of fun splitting up Apache and its configuration in a maze of 
subdirectories and files all over the filesystem.
It is usually quite practical on the one specific platform this is 
written for (because it makes it easier to update the software, 
load/unload additional modules, create additional virtual hosts etc..), 
but makes it a bit harder for someone who is jumping from one system to 
another to find where things are.
You generally end up with various schemes and bits under /etc/init.d, 
/etc/apache2, /etc/apache2/*, /etc/sysconfig, /var/lib/apache2, 
/usr/local/lib/apache2, /usr/share/www, /var/www, /srv/www, and so on, 
plus a spaghetti-bowl of symbolic links.

All of this to say that it is just not possible for the mod_jk 
documentation to describe in detail where you are likely to find what in 
the real world, and what will be included from where to where and in 
what order.
The same situation exists for Apache itself and for Tomcat, which is why 
you'll often see on this forum exhortations to de-install the 

Re: Virtual Hosts

2009-04-15 Thread Hassan Schroeder
On Wed, Apr 15, 2009 at 7:44 AM, gisrob g...@vanbooth.com wrote:

 Can anybody offer any guidance or advice on how I can set up some virtual
 hosts for my application that has multiple skins.

 I want to be able to go to http://flavour1 instead of having to type in
 http://longhostname/service/program.jsp?skins=flavour1, and similar for
 flavour2, flavour3, etc..

 All the documentation seems to point to virtual directories, and when I have
 tried to use the syntax detailed here
 http://tomcat.apache.org/tomcat-5.5-doc/virtual-hosting-howto.html

If you followed the above -- showing the relevant part of server.xml
would probably be helpful -- and entered a url like

http://flavour1.example.com/

in your browser,

 Tomcat tries to open a directory called /service/program.jsp?skins=flavour1/

erm, well, that sounds highly unlikely.

 How do I phrase the context syntax correctly?

No idea what that means. Each virtual host will have a ROOT context;
what that contains is up to you.

-- 
Hassan Schroeder  hassan.schroe...@gmail.com

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Virtual Hosts

2009-04-15 Thread Pid
gisrob wrote:
 Can anybody offer any guidance or advice on how I can set up some virtual
 hosts for my application that has multiple skins.
 
 I want to be able to go to http://flavour1 instead of having to type in
 http://longhostname/service/program.jsp?skins=flavour1, and similar for
 flavour2, flavour3, etc..
 
 All the documentation seems to point to virtual directories, and when I have
 tried to use the syntax detailed here
 http://tomcat.apache.org/tomcat-5.5-doc/virtual-hosting-howto.html
 http://gandhim.wordpress.com/2008/01/31/tomcat-55-virtual-directory/
 http://www.experts-exchange.com/Web/Web_Servers/Apache/Q_21242062.html
 
 Tomcat tries to open a directory called /service/program.jsp?skins=flavour1/
 
 How do I phrase the context syntax correctly?
 
 MTIA
 
 Rob
 

Write a Servlet Filter that parses HttpServletRequest.getServerName()
and performs the same action that whatever handles the skins=flavour1
parameter does.

In server.xml set the Engine attribute defaultHost to the single host
that will handle your application.

(This assumes that you know what you're doing re: DNS)

p

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



What Tomcat presentations / demos / discussions do you want to see at ApacheCon US 2009?

2009-04-15 Thread Mark Thomas
Folks,

The next ApacheCon (in Oakland, CA, USA - Nov 2 to 6 2009) is being
organised a little differently. Each project is being given the
opportunity suggest a possible conference track based on that project.

As part of this process we have a week to put together the outline of a
plan which we then submit to the conference planners. They will get back
to us at the end of the month with how our proposal fits into the
overall plan and give us a further two weeks to firm up the schedule.

So, at this stage what we need to hear from you, the Tomcat user
community, is what sort of topics would you like to see covered?
Remember as well as regular sessions there can also be MeetUps, BOFs,
symposiums, un-conference style activities, etc.

Please feel free to pitch in with your suggestions on this thread and
comment on suggestions made by other people. The more involved the
community gets, the better the outcome is likely to be.

Ideally, each idea for a session / BOF / symposium etc would include:
- Title
- Type of session
- Short (sentence or two) abstract
- Intended audience

Although the call for papers has closed, there is some flexibility that
would allow us to include sessions that weren't offered through the call
for papers. So, if you would like to present on a Tomcat related topic
then please feel free to offer to do that as well as letting us know
what types of sessions you would like to attend.

We only have a week so get your suggestions in quickly.

Mark


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Virtual Hosts

2009-04-15 Thread David Fisher
Can anybody offer any guidance or advice on how I can set up some  
virtual

hosts for my application that has multiple skins.

I want to be able to go to http://flavour1 instead of having to  
type in
http://longhostname/service/program.jsp?skins=flavour1, and similar  
for

flavour2, flavour3, etc..

All the documentation seems to point to virtual directories, and  
when I have

tried to use the syntax detailed here
http://tomcat.apache.org/tomcat-5.5-doc/virtual-hosting-howto.html
http://gandhim.wordpress.com/2008/01/31/tomcat-55-virtual-directory/
http://www.experts-exchange.com/Web/Web_Servers/Apache/ 
Q_21242062.html


Tomcat tries to open a directory called /service/program.jsp? 
skins=flavour1/


How do I phrase the context syntax correctly?

MTIA

Rob



Write a Servlet Filter that parses HttpServletRequest.getServerName()
and performs the same action that whatever handles the  
skins=flavour1

parameter does.

In server.xml set the Engine attribute defaultHost to the single host
that will handle your application.

(This assumes that you know what you're doing re: DNS)


I use this technique and it works in Tomcat 5.5. I have multiple  
domains hosted, and I name each as Aliases in the Host in server.xml.


This works unless the OP also needs to make https connections. In that  
case, all of the virtual hosts will need to be in the same main domain  
and a wildcard certificate will be required.


*.domain.com

vs.

www.domain1.com
www.domain2.com

If you must use https (which I do) and to have multiple domains then I  
have to choose which domain has the correct certificate and the others  
will not match. That wasn't too awful until Firefox 3. It is a pain.


There is no known (at least to me) solution to this except for putting  
Apache in front of Tomcat and handle the certificates and virtual host  
there.


Then use Filter technique to choose the appropriate skin.

I hope my remarks anticipate the next question from the OP, otherwise  
I'm sorry if this a thread hijack


Regards,
Dave





p

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org




-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: Virtual Hosts

2009-04-15 Thread Caldarale, Charles R
 From: David Fisher [mailto:dfis...@jmlafferty.com]
 Subject: Re: Virtual Hosts
 
 I have multiple domains hosted, and I name each as
 Aliases in the Host in server.xml.

If you only have one Host element, aliases are unnecessary.  You only need 
Alias elements when multiple Hosts are configured and you want Tomcat to 
route more than one domain to them.

I would hope that configuring such unneeded Alias elements doesn't add 
processing time doing any comparisons, but I haven't looked at the code to 
verify that.

 - Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY 
MATERIAL and is thus for use only by the intended recipient. If you received 
this in error, please contact the sender and delete the e-mail and its 
attachments from all computers.

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Installing Tomcat

2009-04-15 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Jonathan,

On 4/14/2009 9:00 PM, Jonathan Mast wrote:
 I've pretty much concluded that the problem is that the machine in question
 is SELinux-enabled and that is cause of Tomcat's inability to access the
 8080 port (even though I can see tomcat on the process list, a netstat -a
 indicates shows no entry for 8080).

Ooooh... SELinux can be tough to deal with if you don't know what you're
doing. It's /super/ restrictive, and rightly so. I would have expected
an error message like cannot bind to port 8080 in your catalina.out
file if you really couldn't bind to port 8080, though.

 1) Why not run Tomcat as root?

Security, security, security. There really is no need to run Tomcat as
root, so why would you? If you have a misbehaving (or rogue) web
application, it can really cause chaos if it's running as root. If you
run it as a lowly common user, it can't do nearly so much damage. The
same argument applies for not running MSIE on Windows as Administrator:
if you get malware (and you /will/), you can't affect the machine's
configuration, etc. unless you are an admin.

 We have Tomcat running as root on our
 current setup (Httpd 1.3.33, Tomcat 5.5, JDK 1.4), I presume Tomcat 6 (JDK
 1.6) running by itself must be more secure than our current situation.  Any
 comments?

Yes, Tomcat alone should be more secure but there really is no reason to
run Tomcat as root unless you are just really, really lazy. It's not
that hard to run jsvc or set up iptables appropriately.

 2) My problem with jsvc is multiple:
 a) it involves a language so evil it can only be referred to in paraphrase:
 the letter between B and D.  Have you actually read the instructions for it?

I must admit that I didn't download it and read the instructions, but
the wep site says it pretty plain and simple:

$ ./configure --with-java=/path/to/java
$ make

Oh! The horror!

Have you ever built anything using C before? This is how much packages
work, and they work really well using the 'configure' business.

Okay, I broke down and downloaded it. Here are the instructions for
building from the README file at the top-level of the tarball:


  cd src/native/unix; configure; make


The only problem with that is they forgot to include the ./ in front
of 'configure' for those who don't have '.' in the search path (which is
actually most people).

It took somewhere in the neighborhood of 3 seconds to complete both the
'configure' and 'make' steps for me.

 b) can't they even bother to link to the Jakarta-Whatever package that I
 must now download and lug around? I mean c'mon ;-[

What is Jakarta-Whatever? I don't see any dependencies of any kind, here.

 c) really, if all this stuff is the correct way to run Tomcat on linux,
 why doesn't come as part of the distribution?

Because jsvc is someone else's project. I suppose Tomcat could bundle it
into the distro, but they haven't chosen to do so. There are also lots
of people who don't use it. For instance, I run Tomcat on non-privileged
ports and use httpd to front it. So, bundling it would not help people
like me at all (but certainly wouldn't hurt us).

The biggest problem with this kind of bundling is the fact that *NIX
systems are so varied in configuration that jsvc really must be built on
each individual system (hence the super-simple 'configure/make'
procedure above).

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAknmFXEACgkQ9CaO5/Lv0PDLKACeNOWfXcT6TbJp9dw5ThuG0qRS
CwUAoK7/K6wv7FrmlpqGaMjYqIzlfHaG
=mHxZ
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Installing Tomcat

2009-04-15 Thread Jonathan Mast
Yeah Selinux is a big pain from what I've read about it and I've given up on
the machine on which it runs.  As you may have guessed, I'm not in charge of
the tech department of a secret government spy agency ;-) so I'll leave
SELinux to the spooks who invented it.

I've found another box on which I can install a fresh linux dist.  Pondering
whether to use Slackware, Gentoo or Cent

By Jakarta-Whatever, I'm referring to the commons-daemon package, as
indicated on the setup page:
quote
Download a commons-daemon binary from the Jakarta Commons download page, and
place jsvc.tar.gz and commons-daemon.jar in the $CATALINA_HOME/bin folder.
/quote

Why can't they even link to this project?  I just wish the docs were more
detailed about why this kludgy trampoline is needed, there aren't any links
to the Jsvc project either!

No I'm not a big fan of C, C programming should be left to the hobbits who
develop the OS and who know all the magical incantations needed to use it
safely.

thanks

On Wed, Apr 15, 2009 at 1:12 PM, Christopher Schultz 
ch...@christopherschultz.net wrote:

 -BEGIN PGP SIGNED MESSAGE-
 Hash: SHA1

 Jonathan,

 On 4/14/2009 9:00 PM, Jonathan Mast wrote:
  I've pretty much concluded that the problem is that the machine in
 question
  is SELinux-enabled and that is cause of Tomcat's inability to access the
  8080 port (even though I can see tomcat on the process list, a netstat
 -a
  indicates shows no entry for 8080).

 Ooooh... SELinux can be tough to deal with if you don't know what you're
 doing. It's /super/ restrictive, and rightly so. I would have expected
 an error message like cannot bind to port 8080 in your catalina.out
 file if you really couldn't bind to port 8080, though.

  1) Why not run Tomcat as root?

 Security, security, security. There really is no need to run Tomcat as
 root, so why would you? If you have a misbehaving (or rogue) web
 application, it can really cause chaos if it's running as root. If you
 run it as a lowly common user, it can't do nearly so much damage. The
 same argument applies for not running MSIE on Windows as Administrator:
 if you get malware (and you /will/), you can't affect the machine's
 configuration, etc. unless you are an admin.

  We have Tomcat running as root on our
  current setup (Httpd 1.3.33, Tomcat 5.5, JDK 1.4), I presume Tomcat 6
 (JDK
  1.6) running by itself must be more secure than our current situation.
  Any
  comments?

 Yes, Tomcat alone should be more secure but there really is no reason to
 run Tomcat as root unless you are just really, really lazy. It's not
 that hard to run jsvc or set up iptables appropriately.

  2) My problem with jsvc is multiple:
  a) it involves a language so evil it can only be referred to in
 paraphrase:
  the letter between B and D.  Have you actually read the instructions for
 it?

 I must admit that I didn't download it and read the instructions, but
 the wep site says it pretty plain and simple:

 $ ./configure --with-java=/path/to/java
 $ make

 Oh! The horror!

 Have you ever built anything using C before? This is how much packages
 work, and they work really well using the 'configure' business.

 Okay, I broke down and downloaded it. Here are the instructions for
 building from the README file at the top-level of the tarball:

 
  cd src/native/unix; configure; make
 

 The only problem with that is they forgot to include the ./ in front
 of 'configure' for those who don't have '.' in the search path (which is
 actually most people).

 It took somewhere in the neighborhood of 3 seconds to complete both the
 'configure' and 'make' steps for me.

  b) can't they even bother to link to the Jakarta-Whatever package that I
  must now download and lug around? I mean c'mon ;-[

 What is Jakarta-Whatever? I don't see any dependencies of any kind, here.

  c) really, if all this stuff is the correct way to run Tomcat on linux,
  why doesn't come as part of the distribution?

 Because jsvc is someone else's project. I suppose Tomcat could bundle it
 into the distro, but they haven't chosen to do so. There are also lots
 of people who don't use it. For instance, I run Tomcat on non-privileged
 ports and use httpd to front it. So, bundling it would not help people
 like me at all (but certainly wouldn't hurt us).

 The biggest problem with this kind of bundling is the fact that *NIX
 systems are so varied in configuration that jsvc really must be built on
 each individual system (hence the super-simple 'configure/make'
 procedure above).

 - -chris
 -BEGIN PGP SIGNATURE-
 Version: GnuPG v1.4.9 (MingW32)
 Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

 iEYEARECAAYFAknmFXEACgkQ9CaO5/Lv0PDLKACeNOWfXcT6TbJp9dw5ThuG0qRS
 CwUAoK7/K6wv7FrmlpqGaMjYqIzlfHaG
 =mHxZ
 -END PGP SIGNATURE-

 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: 

Re: Installing Tomcat

2009-04-15 Thread Hassan Schroeder
On Wed, Apr 15, 2009 at 10:49 AM, Jonathan Mast
jhmast.develo...@gmail.com wrote:

 By Jakarta-Whatever, I'm referring to the commons-daemon package, as
 indicated on the setup page:
 quote
 Download a commons-daemon binary from the Jakarta Commons download page, and
 place jsvc.tar.gz and commons-daemon.jar in the $CATALINA_HOME/bin folder.
 /quote

Well, I haven't looked at those docs in a while, but ...

 Why can't they even link to this project?

the tar file of jsvc source is included in the Tomcat bin directory...

-- 
Hassan Schroeder  hassan.schroe...@gmail.com

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Virtual Hosts

2009-04-15 Thread David Fisher

Hi Charles,


I have multiple domains hosted, and I name each as
Aliases in the Host in server.xml.


If you only have one Host element, aliases are unnecessary.  You  
only need Alias elements when multiple Hosts are configured and  
you want Tomcat to route more than one domain to them.


Exactly. We started with Tomcat 3. We have multiple Hosts - localhost  
with internal webapps for monitoring our main webapps and performing  
internal services. We keep a large cache and have a number of jars in  
shared/lib.


We are currently re-architecting so that we can go to Tomcat 6 where  
the games that we have been playing are out of bounds.


We'll have one stack and control access with a Filter and/or Valve.  
This way we have everything in one webapps and it will be a single  
Context that we can put everything into a war - deploy to the Cloud.


I would hope that configuring such unneeded Alias elements doesn't  
add processing time doing any comparisons, but I haven't looked at  
the code to verify that.


We can make apache do this work for us in front. I've been lurking on  
this list for some time. In a few weeks we will build our first  
version of this and I am confident that should we encounter trouble I  
can get advice from the good people like you here on the Tomcat users  
list.


Best Regards,
Dave

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



JK 1.2.28 - load balancer worker fails on startup with one worker down ?

2009-04-15 Thread Scott Bradshaw
I apologize if this a silly question, but I can't figure it out! I've looked
over the documentation and I'm stumped.

I have 5 load balanced workers defined. I have them setup and configured
correctly.

workers.properties file (partial - not including all the individual workers)
---
worker.mygpgby02.type=ajp13
worker.mygpgby02.host=mygpgby02.mycompany.com
worker.mygpgby02.port=8009

worker.loadbalancerprod.type=lb
worker.loadbalancerprod.balance_workers=mygpgby02,mygpgby03,mygpgby04,mygpgby05,mygpgby06
worker.list=loadbalancerprod
---
Now, here is the problem - one of those hosts(mygpgby06) is currently down
for maintenence. Whenever I startup IIS, the ISAPI proxy won't work. The
ISAPI log file shows this:  (please note mycompany.com is not the actual url
- i changed it)

[Wed Apr 15 14:22:00.463 2009] [4208:2848] [error] jk_ajp_common.c (2526):
worker mygpgby06 can't resolve tomcat address mygpgby06.mycompany.com
[Wed Apr 15 14:22:00.463 2009] [4208:2848] [error] jk_worker.c (163):
validate failed for mygpgby06
[Wed Apr 15 14:22:00.463 2009] [4208:2848] [error] jk_lb_worker.c (1599):
Failed creating worker mygpgby06
[Wed Apr 15 14:22:00.479 2009] [4208:2848] [error] jk_lb_worker.c (1647):
NULL parameters
[Wed Apr 15 14:22:00.479 2009] [4208:2848] [error] jk_worker.c (163):
validate failed for loadbalancerprod
[Wed Apr 15 14:22:00.479 2009] [4208:2848] [error] jk_worker.c (262): failed
to create worker loadbalancerprod
[Wed Apr 15 14:22:00.479 2009] [4208:2848] [error] jk_uri_worker_map.c
(506): Could not find worker with name 'loadbalancerprod' in uri map post
processing.

 If I take this worker out of the balance_workers list, everything starts up
fine. If I leave it in, my loadbalancerprod worker is completely dead..

 According to the documentation, When starting up, the web server plugin
with instantiate the workers whose name appears in the worker.list
property...

So - one worker in the load balancer won't start so the whole load balancer
is considered a failed worker.

Is there a property I'm missing to make this work ?

Scott


Re: Expose URL via Apache / Tomcat Load

2009-04-15 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Karthik,

On 4/13/2009 7:57 AM, Karthik Nanjangude wrote:
 Configuration  for  single installation of the web application
 acme
 
 www.acme.com   being exposed to INTERNET
 www.acme.com/adminbeing exposed to INTRANET

The only way I know of doing this (without httpd in front) would be to
use something like http://tuckey.org/urlrewrite/ to filter requests for
/admin* and refuse anything that didn't match an IP address pattern
(such as 192\.196\.1\..*).

 Is there any Configuration with in Apache or Tomcat to achieve the
 same?

You can use Apache httpd's Location and Allow directives to control
this at the httpd level if you prefer.

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAknmRYQACgkQ9CaO5/Lv0PDBLwCdHNz3VgBBbrNzoEXvTFz2cQTf
RywAnih7BtHJrixjOzgCrnG48cPwhazX
=g21c
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: JK 1.2.28 - load balancer worker fails on startup with one worker down ?

2009-04-15 Thread Jorge Medina
Your workers.properties looks fine.

What is the content of uriworkermap.proeprties ?

-Original Message-
From: swbrads...@gmail.com [mailto:swbrads...@gmail.com] On Behalf Of
Scott Bradshaw
Sent: Wednesday, April 15, 2009 3:51 PM
To: users@tomcat.apache.org
Subject: JK 1.2.28 - load balancer worker fails on startup with one
worker down ?

I apologize if this a silly question, but I can't figure it out! I've
looked over the documentation and I'm stumped.

I have 5 load balanced workers defined. I have them setup and configured
correctly.

workers.properties file (partial - not including all the individual
workers)
---
worker.mygpgby02.type=ajp13
worker.mygpgby02.host=mygpgby02.mycompany.com
worker.mygpgby02.port=8009

worker.loadbalancerprod.type=lb
worker.loadbalancerprod.balance_workers=mygpgby02,mygpgby03,mygpgby04,my
gpgby05,mygpgby06
worker.list=loadbalancerprod
---
Now, here is the problem - one of those hosts(mygpgby06) is currently
down for maintenence. Whenever I startup IIS, the ISAPI proxy won't
work. The ISAPI log file shows this:  (please note mycompany.com is not
the actual url
- i changed it)

[Wed Apr 15 14:22:00.463 2009] [4208:2848] [error] jk_ajp_common.c
(2526):
worker mygpgby06 can't resolve tomcat address mygpgby06.mycompany.com
[Wed Apr 15 14:22:00.463 2009] [4208:2848] [error] jk_worker.c (163):
validate failed for mygpgby06
[Wed Apr 15 14:22:00.463 2009] [4208:2848] [error] jk_lb_worker.c
(1599):
Failed creating worker mygpgby06
[Wed Apr 15 14:22:00.479 2009] [4208:2848] [error] jk_lb_worker.c
(1647):
NULL parameters
[Wed Apr 15 14:22:00.479 2009] [4208:2848] [error] jk_worker.c (163):
validate failed for loadbalancerprod
[Wed Apr 15 14:22:00.479 2009] [4208:2848] [error] jk_worker.c (262):
failed to create worker loadbalancerprod [Wed Apr 15 14:22:00.479 2009]
[4208:2848] [error] jk_uri_worker_map.c
(506): Could not find worker with name 'loadbalancerprod' in uri map
post processing.

 If I take this worker out of the balance_workers list, everything
starts up fine. If I leave it in, my loadbalancerprod worker is
completely dead..

 According to the documentation, When starting up, the web server
plugin with instantiate the workers whose name appears in the
worker.list property...

So - one worker in the load balancer won't start so the whole load
balancer is considered a failed worker.

Is there a property I'm missing to make this work ?

Scott

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: JK 1.2.28 - load balancer worker fails on startup with one worker down ?

2009-04-15 Thread Scott Bradshaw
/portal/*=loadbalancerprod

The uriworkermap.properties file is correct - workers are correctly sent to
it assuming all the workers are accessible.

The problem is when the workers in the load balancer are being initialized,
if one worker is not available, the load balance worker is considered not
valid. Because its not valid, requests will not be sent to it. This does not
seem to be the desired behavior of a load balancer.

Scott

On Wed, Apr 15, 2009 at 5:32 PM, Jorge Medina jmed...@e-dialog.com wrote:

 Your workers.properties looks fine.

 What is the content of uriworkermap.proeprties ?

 -Original Message-
 From: swbrads...@gmail.com [mailto:swbrads...@gmail.com] On Behalf Of
 Scott Bradshaw
 Sent: Wednesday, April 15, 2009 3:51 PM
 To: users@tomcat.apache.org
 Subject: JK 1.2.28 - load balancer worker fails on startup with one
 worker down ?

 I apologize if this a silly question, but I can't figure it out! I've
 looked over the documentation and I'm stumped.

 I have 5 load balanced workers defined. I have them setup and configured
 correctly.

 workers.properties file (partial - not including all the individual
 workers)
 ---
 worker.mygpgby02.type=ajp13
 worker.mygpgby02.host=mygpgby02.mycompany.com
 worker.mygpgby02.port=8009

 worker.loadbalancerprod.type=lb
 worker.loadbalancerprod.balance_workers=mygpgby02,mygpgby03,mygpgby04,my
 gpgby05,mygpgby06
 worker.list=loadbalancerprod
 ---
 Now, here is the problem - one of those hosts(mygpgby06) is currently
 down for maintenence. Whenever I startup IIS, the ISAPI proxy won't
 work. The ISAPI log file shows this:  (please note mycompany.com is not
 the actual url
 - i changed it)

 [Wed Apr 15 14:22:00.463 2009] [4208:2848] [error] jk_ajp_common.c
 (2526):
 worker mygpgby06 can't resolve tomcat address mygpgby06.mycompany.com
 [Wed Apr 15 14:22:00.463 2009] [4208:2848] [error] jk_worker.c (163):
 validate failed for mygpgby06
 [Wed Apr 15 14:22:00.463 2009] [4208:2848] [error] jk_lb_worker.c
 (1599):
 Failed creating worker mygpgby06
 [Wed Apr 15 14:22:00.479 2009] [4208:2848] [error] jk_lb_worker.c
 (1647):
 NULL parameters
 [Wed Apr 15 14:22:00.479 2009] [4208:2848] [error] jk_worker.c (163):
 validate failed for loadbalancerprod
 [Wed Apr 15 14:22:00.479 2009] [4208:2848] [error] jk_worker.c (262):
 failed to create worker loadbalancerprod [Wed Apr 15 14:22:00.479 2009]
 [4208:2848] [error] jk_uri_worker_map.c
 (506): Could not find worker with name 'loadbalancerprod' in uri map
 post processing.

  If I take this worker out of the balance_workers list, everything
 starts up fine. If I leave it in, my loadbalancerprod worker is
 completely dead..

  According to the documentation, When starting up, the web server
 plugin with instantiate the workers whose name appears in the
 worker.list property...

 So - one worker in the load balancer won't start so the whole load
 balancer is considered a failed worker.

 Is there a property I'm missing to make this work ?

 Scott

 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org




Re: JK 1.2.28 - load balancer worker fails on startup with one worker down ?

2009-04-15 Thread André Warnier
If we just stick to the actual error message for a moment, and assume it 
means what it says :

 worker mygpgby06 can't resolve tomcat address mygpgby06.mycompany.com
the first question would be : why can the DNS name 
mygpgby06.mycompany.com not be /resolved/ to an IP address when host 
mygpgby06 (?) is down for maintenance ?


Is there some kind of dynamic DNS system at work there ?

What happens if you replace
 worker.mygpgby06.host=mygpgby06.mycompany.com
by
 worker.mygpgby06.host=xxx.xxx.xxx.xxx
(xxx.xxx.xxx.xxx being the actual IP address of that host)

I'm just guessing here, but what if it is so that, at least at start, 
the load balancing members must at least be able to be resolved to an IP 
address, otherwise mod_jk determines that there's really something wrong 
with the configuration, and won't even start ?





Scott Bradshaw wrote:

/portal/*=loadbalancerprod

The uriworkermap.properties file is correct - workers are correctly sent to
it assuming all the workers are accessible.

The problem is when the workers in the load balancer are being initialized,
if one worker is not available, the load balance worker is considered not
valid. Because its not valid, requests will not be sent to it. This does not
seem to be the desired behavior of a load balancer.

Scott

On Wed, Apr 15, 2009 at 5:32 PM, Jorge Medina jmed...@e-dialog.com wrote:


Your workers.properties looks fine.

What is the content of uriworkermap.proeprties ?

-Original Message-
From: swbrads...@gmail.com [mailto:swbrads...@gmail.com] On Behalf Of
Scott Bradshaw
Sent: Wednesday, April 15, 2009 3:51 PM
To: users@tomcat.apache.org
Subject: JK 1.2.28 - load balancer worker fails on startup with one
worker down ?

I apologize if this a silly question, but I can't figure it out! I've
looked over the documentation and I'm stumped.

I have 5 load balanced workers defined. I have them setup and configured
correctly.

workers.properties file (partial - not including all the individual
workers)
---
worker.mygpgby02.type=ajp13
worker.mygpgby02.host=mygpgby02.mycompany.com
worker.mygpgby02.port=8009

worker.loadbalancerprod.type=lb
worker.loadbalancerprod.balance_workers=mygpgby02,mygpgby03,mygpgby04,my
gpgby05,mygpgby06
worker.list=loadbalancerprod
---
Now, here is the problem - one of those hosts(mygpgby06) is currently
down for maintenence. Whenever I startup IIS, the ISAPI proxy won't
work. The ISAPI log file shows this:  (please note mycompany.com is not
the actual url
- i changed it)

[Wed Apr 15 14:22:00.463 2009] [4208:2848] [error] jk_ajp_common.c
(2526):
worker mygpgby06 can't resolve tomcat address mygpgby06.mycompany.com
[Wed Apr 15 14:22:00.463 2009] [4208:2848] [error] jk_worker.c (163):
validate failed for mygpgby06
[Wed Apr 15 14:22:00.463 2009] [4208:2848] [error] jk_lb_worker.c
(1599):
Failed creating worker mygpgby06
[Wed Apr 15 14:22:00.479 2009] [4208:2848] [error] jk_lb_worker.c
(1647):
NULL parameters
[Wed Apr 15 14:22:00.479 2009] [4208:2848] [error] jk_worker.c (163):
validate failed for loadbalancerprod
[Wed Apr 15 14:22:00.479 2009] [4208:2848] [error] jk_worker.c (262):
failed to create worker loadbalancerprod [Wed Apr 15 14:22:00.479 2009]
[4208:2848] [error] jk_uri_worker_map.c
(506): Could not find worker with name 'loadbalancerprod' in uri map
post processing.

 If I take this worker out of the balance_workers list, everything
starts up fine. If I leave it in, my loadbalancerprod worker is
completely dead..

 According to the documentation, When starting up, the web server
plugin with instantiate the workers whose name appears in the
worker.list property...

So - one worker in the load balancer won't start so the whole load
balancer is considered a failed worker.

Is there a property I'm missing to make this work ?

Scott

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org







-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: JK 1.2.28 - load balancer worker fails on startup with one worker down ?

2009-04-15 Thread Scott Bradshaw
Yep - you are right on.

The machine was taken off the network and moved to a test network for a few
days. It currently does not resolve. If I change the host to its old IP
address (which does not respond), the system starts up just fine.

I would expect to see an error in the log, but just because 1 host does not
resolve, I wouldn't expect mod_jk to prevent the rest of the hosts from
functioning. In the current configuration I just changed, the IP address I
have now is not functioning and could be a configuration error, but mod_jk
is still loading.

How do I go about submitting this as an enhancement request for the next
version?

Thanks for your help!

Scott


On Wed, Apr 15, 2009 at 6:20 PM, André Warnier a...@ice-sa.com wrote:

 If we just stick to the actual error message for a moment, and assume it
 means what it says :
  worker mygpgby06 can't resolve tomcat address mygpgby06.mycompany.com
 the first question would be : why can the DNS name 
 mygpgby06.mycompany.com not be /resolved/ to an IP address when host
 mygpgby06 (?) is down for maintenance ?

 Is there some kind of dynamic DNS system at work there ?

 What happens if you replace
  worker.mygpgby06.host=mygpgby06.mycompany.com
 by
  worker.mygpgby06.host=xxx.xxx.xxx.xxx
 (xxx.xxx.xxx.xxx being the actual IP address of that host)

 I'm just guessing here, but what if it is so that, at least at start, the
 load balancing members must at least be able to be resolved to an IP
 address, otherwise mod_jk determines that there's really something wrong
 with the configuration, and won't even start ?





 Scott Bradshaw wrote:

 /portal/*=loadbalancerprod

 The uriworkermap.properties file is correct - workers are correctly sent
 to
 it assuming all the workers are accessible.

 The problem is when the workers in the load balancer are being
 initialized,
 if one worker is not available, the load balance worker is considered not
 valid. Because its not valid, requests will not be sent to it. This does
 not
 seem to be the desired behavior of a load balancer.

 Scott

 On Wed, Apr 15, 2009 at 5:32 PM, Jorge Medina jmed...@e-dialog.com
 wrote:

  Your workers.properties looks fine.

 What is the content of uriworkermap.proeprties ?

 -Original Message-
 From: swbrads...@gmail.com [mailto:swbrads...@gmail.com] On Behalf Of
 Scott Bradshaw
 Sent: Wednesday, April 15, 2009 3:51 PM
 To: users@tomcat.apache.org
 Subject: JK 1.2.28 - load balancer worker fails on startup with one
 worker down ?

 I apologize if this a silly question, but I can't figure it out! I've
 looked over the documentation and I'm stumped.

 I have 5 load balanced workers defined. I have them setup and configured
 correctly.

 workers.properties file (partial - not including all the individual
 workers)
 ---
 worker.mygpgby02.type=ajp13
 worker.mygpgby02.host=mygpgby02.mycompany.com
 worker.mygpgby02.port=8009

 worker.loadbalancerprod.type=lb
 worker.loadbalancerprod.balance_workers=mygpgby02,mygpgby03,mygpgby04,my
 gpgby05,mygpgby06
 worker.list=loadbalancerprod
 ---
 Now, here is the problem - one of those hosts(mygpgby06) is currently
 down for maintenence. Whenever I startup IIS, the ISAPI proxy won't
 work. The ISAPI log file shows this:  (please note mycompany.com is not
 the actual url
 - i changed it)

 [Wed Apr 15 14:22:00.463 2009] [4208:2848] [error] jk_ajp_common.c
 (2526):
 worker mygpgby06 can't resolve tomcat address mygpgby06.mycompany.com
 [Wed Apr 15 14:22:00.463 2009] [4208:2848] [error] jk_worker.c (163):
 validate failed for mygpgby06
 [Wed Apr 15 14:22:00.463 2009] [4208:2848] [error] jk_lb_worker.c
 (1599):
 Failed creating worker mygpgby06
 [Wed Apr 15 14:22:00.479 2009] [4208:2848] [error] jk_lb_worker.c
 (1647):
 NULL parameters
 [Wed Apr 15 14:22:00.479 2009] [4208:2848] [error] jk_worker.c (163):
 validate failed for loadbalancerprod
 [Wed Apr 15 14:22:00.479 2009] [4208:2848] [error] jk_worker.c (262):
 failed to create worker loadbalancerprod [Wed Apr 15 14:22:00.479 2009]
 [4208:2848] [error] jk_uri_worker_map.c
 (506): Could not find worker with name 'loadbalancerprod' in uri map
 post processing.

  If I take this worker out of the balance_workers list, everything
 starts up fine. If I leave it in, my loadbalancerprod worker is
 completely dead..

  According to the documentation, When starting up, the web server
 plugin with instantiate the workers whose name appears in the
 worker.list property...

 So - one worker in the load balancer won't start so the whole load
 balancer is considered a failed worker.

 Is there a property I'm missing to make this work ?

 Scott

 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org





 

mod_jk ping_timeout revisit

2009-04-15 Thread Anthony J. Biacco
A month or so ago I posted that I was having problems with mod_jk
(1.2.27) getting a pong response back from tomcat (6.0.18) in responses
to a ping. Apache is 2.2.11 with worker mpm.

I have a little more information now and am hoping with help I can solve
the problem so I can keep the ping timeout low and get rid of the error.
Error does not show up when ping timeout is = 25000.

My tomcat connectionTimeout is set to 6
My jkwatchdoginterval is set to 60
My relevant workers.properties is:
worker.template.connection_pool_timeout=60
worker.template.reply_timeout=2
worker.template.socket_timeout=10
worker.template.socket_connect_timeout=5000
worker.template.ping_mode=A
worker.template.ping_timeout=1

The mod_jk error is:
[Wed Apr 15 17:25:06 2009] [23222:1085466944] [debug]
wc_maintain::jk_worker.c (339): Maintaining worker app-01
[Wed Apr 15 17:25:06 2009] [23222:1085466944] [debug]
ajp_maintain::jk_ajp_common.c (3081): reached pool min size 13 from 25
cache slots
[Wed Apr 15 17:25:06 2009] [23222:1085466944] [debug]
ajp_connection_tcp_send_message::jk_ajp_common.c (1070): sending to
ajp13 pos=4 len=5 max=16
[Wed Apr 15 17:25:06 2009] [23222:1085466944] [debug]
ajp_connection_tcp_send_message::jk_ajp_common.c (1070): 12 34
00 01 0A 00 00 00 00 00 00 00 00 00 00 00  - .4..
[Wed Apr 15 17:25:06 2009] [23222:1085466944] [debug]
jk_shutdown_socket::jk_connect.c (681): About to shutdown socket 52
[Wed Apr 15 17:25:06 2009] [23222:1085466944] [debug]
jk_shutdown_socket::jk_connect.c (732): Shutdown socket 52 and read 0
lingering bytes
[Wed Apr 15 17:25:06 2009] [23222:1085466944] [info]
ajp_connection_tcp_get_message::jk_ajp_common.c (1143): (app-01) can't
receive the response header message from tomcat, tomcat
(10.10.10.16:8009) has forced a connection close for socket 52
[Wed Apr 15 17:25:06 2009] [23222:1085466944] [info]
ajp_handle_cping_cpong::jk_ajp_common.c (876): awaited reply cpong, not
received
[Wed Apr 15 17:25:06 2009] [23222:1085466944] [info]
ajp_maintain::jk_ajp_common.c (3101): (app-01) failed sending request,
socket -1 keepalive cping/cpong failure (errno=0)
[Wed Apr 15 17:25:06 2009] [23222:1085466944] [debug]
ajp_reset_endpoint::jk_ajp_common.c (743): (app-01) resetting endpoint
with sd = 4294967295 (socket shutdown)
[Wed Apr 15 17:25:06 2009] [23222:1085466944] [debug]
ajp_maintain::jk_ajp_common.c (3126): pinged 1 sockets in 0 seconds from
25 pool slots

I send a request to tomcat via apache/mod_jk. Request's mount is mapped
to worker, not loadbalancer.
After successful request, Tomcat manager status shows the socket in
stage 'R' and keeped alive socket count as 1. 
After 60 seconds, Tomcat manager status shows keeped alive socket count
as 0, socket still in stage 'R'
Above error happens 2 minutes after a request is finished, I'm assuming
because the keep alive socket is not there anymore.
So I set tomcat's connectionTimeout to 0 and repeat request.
This time Tomcat (after 60 seconds) doesn't reset the keeped alive
socket count to 0 (as expected), socket still in stage 'R'.
2 minutes later from mod_jk I get:
[Wed Apr 15 17:30:08 2009] [23251:1102088512] [debug]
wc_maintain::jk_worker.c (339): Maintaining worker app-01
[Wed Apr 15 17:30:08 2009] [23251:1102088512] [debug]
ajp_maintain::jk_ajp_common.c (3081): reached pool min size 13 from 25
cache slots
[Wed Apr 15 17:30:08 2009] [23251:1102088512] [debug]
ajp_connection_tcp_send_message::jk_ajp_common.c (1070): sending to
ajp13 pos=4 len=5 max=16
[Wed Apr 15 17:30:08 2009] [23251:1102088512] [debug]
ajp_connection_tcp_send_message::jk_ajp_common.c (1070): 12 34
00 01 0A 00 00 00 00 00 00 00 00 00 00 00  - .4..
[Wed Apr 15 17:30:08 2009] [23251:1102088512] [debug]
ajp_connection_tcp_get_message::jk_ajp_common.c (1259): received from
ajp13 pos=0 len=1 max=16
[Wed Apr 15 17:30:08 2009] [23251:1102088512] [debug]
ajp_connection_tcp_get_message::jk_ajp_common.c (1259): 09 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00  - 
[Wed Apr 15 17:30:08 2009] [23251:1102088512] [debug]
ajp_maintain::jk_ajp_common.c (3126): pinged 1 sockets in 0 seconds from
25 pool slots

At this point tomcat manager status shows the socket in stage 'P' and
keeped alive socket count is 0.
Above mod_jk log repeats every 2 minutes. Tomcat manager status doesn't
change.

Any help is appreciated.

-Tony
---
Manager, IT Operations
Format Dynamics, Inc.
303-573-1800x27
abia...@formatdynamics.com
http://www.formatdynamics.com



-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: retrieve session data stored in db using JDBCStore.

2009-04-15 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Jerry,

On 4/13/2009 11:15 PM, jerrySheen wrote:
 As we are dealing with sessions that are no [longer accessible], this action
 would have no effect on any live sessions thus no inconsistencies.
 
 if YES, please furnish some sample code or at least direct me towards the
 solutions.

You could certainly look at the code for the
org.apache.catalina.session.JDBCStore class.

 Isn't [something already] happening now?

 Yes but only at server restarts.

Server restarts or browser restarts?

 what i am trying to implement here is session persistence across browser
 restarts. ie. I would like to maintain the session state even if the browser
 is closed and restarted at which point a new session is started. 

I think you want to change the cookie behavior, not go mucking-around
with the session itself. All you really need is the browser to remember
the JSESSIONID cookie across a browser restart.

 now i would like to persist the old session by maintaining the session id
 inside a cookie, and compare this id against the session id stored in
 'sessionIdCol=id ', then copy the session data stored as blob in
 '''sessionDataCol = data ' and assign this data to the new session.

This seems like more work than necessary. Why not fix the JSESSIONID
cookie?

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAknmkxUACgkQ9CaO5/Lv0PCu/ACffl4CPLTEISX8Ri4IAMmVOt61
DlIAn2zwanuZYdBxJjQ85nCeum5f555K
=l8Ey
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Apache Tomcat 6.0.18

2009-04-15 Thread HASSAN Kamrul

Currently, I using Apache Tomcat 6.0.16 where and How can I upgrade to
Apache Tomcat 6.0.18.
Is there any major modification or fix in Apache Tomcat 6.0.18

Thank you.

Kamrul Hassan
Alcatel-Lucent
GNOC IT Development and Architecture
(972) 477 8792
kamrul.has...@alcatel-lucent.com



-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: retrieve session data stored in db using JDBCStore.

2009-04-15 Thread jerrySheen

So u mean to say, that if I were to prolong the JSESSIONID cookie's expiry
time, the server would take care of repopulating the session state(stored in
the db) even after a browser restart?

Well, this seems like a much simpler solution,ill give it a try, hope it
works.

Thanks,
JS

-- 
View this message in context: 
http://www.nabble.com/retrieve-session-data-stored-in-db-using-JDBCStore.-tp23020556p23071047.html
Sent from the Tomcat - User mailing list archive at Nabble.com.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Apache Tomcat 6.0.18

2009-04-15 Thread zhaoxueqing
backup your configurature file.
override all file.
restore the conf file.

tomcat/conf
tomcat/bin/catalina.bat or .sh

- Original Message - 
From: HASSAN Kamrul kamrul.has...@alcatel-lucent.com
To: users@tomcat.apache.org
Sent: Thursday, April 16, 2009 11:43 AM
Subject: Apache Tomcat 6.0.18



Currently, I using Apache Tomcat 6.0.16 where and How can I upgrade to
Apache Tomcat 6.0.18.
Is there any major modification or fix in Apache Tomcat 6.0.18

Thank you.

Kamrul Hassan
Alcatel-Lucent
GNOC IT Development and Architecture
(972) 477 8792
kamrul.has...@alcatel-lucent.com



-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



how to configure a PKCS#11 keysore and use it with Tomcat for SSL enabling

2009-04-15 Thread Rajat Gupta05

Thanks
Rajat


 CAUTION - Disclaimer *
This e-mail contains PRIVILEGED AND CONFIDENTIAL INFORMATION intended solely 
for the use of the addressee(s). If you are not the intended recipient, please 
notify the sender by e-mail and delete the original message. Further, you are 
not 
to copy, disclose, or distribute this e-mail or its contents to any other 
person and 
any such actions are unlawful. This e-mail may contain viruses. Infosys has 
taken 
every reasonable precaution to minimize this risk, but is not liable for any 
damage 
you may sustain as a result of any virus in this e-mail. You should carry out 
your 
own virus checks before opening the e-mail or attachment. Infosys reserves the 
right to monitor and review the content of all messages sent to or from this 
e-mail 
address. Messages sent to or from this e-mail address may be stored on the 
Infosys e-mail system.
***INFOSYS End of Disclaimer INFOSYS***


Apache Tomcat 6.0.18 - download info

2009-04-15 Thread HASSAN Kamrul
Thank you for quick responses.

I need to upgrade to Apache Tomcat 6.0.18 for Windows XP. 
So, I would back up a copy of 
tomcat/conf
tomcat/bin/catalina.bat

Please let me know where I can get download for Apache Tomcat 6.0.18 [
Windows XP]

Thank you.

Kam

-Original Message-
From: zhaoxueqing [mailto:zhaoxueq...@g-data.com.cn] 
Sent: Wednesday, April 15, 2009 11:44 PM
To: users-return-194735-zhaoxueqing=g-data.com...@tomcat.apache.org;
Tomcat Users List
Subject: Re: Apache Tomcat 6.0.18

backup your configurature file.
override all file.
restore the conf file.

tomcat/conf
tomcat/bin/catalina.bat or .sh

- Original Message -
From: HASSAN Kamrul kamrul.has...@alcatel-lucent.com
To: users@tomcat.apache.org
Sent: Thursday, April 16, 2009 11:43 AM
Subject: Apache Tomcat 6.0.18



Currently, I using Apache Tomcat 6.0.16 where and How can I upgrade to
Apache Tomcat 6.0.18.
Is there any major modification or fix in Apache Tomcat 6.0.18

Thank you.

kam


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



request.getSession() generates IllegalStateException in top filter (appears, response not being recycled properly if SocketException happened for it in the past)

2009-04-15 Thread Leonard Gestrin
Hello,

This is my first post on the list and I've been using tomcat for few years, so 
I want to start off stating that it is an excellent product.

However, I've ran into an issue, which I am not sure what to do about.

We have jsp that displays multiple images, which is being written directly to 
the page by the servlet.

img src=/chart/DrawTestChart

Every once in while, in the servlet,  while writing the bytes out, I get  
ClientAbortException:  java.net.SocketException: Connection reset by peer

At this point, I catch an exception and in finally block, I am trying to close 
response.outputstream.

After a while, the same response object is being used by tomcat again, but as 
it gets to a first filter, I can see that it's already in commited state 
(response.isCommitted()==true)

I know it's the same response object for which SocketException was generated, 
because I am printing response.hashcode() in chart servlet and in Filter

This really sucks, because anything I try to do with such response is doomed to 
fail :)

So, please advise how can I work around this issue, short of writing image in 
temp directory of tomcat as oppose to directly to response output stream.

This is tomcat apache-tomcat-5.5.20, JRE 15, WinXP.

I can provide code snippets, if it would be helpful. (chart servlet is using 
jdk classes
java.awt.image.BufferedImage to create image
javax.imageio.ImageWriter that is wrapped on top of response.outputstream)

Thanks

Leonard







-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org