Re: 8.0->8.5 migration - digests

[Anthony Biacco]

On Mon, Aug 15, 2016 at 11:02 PM, Mark Thomas <ma...@apache.org> wrote:

> On 16/08/2016 04:08, Anthony Biacco wrote:
> > Just started testing a migration from 8.0 to 8.5.
> > I'm was using digested passwords with digest="sha-512" in my realm for
> > manager and i noticed in the migration doc that it said the digest
> property
> > was removed.
> > Took me a little while to figure out that this was replaced with the
> > CredentialHandler.
> > Might to nice to see a little blurb after the notice to say, this is
> > replaced by CredentialHandler. See
> > https://tomcat.apache.org/tomcat-8.5-doc/config/credentialhandler.html
>
> The digest attribute is deprecated in 8.0.x. The credential handler is
> referenced in the 8.0.x docs in the description for the digest attribute.
>
> That said, this isn't mentioned in the 7.0.x to 8.0.x migration guide.
> I've made some changes.
>
>
Yep, had no idea. That's probably exactly what happened. I followed the
migration guide going from 7 to 8.0 , then just followed the release notes
for all the 8.0 versions going forward. It's also possible I knew and then
forgot when i hit 40 :)

Much thanks

-Tony




Mark
>
>
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
>
>

8.0->8.5 migration - digests

[Anthony Biacco]

Just started testing a migration from 8.0 to 8.5.
I'm was using digested passwords with digest="sha-512" in my realm for
manager and i noticed in the migration doc that it said the digest property
was removed.
Took me a little while to figure out that this was replaced with the
CredentialHandler.
Might to nice to see a little blurb after the notice to say, this is
replaced by CredentialHandler. See
https://tomcat.apache.org/tomcat-8.5-doc/config/credentialhandler.html

-Tony

Re: question on Java / Tomcat / GC

[Anthony Biacco]

On Thu, Jul 14, 2016 at 11:41 AM, André Warnier (tomcat) 
wrote:

> Hi Java GC gurus.
>
> I am coming for a bit of expert advice, not for a problem.
>
> At some customer site, some applications appear to react somewhat slowly
> sometimes, although these are not very heavy applications, and traffic on
> the site is also not very high.
>
> Amog several other things I'm looking at, wondering if this might have
> something to do with Java/Tomcat running out of memory, and perhaps doing
> excessive GC's, I set up GC logging.
> Below I am pasting that small Java GC log.
> This is running tomcat 6 still, the java versions and tomcat JVM relevant
> switches are shown in the log.
> I am starting the tomcat JVM with "-Xms1024M -Xmx1024M", and no other
> non-default settings regarding memory management or GC type.
>
> I take it that in the log below, the first number on the left is a
> timestamp in "seconds , thousands of a second".
>
> Based on what I am seeing below, it does not appear that this Tomcat would
> be at any time running short of Heap space, does it ?
> The most it seems to be using below, is 153579K, when it has 1024M to play
> with.
> Meither does it seem to be doing excessive GC either, since these logged
> GC's are separated by several thousands of seconds.
>
> But what does puzzle me a bit, is that each time it runs a "minor GC", it
> seems to follow this almost immediately (within 1-2 ms) with a "full GC".
>
>
Well, i'm not a GC expert by any stretch of the imagination, but i think
with your PrintGC options the "GC (System.gc())" and the "Full GC
(System.gc())" are the same GC.
Since they're consistent at every hour, the application may be calling the
System.gc
You may want to check the code if you have access to it.

-Tony

Re: Apache server as forward and reverse proxy

[Anthony Biacco]

On Thu, Jul 14, 2016 at 3:21 AM, Mohanavelu Subramanian 
wrote:

> Hi All,
>
> I know this group is for tomcat related queries.
> I have some query related to apache server, if someone have an idea about
> this, I request you to please share.
>
>
You should ask your questions on the apache users mailing list then.


-Tony

Re: [OT] mod-jk + ssl: requests are not forward to tomcat correctly

[Anthony Biacco]

On Wed, Jul 13, 2016 at 8:44 AM, André Warnier (tomcat) <a...@ice-sa.com>
wrote:

> On 13.07.2016 16:34, Anthony Biacco wrote:
>
>> On Mon, Jul 11, 2016 at 5:39 PM, Wayne Li <wayneli0...@gmail.com> wrote:
>>
>> Probably the quickest : download these files, install them on your
>>>>
>>> server, and change the above links.
>>> Like : create a sub-directory "/js" of your webapp, and install them
>>> there.
>>> Then change the above links to : href="js/jquery.mobile-1.4.5.min.css"
>>>
>>> Yes. It works. Thanks.
>>>
>>> It is okay for now. but, if I do not want host these files, what should I
>>> do? Can you point a direction for me please?
>>>
>>>
>>
>> If you must not host these files, use CDNjs, i.e.
>> https://cdnjs.com/libraries/jquery-mobile
>>
>>
> But then Rainer's previous point would still be valid.
>
>
>
Yes, of course. Doesn't change that fact.


-Tony

Re: mod-jk + ssl: requests are not forward to tomcat correctly

[Anthony Biacco]

On Mon, Jul 11, 2016 at 5:39 PM, Wayne Li  wrote:

> > Probably the quickest : download these files, install them on your
> server, and change the above links.
> Like : create a sub-directory "/js" of your webapp, and install them there.
> Then change the above links to : href="js/jquery.mobile-1.4.5.min.css"
>
> Yes. It works. Thanks.
>
> It is okay for now. but, if I do not want host these files, what should I
> do? Can you point a direction for me please?
>


If you must not host these files, use CDNjs, i.e.
https://cdnjs.com/libraries/jquery-mobile

-Tony

Re: Runtime Cloning of DataSource for Different DB?

[Anthony Biacco]

On Sun, Jun 26, 2016 at 11:07 PM, Jerry Malcolm 
wrote:

>
> On 6/26/2016 8:27 PM, David Kerber wrote:
>
>> On 6/26/2016 1:32 AM, Jerry Malcolm wrote:
>>
>>> I have a webapp that runs on a single host.  It has one primary
>>> database.  But it has many secondary databases.  There is one
>>> secondary database for each of my clients that use my app. These
>>> client databases come and go regularly as clients signup and leave.
>>> I don't want to have to edit Tomcat conf files adding and deleting
>>>  tags for the secondary databases and then have to bounce
>>> Tomcat several times a day as clients come onboard or leave.
>>>
>>> I have one  tag for the primary database.  The id/pw and
>>> everything else in the resource tag is the same for all of the
>>> databases.  Is there a way to specify/override the url (i.e. the
>>> database name) at runtime to connect to whatever secondary database I
>>> need for the particular client?  Or is there a way to clone a
>>> datasource for a different url/database?  I still would like to use
>>> the one resource tag in the context.xml.default conf file to specify
>>> the id/pw for the secondary DBs.  I'd prefer not to hardcode id/pw in
>>> the java code.  But if that is the only option, I can do it.
>>>
>>> Hopefully there is some way to dynamically select the db in a
>>> datasource at runtime... (??) Suggestions?
>>>
>>
>> You can move your authentication code into your application, rather than
>> having TC handle it.  Then you can pick any database or data source you
>> want.
>>
>>
>> I know I can hardcode the connection in the code.  But that is not going
> to provide connection pooling.  That 's a huge performance hit.  I really
> want the same capability I get with jdbc datasources, only without
> hardcoding hundreds of them in the conf files.
>
>
I seem to recall DBCP having a per-user pool data source feature, where you
can pass different credentials to the same base Resource. Whether you can
change the database too, i don't remember.
You might want to check the docs or ask those guys a couple doors down.

-Tony





> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
>
>

Re: Fail secure state

[Anthony Biacco]

On Fri, Jun 24, 2016 at 7:36 AM, Jason Ricles 
wrote:

> Yes, which has security modules and settings which may fail to be
> loaded or might be unloaded from tomcat if the computer fails to start
> up or shut down correctly. In that case, how does tomcat handle that
> failure?
>


Furthermore, what state the filesystem is in if Tomcat fails to start/stop.
The state of the webapp dirs (if exploded from war), work dirs, temp dir,
which may contain data you deem sensitive.

-Tony


>
> On Thu, Jun 23, 2016 at 6:19 PM, André Warnier (tomcat) 
> wrote:
> > On 23.06.2016 21:43, Jason Ricles wrote:
> >>
> >> Fail-secure is a condition achieved by the application server in order
> >> to ensure that in the event of an operational failure, the system does
> >> not enter into an unsecure state where intended security properties no
> >> longer hold
> >
> >
> > Just to make sure : you do know that tomcat is a computer program, right
> ?
> >
> >
> >>
> >> On Thu, Jun 23, 2016 at 3:33 PM, Mark Thomas  wrote:
> >>>
> >>> On 23/06/2016 20:21, Jason Ricles wrote:
> 
>  Does tomcat have a secure state if system initialization fails,
>  shutdown fails, or aborts fail?
> >>>
> >>>
> >>> Define "secure state", "system initialization", "fails", "shutdown" and
> >>> "aborts" and we might be able to help you.
> >>>
> >>> Mark
> >>>
> >>>
> >>> -
> >>> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> >>> For additional commands, e-mail: users-h...@tomcat.apache.org
> >>>
> >>
> >> -
> >> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> >> For additional commands, e-mail: users-h...@tomcat.apache.org
> >>
> >
> >
> > -
> > To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> > For additional commands, e-mail: users-h...@tomcat.apache.org
> >
>
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
>
>

Re: mod JK ho to rout all content to tomcat except for a few static folders

[Anthony Biacco]

On Mon, Jun 20, 2016 at 9:14 AM, Campbell, Lance  wrote:

> These are the versions of software I have to use.  I cannot install other
> software:
>
>
>
> Apache 2.2.15
>
> mod_jk  1.2.41
>
> Tomcat 8.0.36
>
>
>
> Issue:
>
> We are looking at having a domain where all content will get routed to
> Tomcat 8 except for three directories that contain static content.  These
> three directories will be served up by Apache.  Based on the above versions
> how can I tell Apache to handle just these three directories and then send
> all other content requests to Tomcat?
>
>
>
>
>
should be able to use either of:

JkUnMount /URI/* worker

SetEnvIf Request_URI "/URI/*" no-jk


-Tony

Re: Re: Tomcat application folder created in /tmp?

[Anthony Biacco]

On Fri, Jun 10, 2016 at 11:04 AM, Scott Derrick  wrote:

>
> I'm not sure why those flags were set to true? I removed them and the copy
> is gone! thanks.
>

I can only imagine some sort of alcohol-induced admining? ;)


>
> I'm running on linux and understand that the locking has no effect anyway.
>
> thanks again,
>

yep yep. cheers


-Tony


>
> --
> We are all here for a spell; get all the good laughs you can.
> Will Rogers
>
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
>
>

Re: Tomcat application folder created in /tmp?

[Anthony Biacco]

On Wed, Jun 8, 2016 at 1:51 PM, Scott Derrick  wrote:

> Tomcat7
> Java 1.8.0_51
> Running on CentOS 6(Linux)
>
> When I deploy one of my apps using the tomcat manager app, it unpaks the
> .war file into
>
> ../webapp/appName
>
> and
>
> /tmp/0-appName
>
> The files look identical in both folders except the files in the
> webapp/appName folder have the timestamp of when I created the war, and the
> files in /tmp/0-appName have the timestamp of when I deployed the war.
>
> what is the /tmp/appName folder and files for?
>
> why does it do this for this app but not the other 7 apps I have deployed?
>
> thanks,
>
> Scott


this will happen if you have antiResourceLocking or antiJARLocking set to
true in your context config. if you do, question why you are doing this as
it's not the default.

http://tomcat.apache.org/tomcat-7.0-doc/config/context.html

-Tony



>
>
> --
> No pessimist ever discovered the secret of the stars or sailed an
> uncharted land, or opened a new doorway for the human spirit.
> Helen Keller
>
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
>
>

Re: mod_jk resubmitting request to Tomcat

[Anthony Biacco]

On Sat, Jun 4, 2016 at 12:00 PM, Jerry Malcolm 
wrote:

> I am calling a JSP to start a fairly long-running process in Tomcat.  I'm
> not using the page response data.  The JSP is simply a way to initiate the
> process.  The JSP simply returns "OK" or "RC=". However, mod_jk gets
> impatient, and after about 5 minutes, it decides to send the request to
> Tomcat again, which kicks off another instance of the back-end process
> (obviously not what I want).  Following is from the mod_jk log:
>
> >>> can't receive the response message from tomcat, network problems or
> tomcat is down (127.0.0.1:8009), err=-60
> >>> Tomcat is down or refused connection. No response has been sent to the
> client (yet)
> >>> receiving from tomcat failed, recoverable operation attempt=0
> >>> sending request to tomcat failed,  recoverable operation attempt=1
>
> How can I tell mod_jk to be more patient for this request and not to
> resubmit it?
>

you probably have the reply_timeout on the worker set too low.

https://tomcat.apache.org/connectors-doc/common_howto/timeouts.html


-Tony



> Thanks.
>
> Jerry
>
>
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
>
>

Re: minSpareThreads for AJP connector

[Anthony Biacco]

On Tue, May 31, 2016 at 11:44 AM, Christopher Schultz <
ch...@christopherschultz.net> wrote:

> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA256
>
> Anthony,
>
> On 5/27/16 3:54 PM, Anthony Biacco wrote:
> > On Fri, May 27, 2016 at 7:34 AM, Christopher Schultz <
> > ch...@christopherschultz.net> wrote:
> >
> > Tony,
> >
> > On 5/26/16 4:22 PM, Anthony Biacco wrote:
> >>>> On Thu, May 26, 2016 at 2:19 PM, Anthony Biacco
> >>>> <abia...@handll.com> wrote:
> >>>>
> >>>>> I have this property set under 8.0.35, but it only hits the
> >>>>> value I set when i make that many requests. Should it not
> >>>>> allocate threads of the value I set on startup?
> >>>>>
> >>>>>
> >>>> btw, i'm using org.apache.coyote.ajp.AjpNioProtocol
> >
> > Can you post your complete Connector configuration?
> >
> >
> >> Sure..
> >
> >>  >> protocol="org.apache.coyote.ajp.AjpNioProtocol" maxThreads="400"
> >> backlog="25" maxPostSize="4194304" enableLookups="false"
> >> connectionTimeout="12" keepAliveTimeout="1"
> >> redirectPort="8443" acceptorThreadCount="2"
> >> pollerThreadCount="2" processorCache="400" minSpareThreads="25"
> >> useComet="false" />
>
> You should:
>
> 1. Use an  instead of specifying your threading config in
> 
> 2. Set prestartminSpareThreads="true" on your 
>
> I think you'll get the behavior you are expecting.
>
>
So this worked well, except now, under my consistent load, the threads in
the executor don't time out after their set idle time (maxIdleTime="6").
If i run a load test, they do after the test finishes, so i'm assuming it's
FIFO based.
If it is, then my threads will likely never idle out. Maybe we should have
an option to make this LIFO?

-Tony




> - -chris
> -BEGIN PGP SIGNATURE-
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQIcBAEBCAAGBQJXTc1tAAoJEBzwKT+lPKRYMpsQAIm5jmGuNFEbhQOLqQYWvquy
> WglEnM4QGsquyAU5Mfb5qsds9uu7f81c0CIw7M1fT76kvC8xC9aaTxAk8qSG+TTR
> FN+UiNr91IfyKHdq/qoOjxHbtISLhlE1IA7/Z3AQdtZ+Rvf3TioFULEVgZryt9Wo
> e1GioN5plkkYJlf4dxYpBXpfProuwsKDMsmISXAjPSZM8IzYggO2axBoKxIx2JHL
> /rkY6zZPhgaf6NWhEoFB0a/+Pfbug5eodPS93ph57BYxHOCCfGiRQ9kpua/k9rIh
> OKauwZefuSV2MxtMr40A6ckfMSkeW/4fq73JSvZFuGiTe7Yuij85lIPR9s7BCaON
> XH/tMJScecTcmREN5Ki+GMGfnssihlfUu78zw/DVFlIwkZQIoG7VqBUBVKJ6pboo
> AJjzZGkogskEK/ailaeRY/jITNfsGbxVHxE7qqhOaBOfWXRipxHeu4e08FFToLxv
> OWgUmcyB4bOzz8d3XXbl/NtIyY4wNl0SNywalW527r/uv86cUTtBBKEuMmJXVjt5
> Z7MLigAk5SvPaUtv2iP2ddmp1GTxcUXbjUJrpM20pKlyPum1bUysxX4I3mwdYNJ4
> EboTSZeiDq/eCbutoKb8Gk8yZ8c35/3utqmp88xNksmGrDxy17WplUf4tvcWhX/f
> Kb+DU9C1eBH78TNfhjKP
> =NNCM
> -END PGP SIGNATURE-
>
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
>
>

Re: minSpareThreads for AJP connector

[Anthony Biacco]

On Tue, May 31, 2016 at 11:44 AM, Christopher Schultz <
ch...@christopherschultz.net> wrote:

> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA256
>
> Anthony,
>
> On 5/27/16 3:54 PM, Anthony Biacco wrote:
> > On Fri, May 27, 2016 at 7:34 AM, Christopher Schultz <
> > ch...@christopherschultz.net> wrote:
> >
> > Tony,
> >
> > On 5/26/16 4:22 PM, Anthony Biacco wrote:
> >>>> On Thu, May 26, 2016 at 2:19 PM, Anthony Biacco
> >>>> <abia...@handll.com> wrote:
> >>>>
> >>>>> I have this property set under 8.0.35, but it only hits the
> >>>>> value I set when i make that many requests. Should it not
> >>>>> allocate threads of the value I set on startup?
> >>>>>
> >>>>>
> >>>> btw, i'm using org.apache.coyote.ajp.AjpNioProtocol
> >
> > Can you post your complete Connector configuration?
> >
> >
> >> Sure..
> >
> >>  >> protocol="org.apache.coyote.ajp.AjpNioProtocol" maxThreads="400"
> >> backlog="25" maxPostSize="4194304" enableLookups="false"
> >> connectionTimeout="12" keepAliveTimeout="1"
> >> redirectPort="8443" acceptorThreadCount="2"
> >> pollerThreadCount="2" processorCache="400" minSpareThreads="25"
> >> useComet="false" />
>
> You should:
>
> 1. Use an  instead of specifying your threading config in
> 
> 2. Set prestartminSpareThreads="true" on your 
>
> I think you'll get the behavior you are expecting.
>
>
i'll try that out. thanks chris

-Tony


> - -chris
> -BEGIN PGP SIGNATURE-
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQIcBAEBCAAGBQJXTc1tAAoJEBzwKT+lPKRYMpsQAIm5jmGuNFEbhQOLqQYWvquy
> WglEnM4QGsquyAU5Mfb5qsds9uu7f81c0CIw7M1fT76kvC8xC9aaTxAk8qSG+TTR
> FN+UiNr91IfyKHdq/qoOjxHbtISLhlE1IA7/Z3AQdtZ+Rvf3TioFULEVgZryt9Wo
> e1GioN5plkkYJlf4dxYpBXpfProuwsKDMsmISXAjPSZM8IzYggO2axBoKxIx2JHL
> /rkY6zZPhgaf6NWhEoFB0a/+Pfbug5eodPS93ph57BYxHOCCfGiRQ9kpua/k9rIh
> OKauwZefuSV2MxtMr40A6ckfMSkeW/4fq73JSvZFuGiTe7Yuij85lIPR9s7BCaON
> XH/tMJScecTcmREN5Ki+GMGfnssihlfUu78zw/DVFlIwkZQIoG7VqBUBVKJ6pboo
> AJjzZGkogskEK/ailaeRY/jITNfsGbxVHxE7qqhOaBOfWXRipxHeu4e08FFToLxv
> OWgUmcyB4bOzz8d3XXbl/NtIyY4wNl0SNywalW527r/uv86cUTtBBKEuMmJXVjt5
> Z7MLigAk5SvPaUtv2iP2ddmp1GTxcUXbjUJrpM20pKlyPum1bUysxX4I3mwdYNJ4
> EboTSZeiDq/eCbutoKb8Gk8yZ8c35/3utqmp88xNksmGrDxy17WplUf4tvcWhX/f
> Kb+DU9C1eBH78TNfhjKP
> =NNCM
> -END PGP SIGNATURE-
>
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
>
>

Re: minSpareThreads for AJP connector

[Anthony Biacco]

On Fri, May 27, 2016 at 7:34 AM, Christopher Schultz <
ch...@christopherschultz.net> wrote:

> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA256
>
> Tony,
>
> On 5/26/16 4:22 PM, Anthony Biacco wrote:
> > On Thu, May 26, 2016 at 2:19 PM, Anthony Biacco
> > <abia...@handll.com> wrote:
> >
> >> I have this property set under 8.0.35, but it only hits the value
> >> I set when i make that many requests. Should it not allocate
> >> threads of the value I set on startup?
> >>
> >>
> > btw, i'm using org.apache.coyote.ajp.AjpNioProtocol
>
> Can you post your complete Connector configuration?
>
>
Sure..




> How are you testing (applying load)? How are you measuring the number
> of allocated threads?
>
>
1 request at a time with apache ab->apache->mod_proxy_ajp/balancer->tomcat,
then checking JMX
(get=Catalina:type=ThreadPool,name="ajp-nio-8009"=currentThreadCount)

it increases +1 with every request, then when i get to 25, it'll stay there
(that part is right).

is it maybe that tomcat won't open a thread without a connection
(mod_proxy_ajp) attached to it first??

If it helps, members in my mod_proxy_ajp config look like this:

BalancerMember ajp://app-01.local:8009 route=app-01 loadfactor=1 max=200
acquire=2000 connectiontimeout=1500ms disablereuse=off keepalive=off
ping=1500ms timeout=30
retry=60 ttl=120 flushpackets=on


-Tony



> - -chris
> -BEGIN PGP SIGNATURE-
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQIcBAEBCAAGBQJXSEz3AAoJEBzwKT+lPKRYxlIQAJVil7ttuuOMkQm3TFqrTIej
> rKj2/rLyvo5x0UGE2POsWbAKNBq48eUPEOtSAJ1KvYmSaJ02q/nMDO/Uvf5aNIyA
> Ms2DJpn6L6uqM7GZO5dPXWtcNdughEOI2uMqFFJUBtNpjaBEeofNnv+LthGYzVjy
> 0MkZ2CLiSD54rrdTiZzCa7Q9bkc/y7sRzQN0G8ChKiYJumON2aYK+16iLH8XVHCs
> QFTe5I988mRnFP8c2r2G0gPVGxtBRdqXPPLIsJRUpxDmoYuo9/JGL0jI3GaCAX4H
> 4zrQqZmur5JfjqzsL8ehCGpQrEHzy8yseU8XhgLxZzWyUWWta04zwQn5noOUVEAf
> kcPQa72+RwNUd6i8446Pi8HdY+N1S3BFbjh/WQ8/jAk8AzzQtKye7UYBm3OxaHLw
> k+J+C+E7V4p+4GZDKR707+vE2q7//WEFYnor47WGwITxxRI+KP8z9jHkoBithdq1
> kMNlQyz/nsB4tIjRrTTSnp8N27HPFcFWdRL43m0dOnV+xCkwBs7F1aeUaQy9XonN
> 6hm67eIEx7nQ0BLnEziu9TO2fqRioOkFjuhnB2NURo+A6vebjwI9BLv3kJhAIpUu
> dmss7t+Ht8u5Nv+FTF/ntOm51MaNtp0HPjvGrjS1UJnD/seWef7sk8UPlB4EC3vb
> 56K0Na1fQVOzGYqtXcfg
> =sGAr
> -END PGP SIGNATURE-
>
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
>
>

Re: minSpareThreads for AJP connector

[Anthony Biacco]

On Thu, May 26, 2016 at 2:19 PM, Anthony Biacco <abia...@handll.com> wrote:

> I have this property set under 8.0.35, but it only hits the value I set
> when i make that many requests.
> Should it not allocate threads of the value I set on startup?
>
>
btw, i'm using org.apache.coyote.ajp.AjpNioProtocol


-Tony

minSpareThreads for AJP connector

[Anthony Biacco]

I have this property set under 8.0.35, but it only hits the value I set
when i make that many requests.
Should it not allocate threads of the value I set on startup?

Thanks,

-Tony

Re: Linux Logging Rotate

[Anthony Biacco]

On Thu, May 19, 2016 at 11:47 PM, Yuval Schwartz 
wrote:

> Thanks Christopher, that's informative.
> I've decided to just manually move (via ftp) the dated files off the server
> and just clear Catalina.out (like your link says, the only unique output it
> includes is system.out/err).
>
> Eventually I will implement a more thorough logging solution.
> Let me know if you have any suggestions for something simple.


if you choose to let tomcat rotate them, you can choose to compress and
remove them when they are X days old with cron. just one solution.
something like this:

# compress rotated logs, remove 7 day old compressed logs
1 0 * * * [[ -d /path/to/logs ]]&& find /path/to/logs -maxdepth 1 -type f
-name "*.[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9].log" -exec bzip2 '{}'
\; ; [[ -d /path/to/logs ]]&& find /path/to/logs -maxdepth 1 -type f -mtime
+7 -name "*.bz2" -exec rm -f '{}' \;

but you're probably better off using logrotate to handle this
rotate/removal logic.

-Tony


>
> Thanks.
>
> On Friday, 20 May 2016, Christopher Schultz 
> wrote:
>
> > -BEGIN PGP SIGNED MESSAGE-
> > Hash: SHA1
> >
> >
> >
> > On 5/18/16 7:41 AM, Yuval Schwartz wrote:
> > > Hello,
> > >
> > > I am currently running a web application:
> > >
> > > Tomcat: 8.0.22 JDK: 1.8.0_05 Server: Amazon Linux AMI
> > >
> > > At the moment, I am simply using the default logging. catalina.out
> > > catalina.[date].log localhost.[date].log host-manager.[date].log
> > > localhost_access_log.[date].log manager.[date].log
> > >
> > > These log files build up in my {catalina.base}/logs directory.
> > >
> > > At the moment it's not a problem but eventually I would like to
> > > clear these log files and store them somewhere (maybe send them to
> > > my email).
> > >
> > > Does anyone have any solutions for what to do with these log
> > > files? I looked into rotating them with logrotate but I read in a
> > > few places that tomcat automatically rotates its log files and that
> > > I shouldn't override this.
> > >
> > > I will eventually probably implement more thorough logging for my
> > > application. But for the meantime, what should I do so that I don't
> > > have a ton of log files in my logs directory? Any way to
> > > automatically delete and email all log files with dates older than
> > > one month? Should I implement logrotate on catalina.out since this
> > > does not get dated?
> > >
> > > Thank you
> >
> > Does this help?
> > http://wiki.apache.org/tomcat/HowTo#How_do_I_rotate_catalina.out.3F
> >
> > - -chris
> > -BEGIN PGP SIGNATURE-
> > Comment: GPGTools - http://gpgtools.org
> > Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
> >
> > iEYEARECAAYFAlc+OQkACgkQ9CaO5/Lv0PBsAACgpWGeCwhSkiTa7m8MYC7KMCae
> > N6EAn3moj/uRXdDHNfG9a1w/3/ypB7O4
> > =y7BX
> > -END PGP SIGNATURE-
> >
> > -
> > To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> 
> > For additional commands, e-mail: users-h...@tomcat.apache.org
> > 
> >
> >
>

Re: Auto-bounce a host or webapp?

[Anthony Biacco]

On Fri, May 6, 2016 at 11:05 AM, Jerry Malcolm 
wrote:

> My web apps are very large.  Typically I only need to refresh a jar file
> or two.  If I went to the WAR approach, I'd have to be uploading several
> hundred MB for each web app every time even if only a small jar actually
> was being replaced.   I really want to stay with the incremental refresh
> approach.
>
> I will look at the program-friendly manager stuff and see if I can make
> that work for me.
>
> Thanks.
>
> Jerry
>
>
I don't know how you upload your files to the app server, but maybe you can
use rsync with the --temp-dir option to specify a scratch dir on the remote
host that the files will go to before their final webapp destination.

if you don't want to use rsync, then maybe uploading to a temp dir and
running a remote command over ssh with pubkey authentication to move the
files.

your-upload-command && ssh -i key.pem user@host "mv tmp-dir/file webapp-dir"

obviously you'd have to play around with the file/directory logic and maybe
not using the tomcat user to ssh, but an upload user in the tomcat group

-Tony


> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
>
>

Re: Tomcat Files and Tools

[Anthony Biacco]

On Thu, Apr 14, 2016 at 8:48 AM, King Kenneth 
wrote:

> All,
>
> I have a few questions listed below please provided insight.
>
> Where do I find the tomcat-user.xml file?
>
> Where do I find the logging properties for Tomcat?
>
> Where is the java security manager, is this component installed by default?
>
>
You might want to to think about reading the docs at
http://tomcat.apache.org/tomcat-8.0-doc/
as well as buying a book, taking a class, things of that nature to get your
feet wet.

-Tony



> Thanks,
>
> Kenneth King Jr.
> Booz l Allen l Hamilton
> Office (202) 317-5593
> Cell (203) 450-7941
>
>
>
>

Re: Monitoring Tomcat

[Anthony Biacco]

On Sat, Apr 2, 2016 at 4:47 PM, Christopher Schultz <
ch...@christopherschultz.net> wrote:

>
> What regular expression did you try?
>
> How about this one:
>
> ^OK.*=\s*([0-9.]+)$
>
> -chris
>

sorry it took so long, i've been in dynamodb hell.
that worked as the -r and -R
grazie!

-Tony


>
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
>
>

Re: Monitoring Tomcat

[Anthony Biacco]

On Wed, Mar 30, 2016 at 5:23 PM, Christopher Schultz <
ch...@christopherschultz.net> wrote:

> Anthony,
>
> On 3/30/16 6:08 PM, Anthony Biacco wrote:
> > On Wed, Mar 30, 2016 at 9:13 AM, Christopher Schultz <
> > ch...@christopherschultz.net> wrote:
> >
> > Edwin,
> >
> >
> > For my money, I wouldn't enable JMX because, for monitoring, JMX is a
> > heavy-handed protocol: you either have to maintain a persistent
> > connection to the server or you need to launch a whole JVM and connect
> > over JMX to get e.g. a single sample value (such as current throughput).
> >
> > I would recommend enabling the JMXProxyServlet through the manager
> > application, and then locking-down the manager application so you can
> > only access it from localhost. Also use a non-trivial password for
> > HTTP authentication for the manager.
> >
> >
> >> +1
> >> i was using the jmxquery jar pulled from nagios and was slooow compared
> to
> >> the manager's jmxproxy (as would be expected).
> >> i just used the the perl script from
> >> https://wiki.apache.org/tomcat/FAQ/Monitoring and assigned a user to
> the
> >> manager-jmx security role in tomcat.
>
> Nice to see someone else is using it ;)
>
> Feel free to contribute to it or just complain about anything you need.
> I'd like for that tool to be widely-useful. I use it a lot at $work, but
> it should be universally useful.
>
> -chris
>

I only changed some minor things.
I removed the requirement for the -w and -c parameters, because i didn't
need them. I just wanted the data. Sure I could have have just put in bogus
values for them on the command line, but it just cluttered it up.
One problem i have is with returned data that's a number with a decimal in
it (like 'OK - Attribute get 'java.lang:type=OperatingSystem' -
ProcessCpuLoad = 0.009808796275369524'). It returned a Bad Response because
$num was null. I tried a different regex for it, but i'm not very good with
regex. :D
I ended up just doing a "split ' = ', $content" to get the number.

-Tony



> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
>
>

Re: Monitoring Tomcat

[Anthony Biacco]

On Wed, Mar 30, 2016 at 9:13 AM, Christopher Schultz <
ch...@christopherschultz.net> wrote:

> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA1
>
> Edwin,
>
>
> For my money, I wouldn't enable JMX because, for monitoring, JMX is a
> heavy-handed protocol: you either have to maintain a persistent
> connection to the server or you need to launch a whole JVM and connect
> over JMX to get e.g. a single sample value (such as current throughput).
>
> I would recommend enabling the JMXProxyServlet through the manager
> application, and then locking-down the manager application so you can
> only access it from localhost. Also use a non-trivial password for
> HTTP authentication for the manager.
>
>
+1
i was using the jmxquery jar pulled from nagios and was slooow compared to
the manager's jmxproxy (as would be expected).
i just used the the perl script from
https://wiki.apache.org/tomcat/FAQ/Monitoring and assigned a user to the
manager-jmx security role in tomcat.

-Tony



> That ought to cover just about everything except for a local
> intrusion, in which case you've already been pwned.
>
> - -chris
>
> >  From: Leonardo
> > Santagostini  Sent: Tuesday, March 29,
> > 2016 12:20 AM To: Tomcat Users List Subject: Re: Monitoring Tomcat
> >
> > My two cents:
> >
> > You can aldo use Zabbix to Monitor your Tomcar using JMX.
> >
> > Also Zabbix is used from templates. So once you got one machine
> > monitored as you expected you can easy deployit on other your
> > machine, and the best of all, you dont nees to use apps like
> > Jolokia. But bear in mind that there are some security concerns.
> >
> > Best regards El mar 28, 2016 8:56 p.m., "Edwin Quijada"
> >  escribió:
> >
> >> Thks!
> >>
> >>  From: Mark Eggers
> >>  Sent: Monday, March 28, 2016
> >> 10:32 PM To: Tomcat Users List Subject: Re: Monitoring Tomcat
> >>
> >> https://tomcat.apache.org/tomcat-7.0-doc/monitoring.html
> >> https://wiki.apache.org/tomcat/FAQ/Monitoring
> >>
> >> Basically enable JMX, then use a wide variety of tools to query
> >> an even wider variety of information.
> >>
> >> Please note that there are security issues when enabling JMX.
> >> Read the first link above for details.
> >>
> >> . . . just my two cents /mde/
> >>
> >> On 3/28/2016 3:23 PM, Edwin Quijada wrote:
> >>> Hi! I have an app with Tomcat+Grails+Vaadin+PostgreSQL and I
> >>> wanna monitor
> >> the speed and resources of this. I add to 1024mb to Tomcat
> >> because the app and DB is in the same server.
> >>>
> >>> What application can I use to monitor performance of this
> >>> Tomcat ?
> >>>
> >>>
> >>> TIA
> >>>
> >>
> >>
> >>
> >> -
> >>
> >>
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> >> For additional commands, e-mail: users-h...@tomcat.apache.org
> >>
> >>
> >
> > -
> >
> >
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> > For additional commands, e-mail: users-h...@tomcat.apache.org
> >
> -BEGIN PGP SIGNATURE-
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iEYEARECAAYFAlb77QgACgkQ9CaO5/Lv0PAcOQCeMNlr+pYLD3H6Z9k/JNR4PYm/
> vSkAnRvFDAeeyrq0U/2ca04bRxcc0bfv
> =DZU7
> -END PGP SIGNATURE-
>
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
>
>

8.0.30 500 error - redirect

[Anthony Biacco]

Background:
I run a jruby app under tomcat 8.0.29 in a context, namely /db.
I run Apache 2.4.17 in front of it, proxying my url to tomcat using
mod_proxy_balancer/ajp. For asthetics, i rewrite / for my URL (e.g.
https://dashboard.domain.com) to the tomcat context uri /db, and then
ProxyPass/ProxyPassReverse /db to tomcat (so esentially
https://dashboard.domain.com/db/). No problem.
The app, upon this request, will redirect the user with a 301 redirect to
the main page. If there's no session, the app then redirects the user with
a 302 to the sign in page.

Problem:
Upon updating to tomcat 8.0.30, instead of receiving a 301 response back,
tomcat returns a 500 error.
I've included the error w/stack trace, along with my app's context.xml and
web.xml below.
I assume this has to do with
https://bz.apache.org/bugzilla/show_bug.cgi?id=56917 that was introduced in
8.0.30.

I have added the parameters mapperContextRootRedirectEnabled="true"
and mapperDirectoryRedirectEnabled="true"
that were mentioned in the "CSRF errors after upgrade of tomcat 8

"  mailing list thread to my server context.xml file (they didn't have any
effect in the app's context.xml) and this has resolved my problem.
It's interesting that now, instead of the 301 (on /), then the 302 (on main
page), now I get a 302 (on /), then the 301 (on /db/), and then the 302 (on
main page). Curl output is below for 8.0.29, 8.0.30 without changes and
8.0.30 with changes.

My questions are:
1. Should the problem be occuring without the parameters added?
2. Is there a way to configure apache/tomcat so i don't need the added
parameters, and don't incur the extra request? I realize that may be
outside the scope of the list, if apache.

Thanks,

-Tony


Error
---
Dec 16, 2015 1:13:06 PM org.apache.catalina.core.StandardWrapperValve invoke
SEVERE: Servlet.service() for servlet [default] in context with path [/db]
threw exception
java.lang.IllegalArgumentException: The resource path [index.html] is not
valid
 at
org.apache.catalina.webresources.StandardRoot.validate(StandardRoot.java:250)
 at
org.apache.catalina.webresources.StandardRoot.getResource(StandardRoot.java:212)
 at
org.apache.catalina.webresources.StandardRoot.getResource(StandardRoot.java:206)
 at
org.apache.catalina.servlets.DefaultServlet.serveResource(DefaultServlet.java:710)
 at
org.apache.catalina.servlets.DefaultServlet.doGet(DefaultServlet.java:398)
 at javax.servlet.http.HttpServlet.service(HttpServlet.java:622)
 at javax.servlet.http.HttpServlet.service(HttpServlet.java:729)
 at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:291)
 at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
 at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
 at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
 at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
 at org.jruby.rack.RackFilter.doFilterInternal(RackFilter.java:78)
 at
org.jruby.rack.UnmappedRackFilter.isDoDispatch(UnmappedRackFilter.java:111)
 at org.jruby.rack.AbstractFilter.isDoDispatch(AbstractFilter.java:107)
 at org.jruby.rack.AbstractFilter.doFilter(AbstractFilter.java:65)
 at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
 at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
 at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:212)
 at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106)
 at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:141)
 at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79)
 at
org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:616)
 at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88)
 at
org.apache.catalina.valves.StuckThreadDetectionValve.invoke(StuckThreadDetectionValve.java:208)
 at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:521)
 at
org.apache.coyote.ajp.AbstractAjpProcessor.process(AbstractAjpProcessor.java:850)
 at
org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:674)
 at
org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1500)
 at
org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1456)
 at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
 at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
 at
org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
 at java.lang.Thread.run(Thread.java:745)

context.xml
-

Re: 8.0.30 500 error - redirect

[Anthony Biacco]

On Thu, Dec 17, 2015 at 1:53 PM, Mark Thomas  wrote:

> It looks like something isn't quite right in the AJP processing path. It
> appears to be expecting a '/' to be inserted somewhere. That looks like
> a bug.
>
> Not sure why things didn't work when you set them at the app level. They
> should have done.
>
> Generally, changing the context path between httpd and Tomcat opens up a
> world of opportunity for things to go wrong. It is neraly always better
> to keep the context path the same.
>
> Mark



Yep, I know. Everytime I look at my apache config I shiver. :)

I just noticed that if i put a slash at the end of my ProxyPass balancer
path then it works without the tomcat parameter changes.

ProxyPass /db balancer://loadbalancer/db/
ProxyPassReverse /db balancer://loadbalancer/db/

Obviously i'll have to test the whole app, but this may work for me. If so,
maybe it'll help somebody else out as well.
Thanks for the nudge.

-Tony




>
>
> > It's interesting that now, instead of the 301 (on /), then the 302 (on
> main
> > page), now I get a 302 (on /), then the 301 (on /db/), and then the 302
> (on
> > main page). Curl output is below for 8.0.29, 8.0.30 without changes and
> > 8.0.30 with changes.
> >
> > My questions are:
> > 1. Should the problem be occuring without the parameters added?
> > 2. Is there a way to configure apache/tomcat so i don't need the added
> > parameters, and don't incur the extra request? I realize that may be
> > outside the scope of the list, if apache.
> >
> > Thanks,
> >
> > -Tony
> >
> >
> > Error
> > ---
> > Dec 16, 2015 1:13:06 PM org.apache.catalina.core.StandardWrapperValve
> invoke
> > SEVERE: Servlet.service() for servlet [default] in context with path
> [/db]
> > threw exception
> > java.lang.IllegalArgumentException: The resource path [index.html] is not
> > valid
> >  at
> >
> org.apache.catalina.webresources.StandardRoot.validate(StandardRoot.java:250)
> >  at
> >
> org.apache.catalina.webresources.StandardRoot.getResource(StandardRoot.java:212)
> >  at
> >
> org.apache.catalina.webresources.StandardRoot.getResource(StandardRoot.java:206)
> >  at
> >
> org.apache.catalina.servlets.DefaultServlet.serveResource(DefaultServlet.java:710)
> >  at
> >
> org.apache.catalina.servlets.DefaultServlet.doGet(DefaultServlet.java:398)
> >  at javax.servlet.http.HttpServlet.service(HttpServlet.java:622)
> >  at javax.servlet.http.HttpServlet.service(HttpServlet.java:729)
> >  at
> >
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:291)
> >  at
> >
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
> >  at
> org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
> >  at
> >
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
> >  at
> >
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
> >  at org.jruby.rack.RackFilter.doFilterInternal(RackFilter.java:78)
> >  at
> >
> org.jruby.rack.UnmappedRackFilter.isDoDispatch(UnmappedRackFilter.java:111)
> >  at org.jruby.rack.AbstractFilter.isDoDispatch(AbstractFilter.java:107)
> >  at org.jruby.rack.AbstractFilter.doFilter(AbstractFilter.java:65)
> >  at
> >
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
> >  at
> >
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
> >  at
> >
> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:212)
> >  at
> >
> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106)
> >  at
> >
> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:141)
> >  at
> >
> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79)
> >  at
> >
> org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:616)
> >  at
> >
> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88)
> >  at
> >
> org.apache.catalina.valves.StuckThreadDetectionValve.invoke(StuckThreadDetectionValve.java:208)
> >  at
> >
> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:521)
> >  at
> >
> org.apache.coyote.ajp.AbstractAjpProcessor.process(AbstractAjpProcessor.java:850)
> >  at
> >
> org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:674)
> >  at
> >
> org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1500)
> >  at
> >
> org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1456)
> >  at
> >
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
> >  at
> >
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
> >  at
> >
> org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
> >  at