Re: High thread count load on Tomcat8 when accessing AJP port with no request

[Lisa Woodring]

Chris,

On Thu, Nov 20, 2014 at 3:16 PM, Christopher Schultz
ch...@christopherschultz.net wrote:

 Lisa,

 On 11/19/14 1:36 PM, Lisa Woodring wrote:
 On Tue, Nov 18, 2014 at 2:43 PM, Christopher Schultz
 ch...@christopherschultz.net wrote:
 -BEGIN PGP SIGNED MESSAGE- Hash: SHA256

 Lisa,

 On 11/18/14 11:52 AM, Lisa Woodring wrote:
 We recently upgraded from Tomcat 6.0.29 to Tomcat 8.0.14.
 Everything appears to be working fine, except that Tomcat is
 keeping a high # of threads (in TIMED_WAITING state) -- and the
 CPU has a high load  low idle time.  We are currently running
 Tomcat8 on 2 internal test machines, where we also monitor
 their statistics.  In order to monitor the availability of the
 HTTPS/AJP port (Apache--Tomcat), our monitoring software opens
 a port to verify that this works -- but then does not follow
 that up with an actual request.  This happens every 2 minutes.
 We have noticed that the high thread/load activity on Tomcat
 coincides with this monitoring.  If we disable our monitoring,
 the issue does not happen.  We have enabled/disabled the
 monitoring on both machines over several days (and there is
 only very minimal, sometimes non-existent) internal traffic
 otherwise) -- in order to verify that the monitoring is really
 the issue.  Once these threads ramp up, they stay there or keep
 increasing.  We had no issues running on Tomcat 6 (the thread
 count stayed low, low load, high idle time).

 The thread backtraces for these threads look like this:
 -




 Thread[catalina-exec-24,5,main]
 at sun.misc.Unsafe.park(Native Method) at
 java.util.concurrent.locks.LockSupport.parkNanos(LockSupport.java:215)




 at
 java.util.concurrent.locks.AbstractQueuedSynchronizer$ConditionObject.awaitNanos(AbstractQueuedSynchronizer.java:2078)


 at
 java.util.concurrent.LinkedBlockingQueue.poll(LinkedBlockingQueue.java:467)




 at org.apache.tomcat.util.threads.TaskQueue.poll(TaskQueue.java:85)
 at
 org.apache.tomcat.util.threads.TaskQueue.poll(TaskQueue.java:31)
 at
 java.util.concurrent.ThreadPoolExecutor.getTask(ThreadPoolExecutor.java:1066)




 at
 java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1127)


 at
 java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)




 at
 org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)


 at java.lang.Thread.run(Thread.java:745)
 -




 The thread count grows over time (goes up to 130-150 threads after 2
 hours).  Setting 'connectionTimeout' (as opposed to the default
 of never timing out) does seems to help some -- the # of
 threads isn't quite as bad (only 60-80 threads after 2 hours).
 However, the CPU Idle % is still not good -- was only 10% idle
 with default tomcat settings, is something like 40% idle with
 current settings. Also tried setting Apache's 'KeepAliveTimeout
 = 5' (currently set to 15) but this did not make any
 difference.


 Is there some configuration we can set to make Tomcat tolerant
 of this monitoring?  (We have tried setting connectionTimeout
  keepAliveTimeout on the Connector.  And we have tried putting
 the Connector behind an Executor with maxIdleTime.) OR, should
 we modify our monitoring somehow?  And if so, suggestions?


 * Running on Linux CentOS release 5.9 * running Apache in front
 of Tomcat for authentication, using mod_jk * Tomcat 8.0.14

 relevant sections of tomcat/conf/server.xml:
 




 Executor name=tomcatThreadPool namePrefix=catalina-exec-
 maxThreads=250 minSpareThreads=20 maxIdleTime=6 /

 Connector executor=tomcatThreadPool port=8080
 protocol=HTTP/1.1 connectionTimeout=2
 redirectPort=8443 /

 Connector executor=tomcatThreadPool port=8009
 protocol=AJP/1.3 redirectPort=8443 maxThreads=256
 connectionTimeout=3000 keepAliveTimeout=6 /

 Both of these connectors should be NIO connectors, so they should
 not block while waiting for more input. That means that you
 should not run out of threads (which is good), but those
 connections will sit in the poller queue for a long time (20
 seconds for HTTP, 3 seconds for AJP) and then sit in the acceptor
 queue for the same amount of time (to check for a next
 keepAlive request). Are you properly shutting-down the connection
 on the client end every 2 minutes?




 The monitoring software is trying to test is that the AJP port
 itself is actually accepting connections.  With Apache in front in
 a production system, it could forward the actual request to one of
 several Tomcat boxes -- but we don't know which one from the
 outside.

 Given that the whole point is to test whether the AJP connection is
 available, why would you bother making an HTTP request to the web
 server and then be sent arbitrarily to an unknown back-end Tomcat server

Re: High thread count load on Tomcat8 when accessing AJP port with no request

[Lisa Woodring]

On Tue, Nov 18, 2014 at 2:26 PM, André Warnier a...@ice-sa.com wrote:
 Lisa Woodring wrote:
 ...
 In order to monitor
 the availability of the HTTPS/AJP port (Apache--Tomcat), our
 monitoring software opens a port to verify that this works -- but then
 does not follow that up with an actual request.  This happens every 2
 minutes.
 ...

 This sounds like the perfect recipe for simulating a DOS attack.  Your
 monitoring system is forcing Tomcat to allocate a thread to process the
 request which should subsequently arrive on that connection, yet that
 request never comes; so basically this thread is wasted, until the
 ConnectionTimeout triggers (after 20 seconds, according to your HTTP
 connector settings).

 ...

 The thread count grows over time (goes up to 130-150 threads after 2
 hours).  Setting 'connectionTimeout' (as opposed to the default of
 never timing out) does seems to help some


 Have you tried setting it shorter ? 2 = 2 ms = 20 seconds. That is
 still quite long if you think about a legitimate browser/application making
 a connection, and then sending a request on that connection.  Why would it
 wait so long ? A browser would never do that : it would open a connection to
 the server when it needs to send a request, and then send the request
 immediately, as soon as the connection is established.

 In other words : anything which opens a HTTP connection to your server, and
 then waits more than 1 or 2 seconds before sending a request on that
 connection, is certainly not a browser.
 And it probably is either a program designed to test or attack your server,
 or else a badly-designed monitoring system.. ;-)



The monitoring software is going thru Apache to AJP connector in
Tomcat.  As I described, with the default of no timeout, the # of
threads were much higher.  I currently have the AJP connectionTimeout
set to 3 seconds.




 -- the # of threads isn't

 quite as bad (only 60-80 threads after 2 hours).  However, the CPU
 Idle % is still not good -- was only 10% idle with default tomcat
 settings, is something like 40% idle with current settings.  Also
 tried setting Apache's 'KeepAliveTimeout = 5' (currently set to 15)
 but this did not make any difference.


 Note : this value is in milliseconds. setting it to 5 or 15 is almost
 equivalent to disabling keep-alive altogether. 3000 may be a reasonable
 value.


No, Apache's configuration is in seconds.



 KeepAlive only happens after at least one request has been received and
 processed, waiting for another (possible) request on the same connection.
 If there is never any request sent on that connection, then it would not
 apply here, and only the connectionTimeout would apply.

 Note that my comments above are relative to your HTTP Connector.
 For the AJP Connector, other circumstances apply.

 If you are using AJP, it implies that there is a front-end server, using a
 module such as mod_jk or mod_proxy_ajp to connect to Tomcat's AJP Connector.
 In that case, you should probably leave Tomcat's connectionTimeout to its
 default value, and let the front-end server handle such things as the
 connection timeout and the keep-alive timeout.  The connector module on the
 front-end server will manage these connections to Tomcat, and it may
 pre-allocate some connections, to constitute a pool of available connections
 for when it actually does need to send a request to Tomcat over one such
 connection.  Timing out these connections at the Tomcat level may thus be
 contra-productive, forcing the front-end to re-create them constantly.




Yes, as I stated, Apache is running in front of Tomcat using mod_jk.
My big question is why is this now an issue?  This monitoring software
has been running for years now.  It has only been an issue since we
upgraded to Tomcat 8.

I also forgot to mention that we are using APR.




 Is there some configuration we can set to make Tomcat tolerant of this
 monitoring?  (We have tried setting connectionTimeout 
 keepAliveTimeout on the Connector.  And we have tried putting the
 Connector behind an Executor with maxIdleTime.)
 OR, should we modify our monitoring somehow?  And if so, suggestions?


 I would think so.  Have your monitoring send an actual request to Tomcat
 (and read the response); even a request that results in an error would
 probably be better than no request at all.  But better would be to request
 something real but small, which at the Tomcat level would be efficient to
 respond to (e.g. not a 5 MB image file).
 Create a little webapp which just responds I'm fine (*), and check that
 response in your monitor.  It will tell you not only that Tomcat has opened
 the port, but also that Tomcat webapps are actually working (and how quickly
 it answers).
 And do not try to monitor the AJP port directly. Monitor a request to the
 front-end, which should arrive to Tomcat via the AJP port.  The AJP
 connector module on the front-end will respond with its own error, if it
 cannot talk to Tomcat

Re: High thread count load on Tomcat8 when accessing AJP port with no request

[Lisa Woodring]

On Tue, Nov 18, 2014 at 2:43 PM, Christopher Schultz
ch...@christopherschultz.net wrote:
 -BEGIN PGP SIGNED MESSAGE-
 Hash: SHA256

 Lisa,

 On 11/18/14 11:52 AM, Lisa Woodring wrote:
 We recently upgraded from Tomcat 6.0.29 to Tomcat 8.0.14.
 Everything appears to be working fine, except that Tomcat is
 keeping a high # of threads (in TIMED_WAITING state) -- and the CPU
 has a high load  low idle time.  We are currently running Tomcat8
 on 2 internal test machines, where we also monitor their
 statistics.  In order to monitor the availability of the HTTPS/AJP
 port (Apache--Tomcat), our monitoring software opens a port to
 verify that this works -- but then does not follow that up with an
 actual request.  This happens every 2 minutes.  We have noticed
 that the high thread/load activity on Tomcat coincides with this
 monitoring.  If we disable our monitoring, the issue does not
 happen.  We have enabled/disabled the monitoring on both machines
 over several days (and there is only very minimal, sometimes
 non-existent) internal traffic otherwise) -- in order to verify
 that the monitoring is really the issue.  Once these threads ramp
 up, they stay there or keep increasing.  We had no issues running
 on Tomcat 6 (the thread count stayed low, low load, high idle
 time).

 The thread backtraces for these threads look like this:
 -


 Thread[catalina-exec-24,5,main]
 at sun.misc.Unsafe.park(Native Method) at
 java.util.concurrent.locks.LockSupport.parkNanos(LockSupport.java:215)


 at
 java.util.concurrent.locks.AbstractQueuedSynchronizer$ConditionObject.awaitNanos(AbstractQueuedSynchronizer.java:2078)
 at
 java.util.concurrent.LinkedBlockingQueue.poll(LinkedBlockingQueue.java:467)


 at org.apache.tomcat.util.threads.TaskQueue.poll(TaskQueue.java:85)
 at
 org.apache.tomcat.util.threads.TaskQueue.poll(TaskQueue.java:31) at
 java.util.concurrent.ThreadPoolExecutor.getTask(ThreadPoolExecutor.java:1066)


 at
 java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1127)
 at
 java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)


 at
 org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
 at java.lang.Thread.run(Thread.java:745)
 -


 The thread count grows over time (goes up to 130-150 threads after 2
 hours).  Setting 'connectionTimeout' (as opposed to the default of
 never timing out) does seems to help some -- the # of threads
 isn't quite as bad (only 60-80 threads after 2 hours).  However,
 the CPU Idle % is still not good -- was only 10% idle with default
 tomcat settings, is something like 40% idle with current settings.
 Also tried setting Apache's 'KeepAliveTimeout = 5' (currently set
 to 15) but this did not make any difference.


 Is there some configuration we can set to make Tomcat tolerant of
 this monitoring?  (We have tried setting connectionTimeout 
 keepAliveTimeout on the Connector.  And we have tried putting the
 Connector behind an Executor with maxIdleTime.) OR, should we
 modify our monitoring somehow?  And if so, suggestions?


 * Running on Linux CentOS release 5.9 * running Apache in front of
 Tomcat for authentication, using mod_jk * Tomcat 8.0.14

 relevant sections of tomcat/conf/server.xml:
 


 Executor name=tomcatThreadPool namePrefix=catalina-exec-
 maxThreads=250 minSpareThreads=20 maxIdleTime=6 /

 Connector executor=tomcatThreadPool port=8080
 protocol=HTTP/1.1 connectionTimeout=2 redirectPort=8443
 /

 Connector executor=tomcatThreadPool port=8009
 protocol=AJP/1.3 redirectPort=8443 maxThreads=256
 connectionTimeout=3000 keepAliveTimeout=6 /

 Both of these connectors should be NIO connectors, so they should not
 block while waiting for more input. That means that you should not run
 out of threads (which is good), but those connections will sit in the
 poller queue for a long time (20 seconds for HTTP, 3 seconds for AJP)
 and then sit in the acceptor queue for the same amount of time (to
 check for a next keepAlive request). Are you properly shutting-down
 the connection on the client end every 2 minutes?




The monitoring software is trying to test is that the AJP port itself
is actually accepting connections.  With Apache in front in a
production system, it could forward the actual request to one of
several Tomcat boxes -- but we don't know which one from the outside.
The monitoring software is trying to test -- for each Tomcat instance
-- if it is accepting connections.  It used to send an nmap request,
but now sends essentially a tcp ping -- to port 8009, gets a
response  moves on.  So, no, it does not shutdown the connection --
it's pretty simple/dumb.

My main questions are:
1) Why was this ok on Tomcat 6?  but now an issue with Tomcat 8?
2

Re: High thread count load on Tomcat8 when accessing AJP port with no request

[Lisa Woodring]

 Actually, I received a little clarification on the monitoring software
 (I didn't write it).  What it's trying to test is that the AJP port
 itself is actually accepting connections.  With Apache in front in a
 production system, it could forward the actual request to one of
 several Tomcat boxes -- but we don't know which one from the outside.
 The monitoring software is trying to test -- for each Tomcat instance
 -- if it is accepting connections.  It used to send an nmap request,
 but now sends essentially a tcp ping -- gets a response  moves on.


 In my case (homemade monitoring) i choosed to check mod_jk's log, after all
 mod_jk does indeed check the state of the ajp connector in tomcat.

 Hope this helps.
 [... ]


Thanks for the idea.  Can you tell me what you specifically look for
in the mod_jk_log file?  Do you look for the presence of something?
or the absence of something?
I only see 'negative' events in the logfile.  For example,
all endpoints are disconnected, detected by connect check(1),
cping(0), send(0)
which evidently, is when Tomcat releases a connection on its end.
(I set JkLogLevel = DEBUG, but still don't see any messages that look
like what I would want...)

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

High thread count load on Tomcat8 when accessing AJP port with no request

[Lisa Woodring]

We recently upgraded from Tomcat 6.0.29 to Tomcat 8.0.14.  Everything
appears to be working fine, except that Tomcat is keeping a high # of
threads (in TIMED_WAITING state) -- and the CPU has a high load  low
idle time.  We are currently running Tomcat8 on 2 internal test
machines, where we also monitor their statistics.  In order to monitor
the availability of the HTTPS/AJP port (Apache--Tomcat), our
monitoring software opens a port to verify that this works -- but then
does not follow that up with an actual request.  This happens every 2
minutes.  We have noticed that the high thread/load activity on Tomcat
coincides with this monitoring.  If we disable our monitoring, the
issue does not happen.  We have enabled/disabled the monitoring on
both machines over several days (and there is only very minimal,
sometimes non-existent) internal traffic otherwise) -- in order to
verify that the monitoring is really the issue.  Once these threads
ramp up, they stay there or keep increasing.  We had no issues running
on Tomcat 6 (the thread count stayed low, low load, high idle time).

The thread backtraces for these threads look like this:
-
Thread[catalina-exec-24,5,main]
 at sun.misc.Unsafe.park(Native Method)
 at 
java.util.concurrent.locks.LockSupport.parkNanos(LockSupport.java:215)
 at 
java.util.concurrent.locks.AbstractQueuedSynchronizer$ConditionObject.awaitNanos(AbstractQueuedSynchronizer.java:2078)
 at 
java.util.concurrent.LinkedBlockingQueue.poll(LinkedBlockingQueue.java:467)
 at org.apache.tomcat.util.threads.TaskQueue.poll(TaskQueue.java:85)
 at org.apache.tomcat.util.threads.TaskQueue.poll(TaskQueue.java:31)
 at 
java.util.concurrent.ThreadPoolExecutor.getTask(ThreadPoolExecutor.java:1066)
 at 
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1127)
 at 
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
 at 
org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
 at java.lang.Thread.run(Thread.java:745)
-
The thread count grows over time (goes up to 130-150 threads after 2
hours).  Setting 'connectionTimeout' (as opposed to the default of
never timing out) does seems to help some -- the # of threads isn't
quite as bad (only 60-80 threads after 2 hours).  However, the CPU
Idle % is still not good -- was only 10% idle with default tomcat
settings, is something like 40% idle with current settings.  Also
tried setting Apache's 'KeepAliveTimeout = 5' (currently set to 15)
but this did not make any difference.


Is there some configuration we can set to make Tomcat tolerant of this
monitoring?  (We have tried setting connectionTimeout 
keepAliveTimeout on the Connector.  And we have tried putting the
Connector behind an Executor with maxIdleTime.)
OR, should we modify our monitoring somehow?  And if so, suggestions?


* Running on Linux CentOS release 5.9
* running Apache in front of Tomcat for authentication, using mod_jk
* Tomcat 8.0.14

relevant sections of tomcat/conf/server.xml:

Executor name=tomcatThreadPool namePrefix=catalina-exec-
   maxThreads=250 minSpareThreads=20 maxIdleTime=6 /

Connector executor=tomcatThreadPool port=8080 protocol=HTTP/1.1
   connectionTimeout=2 redirectPort=8443 /

Connector executor=tomcatThreadPool port=8009 protocol=AJP/1.3
   redirectPort=8443 maxThreads=256
   connectionTimeout=3000 keepAliveTimeout=6 /


If interested, I can provide graphing of the machine's thread count,
cpu idle%, and cpu load.
Any suggestions would be most welcome.

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Need help deploying web-service to EC2 with Tomcat7

[Lisa and Terence Davis]

Hi Everyone,

I have a web-service that I've developed using Tomcat7/MySQL5 using
NetBeans 7.  In the IDE it all works fine.  For testing however, I need
to get it onto an EC2 instance so users other than me can access it.  I
have created an EC2 micro-instance, installed Tomcat 7 and MySQL 5 (the
same versions as on my dev env) and deployed my .war file.  The
deployment succeeds at least partially because I can get to the simple
static Hello World index jsp page and because it tries to access my
database user (which I then created).  I don't see any errors in the log
and I've gone back-and-forth trying all sorts of desperate things to try
and get this working.  I'm sure there must be a simple solution but I
just don't know what it is.

Any ideas?

Thanks in advance,

Terry

Re: Trouble setting up virtual host

[Lisa D Beggs/AC/VCU]

I guess nobody is willing to help me any further on the below?
_









From:
Lisa D Beggs/AC/VCU ldbe...@vcu.edu
To:
Tomcat Users List users@tomcat.apache.org
Date:
07/30/2009 12:47 PM
Subject:
Re: Trouble setting up virtual host



Thanks to all those that have helped with this issue.

I contacted our Networking department to make sure that both ports 80 and 
443 were open inbound to the server and that they were open from both VCU 
and external networks (outside VCU).  The issue was on their end and it 
has been resolved!

I am also able to connect to my application using the virtual host 
www.fmdreports.vcu.edu/InfoViewApp (which automatically loads the 
logon.jsp page).

However, what I would really like to have happen is to only have to type 
in www.fmdreports.vcu.edu or fmdreports.vcu.edu and not have to type the 
/InfoViewApp after it and have set it to load the login page which is 
www.fmdreports.vcu.edu/InfoViewApp/logon.jsp

Here is a copy of what I have in the host element..how can I 
accomplish the above?

Host name=fmdreports.vcu.edu appBase=webappps/InfoViewApp 
unpackWARs=false autoDeploy=true xmlValidation=false 
xmlNamespaceAware=false
Aliaswww.fmdreports.vcu.edu/Alias
  /Host

_
Change is the essence of life. Be willing to surrender what you are, for 
what you could become. 

Lisa D. Beggs 
Information Technology Specialist
Business Application Services
Phone:  804 828-2098
Fax:   804 828-0322

Don't be a phishing victim - VCU and other reputable organizations will 
never use email to request that you reply with your password, social 
security number or confidential personal information.  For more details 
visit http://infosecurity.vcu.edu/phishing.html 








From:
Mark Eggers its_toas...@yahoo.com
To:
Tomcat Users List users@tomcat.apache.org
Date:
07/27/2009 10:55 PM
Subject:
Re: Trouble setting up virtual host




As usual, late to the thread.

I'll use C) then:

  C) on another workstation :
  
  - close the browser and re-open it.
  - in the browser, find the place where you can clear the cache.
  - do it (clear the cache)
  - request the URL :
  
   http://adm138/InfoViewApp
  
  - indicate the result here :
  
  
  A:  Internet Explorer cannot display the webpage

This usually means that the other workstation cannot translate between the 

name you gave the host on the other workstation (adm138) and the IP 
address of your server.

I also noticed that while you use the fully qualified name in the other 
example (www.fmdreports.vcu.edu) you use the short name in your tests 
(adm138).

There are several things to try here, to see where the breakdown is.  I'll 

use numbers since everyone else is using letters.

1. From another workstation, open a DOS window (if it's Windows) or a UNIX 

shell command (if it's UNIX), and type the following:

ping adm138

1a) If you get:
Ping could not find the host adm138, then the other workstation does not 
know how to translate between the name and the IP address.

1b) If you get:
Four lines with a bunch of numbers, then the other workstation knows how 
to translate between the name and the IP address

2. From another workstation, open a DOS window (if it's Windows) or a UNIX 

shell command (if it's UNIX) and type the following:

ping adm138.fmdreports.vcu.edu

2a) If you get:
Ping could not find the host adm138.fmdreports.vcu.edu, then the other 
workstation does not know how to translate between the name and the IP 
address.

2b) If you get:
Four lines with a bunch of numbers, then the other workstation knows how 
to translate between the name and the IP address

adm138.fmdreports.vcu.edu may be the fully qualified name, but this 
depends on how your network administrator has set up something called DNS.

Firewall check
==

Windows comes with a built-in firewall.  On XP/Professional it's located 
in Start-Control Panel-Network Connections.  You'll have to single-click 

on the active network (the one your server connects to) to see Change 
Firewall Settings on the left hand side.

Once you click on that (Change Firewall Settings), you should be able to 
edit the settings by selecting Exceptions tab.  Hopefully you'll see two 
entries for Java(TM) Platform SE Binary.  Make sure that the JRE you're 
using to run Tomcat is there (by clicking on edit and reading the 
properties).

Short term fix (once you've checked your firewall)
==

If you have administrative privileges on the other workstation (Windows) 
or root access (UNIX), you can add some information in a file called 
hosts.  On Windows, it's located in the %windir%\System 32\drivers\etc 
directory.  In UNIX it's located in /etc

The line you need to add is the following:

aaa.bbb.ccc.ddd adm138

where aaa.bbb.ccc.ddd is the IP address of the machine with your Tomcat 
server.

If the fully qualified name

Re: Trouble setting up virtual host

[Lisa D Beggs/AC/VCU]

From:
Hassan Schroeder hassan.schroe...@gmail.com
To:
Tomcat Users List users@tomcat.apache.org
Date:
08/03/2009 11:28 AM
Subject:
Re: Trouble setting up virtual host



On Mon, Aug 3, 2009 at 7:31 AM, Lisa D Beggs/AC/VCUldbe...@vcu.edu 
wrote:
 I guess nobody is willing to help me any further on the below?

I gave you the answer in the very first reply in this thread.


--  If I remember correctly, the answer you gave me is not appropriate 
for my situation.  I can not rename my application directory folder with 
ROOT.  I must keep my application directory structure.

-- 
Hassan Schroeder  hassan.schroe...@gmail.com
twitter: @hassan

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Trouble setting up virtual host

[Lisa D Beggs/AC/VCU]

From:
Hassan Schroeder hassan.schroe...@gmail.com
To:
Tomcat Users List users@tomcat.apache.org
Date:
08/03/2009 11:44 AM
Subject:
Re: Trouble setting up virtual host



On Mon, Aug 3, 2009 at 8:39 AM, Lisa D Beggs/AC/VCUldbe...@vcu.edu 
wrote:

 --  If I remember correctly, the answer you gave me is not appropriate
 for my situation.  I can not rename my application directory folder with
 ROOT.  I must keep my application directory structure.

Why? Since you don't want that structure to be apparent?

In any case, I gave you two solutions; so if you truly can't or won't
use the second, use the first.


--  Well you obviously chose not to read that I have gotten much further 
than the first time I posted on this forum and am well beyond the initial 
problem I was having.  It's really sad that I decided to come here to get 
the help of people who with more experience than myself and learn 
something instead I feel I have been more chastised because of my lack of 
knowledge.

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Trouble setting up virtual host

[Lisa D Beggs/AC/VCU]

Thanks to all those that have helped with this issue.

I contacted our Networking department to make sure that both ports 80 and 
443 were open inbound to the server and that they were open from both VCU 
and external networks (outside VCU).  The issue was on their end and it 
has been resolved!

I am also able to connect to my application using the virtual host 
www.fmdreports.vcu.edu/InfoViewApp (which automatically loads the 
logon.jsp page).

However, what I would really like to have happen is to only have to type 
in www.fmdreports.vcu.edu or fmdreports.vcu.edu and not have to type the 
/InfoViewApp after it and have set it to load the login page which is 
www.fmdreports.vcu.edu/InfoViewApp/logon.jsp

Here is a copy of what I have in the host element..how can I 
accomplish the above?

Host name=fmdreports.vcu.edu appBase=webappps/InfoViewApp 
unpackWARs=false autoDeploy=true xmlValidation=false 
xmlNamespaceAware=false
Aliaswww.fmdreports.vcu.edu/Alias
  /Host

_
Change is the essence of life. Be willing to surrender what you are, for 
what you could become. 

Lisa D. Beggs 
Information Technology Specialist
Business Application Services
Phone:  804 828-2098
Fax:   804 828-0322

Don't be a phishing victim - VCU and other reputable organizations will 
never use email to request that you reply with your password, social 
security number or confidential personal information.  For more details 
visit http://infosecurity.vcu.edu/phishing.html 








From:
Mark Eggers its_toas...@yahoo.com
To:
Tomcat Users List users@tomcat.apache.org
Date:
07/27/2009 10:55 PM
Subject:
Re: Trouble setting up virtual host




As usual, late to the thread.

I'll use C) then:

  C) on another workstation :
  
  - close the browser and re-open it.
  - in the browser, find the place where you can clear the cache.
  - do it (clear the cache)
  - request the URL :

   http://adm138/InfoViewApp
  
  - indicate the result here :
  
  
  A:  Internet Explorer cannot display the webpage

This usually means that the other workstation cannot translate between the 
name you gave the host on the other workstation (adm138) and the IP 
address of your server.

I also noticed that while you use the fully qualified name in the other 
example (www.fmdreports.vcu.edu) you use the short name in your tests 
(adm138).

There are several things to try here, to see where the breakdown is.  I'll 
use numbers since everyone else is using letters.

1. From another workstation, open a DOS window (if it's Windows) or a UNIX 
shell command (if it's UNIX), and type the following:

ping adm138

1a) If you get:
Ping could not find the host adm138, then the other workstation does not 
know how to translate between the name and the IP address.

1b) If you get:
Four lines with a bunch of numbers, then the other workstation knows how 
to translate between the name and the IP address

2. From another workstation, open a DOS window (if it's Windows) or a UNIX 
shell command (if it's UNIX) and type the following:

ping adm138.fmdreports.vcu.edu

2a) If you get:
Ping could not find the host adm138.fmdreports.vcu.edu, then the other 
workstation does not know how to translate between the name and the IP 
address.

2b) If you get:
Four lines with a bunch of numbers, then the other workstation knows how 
to translate between the name and the IP address

adm138.fmdreports.vcu.edu may be the fully qualified name, but this 
depends on how your network administrator has set up something called DNS.

Firewall check
==

Windows comes with a built-in firewall.  On XP/Professional it's located 
in Start-Control Panel-Network Connections.  You'll have to single-click 
on the active network (the one your server connects to) to see Change 
Firewall Settings on the left hand side.

Once you click on that (Change Firewall Settings), you should be able to 
edit the settings by selecting Exceptions tab.  Hopefully you'll see two 
entries for Java(TM) Platform SE Binary.  Make sure that the JRE you're 
using to run Tomcat is there (by clicking on edit and reading the 
properties).

Short term fix (once you've checked your firewall)
==

If you have administrative privileges on the other workstation (Windows) 
or root access (UNIX), you can add some information in a file called 
hosts.  On Windows, it's located in the %windir%\System 32\drivers\etc 
directory.  In UNIX it's located in /etc

The line you need to add is the following:

aaa.bbb.ccc.ddd adm138

where aaa.bbb.ccc.ddd is the IP address of the machine with your Tomcat 
server.

If the fully qualified name is supposed to be adm138.fmdreports.vcu.edu, 
then add this line instead to the hosts file

aaa.bbb.ccc.ddd adm138 adm138.fmdreports.vcu.edu

where aaa.bbb.ccc.ddd is the IP address of the machine with your Tomcat 
server.

Long term (proper) fixes

Re: Trouble setting up virtual host

[Lisa D Beggs/AC/VCU]

From:
Mark Eggers its_toas...@yahoo.com
To:
Tomcat Users List users@tomcat.apache.org
Date:
07/27/2009 10:55 PM
Subject:
Re: Trouble setting up virtual host




As usual, late to the thread.

I'll use C) then:

  C) on another workstation :
  
  - close the browser and re-open it.
  - in the browser, find the place where you can clear the cache.
  - do it (clear the cache)
  - request the URL :

   http://adm138/InfoViewApp
  
  - indicate the result here :
  
  
  A:  Internet Explorer cannot display the webpage

This usually means that the other workstation cannot translate between the 
name you gave the host on the other workstation (adm138) and the IP 
address of your server.

I also noticed that while you use the fully qualified name in the other 
example (www.fmdreports.vcu.edu) you use the short name in your tests 
(adm138).

There are several things to try here, to see where the breakdown is.  I'll 
use numbers since everyone else is using letters.

1. From another workstation, open a DOS window (if it's Windows) or a UNIX 
shell command (if it's UNIX), and type the following:

ping adm138

1a) If you get:
Ping could not find the host adm138, then the other workstation does not 
know how to translate between the name and the IP address.

1b) If you get:
Four lines with a bunch of numbers, then the other workstation knows how 
to translate between the name and the IP address


**A:  Yes I get the replys back, it is able to ping ADM138


2. From another workstation, open a DOS window (if it's Windows) or a UNIX 
shell command (if it's UNIX) and type the following:

ping adm138.fmdreports.vcu.edu

2a) If you get:
Ping could not find the host adm138.fmdreports.vcu.edu, then the other 
workstation does not know how to translate between the name and the IP 
address.


**A:  I can not ping adm138.fmdreports.vcuedu - HOWEVER, I can ping 
fmdreports.vcu.edu (and this is how we want the user to be name to be 
setup so that is setup correctly)

2b) If you get:
Four lines with a bunch of numbers, then the other workstation knows how 
to translate between the name and the IP address

adm138.fmdreports.vcu.edu may be the fully qualified name, but this 
depends on how your network administrator has set up something called DNS.

Firewall check
==

Windows comes with a built-in firewall.  On XP/Professional it's located 
in Start-Control Panel-Network Connections.  You'll have to single-click 
on the active network (the one your server connects to) to see Change 
Firewall Settings on the left hand side.

Once you click on that (Change Firewall Settings), you should be able to 
edit the settings by selecting Exceptions tab.  Hopefully you'll see two 
entries for Java(TM) Platform SE Binary.  Make sure that the JRE you're 
using to run Tomcat is there (by clicking on edit and reading the 
properties).

Short term fix (once you've checked your firewall)
==

If you have administrative privileges on the other workstation (Windows) 
or root access (UNIX), you can add some information in a file called 
hosts.  On Windows, it's located in the %windir%\System 32\drivers\etc 
directory.  In UNIX it's located in /etc

The line you need to add is the following:

aaa.bbb.ccc.ddd adm138

where aaa.bbb.ccc.ddd is the IP address of the machine with your Tomcat 
server.

If the fully qualified name is supposed to be adm138.fmdreports.vcu.edu, 
then add this line instead to the hosts file

aaa.bbb.ccc.ddd adm138 adm138.fmdreports.vcu.edu

where aaa.bbb.ccc.ddd is the IP address of the machine with your Tomcat 
server.

Long term (proper) fixes
=

There are really two parts to this fix.  The first part is to get your 
network administrator to add this hostname and IP address to your campus 
DNS server.  The DNS server is responsible for translating between 
human-readable names and IP addresses.  Once the name you have chosen for 
your server is in DNS, all machines using DNS servers will know how to 
interpret the name of the host.

**A:  They have done this www.fmdreports.vcu.edu is replacing the lengthy 
URL name of the web browser application(Infoview) that our users are using 
to use when viewing/scheduling Crystal Reports.  This is a Crystal Reports 
Server running Tomcat (not sure if you saw the initial post.

The second part of the fix is to alter your virtual host definition in 
server.xml.  In general, it's a good idea to only use fully qualified 
names in the server.xml file.

So, in part, your host element should look like this:

Host name=fully-qualified-host-name . . . . 

/Host

For example:

Host name=adm138.fmdreports.vcu.edu . . . 

/Host

However, if you want to have this virtual host respond to other names, you 
can add aliases for each name.  To do that, just add an alias element for 
each name you want.

Host name=fully-qualified-host-name . . . .
  Aliassome-other-name/Alias
  

Re: Trouble setting up virtual host

[Lisa D Beggs/AC/VCU]

 this 
port in the URL.  But if the server is listening on any other, 
non-default port (like 8080), then you need to specify it in the URL.

And finally, what comes after the
protocol://hostname:port/
is the rest, known as a combination of a path and possibly a query.
That's your /InfoViewApp.  It indicates which application the browser 
wants to talk to, within the Tomcat service.

An empty path, indicated as just /, is also a valid path.  It 
indicates that the browser wants the default application of that 
service.

In the case of Tomcat, the various applications are usually organised 
under the Tomcat/webapps/ sub-directory.
Currently thus, you application is located in the directory
Tomcat/webapps/InfoViewApp.
And a browser, to request it, must use a URL like
protocol://hostname(:port)/InfoViewApp

In order to avoid confusion, the Tomcat default application is located 
under Tomcat/webapps/ROOT/. (The capitals in ROOT do matter).
That is the application that browsers get when they request just
protocol://hostname(:port)/

That is why, earlier, by renaming the existing ROOT application (which 
displays the Tomcat default page), and renaming yours to ROOT, we made 
your application become the default, so that browsers can now access it 
via
  protocol://hostname(:port)/

Note that the old default Tomcat page is still there.  But to get it, 
now in the browser you have to use the URL
http://www.fmdreports.vcu.edu(:8080)/old-default
(do you understand why ?)


One inconvenient of this scheme, is that you cannot have TWO default 
applications.  You need to choose one of them to be the default (and go 
under Tomcat/webapps/ROOT/).
So, if later you decide to add another different application to the same 
server, then that one cannot be the default, because yours already is.
This other application (suppose it is called AnotherApp) will then be 
placed in the subdirectory Tomcat/webapps/AnotherApp, and will have to 
be accessed by browsers as
http://www.fmdreports.vcu.edu/AnotherApp

Is it now clearer ?

It may all looks rather mysterious at first, but it is really quite 
simple and logical.  A bit of dedication, and you'll end up as the 
Tomcat guru, you'll see.
;-)



_
Change is the essence of life. Be willing to surrender what you are, for 
what you could become. 

Lisa D. Beggs 
Information Technology Specialist
Business Application Services
Phone:  804 828-2098
Fax:   804 828-0322

Don't be a phishing victim - VCU and other reputable organizations will 
never use email to request that you reply with your password, social 
security number or confidential personal information.  For more details 
visit http://infosecurity.vcu.edu/phishing.html 

Re: Trouble setting up virtual host

[Lisa D Beggs/AC/VCU]

From:
André Warnier a...@ice-sa.com
To:
Tomcat Users List users@tomcat.apache.org
Date:
07/27/2009 03:18 PM
Subject:
Re: Trouble setting up virtual host



Lisa D Beggs/AC/VCU wrote:
 I am sorry, I don't usually post on forums.  I am sorry if I am making 
 this difficult to read.  I hope this is better.  I am only copying what 
 you are giving me and then responding.

Lisa, let's take this a little bit at a time.
The reason why your messages are difficult to read, is because there is 
very little visual difference between the original message, and what you 
reply.  So it is hard to see the difference.

If you are subscribed to this forum, presumably you get these list 
messages in your email inbox.
If you just hit the reply button, unless you have some funny email 
program, it should in some way highlight what was part of the original 
message. (Like this previous paragraph).

To type your response, just position below the original paragraph you 
want to respond to, leave a blank line, and type your response.
Then hit Send. It should automatically send your response to the 
Tomcat list.
Go ahead, try it with this message, right now.
Type a line just below here and hit Send :


I have Lotus Notes..I do not see anything different when I hit Reply, 
only when it comes back to me from where you reply does it look different. 
 I assume even if I bold or highlight it, it's not coming through on your 
end?


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Trouble setting up virtual host

[Lisa D Beggs/AC/VCU]

_
Change is the essence of life. Be willing to surrender what you are, for 
what you could become. 

Lisa D. Beggs 
Information Technology Specialist
Business Application Services
Phone:  804 828-2098
Fax:   804 828-0322

Don't be a phishing victim - VCU and other reputable organizations will 
never use email to request that you reply with your password, social 
security number or confidential personal information.  For more details 
visit http://infosecurity.vcu.edu/phishing.html 








From:
André Warnier a...@ice-sa.com
To:
Tomcat Users List users@tomcat.apache.org
Date:
07/27/2009 03:37 PM
Subject:
Re: Trouble setting up virtual host



Lisa D Beggs/AC/VCU wrote:
... (indicates I cut part of the previous message)
 
 If I type in http://adm138:8080/InfoViewApps or 
http://adm138/InfoViewApps 
 on the server, the application comes up.  Before when I had it directed 
to 
 port 8080, from a user's workstation I could get the application to come 

 up using the http://adm138:8080/InfoViewApps URL, after I changed it to 
 port 80, I could not get the http://adm138/InfoViewApps URL to work from 

 the user's workstation, it only worked from the server.  Is that a 
better 
 explanation?

Unfortunately no, because :
As you explain it above, *from a browser running on the server itself*, 
the application responds, whether you add the :8080 or not.
(And, as per earlier explanations, not indicating a port is equivalent 
to adding :80, because that is the /default/ port.)

That would mean that your Tomcat server is listening on /both/ ports 
80 and 8080.

However, previously you mentioned that you had /changed/ port 80 to port 
8080 (or vice-versa) in the server configuration.
So it should be listening on either 80 OR 8080, but not both.
But according to what you say above, it responds to both.
That is what does not appear to make sense.


Now, a reason why it may work differently with a browser opened on the 
server itself, and a browser opened on a workstation :
- for the browser opened on the server itself, there is nothing 
in-between that could block the communication between the browser and 
the server, since they are both on the same computer.
- for a browser running on another workstation, the /may/ be something 
in-between the workstation and the server, which blocks communications 
either on port 80 OR on port 8080 OR on both OR on none.

That something in-between may be a router, a firewall, whatever.

So, do /exactly/ the following steps, and report the result for each step 
:

A) on the server itself :

- close the browser and re-open it.
- in the browser, find the place where you can clear the cache.
   Ask someone around you where that is for this kind of browser.
- do it (clear the cache, everything)
- request the URL :
 http://adm138/InfoViewApp

- indicate the result here :

A:  This is with having the port changed to 80 for all of these answers. I 
get redirected to the http://adm138/InfoViewApp/logon.jsp which is the 
logon page for the application.


B) still on the server itself :

- close the browser and re-open it.
- in the browser, find the place where you can clear the cache.
- do it (clear the cache)
- request the URL :
 http://adm138:8080/InfoViewApp

- indicate the result here :


A:  Internet Explorer cannot display the webpage
 


C) on another workstation :

- close the browser and re-open it.
- in the browser, find the place where you can clear the cache.
- do it (clear the cache)
- request the URL :
 http://adm138/InfoViewApp

- indicate the result here :


A:  Internet Explorer cannot display the webpage




D) on that same workstation :

- close the browser and re-open it.
- in the browser, find the place where you can clear the cache.
- do it (clear the cache)
- request the URL :
 http://adm138:8080/InfoViewApp

- indicate the result here :


A:  Internet Explorer cannot display the webpage



It is very important that you do exactly as indicated above, following 
all the steps.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Trouble setting up virtual host

[Lisa D Beggs/AC/VCU]

Can you tell us first under what kind of host this Tomcat is running ? 
Is it a Unix system, a Linux system, a Windows system ?
 
We are running Windows Server 2003

Second :
I am going to ask some pretty basic questions.  Can you answer them, 
even if you think that they are stupid, or that you have already 
answered them ?  That will give us some insight into the situation, to 
help you quicker.

Q1 : I presume that this, until now, is a working server. Yes/No ?  Yes

Q2: If yes, how do the users access it now ? What exact URL do they type 
in the browser location bar, to access the homepage of this server ? 

They used to type in http://adm138:8080/InfoViewApp - until I changed the 
port to 80 so now it is http://adm138/InfoViewApp - we want them to now be 
able to type in www.fmdreports.vcu.edu or fmdreports.vcu.edu to be able to 
get to that same page just easier to remember url for them

Q3: Still if yes, does that same URL work from all workstations, and do 
they all get the same page for the same URL ? And which page is that ? 

Yes, when they type in that page they get 
http://adm138/InfoViewApp/logon.jsp and this is what I need the DNS names 
to be redirected to.

Q4: Have you ever configured a webserver before (Tomcat or other) ? 

Yes  No, I have configured an out of the box application before using 
Tomcat for a Maximus application beforesome configuration modification 
of Tomcat involved and clearing cache, etc. but after installing the 
application and Tomcat, most modication done within the application 
itself.

Thanks for all your help!

_
Change is the essence of life. Be willing to surrender what you are, for 
what you could become. 

Lisa D. Beggs 
Information Technology Specialist
Business Application Services
Phone:  804 828-2098
Fax:   804 828-0322

Don't be a phishing victim - VCU and other reputable organizations will 
never use email to request that you reply with your password, social 
security number or confidential personal information.  For more details 
visit http://infosecurity.vcu.edu/phishing.html 








From:
André Warnier a...@ice-sa.com
To:
Tomcat Users List users@tomcat.apache.org
Date:
07/22/2009 06:49 PM
Subject:
Re: Trouble setting up virtual host



Lisa D Beggs/AC/VCU wrote:
 The default Tomcat page is what I get if I try to enter that on the 
server 
 hosting Tomcat  Crystal Reports Server.so my configuration in the 
 server.xml file must be incorrect.
 
 If I try to type in the webpage from another computer it can not find 
the 
 page.
 
...
Mmm.
Ok, Lisa, we're here to serve, no matter what comes...

Can you tell us first under what kind of host this Tomcat is running ? 
Is it a Unix system, a Linux system, a Windows system ?
And if it is a Unix or Linux system, which kind ?
(if you don't know, either ask around or enter uname -a in a console 
window on the server and tell us the result).

Second :
I am going to ask some pretty basic questions.  Can you answer them, 
even if you think that they are stupid, or that you have already 
answered them ?  That will give us some insight into the situation, to 
help you quicker.

Q1 : I presume that this, until now, is a working server. Yes/No ?

Q2: If yes, how do the users access it now ? What exact URL do they type 
in the browser location bar, to access the homepage of this server ?

Q3: Still if yes, does that same URL work from all workstations, and do 
they all get the same page for the same URL ? And which page is that ?

Q4: Have you ever configured a webserver before (Tomcat or other) ?


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Trouble setting up virtual host

[Lisa D Beggs/AC/VCU]

Allright, let's continue step by step, based on the above.

Q5:
a) Open a Windows command window.

b) Type nslookup adm138
The last line of the response is an IP address.  What is it ?

128.172.12.129  (which is IP of ADM138)

c) Type nslookup www.fmdreports.vcu.edu
The last line of the response is an IP address.  What is it ?

128.172.12.129  (which is IP of ADM138)

Q6:
when the users now type the following URL in their browser :
http://www.fmdreports.vcu.edu
what page do they see ?

Can not display webpage

Is it the same page as when you type this URL in your browser :
http://adm138

Can not display webpage

another note.now that I have changed port from 8080 to 80, I cannot 
see my default URL (http://adm138/InfoViewApp) either on user workstation 
(not sure if same or different issue, can see on server with no problem) 
but I can address w/ vendor if I need to.


_
Change is the essence of life. Be willing to surrender what you are, for 
what you could become. 

Lisa D. Beggs 
Information Technology Specialist
Business Application Services
Phone:  804 828-2098
Fax:   804 828-0322

Don't be a phishing victim - VCU and other reputable organizations will 
never use email to request that you reply with your password, social 
security number or confidential personal information.  For more details 
visit http://infosecurity.vcu.edu/phishing.html 








From:
André Warnier a...@ice-sa.com
To:
Tomcat Users List users@tomcat.apache.org
Date:
07/23/2009 10:42 AM
Subject:
Re: Trouble setting up virtual host



Lisa D Beggs/AC/VCU wrote:
 Can you tell us first under what kind of host this Tomcat is running ? 
 Is it a Unix system, a Linux system, a Windows system ?
 
 We are running Windows Server 2003
 
 Second :
 I am going to ask some pretty basic questions.  Can you answer them, 
 even if you think that they are stupid, or that you have already 
 answered them ?  That will give us some insight into the situation, to 
 help you quicker.
 
 Q1 : I presume that this, until now, is a working server. Yes/No ?  Yes
 
 Q2: If yes, how do the users access it now ? What exact URL do they type 

 in the browser location bar, to access the homepage of this server ? 
 
 They used to type in http://adm138:8080/InfoViewApp - until I changed 
the 
 port to 80 so now it is http://adm138/InfoViewApp - we want them to now 
be 
 able to type in www.fmdreports.vcu.edu or fmdreports.vcu.edu to be able 
to 
 get to that same page just easier to remember url for them
 
 Q3: Still if yes, does that same URL work from all workstations, and do 
 they all get the same page for the same URL ? And which page is that ? 
 
 Yes, when they type in that page they get 
 http://adm138/InfoViewApp/logon.jsp and this is what I need the DNS 
names 
 to be redirected to.
 
Allright, let's continue step by step, based on the above.

Q5:
a) Open a Windows command window.

b) Type nslookup adm138
The last line of the response is an IP address.  What is it ?

c) Type nslookup www.fmdreports.vcu.edu
The last line of the response is an IP address.  What is it ?


Q6:
when the users now type the following URL in their browser :
http://www.fmdreports.vcu.edu
what page do they see ?

Is it the same page as when you type this URL in your browser :
http://adm138




-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Trouble setting up virtual host

[Lisa D Beggs/AC/VCU]

]

  TCP128.172.12.129:6415128.172.12.129:2940ESTABLISHED 2804
  [CMS.exe]

  TCP128.172.12.129:6415128.172.12.129:2877ESTABLISHED 2804
  [CMS.exe]

  TCP128.172.12.129:6415128.172.12.129:4608ESTABLISHED 2804
  [CMS.exe]

  TCP128.172.12.129:6415128.172.12.129:2164ESTABLISHED 2804
  [CMS.exe]

  TCP128.172.12.129:6415128.172.12.129:2873ESTABLISHED 2804
  [CMS.exe]

  TCP128.172.12.129:6415128.172.12.129:2867ESTABLISHED 2804
  [CMS.exe]

  TCP128.172.12.129:6415128.172.12.129:2880ESTABLISHED 2804
  [CMS.exe]

  TCP128.172.12.129:6415128.172.12.129:2886ESTABLISHED 2804
  [CMS.exe]

  TCP128.172.12.129:6415128.172.12.129:3602ESTABLISHED 2804
  [CMS.exe]

  TCP128.172.12.129:6416128.172.12.129:2891ESTABLISHED 1932
  [crcache.exe]

  TCP128.172.12.129:6416128.172.12.129:2904ESTABLISHED 1932
  [crcache.exe]

  TCP128.172.12.129:6418128.172.12.129:2908ESTABLISHED 512
  [crystalras.exe]

  TCP128.172.12.129:9535128.172.193.85:3898ESTABLISHED 196
  [issuser.exe]

  TCP192.168.21.101:1085192.168.21.101:8194ESTABLISHED 2428
  [ManagementAgentNT.exe]

  TCP192.168.21.101:1087192.168.21.101:1088ESTABLISHED 2428
  [ManagementAgentNT.exe]

  TCP192.168.21.101:1088192.168.21.101:1087ESTABLISHED 2636
  [RouterNT.exe]

  TCP192.168.21.101:8194192.168.21.101:1085ESTABLISHED 2636
  [RouterNT.exe]

  TCP127.0.0.1:2162 127.0.0.1:9592 CLOSE_WAIT  932
  [vulScan.exe]

  TCP127.0.0.1:4925 127.0.0.1:9592 CLOSE_WAIT 4372
  [policy.client.invoker.exe]

  TCP127.0.0.1:53001127.0.0.1:2436 TIME_WAIT   0
  TCP128.172.12.129:2440128.172.12.129:2963TIME_WAIT   0
  TCP128.172.12.129:2451128.172.12.129:6410TIME_WAIT   0
  TCP128.172.12.129:2452128.172.12.129:6410TIME_WAIT   0
  TCP128.172.12.129:2463128.172.12.129:2963TIME_WAIT   0
  TCP128.172.12.129:2474128.172.12.129:6410TIME_WAIT   0
  TCP128.172.12.129:2475128.172.12.129:6410TIME_WAIT   0
  TCP128.172.12.129:2476128.172.4.225:80   TIME_WAIT   0

C:\Documents and Settings\Administrator
_
Change is the essence of life. Be willing to surrender what you are, for 
what you could become. 

Lisa D. Beggs 
Information Technology Specialist
Business Application Services
Phone:  804 828-2098
Fax:   804 828-0322

Don't be a phishing victim - VCU and other reputable organizations will 
never use email to request that you reply with your password, social 
security number or confidential personal information.  For more details 
visit http://infosecurity.vcu.edu/phishing.html 








From:
André Warnier a...@ice-sa.com
To:
Tomcat Users List users@tomcat.apache.org
Date:
07/23/2009 12:46 PM
Subject:
Re: Trouble setting up virtual host



Lisa D Beggs/AC/VCU wrote:
 Allright, let's continue step by step, based on the above.
 
 Q5:
 a) Open a Windows command window.
 
 b) Type nslookup adm138
 The last line of the response is an IP address.  What is it ?
 
 128.172.12.129  (which is IP of ADM138)
 
 c) Type nslookup www.fmdreports.vcu.edu
 The last line of the response is an IP address.  What is it ?
 
 128.172.12.129  (which is IP of ADM138)

The above is good. It means that at least the DNS part is OK.

 
 Q6:
 when the users now type the following URL in their browser :
 http://www.fmdreports.vcu.edu
 what page do they see ?
 
 Can not display webpage
 
 Is it the same page as when you type this URL in your browser :
 http://adm138
 
 Can not display webpage

That is not good.  It means either that Tomcat is not working properly, 
or that something is blocking port 80.

 
 another note.now that I have changed port from 8080 to 80,
How exactly did you do this ?

  I cannot
 see my default URL (http://adm138/InfoViewApp) either on user 
workstation 
 (not sure if same or different issue, can see on server with no problem) 


Q6.5 :
Can you explain what you mean by can see on server with no problem ?
Do you mean that if you open a browser directly on the server console, 
then you can see the Tomcat default page when you enter :
either
http://www.fmdreports.vcu.edu
and/or
http://adm138
?

But if you do this on any other workstation, you get a cannot display 
this page answer ?


A whole bunch of new questions :

Q7:
In which directory is Tomcat installed on this server ?

Q8:
Supposing for now that this directory is c:\tomcat, then under this 
directory, are there the following subdirectories :
- c:\tomcat\conf ?
- c:\tomcat\webapps ?
- c:\tomcat\webapps\ROOT ?
- c:\tomcat\webapps\InfoViewApp ?

(replace c:\tomcat\ above by whatever directory your Tomcat is really 
installed in)

Q9:
Is there any other (than InfoViewApp) Tomcat-based application running 
on that server

Trouble setting up virtual host

[Lisa D Beggs/AC/VCU]

I am hoping you can help me.  I am trying to get a DNS entry that we set 
up www.websitename.edu (alias websitename.edu) to point to another page on 
our Crystal Reports Server (Infoview). 

We are running Tomcat 5.5.20.  I was told I need to set up a virtual host, 
I need to point the DNS entries to the logon.jsp page that is located in 
the Tomcat55\webapps\InfoViewApp\ directory. 

When I type in the above website from the server however, I get the 
default Tomcat home page.  So essentially I need to set it up so that the 
URL to the logon page is redirected to http://websitename.edu/logon.jsp or 
http://www.websitename.edu/logon.jsp and not the current - 
http://myserver:/InfoViewApp/logon.jsp.

Any suggestions, this is all new to me.

THANKS!



Server port=8005 shutdown=SHUTDOWN

  GlobalNamingResources
!-- Used by Manager webapp --
Resource name=UserDatabase auth=Container
  type=org.apache.catalina.UserDatabase
   description=User database that can be updated and saved
   factory=org.apache.catalina.users.MemoryUserDatabaseFactory
  pathname=conf/tomcat-users.xml /
  /GlobalNamingResources

  Service name=Catalina
Connector port=80 /

Connector URIEncoding=UTF-8 acceptCount=100 
connectionTimeout=2 disableUploadTimeout=true 
enableLookups=false maxHttpHeaderSize=8192 maxSpareThreads=75 
maxThreads=150 minSpareThreads=25 port=8080 redirectPort=8443/

!-- This is here for compatibility only, not required --
Connector port=8009 protocol=AJP/1.3 /

Engine name=Catalina defaultHost=localhost
  Realm className=org.apache.catalina.realm.UserDatabaseRealm
 resourceName=UserDatabase / Host name=localhost 
appBase=webapps /
/Engine
 
Host name=www.websitename.edu 
appBase=\webapps\InfoViewApp\logon.jsp unpackWARs=false 
autoDeploy=true xmlValidation=false xmlNamespaceAware=false
Context path= docBase=./
Aliaswebsitename.edu/Alias
  /Host

/Service

  /Server





_
Change is the essence of life. Be willing to surrender what you are, for 
what you could become. 

Lisa D. Beggs 
Information Technology Specialist
Business Application Services
Phone:  804 828-2098
Fax:   804 828-0322

Don't be a phishing victim - VCU and other reputable organizations will 
never use email to request that you reply with your password, social 
security number or confidential personal information.  For more details 
visit http://infosecurity.vcu.edu/phishing.html 

Re: Trouble setting up virtual host

[Lisa D Beggs/AC/VCU]

The default Tomcat page is what I get if I try to enter that on the server 
hosting Tomcat  Crystal Reports Server.so my configuration in the 
server.xml file must be incorrect.

If I try to type in the webpage from another computer it can not find the 
page.


_
Change is the essence of life. Be willing to surrender what you are, for 
what you could become. 

Lisa D. Beggs 
Information Technology Specialist
Business Application Services
Phone:  804 828-2098
Fax:   804 828-0322

Don't be a phishing victim - VCU and other reputable organizations will 
never use email to request that you reply with your password, social 
security number or confidential personal information.  For more details 
visit http://infosecurity.vcu.edu/phishing.html 








From:
Hassan Schroeder hassan.schroe...@gmail.com
To:
Tomcat Users List users@tomcat.apache.org
Date:
07/22/2009 03:42 PM
Subject:
Re: Trouble setting up virtual host



On Wed, Jul 22, 2009 at 12:10 PM, Lisa D Beggs/AC/VCUldbe...@vcu.edu 
wrote:
 I am hoping you can help me.  I am trying to get a DNS entry that we set
 up www.websitename.edu (alias websitename.edu) to point to another page 
on
 our Crystal Reports Server (Infoview).

DNS entries associate host (and domain) names with IP addresses.
They do not point to pages.

 When I type in the above website from the server however, I get the
 default Tomcat home page.  So essentially I need to set it up so that 
the
 URL to the logon page is redirected to http://websitename.edu/logon.jsp 
or
 http://www.websitename.edu/logon.jsp and not the current -
 http://myserver:/InfoViewApp/logon.jsp.

Then you could replace the default home page with one that will
forward or redirect requests to / to your own app.
~or~
You can make your own app the default Context by removing the
existing ROOT Context and renaming yours to ROOT, and define
login.jsp as a welcome page (see the default welcome pages and
explanatory note in the global $CATALINA_HOME/conf/web.xml).

HTH,
-- 
Hassan Schroeder  hassan.schroe...@gmail.com
twitter: @hassan

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Can't re-deploy webapp with Manager -- started after upgrade to Tomcat 6

[Lisa L. Woodring]

Having issues re-deploying my webapp using Tomcat Manager.  Previously used 
tomcat 5.0.28 with no issues, now using tomcat 6.0.14 and can't re-deploy.  I'm 
getting an exception:  java.util.zip.ZipException: error reading zip file.  
Sequence of actions and my configuration are below.

 

1)  Start Tomcat  (my webapp is not already installed)

2)  ant deploy à webapp works fine

3)  ant deploy à webapp is undeployed, but not re-deployed (even though 
there is a log msg in tomcat.log saying Deploying)

a.In tomcat.log:   
10:32:28,216 INFO  [http-8080-1] 
org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager]: 
Manager: init: Associated with Deployer
'Catalina:type=Deployer,host=localhost'

10:32:28,217 INFO  [http-8080-1] 
org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager]: 
Manager: init: Global resources are available

10:32:28,228 INFO  [http-8080-1] 
org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager]: 
Manager: undeploy: Undeploying web application at '/jglass'

10:32:29,006 INFO  [http-8080-1] org.apache.catalina.startup.HostConfig: 
Undeploying context [/jglass]

10:32:41,611 INFO  [http-8080-1] 
org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager]: 
Manager: deploy: Deploying web application at '/jglass'

10:32:41,611 INFO  [http-8080-1] 
org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager]: 
Manager: Uploading WAR file to /usr/local/jakarta-tomcat/webapps/jglass.war

10:32:45,317 INFO  [http-8080-1] org.apache.catalina.startup.HostConfig: 
Deploying web application archive jglass.war

 

b. In webapp.log:

10:32:28,242 INFO  [] SessionListener: == sessionDestroyed: 
6F32614EDB7F15D1752D00A3DDAD9437.W01 ==

10:32:28,243 INFO  [] SessionListener: == contextDestroyed: IGLASS 
==

 

4)  ant deploy à tries to deploy, but receives exception

a.   In tomcat.log:

10:40:02,982 INFO  [http-8080-1] 
org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager]: 
Manager: undeploy: Undeploying web application at '/jglass'

10:40:03,004 INFO  [http-8080-1] org.apache.catalina.startup.HostConfig: 
Undeploying context [/jglass]

10:40:04,967 INFO  [http-8080-1] 
org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager]: 
Manager: deploy: Deploying web application at '/jglass'

10:40:04,969 INFO  [http-8080-1] 
org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager]: 
Manager: Uploading WAR file to /usr/local/jakarta-tomcat/webapps/jglass.war

10:40:07,190 INFO  [http-8080-1] org.apache.catalina.startup.HostConfig: 
Deploying web application archive jglass.war

10:40:39,488 INFO  [http-8080-1] 
org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/jglass]: Log4J 
config file: prefix [/usr/local/jakarta-tomcat/webapps/jglass/], 
filename[WEB-INF/classes/log4j.xml], WITH watchdog 

Log4J, using DOMConfigurator.

10:40:39,739 INFO  [http-8080-1] 
org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/jglass]: 
Marking servlet action as unavailable

10:40:39,743 ERROR [http-8080-1] 
org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/jglass]: 
Servlet /jglass threw load() exception

javax.servlet.UnavailableException: java.util.zip.ZipException: error reading 
zip file

at org.apache.struts.action.ActionServlet.init(ActionServlet.java:402)

at 
net.iglass.jglass.servlets.FrontController.init(FrontController.java:49)

at javax.servlet.GenericServlet.init(GenericServlet.java:212)

at 
org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1161)

at 
org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:981)

at 
org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:4045)

at 
org.apache.catalina.core.StandardContext.start(StandardContext.java:4351)

at 
org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:791)

at 
org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:771)

at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:525)

at org.apache.catalina.startup.HostConfig.deployWAR(HostConfig.java:825)

at 
org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:515)

at org.apache.catalina.startup.HostConfig.check(HostConfig.java:1220)

at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

at 
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)

at 
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)

at java.lang.reflect.Method.invoke(Method.java:597)

at 
org.apache.tomcat.util.modeler.BaseModelMBean.invoke(BaseModelMBean.java:297)

at 

RE: Self-Signed Certificate for Tomcat JVM and CAS

[Lisa Tan]

I wish you would read this email earlier. I thought if I use the default
password (changeit), I don't need to have -storepass parameter. This morning
I re-read extkeytool example and tried to put the storepass parameter and it
works. After I imported my self-signed cert to JVM truststore, CAS client
can trust CAS server.

Thank all of you for providing me all the valueable links and information.

Lisa
-Original Message-
From: Morris Jones [mailto:[EMAIL PROTECTED] 
Sent: Wednesday, August 15, 2007 10:48 AM
To: Tomcat Users List; [EMAIL PROTECTED]
Subject: Re: Self-Signed Certificate for Tomcat JVM and CAS

Sorry I hadn't seen your message earlier when you posted it.  But you 
should create the keystore with a keystore password.  Did you do that?

Cheers,
Mojo

Lisa Tan wrote:
 After following the docs to generate self-signed pkcs12 key, I  failed to
import the key/certificate into my application with No password given for
keystore, integrity will not be verified. What does the reason cause this
error?
 
 I read some docs which ask to create an empty Java keystore and convert
PEM formatted key to PKCS8 format. Why do I need to create an empty
keystore?
 
 Thanks,
 
 Lisa
 
  Original message 
 Date: Fri, 10 Aug 2007 18:25:56 -0700
 From: Bill Barker [EMAIL PROTECTED]  
 Subject: Re: Self-Signed Certificate for Tomcat JVM and CAS  
 To: users@tomcat.apache.org


 Lisa Tan [EMAIL PROTECTED] wrote in message 
 news:[EMAIL PROTECTED]
 I don't know if this is a right list to ask this question. I tried to
 configure shibboleth which uses Tomcat with CAS authentication. I
received
 an error: Unable to validate ProxyTicketValidator



 I did google search on this topic and understood the reason causing this
 problem is Tomcat JVM doesn't trust the SSL cert of the CAS server.
Since 
 I
 am still in the testing stage, I can't get a CA certificate but the
 self-signed certificate.



 If my understanding is correct, the self signed certificate via openssl
 doesn't have jks format but Tomcat JVM only accept jks format
certificate.

 If you had read the friendly manual at 
 http://tomcat.apache.org/tomcat-5.5-doc/ssl-howto.html, you would know
that 
 this isn't true :).  While it talks about the keystore, the truststore
works 
 the same way.  So use openssl to create a pkcs12 file, specify this as
the 
 truststore, in whatever way you need to do from the CAS docs, and you
should 
 be good to go.

 I am just wondering if any one can give me some instruction how to
create 
 a
 self-signed certificate and private key which can be used or imported to
 both Tomcat JVM and CAS server.



 Thanks,



 Lisa









 -
 To start a new topic, e-mail: users@tomcat.apache.org
 To unsubscribe, e-mail: [EMAIL PROTECTED]
 For additional commands, e-mail: [EMAIL PROTECTED]

 
 -
 To start a new topic, e-mail: users@tomcat.apache.org
 To unsubscribe, e-mail: [EMAIL PROTECTED]
 For additional commands, e-mail: [EMAIL PROTECTED]


-- 
Morris Jones
Monrovia, CA
http://www.whiteoaks.com
Old Town Astronomers http://www.otastro.org

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]




-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Self-Signed Certificate for Tomcat JVM and CAS

[Lisa Tan]

After following the docs to generate self-signed pkcs12 key, I  failed to 
import the key/certificate into my application with No password given for 
keystore, integrity will not be verified. What does the reason cause this error?

I read some docs which ask to create an empty Java keystore and convert PEM 
formatted key to PKCS8 format. Why do I need to create an empty keystore?

Thanks,

Lisa

 Original message 
Date: Fri, 10 Aug 2007 18:25:56 -0700
From: Bill Barker [EMAIL PROTECTED]  
Subject: Re: Self-Signed Certificate for Tomcat JVM and CAS  
To: users@tomcat.apache.org


Lisa Tan [EMAIL PROTECTED] wrote in message 
news:[EMAIL PROTECTED]
I don't know if this is a right list to ask this question. I tried to
 configure shibboleth which uses Tomcat with CAS authentication. I received
 an error: Unable to validate ProxyTicketValidator



 I did google search on this topic and understood the reason causing this
 problem is Tomcat JVM doesn't trust the SSL cert of the CAS server. Since 
 I
 am still in the testing stage, I can't get a CA certificate but the
 self-signed certificate.



 If my understanding is correct, the self signed certificate via openssl
 doesn't have jks format but Tomcat JVM only accept jks format certificate.


If you had read the friendly manual at 
http://tomcat.apache.org/tomcat-5.5-doc/ssl-howto.html, you would know that 
this isn't true :).  While it talks about the keystore, the truststore works 
the same way.  So use openssl to create a pkcs12 file, specify this as the 
truststore, in whatever way you need to do from the CAS docs, and you should 
be good to go.


 I am just wondering if any one can give me some instruction how to create 
 a
 self-signed certificate and private key which can be used or imported to
 both Tomcat JVM and CAS server.



 Thanks,



 Lisa





 




-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Self-Signed Certificate for Tomcat JVM and CAS

[Lisa Tan]

I don't know if this is a right list to ask this question. I tried to
configure shibboleth which uses Tomcat with CAS authentication. I received
an error: Unable to validate ProxyTicketValidator

 

I did google search on this topic and understood the reason causing this
problem is Tomcat JVM doesn't trust the SSL cert of the CAS server. Since I
am still in the testing stage, I can't get a CA certificate but the
self-signed certificate.

 

If my understanding is correct, the self signed certificate via openssl
doesn't have jks format but Tomcat JVM only accept jks format certificate.

 

I am just wondering if any one can give me some instruction how to create a
self-signed certificate and private key which can be used or imported to
both Tomcat JVM and CAS server.

 

Thanks,

 

Lisa

 

 

RE: Certificate for Tomcat JVM and CAS

[Lisa Tan]

I don't know if this is a right list to ask this question. I tried to
configure shibboleth which uses Tomcat with CAS authentication. I received
an error: Unable to validate ProxyTicketValidator

I did google search on this topic and understood the reason causing this
problem is Tomcat JVM doesn't trust the SSL cert of the CAS server. Since I
am still in the testing stage, I can't get a CA certificate but the
self-signed certificate.

If my understanding is correct, the self signed certificate via openssl
doesn't have jks format but Tomcat JVM only accept jks format certificate.

I am just wondering if any one can give me some instruction how to create a
self-signed certificate and private key which can be used or imported to
both Tomcat JVM and CAS server.

Thanks,

Lisa



-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

RE: Failed Authentication

[Lisa Tan]

I am trying to set up Tomcat form based authentication and received the
following error.
Failed authenticate() test ??/j_security_check -
org.apache.catalina.authenticator.AuthenticatorBase [20070802]

What I have done is:
a). in $TOMCAT/conf/server.xml, I add JNDIRealm Realm
className=org.apache.catalina.realm.JNDIRealm
   debug='55'
connectionURL=ldap://xxx:xxx;
 userBase=ou=People,dc=example,dc=edu
 userSearch=(uid={0})
 /
b). in tomcat WEB-INF/web.xml,  I add security and login blocks 
   security-constraint
 web-resource-collection
  web-resource-nametracker/web-resource-name
  url-pattern*.jsp/url-pattern
  http-methodGET/http-method
  http-methodPOST/http-method
 /web-resource-collection
 !-- Security roles referenced by this web application --
 security-role
  descriptionAll Users/description
  role-nameperson/role-name
 /security-role
  /security-constraint
  
  login-config
auth-methodFORM/auth-method
realm-nameldapRealm/realm-name
form-login-config
form-login-page/login.jsp/form-login-page
form-error-page/login_error.jsp/form-error-page
/form-login-config
  /login-config
c). create login.jsp and login_error.jsp and put them in the web-app's
document root
  form action=j_security_check method=POST
LDAP AuthenticationBR
  
strongEnter UserId/strongbr
input type=text name=j_username size=22
  br
strongEnter Password/strongbr
input type=password name=j_password size=22
  
input type=submit name=Submit value=Submit
  /form
  
  login_error.jsp can be as simple as:
 
html
  body
  The system was not able to log you in.br
 form
   input type=button onclick=history.go(-1) value=Retry/
 /form
  /body
/html

Any directions will appreciate. Thanks,

Lisa


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

RE: Failed Authentication

[Lisa Tan]

I am using apache-tomcat-5.5.17, and Apache 2.0.52 which comes with RedHat.

Thanks,

Lisa

-Original Message-
From: Propes, Barry L [mailto:[EMAIL PROTECTED] 
Sent: Friday, August 03, 2007 4:40 PM
To: Tomcat Users List
Subject: RE: Failed Authentication

what version do you have? Of TC?

-Original Message-
From: Lisa Tan [mailto:[EMAIL PROTECTED]
Sent: Friday, August 03, 2007 9:59 AM
To: 'Tomcat Users List'
Subject: RE: Failed Authentication


I am trying to set up Tomcat form based authentication and received the
following error.
Failed authenticate() test ??/j_security_check -
org.apache.catalina.authenticator.AuthenticatorBase [20070802]

What I have done is:
a). in $TOMCAT/conf/server.xml, I add JNDIRealm Realm
className=org.apache.catalina.realm.JNDIRealm
   debug='55'
connectionURL=ldap://xxx:xxx;
 userBase=ou=People,dc=example,dc=edu
 userSearch=(uid={0})
 /
b). in tomcat WEB-INF/web.xml,  I add security and login blocks 
   security-constraint
 web-resource-collection
  web-resource-nametracker/web-resource-name
  url-pattern*.jsp/url-pattern
  http-methodGET/http-method
  http-methodPOST/http-method
 /web-resource-collection
 !-- Security roles referenced by this web application --
 security-role
  descriptionAll Users/description
  role-nameperson/role-name
 /security-role
  /security-constraint
  
  login-config
auth-methodFORM/auth-method
realm-nameldapRealm/realm-name
form-login-config
form-login-page/login.jsp/form-login-page
form-error-page/login_error.jsp/form-error-page
/form-login-config
  /login-config
c). create login.jsp and login_error.jsp and put them in the web-app's
document root
  form action=j_security_check method=POST
LDAP AuthenticationBR
  
strongEnter UserId/strongbr
input type=text name=j_username size=22
  br
strongEnter Password/strongbr
input type=password name=j_password size=22
  
input type=submit name=Submit value=Submit
  /form
  
  login_error.jsp can be as simple as:
 
html
  body
  The system was not able to log you in.br
 form
   input type=button onclick=history.go(-1) value=Retry/
 /form
  /body
/html

Any directions will appreciate. Thanks,

Lisa


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: [OT] Weird Exception thrown on startup (how to resolve?)

[Lisa]

I think this worked.  I just recursively removed every .ser file there just
to make sure:
$find . -name '*.ser' -exec rm {} \;

thanks

L




Markus Schönhaber wrote:
 
 Lisa wrote:
 
 What is throwing the following Exception?  How to fix?

 ---
 INFO: Filter 'sessionFilter' configured successfully
 Feb 15, 2007 10:15:18 AM org.apache.catalina.session.StandardManager
 doLoad
 SEVERE: IOException while loading persisted sessions:
 java.io.EOFException
 
 To me, this looks as if the serialized session data got somehow corrupted.
 You 
 could try to move the corresponding files out of the way or delete them.
 By default, for each webapp the session data will be serialized to
 ${catalina.home}/work/Engine/Host/webapp/SESSIONS.ser
 
 Regards
   mks
 
 -
 To start a new topic, e-mail: users@tomcat.apache.org
 To unsubscribe, e-mail: [EMAIL PROTECTED]
 For additional commands, e-mail: [EMAIL PROTECTED]
 
 
 

-- 
View this message in context: 
http://www.nabble.com/Weird-Exception-thrown-on-startup-%28how-to-resolve-%29-tf3234967.html#a9022770
Sent from the Tomcat - User mailing list archive at Nabble.com.


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Weird Exception thrown on startup (how to resolve?)

[Lisa]

What is throwing the following Exception?  How to fix?

---
INFO: Filter 'sessionFilter' configured successfully
Feb 15, 2007 10:15:18 AM org.apache.catalina.session.StandardManager doLoad
SEVERE: IOException while loading persisted sessions: java.io.EOFException
java.io.EOFException
at
java.io.ObjectInputStream$PeekInputStream.readFully(ObjectInputStrea
.java:2279)
at
java.io.ObjectInputStream$BlockDataInputStream.readShort(ObjectInput
tream.java:2748)
at
java.io.ObjectInputStream.readStreamHeader(ObjectInputStream.java:78
)
at java.io.ObjectInputStream.init(ObjectInputStream.java:280)
at
org.apache.catalina.util.CustomObjectInputStream.init(CustomObject
nputStream.java:57)
at
org.apache.catalina.session.StandardManager.doLoad(StandardManager.j
va:361)
at
org.apache.catalina.session.StandardManager.load(StandardManager.jav
:320)
at
org.apache.catalina.session.StandardManager.start(StandardManager.ja
a:636)
at
org.apache.catalina.core.ContainerBase.setManager(ContainerBase.java
431)
at
org.apache.catalina.core.StandardContext.start(StandardContext.java:
155)
at
org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBas
.java:759)
at
org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:7
9)
at
org.apache.catalina.core.StandardHost.addChild(StandardHost.java:524

at
org.apache.catalina.startup.HostConfig.deployDirectory(HostConfig.ja
a:904)
at
org.apache.catalina.startup.HostConfig.deployDirectories(HostConfig.
ava:867)
at
org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:47
)
at
org.apache.catalina.startup.HostConfig.start(HostConfig.java:1122)
at
org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.jav
:310)
at
org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(Lifecyc
eSupport.java:119)
at
org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1021

at
org.apache.catalina.core.StandardHost.start(StandardHost.java:718)
at
org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1013

at
org.apache.catalina.core.StandardEngine.start(StandardEngine.java:44
)
at
org.apache.catalina.core.StandardService.start(StandardService.java:
50)
at
org.apache.catalina.core.StandardServer.start(StandardServer.java:70
)
at org.apache.catalina.startup.Catalina.start(Catalina.java:551)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl
java:39)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAcce
sorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:294)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:432)
Feb 15, 2007 10:15:18 AM org.apache.catalina.session.StandardManager start
SEVERE: Exception loading sessions from persistent storage
java.io.EOFException
at
java.io.ObjectInputStream$PeekInputStream.readFully(ObjectInputStrea
.java:2279)
at
java.io.ObjectInputStream$BlockDataInputStream.readShort(ObjectInput
tream.java:2748)
at
java.io.ObjectInputStream.readStreamHeader(ObjectInputStream.java:78
)
at java.io.ObjectInputStream.init(ObjectInputStream.java:280)
at
org.apache.catalina.util.CustomObjectInputStream.init(CustomObject
nputStream.java:57)
at
org.apache.catalina.session.StandardManager.doLoad(StandardManager.j
va:361)
at
org.apache.catalina.session.StandardManager.load(StandardManager.jav
:320)
at
org.apache.catalina.session.StandardManager.start(StandardManager.ja
a:636)
at
org.apache.catalina.core.ContainerBase.setManager(ContainerBase.java
431)
at
org.apache.catalina.core.StandardContext.start(StandardContext.java:
155)
at
org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBas
.java:759)
at
org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:7
9)
at
org.apache.catalina.core.StandardHost.addChild(StandardHost.java:524

at
org.apache.catalina.startup.HostConfig.deployDirectory(HostConfig.ja
a:904)
at
org.apache.catalina.startup.HostConfig.deployDirectories(HostConfig.
ava:867)
at
org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:47
)
at
org.apache.catalina.startup.HostConfig.start(HostConfig.java:1122)
at
org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.jav
:310)
at
org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(Lifecyc
eSupport.java:119)
at
org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1021

at
org.apache.catalina.core.StandardHost.start(StandardHost.java:718)
at
org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1013

Re: [OT] Tomcat setup / config (System.exit if exception thrown)

[Lisa]

I want to shut down everything and prevent everyone from being able to get
anything accomplished.  If I could blow blue smoke out the back of the
machine, I would.  will work on an API and attachment for this.

L


reno-2 wrote:
 
 Le mercredi 07 février 2007 à 23:17 -0800, Lisa a écrit :
 
 When starting up Tomcat, I would like to do a System.exit() if an
 exception
 of any kind is thrown.  Is there a way to configure this?   We are using
 a
 large number of frameworks (Spring, Hibernate, log4j) and I want the
 developers to pay attention right away if there is something wrong and to
 get it fixed rather than ignoring them (or missing them).
 
 System.exit() is a bit radical...
 Why don't you send a mail to everyone when an exception is thrown with
 the exception?
 
 
 I want to shut things down hard and fast if something is wrong during
 development and force everyone to throw their hands up and be stuck (and
 make noise) until it is fixed.
 
 Any ideas would be appreciated.
 
 
 L
 
 

-- 
View this message in context: 
http://www.nabble.com/Tomcat-setup---config-%28System.exit-if-exception-thrown%29-tf3191721.html#a8939042
Sent from the Tomcat - User mailing list archive at Nabble.com.


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: [OT] Tomcat setup / config (System.exit if exception thrown)

[Lisa]

So how do I detect that an exception is thrown when Tomcat starts up? 

thanks


L



Lisa wrote:
 
 I want to shut down everything and prevent everyone from being able to get
 anything accomplished.  If I could blow blue smoke out the back of the
 machine, I would.  will work on an API and attachment for this.
 
 L
 
 
 reno-2 wrote:
 
 Le mercredi 07 février 2007 à 23:17 -0800, Lisa a écrit :
 
 When starting up Tomcat, I would like to do a System.exit() if an
 exception
 of any kind is thrown.  Is there a way to configure this?   We are using
 a
 large number of frameworks (Spring, Hibernate, log4j) and I want the
 developers to pay attention right away if there is something wrong and
 to
 get it fixed rather than ignoring them (or missing them).
 
 System.exit() is a bit radical...
 Why don't you send a mail to everyone when an exception is thrown with
 the exception?
 
 
 I want to shut things down hard and fast if something is wrong during
 development and force everyone to throw their hands up and be stuck (and
 make noise) until it is fixed.
 
 Any ideas would be appreciated.
 
 
 L
 
 
 
 

-- 
View this message in context: 
http://www.nabble.com/Tomcat-setup---config-%28System.exit-if-exception-thrown%29-tf3191721.html#a8939043
Sent from the Tomcat - User mailing list archive at Nabble.com.


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Tomcat setup / config (System.exit if exception thrown)

[Lisa]

When starting up Tomcat, I would like to do a System.exit() if an exception
of any kind is thrown.  Is there a way to configure this?   We are using a
large number of frameworks (Spring, Hibernate, log4j) and I want the
developers to pay attention right away if there is something wrong and to
get it fixed rather than ignoring them (or missing them).

I want to shut things down hard and fast if something is wrong during
development and force everyone to throw their hands up and be stuck (and
make noise) until it is fixed.

Any ideas would be appreciated.


L
-- 
View this message in context: 
http://www.nabble.com/Tomcat-setup---config-%28System.exit-if-exception-thrown%29-tf3191721.html#a8860501
Sent from the Tomcat - User mailing list archive at Nabble.com.


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

RE: How to enable log4 for use with Tomcat?

[Lisa]

Specifying the location of the log4j.xml file in CATALINA_OPTS is ignored. 
It will only pick it up from the classes/ directory.  Ideally I would like
to put it under the conf/ directory but am having no such luck.

I got it to work sort of.  I can not get fileappenders to work.  I am trying
to log all INFO from com.apache.myfaces to $CATALINA_HOME/logs/jsf.info.log
but am having no luck.

any ideas would be appreciated.




Caldarale, Charles R wrote:
 
 From: Lisa [mailto:[EMAIL PROTECTED] 
 Subject: RE: How to enable log4 for use with Tomcat?
 
 yes, but there is no mention about log4j.xml.  What config 
 file in tomcat do I edit to point to a log4j.xml file and
 have it use that for config instead of the .properties file.
 
 Look at the Default Initialization Procedure and Example Configurations
 sections here:
 http://logging.apache.org/log4j/docs/manual.html
 (about 3/4 of the way down).
 
 If you don't want to use the .properties format, remove (or rename) the
 tomcat-juli.jar from Tomcat's bin directory, then specify the location
 of the .xml file in CATALINA_OPTS or JAVA_OPTS (or as a -D parameter if
 running as a Windows service) per the above doc.  However, note this
 comment in the Tomcat docs for log4j:
 
 Note that there are known issues with using this naming convention
 (with square brackets) in log4j XML based configuration files, so we
 recommend you use a properties file as described until a future version
 of log4j allows this convention.
 
  - Chuck
 
 
 THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
 MATERIAL and is thus for use only by the intended recipient. If you
 received this in error, please contact the sender and delete the e-mail
 and its attachments from all computers.
 
 -
 To start a new topic, e-mail: users@tomcat.apache.org
 To unsubscribe, e-mail: [EMAIL PROTECTED]
 For additional commands, e-mail: [EMAIL PROTECTED]
 
 
 

-- 
View this message in context: 
http://www.nabble.com/How-to-enable-log4-for-use-with-Tomcat--tf3018241.html#a8402032
Sent from the Tomcat - User mailing list archive at Nabble.com.


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

How to enable log4 for use with Tomcat?

[Lisa]

I have tomcat 5.5.16 and have just downloaded log4j-1.2.14.jar and put it in
common/lib.  

Now how do I tell Tomcat to use this jar and to specifiy a log4j.xml file to
use for the configuration?

I see conf/logging.properties but I want to use log4j.xml instead of a
.properties file.

Thanks


Lisa
-- 
View this message in context: 
http://www.nabble.com/How-to-enable-log4-for-use-with-Tomcat--tf3018241.html#a8382422
Sent from the Tomcat - User mailing list archive at Nabble.com.


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

How do I set up Embedded Tomcat to override the Security Constraints set in the web.xml file using the catalina.deploy.SecurityConstaint class?

[Lisa Balducci]

I am trying to override the web.xml SecurityConstraints using the
Context addConstraint/removeConstraint methods.  The context.xml
contains the following element
WatchedResourceWEB-INF/web.xml/WatchedResource

 I tried the following to override the SecurityConstraints:   

 // adding the authConstraint  

   SecurityConstraint sc = new SecurityConstraint();


  sc.setAuthConstraint(false);

 

I've tried to use both the addConstraint(sc) and removeConstraint(sc)
methods to remove the auth-constraint element.  

  context.addConstraint(sc);  

 

 host.addChild(context);

 

The methods are set correctly but the web.xml security constraints
overrides these security constraint changes.  Is there a way to override
the web.xml security constraints using the
catalina.deploy.SecurityConstaint and Context methods?

 

 

Lisa