date:20090521

 From: Pid [mailto:p...@pidster.com]
 Subject: Re: Running out of tomcat threads - why many threads in
 RUNNABLEstage even with no activity

 I am not a number!

But are you a free man?

We want information, by hook or by crook...

(Apologies to the late Patrick McGoohan.)

 - Chuck

THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY 
MATERIAL and is thus for use only by the intended recipient. If you received 
this in error, please contact the sender and delete the e-mail and its 
attachments from all computers.

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

RE: tomcat6 executables on Windows Serer

 From: kolaloka [mailto:kolal...@freemail.hu]
 Subject: RE: tomcat6 executables on Windows Serer

 Well, under Linux, the top lists the java process, not an .so

That's because top, ps, and the Windows equivalents show only the initial 
executable, not the shared library names where the functionality is actually 
implemented.  There are many different launchers that will get you into the 
JVM, such as java.exe, javaw.exe, javac.exe, jar.exe, jstack.exe, jps.exe, 
jconsole.exe, etc., including tomcat6.exe.

 - Chuck

THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY 
MATERIAL and is thus for use only by the intended recipient. If you received 
this in error, please contact the sender and delete the e-mail and its 
attachments from all computers.

RE: Processes are not showing in the JConsole

 From: Anamika raj [mailto:rajnam...@gmail.com]
 Subject: Processes are not showing in the JConsole

 the process which i want to monitor on JConsole not showing 
 in the JConsole window.

Welcome to the wonderful world of Windows security.  At least on Vista, 
Tomcat running as a service is not accessible to JConsole, jps, jstack, or any 
of the other highly useful tools, regardless of the account the service is 
running under, or whether or not the tool is being run as an administrator.

The only means I've found to monitor Tomcat with JConsole is to run Tomcat from 
the .bat scripts, not as a service.  The scripts are only in the .zip download, 
not the .exe one, by the way.

 - Chuck

THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY 
MATERIAL and is thus for use only by the intended recipient. If you received 
this in error, please contact the sender and delete the e-mail and its 
attachments from all computers.

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: NIOConnector and high memory consumption

2009-05-21 Thread Filip Hanik - Dev Lists


hi Sagi, are you referring to the Http11NioProcessor objects?
If so, you should be able to configure the cache size when connections 
are released. So you could also use maxKeepAliveRequests to limit it


do you have the memory dump available?
Filip


sagi tomcat wrote:

Hello,

I am using Tomcat 6.0.18 in a production server, serving thousands of users
and hundreds of transactions per second. I am using the NIO connector. I've
noticed a serious memory utilization problem which were traced to the fact
that a single processor is dedicated to a connection and is not recycled
in-between requests. I've noticed ~7000 registered processors and that, as a
result, the server was busy doing GC and nothing else. I've performed
modification to the code to allow a processor to be recycled between
requests (I believe this was the behavior in older Tomcat versions) which
indeed solved the memory problem. I'd like to know more regarding the
implications of such a modification and to understand more why is the
processor is dedicated to a connection and not to a request.

Thanks

  



-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: NIOConnector and high memory consumption

2009-05-21 Thread sagi tomcat

Yes I am referring to the Http11NioProcessor objects. Playing with the cache
size did not help, since I had to deal with ~7000 registered
Http11NioProcessor objects (by registered I mean the object becoming a JMX
managed object). That amount by itself consumed a lot of the old gen space
(around ~600MB of the 1.6GB) and left no room for other long lived objects.
As a consquence, the server had to constantly perform a GC. Also, since the
cache size was much lower than 7000, the actual creation, registration and
dereregistration of Http11NioProcessor objects caused a major concurrency
bottleneck. Changing the Http11NioProcessor to be dedicated to request and
not to a connection dropped the number of concurrent registered processors
to ~500 (instead of the 7000) in the same production environment and
eliminated all memory ad concurrency problems.

I am not sure how the maxKeepAliveRequests can help. The problem is the
delay between each new http request on the same TCP connection. Browsers
tend to keep connections open without sending new requests in a hope for
reusing the connection. In the meantime, the processor is doing nothing
(reference in kept in the connections map, socket state is LONG), consuming
memory and not returned to the cache.

On Thu, May 21, 2009 at 5:12 PM, Filip Hanik - Dev Lists devli...@hanik.com
 wrote:

 hi Sagi, are you referring to the Http11NioProcessor objects?
 If so, you should be able to configure the cache size when connections are
 released. So you could also use maxKeepAliveRequests to limit it

 do you have the memory dump available?
 Filip



 sagi tomcat wrote:

 Hello,

 I am using Tomcat 6.0.18 in a production server, serving thousands of
 users
 and hundreds of transactions per second. I am using the NIO connector.
 I've
 noticed a serious memory utilization problem which were traced to the fact
 that a single processor is dedicated to a connection and is not recycled
 in-between requests. I've noticed ~7000 registered processors and that, as
 a
 result, the server was busy doing GC and nothing else. I've performed
 modification to the code to allow a processor to be recycled between
 requests (I believe this was the behavior in older Tomcat versions) which
 indeed solved the memory problem. I'd like to know more regarding the
 implications of such a modification and to understand more why is the
 processor is dedicated to a connection and not to a request.

 Thanks





 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Running out of tomcat threads - why many threads in RUNNABLE stage even with no activity

Trying to add some info below.

On 21.05.2009 05:09, Caldarale, Charles R wrote:
From: Pantvaidya, Vishwajit [mailto:vpant...@selectica.com]
Subject: RE: Running out of tomcat threads - why many threads in
RUNNABLEstage even with no activity

So socket_keepalive is already 1. So does this mean that firewall is
dropping connections in spite of it.

The doc does not mention using 1 here, just true (although other variables
allow either). Would be best to get Rainer's opinion when the sun comes up
in Europe.

My netstat o/p had only 2 tomcat connections active in FIN_WAIT2 and
about 11 in keepalive on httpd side - I guess this does not indicate
any hanging connections?

It's not what one would like to see, especially since none of the ports match
- all of the connections are broken.

Could that be because currently connectionTimeout is
active in my server.xml?

I think so; it appears that setting the connectionTimeout on the Tomcat side
will effectively disable the expected persistence; it's an expensive
workaround for the problem.

1) If you want to analyze your original problem, you need to get back to
the original situation, i.e. without connectionTimeout. It doesn't make
much sense to guess about the original problem by looking at something
very different.

2) The output of netstat and the content of a thread dump change in
time. If you want to understand the exact relations between the two
netstat outputs and a thread dump, you need to ensure to produce those
three things as close in time as possible. I'm talking about seconds not
milliseconds.

3) I think I already indicated that you do not want to look at entries
in TIME_WAIT state. This state is special and not related to any threads
in Apache or in Tomcat. A connection in TIME_WAIT state is in no way
longer associated with a process and will no longer handle any data.
It's a placeholder to prevent new connections using the same ports and
possibly getting confused by old packets for the previous connections
coming in late. The only reason to care about TIME_WAIT connections is,
when the total number of all connections on the system (all ports and
including TIME_WAIT) gets into more than 1. Some systems can cope
with more, like 6, but if you go above 1, then you need to start
thinking about it. I assume this is in no way the case here. So let's
for the moment always forget about the TIME_WAIT connections.

4) Firewall idle connection drop: First read

http://tomcat.apache.org/connectors-doc/generic_howto/timeouts.html#Firewall%20Connection%20Dropping

carefully and try to understand.

Any mod_jk attribute that takes a booelan value will accept 1, true,
True, t or T as true, 0, false, False, f or F as false (and maybe even
more).

5) Matching port numbers

Usually the port numbers should match. The non matching of the port
numbers could indicate, that there is a firewall in between, although
most firewall systems will be transparent to the ports (yes, I know
there are many variations). Since the port numbers are very close I
would guess, that the reason for not matching is that netstat was done a
couple of seconds or more apart, and your connections are only used for
a very short time, so we have lots of new connections activity.

6) TCP states

LISTEN on the Tomcat side corresponds to the one TP thread, that does a
socket accept.

ESTABLISHED: both sides still want to use this connection. On the Tomcat
side shows up as socketRead0()

CLOSE_WAIT: the other side has closed the connection, the local side
hasn't yet. E.g. if Tomcat closes the connection because of
connectionTimeout, but Apache doesn't have a configured idle timeout and
didn't yet try to reuse the half-closed connection, the connection will
be shown as CLOSE_WAIT on the httpd side. If Apache closed the
connection, but Tomcat hasn't noticed yet, it will be CLOSE_WAIT at the
Tomcat end. In this case it could be also socketRead0() in the thread dump.

FIN_WAIT2: most likely the other end of CLOSE_WAIT.

7) mod_jk update

Before you start to fix your mod_jk configuration, go to your ops people
and tell them that they are using a very bad mod_jk version and they
have to update. The right version to update to is 1.2.28. It does make
no sense at all to try to fix this with your old version. Solve your
problem in the right way, by setting much more attributes on the JK side
than simply the connectionTimeout on the Tomcat side.

Most important: read the above timeouts page fully.

Regards,

Rainer

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Processes are not showing in the JConsole

On 21.05.2009 14:57, Caldarale, Charles R wrote:
 From: Anamika raj [mailto:rajnam...@gmail.com]
 Subject: Processes are not showing in the JConsole

 the process which i want to monitor on JConsole not showing 
 in the JConsole window.

 Welcome to the wonderful world of Windows security.  At least on Vista, 
 Tomcat running as a service is not accessible to JConsole, jps, jstack, or 
 any of the other highly useful tools, regardless of the account the service 
 is running under, or whether or not the tool is being run as an administrator.

 The only means I've found to monitor Tomcat with JConsole is to run Tomcat 
 from the .bat scripts, not as a service.  The scripts are only in the .zip 
 download, not the .exe one, by the way.

Is it still possible under Vista, and will it help, if you let the
service run with the same account you are using to login?

Regards,

Rainer

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

NIO Connector: Too many open files

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

All,

I've been testing the performance of various Tomcat configurations
against Apache httpd and my serious tests are not completing for the NIO
connector because the server is running out of files:

 May 20, 2009 2:35:55 AM org.apache.tomcat.util.net.NioEndpoint$Acceptor run
 SEVERE: Socket accept failed
 java.io.IOException: Too many open files
 at sun.nio.ch.ServerSocketChannelImpl.accept0(Native Method)
 at 
 sun.nio.ch.ServerSocketChannelImpl.accept(ServerSocketChannelImpl.java:145)
 at 
 org.apache.tomcat.util.net.NioEndpoint$Acceptor.run(NioEndpoint.java:1198)
 at java.lang.Thread.run(Thread.java:619)

A bit of background for those who haven't followed the Apache httpd vs
Tomcat static content performance thread:

I'm running Tomcat 6.0.18 using tcnative 1.1.16. Apache httpd is not
being used for this test, so the client is contacting Tomcat directly
from localhost.

$ uname -a
Linux chadis 2.6.14-gentoo-r5 #2 PREEMPT Sat Dec 17 16:30:55 EST 2005
i686 AMD Athlon(tm) XP 1700+ AuthenticAMD GNU/Linux

$ java -version
java version 1.6.0_13
Java(TM) SE Runtime Environment (build 1.6.0_13-b03)
Java HotSpot(TM) Client VM (build 11.3-b02, mixed mode, sharing)

$ ulimit -n (fds per process limit)
1024

1GiB RAM on the machine, here are the heap details /after/  the tests
are run:

$ jmap -heap 1430
Attaching to process ID 1430, please wait...
Debugger attached successfully.
Client compiler detected.
JVM version is 11.3-b02

using thread-local object allocation.
Mark Sweep Compact GC

Heap Configuration:
   MinHeapFreeRatio = 40
   MaxHeapFreeRatio = 70
   MaxHeapSize  = 67108864 (64.0MB)
   NewSize  = 1048576 (1.0MB)
   MaxNewSize   = 4294901760 (4095.9375MB)
   OldSize  = 4194304 (4.0MB)
   NewRatio = 12
   SurvivorRatio= 8
   PermSize = 12582912 (12.0MB)
   MaxPermSize  = 67108864 (64.0MB)

Heap Usage:
New Generation (Eden + 1 Survivor Space):
   capacity = 2228224 (2.125MB)
   used = 612888 (0.5844955444335938MB)
   free = 1615336 (1.5405044555664062MB)
   27.505672679227942% used
Eden Space:
   capacity = 2031616 (1.9375MB)
   used = 612888 (0.5844955444335938MB)
   free = 1418728 (1.3530044555664062MB)
   30.167511970766128% used
- From Space:
   capacity = 196608 (0.1875MB)
   used = 0 (0.0MB)
   free = 196608 (0.1875MB)
   0.0% used
To Space:
   capacity = 196608 (0.1875MB)
   used = 0 (0.0MB)
   free = 196608 (0.1875MB)
   0.0% used
tenured generation:
   capacity = 28311552 (27.0MB)
   used = 20464784 (19.516738891601562MB)
   free = 7846768 (7.4832611083984375MB)
   72.28421811704283% used
Perm Generation:
   capacity = 12582912 (12.0MB)
   used = 8834304 (8.425048828125MB)
   free = 3748608 (3.574951171875MB)
   70.208740234375% used

Here are my Connector configurations:

!-- Regular non-APR Coyote Connector --
Connector  port=8001
protocol=org.apache.coyote.http11.Http11Protocol
connectionTimeout=2
server=Coyote1.1non-APR
   /

!-- APR Connector --
Connector  port=8002
protocol=org.apache.coyote.http11.Http11AprProtocol
useSendfile=true
connectionTimeout=2
server=Coyote1.1APR
   /

!-- APR without sendfile --
Connector  port=8003
protocol=org.apache.coyote.http11.Http11AprProtocol
useSendfile=false
connectionTimeout=2
server=Coyote1.1APRw/osendfile
   /

!-- NIO Connector --
Connector  port=8004
protocol=org.apache.coyote.http11.Http11NioProtocol
useSendfile=true
connectionTimeout=2
server=Coyote1.1NIO
   /

!-- APR without sendfile --
Connector  port=8005
protocol=org.apache.coyote.http11.Http11NioProtocol
useSendfile=false
connectionTimeout=2
server=Coyote1.1NIOw/osendfile
   /

All connectors are configured at once, so I should have a maximum of 40
threads in each pool. The command I ran to benchmark each connector was
(for example):

/usr/sbin/ab -c 40 -t 480 -n 1000 http://localhost:8004/4kiB.bin

This runs ApacheBench for 8 minutes with 40 client threads requesting a
4k file over and over again. This particular test succeeded, but there
are 14 more tests, each using a file twice the size of the previous
test. After the 128k file test, every single test fails after that.

The last test I ran (with only 1 thread instead of 40), the NIO
connector died in the same way, but the NIO connector without sendfile
enabled appeared to work properly. This time (40 threads), neither of
the connectors worker properly, the NIO connector failing to complete
any tests after the 128kb test and the NIO-sendfile

RE: Processes are not showing in the JConsole

 From: Rainer Jung [mailto:rainer.j...@kippdata.de]
 Subject: Re: Processes are not showing in the JConsole

 Is it still possible under Vista, and will it help, if you let the
 service run with the same account you are using to login?

Nope, I've tried that.  The service remains invisible to jps and JConsole, even 
if the same account is used for both.  I did not try getting the pid from task 
manager and using it explicitly when starting JConsole, but will do so when I 
get back to my Vista box (it's a couple of kilometers away and powered off at 
the moment).

 - Chuck

THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY 
MATERIAL and is thus for use only by the intended recipient. If you received 
this in error, please contact the sender and delete the e-mail and its 
attachments from all computers.

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Running out of tomcat threads - why many threads in RUNNABLE stage even with no activity

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Vishwajit,

On 5/19/2009 6:08 PM, Pantvaidya, Vishwajit wrote:
 No, Tomcat uses precisely 1 thread to handle each incoming HTTP
 request. If keepalives are used, multiple requests may be handled
 by the same thread before it is returned to the pool, or different
 threads may be used to serve different requests from the single
 connection, but in either case, no more than 1 thread will be used
 to service a single HTTP request.
 
 [Pantvaidya, Vishwajit] Could this happen if upon my http browser
 request, the app could be spawning multiple redirects in quick
 succession leading tomcat to create multiple threads. Any other
 thoughts why I could be seeing tomcat spawn threads in multiples of
 4?

No, the only thing your browser can do in order to activate a thread is
to make a request. If a single page contains many items to download
(images, CSS files, scripts, etc.) then the browser may make several
requests to the server simultaneously. Most web browsers limit their
simultaneous requests to a single server to 4, so maybe that's what
you're observing.

The weird thing is that you're observing 4 threads doing something
/without/ any requests being made.

 [Pantvaidya, Vishwajit] Ok thanks. httpd -l showed perfork.c. I
 guess that means we are using prefork MPM. So our cachesize should be
 1? Our mod_jk version is 1.2.15 - will that also auto-detect the
 cache-size?

Yes and yes.

 [Pantvaidya, Vishwajit] I agree - but again as I mentioned above
 because the admin will be conservative about any changes, I need to
 have a strong reason.

How's this for a compelling reason: your server keeps locking-up in its
current configuration.

 Also when you say let the connection stay
 alive, does that mean let the TP-Processor thread remain in Waiting
 state / Runnable state?

I mean that you shouldn't set any connection_pool_timeout on any of your
workers. There really isn't a need to set this unless you are having
some kind of problem IMO.


- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkoVe7oACgkQ9CaO5/Lv0PAbdQCeK088qxz+9/TNBnJgfHBg6Gyz
7+4AoI6fbXdn4Sh6kR9QaQhvK/jmHWpF
=frxU
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: NIOConnector and high memory consumption

2009-05-21 Thread Filip Hanik - Dev Lists

yes, with maxKeepAliveRequests you would also throttle the 
connectionTimeout (or keepAliveTimeout, but that may be in 6.0.20) to 
reduce the amount of objects.
I think you have a very valid use case, so I will add in some features 
around managing the size of these objects to ensure they don't overgrow.


Thank you very much for the report

Filip

sagi tomcat wrote:

Yes I am referring to the Http11NioProcessor objects. Playing with the cache
size did not help, since I had to deal with ~7000 registered
Http11NioProcessor objects (by registered I mean the object becoming a JMX
managed object). That amount by itself consumed a lot of the old gen space
(around ~600MB of the 1.6GB) and left no room for other long lived objects.
As a consquence, the server had to constantly perform a GC. Also, since the
cache size was much lower than 7000, the actual creation, registration and
dereregistration of Http11NioProcessor objects caused a major concurrency
bottleneck. Changing the Http11NioProcessor to be dedicated to request and
not to a connection dropped the number of concurrent registered processors
to ~500 (instead of the 7000) in the same production environment and
eliminated all memory ad concurrency problems.

I am not sure how the maxKeepAliveRequests can help. The problem is the
delay between each new http request on the same TCP connection. Browsers
tend to keep connections open without sending new requests in a hope for
reusing the connection. In the meantime, the processor is doing nothing
(reference in kept in the connections map, socket state is LONG), consuming
memory and not returned to the cache.

On Thu, May 21, 2009 at 5:12 PM, Filip Hanik - Dev Lists devli...@hanik.com
  

wrote:



  

hi Sagi, are you referring to the Http11NioProcessor objects?
If so, you should be able to configure the cache size when connections are
released. So you could also use maxKeepAliveRequests to limit it

do you have the memory dump available?
Filip



sagi tomcat wrote:



Hello,

I am using Tomcat 6.0.18 in a production server, serving thousands of
users
and hundreds of transactions per second. I am using the NIO connector.
I've
noticed a serious memory utilization problem which were traced to the fact
that a single processor is dedicated to a connection and is not recycled
in-between requests. I've noticed ~7000 registered processors and that, as
a
result, the server was busy doing GC and nothing else. I've performed
modification to the code to allow a processor to be recycled between
requests (I believe this was the behavior in older Tomcat versions) which
indeed solved the memory problem. I'd like to know more regarding the
implications of such a modification and to understand more why is the
processor is dedicated to a connection and not to a request.

Thanks



  

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org





  



-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: AJP connections just stop working

I looked at the dumps. Comments inline.

On 18.05.2009 20:33, kvancamp wrote:
 My problem seems to be most similar to this post.  We are having intermittent
 problems with the JBoss/Tomcat AJP 1.3 connector hanging.  From searching
 the JBoss and Tomcat user forums, other issues that are similar to mine are:
 http://marc.info/?l=tomcat-userm=116231271819840w=2
 http://www.nabble.com/Problem-with-AJP-connector-td19657959.html#a19657959
 
 neither of which really seems to offer a solution.  Here are my specifics:
 
 We are running JBoss 4.2.2 (which uses Tomcat 6) running on Linux (RedHat
 5.3) behind an IIS proxy, which is proxying to the JBoss AJP port.  I have
 left AJP at its default settings in my server.xml:
   !-- A AJP 1.3 Connector on port 8009 --
   Connector protocol=AJP/1.3 port=8009
 address=${jboss.bind.address}
  redirectPort=8443 /
 The behavior I’m observing is only occurring about once every 2 weeks,
 making it difficult to reproduce.  From the user’s perspective, the site is
 unreachable.  The IIS proxy is logging this when the problem occurs:
 [Tue Apr 21 04:13:14.775 2009] [3192:2500] [error] jk_ajp_common.c (1011):
 (adastarNode) can't receive the response message from tomcat, network
 problems or tomcat (172.17.3.240:8009) is down (errno=54)

54 is winsock error 10054, connection reset by peer.

 [Tue Apr 21 04:13:14.775 2009] [3192:2500] [error] jk_ajp_common.c (1766):
 (adastarNode) Tomcat is down or refused connection. No response has been
 sent to the client (yet)
 [Tue Apr 21 04:13:14.775 2009] [3192:2500] [info] jk_ajp_common.c (2186):
 (adastarNode) sending request to tomcat failed (recoverable),  (attempt=1)
 
 My JBoss instance is not logging any errors during this timeframe.  As far
 as how to solve the problem, in one case the server was left like this for
 several hours and seemed to recover on its own, only to hang again a couple
 of hours later; otherwise the only solution that’s worked is to restart
 JBoss.
 
 The main difference I can observe in a thread dump is that the AJP acceptor
 thread, which is normally in a RUNNABLE state, is in a WAITING state when
 the hang occurs:
 ajp-abeitmpr1.andesatpa.com%2F172.17.3.88-8009-Acceptor-0 daemon prio=10
 tid=0x2aaad7a70400 nid=0x7dae in Object.wait()
 [0x4424..0x44240c10]
java.lang.Thread.State: WAITING (on object monitor)

Good analysis. If you look further down the stack of this thread you see
it sticks in org.apache.tomcat.util.net.JIoEndpoint.getWorkerThread().

Furthermore all you threads available for requests at port 8009 are in
the same state, namely they are connected to the web server waiting for
the next request to come in over the existing connection they handle.

In all dumps there were 40 of those, so I assume your pool size of the
AJP connector (port 8009) is maximum 40, all of those are connected, and
when the next connection came in, the acceptor tries to get another free
thread, none exists and the acceptor is blocked. As a consequence,
neither the new connection is handled, not is your JBOSS able to accept
any more connections.

The root cause is, that all threads in your pool are busy, waiting for
new rquests coming in over existing connections. So there are two
possiblities:

- either you need more threads to handle more connections
- or something is wrong and instead those threads should be freed.

It's not totally trivial to guess now, which of the two cases you are
in, but I would say the second is more likely.

 Lately I’ve been trying to also use netstat to look at the problem when a
 hang occurs, but I’m not sure I’ve caught it during a true hang.  It appears
 to me that I have a growing number of ESTABLISHED connections prior to the
 hang, plus one CLOSE_WAIT connection:
 [it...@abeitmpr1 log]$ netstat -vatn |grep 8009
 tcp0  0 172.17.3.88:80090.0.0.0:*  
 LISTEN
 tcp  516  0 172.17.3.88:8009172.17.5.42:2154   
 ESTABLISHED
 tcp0  0 172.17.3.88:8009172.17.5.42:3690   
 ESTABLISHED
 tcp  514  0 172.17.3.88:8009172.17.5.42:2159   
 ESTABLISHED
 tcp  514  0 172.17.3.88:8009172.17.5.42:2158   
 ESTABLISHED
 tcp  514  0 172.17.3.88:8009172.17.5.42:2144   
 ESTABLISHED
 tcp0  0 172.17.3.88:8009172.17.5.42:3680   
 ESTABLISHED
 tcp  514  0 172.17.3.88:8009172.17.5.42:2171   
 ESTABLISHED
 tcp  514  0 172.17.3.88:8009172.17.5.42:2170   
 ESTABLISHED
 tcp0  0 172.17.3.88:8009172.17.5.42:1395   
 ESTABLISHED
 tcp0  0 172.17.3.88:8009172.17.5.42:2935   
 ESTABLISHED
 tcp0  0 172.17.3.88:8009172.17.5.42:4724   
 ESTABLISHED
 tcp  514  0 172.17.3.88:8009172.17.5.42:2120

Re: NIO Connector: Too many open files

On 21.05.2009 17:55, Christopher Schultz wrote:
 All,
 
 I've been testing the performance of various Tomcat configurations
 against Apache httpd and my serious tests are not completing for the NIO
 connector because the server is running out of files:
 
 May 20, 2009 2:35:55 AM org.apache.tomcat.util.net.NioEndpoint$Acceptor run
 SEVERE: Socket accept failed
 java.io.IOException: Too many open files
 at sun.nio.ch.ServerSocketChannelImpl.accept0(Native Method)
 at 
 sun.nio.ch.ServerSocketChannelImpl.accept(ServerSocketChannelImpl.java:145)
 at 
 org.apache.tomcat.util.net.NioEndpoint$Acceptor.run(NioEndpoint.java:1198)
 at java.lang.Thread.run(Thread.java:619)
 
 A bit of background for those who haven't followed the Apache httpd vs
 Tomcat static content performance thread:
 
 I'm running Tomcat 6.0.18 using tcnative 1.1.16. Apache httpd is not
 being used for this test, so the client is contacting Tomcat directly
 from localhost.
 
 $ uname -a
 Linux chadis 2.6.14-gentoo-r5 #2 PREEMPT Sat Dec 17 16:30:55 EST 2005
 i686 AMD Athlon(tm) XP 1700+ AuthenticAMD GNU/Linux
 
 $ java -version
 java version 1.6.0_13
 Java(TM) SE Runtime Environment (build 1.6.0_13-b03)
 Java HotSpot(TM) Client VM (build 11.3-b02, mixed mode, sharing)
 
 $ ulimit -n (fds per process limit)
 1024
 
 1GiB RAM on the machine, here are the heap details /after/  the tests
 are run:
 
 $ jmap -heap 1430
 Attaching to process ID 1430, please wait...
 Debugger attached successfully.
 Client compiler detected.
 JVM version is 11.3-b02
 
 using thread-local object allocation.
 Mark Sweep Compact GC
 
 Heap Configuration:
MinHeapFreeRatio = 40
MaxHeapFreeRatio = 70
MaxHeapSize  = 67108864 (64.0MB)
NewSize  = 1048576 (1.0MB)
MaxNewSize   = 4294901760 (4095.9375MB)
OldSize  = 4194304 (4.0MB)
NewRatio = 12
SurvivorRatio= 8
PermSize = 12582912 (12.0MB)
MaxPermSize  = 67108864 (64.0MB)
 
 Heap Usage:
 New Generation (Eden + 1 Survivor Space):
capacity = 2228224 (2.125MB)
used = 612888 (0.5844955444335938MB)
free = 1615336 (1.5405044555664062MB)
27.505672679227942% used
 Eden Space:
capacity = 2031616 (1.9375MB)
used = 612888 (0.5844955444335938MB)
free = 1418728 (1.3530044555664062MB)
30.167511970766128% used
 - From Space:
capacity = 196608 (0.1875MB)
used = 0 (0.0MB)
free = 196608 (0.1875MB)
0.0% used
 To Space:
capacity = 196608 (0.1875MB)
used = 0 (0.0MB)
free = 196608 (0.1875MB)
0.0% used
 tenured generation:
capacity = 28311552 (27.0MB)
used = 20464784 (19.516738891601562MB)
free = 7846768 (7.4832611083984375MB)
72.28421811704283% used
 Perm Generation:
capacity = 12582912 (12.0MB)
used = 8834304 (8.425048828125MB)
free = 3748608 (3.574951171875MB)
70.208740234375% used
 
 Here are my Connector configurations:
 
 !-- Regular non-APR Coyote Connector --
 Connector  port=8001
 protocol=org.apache.coyote.http11.Http11Protocol
 connectionTimeout=2
 server=Coyote1.1non-APR
  /
 
 !-- APR Connector --
 Connector  port=8002
 protocol=org.apache.coyote.http11.Http11AprProtocol
 useSendfile=true
 connectionTimeout=2
 server=Coyote1.1APR
  /
 
 !-- APR without sendfile --
 Connector  port=8003
 protocol=org.apache.coyote.http11.Http11AprProtocol
 useSendfile=false
 connectionTimeout=2
 server=Coyote1.1APRw/osendfile
  /
 
 !-- NIO Connector --
 Connector  port=8004
 protocol=org.apache.coyote.http11.Http11NioProtocol
 useSendfile=true
 connectionTimeout=2
 server=Coyote1.1NIO
  /
 
 !-- APR without sendfile --
 Connector  port=8005
 protocol=org.apache.coyote.http11.Http11NioProtocol
 useSendfile=false
 connectionTimeout=2
 server=Coyote1.1NIOw/osendfile
  /
 
 All connectors are configured at once, so I should have a maximum of 40
 threads in each pool. The command I ran to benchmark each connector was
 (for example):
 
 /usr/sbin/ab -c 40 -t 480 -n 1000 http://localhost:8004/4kiB.bin
 
 This runs ApacheBench for 8 minutes with 40 client threads requesting a
 4k file over and over again. This particular test succeeded, but there
 are 14 more tests, each using a file twice the size of the previous
 test. After the 128k file test, every single test fails after that.
 
 The last test I ran (with only 1 thread instead of 40), the NIO
 connector died in the same way, but the NIO connector without sendfile
 enabled appeared to work properly. This time (40 threads), neither

Re: NIO Connector: Too many open files

2 remarks about all your stress testing efforts:

A) TIME_WAIT

When not doing HTTP Keep-Alive, under high load the size of the TCP hash
table and the effectiveness of the system to lookp up TCP connections
can limit the throughput you can reach. More precisely, depending on the
excat way of connection shutdown, you get TIME_WAIT states for the
finished connections (without HTTP Keep Alive it could be one such
connection per request). Most systems get slow, once the number of those
connections reaches somthing arounf 3.

E.g. if you are doing 2000 requests per second without HTTP Keep Alive
and the combination of web server and stress test tool leads to
TIME_WAITs, after 15 seconds your table size might reach a critical size.

The amount of time a system waits before it destroys TIME_WAIT
connections varies. Solaris 4 minutes, but tunable down to 5 seconds,
Linux 1 minute (I think) and still not tunable (a free pizza to the
first one who can show me how to tune the time interval it takes for a
TCP connection to be moved out of TIME_WAIT), on Windows I think also 1
minute but tunable.

Not using HTTP Keep Alive will very likely limit quickly the achievable
throughput when going up in concurrency.

B) Resource usage

You are doing a first interesting analysis, namely the base throughput
you can reach using concurrency one. Now the throughput we can reach
using a given setup always depends on the first bottleneck we hit.

For big files it might be the network bandwidth. For small files it
might be CPU or maybe I/Os per second we can do on the interface.

So it is also interesting to compare the resource usage. Some resources
are harder to measure (like memory), but the one easy to measure
resource is CPU. So you get some more info, when also measuring CPU per
request. Think of it as maximum speed and gas efficiency.

Regards,

Rainer

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: NIOConnector and high memory consumption

2009-05-21 Thread sagi tomcat

Thanks Filip.

- I think there's a bug with maxKeepAliveRequests. Each call to
Http11NioProcessor.process() resets the keepAliveLeft parameter to the old
maxKeepAliveRequests value. When a parsing of a HTTP request doesn't have
enough input to complete the parsing stage, the process() returns
SocketState.LONG in order to re-register on the selector for more input.
Next call to process() will lose previous keepAliveLeft count.

 I am still very much interested to know the implications of my
modifications to the code. What I did is:

- After a request processing was completed, and no input is available in the
input buffer (to ensure no pipelining on the connection) - instead of
keeping the processor in the connections map I've recycled it and
re-registered the channel for read on the selector. Next request on the same
connection will use the a different processor.

On Thu, May 21, 2009 at 7:06 PM, Filip Hanik - Dev Lists devli...@hanik.com
 wrote:

 yes, with maxKeepAliveRequests you would also throttle the
 connectionTimeout (or keepAliveTimeout, but that may be in 6.0.20) to reduce
 the amount of objects.
 I think you have a very valid use case, so I will add in some features
 around managing the size of these objects to ensure they don't overgrow.

 Thank you very much for the report

 Filip


 sagi tomcat wrote:

 Yes I am referring to the Http11NioProcessor objects. Playing with the
 cache
 size did not help, since I had to deal with ~7000 registered
 Http11NioProcessor objects (by registered I mean the object becoming a JMX
 managed object). That amount by itself consumed a lot of the old gen space
 (around ~600MB of the 1.6GB) and left no room for other long lived
 objects.
 As a consquence, the server had to constantly perform a GC. Also, since
 the
 cache size was much lower than 7000, the actual creation, registration and
 dereregistration of Http11NioProcessor objects caused a major concurrency
 bottleneck. Changing the Http11NioProcessor to be dedicated to request and
 not to a connection dropped the number of concurrent registered processors
 to ~500 (instead of the 7000) in the same production environment and
 eliminated all memory ad concurrency problems.

 I am not sure how the maxKeepAliveRequests can help. The problem is the
 delay between each new http request on the same TCP connection. Browsers
 tend to keep connections open without sending new requests in a hope for
 reusing the connection. In the meantime, the processor is doing nothing
 (reference in kept in the connections map, socket state is LONG),
 consuming
 memory and not returned to the cache.

 On Thu, May 21, 2009 at 5:12 PM, Filip Hanik - Dev Lists 
 devli...@hanik.com


 wrote:





 hi Sagi, are you referring to the Http11NioProcessor objects?
 If so, you should be able to configure the cache size when connections
 are
 released. So you could also use maxKeepAliveRequests to limit it

 do you have the memory dump available?
 Filip



 sagi tomcat wrote:



 Hello,

 I am using Tomcat 6.0.18 in a production server, serving thousands of
 users
 and hundreds of transactions per second. I am using the NIO connector.
 I've
 noticed a serious memory utilization problem which were traced to the
 fact
 that a single processor is dedicated to a connection and is not recycled
 in-between requests. I've noticed ~7000 registered processors and that,
 as
 a
 result, the server was busy doing GC and nothing else. I've performed
 modification to the code to allow a processor to be recycled between
 requests (I believe this was the behavior in older Tomcat versions)
 which
 indeed solved the memory problem. I'd like to know more regarding the
 implications of such a modification and to understand more why is the
 processor is dedicated to a connection and not to a request.

 Thanks





 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org









 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org

Re: mod_proxy, Tomcat and request URL

On 20.05.2009 17:33, Markus Schönhaber wrote:
 Andre-John Mas:
 
 this is not the ideal setup, I don't have any control over this. At  
 the same time I see that using mod_proxy, by way of ProxyPass, means  
 that the Tomcat server does not know what hostname was used to access  
 the Apache server, instead getting http://localhost:8080/ . Is there  
 any way, probably via configuration of Apache, that this could be  
 passed to the Tomcat? I looked for information on this, but I could  
 not find any.
 
 Instead of mod_proxy_http, I use mod_proxy_ajp. AJP passes the client's
 IP through.

On 20.05.2009 16:59, Caldarale, Charles R wrote:
 Aren't the X-Forwarded-For and X-Forwarded-Host headers being set by
mod_proxy?  The doc indicates they should be:
 http://httpd.apache.org/docs/2.2/mod/mod_proxy.html

.. and finally there's ProxyPreserveHost.

If yo want to get an idea, which other traps are to avoid when using a
reverse proxy, you can also look at

http://tomcat.apache.org/connectors-doc/generic_howto/proxy.html

Regards,

Rainer

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: NIO Connector: Too many open files

2009-05-21 Thread Filip Hanik - Dev Lists

hi Christopher, generally, ulimit -n 1024 is too low for any kind of web 
server.

And there was also a file descriptor leak in the NIO connector, fixed in
http://svn.apache.org/viewvc?rev=734454view=rev

this is when Tomcat NIO serves up static content.

Filip


Christopher Schultz wrote:

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

All,

I've been testing the performance of various Tomcat configurations
against Apache httpd and my serious tests are not completing for the NIO
connector because the server is running out of files:

  

May 20, 2009 2:35:55 AM org.apache.tomcat.util.net.NioEndpoint$Acceptor run
SEVERE: Socket accept failed
java.io.IOException: Too many open files
at sun.nio.ch.ServerSocketChannelImpl.accept0(Native Method)
at 
sun.nio.ch.ServerSocketChannelImpl.accept(ServerSocketChannelImpl.java:145)
at 
org.apache.tomcat.util.net.NioEndpoint$Acceptor.run(NioEndpoint.java:1198)
at java.lang.Thread.run(Thread.java:619)



A bit of background for those who haven't followed the Apache httpd vs
Tomcat static content performance thread:

I'm running Tomcat 6.0.18 using tcnative 1.1.16. Apache httpd is not
being used for this test, so the client is contacting Tomcat directly
from localhost.

$ uname -a
Linux chadis 2.6.14-gentoo-r5 #2 PREEMPT Sat Dec 17 16:30:55 EST 2005
i686 AMD Athlon(tm) XP 1700+ AuthenticAMD GNU/Linux

$ java -version
java version 1.6.0_13
Java(TM) SE Runtime Environment (build 1.6.0_13-b03)
Java HotSpot(TM) Client VM (build 11.3-b02, mixed mode, sharing)

$ ulimit -n (fds per process limit)
1024

1GiB RAM on the machine, here are the heap details /after/  the tests
are run:

$ jmap -heap 1430
Attaching to process ID 1430, please wait...
Debugger attached successfully.
Client compiler detected.
JVM version is 11.3-b02

using thread-local object allocation.
Mark Sweep Compact GC

Heap Configuration:
   MinHeapFreeRatio = 40
   MaxHeapFreeRatio = 70
   MaxHeapSize  = 67108864 (64.0MB)
   NewSize  = 1048576 (1.0MB)
   MaxNewSize   = 4294901760 (4095.9375MB)
   OldSize  = 4194304 (4.0MB)
   NewRatio = 12
   SurvivorRatio= 8
   PermSize = 12582912 (12.0MB)
   MaxPermSize  = 67108864 (64.0MB)

Heap Usage:
New Generation (Eden + 1 Survivor Space):
   capacity = 2228224 (2.125MB)
   used = 612888 (0.5844955444335938MB)
   free = 1615336 (1.5405044555664062MB)
   27.505672679227942% used
Eden Space:
   capacity = 2031616 (1.9375MB)
   used = 612888 (0.5844955444335938MB)
   free = 1418728 (1.3530044555664062MB)
   30.167511970766128% used
- From Space:
   capacity = 196608 (0.1875MB)
   used = 0 (0.0MB)
   free = 196608 (0.1875MB)
   0.0% used
To Space:
   capacity = 196608 (0.1875MB)
   used = 0 (0.0MB)
   free = 196608 (0.1875MB)
   0.0% used
tenured generation:
   capacity = 28311552 (27.0MB)
   used = 20464784 (19.516738891601562MB)
   free = 7846768 (7.4832611083984375MB)
   72.28421811704283% used
Perm Generation:
   capacity = 12582912 (12.0MB)
   used = 8834304 (8.425048828125MB)
   free = 3748608 (3.574951171875MB)
   70.208740234375% used

Here are my Connector configurations:

!-- Regular non-APR Coyote Connector --
Connector  port=8001
protocol=org.apache.coyote.http11.Http11Protocol
connectionTimeout=2
server=Coyote1.1non-APR
   /

!-- APR Connector --
Connector  port=8002
protocol=org.apache.coyote.http11.Http11AprProtocol
useSendfile=true
connectionTimeout=2
server=Coyote1.1APR
   /

!-- APR without sendfile --
Connector  port=8003
protocol=org.apache.coyote.http11.Http11AprProtocol
useSendfile=false
connectionTimeout=2
server=Coyote1.1APRw/osendfile
   /

!-- NIO Connector --
Connector  port=8004
protocol=org.apache.coyote.http11.Http11NioProtocol
useSendfile=true
connectionTimeout=2
server=Coyote1.1NIO
   /

!-- APR without sendfile --
Connector  port=8005
protocol=org.apache.coyote.http11.Http11NioProtocol
useSendfile=false
connectionTimeout=2
server=Coyote1.1NIOw/osendfile
   /

All connectors are configured at once, so I should have a maximum of 40
threads in each pool. The command I ran to benchmark each connector was
(for example):

/usr/sbin/ab -c 40 -t 480 -n 1000 http://localhost:8004/4kiB.bin

This runs ApacheBench for 8 minutes with 40 client threads requesting a
4k file over and over again. This particular test succeeded, but there
are 14 more tests, each using a file twice the size of the previous
test. After the 128k file test, every single test fails after that.

The last test I ran (with only 1

Re: Making Apache httpd fallback to local file after receiving 404 from backend Tomcat?

On 20.05.2009 10:52, Imner, Andreas wrote:
 Hi all
 
 I'm setting up a website using Apache webserver 2.2.11 / mod_jk 1.2.28 
 (Windows Server 2000) that connects to two 
 backend Apache Tomcat 6.0.18 server (Windows Server 2003) with load 
 balancing. 
 The webserver also uses mod_proxy to forward some requests to an IIS5 server 
 running on the same server but on a 
 different port. 
 The IIS5 hosts an Episerver 3 installation.
 
 To speed things up, Apache webserver is serving the /images folder used by 
 Episerver using an Alias directive
 
 Alias /images E:/Inetpub/EPiServer3/root/images
 Directory E:/Inetpub/EPiServer3/root/images
   Order deny,allow
   Allow from all
 /Directory
 
 For mod_jk, the uriworkermap.properties -file specifies that all requests to 
 /images/... should be sent to 
 Apache Tomcat since the webapp contains a lot of images with that path
 
 /images/*=wlb
 
 
 Is there some way to achieve any of the following behaviours?:
 
 1.A request for /images/logo.jpg is processed by Apache webserver (This 
 file is located on the Apache webserver, in
   E:/Inetpub/EPiServer3/root/images)
 2.Mod_jk forwards the request to an Apache Tomcat server which returns a 
 404 since logo.jpg does not exist
   on the server
 3.Apache webserver detects this 404 response and fetches logo.jpg from 
 E:/Inetpub/EPiServer3/root/images and returns it
 
 Alternative
 
 1.Same as above
 2.Apache webserver returns logo.jpg from E:/Inetpub/EPiServer3/root/images
 (3.   In the case that logo.jpg is not found in 
 E:/Inetpub/EPiServer3/root/images, an attempt is made to send the request to 
   the Apache Tomcat server using mod_jk)
 
 I have done some research and came accross the mod_jk option 
 ForwardDirectories but it doesnt seem to handle any of the above
 scenarios? It seems more related to directory indexing?! (I'm quite new with 
 Apache Webserver / Apache Tomcat :-) )
 
 Thank you for your attention!

mod_rewrite has a builtin -f flag for does file exist. You can use
it to implement solution 2.

1) Use mod_rewrite to deliver from disk if file exists
2) use mod_rewrite to set the environment variable JK_WORKER_NAME to the
name of the jk worker you want to handle the request in case the file
does not exist. Also set the mod_rewrite PT (pass through) flag in this
case.
3) Do not use an overlapping JkMount. If there is no JkMount for a
request and JK_WORKER_NAME is set, the worker name will be taken from
the variable.

The solution is not easy to understand for administrators, and it is
hard to debug, because you would have to know what was in the file
system at which time to understand what was going on for some request in
the past.

To set it up correctly and debug your setup, use a log file for
mod_rewrite with a high log level. Firs check independently how the -f
in mod_rewrite works, then see how you can use the JK_WORKER_NAME
environment variable and PT, then combine things.

Have fun.

Rainer

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Request entity too large when using SSO (IIS Integrated Windows authentication -Tomcat )

On 20.05.2009 07:20, pappu wrote:
 Chuck,
 
 ---
 
 If by Tomcat 5 you really mean Tomcat 5.0, please be aware that 5.0 has
 not been supported for quite some time.  You do need to move up.
 
 ---
 
 Yes I do mean Tomcat 5.0. The reason why we are having this version is
 because we have Business Objects (Analytics Tool) configured to run on
 tomcat and it only supports for Tomcat 5.0 and Tomcat 5.5. When we did this
 about 3 yrs ago i believe only 5.0 would have been supported.
 
 Could you let me know if there is an option to resolve this error without
 doing the upgrade?

The necessary feature (bigger AJP packet sizes) has been backported to
Tomcat 5.5.

Regards,

Rainer

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Running out of tomcat threads - why many threads in RUNNABLEstage even with no activity

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Vishwajit,

On 5/20/2009 3:01 PM, Pantvaidya, Vishwajit wrote:
 [Pantvaidya, Vishwajit] Ok so RUNNABLE i.e. persistent threads should
 not be an issue. The only reason why I thought that was an issue was
 that I was observing that the none of the RUNNABLE connections were
 not being used to serve new requests, only the WAITING ones were -
 and I do know for sure that the RUNNABLE threads were not servicing
 any existing requests as I was the only one using the system then.

It seems pretty clear that this is what your problem is. See if you can
follow the order of events described below:

1. Tomcat and Apache httpd are started. httpd makes one or more
   (persistent) AJP connections to Tomcat and holds them open (duh).
   Each connection from httpd-Tomcat puts a Java thread in the RUNNABLE
   state (though actually blocked on socket read, it's not really
   runnable)

2. Some requests are received by httpd and sent over the AJP connections
   to Tomcat (or not ... it really doesn't matter)

3. Time passes, your recycle_timeout (300s) or cache_timeout (600s)
   expires

4. A new request comes in to httpd destined for Tomcat. mod_jk dutifully
   follows your instructions for closing the connections expired in #3
   above (note that Tomcat has no idea that the connection has been
   closed, and so those threads remain in the RUNNABLE state, not
   connected to anything, lost forever)

5. A new connection (or multiple new connections... not sure exactly
   how mod_jks connection expiration-and-reconnect logic is done)
   is made to Tomcat which allocates a new thread (or threads)
   which is/are in the RUNNABLE state

Rinse, repeat, your server chokes to death when it runs out of threads.

The above description accounts for your loss of 4 threads at a time:
your web browser requests the initial page followed by 3 other assets
(image, css, whatever). Each one of them hits step #4 above, causing a
new AJP connection to be created, with the old one still hanging around
on the Tomcat side just wasting a thread and memory.

By setting connectionTimeout on the AJP Connector, you are /doing what
you should have done in the first place, which is match mod_jk
cache_timeout with Connector connectionTimeout/. This allows the threads
on the Tomcat side to expire just like those on the httpd side. They
should expire at (virtually) the same time and everything works as expected.

This problem is compounded by your initial configuration which created
10 connections from httpd-Tomcat for every (prefork) httpd process,
resulting in 9 useless AJP connections for every httpd process. I
suspect that you were expiring 10 connections at a time instead of just
one, meaning that you were running out of threads 10 times faster than
you otherwise would.

Suggestions:
1. Tell your ops guys we know what we're talking about
2. Upgrade mod_jk
3. Set connection_pool_size=1, or, better yet, remove the config
   altogether and let mod_jk determine its own value
4. Remove all timeouts unless you know that you have a misbehaving
   firewall. If you do, enable cping/cpong (the preferred strategy
   by at least one author or mod_jk)

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEUEARECAAYFAkoVidEACgkQ9CaO5/Lv0PCzwACYsrhskrNVgJFk6hI1gU+Kkmbe
WQCfTNbSLTgNtHcTbTAu5kw5igicNMw=
=0EWv
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: How to get thread dump on Tomcat 6 (windows)

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Madhu,

On 5/20/2009 1:14 PM, madhu sudhan bandari wrote:
 Thanks for quick response..but in the below URL..it was mentioned that
 jstack is not available on windows platforms
 
 http://java.sun.com/j2se/1.5.0/docs/tooldocs/#debug

You're right. This page also has no mention of jstack:

http://en.wikipedia.org/wiki/Joseph_stalin

...but is just about as relevant.

Instead of looking for documentation that supports your situation, why
no just look at Windows' installed programs list and see if it says
JDK or JRE? Or, better yet, throw out whatever you have and install the JDK?

We're not lying to you. It's really there. I promise.

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkoViooACgkQ9CaO5/Lv0PBBlgCfe/Mp2KFjYu69fEteVs3GEcwN
HsIAninqjncEqmWXt4Xp41Vw6qUVN3uB
=wvWl
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Tomcat, Realm, and context.xml

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Greg,

On 5/20/2009 6:50 AM, Greg Allen wrote:
 However, that exposes a timing issue which I'm not sure how to solve.  
 
 I embedded ApacheDS in my web application by implementing
 ServletContextListener 
 so that it starts on contextInitialized and stops on contextDestroyed -
 when my 
 web application starts and stops..

Heh, that's kind of expected. Are you asking a web application to
authenticate to itself? That's an interesting strategy.

 The problem now is that the application doesn't start until after the
 the context.xml is processed by Tomcat. This ends up with me getting
 errors like this, and my application isn't deployed:
 
  [java] 06:15:14,799 WARN  [[/test]] Exception performing
 authentication
  [java] javax.naming.CommunicationException: localhost:10389 [Root
 exception is java.net.ConnectException: Connection refused: connect]

You're going to want to connect to a separate service (i.e. one not
hosted in your own webapp). You can still run ApacheDS on Tomcat under a
different webapp. And no, you can't specify which webapp gets loaded
first. :(

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkoVi7oACgkQ9CaO5/Lv0PAfpwCfVldHoyP3do5HE3VH94kRHsUo
uJMAniIqD3NViaXFQYNfsa4dnOACLodz
=sR9+
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Problem: JSP works in Firefox but not in Internet Explorer

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Jan,

On 5/19/2009 6:54 PM, Jan Peters wrote:
If you don't include the Flash document embedded in the HTML document,
does MSIE still crash? Try simply using HTML comments to remove it:

!--
embed src= /
- --

unfortunately to no avail.

MSIE still crashes? Even without the .swf download? So... you have a
plain HTML document that can crash MSIE? Cool!

Interesting. So, if you generate an HTML page (say, using Firefox) using
this JSP and then browse it using MSIE, everything is okay? It's only
when you use the JSP dynamically with MSIE that it breaks?

No, it breaks all the time. I do not know what is causing the breaking of IE
which is odd. I tried commenting out the taglib parts, but nothing helped.

What happens if you remove sections of your JSP systematically until you
have nothing left? There must be *some* point at which the browser stops
crashing...

How about an access log instead of the mod_jk one?

ttp://[mysite]/jsp-examples/ct/flamingo-mc_2_0_5/flamingo/flamingo.swf?config=../config/test.xml
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR
2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618)

...looks like the browser is still requesting the .swf file...

j:jscall name=f
url=http://[mysite]/jsp-examples/ct/ClimateConnector.jsp/
j:jscall name=f2
url=http://[mysite]/jsp-examples/ct/ClimateConnectorTemp.jsp/

So, what HTML does this generate? I must admit, I don't understand the
usefulness of this tag library, since you can use jsp:include to do
the same thing if I understand this tag properly. You could also use an
external .js file and call functions in it. shrug

This taglib is capable executing parts of the jsp without reloading
the whole page again. Can you tell me another way of loading the
ClimateConnector.jsp from the page? I just need to execute the jsp with
a query parameter attache id=... to trigger the database query. That
is what the taglib does at the moment.

The parts of the JSP aren't executed... they are imported into your
HTML, which you could probably see if you had posted the generated HTML.
Then your javascript triggers in the generated page do various things.
The taglib itself doesn't cause any requests to occur.

Why do you suspect mod_jk is the problem, here?

Just a guess.

Okay, well, then make your requests directly to Tomcat and see if it
fixes the problem. Does it?

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkoVjfYACgkQ9CaO5/Lv0PCfbQCggyyFMjWlbmE/wGJalUZKI7tv
kzIAoJ5Mxr80OG65GYEZVurmt24hjIAt
=N4kH
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Request entity too large when using SSO (IIS Integrated Windows authentication -Tomcat )

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Pappu,

On 5/20/2009 1:20 AM, pappu wrote:
 Yes I do mean Tomcat 5.0. The reason why we are having this version is
 because we have Business Objects (Analytics Tool) configured to run on
 tomcat and it only supports for Tomcat 5.0 and Tomcat 5.5. When we did this
 about 3 yrs ago i believe only 5.0 would have been supported.

Tomcat 5.5 is still supported by the community. You should be able to
move up to 5.5.27 (the current 5.5.x version) and still be covered for
Business Objects.

 Could you let me know if there is an option to resolve this error without
 doing the upgrade?

Probably not.

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkoVjv8ACgkQ9CaO5/Lv0PAAcQCghOtEUZRe7InvnLscAcWxnEam
Y30AoKL49Gcs49HzsRhzkhE+jd11/bTr
=84M5
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Performance: switch vs if ... else if

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

David,

On 5/19/2009 3:04 PM, David kerber wrote:
 I have a section of code in a frequently-called (~3.5 million times
 per day) servlet where I had to process based on a parameter that
 could take one of 6 different single-character string values.  I had
 been using an if .. else if construct.  Then I discovered that java
 1.5 allowed constructing a switch on strings.  So I did some speed
 testing of a standalone java class that compared the 6-option switch
 that vs my 6-step if/elseif.

I'd be interested to see what the bytecode looks like. Javac compiles
switch statements (using primitives) to one of two bytecodes:
lookupswitch or tableswitch. If you can get the compiler to generate a
tableswitch, your performance will increase dramatically due to the way
the bytecode works.

See
http://java.sun.com/docs/books/jvms/second_edition/html/Compiling.doc.html#14942
for more information on these bytecodes.

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkoVlE4ACgkQ9CaO5/Lv0PDzGgCeKdzJpFmzj8uBhaaC99IpSsky
6mQAoMRbUlgGymISSy9AZe79hstWMInR
=/Zfb
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Performance: switch vs if ... else if

2009-05-21 Thread David kerber


Christopher Schultz wrote:

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

David,

On 5/19/2009 3:04 PM, David kerber wrote:
  

I have a section of code in a frequently-called (~3.5 million times
per day) servlet where I had to process based on a parameter that
could take one of 6 different single-character string values.  I had
been using an if .. else if construct.  Then I discovered that java
1.5 allowed constructing a switch on strings.  So I did some speed
testing of a standalone java class that compared the 6-option switch
that vs my 6-step if/elseif.



I'd be interested to see what the bytecode looks like. Javac compiles
switch statements (using primitives) to one of two bytecodes:
lookupswitch or tableswitch. If you can get the compiler to generate a
tableswitch, your performance will increase dramatically due to the way
the bytecode works.

See
http://java.sun.com/docs/books/jvms/second_edition/html/Compiling.doc.html#14942
for more information on these bytecodes.
  
Interesting.  From that description, depending on how sparse is 
sparse, there's probably a good chance I'm getting a tableswitch.  Can 
you point me to a byte code interpreter so I could look at this?  Or I 
could just send you the .class file of my test class if you'd prefer.


D




-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Running out of tomcat threads - why many threads in RUNNABLEstage even with no activity

2009-05-21 Thread Chetan Chheda

I am following this thread with great interest. I have a similar issue as 
Vishwajit and have resorted to adding the connectionTimeout to get rid of a 
large number of RUNNABLE threads. 

But mod_jk does not like tomcat threads timing out and logs the message 
increase the backend idle connection timeout or
 the connection_pool_minsize in the mod_jk logs

which leads me to believe that its apache thats not letting go of the threads 
in my case. 



From: Christopher Schultz ch...@christopherschultz.net
To: Tomcat Users List users@tomcat.apache.org
Sent: Thursday, May 21, 2009 1:05:21 PM
Subject: Re: Running out of tomcat threads - why many threads in RUNNABLEstage 
even with no activity

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Vishwajit,

On 5/20/2009 3:01 PM, Pantvaidya, Vishwajit wrote:
 [Pantvaidya, Vishwajit] Ok so RUNNABLE i.e. persistent threads should
 not be an issue. The only reason why I thought that was an issue was
 that I was observing that the none of the RUNNABLE connections were
 not being used to serve new requests, only the WAITING ones were -
 and I do know for sure that the RUNNABLE threads were not servicing
 any existing requests as I was the only one using the system then.

It seems pretty clear that this is what your problem is. See if you can
follow the order of events described below:

1. Tomcat and Apache httpd are started. httpd makes one or more
  (persistent) AJP connections to Tomcat and holds them open (duh).
  Each connection from httpd-Tomcat puts a Java thread in the RUNNABLE
  state (though actually blocked on socket read, it's not really
  runnable)

2. Some requests are received by httpd and sent over the AJP connections
  to Tomcat (or not ... it really doesn't matter)

3. Time passes, your recycle_timeout (300s) or cache_timeout (600s)
  expires

4. A new request comes in to httpd destined for Tomcat. mod_jk dutifully
  follows your instructions for closing the connections expired in #3
  above (note that Tomcat has no idea that the connection has been
  closed, and so those threads remain in the RUNNABLE state, not
  connected to anything, lost forever)

5. A new connection (or multiple new connections... not sure exactly
  how mod_jks connection expiration-and-reconnect logic is done)
  is made to Tomcat which allocates a new thread (or threads)
  which is/are in the RUNNABLE state

Rinse, repeat, your server chokes to death when it runs out of threads.

The above description accounts for your loss of 4 threads at a time:
your web browser requests the initial page followed by 3 other assets
(image, css, whatever). Each one of them hits step #4 above, causing a
new AJP connection to be created, with the old one still hanging around
on the Tomcat side just wasting a thread and memory.

By setting connectionTimeout on the AJP Connector, you are /doing what
you should have done in the first place, which is match mod_jk
cache_timeout with Connector connectionTimeout/. This allows the threads
on the Tomcat side to expire just like those on the httpd side. They
should expire at (virtually) the same time and everything works as expected.

This problem is compounded by your initial configuration which created
10 connections from httpd-Tomcat for every (prefork) httpd process,
resulting in 9 useless AJP connections for every httpd process. I
suspect that you were expiring 10 connections at a time instead of just
one, meaning that you were running out of threads 10 times faster than
you otherwise would.

Suggestions:
1. Tell your ops guys we know what we're talking about
2. Upgrade mod_jk
3. Set connection_pool_size=1, or, better yet, remove the config
  altogether and let mod_jk determine its own value
4. Remove all timeouts unless you know that you have a misbehaving
  firewall. If you do, enable cping/cpong (the preferred strategy
  by at least one author or mod_jk)

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEUEARECAAYFAkoVidEACgkQ9CaO5/Lv0PCzwACYsrhskrNVgJFk6hI1gU+Kkmbe
WQCfTNbSLTgNtHcTbTAu5kw5igicNMw=
=0EWv
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

RE: Performance: switch vs if ... else if

 From: David kerber [mailto:dcker...@verizon.net]
 Subject: Re: Performance: switch vs if ... else if

 Can you point me to a byte code interpreter so I could look at this?

The javap tool in the JDK will display the byte codes.  (I use it a lot.)  If 
you want, go ahead and send me the class file via private mail, since the list 
will likely strip attachments.

 - Chuck

THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY 
MATERIAL and is thus for use only by the intended recipient. If you received 
this in error, please contact the sender and delete the e-mail and its 
attachments from all computers.

Re: questions about JNDIRealm and Active Directory

2009-05-21 Thread dahoffer


Did you get this working?  I too have the same need.

BTW, how to you get the error in the output?  I don't see any console or log
errors just failure to login in the browser.

-Dave


maffittd wrote:
 
 I've been reading the tomcat 5.5 doc and searching MARC but still have
 questions about making this work. This seems to come up frequently but I
 have not been able to puzzle out a solution.  Has anyone actually gotten
 tomcat to authenticate with Active Directory (AD)?  I'm worried that the
 configuration options available in the JNDIRealm are insufficient for AD.
 
 The goal is to allow access to users who are a member of the ccir_user
 group in AD.  The error I get (included below) indicates to me that the
 realm never connects to AD.  Is it trying to connect anonymously?  Is it
 trying to connect with juser3's principal name? distinguished name? I can
 connect to AD using JXplorer and juser3's principal name and password. 
 How should I configure JNDIRealm for this situation?
 
 That's a lot of questions but having a thread that answered a complete
 example would help a lot more people than just me.
 
 Thanks for your help.  It  is appreciated!
 
 -Dave
 
 
 Here is the relevant portion of the web.xml:
 
security-role
 
   role-nameccir_user/role-name
 
/security-role
 
 
 
security-constraint
 
   display-nameSecurity Constraint/display-name
 
   web-resource-collection
 
  web-resource-nameProtected Area/web-resource-name
 
  !-- Define the context-relative URL(s) to be protected --
 
  url-pattern/*/url-pattern
 
   /web-resource-collection
 
   auth-constraint
 
  !-- Anyone with one of the listed roles may access this area --
 
  role-nameccir_user/role-name
 
   /auth-constraint
 
 /security-constraint
 
 
 
 !--
 
 login-config
 
   auth-methodBASIC/auth-method
 
 /login-config
 
 --
 
 
 
 login-config
 
   auth-methodFORM/auth-method
 
   realm-nameCCIR Portal/realm-name
 
   form-login-config
 
 form-login-page/login.jsp/form-login-page
 
 form-error-page/loginError.jsp/form-error-page
 
   /form-login-config
 
 /login-config
 
 
 http://tomcat.apache.org/tomcat-5.5-doc/realm-howto.html  indicates that
 setting connectionName and connectionPassword causes tomcat to use
 comparison mode which makes the realm retrieve the password from the
 directory.  From what I can tell, Active Directory does not allow the
 retrieval of its password field, so this option is not available to me.
 
 I'm attempting to configure the realm like this:
 
 
 Realm className=org.apache.catalina.realm.JNDIRealm
 
debug=99
 
connectionURL=ldap://10.252.181.50:389;
 
   
 userPattern=sAMAccountName={0},ou=Users,ou=CCIR,dc=red,dc=ccirdev,dc=mir
 
roleBase=ou=Groups,ou=CCIR,dc=red,dc=ccirdev,dc=mir
 
roleName=cn
 
roleSearch=member={0}
 
 /
 
 I'm confident that connectionURL, userPattern, and roleBase are reasonable
 for my setup.  I'm not at all sure about roleName and roleSearch.
 
 I attempt to login as juser3. I can connect to AD using JXplorer and the
 principal name jus...@red.ccirdev.mirmailto:jus...@red.ccirdev.mir and
 the password.  Here is the corresponding object in AD as displayed by
 JXplorer:
 
 
 cnJeff User3
 
 instanceType  4
 
 nTSecurityDescriptor
 
 objectCategoryCN=Person,CN=Schema,CN=Configuration,DC=ccirdev,DC=mir
 
 objectClass top
 
 objectClass person
 
 objectClass organizationalPerson
 
 objectClass user
 
 accountExpires9223372036854775807
 
 badPasswordTime   128473940593781285
 
 badPwdCount 0
 
 codePage0
 
 company MIR
 
 countryCode 0
 
 department  CCIR
 
 displayName Jeff User3
 
 distinguishedName CN=Jeff User3,OU=Users,OU=CCIR,DC=red,DC=ccirdev,DC=mir
 
 givenName   Jeff
 
 lastLogoff  0
 
 lastLogon   128474750558020052
 
 lastLogonTimestamp  128467468249071167
 
 logonCount  376
 
 mail  jus...@ccir.wustl.edumailto:jus...@ccir.wustl.edu
 
 memberOfCN=ccir_user,OU=Groups,OU=CCIR,DC=red,DC=ccirdev,DC=mir
 
 name  Jeff User3
 
 objectGUID  (non string data)
 
 objectSid   (non string data)
 
 primaryGroupID513
 
 pwdLastSet  128421461731492461
 
 sAMAccountNamejuser3
 
 sAMAccountType805306368
 
 snUser3
 
 telephoneNumber   314-555-1212
 
 userAccountControl  66048
 
 userPrincipalName jus...@red.ccirdev.mirmailto:jus...@red.ccirdev.mir
 
 uSNChanged  90445
 
 uSNCreated  51333
 
 whenChanged 20080213154204.0Z
 
 whenCreated 20071214224933.0Z
 
 
 
 Here is the AD object corresponding to the ccir_user group:
 
 groupType   -2147483646
 
 instanceType  4
 
 nTSecurityDescriptor
 
 objectCategoryCN=Group,CN=Schema,CN=Configuration,DC=ccirdev,DC=mir
 
 objectClass top
 
 objectClass group
 
 cnccir_user
 
 distinguishedName CN=ccir_user,OU=Groups,OU=CCIR,DC=red,DC=ccirdev,DC=mir
 
 member  CN=David

RE: Running out of tomcat threads - why many threads in RUNNABLE stage even with no activity

2009-05-21 Thread Pantvaidya, Vishwajit


 
 1) If you want to analyze your original problem, you need to get back to
 the original situation, i.e. without connectionTimeout. It doesn't make
 much sense to guess about the original problem by looking at something
 very different.

[Pantvaidya, Vishwajit] Yes - I have already initiated that. Expect to be able 
to test the system without connectionTimeout tonight.


 2) The output of netstat and the content of a thread dump change in
 time. If you want to understand the exact relations between the two
 netstat outputs and a thread dump, you need to ensure to produce those
 three things as close in time as possible. I'm talking about seconds not
 milliseconds.

[Pantvaidya, Vishwajit] Yes, I had taken the netstats and the threads dumps 
pretty close together. But I will try and append a timestamp next time I take 
the output.


 3) I think I already indicated that you do not want to look at entries
 in TIME_WAIT state. This state is special and not related to any threads

[Pantvaidya, Vishwajit] My netstat o/p had FIN_WAIT and CLOSE_WAIT, but not 
TIMED_WAIT. Did some reading on TCP states, and seems to me that next time I do 
a netstat (w/o the connTimeout in server.xml), I can ignore processes with all 
these wait states as they seem to just indicate connections in different stages 
of closing.


 4) Firewall idle connection drop: First read
 
 http://tomcat.apache.org/connectors-
 doc/generic_howto/timeouts.html#Firewall%20Connection%20Dropping
 
 carefully and try to understand.
 
 Any mod_jk attribute that takes a booelan value will accept 1, true,
 True, t or T as true, 0, false, False, f or F as false (and maybe even
 more).

[Pantvaidya, Vishwajit] Our workers.props file has most recommended settings:
Worker...type=ajp13
Worker...cachesize=10
Worker...cache_timeout=600
Worker...socket_keepalive=1
Worker...recycle_timeout=300

We are not setting connectionpoolsize and minsize - but from the timeouts doc 
that should be okay as JK auto adjusts to httpd poolsize. So I think only thing 
left is to remove connectionTimeout and test.

Your link recommends connectionTimeouts and JKoption +DisableReuse as a final 
option - I think that will remove persistent connections on httpd and tomcat 
side. For us, the connectionTimeout alone worked. And my netstat o/p showing 11 
conns on http side and only 2 on tomcat side means our http conn's are 
persistent while tomcat ones are not, right?. So I am thinking the perf 
downside should be better than if I had set +DisableReuse also?


 5) Matching port numbers
 
 Usually the port numbers should match. The non matching of the port
 numbers could indicate, that there is a firewall in between, although
 most firewall systems will be transparent to the ports (yes, I know
 there are many variations). Since the port numbers are very close I
 would guess, that the reason for not matching is that netstat was done a
 couple of seconds or more apart, and your connections are only used for
 a very short time, so we have lots of new connections activity.

[Pantvaidya, Vishwajit] Yes - I confirmed from admins that there is a firewall 
and I will work with them to understand that side more. Our connection timeout 
are in the order of 10 mins - so I am not sure why the port#s don't match - 
will try and find if the firewall is having different port# ranges configured 
for httpd  tomcat side.


 6) TCP states
 
 LISTEN on the Tomcat side corresponds to the one TP thread, that does a
 socket accept.
 
 ESTABLISHED: both sides still want to use this connection. On the Tomcat
 side shows up as socketRead0()
 
 CLOSE_WAIT: the other side has closed the connection, the local side
 hasn't yet. E.g. if Tomcat closes the connection because of
 connectionTimeout, but Apache doesn't have a configured idle timeout and
 didn't yet try to reuse the half-closed connection, the connection will
 be shown as CLOSE_WAIT on the httpd side. If Apache closed the
 connection, but Tomcat hasn't noticed yet, it will be CLOSE_WAIT at the
 Tomcat end. In this case it could be also socketRead0() in the thread
 dump.
 
 FIN_WAIT2: most likely the other end of CLOSE_WAIT.

[Pantvaidya, Vishwajit] This is interesting because all the conn's in the 
netstat o/p on httpd and tomcat sides which involved the connector port 21065 
(either in local/foreign addr) were in WAIT states. But I was seeing one 
RUNNABLE thread in socketAccept in the thread console. But anyway I will redo 
this whole thing with the conntimeouts removed and make sure I take the 
netstats and thread dumps in close succession.

 
 7) mod_jk update
 
 Before you start to fix your mod_jk configuration, go to your ops people
 and tell them that they are using a very bad mod_jk version and they
 have to update. The right version to update to is 1.2.28. It does make
 no sense at all to try to fix this with your old version. Solve your
 problem in the right way, by setting much more attributes on the JK side
 than simply the connectionTimeout

Re: questions about JNDIRealm and Active Directory

2009-05-21 Thread Eric Lenio

On Thu, May 21, 2009 at 11:43:44AM -0700, dahoffer wrote:
 
 Did you get this working?  I too have the same need.
 

I'm a bit late to this thread but I can attest it does work, although I am
using Tomcat 6.  You may want to refer to this (apologies if it was already
shared):

http://www.jspwiki.org/wiki/ActiveDirectoryIntegration

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Running out of tomcat threads - why many threads in RUNNABLE stage even with no activity

On 21.05.2009 20:59, Pantvaidya, Vishwajit wrote:
 3) I think I already indicated that you do not want to look at entries
 in TIME_WAIT state. This state is special and not related to any threads
 
 [Pantvaidya, Vishwajit] My netstat o/p had FIN_WAIT and CLOSE_WAIT, but not 
 TIMED_WAIT. Did some reading on TCP states, and seems to me that next time I 
 do a netstat (w/o the connTimeout in server.xml), I can ignore processes with 
 all these wait states as they seem to just indicate connections in different 
 stages of closing.

No, you can not ignore CLOSE_WAIT, FIN_WAIT, FIN_WAIT2 and maybe others.

 4) Firewall idle connection drop: First read

 http://tomcat.apache.org/connectors-
 doc/generic_howto/timeouts.html#Firewall%20Connection%20Dropping

 carefully and try to understand.

 Any mod_jk attribute that takes a booelan value will accept 1, true,
 True, t or T as true, 0, false, False, f or F as false (and maybe even
 more).
 
 [Pantvaidya, Vishwajit] Our workers.props file has most recommended settings:
 Worker...type=ajp13
 Worker...cachesize=10
 Worker...cache_timeout=600
 Worker...socket_keepalive=1
 Worker...recycle_timeout=300

It doesn't make sense for me checking values for attributes that do no
longer exist since a long time.

 We are not setting connectionpoolsize and minsize - but from the timeouts doc 
 that should be okay as JK auto adjusts to httpd poolsize. So I think only 
 thing left is to remove connectionTimeout and test.

No. First cachesize is equivalent to connection pool size. If you want
to get all idle connections closed you will also need the min pool size.
Also important are the cping/cpong features. All that applies to recent
versions.

 Your link recommends connectionTimeouts and JKoption +DisableReuse as a final 
 option - I think that will remove persistent connections on httpd and tomcat 
 side. For us, the connectionTimeout alone worked. And my netstat o/p showing 
 11 conns on http side and only 2 on tomcat side means our http conn's are 
 persistent while tomcat ones are not, right?. So I am thinking the perf 
 downside should be better than if I had set +DisableReuse also?

You would only use DisableReuse if the other configuration options do
not help. Usually they do help, so you won't use DisableReuse.

Regards,

Rainer

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Problem: JSP works in Firefox but not in Internet Explorer

2009-05-21 Thread Jan Peters-Anders


Dear Christopher,
I found the cause for my troubles:

http://support.microsoft.com/kb/927917/en

The taglib uses

document.body.appendChild

which causes IE 7 to crash :( Microsoft states as workaround to upgrade 
to IE 8, that is ironya very good solution/irony


You helped me with your hint:


The parts of the JSP aren't executed... they are imported into your
HTML, which you could probably see if you had posted the generated HTML.
Then your javascript triggers in the generated page do various things.
The taglib itself doesn't cause any requests to occur.
  


bacause I looked at the generated HTML and saw the above stated command. 
I found a forum entry that pointed me to that M$ page. So IE is to 
blame, not my code.


Thanks again, I will have to find another way of doing things, I guess, 
since it is odd to let users encounter this problem and let them be 
annoyed about the website not working.


Jan


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: questions about JNDIRealm and Active Directory

2009-05-21 Thread dahoffer


Thanks that did the trick!

-Dave 


Eric Lenio-2 wrote:
 
 On Thu, May 21, 2009 at 11:43:44AM -0700, dahoffer wrote:
 
 Did you get this working?  I too have the same need.
 
 
 I'm a bit late to this thread but I can attest it does work, although I am
 using Tomcat 6.  You may want to refer to this (apologies if it was
 already
 shared):
 
 http://www.jspwiki.org/wiki/ActiveDirectoryIntegration
 
 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org
 
 
 

-- 
View this message in context: 
http://www.nabble.com/questions-about-JNDIRealm-and-Active-Directory-tp15491143p23660407.html
Sent from the Tomcat - User mailing list archive at Nabble.com.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Upload stop after 30 minutes: Processing of multipart/form-data request failed. Stream ended unexpectedly

2009-05-21 Thread Patrick Herber


Hello,

We have a struts based application running on a Tomcat 6 server sitting 
behind an Apache HTTPD Server.
I'm experiencing problems uploading big files on it: after around 30 
minutes (nearly exactly 30 minutes!) the upload stops.
I've tried to solve them with several combinations but until now I 
didn't find any solution.


In the standard configuration we have Apache HTTPD with mod_ssl 
connected through *mod_proxy_ajp* to the *AJP Connector* of Tomcat.


Apache httpd-ssl.conf:

IfModule mod_proxy_ajp.c
 ProxyRequests Off
 ProxyTimeout 3600
 ProxyPass /error !
 Location / 
   ProxyPass ajp://172.31.252.17:8009/
   ProxyPassReverse ajp://172.31.252.17:8009/
 /Location
/IfModule

Tomcat server.xml file:

Connector port=8009 protocol=AJP/1.3 redirectPort=8443 /

With this configuration I get a *FileUploadBase$IOFileUploadException* 
(*Processing of multipart/form-data request failed. null*) with 
following stacktrace:



org.apache.commons.fileupload.FileUploadBase$IOFileUploadException: 
Processing of multipart/form-data request failed. null
   at 
org.apache.commons.fileupload.FileUploadBase.parseRequest(FileUploadBase.java:367)
   at 
org.apache.commons.fileupload.servlet.ServletFileUpload.parseRequest(ServletFileUpload.java:126)
   at 
ch.arpage.agora.util.MultiPartClassHandler.handleRequest(MultiPartClassHandler.java:220)
   at 
org.apache.struts.util.RequestUtils.populate(RequestUtils.java:442)
   at 
org.apache.struts.action.RequestProcessor.processPopulate(RequestProcessor.java:816)
   at 
org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:203)
   at 
org.apache.struts.action.ActionServlet.process(ActionServlet.java:1196)
   at 
org.apache.struts.action.ActionServlet.doPost(ActionServlet.java:432)

   at javax.servlet.http.HttpServlet.service(HttpServlet.java:637)
   at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
   at 
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
   at 
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
   at 
ch.arpage.agora.util.strip.StripFilter.doFilter(StripFilter.java:82)
   at 
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
   at 
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
   at 
ch.arpage.agora.util.compression.CompressionFilter.doFilter(CompressionFilter.java:116)
   at 
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
   at 
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
   at 
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
   at 
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
   at 
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
   at 
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
   at 
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
   at 
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286)
   at 
org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190)
   at 
org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283)

   at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767)
   at 
org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697)
   at 
org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889)
   at 
org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690)

   at java.lang.Thread.run(Thread.java:595)
Caused by: java.io.IOException
   at 
org.apache.jk.common.JkInputStream.receive(JkInputStream.java:199)
   at 
org.apache.jk.common.JkInputStream.refillReadBuffer(JkInputStream.java:258)

   at org.apache.jk.common.JkInputStream.doRead(JkInputStream.java:177)
   at org.apache.coyote.Request.doRead(Request.java:428)
   at 
org.apache.catalina.connector.InputBuffer.realReadBytes(InputBuffer.java:304)
   at 
org.apache.tomcat.util.buf.ByteChunk.substract(ByteChunk.java:405)
   at 
org.apache.catalina.connector.InputBuffer.read(InputBuffer.java:327)
   at 
org.apache.catalina.connector.CoyoteInputStream.read(CoyoteInputStream.java:193)
   at 
org.apache.commons.fileupload.MultipartStream$ItemInputStream.makeAvailable(MultipartStream.java:977)
   at 
org.apache.commons.fileupload.MultipartStream$ItemInputStream.read(MultipartStream.java:887)

   at java.io.InputStream.read(InputStream.java:89)
   at org.apache.commons.fileupload.util.Streams.copy(Streams.java:94)
   at org.apache.commons.fileupload.util.Streams.copy(Streams.java:64)
   at

Re: xml validation on -- good idea or not?

2009-05-21 Thread Julian Dunn

I'm tempted to say that it should be removed if it's unstable. I don't
know that much about the guts of Tomcat but we've seen errors thrown by
some of those classes in the commits.

Thanks for your advice on the matter. I think we'll run with
xmlValidation=false from now on.

- Julian

 Mark Thomas ma...@apache.org 5/21/2009 3:51 AM 
Bill Barker wrote:
 Julian Dunn julian.d...@cbc.ca wrote in message 
 news:4a14199c.4caf.003...@cbc.ca...
 Hi,

 Is it a good idea to run with xmlValidation=true in server.xml?

 
 In a development enviroment, it can be helpful (especially if you
change 
 web.xml often).  I would generally discurage it in a production
environment 
 since the app will take slightly longer to load.
 
 I had this on for a while, but then it mysteriously stopped working
--
 the container could no longer validate DTDs, refused to load
webapps,
 etc.

 
 And another good reason to not use it in production ;).
 
 What does xmlValidation=true actually do?

 
 Xie is basically right, except that Tomcat *should* be using the
schemas 
 that it ships with.  So not having an internet connection is not
supposed to 
 be a problem.

It is worth noting that there are a bunch of issues with validation in
6.0.x and, I suspect, 5.5.x as well. See:

http://svn.apache.org/viewvc?rev=751502view=rev 
http://svn.apache.org/viewvc?rev=752589view=rev 
http://svn.apache.org/viewvc?rev=752584view=rev 
http://svn.apache.org/viewvc?rev=753035view=rev 
http://svn.apache.org/viewvc?rev=753036view=rev 

Given that it has been broken for all of 6.0.x, I was debating
removing
xml validation completely in Tomcat 7. I'd be interested in any views
people have on this.

Mark


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org 
For additional commands, e-mail: users-h...@tomcat.apache.org

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Configuring SSI in tomcat 6

2009-05-21 Thread raghu ram srinivas

Hi All,
Can anyone help me configuring the Server Side Include (SSI) in Tomcat 6.

For enabling SSI I removed the commented blocks in the web.xml for SSI too
but still i am not able to find.

I tried in the google search but I am not able to get the exact answer, can
anyone give me some suggestions.

-- 
Raghuram Srinivas

RE: Upload stop after 30 minutes: Processing of multipart/form-data requestfailed. Stream ended unexpectedly

 From: Patrick Herber [mailto:patrick.her...@ticino.com]
 Subject: Upload stop after 30 minutes: Processing of multipart/form-
 data requestfailed. Stream ended unexpectedly

 I'm experiencing problems uploading big files on it: after around 30
 minutes (nearly exactly 30 minutes!) the upload stops.

What happens if you go directly into port 8080, bypassing httpd?

I realize it shouldn't have anything to do with the session timeout (and your 
AJAX requests should be resetting the timer), but that's the only thing I can 
think of in Tomcat that has a default value of 30 minutes.  Just for grins, 
what happens if you change that to 60?  Or 10?

Is there anything in between httpd and Tomcat (e.g., firewall) that might be 
dropping the connection?

 - Chuck

THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY 
MATERIAL and is thus for use only by the intended recipient. If you received 
this in error, please contact the sender and delete the e-mail and its 
attachments from all computers.

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

RE: Running out of tomcat threads - why many threads in RUNNABLEstage even with no activity

2009-05-21 Thread Pantvaidya, Vishwajit

-Original Message-
From: Christopher Schultz [mailto:ch...@christopherschultz.net]
Sent: Thursday, May 21, 2009 10:05 AM
To: Tomcat Users List
Subject: Re: Running out of tomcat threads - why many threads in
RUNNABLEstage even with no activity

Vishwajit,

On 5/20/2009 3:01 PM, Pantvaidya, Vishwajit wrote:
[Pantvaidya, Vishwajit] Ok so RUNNABLE i.e. persistent threads should
not be an issue. The only reason why I thought that was an issue was
that I was observing that the none of the RUNNABLE connections were
not being used to serve new requests, only the WAITING ones were -
and I do know for sure that the RUNNABLE threads were not servicing
any existing requests as I was the only one using the system then.

It seems pretty clear that this is what your problem is. See if you can
follow the order of events described below:

1. Tomcat and Apache httpd are started. httpd makes one or more
(persistent) AJP connections to Tomcat and holds them open (duh).
Each connection from httpd-Tomcat puts a Java thread in the RUNNABLE
state (though actually blocked on socket read, it's not really
runnable)

2. Some requests are received by httpd and sent over the AJP connections
to Tomcat (or not ... it really doesn't matter)

3. Time passes, your recycle_timeout (300s) or cache_timeout (600s)
expires

4. A new request comes in to httpd destined for Tomcat. mod_jk dutifully
follows your instructions for closing the connections expired in #3
above (note that Tomcat has no idea that the connection has been
closed, and so those threads remain in the RUNNABLE state, not
connected to anything, lost forever)

5. A new connection (or multiple new connections... not sure exactly
how mod_jks connection expiration-and-reconnect logic is done)
is made to Tomcat which allocates a new thread (or threads)
which is/are in the RUNNABLE state

Rinse, repeat, your server chokes to death when it runs out of threads.

The above description accounts for your loss of 4 threads at a time:
your web browser requests the initial page followed by 3 other assets
(image, css, whatever). Each one of them hits step #4 above, causing a
new AJP connection to be created, with the old one still hanging around
on the Tomcat side just wasting a thread and memory.

By setting connectionTimeout on the AJP Connector, you are /doing what
you should have done in the first place, which is match mod_jk
cache_timeout with Connector connectionTimeout/. This allows the threads
on the Tomcat side to expire just like those on the httpd side. They
should expire at (virtually) the same time and everything works as
expected.

[Pantvaidya, Vishwajit] Thanks Chris - all this makes a lot of sense. However I
am not seeing same problem (tomcat running out of threads) on other servers
which are running exactly same configuration except that in those cases is no
firewall separating websvr and tomcat. Here are the figures of RUNNABLE on 3
different tomcat server running same config:

1. Firewall between httpd and tomcat - 120 threads, 112 runnable (93%)
2. No firewall between httpd and tomcat - 40 threads, 11 runnable (27%)
3. No firewall between httpd and tomcat - 48 threads, 2 runnable (4%)

Leads me to believe there is some firewall related mischief happening with #1.

This problem is compounded by your initial configuration which created
10 connections from httpd-Tomcat for every (prefork) httpd process,
resulting in 9 useless AJP connections for every httpd process. I
suspect that you were expiring 10 connections at a time instead of just
one, meaning that you were running out of threads 10 times faster than
you otherwise would.

[Pantvaidya, Vishwajit] I did not note connections expiring in multiple of 10.
But I will keep an eye out for this. However from the cachesize explanation at
http://tomcat.apache.org/connectors-doc/reference/workers.html#Deprecated%20Worker%20Directives
I get the impression that this value imposes an upper limit - meaning it may
not necessarily create 10 tomcat/jk connections for an httpd child process

Suggestions:
1. Tell your ops guys we know what we're talking about
2. Upgrade mod_jk
3. Set connection_pool_size=1, or, better yet, remove the config
altogether and let mod_jk determine its own value
4. Remove all timeouts unless you know that you have a misbehaving
firewall. If you do, enable cping/cpong (the preferred strategy
by at least one author or mod_jk)

- -chris

[Pantvaidya, Vishwajit] I will set
- cachesize=1 (doc says jk will autoset this value only for worker-mpm and we
use httpd 2.0 prefork)
- remove cache and recycle timeouts

But before all this, I will retest after removing connectionTimeout in
server.xml - just to test if there are firewall caused issues as mentioned
above.

-
To unsubscribe, e-mail:

Re: Running out of tomcat threads - why many threads in RUNNABLEstage even with no activity

On 22.05.2009 00:19, Pantvaidya, Vishwajit wrote:
 [Pantvaidya, Vishwajit] I will set
 - cachesize=1 (doc says jk will autoset this value only for worker-mpm and we 
 use httpd 2.0 prefork)

You don't have to: JK will discover this number for the Apache web
server automatically and set the pool size to this value.

 -  remove cache and recycle timeouts

Chris and me are not having the same opinion here. You can choose :)

 But before all this, I will retest after removing connectionTimeout in 
 server.xml - just to test if there are firewall caused issues as mentioned 
 above.

Regards,

Rainer

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

tomcat Access logs

2009-05-21 Thread Vijay

Hi,
I am using a tomcat tailer which needs the file name to be the same and not
changinging (Dont want to see the Date in the file name). hence i want a
solution to have the logs rotated as well as the file name of the active log
files to remain the same Do we have a solution like it?

When i search in the internet i found logrotate copytruncate option
available, can we use this? whats the implication? do you guys recommend it?

Regards,
/VJ

RE: xml validation on -- good idea or not?

2009-05-21 Thread Martin Gainty

if alternate algorithm can be made to define and require elements
ELEMENT web-app , ELEMENT auth-constraint, ELEMENT auth-method within deployed
web.xml then
1)remove all DTD's and remove the flag

or
2)keep the DTDs and enable the flag

?
Martin Gainty
__
Verzicht und Vertraulichkeitanmerkung/Note de déni et de confidentialité

Diese Nachricht ist vertraulich. Sollten Sie nicht der vorgesehene Empfaenger
sein, so bitten wir hoeflich um eine Mitteilung. Jede unbefugte Weiterleitung
oder Fertigung einer Kopie ist unzulaessig. Diese Nachricht dient lediglich dem
Austausch von Informationen und entfaltet keine rechtliche Bindungswirkung.
Aufgrund der leichten Manipulierbarkeit von E-Mails koennen wir keine Haftung
fuer den Inhalt uebernehmen.
Ce message est confidentiel et peut être privilégié. Si vous n'êtes pas le
destinataire prévu, nous te demandons avec bonté que pour satisfaire informez
l'expéditeur. N'importe quelle diffusion non autorisée ou la copie de ceci est
interdite. Ce message sert à l'information seulement et n'aura pas n'importe
quel effet légalement obligatoire. Étant donné que les email peuvent facilement
être sujets à la manipulation, nous ne pouvons accepter aucune responsabilité
pour le contenu fourni.

Date: Thu, 21 May 2009 17:42:37 -0400
From: julian.d...@cbc.ca
To: users@tomcat.apache.org
Subject: Re: xml validation on -- good idea or not?

I'm tempted to say that it should be removed if it's unstable. I don't
know that much about the guts of Tomcat but we've seen errors thrown by
some of those classes in the commits.

Thanks for your advice on the matter. I think we'll run with
xmlValidation=false from now on.

- Julian

Mark Thomas ma...@apache.org 5/21/2009 3:51 AM
Bill Barker wrote:
Julian Dunn julian.d...@cbc.ca wrote in message
news:4a14199c.4caf.003...@cbc.ca...
Hi,

Is it a good idea to run with xmlValidation=true in server.xml?

In a development enviroment, it can be helpful (especially if you
change
web.xml often). I would generally discurage it in a production
environment
since the app will take slightly longer to load.

I had this on for a while, but then it mysteriously stopped working
--
the container could no longer validate DTDs, refused to load
webapps,
etc.

And another good reason to not use it in production ;).

What does xmlValidation=true actually do?

Xie is basically right, except that Tomcat *should* be using the
schemas
that it ships with. So not having an internet connection is not
supposed to
be a problem.

It is worth noting that there are a bunch of issues with validation in
6.0.x and, I suspect, 5.5.x as well. See:

http://svn.apache.org/viewvc?rev=751502view=rev
http://svn.apache.org/viewvc?rev=752589view=rev
http://svn.apache.org/viewvc?rev=752584view=rev
http://svn.apache.org/viewvc?rev=753035view=rev
http://svn.apache.org/viewvc?rev=753036view=rev

Given that it has been broken for all of 6.0.x, I was debating
removing
xml validation completely in Tomcat 7. I'd be interested in any views
people have on this.

Mark

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

_
Hotmail® goes with you.
http://windowslive.com/Tutorial/Hotmail/Mobile?ocid=TXT_TAGLM_WL_HM_Tutorial_Mobile1_052009

RE: Problem: JSP works in Firefox but not in Internet Explorer

2009-05-21 Thread Martin Gainty


Microsoft says you are putting script not in body but in td (Table Data) 
element e.g.
html
  body
  table
tr
 td
 script type=text/Javascript
  var d = 
document.createElement('div');
  document.body.appendChild(d);
 /script
 /td
 /tr
  /table
  /body
 /html
solution is to place the script outside the table to modify the body as seen 
here
 html
  body
  table
tr
td
   /td
 /tr
  /table
  script type=text/Javascript
  var d = document.createElement('div');
  document.body.appendChild(d);
 /script
  /body
 /html
!-- makes sense since you are modifying the body instead of the td element --

does this conform to your IE implementation?
Martin 
__ 
Jogi és Bizalmassági kinyilatkoztatás/Verzicht und 
Vertraulichkeitanmerkung/Note de déni et de confidentialité
 Ez az
üzenet bizalmas.  Ha nem ön az akinek szánva volt, akkor kérjük, hogy
jelentse azt nekünk vissza. Semmiféle továbbítása vagy másolatának
készítése nem megengedett.  Ez az üzenet csak ismeret cserét szolgál és
semmiféle jogi alkalmazhatósága sincs.  Mivel az electronikus üzenetek
könnyen megváltoztathatóak, ezért minket semmi felelöség nem terhelhet
ezen üzenet tartalma miatt.

Diese Nachricht ist vertraulich. Sollten Sie nicht der vorgesehene Empfaenger 
sein, so bitten wir hoeflich um eine Mitteilung. Jede unbefugte Weiterleitung 
oder Fertigung einer Kopie ist unzulaessig. Diese Nachricht dient lediglich dem 
Austausch von Informationen und entfaltet keine rechtliche Bindungswirkung. 
Aufgrund der leichten Manipulierbarkeit von E-Mails koennen wir keine Haftung 
fuer den Inhalt uebernehmen.
Ce message est confidentiel et peut être privilégié. Si vous n'êtes pas le 
destinataire prévu, nous te demandons avec bonté que pour satisfaire informez 
l'expéditeur. N'importe quelle diffusion non autorisée ou la copie de ceci est 
interdite. Ce message sert à l'information seulement et n'aura pas n'importe 
quel effet légalement obligatoire. Étant donné que les email peuvent facilement 
être sujets à la manipulation, nous ne pouvons accepter aucune responsabilité 
pour le contenu fourni.




 Date: Thu, 21 May 2009 22:51:06 +0200
 From: peters...@gmx.at
 To: users@tomcat.apache.org
 Subject: Re: Problem: JSP works in Firefox but not in Internet Explorer
 
 Dear Christopher,
 I found the cause for my troubles:
 
 http://support.microsoft.com/kb/927917/en
 
 The taglib uses
 
 document.body.appendChild
 
 which causes IE 7 to crash :( Microsoft states as workaround to upgrade 
 to IE 8, that is ironya very good solution/irony
 
 You helped me with your hint:
 
  The parts of the JSP aren't executed... they are imported into your
  HTML, which you could probably see if you had posted the generated HTML.
  Then your javascript triggers in the generated page do various things.
  The taglib itself doesn't cause any requests to occur.

 
 bacause I looked at the generated HTML and saw the above stated command. 
 I found a forum entry that pointed me to that M$ page. So IE is to 
 blame, not my code.
 
 Thanks again, I will have to find another way of doing things, I guess, 
 since it is odd to let users encounter this problem and let them be 
 annoyed about the website not working.
 
 Jan
 
 
 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org
 

_
Windows Live™: Keep your life in sync.
http://windowslive.com/explore?ocid=TXT_TAGLM_BR_life_in_synch_052009

RE: Configuring SSI in tomcat 6

2009-05-21 Thread Martin Gainty

any direction provided would be based on implementing SSI either thru Servlet
OR Filter specifically

Servlet based SSI support is implemented using the class
org.apache.catalina.ssi.SSIServlet. Traditionally, this servlet
is mapped to the URL pattern *.shtml.

Filter based SSI support is implemented using the class
org.apache.catalina.ssi.SSIFilter.

i would suggest reading this rather Extensive tutorial available at
http://www.mbaworld.com/docs/ssi-howto.html

hth
Martin
__
Verzicht und Vertraulichkeitanmerkung/Note de déni et de confidentialité

Date: Thu, 21 May 2009 17:55:44 -0400
Subject: Configuring SSI in tomcat 6
From: raghuramsriniv...@gmail.com
To: users@tomcat.apache.org

Hi All,
Can anyone help me configuring the Server Side Include (SSI) in Tomcat 6.

For enabling SSI I removed the commented blocks in the web.xml for SSI too
but still i am not able to find.

I tried in the google search but I am not able to get the exact answer, can
anyone give me some suggestions.

--
Raghuram Srinivas

_
Hotmail® goes with you.
http://windowslive.com/Tutorial/Hotmail/Mobile?ocid=TXT_TAGLM_WL_HM_Tutorial_Mobile1_052009

SSI configuration

2009-05-21 Thread Ken Bowen


Hi all,

I need to turn on SSI to host a simple html site which uses it.
I shut down TC.
In ~conf/web.xml, I uncommented both the servlet and servlet-mapping  
XML for ssi.  However, when I restarted TC, I get the following  
Exception for every application present in webapps (this one is for  
docs):


May 21, 2009 9:31:58 PM org.apache.catalina.startup.HostConfig  
deployDirectory

SEVERE: Error deploying web application directory docs
java.lang.SecurityException: Servlet of class  
org.apache.catalina.ssi.SSIServlet is privileged and cannot be loaded  
by this web application
	at  
org 
.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java: 
1145)
	at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java: 
992)
	at  
org 
.apache 
.catalina.core.StandardContext.loadOnStartup(StandardContext.java:4058)
	at  
org.apache.catalina.core.StandardContext.start(StandardContext.java: 
4371)
	at  
org 
.apache 
.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:791)
	at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java: 
771)
	at org.apache.catalina.core.StandardHost.addChild(StandardHost.java: 
525)
	at  
org.apache.catalina.startup.HostConfig.deployDirectory(HostConfig.java: 
926)
	at  
org 
.apache.catalina.startup.HostConfig.deployDirectories(HostConfig.java: 
889)
	at org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java: 
492)

at org.apache.catalina.startup.HostConfig.start(HostConfig.java:1149)
	at  
org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java: 
311)
	at  
org 
.apache 
.catalina 
.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:117)
	at org.apache.catalina.core.ContainerBase.start(ContainerBase.java: 
1053)

at org.apache.catalina.core.StandardHost.start(StandardHost.java:719)
	at org.apache.catalina.core.ContainerBase.start(ContainerBase.java: 
1045)
	at org.apache.catalina.core.StandardEngine.start(StandardEngine.java: 
443)
	at  
org.apache.catalina.core.StandardService.start(StandardService.java:516)
	at org.apache.catalina.core.StandardServer.start(StandardServer.java: 
710)

at org.apache.catalina.startup.Catalina.start(Catalina.java:578)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at  
sun 
.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java: 
39)
	at  
sun 
.reflect 
.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java: 
25)

at java.lang.reflect.Method.invoke(Method.java:585)
at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:288)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)

How do I remedy this?
TIA,
Ken

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

RE: Running out of tomcat threads - why many threads in RUNNABLEstage even with no activity

2009-05-21 Thread Pantvaidya, Vishwajit

 -Original Message-
 From: Rainer Jung [mailto:rainer.j...@kippdata.de]
 Sent: Thursday, May 21, 2009 3:37 PM
 To: Tomcat Users List
 Subject: Re: Running out of tomcat threads - why many threads in
 RUNNABLEstage even with no activity

 On 22.05.2009 00:19, Pantvaidya, Vishwajit wrote:
  [Pantvaidya, Vishwajit] I will set
  - cachesize=1 (doc says jk will autoset this value only for worker-mpm
 and we use httpd 2.0 prefork)

 You don't have to: JK will discover this number for the Apache web
 server automatically and set the pool size to this value.

[Pantvaidya, Vishwajit] Does what you say hold true for jk 1.2.15 also? Because 
I saw that for the 1.2.15 cachesize directive, 
http://tomcat.apache.org/connectors-doc/reference/workers.html#Deprecated%20Worker%20Directives
 says that JK will discover the number of threads per child process on Apache 
2 web server with worker-mpm and set its default value to match the 
ThreadsPerChild Apache directive.. Since we use pre-fork MPM, I assumed we 
need to set cachesize.

  -  remove cache and recycle timeouts

 Chris and me are not having the same opinion here. You can choose :)

[Pantvaidya, Vishwajit] I think that may be only because my adding the 
connectionTimeout led you to believe that I wanted nonpersistent conn's. Now 
that I know persistent connections are better, I am trying to rollback 
connectionTimeout - and then I guess you will agree with Chris that I need to 
rollback the recycletimeouts, etc in workers file on httpd side also?

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Apache 2.2 to Tomcat 6 via proxy_ajp

2009-05-21 Thread J. Zimmerman

I am just getting started with Tomcat and have been asked to take on the
administration of our Tomcat servers at our college.  I am not one of the
developers, just the administrator.  So far everything has gone pretty
smoothly except for getting everything to run proxied via Apache (at least
the way we would like it).

Our requirement is for Tomcat to deliver the application through
http://hostname:8080/appname and/or ajp://hostname:8009/appname.  This
happens by default and works well.  However, we want end users to access the
applications via port 443 or 80 and we are doing this via Apache.  I can
make this work via proxy_ajp and proxy_http so that something like
http://hostname/appname works just fine.

The wrench in the works is that we want to do virtual hosting through Apache
and not have the appname appended to it.  The Apache virtual hosted URL's
will be the ones exposed to the public.

For example if we developed an application called mycoolapp and we were
deploying it at a website of the same name we would want the application to
run at http://mycoolapp.com and not http://mycoolapp.com/mycoolapp.

I have hacked together several different configs suggested through many
different pieces of documentation and forums, but just can't seem to get it.

Our setup is as follows.

Server: Ubuntu 8.04 (all updates)
Java: Latest JDK download from Sun
Tomcat: Latest version 6 official download (configs are near defaults, I
have revereted to the default server.xml)
Apache: Latest version 2.2 via Ubuntu repositories.  proxy_ajp, proxy_http,
and rewrite enabled.

If anyone has suggestions or a working example any help is greatly
appreciated.

Re: mod_proxy, Tomcat and request URL

2009-05-21 Thread Andre-John Mas



On 21-May-2009, at 12:32, Rainer Jung wrote:


On 20.05.2009 17:33, Markus Schönhaber wrote:

Andre-John Mas:


this is not the ideal setup, I don't have any control over this. At
the same time I see that using mod_proxy, by way of ProxyPass, means
that the Tomcat server does not know what hostname was used to  
access

the Apache server, instead getting http://localhost:8080/ . Is there
any way, probably via configuration of Apache, that this could be
passed to the Tomcat? I looked for information on this, but I could
not find any.


Instead of mod_proxy_http, I use mod_proxy_ajp. AJP passes the  
client's

IP through.


On 20.05.2009 16:59, Caldarale, Charles R wrote:

Aren't the X-Forwarded-For and X-Forwarded-Host headers being set by

mod_proxy?  The doc indicates they should be:

http://httpd.apache.org/docs/2.2/mod/mod_proxy.html


.. and finally there's ProxyPreserveHost.


That's one option I missed.

Is there any way to know whether Apache was contacted using HTTPS or
HTTP, on the Tomcat side?


If yo want to get an idea, which other traps are to avoid when using a
reverse proxy, you can also look at

http://tomcat.apache.org/connectors-doc/generic_howto/proxy.html


I would love to go with AJP, but due to a very conservative customer,
this is not an option we can look at. The other points on the page
with regards to URL rewriting seem of interest, though the idea is
to try to remove assumptions to what name the client is accessing
the host by. The reason is so when we move from dev to integration
to production, this is one less thing to keep track of.

André-John


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Configuring SSI in tomcat 6

2009-05-21 Thread raghu ram srinivas

Thanks for your reply. I tried it by uncommenting SSI servlet but I am
getting the following error:
java.lang.SecurityException: Servlet of class
org.apache.catalina.ssi.SSIServlet is privileged and cannot be loaded by
this web application

Can you give any idea regarding this. I am trying to figure it out from
couple of days. the main thing is We are planning to migrate our application
from iPlanet 4.1 to Apache Tomcat 6.

In iplanet we used extensively SSI.

Any suggestions would be greatly appreciated.

Thanks in Advance

On Thu, May 21, 2009 at 9:06 PM, Martin Gainty mgai...@hotmail.com wrote:

any direction provided would be based on implementing SSI either thru
Servlet OR Filter specifically

Servlet based SSI support is implemented using the class
org.apache.catalina.ssi.SSIServlet. Traditionally, this servlet
is mapped to the URL pattern *.shtml.

Filter based SSI support is implemented using the class
org.apache.catalina.ssi.SSIFilter.

i would suggest reading this rather Extensive tutorial available at
http://www.mbaworld.com/docs/ssi-howto.html

hth
Martin
__
Verzicht und Vertraulichkeitanmerkung/Note de déni et de confidentialité

Diese Nachricht ist vertraulich. Sollten Sie nicht der vorgesehene
Empfaenger sein, so bitten wir hoeflich um eine Mitteilung. Jede unbefugte
Weiterleitung oder Fertigung einer Kopie ist unzulaessig. Diese Nachricht
dient lediglich dem Austausch von Informationen und entfaltet keine
rechtliche Bindungswirkung. Aufgrund der leichten Manipulierbarkeit von
E-Mails koennen wir keine Haftung fuer den Inhalt uebernehmen.
Ce message est confidentiel et peut être privilégié. Si vous n'êtes pas le
destinataire prévu, nous te demandons avec bonté que pour satisfaire
informez l'expéditeur. N'importe quelle diffusion non autorisée ou la copie
de ceci est interdite. Ce message sert à l'information seulement et n'aura
pas n'importe quel effet légalement obligatoire. Étant donné que les email
peuvent facilement être sujets à la manipulation, nous ne pouvons accepter
aucune responsabilité pour le contenu fourni.

Date: Thu, 21 May 2009 17:55:44 -0400
Subject: Configuring SSI in tomcat 6
From: raghuramsriniv...@gmail.com
To: users@tomcat.apache.org

Hi All,
Can anyone help me configuring the Server Side Include (SSI) in Tomcat 6.

For enabling SSI I removed the commented blocks in the web.xml for SSI
too
but still i am not able to find.

I tried in the google search but I am not able to get the exact answer,
can
anyone give me some suggestions.

--
Raghuram Srinivas

_
Hotmail® goes with you.

http://windowslive.com/Tutorial/Hotmail/Mobile?ocid=TXT_TAGLM_WL_HM_Tutorial_Mobile1_052009

--
Raghuram Srinivas

Re: SSI configuration

2009-05-21 Thread raghu ram srinivas

I am getting the same error.any suggestion please.

On Thu, May 21, 2009 at 9:38 PM, Ken Bowen kbo...@als.com wrote:

 Hi all,

 I need to turn on SSI to host a simple html site which uses it.
 I shut down TC.
 In ~conf/web.xml, I uncommented both the servlet and servlet-mapping XML
 for ssi.  However, when I restarted TC, I get the following Exception for
 every application present in webapps (this one is for docs):

 May 21, 2009 9:31:58 PM org.apache.catalina.startup.HostConfig
 deployDirectory
 SEVERE: Error deploying web application directory docs
 java.lang.SecurityException: Servlet of class
 org.apache.catalina.ssi.SSIServlet is privileged and cannot be loaded by
 this web application
at
 org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1145)
at
 org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:992)
at
 org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:4058)
at
 org.apache.catalina.core.StandardContext.start(StandardContext.java:4371)
at
 org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:791)
at
 org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:771)
at
 org.apache.catalina.core.StandardHost.addChild(StandardHost.java:525)
at
 org.apache.catalina.startup.HostConfig.deployDirectory(HostConfig.java:926)
at
 org.apache.catalina.startup.HostConfig.deployDirectories(HostConfig.java:889)
at
 org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:492)
at
 org.apache.catalina.startup.HostConfig.start(HostConfig.java:1149)
at
 org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:311)
at
 org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:117)
at
 org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1053)
at
 org.apache.catalina.core.StandardHost.start(StandardHost.java:719)
at
 org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1045)
at
 org.apache.catalina.core.StandardEngine.start(StandardEngine.java:443)
at
 org.apache.catalina.core.StandardService.start(StandardService.java:516)
at
 org.apache.catalina.core.StandardServer.start(StandardServer.java:710)
at org.apache.catalina.startup.Catalina.start(Catalina.java:578)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
 sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at
 sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:585)
at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:288)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)

 How do I remedy this?
 TIA,
 Ken

 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org




-- 
Raghuram Srinivas

RE: Configuring SSI in tomcat 6

 From: raghu ram srinivas [mailto:raghuramsriniv...@gmail.com]
 Subject: Re: Configuring SSI in tomcat 6

 java.lang.SecurityException: Servlet of class
 org.apache.catalina.ssi.SSIServlet is privileged and cannot be loaded
 by this web application

Read the Tomcat SSI doc:
http://tomcat.apache.org/tomcat-6.0-doc/ssi-howto.html#Installation

Note especially: Only Contexts which are marked as privileged may use SSI 
features (see the privileged property of the Context element).

You must mark your webapp that wishes to use SSI as privileged in its Context 
element.

 - Chuck

THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY 
MATERIAL and is thus for use only by the intended recipient. If you received 
this in error, please contact the sender and delete the e-mail and its 
attachments from all computers.

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

RE: SSI configuration

 From: Ken Bowen [mailto:kbo...@als.com]
 Subject: SSI configuration

 May 21, 2009 9:31:58 PM org.apache.catalina.startup.HostConfig
 deployDirectory
 SEVERE: Error deploying web application directory docs
 java.lang.SecurityException: Servlet of class
 org.apache.catalina.ssi.SSIServlet is privileged and cannot be loaded
 by this web application

Read the Tomcat SSI doc:
http://tomcat.apache.org/tomcat-6.0-doc/ssi-howto.html#Installation

Note especially: Only Contexts which are marked as privileged may use SSI 
features (see the privileged property of the Context element).

You must mark your webapp that wishes to use SSI as privileged in its Context 
element.  Unless you want to mark all of your webapps as privileged, do not 
uncomment the SSI servlet in the global conf/web.xml; instead, place the SSI 
servlet definition and mappings to the WEB-INF/web.xml of the webapps that need 
to use SSI.

 - Chuck

THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY 
MATERIAL and is thus for use only by the intended recipient. If you received 
this in error, please contact the sender and delete the e-mail and its 
attachments from all computers.

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

RE: Apache 2.2 to Tomcat 6 via proxy_ajp