[ANN] Apache Tomcat 7.0.21 released

2011-09-02 Thread Mark Thomas
The Apache Tomcat team announces the immediate availability of Apache
Tomcat 7.0.21

Apache Tomcat 7.0.21 includes security fixes, bug fixes and new features
compared to version 7.0.20 including:
- A fix for CVE-2011-3190 that allowed an attacker to inject requests
when Tomcat was configured behind a reverse proxy using the AJP protocol.
- Multiple additions and improvements to the memory leak
detection/prevention features.
- Improved validation of received AJP messages.

Please refer to the change log for the complete list of changes:
http://tomcat.apache.org/tomcat-7.0-doc/changelog.html

Note that this version has 4 zip binaries: a generic one and three
bundled with Tomcat native binaries for Windows operating systems
running on different CPU architectures.

Downloads:
http://tomcat.apache.org/download-70.cgi

Migration guide from Apache Tomcat 5.5.x and 6.0.x:
http://tomcat.apache.org/migration.html

Thank you,

-- The Apache Tomcat Team







-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Http11NioProtocol; socketCloseDelay

2011-09-02 Thread Mark Thomas
On 02/09/2011 01:21, Chris Burroughs wrote:
 In tomcat 6 Http11NioProtocol defines a socketCloseDelay field.  But as
 far as I and grep can tell it is not used anywhere [1].  Is this field
 supposed to be doing something?

Not that I can tell. It looks to be have been present in the NIO
connector since it was created but I can find no evidence of it ever
being used or documented. There was an attribute with that name back in
Tomcat 3 but that was before my time with the project.

I'll remove it from trunk and 7.0.x.

Mark

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Is it possible turn off autoincrement the port of AJP when tomcat start and port configured is in use ?

2011-09-02 Thread Javier Barroso
Hi,

I have a tomcat 6.0.20 where I have next config in server.xml:
Connector port=8010 protocol=AJP/1.3 redirectPort=8443
maxThreads=1024 connectionTimeout=6 /

Today I found this is in catalina.out:

12-ago-2011 9:22:32 org.apache.jk.common.
ChannelSocket init
INFO: Port busy 8010 java.net.BindException: Address already in use
12-ago-2011 9:22:32 org.apache.jk.common.ChannelSocket init
INFO: Port busy 8011 java.net.BindException: Address already in use
12-ago-2011 9:22:32 org.apache.jk.common.ChannelSocket init
INFO: JK: ajp13 listening on /0.0.0.0:8012


I need Tomcat running in 8010 port, if it cannot use that port, it should
not be running in another. I have configured that port in apache mod_ajp, so
I don't like that port can be dinamyc.

Is there any tip to disable this mechanism ? I searched in google and this
list and in tomcat docs but I didn't find anything

Thank you very much!


Re: Is it possible turn off autoincrement the port of AJP when tomcat start and port configured is in use ?

2011-09-02 Thread Javier Barroso
Ok, I downloaded tomcat source code and found maxPort which I think is the
parameter I need.

I think this should be documented in
http://tomcat.apache.org/tomcat-6.0-doc/config/ajp.html or in mod_jk from
apache.

Thanks!

On Fri, Sep 2, 2011 at 11:17 AM, Javier Barroso javibarr...@gmail.comwrote:

 Hi,

 I have a tomcat 6.0.20 where I have next config in server.xml:
 Connector port=8010 protocol=AJP/1.3 redirectPort=8443
 maxThreads=1024 connectionTimeout=6 /

 Today I found this is in catalina.out:

 12-ago-2011 9:22:32 org.apache.jk.common.
 ChannelSocket init
 INFO: Port busy 8010 java.net.BindException: Address already in use
 12-ago-2011 9:22:32 org.apache.jk.common.ChannelSocket init
 INFO: Port busy 8011 java.net.BindException: Address already in use
 12-ago-2011 9:22:32 org.apache.jk.common.ChannelSocket init
 INFO: JK: ajp13 listening on /0.0.0.0:8012


 I need Tomcat running in 8010 port, if it cannot use that port, it should
 not be running in another. I have configured that port in apache mod_ajp, so
 I don't like that port can be dinamyc.

 Is there any tip to disable this mechanism ? I searched in google and this
 list and in tomcat docs but I didn't find anything

 Thank you very much!



Re: Is it possible turn off autoincrement the port of AJP when tomcat start and port configured is in use ?

2011-09-02 Thread Javier Barroso
Searching by maxport in google, I found
http://marc.info/?l=tomcat-userm=119266319507127w=2 thread, but seems like
there is not answer to this question :(

Any tip ?

On Fri, Sep 2, 2011 at 11:22 AM, Javier Barroso javibarr...@gmail.comwrote:

 Ok, I downloaded tomcat source code and found maxPort which I think is
 the parameter I need.

 I think this should be documented in
 http://tomcat.apache.org/tomcat-6.0-doc/config/ajp.html or in mod_jk from
 apache.

 Thanks!


 On Fri, Sep 2, 2011 at 11:17 AM, Javier Barroso javibarr...@gmail.comwrote:

 Hi,

 I have a tomcat 6.0.20 where I have next config in server.xml:
 Connector port=8010 protocol=AJP/1.3 redirectPort=8443
 maxThreads=1024 connectionTimeout=6 /

 Today I found this is in catalina.out:

 12-ago-2011 9:22:32 org.apache.jk.common.
 ChannelSocket init
 INFO: Port busy 8010 java.net.BindException: Address already in use
 12-ago-2011 9:22:32 org.apache.jk.common.ChannelSocket init
 INFO: Port busy 8011 java.net.BindException: Address already in use
 12-ago-2011 9:22:32 org.apache.jk.common.ChannelSocket init
 INFO: JK: ajp13 listening on /0.0.0.0:8012


 I need Tomcat running in 8010 port, if it cannot use that port, it should
 not be running in another. I have configured that port in apache mod_ajp, so
 I don't like that port can be dinamyc.

 Is there any tip to disable this mechanism ? I searched in google and this
 list and in tomcat docs but I didn't find anything

 Thank you very much!





Re: tomcat-6 socket.soLingerOn vs connectionLinger

2011-09-02 Thread Mark Thomas
On 02/09/2011 02:37, Chris Burroughs wrote:
 Looking at the Connector configuration options I'm having trouble
 reconciling the description of socket.soLingerOn and connectionLinger [1]

The documentation is a bit of a mess here. I'll explain what should
happen below and try and clean up the documentation.

There are three (or four) attributes to consider:
connectionLinger (a.k.a. soLinger)
socket.soLingerOn
socket.soLingerTime

The simplest way to understand how they interact is to look at the
setSoLingermethod in the endpoint

public void setSoLinger(int soLinger) {
socketProperties.setSoLingerTime(soLinger);
socketProperties.setSoLingerOn(soLinger=0);
}

connectionLinger is essentially a short-cut to setting soLingerTime and
soLingerOn

 So it sounds like connectionLinger is just a way of setting
 socket.soLingerOn, but then it would be redundant to have two options.

Yes, it is redundant. connectionLinger was first and then when the
socket.* attributes were added, all the socket attributes were exposed
creating the redundancy.

 Are they about different sockets?
No.

 The defaults are also opposites.  If
 both options affect SO_LINGER time, which takes precedence?

trunk and Tomcat 7: JVM defaults are used. If both are set in server.xml
(don't do that) it depends on the order in which the attributes are read.

Tomcat 6:
 BIO  APR. Only support connectionLinger. Default 100.
 NIO. Supports all three (four). Default 25.

 Also, the units of connectionLinger are milliseconds, but
 java.net.Socket#setSoLinger uses seconds, so I'm not sure how greater
 than second precision could be achieved.

It can't. The units of connectionLinger are seconds. That is another
documentation error.

The docs have been fixed for trunk, 7.0.x and 6.0.x and will be included
in 7.0.22  6.0.34 onwards.

Mark

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Is it possible turn off autoincrement the port of AJP when tomcat start and port configured is in use ?

2011-09-02 Thread Mark Thomas
On 02/09/2011 10:38, Javier Barroso wrote:
 Searching by maxport in google, I found
 http://marc.info/?l=tomcat-userm=119266319507127w=2 thread, but seems like
 there is not answer to this question :(
 
 Any tip ?

Try reading the 6.0x. changelog.

Mark

 
 On Fri, Sep 2, 2011 at 11:22 AM, Javier Barroso javibarr...@gmail.comwrote:
 
 Ok, I downloaded tomcat source code and found maxPort which I think is
 the parameter I need.

 I think this should be documented in
 http://tomcat.apache.org/tomcat-6.0-doc/config/ajp.html or in mod_jk from
 apache.

 Thanks!


 On Fri, Sep 2, 2011 at 11:17 AM, Javier Barroso javibarr...@gmail.comwrote:

 Hi,

 I have a tomcat 6.0.20 where I have next config in server.xml:
 Connector port=8010 protocol=AJP/1.3 redirectPort=8443
 maxThreads=1024 connectionTimeout=6 /

 Today I found this is in catalina.out:

 12-ago-2011 9:22:32 org.apache.jk.common.
 ChannelSocket init
 INFO: Port busy 8010 java.net.BindException: Address already in use
 12-ago-2011 9:22:32 org.apache.jk.common.ChannelSocket init
 INFO: Port busy 8011 java.net.BindException: Address already in use
 12-ago-2011 9:22:32 org.apache.jk.common.ChannelSocket init
 INFO: JK: ajp13 listening on /0.0.0.0:8012


 I need Tomcat running in 8010 port, if it cannot use that port, it should
 not be running in another. I have configured that port in apache mod_ajp, so
 I don't like that port can be dinamyc.

 Is there any tip to disable this mechanism ? I searched in google and this
 list and in tomcat docs but I didn't find anything

 Thank you very much!



 


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Is it possible turn off autoincrement the port of AJP when tomcat start and port configured is in use ?

2011-09-02 Thread Javier Barroso
That mean that I can use channelSocket.maxPort in tomcat 6.0.20 ? I
read about an new alias maxport, but I suppose I can use still
channelSocket.maxPort. Upgrading all tomcats here could be a problem
with applications :(

Thank you very much

Regards

On Fri, Sep 2, 2011 at 12:07 PM, Mark Thomas ma...@apache.org wrote:

 On 02/09/2011 10:38, Javier Barroso wrote:
  Searching by maxport in google, I found
  http://marc.info/?l=tomcat-userm=119266319507127w=2 thread, but seems like
  there is not answer to this question :(
 
  Any tip ?

 Try reading the 6.0x. changelog.

 Mark

 
  On Fri, Sep 2, 2011 at 11:22 AM, Javier Barroso 
  javibarr...@gmail.comwrote:
 
  Ok, I downloaded tomcat source code and found maxPort which I think is
  the parameter I need.
 
  I think this should be documented in
  http://tomcat.apache.org/tomcat-6.0-doc/config/ajp.html or in mod_jk from
  apache.
 
  Thanks!
 
 
  On Fri, Sep 2, 2011 at 11:17 AM, Javier Barroso 
  javibarr...@gmail.comwrote:
 
  Hi,
 
  I have a tomcat 6.0.20 where I have next config in server.xml:
  Connector port=8010 protocol=AJP/1.3 redirectPort=8443
  maxThreads=1024 connectionTimeout=6 /
 
  Today I found this is in catalina.out:
 
  12-ago-2011 9:22:32 org.apache.jk.common.
  ChannelSocket init
  INFO: Port busy 8010 java.net.BindException: Address already in use
  12-ago-2011 9:22:32 org.apache.jk.common.ChannelSocket init
  INFO: Port busy 8011 java.net.BindException: Address already in use
  12-ago-2011 9:22:32 org.apache.jk.common.ChannelSocket init
  INFO: JK: ajp13 listening on /0.0.0.0:8012
 
 
  I need Tomcat running in 8010 port, if it cannot use that port, it should
  not be running in another. I have configured that port in apache mod_ajp, 
  so
  I don't like that port can be dinamyc.
 
  Is there any tip to disable this mechanism ? I searched in google and this
  list and in tomcat docs but I didn't find anything
 
  Thank you very much!
 
 
 
 


 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Bug 51698 - ajp CPing/Forward-Request packet forgery

2011-09-02 Thread Edward Quick
Hi there,

I was testing out the packet forgery example (at 
https://issues.apache.org/bugzilla/show_bug.cgi?id=51698)
to see if my site was vulnerable and got the following results.
I'm not sure looking at the code comments in ForwardRequestForgeryExample.java
if the output below means it's vulnerable and what exactly that exploited.

Could someone give me a hand please?

Thanks,

Ed.

C:java -cp . ForwardRequestForgeryExample
Sending AJP Forward-Request Packet...
End

$ tail -f catalina.out
Invoke HelloWorldExample.doPost method:
---
Host: my.evil-site.com
RemoteAddr: 1.2.3.4
LocalPort: 999
woo: I am here






The information contained in this email is strictly confidential and for the 
use of the addressee only, unless otherwise indicated. If you are not the 
intended recipient, please do not read, copy, use or disclose to others this 
message or any attachment. Please also notify the sender by replying to this 
email or by telephone (+44 (0)20 7896 0011) and then delete the email and any 
copies of it. Opinions, conclusions (etc) that do not relate to the official 
business of this company shall be understood as neither given nor endorsed by 
it. IG Group Holdings plc is a company registered in England and Wales under 
number 01190902. VAT registration number 761 2978 07. Registered Office: Cannon 
Bridge House, 25 Dowgate Hill, London EC4R 2YA. Authorised and regulated by the 
Financial Services Authority. FSA Register number 114059.


Re: Bug 51698 - ajp CPing/Forward-Request packet forgery

2011-09-02 Thread Mark Thomas
On 02/09/2011 14:12, Edward Quick wrote:
 Hi there,
 
 I was testing out the packet forgery example (at 
 https://issues.apache.org/bugzilla/show_bug.cgi?id=51698)
 to see if my site was vulnerable and got the following results.
 I'm not sure looking at the code comments in ForwardRequestForgeryExample.java
 if the output below means it's vulnerable and what exactly that exploited.

Yes, you are vulnerable.

The attack exploits a bug in the AJP connector you have configured.

 Could someone give me a hand please?

See above.

Mark

 
 Thanks,
 
 Ed.
 
 C:java -cp . ForwardRequestForgeryExample
 Sending AJP Forward-Request Packet...
 End
 
 $ tail -f catalina.out
 Invoke HelloWorldExample.doPost method:
 ---
 Host: my.evil-site.com
 RemoteAddr: 1.2.3.4
 LocalPort: 999
 woo: I am here
 
 
 
 
 
 
 The information contained in this email is strictly confidential and for the 
 use of the addressee only, unless otherwise indicated. If you are not the 
 intended recipient, please do not read, copy, use or disclose to others this 
 message or any attachment. Please also notify the sender by replying to this 
 email or by telephone (+44 (0)20 7896 0011) and then delete the email and any 
 copies of it. Opinions, conclusions (etc) that do not relate to the official 
 business of this company shall be understood as neither given nor endorsed by 
 it. IG Group Holdings plc is a company registered in England and Wales under 
 number 01190902. VAT registration number 761 2978 07. Registered Office: 
 Cannon Bridge House, 25 Dowgate Hill, London EC4R 2YA. Authorised and 
 regulated by the Financial Services Authority. FSA Register number 114059.
 


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Tomcat Performance Turning.

2011-09-02 Thread Talha Fazal
Background:

We have a moderately high traffic web application (between 8 to 21 million 
hits/day) running Apache to serve static content (also to load balance and 
create a DMZ) and Weblogic to serve dynamic content (Struts 1.1 based Java web 
application).
We are trying to replace Weblogic with Tomcat and we have ported our code to 
work with Tomcat. All works well in Tomcat in the DEV, QA, and STAGING 
environment as long as there is no real load.

The Issue - Load Testing:

In our staging environment for load testing, when we run the load test using 
525 concurrent users, the app doesn't perform at all. The CPU usage (on Apache 
and Tomcat Servers) hovers between 7% to 8%. The database server CPU usage is 
also between 4 and 5%.

Setup for Load Testing:

We have setup 2 apache web servers (4 Quad Processors i.e. 16 CPUs each), 2 
Tomcat (version 6.0.29) servers (4 Quad Processors i.e. 16 CPUs each). Each 
server has 32 Gb ram. We are using AJP 1.3 to connect Tomcat and Apache.

Mentioned below is the version information:
Apache Version 2.2.14 (with mod_jk module)
Tomcat: 6.0.29
Database: Oracle Database 10g Enterprise Edition Release 10.2.0.4.0 - 64bits
Connection Pool: DBCP.

Mentioned below are connector settings in conf/server.xml:

  Connector
address=stagingTCserver01
backlog=300
connectionTimeout=6
enableLookups=false
maxPostSize=2097152
maxSpareThreads=10
maxThreads=30
minSpareThreads=5
port=8006
protocol=AJP/1.3
tcpNoDelay=true
/

Mentioned below are the settings for JNDI resource configured in 
conf/context.xml:

  Resource
name=jdbc/onlinedb
auth=Container
type=javax.sql.DataSource
driverClassName=oracle.jdbc.OracleDriver
url=jdbc:oracle:thin:@192.168.12.10:1521:WEBDB
initialSize=1
maxActive=30
minIdle=1
maxIdle=5
maxWait=30
poolPreparedStatements=true
maxOpenPreparedStatements=300
validationQuery=SELECT 1 FROM BB_DUAL
testOnBorrow=true
validationInterval=1
testWhileIdle=true
/

JVM Parameters:

-Xms512m -Xmx2048m
-XX:PermSize=128m -XX:MaxPermSize=256m
-XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/logs/WL2TC/app/
-verbose:gc -Xloggc:/logs/WL2TC/app/WL2TC_1-gc.log

It must be noted that Weblogic setup performs very well using similar settings.

Garbage Collection: While the load test is running, Garbage collection works 
just fine i.e. Young GC occurring every 2-3 minutes and takes less than half a 
second. Full GC occurs every hour and takes a little over 2 seconds.

Any tips/pointers will be greatly appreciated.

Talha.


RE: Bug 51698 - ajp CPing/Forward-Request packet forgery

2011-09-02 Thread Edward Quick
Thanks Mark.  The report says this makes (previous versions of) Apache Tomcat 
vulnerable to an authentication bypass and information disclosure, so I'm was 
just trying to understand how the example demonstrates that?

-Original Message-
From: Mark Thomas [mailto:ma...@apache.org] 
Sent: 02 September 2011 14:18
To: Tomcat Users List
Subject: Re: Bug 51698 - ajp CPing/Forward-Request packet forgery

On 02/09/2011 14:12, Edward Quick wrote:
 Hi there,
 
 I was testing out the packet forgery example (at 
 https://issues.apache.org/bugzilla/show_bug.cgi?id=51698)
 to see if my site was vulnerable and got the following results.
 I'm not sure looking at the code comments in ForwardRequestForgeryExample.java
 if the output below means it's vulnerable and what exactly that exploited.

Yes, you are vulnerable.

The attack exploits a bug in the AJP connector you have configured.

 Could someone give me a hand please?

See above.

Mark

 
 Thanks,
 
 Ed.
 
 C:java -cp . ForwardRequestForgeryExample
 Sending AJP Forward-Request Packet...
 End
 
 $ tail -f catalina.out
 Invoke HelloWorldExample.doPost method:
 ---
 Host: my.evil-site.com
 RemoteAddr: 1.2.3.4
 LocalPort: 999
 woo: I am here
 
 
 
 
 
 
 The information contained in this email is strictly confidential and for the 
 use of the addressee only, unless otherwise indicated. If you are not the 
 intended recipient, please do not read, copy, use or disclose to others this 
 message or any attachment. Please also notify the sender by replying to this 
 email or by telephone (+44 (0)20 7896 0011) and then delete the email and any 
 copies of it. Opinions, conclusions (etc) that do not relate to the official 
 business of this company shall be understood as neither given nor endorsed by 
 it. IG Group Holdings plc is a company registered in England and Wales under 
 number 01190902. VAT registration number 761 2978 07. Registered Office: 
 Cannon Bridge House, 25 Dowgate Hill, London EC4R 2YA. Authorised and 
 regulated by the Financial Services Authority. FSA Register number 114059.
 


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Tomcat Performance Turning.

2011-09-02 Thread Leon Rosenberg
Hello Talha,

from a quick glance at your post, do you have the same 30 max threads
limit in weblogic?
Because sending 525 users through 2x30=60 max threads seems a little
bottlenecky.
Which software are you using to produce the load? Does it keepalive
the connections?

regards
Leon

On Fri, Sep 2, 2011 at 3:31 PM, Talha Fazal tfa...@credera.com wrote:
 Background:

 We have a moderately high traffic web application (between 8 to 21 million 
 hits/day) running Apache to serve static content (also to load balance and 
 create a DMZ) and Weblogic to serve dynamic content (Struts 1.1 based Java 
 web application).
 We are trying to replace Weblogic with Tomcat and we have ported our code to 
 work with Tomcat. All works well in Tomcat in the DEV, QA, and STAGING 
 environment as long as there is no real load.

 The Issue - Load Testing:

 In our staging environment for load testing, when we run the load test using 
 525 concurrent users, the app doesn't perform at all. The CPU usage (on 
 Apache and Tomcat Servers) hovers between 7% to 8%. The database server CPU 
 usage is also between 4 and 5%.

 Setup for Load Testing:

 We have setup 2 apache web servers (4 Quad Processors i.e. 16 CPUs each), 2 
 Tomcat (version 6.0.29) servers (4 Quad Processors i.e. 16 CPUs each). Each 
 server has 32 Gb ram. We are using AJP 1.3 to connect Tomcat and Apache.

 Mentioned below is the version information:
 Apache Version 2.2.14 (with mod_jk module)
 Tomcat: 6.0.29
 Database: Oracle Database 10g Enterprise Edition Release 10.2.0.4.0 - 64bits
 Connection Pool: DBCP.

 Mentioned below are connector settings in conf/server.xml:

  Connector
        address=stagingTCserver01
        backlog=300
        connectionTimeout=6
        enableLookups=false
        maxPostSize=2097152
        maxSpareThreads=10
        maxThreads=30
        minSpareThreads=5
        port=8006
        protocol=AJP/1.3
        tcpNoDelay=true
    /

 Mentioned below are the settings for JNDI resource configured in 
 conf/context.xml:

  Resource
        name=jdbc/onlinedb
        auth=Container
        type=javax.sql.DataSource
        driverClassName=oracle.jdbc.OracleDriver
        url=jdbc:oracle:thin:@192.168.12.10:1521:WEBDB
        initialSize=1
        maxActive=30
        minIdle=1
        maxIdle=5
        maxWait=30
        poolPreparedStatements=true
        maxOpenPreparedStatements=300
        validationQuery=SELECT 1 FROM BB_DUAL
        testOnBorrow=true
        validationInterval=1
        testWhileIdle=true
    /

 JVM Parameters:

 -Xms512m -Xmx2048m
 -XX:PermSize=128m -XX:MaxPermSize=256m
 -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/logs/WL2TC/app/
 -verbose:gc -Xloggc:/logs/WL2TC/app/WL2TC_1-gc.log

 It must be noted that Weblogic setup performs very well using similar 
 settings.

 Garbage Collection: While the load test is running, Garbage collection works 
 just fine i.e. Young GC occurring every 2-3 minutes and takes less than half 
 a second. Full GC occurs every hour and takes a little over 2 seconds.

 Any tips/pointers will be greatly appreciated.

 Talha.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Bug 51698 - ajp CPing/Forward-Request packet forgery

2011-09-02 Thread Mark Thomas
On 02/09/2011 14:33, Edward Quick wrote:
 Thanks Mark.  The report says this makes (previous versions of) Apache Tomcat 
 vulnerable to an authentication bypass and information disclosure, so I'm was 
 just trying to understand how the example demonstrates that?

The example shows that Tomcat process an AJP message that was entirely
controlled by the attacker rather than the reverse proxy. Tomcat trusts
that information in the AJP message (authenticated user name, client IP
address, etc) are correct. If an attacker can control the AJP message
then things like authentication or filters based on client IP address
etc can all be bypassed.

Additionally, processing this extra request can cause Tomcat to start
mixing up responses to requests.

Mark

 
 -Original Message-
 From: Mark Thomas [mailto:ma...@apache.org] 
 Sent: 02 September 2011 14:18
 To: Tomcat Users List
 Subject: Re: Bug 51698 - ajp CPing/Forward-Request packet forgery
 
 On 02/09/2011 14:12, Edward Quick wrote:
 Hi there,

 I was testing out the packet forgery example (at 
 https://issues.apache.org/bugzilla/show_bug.cgi?id=51698)
 to see if my site was vulnerable and got the following results.
 I'm not sure looking at the code comments in 
 ForwardRequestForgeryExample.java
 if the output below means it's vulnerable and what exactly that exploited.
 
 Yes, you are vulnerable.
 
 The attack exploits a bug in the AJP connector you have configured.
 
 Could someone give me a hand please?
 
 See above.
 
 Mark
 

 Thanks,

 Ed.

 C:java -cp . ForwardRequestForgeryExample
 Sending AJP Forward-Request Packet...
 End

 $ tail -f catalina.out
 Invoke HelloWorldExample.doPost method:
 ---
 Host: my.evil-site.com
 RemoteAddr: 1.2.3.4
 LocalPort: 999
 woo: I am here





 
 The information contained in this email is strictly confidential and for the 
 use of the addressee only, unless otherwise indicated. If you are not the 
 intended recipient, please do not read, copy, use or disclose to others this 
 message or any attachment. Please also notify the sender by replying to this 
 email or by telephone (+44 (0)20 7896 0011) and then delete the email and 
 any copies of it. Opinions, conclusions (etc) that do not relate to the 
 official business of this company shall be understood as neither given nor 
 endorsed by it. IG Group Holdings plc is a company registered in England and 
 Wales under number 01190902. VAT registration number 761 2978 07. Registered 
 Office: Cannon Bridge House, 25 Dowgate Hill, London EC4R 2YA. Authorised 
 and regulated by the Financial Services Authority. FSA Register number 
 114059.

 
 
 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org
 
 
 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org
 


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: Tomcat Performance Turning.

2011-09-02 Thread Caldarale, Charles R
 From: Talha Fazal [mailto:tfa...@credera.com] 
 Subject: Tomcat Performance Turning.

 In our staging environment for load testing, when we run the load 
 test using 525 concurrent users, the app doesn't perform at all.
 The CPU usage (on Apache and Tomcat Servers) hovers between 7% to 
 8%. The database server CPU usage is also between 4 and 5%.

Since your CPU usage is low, your threads must be waiting for something.  Take 
several thread dumps and find out what.

http://wiki.apache.org/tomcat/HowTo#How_do_I_obtain_a_thread_dump_of_my_running_webapp_.3F

(I'll guess maxThreads and data base connections; a max of 30 seems a bit low 
for 525 concurrent requests.)

 validationQuery=SELECT 1 FROM BB_DUAL

Most DBs provide a very simple ping-like request capability; that would be 
preferable to a select.

 -Xms512m -Xmx2048m

In a server environment, one normally sets Xms and Xmx to the same value to 
avoid heap thrashing.  However, this is unrelated to your current problem.

 - Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY 
MATERIAL and is thus for use only by the intended recipient. If you received 
this in error, please contact the sender and delete the e-mail and its 
attachments from all computers.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: Tomcat Performance Turning.

2011-09-02 Thread Talha Fazal
Plz. see my answers below in UPPERCAPS.

Thanks!

-Original Message-
From: Leon Rosenberg [mailto:rosenberg.l...@gmail.com] 
Sent: Friday, September 02, 2011 8:35 AM
To: Tomcat Users List
Subject: Re: Tomcat Performance Turning.

Hello Talha,

from a quick glance at your post, do you have the same 30 max threads
limit in weblogic? YES.
Because sending 525 users through 2x30=60 max threads seems a little
bottlenecky. I FORGOT TO MENTION THAT ON EACH TOMCAT SERVER, WE ARE RUNNING 3 
INSTANCES OF TOMCAT ON EACH OF OUR TOMCAT SERVERS (2 SERVERS), THUS 2*3*30=180 
maxThreads. WE EVEN INCREASED THE maxThreads TO 120 FOR EACH INSTANCE (thus 
120*6=720 maxThreads), AND MATCHED maxActive IN JNDI RESOURCE TO 120, BUT WE 
STILL DIDN'T SEE CONSIDERABLE IMPROVEMENT. THE CPU USAGE INCREASED FROM 7% to 
10%.

Which software are you using to produce the load? LOADRUNNER. Does it keepalive 
the connections? YES.

regards
Leon

On Fri, Sep 2, 2011 at 3:31 PM, Talha Fazal tfa...@credera.com wrote:
 Background:

 We have a moderately high traffic web application (between 8 to 21 million 
 hits/day) running Apache to serve static content (also to load balance and 
 create a DMZ) and Weblogic to serve dynamic content (Struts 1.1 based Java 
 web application).
 We are trying to replace Weblogic with Tomcat and we have ported our code to 
 work with Tomcat. All works well in Tomcat in the DEV, QA, and STAGING 
 environment as long as there is no real load.

 The Issue - Load Testing:

 In our staging environment for load testing, when we run the load test using 
 525 concurrent users, the app doesn't perform at all. The CPU usage (on 
 Apache and Tomcat Servers) hovers between 7% to 8%. The database server CPU 
 usage is also between 4 and 5%.

 Setup for Load Testing:

 We have setup 2 apache web servers (4 Quad Processors i.e. 16 CPUs each), 2 
 Tomcat (version 6.0.29) servers (4 Quad Processors i.e. 16 CPUs each). Each 
 server has 32 Gb ram. We are using AJP 1.3 to connect Tomcat and Apache.

 Mentioned below is the version information:
 Apache Version 2.2.14 (with mod_jk module)
 Tomcat: 6.0.29
 Database: Oracle Database 10g Enterprise Edition Release 10.2.0.4.0 - 64bits
 Connection Pool: DBCP.

 Mentioned below are connector settings in conf/server.xml:

  Connector
        address=stagingTCserver01
        backlog=300
        connectionTimeout=6
        enableLookups=false
        maxPostSize=2097152
        maxSpareThreads=10
        maxThreads=30
        minSpareThreads=5
        port=8006
        protocol=AJP/1.3
        tcpNoDelay=true
    /

 Mentioned below are the settings for JNDI resource configured in 
 conf/context.xml:

  Resource
        name=jdbc/onlinedb
        auth=Container
        type=javax.sql.DataSource
        driverClassName=oracle.jdbc.OracleDriver
        url=jdbc:oracle:thin:@192.168.12.10:1521:WEBDB
        initialSize=1
        maxActive=30
        minIdle=1
        maxIdle=5
        maxWait=30
        poolPreparedStatements=true
        maxOpenPreparedStatements=300
        validationQuery=SELECT 1 FROM BB_DUAL
        testOnBorrow=true
        validationInterval=1
        testWhileIdle=true
    /

 JVM Parameters:

 -Xms512m -Xmx2048m
 -XX:PermSize=128m -XX:MaxPermSize=256m
 -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/logs/WL2TC/app/
 -verbose:gc -Xloggc:/logs/WL2TC/app/WL2TC_1-gc.log

 It must be noted that Weblogic setup performs very well using similar 
 settings.

 Garbage Collection: While the load test is running, Garbage collection works 
 just fine i.e. Young GC occurring every 2-3 minutes and takes less than half 
 a second. Full GC occurs every hour and takes a little over 2 seconds.

 Any tips/pointers will be greatly appreciated.

 Talha.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: Tomcat Performance Turning.

2011-09-02 Thread Talha Fazal
Thx Charles! We did take a thread dump and we found a lot of threads locked. 
Please see a short sample below:

http-8014-9 daemon prio=10 tid=0x60965c00 nid=0x6c83 in Object.wait() 
[0x4c688000..0x4c688c90]
   java.lang.Thread.State: WAITING (on object monitor)
at java.lang.Object.wait(Native Method)
at java.lang.Object.wait(Object.java:485)
at 
org.apache.tomcat.util.net.JIoEndpoint$Worker.await(JIoEndpoint.java:458)
- locked 0x2aaae10403b0 (a 
org.apache.tomcat.util.net.JIoEndpoint$Worker)
at 
org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:484)
at java.lang.Thread.run(Thread.java:619)

Sincerely, Talha.

-Original Message-
From: Caldarale, Charles R [mailto:chuck.caldar...@unisys.com] 
Sent: Friday, September 02, 2011 8:42 AM
To: Tomcat Users List
Subject: RE: Tomcat Performance Turning.

 From: Talha Fazal [mailto:tfa...@credera.com] 
 Subject: Tomcat Performance Turning.

 In our staging environment for load testing, when we run the load 
 test using 525 concurrent users, the app doesn't perform at all.
 The CPU usage (on Apache and Tomcat Servers) hovers between 7% to 
 8%. The database server CPU usage is also between 4 and 5%.

Since your CPU usage is low, your threads must be waiting for something.  Take 
several thread dumps and find out what.

http://wiki.apache.org/tomcat/HowTo#How_do_I_obtain_a_thread_dump_of_my_running_webapp_.3F

(I'll guess maxThreads and data base connections; a max of 30 seems a bit low 
for 525 concurrent requests.)

 validationQuery=SELECT 1 FROM BB_DUAL

Most DBs provide a very simple ping-like request capability; that would be 
preferable to a select.

 -Xms512m -Xmx2048m

In a server environment, one normally sets Xms and Xmx to the same value to 
avoid heap thrashing.  However, this is unrelated to your current problem.

 - Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY 
MATERIAL and is thus for use only by the intended recipient. If you received 
this in error, please contact the sender and delete the e-mail and its 
attachments from all computers.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Tomcat Performance Turning.

2011-09-02 Thread Leon Rosenberg
Hello Talha,

seems that your tomcats are fine.
Question, you mention that the tomcat do not perform, but you don't
tell us how you come to this conclusion except for cpu load.
What is the difference in response times between weblogic and tomcat?
Maybe your tomcat just perform the job MUCH faster ;-)
The thread dump you posted in another reply indicates that your
tomcats are idling.
Do you have manager installed? With manager you could monitor active
connections and requests.
Do you have probe installed?
Finally, if you really want to profile your application, do you have
moskito installed? :-) (the one i initially wrote
-moskito.anotheria.net, therefore the shameless advertisement).

In the last case I can offer you to provide support getting it running.

regards
Leon

On Fri, Sep 2, 2011 at 3:50 PM, Talha Fazal tfa...@credera.com wrote:
 Plz. see my answers below in UPPERCAPS.

 Thanks!

 -Original Message-
 From: Leon Rosenberg [mailto:rosenberg.l...@gmail.com]
 Sent: Friday, September 02, 2011 8:35 AM
 To: Tomcat Users List
 Subject: Re: Tomcat Performance Turning.

 Hello Talha,

 from a quick glance at your post, do you have the same 30 max threads
 limit in weblogic? YES.
 Because sending 525 users through 2x30=60 max threads seems a little
 bottlenecky. I FORGOT TO MENTION THAT ON EACH TOMCAT SERVER, WE ARE RUNNING 3 
 INSTANCES OF TOMCAT ON EACH OF OUR TOMCAT SERVERS (2 SERVERS), THUS 
 2*3*30=180 maxThreads. WE EVEN INCREASED THE maxThreads TO 120 FOR EACH 
 INSTANCE (thus 120*6=720 maxThreads), AND MATCHED maxActive IN JNDI RESOURCE 
 TO 120, BUT WE STILL DIDN'T SEE CONSIDERABLE IMPROVEMENT. THE CPU USAGE 
 INCREASED FROM 7% to 10%.

 Which software are you using to produce the load? LOADRUNNER. Does it 
 keepalive the connections? YES.

 regards
 Leon

 On Fri, Sep 2, 2011 at 3:31 PM, Talha Fazal tfa...@credera.com wrote:
 Background:

 We have a moderately high traffic web application (between 8 to 21 million 
 hits/day) running Apache to serve static content (also to load balance and 
 create a DMZ) and Weblogic to serve dynamic content (Struts 1.1 based Java 
 web application).
 We are trying to replace Weblogic with Tomcat and we have ported our code to 
 work with Tomcat. All works well in Tomcat in the DEV, QA, and STAGING 
 environment as long as there is no real load.

 The Issue - Load Testing:

 In our staging environment for load testing, when we run the load test using 
 525 concurrent users, the app doesn't perform at all. The CPU usage (on 
 Apache and Tomcat Servers) hovers between 7% to 8%. The database server CPU 
 usage is also between 4 and 5%.

 Setup for Load Testing:

 We have setup 2 apache web servers (4 Quad Processors i.e. 16 CPUs each), 2 
 Tomcat (version 6.0.29) servers (4 Quad Processors i.e. 16 CPUs each). Each 
 server has 32 Gb ram. We are using AJP 1.3 to connect Tomcat and Apache.

 Mentioned below is the version information:
 Apache Version 2.2.14 (with mod_jk module)
 Tomcat: 6.0.29
 Database: Oracle Database 10g Enterprise Edition Release 10.2.0.4.0 - 64bits
 Connection Pool: DBCP.

 Mentioned below are connector settings in conf/server.xml:

  Connector
        address=stagingTCserver01
        backlog=300
        connectionTimeout=6
        enableLookups=false
        maxPostSize=2097152
        maxSpareThreads=10
        maxThreads=30
        minSpareThreads=5
        port=8006
        protocol=AJP/1.3
        tcpNoDelay=true
    /

 Mentioned below are the settings for JNDI resource configured in 
 conf/context.xml:

  Resource
        name=jdbc/onlinedb
        auth=Container
        type=javax.sql.DataSource
        driverClassName=oracle.jdbc.OracleDriver
        url=jdbc:oracle:thin:@192.168.12.10:1521:WEBDB
        initialSize=1
        maxActive=30
        minIdle=1
        maxIdle=5
        maxWait=30
        poolPreparedStatements=true
        maxOpenPreparedStatements=300
        validationQuery=SELECT 1 FROM BB_DUAL
        testOnBorrow=true
        validationInterval=1
        testWhileIdle=true
    /

 JVM Parameters:

 -Xms512m -Xmx2048m
 -XX:PermSize=128m -XX:MaxPermSize=256m
 -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/logs/WL2TC/app/
 -verbose:gc -Xloggc:/logs/WL2TC/app/WL2TC_1-gc.log

 It must be noted that Weblogic setup performs very well using similar 
 settings.

 Garbage Collection: While the load test is running, Garbage collection works 
 just fine i.e. Young GC occurring every 2-3 minutes and takes less than half 
 a second. Full GC occurs every hour and takes a little over 2 seconds.

 Any tips/pointers will be greatly appreciated.

 Talha.


 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org


 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: 

RE: Tomcat Performance Turning.

2011-09-02 Thread Caldarale, Charles R
 From: Talha Fazal [mailto:tfa...@credera.com] 
 Subject: RE: Tomcat Performance Turning.

 We did take a thread dump and we found a lot of threads locked. 
 http-8014-9 daemon prio=10 tid=0x60965c00 nid=0x6c83 in 
 Object.wait() 
 at 
 org.apache.tomcat.util.net.JIoEndpoint$Worker.await(JIoEndpoint.java:458)

Often, a throughput problem is not the many, but just one that is holding all 
of the others up.  The example you cite above is simply a thread waiting for 
something to do.

Do you perhaps have a network problem, where requests are simply not getting 
delivered to httpd or Tomcat in a timely fashion?

 - Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY 
MATERIAL and is thus for use only by the intended recipient. If you received 
this in error, please contact the sender and delete the e-mail and its 
attachments from all computers.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: Tomcat Performance Turning.

2011-09-02 Thread Talha Fazal
Hi Leon,

Please see any answers in CAPS below.



-Original Message-
From: Leon Rosenberg [mailto:rosenberg.l...@gmail.com] 
Sent: Friday, September 02, 2011 9:06 AM
To: Tomcat Users List
Subject: Re: Tomcat Performance Turning.

Hello Talha,

seems that your tomcats are fine.
Question, you mention that the tomcat do not perform, but you don't
tell us how you come to this conclusion except for cpu load. ANSWER: LOOKING 
INTO THE TOMCAT ACCESS LOGS, THE RESPONSE TIME (%D) IS HORRIBLE).
What is the difference in response times between weblogic and tomcat? ANSWER: 
FOR PAGES THAT WEBLOGIC SERVES IN 500 ms ON AVERAGE, TOMCAT IS TAKING 17000 ms 
ON AVERAGE.
Maybe your tomcat just perform the job MUCH faster ;-)
The thread dump you posted in another reply indicates that your
tomcats are idling.
Do you have manager installed? NO. With manager you could monitor active
connections and requests.
Do you have probe installed? YES, WE HAVE IT INSTALLED. A LOT OF THREADS ARE 
IDLING IS WHAT WE OBSERVE.
Finally, if you really want to profile your application, do you have
moskito installed? :-) (the one i initially wrote
-moskito.anotheria.net, therefore the shameless advertisement). :-) SURE WILL 
GIVE IT A TRY [TIME PERMITTING].

In the last case I can offer you to provide support getting it running. WILL 
LET YOU KNOW IF WE ARE INTERESTED. THANKS.

regards
Leon

On Fri, Sep 2, 2011 at 3:50 PM, Talha Fazal tfa...@credera.com wrote:
 Plz. see my answers below in UPPERCAPS.

 Thanks!

 -Original Message-
 From: Leon Rosenberg [mailto:rosenberg.l...@gmail.com]
 Sent: Friday, September 02, 2011 8:35 AM
 To: Tomcat Users List
 Subject: Re: Tomcat Performance Turning.

 Hello Talha,

 from a quick glance at your post, do you have the same 30 max threads
 limit in weblogic? YES.
 Because sending 525 users through 2x30=60 max threads seems a little
 bottlenecky. I FORGOT TO MENTION THAT ON EACH TOMCAT SERVER, WE ARE RUNNING 3 
 INSTANCES OF TOMCAT ON EACH OF OUR TOMCAT SERVERS (2 SERVERS), THUS 
 2*3*30=180 maxThreads. WE EVEN INCREASED THE maxThreads TO 120 FOR EACH 
 INSTANCE (thus 120*6=720 maxThreads), AND MATCHED maxActive IN JNDI RESOURCE 
 TO 120, BUT WE STILL DIDN'T SEE CONSIDERABLE IMPROVEMENT. THE CPU USAGE 
 INCREASED FROM 7% to 10%.

 Which software are you using to produce the load? LOADRUNNER. Does it 
 keepalive the connections? YES.

 regards
 Leon

 On Fri, Sep 2, 2011 at 3:31 PM, Talha Fazal tfa...@credera.com wrote:
 Background:

 We have a moderately high traffic web application (between 8 to 21 million 
 hits/day) running Apache to serve static content (also to load balance and 
 create a DMZ) and Weblogic to serve dynamic content (Struts 1.1 based Java 
 web application).
 We are trying to replace Weblogic with Tomcat and we have ported our code to 
 work with Tomcat. All works well in Tomcat in the DEV, QA, and STAGING 
 environment as long as there is no real load.

 The Issue - Load Testing:

 In our staging environment for load testing, when we run the load test using 
 525 concurrent users, the app doesn't perform at all. The CPU usage (on 
 Apache and Tomcat Servers) hovers between 7% to 8%. The database server CPU 
 usage is also between 4 and 5%.

 Setup for Load Testing:

 We have setup 2 apache web servers (4 Quad Processors i.e. 16 CPUs each), 2 
 Tomcat (version 6.0.29) servers (4 Quad Processors i.e. 16 CPUs each). Each 
 server has 32 Gb ram. We are using AJP 1.3 to connect Tomcat and Apache.

 Mentioned below is the version information:
 Apache Version 2.2.14 (with mod_jk module)
 Tomcat: 6.0.29
 Database: Oracle Database 10g Enterprise Edition Release 10.2.0.4.0 - 64bits
 Connection Pool: DBCP.

 Mentioned below are connector settings in conf/server.xml:

  Connector
        address=stagingTCserver01
        backlog=300
        connectionTimeout=6
        enableLookups=false
        maxPostSize=2097152
        maxSpareThreads=10
        maxThreads=30
        minSpareThreads=5
        port=8006
        protocol=AJP/1.3
        tcpNoDelay=true
    /

 Mentioned below are the settings for JNDI resource configured in 
 conf/context.xml:

  Resource
        name=jdbc/onlinedb
        auth=Container
        type=javax.sql.DataSource
        driverClassName=oracle.jdbc.OracleDriver
        url=jdbc:oracle:thin:@192.168.12.10:1521:WEBDB
        initialSize=1
        maxActive=30
        minIdle=1
        maxIdle=5
        maxWait=30
        poolPreparedStatements=true
        maxOpenPreparedStatements=300
        validationQuery=SELECT 1 FROM BB_DUAL
        testOnBorrow=true
        validationInterval=1
        testWhileIdle=true
    /

 JVM Parameters:

 -Xms512m -Xmx2048m
 -XX:PermSize=128m -XX:MaxPermSize=256m
 -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/logs/WL2TC/app/
 -verbose:gc -Xloggc:/logs/WL2TC/app/WL2TC_1-gc.log

 It must be noted that Weblogic setup performs very well using similar 
 settings.

 Garbage Collection: While the load test is running, 

RE: Tomcat Performance Turning.

2011-09-02 Thread Talha Fazal
WE GENERATE REPORT ON NETWORK BACKLOG USING ADVANCED TOOLS, WHICH INDICATE 
NEGLIGIBLE NETWORK DELAY. AT ONE POINT TO TIME THIS WAS AN ISSUE. WE INCREASED 
THE BANDWIDTH FROM 45 MBPS TO 100 MBPS WHICH RESOLVED THE ISSUE.

THANKS, TALHA.

-Original Message-
From: Caldarale, Charles R [mailto:chuck.caldar...@unisys.com] 
Sent: Friday, September 02, 2011 9:16 AM
To: Tomcat Users List
Subject: RE: Tomcat Performance Turning.

 From: Talha Fazal [mailto:tfa...@credera.com] 
 Subject: RE: Tomcat Performance Turning.

 We did take a thread dump and we found a lot of threads locked. 
 http-8014-9 daemon prio=10 tid=0x60965c00 nid=0x6c83 in 
 Object.wait() 
 at 
 org.apache.tomcat.util.net.JIoEndpoint$Worker.await(JIoEndpoint.java:458)

Often, a throughput problem is not the many, but just one that is holding all 
of the others up.  The example you cite above is simply a thread waiting for 
something to do.

Do you perhaps have a network problem, where requests are simply not getting 
delivered to httpd or Tomcat in a timely fashion?

 - Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY 
MATERIAL and is thus for use only by the intended recipient. If you received 
this in error, please contact the sender and delete the e-mail and its 
attachments from all computers.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Tomcat Performance Turning.

2011-09-02 Thread Leon Rosenberg
Hello Talha,

well... the quickshots are through.
You should really create some threaddumps after each other (for
example with jstack) and try to find out which thread is slowing the
app down.
For starters you could try with code you changed for tomcat
adaptations if any. The problem seems to lie beneath the surface, so
you will have to start
performance monitoring and look into the inside.
However, time difference of 17 seconds must be something very very
obvious like a synchronized block in a valve/filter, db lock (have you
checked the db locks?), or an if (tomcat)
Thread.sleep(1000L*60*17);

regards
Leon

On Fri, Sep 2, 2011 at 4:21 PM, Talha Fazal tfa...@credera.com wrote:
 Hi Leon,

 Please see any answers in CAPS below.



 -Original Message-
 From: Leon Rosenberg [mailto:rosenberg.l...@gmail.com]
 Sent: Friday, September 02, 2011 9:06 AM
 To: Tomcat Users List
 Subject: Re: Tomcat Performance Turning.

 Hello Talha,

 seems that your tomcats are fine.
 Question, you mention that the tomcat do not perform, but you don't
 tell us how you come to this conclusion except for cpu load. ANSWER: LOOKING 
 INTO THE TOMCAT ACCESS LOGS, THE RESPONSE TIME (%D) IS HORRIBLE).
 What is the difference in response times between weblogic and tomcat? ANSWER: 
 FOR PAGES THAT WEBLOGIC SERVES IN 500 ms ON AVERAGE, TOMCAT IS TAKING 17000 
 ms ON AVERAGE.
 Maybe your tomcat just perform the job MUCH faster ;-)
 The thread dump you posted in another reply indicates that your
 tomcats are idling.
 Do you have manager installed? NO. With manager you could monitor active
 connections and requests.
 Do you have probe installed? YES, WE HAVE IT INSTALLED. A LOT OF THREADS ARE 
 IDLING IS WHAT WE OBSERVE.
 Finally, if you really want to profile your application, do you have
 moskito installed? :-) (the one i initially wrote
 -moskito.anotheria.net, therefore the shameless advertisement). :-) SURE WILL 
 GIVE IT A TRY [TIME PERMITTING].

 In the last case I can offer you to provide support getting it running. WILL 
 LET YOU KNOW IF WE ARE INTERESTED. THANKS.

 regards
 Leon

 On Fri, Sep 2, 2011 at 3:50 PM, Talha Fazal tfa...@credera.com wrote:
 Plz. see my answers below in UPPERCAPS.

 Thanks!

 -Original Message-
 From: Leon Rosenberg [mailto:rosenberg.l...@gmail.com]
 Sent: Friday, September 02, 2011 8:35 AM
 To: Tomcat Users List
 Subject: Re: Tomcat Performance Turning.

 Hello Talha,

 from a quick glance at your post, do you have the same 30 max threads
 limit in weblogic? YES.
 Because sending 525 users through 2x30=60 max threads seems a little
 bottlenecky. I FORGOT TO MENTION THAT ON EACH TOMCAT SERVER, WE ARE RUNNING 
 3 INSTANCES OF TOMCAT ON EACH OF OUR TOMCAT SERVERS (2 SERVERS), THUS 
 2*3*30=180 maxThreads. WE EVEN INCREASED THE maxThreads TO 120 FOR EACH 
 INSTANCE (thus 120*6=720 maxThreads), AND MATCHED maxActive IN JNDI RESOURCE 
 TO 120, BUT WE STILL DIDN'T SEE CONSIDERABLE IMPROVEMENT. THE CPU USAGE 
 INCREASED FROM 7% to 10%.

 Which software are you using to produce the load? LOADRUNNER. Does it 
 keepalive the connections? YES.

 regards
 Leon

 On Fri, Sep 2, 2011 at 3:31 PM, Talha Fazal tfa...@credera.com wrote:
 Background:

 We have a moderately high traffic web application (between 8 to 21 million 
 hits/day) running Apache to serve static content (also to load balance and 
 create a DMZ) and Weblogic to serve dynamic content (Struts 1.1 based Java 
 web application).
 We are trying to replace Weblogic with Tomcat and we have ported our code 
 to work with Tomcat. All works well in Tomcat in the DEV, QA, and STAGING 
 environment as long as there is no real load.

 The Issue - Load Testing:

 In our staging environment for load testing, when we run the load test 
 using 525 concurrent users, the app doesn't perform at all. The CPU usage 
 (on Apache and Tomcat Servers) hovers between 7% to 8%. The database server 
 CPU usage is also between 4 and 5%.

 Setup for Load Testing:

 We have setup 2 apache web servers (4 Quad Processors i.e. 16 CPUs each), 2 
 Tomcat (version 6.0.29) servers (4 Quad Processors i.e. 16 CPUs each). Each 
 server has 32 Gb ram. We are using AJP 1.3 to connect Tomcat and Apache.

 Mentioned below is the version information:
 Apache Version 2.2.14 (with mod_jk module)
 Tomcat: 6.0.29
 Database: Oracle Database 10g Enterprise Edition Release 10.2.0.4.0 - 64bits
 Connection Pool: DBCP.

 Mentioned below are connector settings in conf/server.xml:

  Connector
        address=stagingTCserver01
        backlog=300
        connectionTimeout=6
        enableLookups=false
        maxPostSize=2097152
        maxSpareThreads=10
        maxThreads=30
        minSpareThreads=5
        port=8006
        protocol=AJP/1.3
        tcpNoDelay=true
    /

 Mentioned below are the settings for JNDI resource configured in 
 conf/context.xml:

  Resource
        name=jdbc/onlinedb
        auth=Container
        type=javax.sql.DataSource
        

Re: Tomcat Performance Turning.

2011-09-02 Thread R Batchelor
Have you ruled out issues with db connection pooling?

You might consider setting your dbcp maxWait to 8000 or less and watch 
for timeout waiting for idle object exceptions.  Also, you could 
monitor database connections/active-users on the DB side to see if your 
dbcp pools are max'd but all the database users/connections are idle.  
These can be symptoms of an application mis-managing its dbcp pools.



From: Leon Rosenberg rosenberg.l...@gmail.com
To: Tomcat Users List users@tomcat.apache.org
Sent: Friday, September 2, 2011 7:55 AM
Subject: Re: Tomcat Performance Turning.

Hello Talha,

well... the quickshots are through.
You should really create some threaddumps after each other (for
example with jstack) and try to find out which thread is slowing the
app down.
For starters you could try with code you changed for tomcat
adaptations if any. The problem seems to lie beneath the surface, so
you will have to start
performance monitoring and look into the inside.
However, time difference of 17 seconds must be something very very
obvious like a synchronized block in a valve/filter, db lock (have you
checked the db locks?), or an if (tomcat)
Thread.sleep(1000L*60*17);

regards
Leon

On Fri, Sep 2, 2011 at 4:21 PM, Talha Fazal tfa...@credera.com wrote:
 Hi Leon,

 Please see any answers in CAPS below.



 -Original Message-
 From: Leon Rosenberg [mailto:rosenberg.l...@gmail.com]
 Sent: Friday, September 02, 2011 9:06 AM
 To: Tomcat Users List
 Subject: Re: Tomcat Performance Turning.

 Hello Talha,

 seems that your tomcats are fine.
 Question, you mention that the tomcat do not perform, but you don't
 tell us how you come to this conclusion except for cpu load. ANSWER: LOOKING 
 INTO THE TOMCAT ACCESS LOGS, THE RESPONSE TIME (%D) IS HORRIBLE).
 What is the difference in response times between weblogic and tomcat? ANSWER: 
 FOR PAGES THAT WEBLOGIC SERVES IN 500 ms ON AVERAGE, TOMCAT IS TAKING 17000 
 ms ON AVERAGE.
 Maybe your tomcat just perform the job MUCH faster ;-)
 The thread dump you posted in another reply indicates that your
 tomcats are idling.
 Do you have manager installed? NO. With manager you could monitor active
 connections and requests.
 Do you have probe installed? YES, WE HAVE IT INSTALLED. A LOT OF THREADS ARE 
 IDLING IS WHAT WE OBSERVE.
 Finally, if you really want to profile your application, do you have
 moskito installed? :-) (the one i initially wrote
 -moskito.anotheria.net, therefore the shameless advertisement). :-) SURE WILL 
 GIVE IT A TRY [TIME PERMITTING].

 In the last case I can offer you to provide support getting it running. WILL 
 LET YOU KNOW IF WE ARE INTERESTED. THANKS.

 regards
 Leon

 On Fri, Sep 2, 2011 at 3:50 PM, Talha Fazal tfa...@credera.com wrote:
 Plz. see my answers below in UPPERCAPS.

 Thanks!

 -Original Message-
 From: Leon Rosenberg [mailto:rosenberg.l...@gmail.com]
 Sent: Friday, September 02, 2011 8:35 AM
 To: Tomcat Users List
 Subject: Re: Tomcat Performance Turning.

 Hello Talha,

 from a quick glance at your post, do you have the same 30 max threads
 limit in weblogic? YES.
 Because sending 525 users through 2x30=60 max threads seems a little
 bottlenecky. I FORGOT TO MENTION THAT ON EACH TOMCAT SERVER, WE ARE RUNNING 
 3 INSTANCES OF TOMCAT ON EACH OF OUR TOMCAT SERVERS (2 SERVERS), THUS 
 2*3*30=180 maxThreads. WE EVEN INCREASED THE maxThreads TO 120 FOR EACH 
 INSTANCE (thus 120*6=720 maxThreads), AND MATCHED maxActive IN JNDI RESOURCE 
 TO 120, BUT WE STILL DIDN'T SEE CONSIDERABLE IMPROVEMENT. THE CPU USAGE 
 INCREASED FROM 7% to 10%.

 Which software are you using to produce the load? LOADRUNNER. Does it 
 keepalive the connections? YES.

 regards
 Leon

 On Fri, Sep 2, 2011 at 3:31 PM, Talha Fazal tfa...@credera.com wrote:
 Background:

 We have a moderately high traffic web application (between 8 to 21 million 
 hits/day) running Apache to serve static content (also to load balance and 
 create a DMZ) and Weblogic to serve dynamic content (Struts 1.1 based Java 
 web application).
 We are trying to replace Weblogic with Tomcat and we have ported our code 
 to work with Tomcat. All works well in Tomcat in the DEV, QA, and STAGING 
 environment as long as there is no real load.

 The Issue - Load Testing:

 In our staging environment for load testing, when we run the load test 
 using 525 concurrent users, the app doesn't perform at all. The CPU usage 
 (on Apache and Tomcat Servers) hovers between 7% to 8%. The database server 
 CPU usage is also between 4 and 5%.

 Setup for Load Testing:

 We have setup 2 apache web servers (4 Quad Processors i.e. 16 CPUs each), 2 
 Tomcat (version 6.0.29) servers (4 Quad Processors i.e. 16 CPUs each). Each 
 server has 32 Gb ram. We are using AJP 1.3 to connect Tomcat and Apache.

 Mentioned below is the version information:
 Apache Version 2.2.14 (with mod_jk module)
 Tomcat: 6.0.29
 Database: Oracle Database 10g Enterprise Edition Release 10.2.0.4.0 

Changing bit-ness of JRE that TC uses

2011-09-02 Thread David kerber
What would I need to do to change TC 7.0.20 from using a 64-bit JRE to a 
32-bit one on a 64-bit windows 2008 machine?


I tried changing the JVM setting in tomcat7w, but the service wouldn't 
start.  What else do I need to change?


D

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Changing bit-ness of JRE that TC uses

2011-09-02 Thread Mark Thomas
On 02/09/2011 17:01, David kerber wrote:
 What would I need to do to change TC 7.0.20 from using a 64-bit JRE to a
 32-bit one on a 64-bit windows 2008 machine?
 
 I tried changing the JVM setting in tomcat7w, but the service wouldn't
 start.  What else do I need to change?

If you are running as a service you need to change tomcat7.exe.

If you are using APR, you need to change tcnative-1.dll as well.

Mark

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Changing bit-ness of JRE that TC uses

2011-09-02 Thread David kerber

On 9/2/2011 12:04 PM, Mark Thomas wrote:

On 02/09/2011 17:01, David kerber wrote:

What would I need to do to change TC 7.0.20 from using a 64-bit JRE to a
32-bit one on a 64-bit windows 2008 machine?

I tried changing the JVM setting in tomcat7w, but the service wouldn't
start.  What else do I need to change?


If you are running as a service you need to change tomcat7.exe.

If you are using APR, you need to change tcnative-1.dll as well.


Thanks!

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: Tomcat Performance Turning.

2011-09-02 Thread Talha Fazal
PLEASE SEE MY ANSWERS BELOW IN UPPER CAPS.

ONE IMPORTANT OBSERVATION: Even though, tomcat's response time is decent, for 
some reason, apache is taking a lot longer to serve requests. We are using 
mod_jk with Tomcat using AJP1.3 protocol in the connector setting in 
server.xml. We plan to try mod_proxy_ajp and mod_proxy instead of mod_jk. Any 
thoughts here?

Thanks,


-Original Message-
From: R Batchelor [mailto:rsbat...@yahoo.com] 
Sent: Friday, September 02, 2011 10:10 AM
To: Tomcat Users List
Subject: Re: Tomcat Performance Turning.

Have you ruled out issues with db connection pooling? NO. IN FACT, THERE ARE 
KNOWN DBCP CONNECTION POOLING DEADLOCK ISSUES IN TOMCAT 6.0.26 
[https://issues.apache.org/jira/browse/DBCP-270]. I AM LOBBYING TO UPGRADE TO 
TOMCAT 7.0.20 AND USE THE JDBC CONNECTION POOL INSTEAD OF DBCP CONNECTION POOL.

You might consider setting your dbcp maxWait to 8000 or less and watch 
for timeout waiting for idle object exceptions.  Also, you could 
monitor database connections/active-users on the DB side to see if your 
dbcp pools are max'd but all the database users/connections are idle.  
These can be symptoms of an application mis-managing its dbcp pools.
I WILL DEFINITELY TRY THIS OUT. THANKS!


From: Leon Rosenberg rosenberg.l...@gmail.com
To: Tomcat Users List users@tomcat.apache.org
Sent: Friday, September 2, 2011 7:55 AM
Subject: Re: Tomcat Performance Turning.

Hello Talha,

well... the quickshots are through.
You should really create some threaddumps after each other (for
example with jstack) and try to find out which thread is slowing the
app down.
For starters you could try with code you changed for tomcat
adaptations if any. The problem seems to lie beneath the surface, so
you will have to start
performance monitoring and look into the inside.
However, time difference of 17 seconds must be something very very
obvious like a synchronized block in a valve/filter, db lock (have you
checked the db locks?), or an if (tomcat)
Thread.sleep(1000L*60*17);

regards
Leon

On Fri, Sep 2, 2011 at 4:21 PM, Talha Fazal tfa...@credera.com wrote:
 Hi Leon,

 Please see any answers in CAPS below.



 -Original Message-
 From: Leon Rosenberg [mailto:rosenberg.l...@gmail.com]
 Sent: Friday, September 02, 2011 9:06 AM
 To: Tomcat Users List
 Subject: Re: Tomcat Performance Turning.

 Hello Talha,

 seems that your tomcats are fine.
 Question, you mention that the tomcat do not perform, but you don't
 tell us how you come to this conclusion except for cpu load. ANSWER: LOOKING 
 INTO THE TOMCAT ACCESS LOGS, THE RESPONSE TIME (%D) IS HORRIBLE).
 What is the difference in response times between weblogic and tomcat? ANSWER: 
 FOR PAGES THAT WEBLOGIC SERVES IN 500 ms ON AVERAGE, TOMCAT IS TAKING 17000 
 ms ON AVERAGE.
 Maybe your tomcat just perform the job MUCH faster ;-)
 The thread dump you posted in another reply indicates that your
 tomcats are idling.
 Do you have manager installed? NO. With manager you could monitor active
 connections and requests.
 Do you have probe installed? YES, WE HAVE IT INSTALLED. A LOT OF THREADS ARE 
 IDLING IS WHAT WE OBSERVE.
 Finally, if you really want to profile your application, do you have
 moskito installed? :-) (the one i initially wrote
 -moskito.anotheria.net, therefore the shameless advertisement). :-) SURE WILL 
 GIVE IT A TRY [TIME PERMITTING].

 In the last case I can offer you to provide support getting it running. WILL 
 LET YOU KNOW IF WE ARE INTERESTED. THANKS.

 regards
 Leon

 On Fri, Sep 2, 2011 at 3:50 PM, Talha Fazal tfa...@credera.com wrote:
 Plz. see my answers below in UPPERCAPS.

 Thanks!

 -Original Message-
 From: Leon Rosenberg [mailto:rosenberg.l...@gmail.com]
 Sent: Friday, September 02, 2011 8:35 AM
 To: Tomcat Users List
 Subject: Re: Tomcat Performance Turning.

 Hello Talha,

 from a quick glance at your post, do you have the same 30 max threads
 limit in weblogic? YES.
 Because sending 525 users through 2x30=60 max threads seems a little
 bottlenecky. I FORGOT TO MENTION THAT ON EACH TOMCAT SERVER, WE ARE RUNNING 
 3 INSTANCES OF TOMCAT ON EACH OF OUR TOMCAT SERVERS (2 SERVERS), THUS 
 2*3*30=180 maxThreads. WE EVEN INCREASED THE maxThreads TO 120 FOR EACH 
 INSTANCE (thus 120*6=720 maxThreads), AND MATCHED maxActive IN JNDI RESOURCE 
 TO 120, BUT WE STILL DIDN'T SEE CONSIDERABLE IMPROVEMENT. THE CPU USAGE 
 INCREASED FROM 7% to 10%.

 Which software are you using to produce the load? LOADRUNNER. Does it 
 keepalive the connections? YES.

 regards
 Leon

 On Fri, Sep 2, 2011 at 3:31 PM, Talha Fazal tfa...@credera.com wrote:
 Background:

 We have a moderately high traffic web application (between 8 to 21 million 
 hits/day) running Apache to serve static content (also to load balance and 
 create a DMZ) and Weblogic to serve dynamic content (Struts 1.1 based Java 
 web application).
 We are trying to replace Weblogic with Tomcat and we have ported our code 
 to work 

Re: Is it possible turn off autoincrement the port of AJP when tomcat start and port configured is in use ?

2011-09-02 Thread Konstantin Kolinko
2011/9/2 Javier Barroso javibarr...@gmail.com:
 That mean that I can use channelSocket.maxPort in tomcat 6.0.20 ? I
 read about an new alias maxport, but I suppose I can use still
 channelSocket.maxPort.

Only if you are lucky, because it depends whether port or maxPort is
set first (in that old version of Tomcat).
https://issues.apache.org/bugzilla/show_bug.cgi?id=49521

You may have better luck with upgrading *.sh scripts in bin and
enabling CATALINA_PID file. Later versions of those scripts do check
whether other instance is running before starting Tomcat using the
value in CATALINA_PID file.   It might be easier to you than upgrading
Tomcat itself.

 Upgrading all tomcats here could be a problem
 with applications :(

1. Upgrading 6.0.x to 6.0.y there should not be any issues in applications.

The following web form allows to compare configuration files between releases:
http://tomcat.apache.org/migration.html#Tomcat_6.0.x_configuration_file_differences

2. If you keep using the old version you should consider the issues listed on
http://tomcat.apache.org/security-6.html

Best regards,
Konstantin Kolinko

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Tomcat Performance Turning.

2011-09-02 Thread Leon Rosenberg
Hello Talha,

On Fri, Sep 2, 2011 at 6:16 PM, Talha Fazal tfa...@credera.com wrote:
 PLEASE SEE MY ANSWERS BELOW IN UPPER CAPS.

 ONE IMPORTANT OBSERVATION: Even though, tomcat's response time is decent, for 
 some reason, apache is taking a lot longer to serve requests. We are using 
 mod_jk with Tomcat using AJP1.3 protocol in the connector setting in 
 server.xml. We plan to try mod_proxy_ajp and mod_proxy instead of mod_jk. Any 
 thoughts here?

Interesting observation. Have you tried running directly against
tomcat without apache inbetween?
holywarfrom my experience there is no need for apache in your setup
anyway /holywar.

In the past we used both mod_jk and mod_proxy_ajp, and even
mod_proxy_ajp is somewhat faster, the difference where never 17
seconds.
Your best guess would probably be to test without httpd to rule out if
tomcat or httpd is the bottleneck.

regards
Leon


 Thanks,


 -Original Message-
 From: R Batchelor [mailto:rsbat...@yahoo.com]
 Sent: Friday, September 02, 2011 10:10 AM
 To: Tomcat Users List
 Subject: Re: Tomcat Performance Turning.

 Have you ruled out issues with db connection pooling? NO. IN FACT, THERE ARE 
 KNOWN DBCP CONNECTION POOLING DEADLOCK ISSUES IN TOMCAT 6.0.26 
 [https://issues.apache.org/jira/browse/DBCP-270]. I AM LOBBYING TO UPGRADE TO 
 TOMCAT 7.0.20 AND USE THE JDBC CONNECTION POOL INSTEAD OF DBCP CONNECTION 
 POOL.

 You might consider setting your dbcp maxWait to 8000 or less and watch
 for timeout waiting for idle object exceptions.  Also, you could
 monitor database connections/active-users on the DB side to see if your
 dbcp pools are max'd but all the database users/connections are idle.
 These can be symptoms of an application mis-managing its dbcp pools.
 I WILL DEFINITELY TRY THIS OUT. THANKS!

 
 From: Leon Rosenberg rosenberg.l...@gmail.com
 To: Tomcat Users List users@tomcat.apache.org
 Sent: Friday, September 2, 2011 7:55 AM
 Subject: Re: Tomcat Performance Turning.

 Hello Talha,

 well... the quickshots are through.
 You should really create some threaddumps after each other (for
 example with jstack) and try to find out which thread is slowing the
 app down.
 For starters you could try with code you changed for tomcat
 adaptations if any. The problem seems to lie beneath the surface, so
 you will have to start
 performance monitoring and look into the inside.
 However, time difference of 17 seconds must be something very very
 obvious like a synchronized block in a valve/filter, db lock (have you
 checked the db locks?), or an if (tomcat)
 Thread.sleep(1000L*60*17);

 regards
 Leon

 On Fri, Sep 2, 2011 at 4:21 PM, Talha Fazal tfa...@credera.com wrote:
 Hi Leon,

 Please see any answers in CAPS below.



 -Original Message-
 From: Leon Rosenberg [mailto:rosenberg.l...@gmail.com]
 Sent: Friday, September 02, 2011 9:06 AM
 To: Tomcat Users List
 Subject: Re: Tomcat Performance Turning.

 Hello Talha,

 seems that your tomcats are fine.
 Question, you mention that the tomcat do not perform, but you don't
 tell us how you come to this conclusion except for cpu load. ANSWER: LOOKING 
 INTO THE TOMCAT ACCESS LOGS, THE RESPONSE TIME (%D) IS HORRIBLE).
 What is the difference in response times between weblogic and tomcat? 
 ANSWER: FOR PAGES THAT WEBLOGIC SERVES IN 500 ms ON AVERAGE, TOMCAT IS 
 TAKING 17000 ms ON AVERAGE.
 Maybe your tomcat just perform the job MUCH faster ;-)
 The thread dump you posted in another reply indicates that your
 tomcats are idling.
 Do you have manager installed? NO. With manager you could monitor active
 connections and requests.
 Do you have probe installed? YES, WE HAVE IT INSTALLED. A LOT OF THREADS ARE 
 IDLING IS WHAT WE OBSERVE.
 Finally, if you really want to profile your application, do you have
 moskito installed? :-) (the one i initially wrote
 -moskito.anotheria.net, therefore the shameless advertisement). :-) SURE 
 WILL GIVE IT A TRY [TIME PERMITTING].

 In the last case I can offer you to provide support getting it running. WILL 
 LET YOU KNOW IF WE ARE INTERESTED. THANKS.

 regards
 Leon

 On Fri, Sep 2, 2011 at 3:50 PM, Talha Fazal tfa...@credera.com wrote:
 Plz. see my answers below in UPPERCAPS.

 Thanks!

 -Original Message-
 From: Leon Rosenberg [mailto:rosenberg.l...@gmail.com]
 Sent: Friday, September 02, 2011 8:35 AM
 To: Tomcat Users List
 Subject: Re: Tomcat Performance Turning.

 Hello Talha,

 from a quick glance at your post, do you have the same 30 max threads
 limit in weblogic? YES.
 Because sending 525 users through 2x30=60 max threads seems a little
 bottlenecky. I FORGOT TO MENTION THAT ON EACH TOMCAT SERVER, WE ARE RUNNING 
 3 INSTANCES OF TOMCAT ON EACH OF OUR TOMCAT SERVERS (2 SERVERS), THUS 
 2*3*30=180 maxThreads. WE EVEN INCREASED THE maxThreads TO 120 FOR EACH 
 INSTANCE (thus 120*6=720 maxThreads), AND MATCHED maxActive IN JNDI 
 RESOURCE TO 120, BUT WE STILL DIDN'T SEE CONSIDERABLE IMPROVEMENT. THE CPU 
 USAGE 

Re: Is it possible turn off autoincrement the port of AJP when tomcat start and port configured is in use ?

2011-09-02 Thread Javier Barroso
On Fri, Sep 2, 2011 at 9:26 PM, Konstantin Kolinko
knst.koli...@gmail.com wrote:
 2011/9/2 Javier Barroso javibarr...@gmail.com:
 That mean that I can use channelSocket.maxPort in tomcat 6.0.20 ? I
 read about an new alias maxport, but I suppose I can use still
 channelSocket.maxPort.

 Only if you are lucky, because it depends whether port or maxPort is
 set first (in that old version of Tomcat).
 https://issues.apache.org/bugzilla/show_bug.cgi?id=49521

 You may have better luck with upgrading *.sh scripts in bin and
 enabling CATALINA_PID file. Later versions of those scripts do check
 whether other instance is running before starting Tomcat using the
 value in CATALINA_PID file.   It might be easier to you than upgrading
 Tomcat itself.
Ok, I guess I should not have many problem from tomcat point of view
(we have a very basic (well, somethings are cluster configured and
that is not basic (should all tomcat from cluster have the same
version, or I can update one by one?))), but our customers tell us
tested with tomcat 6.0.xx (where xx is fixed) ..

 Upgrading all tomcats here could be a problem
 with applications :(

 1. Upgrading 6.0.x to 6.0.y there should not be any issues in applications.

 The following web form allows to compare configuration files between releases:
 http://tomcat.apache.org/migration.html#Tomcat_6.0.x_configuration_file_differences
Thank you for that link! It seems very useful


 2. If you keep using the old version you should consider the issues listed on
 http://tomcat.apache.org/security-6.html
Ok, I could use that as excuses for my boss (they say (if work, don't touch))

Thank you very much!

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: Tomcat Performance Turning.

2011-09-02 Thread Talha Fazal
Q. Have you tried running directly against tomcat without apache inbetween?
A. Yes; this resolves the performance bottleneck.

Q. holywarfrom my experience there is no need for apache in your setup anyway 
/holywar.
A.  :-) The reasons for having apache in front: A) Create a DMZ and protect 
Tomcat from being exposed to outside attacks; B) Load balancing.

Thanks Leon!

-Original Message-
From: Leon Rosenberg [mailto:rosenberg.l...@gmail.com] 
Sent: Friday, September 02, 2011 3:19 PM
To: Tomcat Users List
Subject: Re: Tomcat Performance Turning.

Hello Talha,

On Fri, Sep 2, 2011 at 6:16 PM, Talha Fazal tfa...@credera.com wrote:
 PLEASE SEE MY ANSWERS BELOW IN UPPER CAPS.

 ONE IMPORTANT OBSERVATION: Even though, tomcat's response time is decent, for 
 some reason, apache is taking a lot longer to serve requests. We are using 
 mod_jk with Tomcat using AJP1.3 protocol in the connector setting in 
 server.xml. We plan to try mod_proxy_ajp and mod_proxy instead of mod_jk. Any 
 thoughts here?

Interesting observation. Have you tried running directly against
tomcat without apache inbetween?
holywarfrom my experience there is no need for apache in your setup
anyway /holywar.

In the past we used both mod_jk and mod_proxy_ajp, and even
mod_proxy_ajp is somewhat faster, the difference where never 17
seconds.
Your best guess would probably be to test without httpd to rule out if
tomcat or httpd is the bottleneck.

regards
Leon


 Thanks,


 -Original Message-
 From: R Batchelor [mailto:rsbat...@yahoo.com]
 Sent: Friday, September 02, 2011 10:10 AM
 To: Tomcat Users List
 Subject: Re: Tomcat Performance Turning.

 Have you ruled out issues with db connection pooling? NO. IN FACT, THERE ARE 
 KNOWN DBCP CONNECTION POOLING DEADLOCK ISSUES IN TOMCAT 6.0.26 
 [https://issues.apache.org/jira/browse/DBCP-270]. I AM LOBBYING TO UPGRADE TO 
 TOMCAT 7.0.20 AND USE THE JDBC CONNECTION POOL INSTEAD OF DBCP CONNECTION 
 POOL.

 You might consider setting your dbcp maxWait to 8000 or less and watch
 for timeout waiting for idle object exceptions.  Also, you could
 monitor database connections/active-users on the DB side to see if your
 dbcp pools are max'd but all the database users/connections are idle.
 These can be symptoms of an application mis-managing its dbcp pools.
 I WILL DEFINITELY TRY THIS OUT. THANKS!

 
 From: Leon Rosenberg rosenberg.l...@gmail.com
 To: Tomcat Users List users@tomcat.apache.org
 Sent: Friday, September 2, 2011 7:55 AM
 Subject: Re: Tomcat Performance Turning.

 Hello Talha,

 well... the quickshots are through.
 You should really create some threaddumps after each other (for
 example with jstack) and try to find out which thread is slowing the
 app down.
 For starters you could try with code you changed for tomcat
 adaptations if any. The problem seems to lie beneath the surface, so
 you will have to start
 performance monitoring and look into the inside.
 However, time difference of 17 seconds must be something very very
 obvious like a synchronized block in a valve/filter, db lock (have you
 checked the db locks?), or an if (tomcat)
 Thread.sleep(1000L*60*17);

 regards
 Leon

 On Fri, Sep 2, 2011 at 4:21 PM, Talha Fazal tfa...@credera.com wrote:
 Hi Leon,

 Please see any answers in CAPS below.



 -Original Message-
 From: Leon Rosenberg [mailto:rosenberg.l...@gmail.com]
 Sent: Friday, September 02, 2011 9:06 AM
 To: Tomcat Users List
 Subject: Re: Tomcat Performance Turning.

 Hello Talha,

 seems that your tomcats are fine.
 Question, you mention that the tomcat do not perform, but you don't
 tell us how you come to this conclusion except for cpu load. ANSWER: LOOKING 
 INTO THE TOMCAT ACCESS LOGS, THE RESPONSE TIME (%D) IS HORRIBLE).
 What is the difference in response times between weblogic and tomcat? 
 ANSWER: FOR PAGES THAT WEBLOGIC SERVES IN 500 ms ON AVERAGE, TOMCAT IS 
 TAKING 17000 ms ON AVERAGE.
 Maybe your tomcat just perform the job MUCH faster ;-)
 The thread dump you posted in another reply indicates that your
 tomcats are idling.
 Do you have manager installed? NO. With manager you could monitor active
 connections and requests.
 Do you have probe installed? YES, WE HAVE IT INSTALLED. A LOT OF THREADS ARE 
 IDLING IS WHAT WE OBSERVE.
 Finally, if you really want to profile your application, do you have
 moskito installed? :-) (the one i initially wrote
 -moskito.anotheria.net, therefore the shameless advertisement). :-) SURE 
 WILL GIVE IT A TRY [TIME PERMITTING].

 In the last case I can offer you to provide support getting it running. WILL 
 LET YOU KNOW IF WE ARE INTERESTED. THANKS.

 regards
 Leon

 On Fri, Sep 2, 2011 at 3:50 PM, Talha Fazal tfa...@credera.com wrote:
 Plz. see my answers below in UPPERCAPS.

 Thanks!

 -Original Message-
 From: Leon Rosenberg [mailto:rosenberg.l...@gmail.com]
 Sent: Friday, September 02, 2011 8:35 AM
 To: Tomcat Users List
 Subject: Re: Tomcat Performance Turning.

 

Re: Form Authentication and status (response) code

2011-09-02 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Jess,

On 9/1/2011 7:06 PM, Jess Holle wrote:
 So form-based authentication is an obnoxious mutt -- but a mutt
 that everyone seems to have fallen in love with.
 
 This isn't Tomcat's fault, however, and Tomcat is doing the normal
 thing by returning a 200 here.

The servlet spec (section 13.6.3 Form Based Authentication) has the
whole process laid out, except that they don't say what the HTTP
response code should be when a request for a protected resource
arrives and the login form should be sent to the client.

Later, it says:


If authentication fails, the error page is returned using either a
forward or a redirect, and the status code of the response is set to 200.


Ignoring the fact that you can't do a redirect using a 200 response,
it's clear that there is no unauthenticated or forbidden response
code to be used, here. Presumably, the decision to use response code
200 was drawn from this section as well as practical considerations
(being able to prohibit the login form from being directly accessible
to remote clients for instance) and past user input (I think Tomcat
used to issue a redirect, but now does an internal forward and
responds with 200).

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk5hTEwACgkQ9CaO5/Lv0PBpKACbB5A+XQ42NDT9gHSgR7jCDEAz
5i0An2JZMwf+jrrpwuQrk6AtDWbpOYpN
=XYT8
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Tomcat Performance Turning.

2011-09-02 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Leon,

On 9/2/2011 4:19 PM, Leon Rosenberg wrote:
 holywarfrom my experience there is no need for apache in your
 setup anyway /holywar.

Uh, load-balancing?

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk5hUDgACgkQ9CaO5/Lv0PBfhQCdFwEDvm37L9QTe6FBns88RKLg
7ukAnikbIxI+y/oaskk/Zv/Y4aKPpYD9
=Dc+M
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Servlet 3.0 File Upload

2011-09-02 Thread Ole Ersoy

Hi,

I have a working file upload servlet, with the exception that it calls the uploaded file 
samplefile instead of using the name of the file.  So if I upload different 
files, they all overwrite each other.  Any ideas on how to fix this?  I used this 
tutorial to get it working:

http://www.servletworld.com/servlet-tutorials/servlet3/multipartconfig-file-upload-example.html

TIA,
- Ole   


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Servlet 3.0 File Upload

2011-09-02 Thread Ole Ersoy

Never mind...I see the example hard codes the name of the file.  Sorry for the 
noise.

On 09/02/2011 05:50 PM, Ole Ersoy wrote:

Hi,

I have a working file upload servlet, with the exception that it calls
the uploaded file samplefile instead of using the name of the file. So
if I upload different files, they all overwrite each other. Any ideas on
how to fix this? I used this tutorial to get it working:

http://www.servletworld.com/servlet-tutorials/servlet3/multipartconfig-file-upload-example.html


TIA,
- Ole


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: CGIServlet - php

2011-09-02 Thread throwsCode

Hi all:

An update I entered the following directly into my browser:
  http://localhost:8080/secondDynamicWeb/cgi-bin/echoInfo.php

And got the a 404 Error - Servlet CGI not available.

From this it appears that the servlet is not available but has been defined
because the URL pattern /cgi-bin/ appears to call the Servlet as defined in
the web.xml

Which I have set as follows:

servlet
servlet-namecgi/servlet-name
   
servlet-classorg.apache.catalina.servlets.CGIServlet/servlet-class
init-param
  param-namedebug/param-name
  param-value6/param-value
/init-param
init-param
  param-namecgiPathPrefix/param-name
  param-valueWEB-INF/cgi/param-value
/init-param
init-param
  param-nameexecutable/param-name
  param-value/param-value
/init-param
 load-on-startup5/load-on-startup
/servlet
 
AND 

servlet-mapping
servlet-namecgi/servlet-name
url-pattern/cgi-bin/*/url-pattern
/servlet-mapping

I would appreciate any advice you might offer.

TC





-- 
View this message in context: 
http://old.nabble.com/CGIServlet---php-tp32390310p32390388.html
Sent from the Tomcat - User mailing list archive at Nabble.com.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: CGIServlet - php

2011-09-02 Thread Hassan Schroeder
On Fri, Sep 2, 2011 at 5:06 PM, throwsCode donmillho...@yahoo.com wrote:

 I'm trying to implement PHP on tomcat 7.0.20

Dear god, why?

I would rather duct-tape rabid weasels inside my shorts than do, well,
anything with PHP again, but if you must -- just use Apache HTTPD.

Seriously.

-- 
Hassan Schroeder  hassan.schroe...@gmail.com
http://about.me/hassanschroeder
twitter: @hassan

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: CGIServlet - php

2011-09-02 Thread throwsCode

Hi Hassan:

I am predominantly a JSF/Facelets/IceFaces developer but recently I have
been asked to assist some non-profits which calls for php.  I would like to
use my existing development environment which is Eclipse and Tomcat.  If I
can discover the secrets to php in Tomcat that would be the best for me.

I really hate when everyone says they support a particular framework or
language but provide no examples and sketchy instructions.  It would be nice
to be a part of a large organization with expertise in each and every area.

I'll work on it for another day or two before I abandon the Tomcat approach.

Thanks for you comments.

TC
-- 
View this message in context: 
http://old.nabble.com/CGIServlet---php-tp32390310p32390812.html
Sent from the Tomcat - User mailing list archive at Nabble.com.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: CGIServlet - php

2011-09-02 Thread Hassan Schroeder
On Fri, Sep 2, 2011 at 9:25 PM, throwsCode donmillho...@yahoo.com wrote:

 I am predominantly a JSF/Facelets/IceFaces developer but recently I have
 been asked to assist some non-profits which calls for php.

Yeah, that's similar to how I got sucked into doing PHP too :-)
(Fool me once, shame on me yadda yadda...)

 I would like to use my existing development environment which is
 Eclipse and Tomcat.

Mmm. I also don't care much for Eclipse, but in case you want to try
something else, I believe NetBeans has had more PHP focus since
Oracle bought Sun. At the least, trying it might give you some ideas.

Also, google `php quercus` for an alternative to CGI-based solutions.

Good luck  :-)
-- 
Hassan Schroeder  hassan.schroe...@gmail.com
http://about.me/hassanschroeder
twitter: @hassan

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org