Re: mod_jk errors

[Wayne Li]

Thank you for both!

On Fri, Jul 15, 2016 at 3:04 AM, Rainer Jung 
wrote:

> Am 12.07.2016 um 19:44 schrieb Wayne Li:
>
>> Hi,
>>
>> I have a servlet/jsp application running on tomcat 7.0.47. There are no
>> static html files.
>> Now I am try to use apache 2.4.7 (Ubuntu)
>> as the front and forward eveything to tomcat. I installed mod_jk using
>> Ubuntu's software
>> center.. Things are working. But I have errors in
>> /var/log/apache2/mod_jk.log:
>>
>> [Mon Jul 11 20:19:32.261 2016] [1175:140389159810944] [info]
>> init_jk::mod_jk.c (3365): mod_jk/1.2.37 initialized
>> [Mon Jul 11 20:19:32.279 2016] [1175:140389159810944] [error]
>> extension_fix::jk_uri_worker_map.c (564): Could not find worker with name
>> 'jk-manager' in uri map post processing.
>> [Mon Jul 11 20:19:32.279 2016] [1175:140389159810944] [error]
>> extension_fix::jk_uri_worker_map.c (564): Could not find worker with name
>> 'jk-status' in uri map post processing.
>> [Mon Jul 11 20:19:32.386 2016] [1177:140389159810944] [info]
>> init_jk::mod_jk.c (3365): mod_jk/1.2.37 initialized
>> [Mon Jul 11 20:19:32.386 2016] [1177:140389159810944] [error]
>> extension_fix::jk_uri_worker_map.c (564): Could not find worker with name
>> 'jk-manager' in uri map post processing.
>> [Mon Jul 11 20:19:32.386 2016] [1177:140389159810944] [error]
>> extension_fix::jk_uri_worker_map.c (564): Could not find worker with name
>> 'jk-status' in uri map post processing.
>>
>> If I add the following lines, the errors go away:
>>
>> worker.list=jk-status
>> worker.jk-status.type=status
>> worker.jk-status.read_only=true
>> worker.list=jk-manager
>> worker.jk-manager.type=status
>>
>> But the added line read funny. The same thing appears on the left-side of
>> the equal sign twice.
>> Are they correct? Do I need these lines? Can I ignore the errors?
>>
>> Any information would be appreciated. Thanks in advance.
>>
>
> In addition to André's excellent tutorial: mod_jk knows that some
> properties configured via workers.properties take (comma-separated) lists
> as values. Since sometimes maintaining these lists is error-prone, it
> allows you to define the properties multiple times and will collect all
> given values into one big list. That makes maintaining hte list a more
> modular job.
>
> In your case the following is exactly equivalent:
>
> Either:
>
> worker.list=jk-status,jk-manager,myworker
>
> Or:
>
> worker.list=jk-status
> #Some more config items concerning jk-status
> worker.list=jk-manager
> #Some more config items concerning jk-manager
> worker.list=myworker
> #Some more config items concerning myworker
>
> In both cases the internal value of worker.list after parsing the complete
> file will be "jk-status,jk-manager,myworker".
>
> So what look a bit funny to you was supposed to be helpful ;)
>
> Can you ignore the errors: No.
>
> - If you don't want the jk-status and/or jk-manager worker features, then
> look for the JkMount directives where you referenced them (or entried in a
> uriworkermap.properties file but that's rarely used).
>
> - If you want to use the jk-status and/or jk-manager workers, you need to
> define them in workers.properties like you did above.
>
> Regards,
>
> Rainer
>
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
>
>

Re: mod_jk errors

[Rainer Jung]

Am 12.07.2016 um 19:44 schrieb Wayne Li:

Hi,

I have a servlet/jsp application running on tomcat 7.0.47. There are no
static html files.
Now I am try to use apache 2.4.7 (Ubuntu)
as the front and forward eveything to tomcat. I installed mod_jk using
Ubuntu's software
center.. Things are working. But I have errors in
/var/log/apache2/mod_jk.log:

[Mon Jul 11 20:19:32.261 2016] [1175:140389159810944] [info]
init_jk::mod_jk.c (3365): mod_jk/1.2.37 initialized
[Mon Jul 11 20:19:32.279 2016] [1175:140389159810944] [error]
extension_fix::jk_uri_worker_map.c (564): Could not find worker with name
'jk-manager' in uri map post processing.
[Mon Jul 11 20:19:32.279 2016] [1175:140389159810944] [error]
extension_fix::jk_uri_worker_map.c (564): Could not find worker with name
'jk-status' in uri map post processing.
[Mon Jul 11 20:19:32.386 2016] [1177:140389159810944] [info]
init_jk::mod_jk.c (3365): mod_jk/1.2.37 initialized
[Mon Jul 11 20:19:32.386 2016] [1177:140389159810944] [error]
extension_fix::jk_uri_worker_map.c (564): Could not find worker with name
'jk-manager' in uri map post processing.
[Mon Jul 11 20:19:32.386 2016] [1177:140389159810944] [error]
extension_fix::jk_uri_worker_map.c (564): Could not find worker with name
'jk-status' in uri map post processing.

If I add the following lines, the errors go away:

worker.list=jk-status
worker.jk-status.type=status
worker.jk-status.read_only=true
worker.list=jk-manager
worker.jk-manager.type=status

But the added line read funny. The same thing appears on the left-side of
the equal sign twice.
Are they correct? Do I need these lines? Can I ignore the errors?

Any information would be appreciated. Thanks in advance.


In addition to André's excellent tutorial: mod_jk knows that some 
properties configured via workers.properties take (comma-separated) 
lists as values. Since sometimes maintaining these lists is error-prone, 
it allows you to define the properties multiple times and will collect 
all given values into one big list. That makes maintaining hte list a 
more modular job.


In your case the following is exactly equivalent:

Either:

worker.list=jk-status,jk-manager,myworker

Or:

worker.list=jk-status
#Some more config items concerning jk-status
worker.list=jk-manager
#Some more config items concerning jk-manager
worker.list=myworker
#Some more config items concerning myworker

In both cases the internal value of worker.list after parsing the 
complete file will be "jk-status,jk-manager,myworker".


So what look a bit funny to you was supposed to be helpful ;)

Can you ignore the errors: No.

- If you don't want the jk-status and/or jk-manager worker features, 
then look for the JkMount directives where you referenced them (or 
entried in a uriworkermap.properties file but that's rarely used).


- If you want to use the jk-status and/or jk-manager workers, you need 
to define them in workers.properties like you did above.


Regards,

Rainer

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: mod_jk errors

[tomcat]

On 12.07.2016 19:44, Wayne Li wrote:

Hi,

I have a servlet/jsp application running on tomcat 7.0.47. There are no
static html files.
Now I am try to use apache 2.4.7 (Ubuntu)
as the front and forward eveything to tomcat. I installed mod_jk using
Ubuntu's software
center.. Things are working. But I have errors in
/var/log/apache2/mod_jk.log:

[Mon Jul 11 20:19:32.261 2016] [1175:140389159810944] [info]
init_jk::mod_jk.c (3365): mod_jk/1.2.37 initialized
[Mon Jul 11 20:19:32.279 2016] [1175:140389159810944] [error]
extension_fix::jk_uri_worker_map.c (564): Could not find worker with name
'jk-manager' in uri map post processing.
[Mon Jul 11 20:19:32.279 2016] [1175:140389159810944] [error]
extension_fix::jk_uri_worker_map.c (564): Could not find worker with name
'jk-status' in uri map post processing.
[Mon Jul 11 20:19:32.386 2016] [1177:140389159810944] [info]
init_jk::mod_jk.c (3365): mod_jk/1.2.37 initialized
[Mon Jul 11 20:19:32.386 2016] [1177:140389159810944] [error]
extension_fix::jk_uri_worker_map.c (564): Could not find worker with name
'jk-manager' in uri map post processing.
[Mon Jul 11 20:19:32.386 2016] [1177:140389159810944] [error]
extension_fix::jk_uri_worker_map.c (564): Could not find worker with name
'jk-status' in uri map post processing.

If I add the following lines, the errors go away:

worker.list=jk-status
worker.jk-status.type=status
worker.jk-status.read_only=true
worker.list=jk-manager
worker.jk-manager.type=status

But the added line read funny. The same thing appears on the left-side of
the equal sign twice.
Are they correct? Do I need these lines? Can I ignore the errors?

Any information would be appreciated. Thanks in advance.



Tutorial :

Apache httpd knows /nothing/ about Tomcat.  Whenever it gets a request, Apache httpd looks 
at the request URI, and then inside itself for an appropriate "handler" to process that 
request (and generate a response for it).
To do that, it passes the request successively through all the "handlers" which it knows 
about (as per its configuration). Each handler gets a chance to look at the request URI, 
and, if it is not "interested", it returns a status "declined" to Apache httpd.

Apache httpd, in such a case, passes the request to the next possible handler, 
and so on.
The last handler in that chain is the Apache httpd "default handler", which always handles 
the request, if nobody else before wanted it.
If some handler in the chain decides that this request URI "is for him", then instead of 
returning "declined", it will compose and return the response to the request.

Apache then returns that response to the client, and stops scanning for more 
handlers.

For Apache httpd, mod_jk is just one such "handler" : it gets every request to look at, 
and decides if it wants to handle it or not. If it decides to handle it, then mod_jk 
passes the request to Tomcat, which handles the request and generates a response, which 
mod_jk then returns to Apache etc.  Apache httpd is totally unaware that it is not mod_jk 
itself which generates the response, and totally unaware that there are, in the 
background, one or more Tomcat "workers" to do the real work.


So, how does mod_jk decide if it wants to handle a request or not ?
That is where the "JkMount" directives come into play.
These are not instructions for Apache, they are for mod_jk.
When Apache reads its configuration and encounters a directive which it does not 
understand, it also passes it through the configured handlers, in case it is of interest 
to one of them. When mod_jk receives such a line, it notes in an internal "URI mapping 
table" that "URI's that look like this, are for me" (later), and they should be handled 
(later) by "tomcat worker x". When it is finished reading the configuration, that table 
thus looks like this :

URI_1 -> worker_a
URI_2 -> worker_a
URI_3 -> worker_b
URI_4 -> worker_c
etc..


On the other side, another configuration table tells mod_jk which are the Tomcats which it 
can use as "workers", to generate responses.

That is the table built from "workers.properties", and it looks like this :
worker_a -> host, port, type, etc..
worker_b -> host, port, type, etc..
worker_c -> internal (to mod_jk)
..

Now, in your Apache configuration, you have these JkMount's :
JkMount /myapp worker_a
JkMount /status worker_c
JkMount /yyy worker>_b

So mod_jk will build it's mapping table accordingly (see above).

When there is a mismatch between the JkMounts (and the "workers" which they mention), and 
the contents of "workers.properties" table (which lists the effective workers), then you 
get the above error messages.

For example, when the line
JkMount /status jk-status
does not find any corresponding active "jk-status" worker in workers.properties.

So you have a choice :
- if you do have an application under Tomcat (or mod_jk itself) which can handle such 
URI's, and you actually want to make this application available, then leave the JkMount, 
but enable the corresponding 

mod_jk errors

[Wayne Li]

Hi,

I have a servlet/jsp application running on tomcat 7.0.47. There are no
static html files.
Now I am try to use apache 2.4.7 (Ubuntu)
as the front and forward eveything to tomcat. I installed mod_jk using
Ubuntu's software
center.. Things are working. But I have errors in
/var/log/apache2/mod_jk.log:

[Mon Jul 11 20:19:32.261 2016] [1175:140389159810944] [info]
init_jk::mod_jk.c (3365): mod_jk/1.2.37 initialized
[Mon Jul 11 20:19:32.279 2016] [1175:140389159810944] [error]
extension_fix::jk_uri_worker_map.c (564): Could not find worker with name
'jk-manager' in uri map post processing.
[Mon Jul 11 20:19:32.279 2016] [1175:140389159810944] [error]
extension_fix::jk_uri_worker_map.c (564): Could not find worker with name
'jk-status' in uri map post processing.
[Mon Jul 11 20:19:32.386 2016] [1177:140389159810944] [info]
init_jk::mod_jk.c (3365): mod_jk/1.2.37 initialized
[Mon Jul 11 20:19:32.386 2016] [1177:140389159810944] [error]
extension_fix::jk_uri_worker_map.c (564): Could not find worker with name
'jk-manager' in uri map post processing.
[Mon Jul 11 20:19:32.386 2016] [1177:140389159810944] [error]
extension_fix::jk_uri_worker_map.c (564): Could not find worker with name
'jk-status' in uri map post processing.

If I add the following lines, the errors go away:

worker.list=jk-status
worker.jk-status.type=status
worker.jk-status.read_only=true
worker.list=jk-manager
worker.jk-manager.type=status

But the added line read funny. The same thing appears on the left-side of
the equal sign twice.
Are they correct? Do I need these lines? Can I ignore the errors?

Any information would be appreciated. Thanks in advance.

Re: mod_jk errors errno=110 and errno=115

[Philippe Bossu]

Thank you Rainer, it was very helpful.
Sorry for late answer.

On Sun, Feb 17, 2013 at 12:02 PM, Rainer Jung rainer.j...@kippdata.dewrote:

 On 14.02.2013 14:17, Philippe Bossu wrote:
  We have a mod_jk in version 1.2.28 with Apache 2.16  fronting a Tomcat
  server in version 6 on JDK6.
 
  We are facing long response times and timeouts from time to time.
  Mod_jk log files show the following errors:
 
  [][X] [error] ajp_connect_to_endpoint::jk_ajp_common.c
  (1035): (nodeXX) cping/cpong after connecting to the backend server
 failed
  (errno=110)
  [][X] [error] ajp_send_request::jk_ajp_common.c (1630):
  (nodeXX) connecting to backend failed. Tomcat is probably not started or
 is
  listening on the wrong port (errno=110)
  [][X] [error] ajp_connect_to_endpoint::jk_ajp_common.c
  (1035): (nodeXX) cping/cpong after connecting to the backend server
 failed
  (errno=110)
  [][X] [error] ajp_send_request::jk_ajp_common.c (1630):
  (nodeXX) connecting to backend failed. Tomcat is probably not started or
 is
  listening on the wrong port (errno=110)
  [][X] [error] ajp_service::jk_ajp_common.c (2626):
 (nodeXX)
  connecting to tomcat failed.
 
 
  [][X] [error] ajp_send_request::jk_ajp_common.c (1630):
  (nodeYY) connecting to backend failed. Tomcat is probably not started or
 is
  listening on the wrong port (errno=115)
 
  [][X] ] [error] ajp_send_request::jk_ajp_common.c (1630):
  (nodeYY) connecting to backend failed. Tomcat is probably not started or
 is
  listening on the wrong port (errno=115)
  [][X]  [error] ajp_service::jk_ajp_common.c (2626):
  (nodeYY) connecting to tomcat failed.
 
 
  What could be the explanations except for Tomcat Thread pool not having
  threads available anymore ? Thing we checked.
 
  Was there fixes in new mod_jk versions (1.2.37) regarding issues like
 these
  ?

 System errno numbers are platform dependent and you didn't tell us your
 OS. See e.g.

 http://www.ioplex.com/~miallen/errcmpp.html

 I guess oyu are on Linux and then those are expected errnos. The reason
 is not expected on the jk side of things. As you said, it can be your
 Tomcat got stuck - take Thread Dumps when this is happening to
 investigate, or there's a network problem including possibly firewalls
 in between mod_jk and Tomcat.

 Regards,

 Rainer


 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org

Re: mod_jk errors errno=110 and errno=115

[Rainer Jung]

On 14.02.2013 14:17, Philippe Bossu wrote:
 We have a mod_jk in version 1.2.28 with Apache 2.16  fronting a Tomcat
 server in version 6 on JDK6.
 
 We are facing long response times and timeouts from time to time.
 Mod_jk log files show the following errors:
 
 [][X] [error] ajp_connect_to_endpoint::jk_ajp_common.c
 (1035): (nodeXX) cping/cpong after connecting to the backend server failed
 (errno=110)
 [][X] [error] ajp_send_request::jk_ajp_common.c (1630):
 (nodeXX) connecting to backend failed. Tomcat is probably not started or is
 listening on the wrong port (errno=110)
 [][X] [error] ajp_connect_to_endpoint::jk_ajp_common.c
 (1035): (nodeXX) cping/cpong after connecting to the backend server failed
 (errno=110)
 [][X] [error] ajp_send_request::jk_ajp_common.c (1630):
 (nodeXX) connecting to backend failed. Tomcat is probably not started or is
 listening on the wrong port (errno=110)
 [][X] [error] ajp_service::jk_ajp_common.c (2626): (nodeXX)
 connecting to tomcat failed.
 
 
 [][X] [error] ajp_send_request::jk_ajp_common.c (1630):
 (nodeYY) connecting to backend failed. Tomcat is probably not started or is
 listening on the wrong port (errno=115)
 
 [][X] ] [error] ajp_send_request::jk_ajp_common.c (1630):
 (nodeYY) connecting to backend failed. Tomcat is probably not started or is
 listening on the wrong port (errno=115)
 [][X]  [error] ajp_service::jk_ajp_common.c (2626):
 (nodeYY) connecting to tomcat failed.
 
 
 What could be the explanations except for Tomcat Thread pool not having
 threads available anymore ? Thing we checked.
 
 Was there fixes in new mod_jk versions (1.2.37) regarding issues like these
 ?

System errno numbers are platform dependent and you didn't tell us your
OS. See e.g.

http://www.ioplex.com/~miallen/errcmpp.html

I guess oyu are on Linux and then those are expected errnos. The reason
is not expected on the jk side of things. As you said, it can be your
Tomcat got stuck - take Thread Dumps when this is happening to
investigate, or there's a network problem including possibly firewalls
in between mod_jk and Tomcat.

Regards,

Rainer


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

RE: mod_jk errors errno=110 and errno=115

[Martin Gainty]

Phillipe

ajp_send_request::jk_ajp_common.c (1630):
(nodeYY) connecting to backend failed. Tomcat is probably not started or is
listening on the wrong port (errno=115)

indicate that you might have a misconfig on jk.properties ...check out host and 
port attributes here
http://tomcat.apache.org/connectors-doc/reference/workers.html
Bon Chance,
Martin 
__ 
Note de déni et de confidentialitéCe message est confidentiel et peut être 
privilégié. Si vous n'êtes pas le destinataire prévu, nous te demandons avec 
bonté que pour satisfaire informez l'expéditeur. N'importe quelle diffusion non 
autorisée ou la copie de ceci est interdite. Ce message sert à l'information 
seulement et n'aura pas n'importe quel effet légalement obligatoire. Étant 
donné que les email peuvent facilement être sujets à la manipulation, nous ne 
pouvons accepter aucune responsabilité pour le contenu fourni.

  Date: Thu, 14 Feb 2013 14:17:10 +0100
 Subject: mod_jk errors errno=110 and errno=115
 From: pbo...@gmail.com
 To: users@tomcat.apache.org
 
 Hello,
 
 We have a mod_jk in version 1.2.28 with Apache 2.16  fronting a Tomcat
 server in version 6 on JDK6.
 
 We are facing long response times and timeouts from time to time.
 Mod_jk log files show the following errors:
 
 [][X] [error] ajp_connect_to_endpoint::jk_ajp_common.c
 (1035): (nodeXX) cping/cpong after connecting to the backend server failed
 (errno=110)
 [][X] [error] ajp_send_request::jk_ajp_common.c (1630):
 (nodeXX) connecting to backend failed. Tomcat is probably not started or is
 listening on the wrong port (errno=110)
 [][X] [error] ajp_connect_to_endpoint::jk_ajp_common.c
 (1035): (nodeXX) cping/cpong after connecting to the backend server failed
 (errno=110)
 [][X] [error] ajp_send_request::jk_ajp_common.c (1630):
 (nodeXX) connecting to backend failed. Tomcat is probably not started or is
 listening on the wrong port (errno=110)
 [][X] [error] ajp_service::jk_ajp_common.c (2626): (nodeXX)
 connecting to tomcat failed.
 
 
 [][X] [error] ajp_send_request::jk_ajp_common.c (1630):
 (nodeYY) connecting to backend failed. Tomcat is probably not started or is
 listening on the wrong port (errno=115)
 
 [][X] ] [error] ajp_send_request::jk_ajp_common.c (1630):
 (nodeYY) connecting to backend failed. Tomcat is probably not started or is
 listening on the wrong port (errno=115)
 [][X]  [error] ajp_service::jk_ajp_common.c (2626):
 (nodeYY) connecting to tomcat failed.
 
 
 What could be the explanations except for Tomcat Thread pool not having
 threads available anymore ? Thing we checked.
 
 Was there fixes in new mod_jk versions (1.2.37) regarding issues like these
 ?
 
 
 Thanks for your help
  

Re: mod_jk errors errno=110 and errno=115

[Philippe Bossu]

Thank you, we'll double check

On Friday, February 15, 2013, Martin Gainty wrote:

 Phillipe

 ajp_send_request::jk_ajp_common.c (1630):
 (nodeYY) connecting to backend failed. Tomcat is probably not started or is
 listening on the wrong port (errno=115)

 indicate that you might have a misconfig on jk.properties ...check out
 host and port attributes here
 http://tomcat.apache.org/connectors-doc/reference/workers.html
 Bon Chance,
 Martin
 __
 Note de déni et de confidentialitéCe message est confidentiel et peut être
 privilégié. Si vous n'êtes pas le destinataire prévu, nous te demandons
 avec bonté que pour satisfaire informez l'expéditeur. N'importe quelle
 diffusion non autorisée ou la copie de ceci est interdite. Ce message sert
 à l'information seulement et n'aura pas n'importe quel effet légalement
 obligatoire. Étant donné que les email peuvent facilement être sujets à la
 manipulation, nous ne pouvons accepter aucune responsabilité pour le
 contenu fourni.

   Date: Thu, 14 Feb 2013 14:17:10 +0100
  Subject: mod_jk errors errno=110 and errno=115
  From: pbo...@gmail.com javascript:;
  To: users@tomcat.apache.org javascript:;
 
  Hello,
 
  We have a mod_jk in version 1.2.28 with Apache 2.16  fronting a Tomcat
  server in version 6 on JDK6.
 
  We are facing long response times and timeouts from time to time.
  Mod_jk log files show the following errors:
 
  [][X] [error] ajp_connect_to_endpoint::jk_ajp_common.c
  (1035): (nodeXX) cping/cpong after connecting to the backend server
 failed
  (errno=110)
  [][X] [error] ajp_send_request::jk_ajp_common.c (1630):
  (nodeXX) connecting to backend failed. Tomcat is probably not started or
 is
  listening on the wrong port (errno=110)
  [][X] [error] ajp_connect_to_endpoint::jk_ajp_common.c
  (1035): (nodeXX) cping/cpong after connecting to the backend server
 failed
  (errno=110)
  [][X] [error] ajp_send_request::jk_ajp_common.c (1630):
  (nodeXX) connecting to backend failed. Tomcat is probably not started or
 is
  listening on the wrong port (errno=110)
  [][X] [error] ajp_service::jk_ajp_common.c (2626):
 (nodeXX)
  connecting to tomcat failed.
 
 
  [][X] [error] ajp_send_request::jk_ajp_common.c (1630):
  (nodeYY) connecting to backend failed. Tomcat is probably not started or
 is
  listening on the wrong port (errno=115)
 
  [][X] ] [error] ajp_send_request::jk_ajp_common.c (1630):
  (nodeYY) connecting to backend failed. Tomcat is probably not started or
 is
  listening on the wrong port (errno=115)
  [][X]  [error] ajp_service::jk_ajp_common.c (2626):
  (nodeYY) connecting to tomcat failed.
 
 
  What could be the explanations except for Tomcat Thread pool not having
  threads available anymore ? Thing we checked.
 
  Was there fixes in new mod_jk versions (1.2.37) regarding issues like
 these
  ?
 
 
  Thanks for your help

Re: mod_jk errors with tomcat 6.0.20 and Apache 2.0.52

[Christopher Schultz]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Matt,

On 1/22/2010 5:09 PM, Matt Turner wrote:
 In between times I tried the ProxyPass which seems to work fine, but I'd much 
 rather use plain AJP so I'll try that next.

AJP is the protocol used by both mod_jk and mod_proxy_ajp (which is what
you get if you use ProxyPass with an ajp:// URL). Which one depends on
your requirements:

mod_proxy_ajp is bundled with Aapche httpd and therefore has (usually)
no additional compilation and/or configuration to perform. Also, all
configuration for URL mapping, etc. occurs within httpd.conf.

mod_jk is separate and should be compiled on the target system, which is
inconvenient for some users. mod_jk is much older and had therefore
undergone much more in the way of testing in the wild. While
configuration can be done in httpd.conf, historically it's always been
done in an external file with a proprietary format, which increases
complexity.

In my experience, mod_jk is better with complex configurations than
mod_proxy_ajp, but mod_proxy_ajp is much more convenient for simple
configurations.

 I've had problems previously getting CAS working where the SSL is
 handled by the webserver - however from what everyone has said and
 having read around the issue a bit more, it does sound like using AJP
 ought to work, so long as Apache is configured to pass through all the
 relevant SSL and cert. info to tomcat (presumably so that isSecure() can
 work, plus I think CAS validates certificates too).

This will work: I've recently been playing around with client
certificates passed-through Apache httpd and it worked quite well once
the stars aligned for me (and I upgraded certain components that had
known issues with SSL cert chains).

I had Apache httpd validate the certs and then pass them through to
Tomcat, where I performed a manual certification-checking process as a
double-check as well as to pull some information from the cert for
identification purposes.

Good luck,
- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAktdxAUACgkQ9CaO5/Lv0PA80wCeIPVTty+amdv3Nuj2pdI1n6Vh
wloAnjU7hz7RkhYH/24YfdW7ARdH3lxL
=J/l8
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

mod_jk errors with tomcat 6.0.20 and Apache 2.0.52

[Matt Turner]

Hi All,

 

I have an existing Apache 2.0.52 installation, and a new tomcat 6.0.20 
installation.

They are both sitting on the same Linux box - uname -a returns the following:

Linux [machine name] 2.6.9-55.ELsmp #1 SMP Fri Apr 20 16:36:54 EDT 2007 x86_64 
x86_64 x86_64 GNU/Linux

 

I'd like if possible to add mod_jk to enable the two to talk to each other, 
without fiddling with the existing tomcat / apache versions.

 

So far I've build mod_jk 1.2.28 from source on the destination machine, and set 
up the following workers:

 

(in apache conf)

IfModule mod_jk.c
  JkWorkersFile /etc/httpd/conf/workers.properties

  JkLogFile /etc/httpd/logs/mod_jk.log

  JkLogLevel debug

  JkLogStampFormat [%a %b %d %H:%M:%S %Y] 

  JkWorkersFile /etc/httpd/conf/workers.properties

  JkLogFile /etc/httpd/logs/mod_jk.log

  JkLogLevel debug

  JkLogStampFormat [%a %b %d %H:%M:%S %Y] 

  JkRequestLogFormat %w %V %T

  JkOptions +ForwardURICompatUnparsed

  JkExtractSSL On
  JkHTTPSIndicator HTTPS
  JkSESSIONIndicator SSL_SESSION_ID
  JkCIPHERIndicator SSL_CIPHER
  JkCERTSIndicator SSL_CLIENT_CERT
/IfModule

 

(in apache conf, inside a virtual host)

SSLEngine on
SSLCertificateFile /etc/httpd/conf/filename

SSLCertificateKeyFile /etc/httpd/conf/filename

SSLCACertificateFile /etc/httpd/conf/filename

JkMount /* tomcatssl

 

(in workers.properties)

# 
# First tomcat server
# 
worker.tomcat1.port=8009
worker.tomcat1.host=10.13.0.218
worker.tomcat1.type=ajp13
worker.tomcat1.lbfactor=50

#-
# SSL tomcat server
#-
worker.tomcatssl.port=8443
worker.tomcatssl.host=10.13.0.218
worker.tomcatssl.type=ajp13
worker.tomcatssl.lbfactor=50

 

 

However when I kick things off and visit a URL matching the above virtual host, 
I get the following error message in mod_jk.log:

 

[Thu Jan 21 18:51:07 2010] [303:2537062720] [info] init_jk::mod_jk.c (3183): 
mod_jk/1.2.28 initialized
[Thu Jan 21 18:51:30 2010] [30428:2537062720] [error] 
ajp_connection_tcp_get_message::jk_ajp_common.c (1172): wrong message format 
0x1503 from 10.13.0.218:8443

 

 

Looking at jk_ajp_common.c I can see the following @ line 1172:

 


if (ae-proto == AJP13_PROTO) {
if (header != AJP13_SW_HEADER) {

if (header == AJP14_SW_HEADER) {
jk_log(l, JK_LOG_ERROR,
   received AJP14 reply on an AJP13 connection from %s,
   jk_dump_hinfo(ae-worker-worker_inet_addr, buf));
}
else {
jk_log(l, JK_LOG_ERROR,
   wrong message format 0x%04x from %s,
   header, jk_dump_hinfo(ae-worker-worker_inet_addr,
 buf));
}

 

 

So it seems the error has something do with AJP13 headers not being as expected.

 

Could anyone confirm that the 3 version numbers (2.0.52, 1.2.28, 6.0.20) are 
compatible together ?

 

If so - any ideas what might be going on here ?

 

 

 

thanks,

 

matt.
  
_
Tell us your greatest, weirdest and funniest Hotmail stories
http://clk.atdmt.com/UKM/go/195013117/direct/01/

Re: mod_jk errors with tomcat 6.0.20 and Apache 2.0.52

[Peter Crowther]

I'm not an AJP expert, but I suspect:

- You're telling AJP to use a secure connection between httpd and Tomcat;
- The Tomcat connector on port 8443 is a SSL connector, not an AJP connector;
- AJP is getting confused.

I believe you should only need to configure one worker (the one on
8009); AJP is capable of passing through the information as to whether
or not the data arrived securely or not at httpd.

I suspect you'll get a better answer once the States wakes up, but
that's my guess.

- Peter

2010/1/22 Matt Turner m4tt_tur...@hotmail.com:

 Hi All,



 I have an existing Apache 2.0.52 installation, and a new tomcat 6.0.20 
 installation.

 They are both sitting on the same Linux box - uname -a returns the following:

 Linux [machine name] 2.6.9-55.ELsmp #1 SMP Fri Apr 20 16:36:54 EDT 2007 
 x86_64 x86_64 x86_64 GNU/Linux



 I'd like if possible to add mod_jk to enable the two to talk to each other, 
 without fiddling with the existing tomcat / apache versions.



 So far I've build mod_jk 1.2.28 from source on the destination machine, and 
 set up the following workers:



 (in apache conf)

 IfModule mod_jk.c
  JkWorkersFile /etc/httpd/conf/workers.properties

  JkLogFile /etc/httpd/logs/mod_jk.log

  JkLogLevel debug

  JkLogStampFormat [%a %b %d %H:%M:%S %Y] 

  JkWorkersFile /etc/httpd/conf/workers.properties

  JkLogFile /etc/httpd/logs/mod_jk.log

  JkLogLevel debug

  JkLogStampFormat [%a %b %d %H:%M:%S %Y] 

  JkRequestLogFormat %w %V %T

  JkOptions +ForwardURICompatUnparsed

  JkExtractSSL On
  JkHTTPSIndicator HTTPS
  JkSESSIONIndicator SSL_SESSION_ID
  JkCIPHERIndicator SSL_CIPHER
  JkCERTSIndicator SSL_CLIENT_CERT
 /IfModule



 (in apache conf, inside a virtual host)

 SSLEngine on
 SSLCertificateFile /etc/httpd/conf/filename

 SSLCertificateKeyFile /etc/httpd/conf/filename

 SSLCACertificateFile /etc/httpd/conf/filename

 JkMount /* tomcatssl



 (in workers.properties)

 # 
 # First tomcat server
 # 
 worker.tomcat1.port=8009
 worker.tomcat1.host=10.13.0.218
 worker.tomcat1.type=ajp13
 worker.tomcat1.lbfactor=50

 #-
 # SSL tomcat server
 #-
 worker.tomcatssl.port=8443
 worker.tomcatssl.host=10.13.0.218
 worker.tomcatssl.type=ajp13
 worker.tomcatssl.lbfactor=50





 However when I kick things off and visit a URL matching the above virtual 
 host, I get the following error message in mod_jk.log:



 [Thu Jan 21 18:51:07 2010] [303:2537062720] [info] init_jk::mod_jk.c (3183): 
 mod_jk/1.2.28 initialized
 [Thu Jan 21 18:51:30 2010] [30428:2537062720] [error] 
 ajp_connection_tcp_get_message::jk_ajp_common.c (1172): wrong message format 
 0x1503 from 10.13.0.218:8443





 Looking at jk_ajp_common.c I can see the following @ line 1172:




 if (ae-proto == AJP13_PROTO) {
    if (header != AJP13_SW_HEADER) {

        if (header == AJP14_SW_HEADER) {
            jk_log(l, JK_LOG_ERROR,
                   received AJP14 reply on an AJP13 connection from %s,
                   jk_dump_hinfo(ae-worker-worker_inet_addr, buf));
        }
        else {
            jk_log(l, JK_LOG_ERROR,
                   wrong message format 0x%04x from %s,
                   header, jk_dump_hinfo(ae-worker-worker_inet_addr,
                                         buf));
        }





 So it seems the error has something do with AJP13 headers not being as 
 expected.



 Could anyone confirm that the 3 version numbers (2.0.52, 1.2.28, 6.0.20) are 
 compatible together ?



 If so - any ideas what might be going on here ?







 thanks,



 matt.

 _
 Tell us your greatest, weirdest and funniest Hotmail stories
 http://clk.atdmt.com/UKM/go/195013117/direct/01/

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

RE: mod_jk errors with tomcat 6.0.20 and Apache 2.0.52

[Matt Turner]

OK - sounds likely, many thanks.
I'll give that a whirl.

 Date: Fri, 22 Jan 2010 12:49:49 +
 Subject: Re: mod_jk errors with tomcat 6.0.20 and Apache 2.0.52
 From: peter.crowt...@melandra.com
 To: users@tomcat.apache.org
 
 I'm not an AJP expert, but I suspect:
 
 - You're telling AJP to use a secure connection between httpd and Tomcat;
 - The Tomcat connector on port 8443 is a SSL connector, not an AJP connector;
 - AJP is getting confused.
 
 I believe you should only need to configure one worker (the one on
 8009); AJP is capable of passing through the information as to whether
 or not the data arrived securely or not at httpd.
 
 I suspect you'll get a better answer once the States wakes up, but
 that's my guess.
 
 - Peter
 
 2010/1/22 Matt Turner m4tt_tur...@hotmail.com:
 
  Hi All,
 
 
 
  I have an existing Apache 2.0.52 installation, and a new tomcat 6.0.20 
  installation.
 
  They are both sitting on the same Linux box - uname -a returns the 
  following:
 
  Linux [machine name] 2.6.9-55.ELsmp #1 SMP Fri Apr 20 16:36:54 EDT 2007 
  x86_64 x86_64 x86_64 GNU/Linux
 
 
 
  I'd like if possible to add mod_jk to enable the two to talk to each other, 
  without fiddling with the existing tomcat / apache versions.
 
 
 
  So far I've build mod_jk 1.2.28 from source on the destination machine, and 
  set up the following workers:
 
 
 
  (in apache conf)
 
  IfModule mod_jk.c
   JkWorkersFile /etc/httpd/conf/workers.properties
 
   JkLogFile /etc/httpd/logs/mod_jk.log
 
   JkLogLevel debug
 
   JkLogStampFormat [%a %b %d %H:%M:%S %Y] 
 
   JkWorkersFile /etc/httpd/conf/workers.properties
 
   JkLogFile /etc/httpd/logs/mod_jk.log
 
   JkLogLevel debug
 
   JkLogStampFormat [%a %b %d %H:%M:%S %Y] 
 
   JkRequestLogFormat %w %V %T
 
   JkOptions +ForwardURICompatUnparsed
 
   JkExtractSSL On
   JkHTTPSIndicator HTTPS
   JkSESSIONIndicator SSL_SESSION_ID
   JkCIPHERIndicator SSL_CIPHER
   JkCERTSIndicator SSL_CLIENT_CERT
  /IfModule
 
 
 
  (in apache conf, inside a virtual host)
 
  SSLEngine on
  SSLCertificateFile /etc/httpd/conf/filename
 
  SSLCertificateKeyFile /etc/httpd/conf/filename
 
  SSLCACertificateFile /etc/httpd/conf/filename
 
  JkMount /* tomcatssl
 
 
 
  (in workers.properties)
 
  # 
  # First tomcat server
  # 
  worker.tomcat1.port=8009
  worker.tomcat1.host=10.13.0.218
  worker.tomcat1.type=ajp13
  worker.tomcat1.lbfactor=50
 
  #-
  # SSL tomcat server
  #-
  worker.tomcatssl.port=8443
  worker.tomcatssl.host=10.13.0.218
  worker.tomcatssl.type=ajp13
  worker.tomcatssl.lbfactor=50
 
 
 
 
 
  However when I kick things off and visit a URL matching the above virtual 
  host, I get the following error message in mod_jk.log:
 
 
 
  [Thu Jan 21 18:51:07 2010] [303:2537062720] [info] init_jk::mod_jk.c 
  (3183): mod_jk/1.2.28 initialized
  [Thu Jan 21 18:51:30 2010] [30428:2537062720] [error] 
  ajp_connection_tcp_get_message::jk_ajp_common.c (1172): wrong message 
  format 0x1503 from 10.13.0.218:8443
 
 
 
 
 
  Looking at jk_ajp_common.c I can see the following @ line 1172:
 
 
 
 
  if (ae-proto == AJP13_PROTO) {
 if (header != AJP13_SW_HEADER) {
 
 if (header == AJP14_SW_HEADER) {
 jk_log(l, JK_LOG_ERROR,
received AJP14 reply on an AJP13 connection from %s,
jk_dump_hinfo(ae-worker-worker_inet_addr, buf));
 }
 else {
 jk_log(l, JK_LOG_ERROR,
wrong message format 0x%04x from %s,
header, jk_dump_hinfo(ae-worker-worker_inet_addr,
  buf));
 }
 
 
 
 
 
  So it seems the error has something do with AJP13 headers not being as 
  expected.
 
 
 
  Could anyone confirm that the 3 version numbers (2.0.52, 1.2.28, 6.0.20) 
  are compatible together ?
 
 
 
  If so - any ideas what might be going on here ?
 
 
 
 
 
 
 
  thanks,
 
 
 
  matt.
 
  _
  Tell us your greatest, weirdest and funniest Hotmail stories
  http://clk.atdmt.com/UKM/go/195013117/direct/01/
 
 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org
 
  
_
Send us your Hotmail stories and be featured in our newsletter
http://clk.atdmt.com/UKM/go/195013117/direct/01/

Re: mod_jk errors with tomcat 6.0.20 and Apache 2.0.52

[Tobias Crefeld]

I guess that you should exchange the JkMount /* tomcatssl by
JkMount /* tomcat1 provided you use a standard Tomcat-setup.

For a parallel SSL- + Non-SSL-Setup using Apache2 you basically need 2
virtual-hosts in Apache2. One for Port 443 with the
standard-SSL-parameters Apache2 expects to integrate OpenSSL for https
and another for Port 80 / plain http. The Jk-directives are the same for
both virtual hosts and don't care about SSL and go to Tomcats port 8009
(= using standard configuration). 
8443 is typically the http-over-ssl-port (=http) for direct SSL access via
coyote-connector and has nothing to do with ajp.

If your Apache2 is doing the SSL-integration Tomcat sees no
SSL-traffic because Apache2 lets openssl do the conversion from SSL and
is connecting to Tomcat without any SSL-traffic but simple http.

You can give Tomcat some information about the SSL-session like you did
with

  JkExtractSSL On
  JkHTTPSIndicator HTTPS
  JkSESSIONIndicator SSL_SESSION_ID
  JkCIPHERIndicator SSL_CIPHER
  JkCERTSIndicator SSL_CLIENT_CERT

but then you have to give Apache2 an advice to deliver these
information by a 
 SSLOptions +StdEnvVars +ExportCertData

(http://tomcat.apache.org/tomcat-3.2-doc/tomcat-ssl-howto.html might
give you an idea about the two possibilities to setup Tomcat + SSL)


On some of our servers we're still running Apache 2.0 + mod_jk + Tomcat
6 on Solaris - nearly the same setup as under Linux.
These servers run with SSL and Non-SSL parallel but without these extra
Jk-SSL-indicator-parameters you are using.


Gruß,
 Tobias.

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

RE: mod_jk errors with tomcat 6.0.20 and Apache 2.0.52

[Matt Turner]

In my case sometimes I do need to pass through the SSL to Tomcat, as I'm 
running CAS which requires geniune SSL requests.

(I do also have some SSL requests that tomcat doesn't need to see - which I 
will send via 8009 as has been suggested).

 

The SSL pass-through requirement explains why I was attempting to pass through 
to :8443 directly - but it sounds like that's the wrong approach.

 

Should I just use something like..

  ProxyPass /cas https://10.13.0.218:8443/cas ?

 

Many thanks,

 

matt.
 
 Date: Fri, 22 Jan 2010 14:24:49 +0100
 From: t...@cataneo.eu
 To: users@tomcat.apache.org
 Subject: Re: mod_jk errors with tomcat 6.0.20 and Apache 2.0.52
 
 I guess that you should exchange the JkMount /* tomcatssl by
 JkMount /* tomcat1 provided you use a standard Tomcat-setup.
 
 For a parallel SSL- + Non-SSL-Setup using Apache2 you basically need 2
 virtual-hosts in Apache2. One for Port 443 with the
 standard-SSL-parameters Apache2 expects to integrate OpenSSL for https
 and another for Port 80 / plain http. The Jk-directives are the same for
 both virtual hosts and don't care about SSL and go to Tomcats port 8009
 (= using standard configuration). 
 8443 is typically the http-over-ssl-port (=http) for direct SSL access via
 coyote-connector and has nothing to do with ajp.
 
 If your Apache2 is doing the SSL-integration Tomcat sees no
 SSL-traffic because Apache2 lets openssl do the conversion from SSL and
 is connecting to Tomcat without any SSL-traffic but simple http.
 
 You can give Tomcat some information about the SSL-session like you did
 with
 
  JkExtractSSL On
  JkHTTPSIndicator HTTPS
  JkSESSIONIndicator SSL_SESSION_ID
  JkCIPHERIndicator SSL_CIPHER
  JkCERTSIndicator SSL_CLIENT_CERT
 
 but then you have to give Apache2 an advice to deliver these
 information by a 
 SSLOptions +StdEnvVars +ExportCertData
 
 (http://tomcat.apache.org/tomcat-3.2-doc/tomcat-ssl-howto.html might
 give you an idea about the two possibilities to setup Tomcat + SSL)
 
 
 On some of our servers we're still running Apache 2.0 + mod_jk + Tomcat
 6 on Solaris - nearly the same setup as under Linux.
 These servers run with SSL and Non-SSL parallel but without these extra
 Jk-SSL-indicator-parameters you are using.
 
 
 Gruß,
 Tobias.
 
 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org
 
  
_
Got a cool Hotmail story? Tell us now
http://clk.atdmt.com/UKM/go/195013117/direct/01/

Re: mod_jk errors with tomcat 6.0.20 and Apache 2.0.52

[Tobias Crefeld]

Am Fri, 22 Jan 2010 14:25:11 +
schrieb Matt Turner m4tt_tur...@hotmail.com:

 The SSL pass-through requirement explains why I was attempting to
 pass through to :8443 directly - but it sounds like that's the wrong
 approach.

If it isn't possible to move the SSL-certificate and -keys to the
Apache2 (and change the Tomcat to service ajp- or plain-http-requests)
the only possibility to do a pass-through will be a NAT-machine /
firewall with port-forwarding (e.g. port 443 - 8443).

There is another approach to passthrough https (=443) to 8443 by using
xinetd:
 http://tp.its.yale.edu/pipermail/cas/2008-April/008083.html


 Should I just use something like..
 
   ProxyPass /cas https://10.13.0.218:8443/cas ?

I doubt that this will work. A https-client (alias webbrowser) is
transmitting SSL-traffic and ProxyPass is configuring a http-proxy
which expects http - no matter what kind of traffic it use to connect
to the real webserver.


RU,
 Tobias.

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: mod_jk errors with tomcat 6.0.20 and Apache 2.0.52

[Christopher Schultz]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Peter,

On 1/22/2010 7:49 AM, Peter Crowther wrote:
 - You're telling AJP to use a secure connection between httpd and Tomcat;

AJP doesn't recognize any secure connection capability for its own
communication. As you've said, AJP /does/ forward SSL information
through the AJP connection to Tomcat.

 - The Tomcat connector on port 8443 is a SSL connector, not an AJP connector;

Almost certainly, though Matt didn't post his server.xml for verification.

 - AJP is getting confused.

Absolutely!

 I believe you should only need to configure one worker (the one on
 8009); AJP is capable of passing through the information as to whether
 or not the data arrived securely or not at httpd.

+1

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAktaAY8ACgkQ9CaO5/Lv0PBqsACfUUO1yKeUrFqKR0dh+oCQxtey
2ycAnRlvfeJZ0dt+48sKFmU35jou9M6d
=xcqk
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: mod_jk errors with tomcat 6.0.20 and Apache 2.0.52

[Christopher Schultz]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Matt,

On 1/22/2010 9:25 AM, Matt Turner wrote:
 In my case sometimes I do need to pass through the SSL to Tomcat, as
 I'm running CAS which requires geniune SSL requests.

mod_jk ought to be able to forward all SSL information to Tomcat.
Specifically, what does CAS require?

 (I do also have some SSL requests that tomcat doesn't need to see -
 which I will send via 8009 as has been suggested).
 
 The SSL pass-through requirement explains why I was attempting to
 pass through to :8443 directly - but it sounds like that's the wrong
 approach.

Unless something specific is actually not working, you ought to be able
to use a vanilla AJP connection for both secure and non-secure HTTP
(even via the same worker/Connector).

 Should I just use something like..
 
 ProxyPass /cas https://10.13.0.218:8443/cas ?

Now, you're switching from mod_jk to mod_proxy_http(s). Can CAS really
not function properly with an AJP connection?

If you proxy HTTPS you are likely to get in all kinds of trouble because
the client is no longer your user... it's your web server. And the
server is no longer the web server... it's Tomcat.

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAktaAjEACgkQ9CaO5/Lv0PAV6ACfYlbK3Kws26nq7xPYICSlucmC
JqMAoLyACwFx0JxEBozCMWt81KvGmq+B
=Br3o
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

RE: mod_jk errors with tomcat 6.0.20 and Apache 2.0.52

[Matt Turner]

Thanks for the responses.

In between times I tried the ProxyPass which seems to work fine, but I'd much 
rather use plain AJP so I'll try that next.
I've had problems previously getting CAS working where the SSL is handled by 
the webserver - however from what everyone has said and having read around the 
issue a bit more, it does sound like using AJP ought to work, so long as Apache 
is configured to pass through all the relevant SSL and cert. info to tomcat 
(presumably so that isSecure() can work, plus I think CAS validates 
certificates too).

 Date: Fri, 22 Jan 2010 14:53:21 -0500
 From: ch...@christopherschultz.net
 To: users@tomcat.apache.org
 Subject: Re: mod_jk errors with tomcat 6.0.20 and Apache 2.0.52
 
 -BEGIN PGP SIGNED MESSAGE-
 Hash: SHA1
 
 Matt,
 
 On 1/22/2010 9:25 AM, Matt Turner wrote:
  In my case sometimes I do need to pass through the SSL to Tomcat, as
  I'm running CAS which requires geniune SSL requests.
 
 mod_jk ought to be able to forward all SSL information to Tomcat.
 Specifically, what does CAS require?
 
  (I do also have some SSL requests that tomcat doesn't need to see -
  which I will send via 8009 as has been suggested).
  
  The SSL pass-through requirement explains why I was attempting to
  pass through to :8443 directly - but it sounds like that's the wrong
  approach.
 
 Unless something specific is actually not working, you ought to be able
 to use a vanilla AJP connection for both secure and non-secure HTTP
 (even via the same worker/Connector).
 
  Should I just use something like..
  
  ProxyPass /cas https://10.13.0.218:8443/cas ?
 
 Now, you're switching from mod_jk to mod_proxy_http(s). Can CAS really
 not function properly with an AJP connection?
 
 If you proxy HTTPS you are likely to get in all kinds of trouble because
 the client is no longer your user... it's your web server. And the
 server is no longer the web server... it's Tomcat.
 
 - -chris
 -BEGIN PGP SIGNATURE-
 Version: GnuPG v1.4.10 (MingW32)
 Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
 
 iEYEARECAAYFAktaAjEACgkQ9CaO5/Lv0PAV6ACfYlbK3Kws26nq7xPYICSlucmC
 JqMAoLyACwFx0JxEBozCMWt81KvGmq+B
 =Br3o
 -END PGP SIGNATURE-
 
 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org
 
  
_
Tell us your greatest, weirdest and funniest Hotmail stories
http://clk.atdmt.com/UKM/go/195013117/direct/01/

RE: mod_jk errors and http status code 503 under load

[Damien Corbishley]

Good morning Rainer,

bash-3.00# /usr/local/apache2/bin/httpd -V
Server version: Apache/2.0.55
Server built:   Mar  5 2007 11:10:17
Server's Module Magic Number: 20020903:11
Architecture:   32-bit
Server compiled with
 -D APACHE_MPM_DIR=server/mpm/worker
 -D APR_HAS_MMAP
 -D APR_HAVE_IPV6 (IPv4-mapped addresses enabled)
 -D APR_USE_FCNTL_SERIALIZE
 -D APR_USE_PTHREAD_SERIALIZE
 -D SINGLE_LISTEN_UNSERIALIZED_ACCEPT
 -D APR_HAS_OTHER_CHILD
 -D AP_HAVE_RELIABLE_PIPED_LOGS
 -D HTTPD_ROOT=/usr/local/apache2
 -D SUEXEC_BIN=/usr/local/apache2/bin/suexec
 -D DEFAULT_SCOREBOARD=logs/apache_runtime_status
 -D DEFAULT_ERRORLOG=logs/error_log
 -D AP_TYPES_CONFIG_FILE=conf/mime.types
 -D SERVER_CONFIG_FILE=conf/httpd.conf

I shall upgrade our mod_jk component and set the connection timeout
property.

I am currently using jmeter to try and re-produce the problem in our lab
before I update anything - just so I can be sure if I have solved the
issue.

May I get back to you later if I am still having issues?

Damien


-Original Message-
From: Rainer Jung [mailto:[EMAIL PROTECTED] 
Sent: Thursday, September 06, 2007 4:52 PM
To: Tomcat Users List
Subject: Re: mod_jk errors and http status code 503 under load

Damien Corbishley wrote:
 Hi Rainer,
  
 Apache:
 Server version: Apache/2.0.55
 Server built:   Mar  5 2007 11:10:17
 Server's Module Magic Number: 20020903:11
 
 Yes, we are thinking about updating the Java, I was in the process of
 checking the release notes to see if anything specific was mentioned.
 
 Mod JK:
 mod_jk/1.2.15

OK, 1.2.15 is a little antique. At the moment we reached 1.2.25.

 Worker or prefork MPM? - I don't understand the question, sorry.

MPM = Multi processing module
prefork = multiple processes, but only one thread per process
worker = multiple processes with a couple of threads per process 
(default=25)

The strings prefork or worker are also cintained in the output of httpd

-V. Example:

...
Server compiled with
  -D APACHE_MPM_DIR=server/mpm/prefork
...

 Connector port=8009
enableLookups=false redirectPort=8443
 protocol=AJP/1.3
acceptCount=50
minSpareThreads=240
maxThreads=950
backlog=50
address=127.0.0.1
debug=0
/

You should have a connectionTimeout.

 Tomcat is installed on the same machine as Apache.
 
 With respect to the number of connections to the tomcat port I can't
 give a complete answer - looking at the crash I can see there are
around
 4000 stuck at TIME_WAIT. Another 30 or so are at ESTABLISHED.

All of those 4000 TIME_WAIT for port 8009? That would be very much, 
indicating, that you are rapidly opening and closing the connections 
between Apache/mod_jk and tomcat. Those connections are supposed to be 
reused for some time.

 The mod jk configuration:

This file only consits of comments?

 ## THIS FILE MAY BE OVERRIDEN AT RUNTIME. MAKE SURE TOMCAT IS STOPED
 ## WHEN YOU EDIT THE FILE.
 
 ## COMMENTS WILL BE _LOST_
 
 ## DOCUMENTATION OF THE FORMAT IN JkMain javadoc.
 
 # Set the desired handler list
 # handler.list=apr,request,channelJni
 #
 # Override the default port for the socketChannel
 # channelSocket.port=8019
 # Default:
 # channelUnix.file=${jkHome}/work/jk2.socket
 # Just to check if the the config  is working
 # shm.file=${jkHome}/work/jk2.shm
 
 # In order to enable jni use any channelJni directive
 # channelJni.disabled = 0
 # And one of the following directives:
 
 # apr.jniModeSo=/opt/apache2/modules/mod_jk2.so
 
 # If set to inprocess the mod_jk2 will Register natives itself
 # This will enable the starting of the Tomcat from mod_jk2
 # apr.jniModeSo=inprocess
 


 bash-3.00# cat ./callflow-server/webserver/conf/workers.properties
 workers.apache_log=/usr/local/apache2

This attribute never existed (so it's ignored).

 workers.tomcat_home=/opt/tomcat
 workers.java_home=/usr/j2se/

Thos two don't have a meaning any more.

 worker.list= worker1
 
 worker.worker1.type=ajp13
 
 worker.worker1.host=127.0.0.1
 worker.worker1.port=8009
 worker.worker1.lbfactor=2.5

Not needed, if you are not using a JK load balancer. If you upgrade and 
later want to use a JK load balancer: newer JK versions use integer 
numbers here.

 # Number of concurrent users.
 worker.worker1.cachesize=950
 worker.worker1.cache_timeout=600

So set connectionTimeout in the AJP connector (server.xml) to 60 
(Milliseconds).

 worker.worker1.socket_timeout=300
 
 Yes, I agree with you about contacting SUN, I'm digging out our
service
 plan at the moment.

I don't see a good reason, why you should get those error messages for 
this configuration. But you should update to a more recent mod_jk in 
order to research this problem from a better starting point (and maybe 
it will be gone).

 Damien
 
 
 -Original Message-
 From: Rainer Jung [mailto:[EMAIL PROTECTED] 
 Sent: Thursday, September 06, 2007 3:42 PM
 To: Tomcat Users List
 Subject: Re

Re: mod_jk errors and http status code 503 under load

[Rainer Jung]

Hi Damien,

Damien Corbishley wrote:

Good morning Rainer,

bash-3.00# /usr/local/apache2/bin/httpd -V
Server version: Apache/2.0.55
Server built:   Mar  5 2007 11:10:17
Server's Module Magic Number: 20020903:11
Architecture:   32-bit
Server compiled with
 -D APACHE_MPM_DIR=server/mpm/worker
 -D APR_HAS_MMAP
 -D APR_HAVE_IPV6 (IPv4-mapped addresses enabled)
 -D APR_USE_FCNTL_SERIALIZE
 -D APR_USE_PTHREAD_SERIALIZE
 -D SINGLE_LISTEN_UNSERIALIZED_ACCEPT
 -D APR_HAS_OTHER_CHILD
 -D AP_HAVE_RELIABLE_PIPED_LOGS
 -D HTTPD_ROOT=/usr/local/apache2
 -D SUEXEC_BIN=/usr/local/apache2/bin/suexec
 -D DEFAULT_SCOREBOARD=logs/apache_runtime_status
 -D DEFAULT_ERRORLOG=logs/error_log
 -D AP_TYPES_CONFIG_FILE=conf/mime.types
 -D SERVER_CONFIG_FILE=conf/httpd.conf

I shall upgrade our mod_jk component and set the connection timeout
property.

I am currently using jmeter to try and re-produce the problem in our lab
before I update anything - just so I can be sure if I have solved the
issue.

May I get back to you later if I am still having issues?


Of course, and in case I'm to busy: there are more JK users out there 
reading the list and helping with problems.



Damien


Regards,

Rainer

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

mod_jk errors and http status code 503 under load

[Damien Corbishley]

Hi, 

 I'm getting stuck with an error we are seeing on our production server
under load. 

 I've googled and found many posts on similar topics but I haven't found
an answer yet, 

 I was hoping somebody here could shed some light on my issue:

 

We upgraded our combination of Apache,Tomcat,Java all running on Solaris
10 to 

Apache 2_2.0.55.build2

Tomcat 5.5.23

Java 1.5.0_06-b05

 

Our Apache Tomcat connector is AJP/1.3.

 

It's all installed on the same server, we have no tomcat clusters and no
load balancers.

 

With a few (10) concurrent users accessing the various JSP's everything
worked as expected, all our functional tests passed.

We opened more up live traffic to the server and starting seeing the
following error message:

 

[Thu Sep 06 02:23:00 2007] [error] ajp_service::jk_ajp_common.c (1758):
Error connecting to tomcat. Tomcat is probably not started or is
listening on the wrong port. worker=worker1 failed

 

On the client side this was being reported as a 503 and our
intelligent browser was re-submitting the request and generally, 

on the second time, the request would be successful. 

After an hour we then had a Solaris panic, and after analyzing the crash
using scat I can see that the cause was:

 

panic string:   BAD TRAP: type=9 rp=2a1015332d0 addr=0 mmu_fsr=0

 

and looking further into the trap, it seems to be network related.

 

trapip:tcp_conn_request+0x894 (0x4, 0x2000, 0x136ec00, 0x3a2b9a44040,
0x40e03960300, 0x40dedc247c0)

ip:squeue_drain+0xe4 (0x300015ddec0, 0x40e2021c1c0, 0x411666de,
0x135f2c0, 0x3a2b9a44040, 0x3)

ip:squeue_enter+0x358 (0x300015ddec0, 0x38fca5e0d80, 0x3000426b640,
0x3a2bd674c00, 0x0, 0x1)

ip:tcp_wput - frame recycled

 

I am still trying to work out if the crash is a symptom of the browsers
resubmitting the failed requests and we've hit a Solaris bug that we
haven't got a patch for,

Or if the two errors are unrelated and it was coincidence that we
panicked whilst having mod_jk errors. 

 

 

Any help/pointers in resolving the mod_jk error would be appreciated, I
included the brief crash information as it may be relevant. 

Thanks

 

Damien


This e-mail transmission may contain information that is proprietary, 
privileged and/or confidential and is intended exclusively for the person(s) to 
whom it is addressed. Any use, copying, retention or disclosure by any person 
other than the intended recipient or the intended recipient's designees is 
strictly prohibited. If you are the intended recipient, you must treat the 
information in confidence and in accordance with all laws related to the 
privacy and confidentiality of such information.  If you are not the intended 
recipient or their designee, please notify the sender immediately by return 
e-mail and delete all copies of this email, including all attachments.

Intervoice, Inc. 17811 Waterview Parkway Dallas, TX 75252 USA

Intervoice Limited, Registered in England and Wales with number 2601740, 50 
Park Road, Gatley, Cheshire, SK8 4HZ. VAT Number: 560421375

Intervoice GmbH, Hagenauer Straße 55, 65203 Wiesbaden, Sitz der Gesellschaft: 
Wiesbaden, Handelsregister: HRB 8186 (Amtsgericht Wiesbaden), Geschäftsführer: 
Richard Arnold.

Re: mod_jk errors and http status code 503 under load

[Rainer Jung]

Damien Corbishley wrote:

Hi,

I'm getting stuck with an error we are seeing on our production
server under load.

We upgraded our combination of Apache,Tomcat,Java all running on
Solaris 10 to

Apache 2_2.0.55.build2


This doesn't sound like a real Apache httpd version. You can check the 
real version with httpd -V or when using log level info in the error 
log of httpd.


Worker or prefork MPM?


Tomcat 5.5.23

Java 1.5.0_06-b05


If you are in a general update situation, switch to 1.5.0_12 or whatever 
seems to be recent and not only a couple days old.


And finally mod_jk-version?


Our Apache Tomcat connector is AJP/1.3.


What's the configuration of the connector element in server.xml?


It's all installed on the same server, we have no tomcat clusters and
no load balancers.

With a few (10) concurrent users accessing the various JSP's
everything worked as expected, all our functional tests passed.

We opened more up live traffic to the server and starting seeing the 
following error message:


[Thu Sep 06 02:23:00 2007] [error] ajp_service::jk_ajp_common.c
(1758): Error connecting to tomcat. Tomcat is probably not started or
is listening on the wrong port. worker=worker1 failed


Is Tomcat on the same machine, or on another one?

What do you get for netstat -an| grep TOMCATPORT where you replace 
TOMCATPORT with the port number your Tomcat AJP connector listens on?


How many ESTABLISHED, how many of other states (SYN_SENT, CLOSE_WAIT etc.)?

What's you mod_jk configuration?

On the client side this was being reported as a 503 and our 
intelligent browser was re-submitting the request and generally,


on the second time, the request would be successful.

After an hour we then had a Solaris panic, and after analyzing the
crash using scat I can see that the cause was:


Solaris panic looks very bad. I would definitely open a bug with sun. 
I'm not saying that the original problem is there, but it is very 
unusual, that the whole system panics.



panic string:   BAD TRAP: type=9 rp=2a1015332d0 addr=0 mmu_fsr=0

and looking further into the trap, it seems to be network related.

trapip:tcp_conn_request+0x894 (0x4, 0x2000, 0x136ec00,
0x3a2b9a44040, 0x40e03960300, 0x40dedc247c0)

ip:squeue_drain+0xe4 (0x300015ddec0, 0x40e2021c1c0, 0x411666de, 
0x135f2c0, 0x3a2b9a44040, 0x3)


ip:squeue_enter+0x358 (0x300015ddec0, 0x38fca5e0d80, 0x3000426b640, 
0x3a2bd674c00, 0x0, 0x1)


ip:tcp_wput - frame recycled



I am still trying to work out if the crash is a symptom of the
browsers resubmitting the failed requests and we've hit a Solaris bug
that we haven't got a patch for,

Or if the two errors are unrelated and it was coincidence that we 
panicked whilst having mod_jk errors.



Any help/pointers in resolving the mod_jk error would be appreciated,
I included the brief crash information as it may be relevant.

Thanks

Damien


Regards,

Rainer

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

RE: mod_jk errors and http status code 503 under load

[Damien Corbishley]

Hi Rainer,
 
Apache:
Server version: Apache/2.0.55
Server built:   Mar  5 2007 11:10:17
Server's Module Magic Number: 20020903:11

Yes, we are thinking about updating the Java, I was in the process of
checking the release notes to see if anything specific was mentioned.

Mod JK:
mod_jk/1.2.15

Worker or prefork MPM? - I don't understand the question, sorry.

Connector port=8009
   enableLookups=false redirectPort=8443
protocol=AJP/1.3
   acceptCount=50
   minSpareThreads=240
   maxThreads=950
   backlog=50
   address=127.0.0.1
   debug=0
   /

Tomcat is installed on the same machine as Apache.

With respect to the number of connections to the tomcat port I can't
give a complete answer - looking at the crash I can see there are around
4000 stuck at TIME_WAIT. Another 30 or so are at ESTABLISHED.

The mod jk configuration:

## THIS FILE MAY BE OVERRIDEN AT RUNTIME. MAKE SURE TOMCAT IS STOPED
## WHEN YOU EDIT THE FILE.

## COMMENTS WILL BE _LOST_

## DOCUMENTATION OF THE FORMAT IN JkMain javadoc.

# Set the desired handler list
# handler.list=apr,request,channelJni
#
# Override the default port for the socketChannel
# channelSocket.port=8019
# Default:
# channelUnix.file=${jkHome}/work/jk2.socket
# Just to check if the the config  is working
# shm.file=${jkHome}/work/jk2.shm

# In order to enable jni use any channelJni directive
# channelJni.disabled = 0
# And one of the following directives:

# apr.jniModeSo=/opt/apache2/modules/mod_jk2.so

# If set to inprocess the mod_jk2 will Register natives itself
# This will enable the starting of the Tomcat from mod_jk2
# apr.jniModeSo=inprocess


bash-3.00# cat ./callflow-server/webserver/conf/workers.properties
workers.apache_log=/usr/local/apache2
workers.tomcat_home=/opt/tomcat
workers.java_home=/usr/j2se/

worker.list= worker1

worker.worker1.type=ajp13

worker.worker1.host=127.0.0.1
worker.worker1.port=8009
worker.worker1.lbfactor=2.5

# Number of concurrent users.
worker.worker1.cachesize=950
worker.worker1.cache_timeout=600
worker.worker1.socket_timeout=300

Yes, I agree with you about contacting SUN, I'm digging out our service
plan at the moment.

Damien


-Original Message-
From: Rainer Jung [mailto:[EMAIL PROTECTED] 
Sent: Thursday, September 06, 2007 3:42 PM
To: Tomcat Users List
Subject: Re: mod_jk errors and http status code 503 under load

Damien Corbishley wrote:
 Hi,
 
 I'm getting stuck with an error we are seeing on our production
 server under load.
 
 We upgraded our combination of Apache,Tomcat,Java all running on
 Solaris 10 to
 
 Apache 2_2.0.55.build2

This doesn't sound like a real Apache httpd version. You can check the 
real version with httpd -V or when using log level info in the error 
log of httpd.

Worker or prefork MPM?

 Tomcat 5.5.23
 
 Java 1.5.0_06-b05

If you are in a general update situation, switch to 1.5.0_12 or whatever

seems to be recent and not only a couple days old.

And finally mod_jk-version?

 Our Apache Tomcat connector is AJP/1.3.

What's the configuration of the connector element in server.xml?

 It's all installed on the same server, we have no tomcat clusters and
 no load balancers.
 
 With a few (10) concurrent users accessing the various JSP's
 everything worked as expected, all our functional tests passed.
 
 We opened more up live traffic to the server and starting seeing the 
 following error message:
 
 [Thu Sep 06 02:23:00 2007] [error] ajp_service::jk_ajp_common.c
 (1758): Error connecting to tomcat. Tomcat is probably not started or
 is listening on the wrong port. worker=worker1 failed

Is Tomcat on the same machine, or on another one?

What do you get for netstat -an| grep TOMCATPORT where you replace 
TOMCATPORT with the port number your Tomcat AJP connector listens on?

How many ESTABLISHED, how many of other states (SYN_SENT, CLOSE_WAIT
etc.)?

What's you mod_jk configuration?

 On the client side this was being reported as a 503 and our 
 intelligent browser was re-submitting the request and generally,
 
 on the second time, the request would be successful.
 
 After an hour we then had a Solaris panic, and after analyzing the
 crash using scat I can see that the cause was:

Solaris panic looks very bad. I would definitely open a bug with sun. 
I'm not saying that the original problem is there, but it is very 
unusual, that the whole system panics.

 panic string:   BAD TRAP: type=9 rp=2a1015332d0 addr=0 mmu_fsr=0
 
 and looking further into the trap, it seems to be network related.
 
 trapip:tcp_conn_request+0x894 (0x4, 0x2000, 0x136ec00,
 0x3a2b9a44040, 0x40e03960300, 0x40dedc247c0)
 
 ip:squeue_drain+0xe4 (0x300015ddec0, 0x40e2021c1c0, 0x411666de, 
 0x135f2c0, 0x3a2b9a44040, 0x3)
 
 ip:squeue_enter+0x358 (0x300015ddec0, 0x38fca5e0d80, 0x3000426b640, 
 0x3a2bd674c00, 0x0, 0x1)
 
 ip:tcp_wput - frame recycled
 
 
 
 I am still trying to work out if the crash is a symptom of the
 browsers

Re: mod_jk errors and http status code 503 under load

[Rainer Jung]

Damien Corbishley wrote:

Hi Rainer,
 
Apache:

Server version: Apache/2.0.55
Server built:   Mar  5 2007 11:10:17
Server's Module Magic Number: 20020903:11

Yes, we are thinking about updating the Java, I was in the process of
checking the release notes to see if anything specific was mentioned.

Mod JK:
mod_jk/1.2.15


OK, 1.2.15 is a little antique. At the moment we reached 1.2.25.


Worker or prefork MPM? - I don't understand the question, sorry.


MPM = Multi processing module
prefork = multiple processes, but only one thread per process
worker = multiple processes with a couple of threads per process 
(default=25)


The strings prefork or worker are also cintained in the output of httpd 
-V. Example:


...
Server compiled with
 -D APACHE_MPM_DIR=server/mpm/prefork
...


Connector port=8009
   enableLookups=false redirectPort=8443
protocol=AJP/1.3
   acceptCount=50
   minSpareThreads=240
   maxThreads=950
   backlog=50
   address=127.0.0.1
   debug=0
   /


You should have a connectionTimeout.


Tomcat is installed on the same machine as Apache.

With respect to the number of connections to the tomcat port I can't
give a complete answer - looking at the crash I can see there are around
4000 stuck at TIME_WAIT. Another 30 or so are at ESTABLISHED.


All of those 4000 TIME_WAIT for port 8009? That would be very much, 
indicating, that you are rapidly opening and closing the connections 
between Apache/mod_jk and tomcat. Those connections are supposed to be 
reused for some time.



The mod jk configuration:


This file only consits of comments?


## THIS FILE MAY BE OVERRIDEN AT RUNTIME. MAKE SURE TOMCAT IS STOPED
## WHEN YOU EDIT THE FILE.

## COMMENTS WILL BE _LOST_

## DOCUMENTATION OF THE FORMAT IN JkMain javadoc.

# Set the desired handler list
# handler.list=apr,request,channelJni
#
# Override the default port for the socketChannel
# channelSocket.port=8019
# Default:
# channelUnix.file=${jkHome}/work/jk2.socket
# Just to check if the the config  is working
# shm.file=${jkHome}/work/jk2.shm

# In order to enable jni use any channelJni directive
# channelJni.disabled = 0
# And one of the following directives:

# apr.jniModeSo=/opt/apache2/modules/mod_jk2.so

# If set to inprocess the mod_jk2 will Register natives itself
# This will enable the starting of the Tomcat from mod_jk2
# apr.jniModeSo=inprocess





bash-3.00# cat ./callflow-server/webserver/conf/workers.properties
workers.apache_log=/usr/local/apache2


This attribute never existed (so it's ignored).


workers.tomcat_home=/opt/tomcat
workers.java_home=/usr/j2se/


Thos two don't have a meaning any more.


worker.list= worker1

worker.worker1.type=ajp13

worker.worker1.host=127.0.0.1
worker.worker1.port=8009
worker.worker1.lbfactor=2.5


Not needed, if you are not using a JK load balancer. If you upgrade and 
later want to use a JK load balancer: newer JK versions use integer 
numbers here.



# Number of concurrent users.
worker.worker1.cachesize=950
worker.worker1.cache_timeout=600


So set connectionTimeout in the AJP connector (server.xml) to 60 
(Milliseconds).



worker.worker1.socket_timeout=300

Yes, I agree with you about contacting SUN, I'm digging out our service
plan at the moment.


I don't see a good reason, why you should get those error messages for 
this configuration. But you should update to a more recent mod_jk in 
order to research this problem from a better starting point (and maybe 
it will be gone).



Damien


-Original Message-
From: Rainer Jung [mailto:[EMAIL PROTECTED] 
Sent: Thursday, September 06, 2007 3:42 PM

To: Tomcat Users List
Subject: Re: mod_jk errors and http status code 503 under load

Damien Corbishley wrote:

Hi,

I'm getting stuck with an error we are seeing on our production
server under load.

We upgraded our combination of Apache,Tomcat,Java all running on
Solaris 10 to

Apache 2_2.0.55.build2


This doesn't sound like a real Apache httpd version. You can check the 
real version with httpd -V or when using log level info in the error 
log of httpd.


Worker or prefork MPM?


Tomcat 5.5.23

Java 1.5.0_06-b05


If you are in a general update situation, switch to 1.5.0_12 or whatever

seems to be recent and not only a couple days old.

And finally mod_jk-version?


Our Apache Tomcat connector is AJP/1.3.


What's the configuration of the connector element in server.xml?


It's all installed on the same server, we have no tomcat clusters and
no load balancers.

With a few (10) concurrent users accessing the various JSP's
everything worked as expected, all our functional tests passed.

We opened more up live traffic to the server and starting seeing the 
following error message:


[Thu Sep 06 02:23:00 2007] [error] ajp_service::jk_ajp_common.c
(1758): Error connecting to tomcat. Tomcat is probably not started or
is listening on the wrong port. worker=worker1 failed


Is Tomcat

Re: mod_jk errors - are these normal?

[Justin Greene]

 -Original Message-
 From: michael thomas [mailto:[EMAIL PROTECTED] 
 Sent: Monday, March 06, 2006 4:42 PM
 To: Tomcat Users List
 Subject: TomcatUsers: Re: mod_jk errors - are these normal?
 
 --- Sven K�hler [EMAIL PROTECTED] wrote:
 
   [Wed Mar 01 20:00:42 2006] [error] 
   ajp_connection_tcp_get_message::jk_ajp_common.c
  (961):
   Can't receive the response message from tomcat,
   network problems or tomcat is down
  (10.0.0.9:8009),
   err=-113
   [Wed Mar 01 20:00:42 2006] [error] ajp_get_reply::jk_ajp_common.c 
   (1503): Tomcat is
  down
   or refused connection. No response has been sent
  to
   the client (yet)

SNIP

 2. It seems like people who have apache and tomcat
 running on the same server can get away without any
 errors.

We are running on the same server (windows) and get these error contantly...
Actually, our read:

[Mon Mar 06 16:32:22 2006] [error] jk_ajp_common.c (961): Can't receive the
response message from tomcat, network problems or tomcat is down
(127.0.0.1:8009), err=-54
[Mon Mar 06 16:32:22 2006] [error] jk_ajp_common.c (1503): Tomcat is down or
refused connection. No response has been sent to the client (yet)

Which is subely different.  Anyone have a reference to what the various
'err=' codes mean?

Justin

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

mod_jk errors - are these normal?

[michael thomas]

If our setup was completely stable, and configured
perfectly, should there be NO mod_jk errors ever?

Or, are some errors part of normal operation?

The system seems to work fine from a user's
perspective, but we still occasionally get these:

[Wed Mar 01 20:00:42 2006] [error]
ajp_connection_tcp_get_message::jk_ajp_common.c (961):
Can't receive the response message from tomcat,
network problems or tomcat is down (10.0.0.9:8009),
err=-113
[Wed Mar 01 20:00:42 2006] [error]
ajp_get_reply::jk_ajp_common.c (1503): Tomcat is down
or refused connection. No response has been sent to
the client (yet)
[Wed Mar 01 20:00:42 2006] [info]
ajp_service::jk_ajp_common.c (1721): Receiving from
tomcat failed, recoverable operation attempt=0
[Wed Mar 01 20:00:42 2006] [info]
ajp_service::jk_ajp_common.c (1749): Sending request
to tomcat failed,  recoverable operation attempt=1

We don't get them that often... about once every 30
minutes.  But, we also don't have much traffic right
now.  (Only about 700 visitors a day, with about 15
page views per visitor.)

We've ran load tests, but the error message count
doesn't seem to inrease by much if any.

Are these error messages a normal part of mod_jk, or
do they definitely indicate some sort of problem (like
network issues)?

We are using mod_jk 1.2.15, Apache 2.0.55 and Tomcat
5.5.15.

For what it's worth, we have other completely separate
system setups using mod_jk2, and they also all seem to
get occasional ajp errors.  This is our first setup
using mod_jk, and we are assuming these errors are a
bad thing.

Thanks,
-Michael 


__
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: mod_jk errors - are these normal?

[Sven Köhler]

 The system seems to work fine from a user's
 perspective, but we still occasionally get these:
 
 [Wed Mar 01 20:00:42 2006] [error]
 ajp_connection_tcp_get_message::jk_ajp_common.c (961):
 Can't receive the response message from tomcat,
 network problems or tomcat is down (10.0.0.9:8009),
 err=-113
 [Wed Mar 01 20:00:42 2006] [error]
 ajp_get_reply::jk_ajp_common.c (1503): Tomcat is down
 or refused connection. No response has been sent to
 the client (yet)
 [Wed Mar 01 20:00:42 2006] [info]
 ajp_service::jk_ajp_common.c (1721): Receiving from
 tomcat failed, recoverable operation attempt=0
 [Wed Mar 01 20:00:42 2006] [info]
 ajp_service::jk_ajp_common.c (1749): Sending request
 to tomcat failed,  recoverable operation attempt=1
 
 For what it's worth, we have other completely separate
 system setups using mod_jk2, and they also all seem to
 get occasional ajp errors.  This is our first setup
 using mod_jk, and we are assuming these errors are a
 bad thing.

I always had those errors. I did anything i could do - change timeouts,
change backlog, change this, change that - whatever - these errors remain.

Just make sure, that the tomcat allows as much or more ajp-connctions,
than there will be apache-processes/threads.

I think the programmers have given up on solving this - whatever the
problem is. AFAIK, mod_jk prints that error-messages to the log and then
tries another connect which usually works.

Actually i hear the developers say: this is not a problem - or
something like that. Well, no comment on that ...


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]