Re: sudden increase in tomcat sessions..?

2014-02-11 Thread Kumar Muthuramalingam
I am sorry. I thought load balancer is something related to tomcat and asked so many questions. Really sorry for that. On Tue, Feb 11, 2014 at 3:30 PM, André Warnier wrote: > Kumar Muthuramalingam wrote: > >> Thanks for all. Finally found the issue. Think it should be a network >> delay. The lo

Re: sudden increase in tomcat sessions..?

2014-02-11 Thread André Warnier
Kumar Muthuramalingam wrote: Thanks for all. Finally found the issue. Think it should be a network delay. The load balancer was configured in such a way to send the ping requests for every 3 secs. But it didn't happened and it was irregular. And it sent all the delayed pings at a time. I think it

Re: sudden increase in tomcat sessions..?

2014-02-11 Thread Kumar Muthuramalingam
Thanks for all. Finally found the issue. Think it should be a network delay. The load balancer was configured in such a way to send the ping requests for every 3 secs. But it didn't happened and it was irregular. And it sent all the delayed pings at a time. I think it should be the cause. Am I righ

Re: sudden increase in tomcat sessions..?

2014-02-11 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Kumar, On 2/11/14, 1:26 PM, Kumar Muthuramalingam wrote: > Yes I can check those configurations. In the meanwhile I have > another question. Please take a look at the log below. > > [11/Feb/2014:12:50:24 -0500] "GET / storyboard /stat/ > QueryUpda

Re: sudden increase in tomcat sessions..?

2014-02-11 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Kumar, On 2/11/14, 11:56 AM, Kumar Muthuramalingam wrote: > what I mean is if I am supposed to get a response for that > Update.jsp file and I didn't get it for a while. Will the load > balancer will check for it connectivity? Is there any timeout s

Re: sudden increase in tomcat sessions..?

2014-02-11 Thread Kumar Muthuramalingam
Yes I can check those configurations. In the meanwhile I have another question. Please take a look at the log below. [11/Feb/2014:12:50:24 -0500] "GET / storyboard /stat/ QueryUpdate.jsp?stats=0&sid=0.40406329182209005 HTTP/1.1" 200 151 [11/Feb/2014:12:50:24 -0500] "GET /storyboard/stat/ QueryUpd

Re: sudden increase in tomcat sessions..?

2014-02-11 Thread Leon Rosenberg
Hello Kumar, can't you just ask your Ops guys to get your the load balancer config? That would be much easier as guessing. Usually you can configure how many samples the load balancer must try to get and what is the timeout. For example if the setting is 3 with timeout of 15 seconds, 3 requests w

Re: sudden increase in tomcat sessions..?

2014-02-11 Thread Kumar Muthuramalingam
what I mean is if I am supposed to get a response for that Update.jsp file and I didn't get it for a while. Will the load balancer will check for it connectivity? Is there any timeout set for load balancer to get response. Thanks, Kumar. On Tue, Feb 11, 2014 at 8:13 AM, Daniel Mikusa wrote: > O

Re: sudden increase in tomcat sessions..?

2014-02-11 Thread Daniel Mikusa
On Feb 10, 2014, at 7:22 PM, Kumar Muthuramalingam wrote: > Before that can you tell me one thing please. Suppose if a page request > (eg. /UpdateQuery.JSP) is coming from a load balancer to tomcat and the > UpdateQuery.JSP is connected to some third party server. Assume if the > tomcat is not ge

Re: sudden increase in tomcat sessions..?

2014-02-10 Thread Kumar Muthuramalingam
Before that can you tell me one thing please. Suppose if a page request (eg. /UpdateQuery.JSP) is coming from a load balancer to tomcat and the UpdateQuery.JSP is connected to some third party server. Assume if the tomcat is not getting any reply from the Query server for some seconds. Will the loa

Re: sudden increase in tomcat sessions..?

2014-02-10 Thread Daniel Mikusa
On Feb 10, 2014, at 4:07 PM, Kumar Muthuramalingam wrote: > Yes its the load balancer. and recently I found in the log that there was a > memory leak exception while the tomcat server was restarted.The session > increase problem started from this particular date . Could this be a cause > for the

Re: sudden increase in tomcat sessions..?

2014-02-10 Thread Kumar Muthuramalingam
Yes its the load balancer. and recently I found in the log that there was a memory leak exception while the tomcat server was restarted.The session increase problem started from this particular date . Could this be a cause for the tomcat to hang up and DOS occurred? One more question. I see this m

Re: sudden increase in tomcat sessions..?

2014-02-10 Thread Daniel Mikusa
On Feb 10, 2014, at 1:59 PM, Kumar Muthuramalingam wrote: > Thanks for the reply. I accept this remedy will clear the issue. But my > question is how to verify the root cause of this DOS attack that occurred > earlier? As previously directed, look at your access logs. That should show you who i

Re: sudden increase in tomcat sessions..?

2014-02-10 Thread Kumar Muthuramalingam
Thanks for the reply. I accept this remedy will clear the issue. But my question is how to verify the root cause of this DOS attack that occurred earlier? What ever steps suggested above is to take a precaution or solve the issue. please help me. Thanks, Kumar. On Mon, Feb 10, 2014 at 12:06 PM,

Re: sudden increase in tomcat sessions..?

2014-02-10 Thread Daniel Mikusa
On Feb 10, 2014, at 11:56 AM, Kumar Muthuramalingam wrote: > Thanks for your reply. I have 3 applications running under the tomcat and > only one application got a ping.jsp file others don't. And also I could see > from the access logs that only the application that has got ping.jsp file > was p

Re: sudden increase in tomcat sessions..?

2014-02-10 Thread Kumar Muthuramalingam
Thanks for your reply. I have 3 applications running under the tomcat and only one application got a ping.jsp file others don't. And also I could see from the access logs that only the application that has got ping.jsp file was pinged others were not. And the sessions are high only for this particu

Re: sudden increase in tomcat sessions..?

2014-02-10 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Kumar, On 2/8/14, 7:08 PM, Kumar Muthuramalingam wrote: > I 'm using tomcat version 6 and 7. One day there was a sudden > increase in number of sessions in both tomcats. And all the > sessions had no username, same lastaccessed time, same created ti

Re: sudden increase in tomcat sessions..?

2014-02-10 Thread Daniel Mikusa
tellect.com/support/windowsserversecurity/disable-icmp-requests/ >>> >>> >>> >>> DOC attack usually results in TROJ_MDROPPER.* on system >>> NAV and McAfee can detect these malware attachments on Word Docs >>> >>> >>> &

Re: sudden increase in tomcat sessions..?

2014-02-09 Thread Leon Rosenberg
t; > DOC attack usually results in TROJ_MDROPPER.* on system > > NAV and McAfee can detect these malware attachments on Word Docs > > > > > > > http://blog.trendmicro.com/trendlabs-security-intelligence/trojanized-doc-files-in-targeted-attack/ > > > &g

Re: sudden increase in tomcat sessions..?

2014-02-08 Thread Kumar Muthuramalingam
sults in TROJ_MDROPPER.* on system > NAV and McAfee can detect these malware attachments on Word Docs > > > http://blog.trendmicro.com/trendlabs-security-intelligence/trojanized-doc-files-in-targeted-attack/ > > > HTH > Martin > > > > > > > Date: Sat,

RE: sudden increase in tomcat sessions..?

2014-02-08 Thread Martin Gainty
.* on system NAV and McAfee can detect these malware attachments on Word Docs http://blog.trendmicro.com/trendlabs-security-intelligence/trojanized-doc-files-in-targeted-attack/ HTH Martin > Date: Sat, 8 Feb 2014 19:54:32 -0500 > Subject: Re: sudden increase in tomcat sessions..?

Re: sudden increase in tomcat sessions..?

2014-02-08 Thread Kumar Muthuramalingam
Hi David, Thanks for your reply. How can I verify that it is a DOC attack? which log i should refer.please guide me. Thanks, Kumar. On Sat, Feb 8, 2014 at 7:42 PM, David Kerber wrote: > On 2/8/2014 7:08 PM, Kumar Muthuramalingam wrote: > >> Hi, >>I 'm using tomcat version 6 and 7. One

Re: sudden increase in tomcat sessions..?

2014-02-08 Thread David Kerber
On 2/8/2014 7:08 PM, Kumar Muthuramalingam wrote: Hi, I 'm using tomcat version 6 and 7. One day there was a sudden increase in number of sessions in both tomcats. And all the sessions had no username, same lastaccessed time, same created time and the inactive time was 00:00:00. It is not happ

sudden increase in tomcat sessions..?

2014-02-08 Thread Kumar Muthuramalingam
Hi, I 'm using tomcat version 6 and 7. One day there was a sudden increase in number of sessions in both tomcats. And all the sessions had no username, same lastaccessed time, same created time and the inactive time was 00:00:00. It is not happening always but it happens some times on some day. C