Re: Tomcat 6.0 threads

2012-11-05 Thread Mark Eggers
On 11/4/2012 10:54 PM, vicky007aggar...@yahoo.co.in wrote: Hi All, Can somebody please help me out in stopping the surplus threads which get created in tomcat 6.0 as we dont have maxSpareThreads attribute anymore in it .. How can we close these threads Thanks for ur help, Vicky I've never

Re: Tomcat 6.O ajp thread issue

2012-11-05 Thread vicky007aggarwal
Thanks Mark, I have following configuration, is there anything else do i need configure ..please suggest ..as i am still able to see ajp port in Probe application with default thread count. Executor name=abc namePrefix=catalina-exec- maxThreads=150 minSpareThreads=40 / Connector port=1080

Re: CSRF on multiple tomcat instances

2012-11-05 Thread Pid *
On 2 Nov 2012, at 14:23, Wilfred Duizers wilfred.duiz...@indicia.nl wrote: Hello, I am running 2 Tomcat instances on 1 server. So far nothing special :-) Both: Apache Tomcat/7.0.25 JVM 1.6.0_20-b02 When a user clicks a link in the webapplication running on Tomcat instance 1 (portal) an

Re: Tomcat 6.O ajp thread issue

2012-11-05 Thread Mark Eggers
On 11/5/2012 12:22 AM, vicky007aggar...@yahoo.co.in wrote: Thanks Mark, I have following configuration, is there anything else do i need configure ..please suggest ..as i am still able to see ajp port in Probe application with default thread count. Executor name=abc namePrefix=catalina-exec-

handling expired sessions in Tomcat

2012-11-05 Thread Miguel Gonzalez
Dear all,   When an user is logged on our system (a Struts app), when the session expires, the user gets a java error report. Is there any way to handle this and either to show a custom jsp page or redirect the user to the login form? I have googled this, but I can't find this info.  

RE: CSRF on multiple tomcat instances

2012-11-05 Thread Wilfred Duizers
yes it would :P Do you see a solution anywayboth tomcat instances use the same domain https://www.example.com They use isapi Van: Pid * [p...@pidster.com] Verzonden: maandag 5 november 2012 9:30 Aan: Tomcat Users List Onderwerp: Re: CSRF on multiple

Re: tomcat 6.0.32 stops expiring sessions

2012-11-05 Thread Igor Cicimov
On 05/11/2012 6:50 PM, Altmeier, Christian christian.altme...@softwareag.com wrote: Hi, I have a big problem. After some time, tomcat stops expiring sessions. We have enabled logging for org.apache.catalina.session.ManagerBase. So we see that at first everything works fine and suddenly

AW: tomcat 6.0.32 stops expiring sessions

2012-11-05 Thread Altmeier, Christian
No that's OK, I don't mean the time a user stays inactive for some minutes. The session timeout is set to 66 minutes. I have sessions which are inactive for 70 hours ... -Ursprüngliche Nachricht- Von: Igor Cicimov [mailto:icici...@gmail.com] Gesendet: Montag, 5. November 2012 10:26 An:

Re: AW: tomcat 6.0.32 stops expiring sessions

2012-11-05 Thread Igor Cicimov
On 05/11/2012 8:41 PM, Altmeier, Christian christian.altme...@softwareag.com wrote: No that's OK, I don't mean the time a user stays inactive for some minutes. The session timeout is set to 66 minutes. I have sessions which are inactive for 70 hours ... Which tomcat version? Are they SSL

Re: Tomcat 6.0 threads

2012-11-05 Thread vicky007aggarwal
Mark actually i have a scenario in which my application receives variable amount of request depending on time . So at one point i have an approx around 400 users concurrently accessing my application as a result i have an approx 400 threads but when the request count decreases the thread count

Re: mod_jk and mod_rewrite

2012-11-05 Thread André Warnier
Pete Storey wrote: Hi I've got what I think is a pretty normal setup, where I have an Apache server serving some content for a website, and using mod_jk to connect to Tomcat running on another server. My problem is that I'm also trying to use mod_rewrite to ­ err, rewrite URLs. In short, if I

Re: [OT] mod_jk and mod_rewrite

2012-11-05 Thread André Warnier
By the way, your message shows a time that sems out of whack, as compared to my time, but also as compared to the other messages on the list. This can create some problems for people who follow this list by date/time (*). You may want to check the date/time on your workstation. (*) For

Re: Tomcat 6.O ajp thread issue

2012-11-05 Thread vicky007aggarwal
Thanks Mark for ur comments .but i didnt understand what you mean by following line ;- I think you were still using the Connector-based server.xml. I am using below executor for both ajp http but why i am still seeing the ajp default

AW: AW: tomcat 6.0.32 stops expiring sessions

2012-11-05 Thread Altmeier, Christian
Yes we are using SSL. Tomcat 6.0.32 Our connector config: Connector port=8080 protocol=HTTP/1.1 connectionTimeout=2 redirectPort=8443 scheme=https secure=true proxyName=..xx proxyPort=443/ -Ursprüngliche Nachricht- Von: Igor Cicimov [mailto:icici...@gmail.com] Gesendet:

Re: Tomcat 6.O ajp thread issue

2012-11-05 Thread André Warnier
Vicky, you keep on top-posting, which is annoying and makes it difficult to follow the conversation. Please answer below the questions and suggestions of other people. My question is : apart from what the various probe programs show you as counters, are you actually *seeing* a number of

Re: AW: tomcat 6.0.32 stops expiring sessions

2012-11-05 Thread Mark Thomas
Altmeier, Christian christian.altme...@softwareag.com wrote: Yes we are using SSL. Tomcat 6.0.32 Our connector config: Connector port=8080 protocol=HTTP/1.1 connectionTimeout=2 redirectPort=8443 scheme=https secure=true proxyName=..xx proxyPort=443/ -Ursprüngliche Nachricht-

Re: Tomcat 6.O ajp thread issue

2012-11-05 Thread vicky007aggarwal
Andre- i am facing issue thats y i m Posting. I didnt intend to spam please. In probe , http values are displayed correctly but not the ajp one. Thanks, Vicky On Nov 5, 2012, at 4:35 PM, André Warnier a...@ice-sa.com wrote: Vicky, you keep on top-posting, which is annoying and makes it

Re: AW: AW: tomcat 6.0.32 stops expiring sessions

2012-11-05 Thread Igor Cicimov
On 05/11/2012 10:01 PM, Altmeier, Christian christian.altme...@softwareag.com wrote: Yes we are using SSL. The default session timeout for ssl in tomcat6 is 24 hours, maybe that explains why. Tomcat 6.0.32 Our connector config: Connector port=8080 protocol=HTTP/1.1 connectionTimeout=2

Re: Handling requests when under load - ACCEPT and RST vs non-ACCEPT

2012-11-05 Thread Asankha C. Perera
Hi Chris / Mark Or you could just read the configuration documentation for the connector. Hint: acceptCount - and it has been there since at least Tomcat 4. The acceptCount WAS being used, but was not being honored as an end user would expect in reality (See the configurations I've shared at

Re: handling expired sessions in Tomcat

2012-11-05 Thread Daniel Mikusa
On Nov 5, 2012, at 4:04 AM, Miguel Gonzalez wrote: Dear all, When an user is logged on our system (a Struts app), when the session expires, the user gets a java error report. What does the user see when this happens? Is there a stack trace? If so, can you include the stack trace here.

Re: Suggestions for Interesting Tomcat-related presentations at ApacheCON NA 2013

2012-11-05 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 All, I didn't get any responses from anyone on this topic. I'm still open if anyone would like to see something specific. I'm simply not all that creative :) Thanks, - -chris On 10/11/12 4:31 PM, Christopher Schultz wrote: All, Having missed

Re: handling expired sessions in Tomcat

2012-11-05 Thread Jose María Zaragoza
2012/11/5 Miguel Gonzalez miguel_3_gonza...@yahoo.es: Dear all, When an user is logged on our system (a Struts app), when the session expires, the user gets a java error report. Is there any way to handle this and either to show a custom jsp page or redirect the user to the login form?

Re: handling expired sessions in Tomcat

2012-11-05 Thread Miguel Gonzalez
Dear all,    When an user is logged on our system (a Struts app), when the session expires, the user gets a java error report. What does the user see when this happens?  Is there a stack trace?  If so, can you include the stack trace here. Yes, they get a stack trace. I would have to dig

Re: handling expired sessions in Tomcat

2012-11-05 Thread Daniel Mikusa
On Nov 5, 2012, at 9:51 AM, Miguel Gonzalez wrote: Dear all, When an user is logged on our system (a Struts app), when the session expires, the user gets a java error report. What does the user see when this happens? Is there a stack trace? If so, can you include the stack

Re: handling expired sessions in Tomcat

2012-11-05 Thread Miguel Gonzalez
Dear all,   When an user is logged on our system (a Struts app), when the session expires, the user gets a java error report. Is there any way to handle this and either to show a custom jsp page or redirect the user to the login form? I have googled this, but I can't find this info. If you

AW: AW: AW: tomcat 6.0.32 stops expiring sessions

2012-11-05 Thread Altmeier, Christian
No, sorry. Default should be 30 Minutes We set it to 66 Minutes But the sessions didn't even expire after 75 hours inactive time. -Ursprüngliche Nachricht- Von: Igor Cicimov [mailto:icici...@gmail.com] Gesendet: Montag, 5. November 2012 14:01 An: Tomcat Users List Betreff: Re: AW: AW:

Re: AW: AW: AW: tomcat 6.0.32 stops expiring sessions

2012-11-05 Thread David kerber
On 11/5/2012 10:07 AM, Altmeier, Christian wrote: No, sorry. Default should be 30 Minutes We set it to 66 Minutes But the sessions didn't even expire after 75 hours inactive time. Are you sure they're really inactive that entire time, and don't have some kind of keepalive going on?

Re: handling expired sessions in Tomcat

2012-11-05 Thread Miguel Gonzalez
Hard to say without more details.  Seeing the stack trace would be a good start. I attach a screenshot of one one of the stack traces we get Miguel - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional

Re: handling expired sessions in Tomcat

2012-11-05 Thread Daniel Mikusa
On Nov 5, 2012, at 10:24 AM, Miguel Gonzalez wrote: Hard to say without more details. Seeing the stack trace would be a good start. I attach a screenshot of one one of the stack traces we get Sorry. The attachment didn't come through. The list usually removes them. Dan Miguel

AW: AW: AW: AW: tomcat 6.0.32 stops expiring sessions

2012-11-05 Thread Altmeier, Christian
Yes I think so: Session Id Guessed Locale Guessed User name Creation Time Last Accessed Time Used Time Inactive Time TTL 9B33CA0CA59049557CEA6B4938FA98DB2012-11-02 12:42:38 2012-11-02 12:42:38 00:00:0075:44:05-74:38:05

Re: How do I get Tomcat 7 to start up faster in Linux CentOS kernel version 2.6.18?

2012-11-05 Thread Dilshad Shahid
Thank you for all your responses and apologies for my late reply. I got pulled off of this project last week and was assigned back to java coding (my preferred state in any case). I have forwarded your replies to the manager in charge of the project and someone in his team has been looking into it

Re: AW: AW: AW: AW: tomcat 6.0.32 stops expiring sessions

2012-11-05 Thread Pid
On 05/11/2012 15:27, Altmeier, Christian wrote: Yes I think so: Session Id Guessed Locale Guessed User name Creation Time Last Accessed Time Used Time Inactive Time TTL 9B33CA0CA59049557CEA6B4938FA98DB2012-11-02 12:42:38 2012-11-02

AW: AW: AW: AW: AW: tomcat 6.0.32 stops expiring sessions

2012-11-05 Thread Altmeier, Christian
I don't think so ... but I can't exclude it. The problem is, that everything works fine and then suddenly all session, which are not closes by the browser, stay open. Have you an idea how I can see, if there are any references? -Ursprüngliche Nachricht- Von: Pid

Re: handling expired sessions in Tomcat

2012-11-05 Thread Daniel Mikusa
On Nov 5, 2012, at 10:24 AM, Miguel Gonzalez wrote: Hard to say without more details. Seeing the stack trace would be a good start. I attach a screenshot of one one of the stack traces we get Please don't send stuff directly to people off the list. This creates a gap in the email

Re: How do I get Tomcat 7 to start up faster in Linux CentOS kernel version 2.6.18?

2012-11-05 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dilshad, On 11/5/12 10:28 AM, Dilshad Shahid wrote: We are using Tomcat 7 to load up our application written in struts. On production sites, the startup time can be as slow as 20 minutes. When I was testing on our QA environments, I saw much

Re: AW: AW: tomcat 6.0.32 stops expiring sessions

2012-11-05 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Igor, On 11/5/12 8:01 AM, Igor Cicimov wrote: On 05/11/2012 10:01 PM, Altmeier, Christian christian.altme...@softwareag.com wrote: Yes we are using SSL. The default session timeout for ssl in tomcat6 is 24 hours, maybe that explains why.

Re: AW: AW: AW: AW: AW: tomcat 6.0.32 stops expiring sessions

2012-11-05 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Christian, On 11/5/12 10:48 AM, Altmeier, Christian wrote: I don't think so ... but I can't exclude it. The problem is, that everything works fine and then suddenly all session, which are not closes by the browser, stay open. Have you an idea

Re: handling expired sessions in Tomcat

2012-11-05 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Miguel, On 11/5/12 9:51 AM, Miguel Gonzalez wrote: Dear all, When an user is logged on our system (a Struts app), when the session expires, the user gets a java error report. What does the user see when this happens? Is there a stack

Re: [OT] mod_jk and mod_rewrite

2012-11-05 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 André, On 11/5/12 5:24 AM, André Warnier wrote: By the way, your message shows a time that sems out of whack, as compared to my time, but also as compared to the other messages on the list. This can create some problems for people who follow this

Re: [OT] mod_jk and mod_rewrite

2012-11-05 Thread Mark Eggers
On 11/5/2012 11:56 AM, Christopher Schultz wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 André, On 11/5/12 5:24 AM, André Warnier wrote: By the way, your message shows a time that sems out of whack, as compared to my time, but also as compared to the other messages on the list. This

WebappClassLoader weak/soft reachable

2012-11-05 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 All, I was playing around with the manager webapp today and just for grins, I redeployed my webapp and then hit the Find Leaks button to see how long it would take Tomcat to decide that my webapp reloads cleanly. It didn't. That is, my webapp does

Re: AW: AW: tomcat 6.0.32 stops expiring sessions

2012-11-05 Thread Igor Cicimov
On 06/11/2012 6:43 AM, Christopher Schultz ch...@christopherschultz.net wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Igor, On 11/5/12 8:01 AM, Igor Cicimov wrote: On 05/11/2012 10:01 PM, Altmeier, Christian christian.altme...@softwareag.com wrote: Yes we are using SSL.

RE: AW: AW: tomcat 6.0.32 stops expiring sessions

2012-11-05 Thread Caldarale, Charles R
From: Igor Cicimov [mailto:icici...@gmail.com] Subject: Re: AW: AW: tomcat 6.0.32 stops expiring sessions The default session timeout for ssl in tomcat6 is 24 hours, maybe that explains why. Uh, what? Hi Chris, I got this from the config page

Re: [OT] mod_jk and mod_rewrite

2012-11-05 Thread André Warnier
Mark Eggers wrote: On 11/5/2012 11:56 AM, Christopher Schultz wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 André, On 11/5/12 5:24 AM, André Warnier wrote: By the way, your message shows a time that sems out of whack, as compared to my time, but also as compared to the other messages

Re: [OT] mod_jk and mod_rewrite

2012-11-05 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 André, On 11/5/12 4:35 PM, André Warnier wrote: Mark Eggers wrote: On 11/5/2012 11:56 AM, Christopher Schultz wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 André, On 11/5/12 5:24 AM, André Warnier wrote: By the way, your message

[SECURITY] CVE-2012-2733 Apache Tomcat Denial of Service

2012-11-05 Thread Mark Thomas
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2012-2733 Apache Tomcat Denial of Service Severity: Important Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.27 - - Tomcat 6.0.0 to 6.0.35 Description: The checks that limited the permitted size of request

[SECURITY] CVE-2012-3439 Apache Tomcat DIGEST authentication weaknesses

2012-11-05 Thread Mark Thomas
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2012-3439 Apache Tomcat DIGEST authentication weaknesses Severity: Moderate Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.29 - - Tomcat 6.0.0 to 6.0.35 - - Tomcat 5.5.0 to 5.5.35 - - Earlier, unsupported

Re: Handling requests when under load - ACCEPT and RST vs non-ACCEPT

2012-11-05 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Asankha, On 11/5/12 8:36 AM, Asankha C. Perera wrote: Hi Chris / Mark Or you could just read the configuration documentation for the connector. Hint: acceptCount - and it has been there since at least Tomcat 4. The acceptCount WAS being

Re: Tomcat 6.0 threads

2012-11-05 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Vicky, On 11/5/12 1:54 AM, vicky007aggar...@yahoo.co.in wrote: Can somebody please help me out in stopping the surplus threads which get created in tomcat 6.0 as we dont have maxSpareThreads attribute anymore in it .. How can we close these

Re: Tomcat 6.0 threads

2012-11-05 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Vicky, On 11/5/12 5:12 AM, vicky007aggar...@yahoo.co.in wrote: Mark actually i have a scenario in which my application receives variable amount of request depending on time . So at one point i have an approx around 400 users concurrently

Re: Tomcat 6.O ajp thread issue

2012-11-05 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Vicky, On 11/5/12 2:18 AM, vicky007aggar...@yahoo.co.in wrote: I have defined one executor tag in server.xml , which i am referring for both protocols i.e http Ajp. You should post your configuration. I see you posted a followup which included

Re: CSRF on multiple tomcat instances

2012-11-05 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Wilfred, On 11/5/12 4:08 AM, Wilfred Duizers wrote: When a user clicks a link in the webapplication running on Tomcat instance 1 (portal) an application running on Tomcat instance 2 is opened. Is it possible to send the nonce with the link?

Re: Tomcat 6.0 threads

2012-11-05 Thread vicky007aggarwal
Thanks a ton Chris, i got my answer. Applause for giving your time. ;) On Nov 6, 2012, at 9:13 AM, Christopher Schultz ch...@christopherschultz.net wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Vicky, On 11/5/12 5:12 AM, vicky007aggar...@yahoo.co.in wrote: Mark actually i have

Re: Tomcat 6 query

2012-11-05 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Vicky, On 11/4/12 2:20 PM, vicky007aggar...@yahoo.co.in wrote: Thanks Mark for your valuable comments. Based on 3rd question answer (below mail), so does it mean that in tomcat 6.0 i have to use executor to configure minSpareThreads , i

Re: Apache httpd reverse proxy setup

2012-11-05 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Marko, On 10/31/12 3:55 PM, Marko Asplund wrote: There are at least 3 different approaches for configuring Apache httpd 2.2 to act as a reverse proxy for Tomcat 7.0: a) mod_proxy_http b) mod_proxy_ajp c) mod_jk There's been quite a lot of

Re: Apache httpd reverse proxy setup

2012-11-05 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 André, On 10/31/12 4:32 PM, André Warnier wrote: Marko Asplund wrote: Hi, There are at least 3 different approaches for configuring Apache httpd 2.2 to act as a reverse proxy for Tomcat 7.0: a) mod_proxy_http b) mod_proxy_ajp c) mod_jk

Re: Tomcat 6 query

2012-11-05 Thread vicky007aggarwal
Chris , When i was monitoring the tomcat thread pools using psi-probe application (below link for reference) i observed it shows minSpareThread attribute as zero for http connector when i configured the same attribute via executor referred it in my http protocol it displays the count which i

Re: Apache httpd reverse proxy setup

2012-11-05 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Marko, On 11/4/12 10:12 AM, Marko Asplund wrote: On 31/10/2012 20:08:21 GMT, Mark Thomas wrote: http://www.tomcatexpert.com/blog/2010/06/16/deciding-between-modjk-modproxyhttp-and-modproxyajp The mod_proxy_ajp stability issues are less of an

AW: AW: AW: AW: AW: AW: tomcat 6.0.32 stops expiring sessions

2012-11-05 Thread Altmeier, Christian
Hey chris, do you have a guideline how to get the thread dump? We don't host tomcat by our self. It's a customer system. Yes I use the manager app to see the sessions. -Ursprüngliche Nachricht- Von: Christopher Schultz [mailto:ch...@christopherschultz.net] Gesendet: Montag, 5. November

RE: AW: AW: AW: AW: AW: tomcat 6.0.32 stops expiring sessions

2012-11-05 Thread Caldarale, Charles R
From: Altmeier, Christian [mailto:christian.altme...@softwareag.com] Subject: AW: AW: AW: AW: AW: AW: tomcat 6.0.32 stops expiring sessions do you have a guideline how to get the thread dump? It's in the FAQ:

Re: [OT] mod_jk and mod_rewrite

2012-11-05 Thread Pete Storey
Hi Thanks for the various timely emails - I am in Australia hence I am in front of you time wise! What I didn't see was any actual answer to the question though - just queried the email list for this thread and this was the first reply I got! Could you resend your actual answer? Cheers Pete

Re: Handling requests when under load - ACCEPT and RST vs non-ACCEPT

2012-11-05 Thread Asankha C. Perera
Hi Chris First, evidently, acceptCount almost does not appear in the Tomcat source. It's real name is backlog if you want to do some searching. It's been in there forever. Yes, I found it too; but saw that it didn't perform what an 'end user' would expect from Tomcat. Second, all three