Rainer, Thanks for the comprehensive reply. We're using Apache on RHEL4. I'll try and investigate the actual URL. It is a very busy environment (> 25 million hits a day) so it'll take me some time to pick through.
Yes it does look like a response. I'm assuming this doesn't just mean it's a big page. What kind of information is sent in the header? - We're not really using cookies at the moment for instance. Thanks Rob On 08/08/2007, Rainer Jung <[EMAIL PROTECTED]> wrote: > > Hi Rob, > > I would prefer to find out, what kind of requests cause this behaviour. > Are there log messages in the mod_jk log file? The mod_jk log file > contains the pid and thread-ID of the web server thread processing the > request. Dependent on the platform an web server, you casn also log the > pid and thread-id in the access log of the web server and then identify > the requests even under medium load by using the time stamp and > pid/thread-id. After identifying the request, you could check client IP, > user agent and of course the URL, whether there is something strange. > > If your load is low, the time stamps from the Tomcat log could be enough > to relate to a request in a Tomcat access log, or if time is synced in a > web server access log. > > Furthermore: the stack looks like this is not a strange request, but > instead a strange response. It seems your webapp produces responses with > big headers? Maybe I'm wrong, but that's how i interprete the stack. > > Regards, > > Rainer > > Rob Kirkbride wrote: > > Hi, > > > > I've been getting a lot MsgAjp Overflow messages recently. The strange > > this is only seems to happen only 1 app server at a time and seems to > > stop and start in bursts of sometimes over an hour, but then nothing for > > several hours after that. > > This is with Tomcat 5.5.20 and mod_jk 1.2.23. > > > > Is it possible that it is someone trying to provoke a DOS or should I > > really investigate increasing the maxhttpheadersize in server.xml and > > max_http_size in Mod_jk? > > > > Thanks for any help, > > > > Rob > > > > 2007-08-08 08:36:47,579 ERROR [ ] [org.apache.jk.common.MsgAjp] Buffer > > overflow > > : buffer.len=8192 pos=259 data=20202 > > 2007-08-08 08:36:47,580 ERROR [ ] [org.apache.jk.common.MsgAjp] > Overflow > > java.lang.Throwable > > at org.apache.jk.common.MsgAjp.cpBytes(MsgAjp.java:194) > > at org.apache.jk.common.MsgAjp.appendByteChunk(MsgAjp.java:168) > > at org.apache.jk.common.MsgAjp.appendBytes(MsgAjp.java:154) > > at > > org.apache.jk.common.JkInputStream.appendHead(JkInputStream.java:302) > > at org.apache.jk.core.MsgContext.action(MsgContext.java:258) > > at org.apache.coyote.Response.action(Response.java:182) > > at org.apache.coyote.Response.sendHeaders(Response.java:378) > > at > > org.apache.catalina.connector.OutputBuffer.doFlush(OutputBuffer.java: > > 317) > > at > > org.apache.catalina.connector.OutputBuffer.close(OutputBuffer.java:27 > > 8) > > at > > org.apache.catalina.connector.Response.finishResponse(Response.java:4 > > 76) > > at > > org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.jav > > a:151) > > --------------------------------------------------------------------- > To start a new topic, e-mail: users@tomcat.apache.org > To unsubscribe, e-mail: [EMAIL PROTECTED] > For additional commands, e-mail: [EMAIL PROTECTED] > >
