Author Login
Post Reply
users Digest 23 Jul 2010 02:08:20 -0000 Issue 9726
Topics (messages 214948 through 214971):
Re: Cluster session failover question
214948 by: Jon Brisbin
Connection Refused On Tomcat Server Shutdowns if...
214949 by: John A Parker
214950 by: David Fisher
214951 by: Rainer Jung
214952 by: Rainer Jung
214953 by: John A Parker
Notification on Tomcat Active HTTP Threads > 400
214954 by: kapilok
214959 by: Christopher Schultz
Re: Problems starting Tomcat on windows 7 64bit.
214955 by: sharkanana
214960 by: Christopher Schultz
214970 by: sharkanana
Re: Fire off asynch task in Tomcat.
214956 by: Christopher Schultz
214957 by: Christopher Schultz
214958 by: Christopher Schultz
214968 by: Pid
214969 by: Eric P
SSL, mod_proxy_ajp and AJP connectors query
214961 by: Brett Delle Grazie
214962 by: Rainer Jung
214966 by: Christopher Schultz
Error of Tomcat using Struts2
214963 by: bladu
Default JVM argument for tomcat
214964 by: Gopi Valleru
214965 by: Christopher Schultz
214967 by: Gopi Valleru
Tomcat AJP vs mod_jk's max_pool_size
214971 by: Imran Khan
Administrivia:
---------------------------------------------------------------------
To post to the list, e-mail: users@(protected)
To unsubscribe, e-mail: users-digest-unsubscribe@(protected)
For additional commands, e-mail: users-digest-help@(protected)
----------------------------------------------------------------------

Attachment:
users_214948.ezm (zipped)
On Jul 22, 2010, at 9:19 AM, Darren Kukulka wrote:
> Another, more difficult scenario, is when one of the Tomcat cluster
> nodes begins to groan and become unresponsive, say when OldGen or
> PermGen becomes full...in this case the mod_jk connector does not
> identify the node as having failed and will continue to attempt to pass
> requests to it, rather than pass them to the more responsive node.
We had this problem often. mod_proxy_ajp seems to suffer from the same malady. I got fed up with it and wrote my own session manager and switched to using HAProxy. HAProxy will let you use a URL as a health checker.
My article on using HAProxy rather than mod_jk/mod_proxy_ajp:
http://www.tomcatexpert.com/blog/2010/07/12/trick-my-proxy-front-tomcat-haproxy-instead-apache
Jon Brisbin
Portal Webmaster
NPC International, Inc.
>
>
>
> Are there any configuration settings to be mindful of with these
> scenarios?
>
>
>
> Cheers,
>
> Darren.
>
>
>
> Connaught plc is a FTSE 250 company. We are the UK's leading provider of integrated services operating in the compliance, environmental, social housing and public sector markets.
>
> Please visit our website to see a full list of Connaught's Registered Companies www.connaught.plc.uk/group/aboutconnaught/registeredcompanies
>
> Disclaimer:
> The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete this message. Connaught plc, Head Office 01392 444546

Attachment:
users_214949.ezm (zipped)
Attachment:
users_214950.ezm (zipped)
Attachment:
users_214951.ezm (zipped)
Attachment:
users_214952.ezm (zipped)On 22.07.2010 17:24, David Fisher wrote:
> If you look at catalina.sh you will see that stop does not include CATALINA_OPTS:
>
> "$_RUNJAVA" $JAVA_OPTS \
> -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -classpath "$CLASSPATH" \
> -Dcatalina.base="$CATALINA_BASE" \
> -Dcatalina.home="$CATALINA_HOME" \
> -Djava.io.tmpdir="$CATALINA_TMPDIR" \
>
org.apache.catalina.startup.Bootstrap "$@(protected)
>
> Change your catalina.sh to include your CATALINA_OPTS and it ought to work.
>
> Looks like a "bug" in Tomcat to me.
Feature, not a bug. There are options that you actually do not want to
occur for start and stop, e.g. assume you assign 1GB of heap per
commandline parameter. If the same parameter were used for stopping, the
shutdown process that lives only a few milliseconds to connect to the
shutdown port of Tomcat would also be started with this huge memory
size, although it doesn't need it. Another example is using a JMX port.
If you use the same flag for the shutdown process, the JVM will not
initialize, because it can not bind to the JMX port already in use.
This has been introduced in 6.0.15, see
https://issues.apache.org/bugzilla/show_bug.cgi?id=42951
Rainer

Attachment:
users_214953.ezm (zipped)
Attachment:
users_214954.ezm (zipped)
1. Is there a JMX counter/attribute that measures active/busy HTTP threads?
2. How can I send a notification on exceeding a threshold value on this
counter?
3. Can this be achieved through some admin console? Modifying tomcat code is
not an option.
Thanks,
Kapil
--
Sent from the Tomcat - User mailing list archive at Nabble.com.

Attachment:
users_214959.ezm (zipped)-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Kapil,
On 7/22/2010 12:07 PM, kapilok wrote:
> 1. Is there a JMX counter/attribute that measures active/busy HTTP threads?
Yes, depending on the Tomcat version. You didn't mention yours.
> 2. How can I send a notification on exceeding a threshold value on this
> counter?
How would you like to send a notification?
> 3. Can this be achieved through some admin console? Modifying tomcat code is
> not an option.
LabmdaProbe is one of several tools that can report on the status of
request processing threads. LP is open-source, so you can even dig into
the code to see how to grab the various state values if you want to
write your own observation and notification tool.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAkxIeeYACgkQ9CaO5/Lv0PDwEwCgolbRH5Ln5d41ma0PhaTa6nsZ
SyoAnjFOeB9oV1ajGMWmM+2zIiLEKQg5
=S64k
-----END PGP SIGNATURE-----

Attachment:
users_214955.ezm (zipped)
java -version
java version "1.6.0_18"
Java(TM) SE Runtime Environment (build 1.6.0_18-b07)
Java HotSpot(TM) Client VM (build 16.0-b13, mixed mode)
javac -version
javac 1.6.0_18
Tomcat 7 is the version I'm currently trying to run with, I installed it by
extracting the zip file.
I'm starting with Intellij and when starting the output is:
cmd /c C:\apps\tomcat\bin\catalina.bat run
Using CATALINA_BASE:
"C:\Users\Sharkanana\.IntelliJIdea90\system\tomcat\Unnamed_johnhelfertcomc9e4836f"
Using CATALINA_HOME: "C:\apps\tomcat"
Using CATALINA_TMPDIR: "C:\apps\tomcat\temp"
Using JRE_HOME: "C:\Sun\SDK\jdk\jre\"
Using CLASSPATH:
"C:\apps\tomcat\bin\bootstrap.jar;C:\apps\tomcat\bin\tomcat-juli.jar"
Connected to the target VM, address: '127.0.0.1:4956', transport: 'socket'
Then the debug log that I posted before.
I have also attempted starting from outside of Intellij(by running the
script files or executables), and am getting the same error.
Thanks for your quick replies!
John
n828cl wrote:
>
>> From: sharkanana [mailto:sharkanana@(protected)]
>> Subject: Problems starting Tomcat on windows 7 64bit.
>>
>> I have tried many different versions of tomcat and
>> all give the same problem.
>
> So tell us the exact version of *one* Tomcat you tried that has the
> problem, along with the JRE or JDK version you're using, how you installed
> Tomcat, and how you're starting it.
>
> Just as a guess, it looks like you might be using a server.xml that
> doesn't come from the version of Tomcat you're trying to run. Try a fresh
> download and a clean installation and see if that works.
>
> - Chuck
>
>
> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
> MATERIAL and is thus for use only by the intended recipient. If you
> received this in error, please contact the sender and delete the e-mail
> and its attachments from all computers.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@(protected)
> For additional commands, e-mail: users-help@(protected)
>
>
>
--
Sent from the Tomcat - User mailing list archive at Nabble.com.

Attachment:
users_214960.ezm (zipped)-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Chuck,
On 7/22/2010 12:21 AM, Caldarale, Charles R wrote:
>> From: sharkanana [mailto:sharkanana@(protected)]
>> Subject: Problems starting Tomcat on windows 7 64bit.
>>
>> I have tried many different versions of tomcat and
>> all give the same problem.
>
> So tell us the exact version of *one* Tomcat you tried that has the problem, along with the JRE or JDK version you're using, how you installed Tomcat, and how you're starting it.
>
> Just as a guess, it looks like you might be using a server.xml that doesn't come from the version of Tomcat you're trying to run. Try a fresh download and a clean installation and see if that works.
+1
Sharkanana, can you post your server.xml? Particularly the line that
mentions "
org.apache.catalina.core.AprLifecycleListener"?
My (stock 6.0.26) server.xml file contains a reference to this class:
org.apache.catalina.core.AprLifecycleListener...and seems to work just fine, though I don't have libapr installed, so
I get a warning that APR isn't going to be used.
I agree with Pid: you shouldn't be setting the CLASSPATH. If you use
catalina.bat or startup.bat to startup your Tomcat, it should be setting
CLASSPATH to "" before it starts. If, however, you have a setenv.bat
file that sets the CLASSPATH, you can still break things.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAkxIe10ACgkQ9CaO5/Lv0PB4vgCcC6tYKq9y/UufE1l80+XBFYr6
5lcAn0Wz/EZV0QdW4A+ACSJB6IgSWp1D
=2ilk
-----END PGP SIGNATURE-----

Attachment:
users_214970.ezm (zipped)Here is my server.xml. It is default.
<?xml version='1.0' encoding='utf-8'?>
<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<!-- Note: A "Server" is not itself a "Container", so you may not
define subcomponents such as "Valves" at this level.
Documentation at /docs/config/server.html
-->
<Server port="8005" shutdown="SHUTDOWN">
<!--APR library loader. Documentation at /docs/apr.html -->
<Listener className="
org.apache.catalina.core.AprLifecycleListener"
SSLEngine="on" />
<!--Initialize Jasper prior to webapps are loaded. Documentation at
/docs/jasper-howto.html -->
<Listener className="
org.apache.catalina.core.JasperListener" />
<!-- Prevent memory leaks due to use of particular java/javax APIs-->
<Listener
className="
org.apache.catalina.core.JreMemoryLeakPreventionListener" />
<Listener
className="
org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
<!-- Global JNDI resources
Documentation at /docs/jndi-resources-howto.html
-->
<GlobalNamingResources>
<!-- Editable user database that can also be used by
UserDatabaseRealm to authenticate users
-->
<Resource name="UserDatabase" auth="Container"
type="
org.apache.catalina.UserDatabase"
description="User database that can be updated and saved"
factory="
org.apache.catalina.users.MemoryUserDatabaseFactory"
pathname="conf/tomcat-users.xml" />
</GlobalNamingResources>
<!-- A "Service" is a collection of one or more "Connectors" that share
a single "Container" Note: A "Service" is not itself a "Container",
so you may not define subcomponents such as "Valves" at this level.
Documentation at /docs/config/service.html
-->
<Service name="Catalina">
<!--The connectors can use a shared executor, you can define one or more
named thread pools-->
<!--
<Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
maxThreads="150" minSpareThreads="4"/>
-->
<!-- A "Connector" represents an endpoint by which requests are received
and responses are returned. Documentation at :
Java HTTP Connector: /docs/config/http.html (blocking &
non-blocking)
Java AJP Connector: /docs/config/ajp.html
APR (HTTP/AJP) Connector: /docs/apr.html
Define a non-SSL HTTP/1.1 Connector on port 8080
-->
<Connector port="8080" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443" />
<!-- A "Connector" using the shared thread pool-->
<!--
<Connector executor="tomcatThreadPool"
port="8080" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443" />
-->
<!-- Define a SSL HTTP/1.1 Connector on port 8443
This connector uses the JSSE configuration, when using APR, the
connector should be using the OpenSSL style configuration
described in the APR documentation -->
<!--
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" />
-->
<!-- Define an AJP 1.3 Connector on port 8009 -->
<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
<!-- An Engine represents the entry point (within Catalina) that
processes
every request. The Engine implementation for Tomcat stand alone
analyzes the HTTP headers included with the request, and passes
them
on to the appropriate Host (virtual host).
Documentation at /docs/config/engine.html -->
<!-- You should set jvmRoute to support load-balancing via AJP ie :
<Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
-->
<Engine name="Catalina" defaultHost="localhost">
<!--For clustering, please take a look at documentation at:
/docs/cluster-howto.html (simple how to)
/docs/config/cluster.html (reference documentation) -->
<!--
<Cluster className="
org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
-->
<!-- This Realm uses the UserDatabase configured in the global JNDI
resources under the key "UserDatabase". Any edits
that are performed against this UserDatabase are immediately
available for use by the Realm. -->
<Realm className="
org.apache.catalina.realm.UserDatabaseRealm"
resourceName="UserDatabase"/>
<!-- Define the default virtual host
Note: XML Schema validation will not work with Xerces 2.2.
-->
<Host name="localhost" appBase="webapps"
unpackWARs="true" autoDeploy="true">
<!-- SingleSignOn valve, share authentication between web
applications
Documentation at: /docs/config/valve.html -->
<!--
<Valve className="
org.apache.catalina.authenticator.SingleSignOn" />
-->
<!-- Access log processes all example.
Documentation at: /docs/config/valve.html
Note: The pattern used is equivalent to using pattern="common"
-->
<Valve className="
org.apache.catalina.valves.AccessLogValve"
directory="logs"
prefix="localhost_access_log." suffix=".txt"
pattern="%h %l %u %t "%r" %s %b"
resolveHosts="false"/>
</Host>
</Engine>
</Service>
</Server>
Christopher Schultz-2 wrote:
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Chuck,
>
> On 7/22/2010 12:21 AM, Caldarale, Charles R wrote:
>>> From: sharkanana [mailto:sharkanana@(protected)]
>>> Subject: Problems starting Tomcat on windows 7 64bit.
>>>
>>> I have tried many different versions of tomcat and
>>> all give the same problem.
>>
>> So tell us the exact version of *one* Tomcat you tried that has the
>> problem, along with the JRE or JDK version you're using, how you
>> installed Tomcat, and how you're starting it.
>>
>> Just as a guess, it looks like you might be using a server.xml that
>> doesn't come from the version of Tomcat you're trying to run. Try a
>> fresh download and a clean installation and see if that works.
>
> +1
>
> Sharkanana, can you post your server.xml? Particularly the line that
> mentions "
org.apache.catalina.core.AprLifecycleListener"?
>
> My (stock 6.0.26) server.xml file contains a reference to this class:
>
>
org.apache.catalina.core.AprLifecycleListener>
> ...and seems to work just fine, though I don't have libapr installed, so
> I get a warning that APR isn't going to be used.
>
> I agree with Pid: you shouldn't be setting the CLASSPATH. If you use
> catalina.bat or startup.bat to startup your Tomcat, it should be setting
> CLASSPATH to "" before it starts. If, however, you have a setenv.bat
> file that sets the CLASSPATH, you can still break things.
>
> - -chris
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (MingW32)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAkxIe10ACgkQ9CaO5/Lv0PB4vgCcC6tYKq9y/UufE1l80+XBFYr6
> 5lcAn0Wz/EZV0QdW4A+ACSJB6IgSWp1D
> =2ilk
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@(protected)
> For additional commands, e-mail: users-help@(protected)
>
>
>
--
Sent from the Tomcat - User mailing list archive at Nabble.com.

Attachment:
users_214956.ezm (zipped)-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Eric,
On 7/22/2010 12:58 AM, Eric P wrote:
> One idea would be to insert a record into a database table that
> signifies an email should be sent to the user. This table could be
> regularly checked by a scheduled job (e.g., a TimerTask) that runs every
> minute in the background.
I like this idea in theory, but prefer a different implementation: use
cron instead of TimerTask. Make your email-sending code completely
separate from your webapp.
This will give you greater flexibility and you can even have the job
running on a completely different server. Plus, if you decide to cluster
your webapp, you don't have to figure out how to choose which cluster
member should run the email job and which ones should not.
> Another (maybe not so good) idea would be to leverage perhaps a session
> or request attribute listener that would check for a certain attribute
> being added to a session or requests.
This sounds overly complicated.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAkxIeDkACgkQ9CaO5/Lv0PB86gCeO9Mhqdl7UJ/LvgP5TesfKL19
x3QAn04tmdN36IfSoka2JFNt2lavV/7J
=fX2A
-----END PGP SIGNATURE-----

Attachment:
users_214957.ezm (zipped)-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
André,
On 7/22/2010 4:33 AM, André Warnier wrote:
> André Warnier wrote:
> Talking further to myself, I'll add that it also makes it easier to
> suspend/resume the sending of emails separately if you need to for some
> reason, without having to change anything to your running webapp.
+1
> I know, it is certainly less exciting than using consumer/producer
> patterns or Executor classes.. sigh.
This is still a producer/consumer pattern, honestly. It's just that the
classes are communicating using a database-based queue instead of via
method calls, etc.
I've built a wonderfully over-engineered email sending program that uses
the Executor classes. It actually is a multi-threaded and pipelined
report-generation-and-emailing program. It chews through tons of
quarterly reports and runs quite well.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAkxIeNcACgkQ9CaO5/Lv0PBIjQCgrDrW+/E2GwhMueyvPsiNbiUh
KmoAnirc+zn0MBrrjxmUabq2ODZN7904
=atUL
-----END PGP SIGNATURE-----

Attachment:
users_214958.ezm (zipped)-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Eric,
On 7/22/2010 12:56 PM, Christopher Schultz wrote:
> Eric,
>
> On 7/22/2010 12:58 AM, Eric P wrote:
>> One idea would be to insert a record into a database table that
>> signifies an email should be sent to the user. This table could be
>> regularly checked by a scheduled job (e.g., a TimerTask) that runs every
>> minute in the background.
>
> I like this idea in theory, but prefer a different implementation: use
> cron instead of TimerTask. Make your email-sending code completely
> separate from your webapp.
>
> This will give you greater flexibility and you can even have the job
> running on a completely different server. Plus, if you decide to cluster
> your webapp, you don't have to figure out how to choose which cluster
> member should run the email job and which ones should not.
>
>> Another (maybe not so good) idea would be to leverage perhaps a session
>> or request attribute listener that would check for a certain attribute
>> being added to a session or requests.
>
> This sounds overly complicated.
Oh, and one more thing: any in-memory solution you come up with (that
is, without writing to a database) is likely to suffer from loss of jobs
in the event of a crash or poorly-coded exception-handling.
This isn't necessarily a case for using a separate process just for
sending emails, but definitely a case for writing your "job" to the
database synchronously during the request so that you're sure it was
written.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAkxIeYIACgkQ9CaO5/Lv0PC7xgCfYS9iTWmINbxkr/wrGx3wAnCs
1RgAoJj3aH4MVgfqkzEtSBfglWUz6w13
=gaIt
-----END PGP SIGNATURE-----

Attachment:
users_214968.ezm (zipped)On 22/07/2010 15:37, André Warnier wrote:
> Mikolaj Rydzewski wrote:
>> On 07/22/2010 03:49 PM, Martin Gainty wrote:
>>> //i wasnt able to determine JMX ability to schedule a specific task
>>> for a specific time?
>>>
>>
>> I was referring to Andre's sentence:
>> "[using database] makes it easier to suspend/resume the sending of
>> emails separately if you need to for some reason, without having to
>> change anything to your running webapp. "
>>
>> One can use JMX to interact with code running in (possibly even
>> remote) JVM. So, one can use JMX to stop/start sending emails, using
>> custom code of course.
>> And my point was (with laugh), that now it becomes interesting and
>> exciting feature to implement.
>>
> And I got the point, and appreciated it.
> :-)
>
> Maybe we should have a competition for whom can find the most exciting
> and complex solution to the OP's problem. I'm sure we could fit SOAP in
> there somewhere, and use Hadoop for the db back-end.
> ;-)
Not forgetting JTA, JMS, JSF, EJB, JPA, JAF, etc...
Wait, then we'd have Glassfish.
p
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@(protected)
> For additional commands, e-mail: users-help@(protected)
>

Attachment:
signature.asc (zipped)
Attachment:
users_214969.ezm (zipped)Christopher Schultz wrote:
> Oh, and one more thing: any in-memory solution you come up with (that
> is, without writing to a database) is likely to suffer from loss of jobs
> in the event of a crash or poorly-coded exception-handling.
>
> This isn't necessarily a case for using a separate process just for
> sending emails, but definitely a case for writing your "job" to the
> database synchronously during the request so that you're sure it was
> written.
>
Thanks everyone for all your excellent ideas. I duly read all of them (*grin*).
I'll probably go w/the email queue/database table approach. All the points André and Christopher raised gave me further
insight into the robustness of this approach (loose coupling w/the app, no extra lib dependencies, emails not lost if
the app goes down, etc.). Also, the email queue table can serve as a nice log of emails processed.
Anyway, you all were super helpful. Thanks again!
Eric P.

Attachment:
users_214961.ezm (zipped)Hi,
I'm using RHEL5.5 (Up-to-date)
Apache httpd-2.2.3 (from RHEL) with mod_proxy/mod_proxy_ajp
Tomcat 6.0.28 (binary distribution from apache).
Tomcat native libs (1.1.20, compiled)
I have a question regarding AJP connectors and SSL
Our application is being SSL offloaded at the HTTPD server end so communication with Tomcat doesn't need to be encrypted.
I have two virtual hosts configured in Apache HTTPD (one for :80, one for :443) with the application being proxied
in both virtual hosts.
My question is, in the Tomcat server.xml, do I require _two_ AJP connectors as follows:
(executor omitted for simplicity)
<!-- AJP connector pair (HTTP and fake HTTPS), proxied -->
<Connector executor="tomcatThreadPool"
enableLookups="false"
port="8009" protocol="
org.apache.coyote.ajp.AjpAprProtocol"
redirectPort="8010"
proxyPort="80" />
<Connector executor="tomcatThreadPool"
enableLookups="false"
port="8010" protocol="
org.apache.coyote.ajp.AjpAprProtocol"
scheme="https" secure="true"
proxyPort="443" />
Or can I proxy both HTTP and HTTPS requests to the same AJP connector and have Tomcat correctly recognise when its
SSL and return the correct port to the application so URLs are constructed properly? If I do this, are there any
special configuration needed in the SSL vhost?
Essentially I'm wondering if I can do this:
<VirtualHost _default_:80>
<!-- ... snip ... -->
ProxyPass /examples/ ajp://tomcat:8009/examples/
ProxyPassReverse /examples/ ajp://tomcat:8009/examples/
</VirtualHost>
<VirtualHost _default_:443>
SSLEngine on
<!-- ... snipped ssl config ... -->
ProxyPass /examples/ ajp://tomcat:8009/examples/
ProxyPassReverse /examples/ ajp://tomcat:8009/examples/
<!-- Note the AJP port above is the same as the one in the port 80 vhost -->
</VirtualHost>
Rather than this:
Port 80 vhost identical to above
Port 443 vhost as follows
<VirtualHost _default_:443>
SSLEngine on
<!-- ... snipped ssl config ... -->
ProxyPass /examples/ ajp://tomcat:8010/examples/
ProxyPassReverse /examples/ ajp://tomcat:8010/examples/
<!-- Note the AJP port is different to that in the port 80 vhost -->
</VirtualHost>
Any advice appreciated,
Thanks,
Best Regards,
Brett Delle Grazie
______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email
______________________________________________________________________

Attachment:
users_214962.ezm (zipped)On 22.07.2010 19:31, Brett Delle Grazie wrote:
> Hi,
>
> I'm using RHEL5.5 (Up-to-date)
> Apache httpd-2.2.3 (from RHEL) with mod_proxy/mod_proxy_ajp
> Tomcat 6.0.28 (binary distribution from apache).
> Tomcat native libs (1.1.20, compiled)
>
> I have a question regarding AJP connectors and SSL
>
> Our application is being SSL offloaded at the HTTPD server end so communication with Tomcat doesn't need to be encrypted.
>
> I have two virtual hosts configured in Apache HTTPD (one for :80, one for :443) with the application being proxied
> in both virtual hosts.
>
> My question is, in the Tomcat server.xml, do I require _two_ AJP connectors as follows:
>
> (executor omitted for simplicity)
>
> <!-- AJP connector pair (HTTP and fake HTTPS), proxied -->
> <Connector executor="tomcatThreadPool"
> enableLookups="false"
> port="8009" protocol="
org.apache.coyote.ajp.AjpAprProtocol"
> redirectPort="8010"
> proxyPort="80" />
>
> <Connector executor="tomcatThreadPool"
> enableLookups="false"
> port="8010" protocol="
org.apache.coyote.ajp.AjpAprProtocol"
> scheme="https" secure="true"
> proxyPort="443" />
>
> Or can I proxy both HTTP and HTTPS requests to the same AJP connector and have Tomcat correctly recognise when its
> SSL and return the correct port to the application so URLs are constructed properly? If I do this, are there any
> special configuration needed in the SSL vhost?
It will work with well-behaved apps without special configuration.
That's one strength of the AJP protocol.
See
http://tomcat.apache.org/connectors-doc/generic_howto/proxy.html
for more details.
Regards,
Rainer

Attachment:
users_214966.ezm (zipped)-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Brett,
On 7/22/2010 1:31 PM, Brett Delle Grazie wrote:
> Tomcat 6.0.28 (binary distribution from apache).
>
> My question is, in the Tomcat server.xml, do I require _two_ AJP
> connectors as follows:
>
> (executor omitted for simplicity)
>
> <!-- AJP connector pair (HTTP and fake HTTPS), proxied -->
> <Connector executor="tomcatThreadPool"
> enableLookups="false"
> port="8009" protocol="
org.apache.coyote.ajp.AjpAprProtocol"
> redirectPort="8010"
> proxyPort="80" />
>
> <Connector executor="tomcatThreadPool"
> enableLookups="false"
> port="8010" protocol="
org.apache.coyote.ajp.AjpAprProtocol"
> scheme="https" secure="true"
> proxyPort="443" />
In addition to Rainer's notes, I have a couple of comments:
It's not necessary to specify
protocol="
org.apache.coyote.ajp.AjpAprProtocol" in the <Connector>. If
libapr isn't available, you'll be left with no working connectors. If,
instead, you simply have protocol="AJP/1.3", your <Connector> can
fall-back to the BIO (i.e. blocking pure-Java connector).
Your redirectPort should point to the port that is visible to the
outside world, not to the port that is being used for Tomcat. Probably,
your redirectPort should be set to "443" so that requests will be
redirected (remember, via the user agent) and hit your Apache httpd
instance out in front of Tomcat. If you specify "8010", and that port is
blocked to the outside world, you'll find that your users will receive a
"cannot contact server" message. if port 8010 is /not/ blocked, they'll
get a weird SSL error saying that the server isn't speaking HTTPS....
because it's speaking AJP!
Hope that helps,
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAkxIuZcACgkQ9CaO5/Lv0PBAfwCfQN9zGWDLjE8flIPh3xpmUoWx
MrUAn1Epj1dKmzh0/SAD2KI+C44i2bvX
=xF9L
-----END PGP SIGNATURE-----

Attachment:
users_214963.ezm (zipped)Hi,
I am developing an Struts2 application, but unfortunately it doesn´t run, It
gives me the following error:
ERROR: Servlet /webstruts throw exception de load()
javax.servlet.UnavailableException: Initializing application data source
org.apache.struts.action.DATA_SOURCE
Anybody knows how to solve this error?
Regards
--
Sent from the Tomcat - User mailing list archive at Nabble.com.

Attachment:
users_214964.ezm (zipped)Hi,
For tomcat, if we dont give any memory args in catalina.sh, then want is the
xms and xmx values. And can we monitor tomcat memory utilization from tomcat
manager(console). If we are not using tomcat console then is there any way
to monitor memory utilization of tomcat instance.
--
Thanks,
Gopi
Ph: (408) 306-8643

Attachment:
users_214965.ezm (zipped)-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Gopi,
On 7/22/2010 5:11 PM, Gopi Valleru wrote:
> For tomcat, if we dont give any memory args in catalina.sh, then want
> is the xms and xmx values.
This is entirely up to the JVM, and is not Tomcat-specific. If you don't
specify any memory settings, Tomcat does not add any of its own.
> And can we monitor tomcat memory utilization from tomcat
> manager(console).
If you can see it in the manager, then you can certainly monitor it.
> If we are not using tomcat console then is there any way to monitor
> memory utilization of tomcat instance.
There are many ways. What would you prefer?
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAkxIt6EACgkQ9CaO5/Lv0PC7PgCgrc0l8aQxOfk+0fFjQ4eU1NKJ
G0gAnAtj7z6MzyZDGMkBKzoi9O90PamJ
=JY8G
-----END PGP SIGNATURE-----

Attachment:
users_214967.ezm (zipped)Hi Chris,
Thanks for your quick reply.
*>This is entirely up to the JVM, and is not Tomcat-specific. If you don't
specify any memory settings, Tomcat does not add any of its own.*
In a new tomcat domain I haven't added any xms and xmx values. When i went
to the console and i can see "Free memory: 707.71 MB Total memory: 733.18 MB
Max memory: 913.37 MB".and in this instance an application is running.
Now i created a new instance on which no application is running and it has,
Free memory: 897.25 MB Total memory: 985.00 MB Max memory: 985.00 MB
Do you you know the reason why? Is there is any way that we can predict
this.
And for monitoring is there any open source with less memory foot print.
On Thu, Jul 22, 2010 at 5:26 PM, Christopher Schultz <
chris@(protected):
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Gopi,
>
> On 7/22/2010 5:11 PM, Gopi Valleru wrote:
> > For tomcat, if we dont give any memory args in catalina.sh, then want
> > is the xms and xmx values.
>
> This is entirely up to the JVM, and is not Tomcat-specific. If you don't
> specify any memory settings, Tomcat does not add any of its own.
>
> > And can we monitor tomcat memory utilization from tomcat
> > manager(console).
>
> If you can see it in the manager, then you can certainly monitor it.
>
> > If we are not using tomcat console then is there any way to monitor
> > memory utilization of tomcat instance.
>
> There are many ways. What would you prefer?
>
> - -chris
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (MingW32)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAkxIt6EACgkQ9CaO5/Lv0PC7PgCgrc0l8aQxOfk+0fFjQ4eU1NKJ
> G0gAnAtj7z6MzyZDGMkBKzoi9O90PamJ
> =JY8G
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@(protected)
> For additional commands, e-mail: users-help@(protected)
>
>
--
Thanks,
Gopi
Ph: (408) 306-8643

Attachment:
users_214971.ezm (zipped)Hi,
I am currently using apache tomcat 5.5 using mod_jk to connect with apache
2.2.
I am curious to understand how the AJP 1.3 connector works. Basically I
would like to know if maxThreads attribute has the same meaning with the AJP
connector as it does with standard HTTP connectors. I would like to increase
the number of connectors, but I noticed there is also connection_pool_size
and connection_pool_minsize on the workers.properties file.
What is the relationship between the AJP connectors maxThreads and the
connection_pool_size?
Thanks,
Imran