Re: tomcat jitters, then hangs - please help
Good to hear, I can confirm setting LD_ASSUME_KERNEL to 2.2.5 also works. The server has been running for the past two weeks without a single outage. Best Regards, Noam - Original Message - From: "Ryan Lissack" <[EMAIL PROTECTED]> To: "'Tomcat Users List'" <[EMAIL PROTECTED]> Sent: Friday, October 24, 2003 1:35 PM Subject: RE: tomcat jitters, then hangs - please help > Hi all, > > Just an update on issues we were experiencing when running Tomcat on Red Hat > 9. > > As mentioned previously in this thread, the problem appears to be with a bug > in NPTL. > In order to revert to standard Linux threads you can set the > LD_ASSUME_KERNEL environment variable to 2.2.5 or 2.4.1 > > We set LD_ASSUME_KERNEL to 2.4.1 on one of our servers one week ago and, > since then, have *not* had one outage, our other machine which does not have > the environment variable set has had numerous outages during the period. > > We can confirm that this does appear to resolve the issue. > > I believe Noam Camiel found that setting LD_ASSUME_KERNEL to 2.2.5 also > works. > > I would like to say a special thank you to Remy for all his help during this > period. > > Best regards, > Ryan > > > -Original Message- > From: Shapira, Yoav [mailto:[EMAIL PROTECTED] > Sent: 15 October 2003 14:07 > To: Tomcat Users List > Subject: RE: tomcat jitters, then hangs - please help > > > > Howdy, > Cool, please keep us updated ;) I want these linux questions better > documented in the list archives ;) > > Yoav Shapira > Millennium ChemInformatics > > > >-Original Message- > >From: Noam Camiel [mailto:[EMAIL PROTECTED] > >Sent: Wednesday, October 15, 2003 6:37 AM > >To: Euan Guttridge; Tomcat Users List > >Subject: Re: tomcat jitters, then hangs - please help > > > >Hi Euan > > > >Please note the server is now up for 48 hours strait. > >The change I've made is I've set LD_ASSUME_KERNEL to 2.2.5 > >I will update again in another 48 hours or if the server hangs, > whichever > >comes first. > > > >Regards, > >Noam > > > >- Original Message - > >From: "Euan Guttridge" <[EMAIL PROTECTED]> > >To: <[EMAIL PROTECTED]> > >Sent: Wednesday, October 15, 2003 9:42 AM > >Subject: FW: tomcat jitters, then hangs - please help > > > > > >> Hi Noam, > >> > >> I work with Ryan on tomcat issues. I would be grateful if you would > let > >me > >> know if your tomcat installation is *still* up (another 24 hours) > since > >the > >> NPTL change as below. > >> > >> > >> Regards, > >> Euan > >> > >> -Original Message- > >> From: Noam Camiel [mailto:[EMAIL PROTECTED] > >> Sent: 14 October 2003 14:46 > >> To: Tomcat Users List > >> Subject: Re: tomcat jitters, then hangs - please help > >> > >> > >> Hi, > >> > >> On Friday, October 10, 2003 11:09 AM "Ryan Lissack" > >> <[EMAIL PROTECTED]> wrote: > >> > >> > Remy pointed out to me previously that RH9 uses a new form of > threading > >> and > >> > based on this we have done some investigation. > >> > > >> > RH9 uses NTPL (Native POSIX Thread Library) > >> > http://www.redhat.com/docs/manuals/linux/RHL-9-Manual/release- > >notes/x86/ > >> > > >> > It is possible to revert to the older form of threading, > >"LinuxThreads", > >> by > >> > setting an environment variable, namely: > >> > LD_ASSUME_KERNEL= > >> > - 2.4.1 - Linuxthreads with floating stacks > >> > - 2.2.5 - Linuxthreads without floating stacks > >> > > >> > This does not revert back to an older kernel, it just changes the > GNU C > >> > library used > http://www-106.ibm.com/developerworks/java/library/j-jtc/ > >> > > >> > We will be testing with these settings starting today and, if we > >continue > >> to > >> > have problems, we will be trying another distro. > >> > >> setting the LD_ASSUME_KERNEL variable, the server is now running over > 24 > >> hours strait. > >> Still, nothing conclusive as of yet.. > >> Ryan, thanks for the information above. Do you have move information > >> regarding this configuration? do you still encounter problems? > >> > >> > >> On Monday, October 13, 2003 9:59 PM "Joe Zendle" > ><[EMAIL PROTECTED]> > >> wrote: > >> > >> > We had the same problem w/ TC 4.1.27, sun jvm 1.4.2 and redhat 9. > The > >> > thing wouldn't work for more than about 12 hours. IMHO, there are > some > >> > fundamental problems with tomcat as of late. Hate to say it but we > >> > solved the problem by throwing away tomcat and using jetty! We are > very > >> > pleased so far. Jetty is very fast and about 1/3 the memory > footprint. > >> > > >> > Good luck. > >> > >> > >> Hi Joe, > >> Thanks for sharing the info, I am considering what you suggest as > well. > >> As a last try before moving away from Tomcat, I'm trying out the > >suggestion > >> from Ryan above. > >> Regards, > >> Noam. > >> > >> > >> > >> - > >> To unsubscribe, e-mail: [EMAIL PROTECTED] > >> For additional commands, e-mail: [EMAIL PROTECTED] > > > > > >
FW: [HELP!] Which key alias names to use for SSL?
--- Begin Message ---
Sonny:
Just as port 80 is the standard HTTP port, port 443 is the standard
HTTPS port. Similarly, just as the default Tomcat installation is
configured to run on HTTP port 8080, it is also set to accept HTTPS
requests on port 8443. By default, I also believe that Tomcat is
configured so that the JK2 connector forwards HTTPS requests to Tomcat
on port 8443. So, unless you change the SSL port from 8443 to 443, you
must specify port 8443 in the URL when you access your SSL application:
https://localhost:8443/ssl-application
If you change port 8443 to 443, you no longer need to specify any port
in the URL:
https://localhost/ssl-application
Derek
-
Derek Mahar
Software Developer
Penson Financial Services Canada
360 St-Jacques St West, 12th Floor
Montreal QC H2Y 1P5
514.841.9665 x212 Phone
514.841.9700 Fax
-
-Original Message-
From: Sonny Sukumar [mailto:[EMAIL PROTECTED]
Sent: October 11, 2003 9:22 PM
To: [EMAIL PROTECTED]
Subject: Re: [HELP!] Which key alias names to use for SSL?
3rd update:
For the 2nd issue below, I had some "http" references in my static html
file--that's why I was getting the message about the page having
unencrypted
elements on it. :-)
I still haven't figured out the 1st issue regarding ports 443/8443, but
443
is the one I want anyhow, so it's not critical that I figure that out
(although I'm curious!)
Sonny
>From: "Sonny Sukumar" <[EMAIL PROTECTED]>
>
>
>2nd Update:
>
>--I reconfigured the SSL port from 8443 to 443 on our server (as well
>as
>the redirect port), and all of a sudden I can connect using SSL. I
don't
>understand why 8443 didn't work. Any ideas??
>
>--Now when I request static HTML pages, I get a browser alert saying
>that
>some of the info on the requested page is NOT encrypted, so it displays
a
>lock broken in half instead of the golden lock I so desire. :-( I
can't
>understand how a page would get partially encrypted--especially a
static
>HTML page.
>
>I'm not sure if it's relevant, but I use Cocoon for the backend (2.1.2)
>in
>conjunction with Tomcat (4.1.27) on Linux (RedHat 7.3).
>
>Sonny
>
>>From: "Sonny Sukumar" <[EMAIL PROTECTED]>
>>
>>
>>Update: I did a "keytool -list" with the "-rfc" options and discovered
>>that all the certs *are* in fact there, but just that public/private
key
>>were bundled together under the same alias. The way it lists the
certs by
>>default is what confused me.
>>
>>HOWEVER, I uploaded the keystore to our server, set up server.xml, and
>>restarted Tomcat, but every single secure connection I attempt just
times
>>out. I don't understand why this happens.
>>
>>Here's my server.xml SSL connector:
>>
>>
>>> port="8443" minProcessors="5" maxProcessors="75"
>> enableLookups="true"
>> acceptCount="100" debug="0" scheme="https" secure="true"
>> useURIValidationHack="false"
disableUploadTimeout="true"
>> compression="on">
>> >className="org.apache.coyote.tomcat4.CoyoteServerSocketFactory"
>> clientAuth="false" protocol="TLS"
keystorePass="changeit"
>> keystoreFile="conf/.keystore"/>
>>
>>
>>Btw, does anybody know how to secure the server.xml file? It contains
>>some clear text passwords, so this really concerns me! (Yes, I know
>>"changeit" is the default password even without specifying it here).
>>
>>Also, I don't currently have any s set in my
>>web.xml.
>>
>>Thanks for any insights!
>>
>>Sonny
>>
>>>From: "Sonny Sukumar" <[EMAIL PROTECTED]>
>>>Reply-To: [EMAIL PROTECTED]
>>>To: [EMAIL PROTECTED]
>>>Subject: Re: [HELP!] Which key alias names to use for SSL?
>>>Date: Sat, 11 Oct 2003 14:12:17 -0700
>>>
>>>
>>>Hi Adam,
>>>
>>>Your first step was:
# keytool -genkey -alias tomcat -keyalg RSA
>>>
>>>and your last step was:
# keytool -import trustcacerts -file public.crt -alias tomcat
>>>
>>>So you used the same alias ("tomcat") for both the private key and
>>>the
>>>signed public key. This is what doesn't work for me, because when I
>>>import the signed public key using the same ("tomcat") alias, my
private
>>>key gets overwritten. I've verified this using "keytool list
-keystore
>>>./.keystore"
>>>
>>>I also have the root cert from GeoTrust in there with alias "root".
>>>The
>>>root cert is actually an Equifax cert valid from 1998 to 2018, but
the
>>>GeoTrust tech support rep told me to use that one. Could this be the
>>>problem?
>>>
>>>Other ideas?
>>>
>>>Thanks,
>>>
>>>Sonny
>>>
From: Adam Hardy <[EMAIL PROTECTED]>
>>>
On 10/11/2003 09:08 PM Sonny Sukumar wrote:
>
>[I sent this once before, but got no response, and I'm not sure
>what to
>do. Thanks in advance.]
>
>Hi guys,
>
>I'm trying to setup my Tomcat (4.1.27) server to work with SSL. I
>got
>a CA-signed cert to go with my private key and CA root cert, but
I'm
>confused
Help with access to certificate on HTTPS
To whoever can help:
I have an application which requires certificates, and a bunch of
servlets which don't. In my application I need to determine the
originating client of the certificate-based connection
(which comes from an enterprise application). I can do this if I can
get access to either the request Principal, or the certificate itself.
I have tried to use
req.getUserPrincipal();
req.getAttribute("javax.servlet.request.X509Certificate"); and
req.getAttribute("javax.net.ssl.peer_certificates");
all return null unless CLIENT-AUTH=true in server.xml is set,
(in which case the x509cert attribute returns the cert chain the rest
always return null)
but this requires certificates for all access which is what I don't
want.
I also tried setting
in the context for the application but it didn't seem to help.
I've also tried various combinations with CLIENT-CERT authorization in
the
deployment descriptor for the application.
Some of the combinations simly block the interaction (saying no
client-cert presented, when there is one.)
I'm running 4.1.24 and 4.1.27 on XP Pro and Win2000.
Can anyone help?
Thanks,
Bill
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
Re: Tomcat doesn't start under Windows XP
Sure, sorry. My JAVA_HOME variable was not set correctly, I had included \bin where I shouldnt have ... Incorrect: F:\j2sdk1.4.1_02\bin Correct: F:\j2sdk1.4.1_02 Previous posts helped me finding the problem... - Original Message - From: "Christopher Schultz" <[EMAIL PROTECTED]> To: "Tomcat Users List" <[EMAIL PROTECTED]> Sent: Sunday, October 26, 2003 2:05 PM Subject: Re: Tomcat doesn't start under Windows XP > Giselle, > > Never mind, folks, I got it. > > Could you explain what the problem was, and what the fix was, so that > others can get help when they search the archives? > > -chris > > > - > To unsubscribe, e-mail: [EMAIL PROTECTED] > For additional commands, e-mail: [EMAIL PROTECTED] > > - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
Re: Help with access to certificate on HTTPS
Bill,
I have tried to use
req.getUserPrincipal();
req.getAttribute("javax.servlet.request.X509Certificate"); and
req.getAttribute("javax.net.ssl.peer_certificates");
This is specific to Tomcat 4.1 and higher, but:
req.getAttribute("org.apache.coyote.request.X509Certificate");
should work. Of course, this ties your application to Tomcat and there is
no guarantee that future versions of Tomcat will continue to support it
(although currently 5.0 does).
You also have the option of putting the attribute name into a properties
file, and updating that file based upon the container that you use. You
could also use a JNDI resource which is pretty much the same thing, but
may be easier to configure when moving from app server to app server.
-chris
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
Re: Help with access to certificate on HTTPS
"Bill Harrelson" <[EMAIL PROTECTED]> wrote in message
news:[EMAIL PROTECTED]
> To whoever can help:
>
> I have an application which requires certificates, and a bunch of
> servlets which don't. In my application I need to determine the
> originating client of the certificate-based connection
> (which comes from an enterprise application). I can do this if I can
> get access to either the request Principal, or the certificate itself.
>
> I have tried to use
> req.getUserPrincipal();
> req.getAttribute("javax.servlet.request.X509Certificate"); and
> req.getAttribute("javax.net.ssl.peer_certificates");
>
This is specific to Tomcat 4.1 and higher, but:
req.getAttribute("org.apache.coyote.request.X509Certificate");
should work. Of course, this ties your application to Tomcat and there is
no guarantee that future versions of Tomcat will continue to support it
(although currently 5.0 does).
> all return null unless CLIENT-AUTH=true in server.xml is set,
> (in which case the x509cert attribute returns the cert chain the rest
> always return null)
> but this requires certificates for all access which is what I don't
> want.
>
> I also tried setting className="org.apache.catalina.valves.CertificatesValve"
> certificates="true" debug="1"/>
> in the context for the application but it didn't seem to help.
>
CertificatesValve does nothing if you are using the Coyote connectors.
> I've also tried various combinations with CLIENT-CERT authorization in
> the
> deployment descriptor for the application.
> Some of the combinations simly block the interaction (saying no
> client-cert presented, when there is one.)
>
This is the usual way. However, you have to use MemoryRealm, and enter the
DN of all of your certs into tomcat-users.xml. Alternatively, you write
your own Realm that decides which certs you like.
> I'm running 4.1.24 and 4.1.27 on XP Pro and Win2000.
>
> Can anyone help?
>
> Thanks,
>
> Bill
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
Tomcat doesn't start under Windows XP
Hi all, Im having the same problem and Giorgio, my Tomcat wont start under Windows XP, I get the msg : Windows cannot find '-Djava.endorsed.dirs='. Im using I'm using Win XP Java 1.4.2, Tomcat 4.1.27 Does anyone know what is the solution for this problem ? Thx
Re: Tomcat doesn't start under Windows XP
Never mind, folks, I got it. - Original Message - From: "Giselle Dazzi" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Sunday, October 26, 2003 1:33 PM Subject: Tomcat doesn't start under Windows XP Hi all, Im having the same problem and Giorgio, my Tomcat wont start under Windows XP, I get the msg : Windows cannot find '-Djava.endorsed.dirs='. Im using I'm using Win XP Java 1.4.2, Tomcat 4.1.27 Does anyone know what is the solution for this problem ? Thx - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
Re: Tomcat doesn't start under Windows XP
Giselle, Never mind, folks, I got it. Could you explain what the problem was, and what the fix was, so that others can get help when they search the archives? -chris - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
RE: Session affinity doesn't work
Hi Klaus, The jvmRoute of the second tomcat instance is "tomcat2", I forgot to said that in my first email. About the tomcatId, I modified my settings as you said but now the load balancing no longer works. Only tomcat2 responses to my request. Thank you anyway. Anyone have another idea? Thanks. Dinh. PS: The attachments are my setting files for your reference. server1.xml is server.xml for tomcat1 and server2.xml is server.xml for tomcat2 factory org.apache.catalina.users.MemoryUserDatabaseFactory pathname conf/tomcat-users.xml usernamesa password driverClassName org.hsql.jdbcDriver url jdbc:HypersonicSQL:database mail.smtp.host localhost factory org.apache.catalina.users.MemoryUserDatabaseFactory pathname conf/tomcat-users.xml usernamesa password driverClassName org.hsql.jdbcDriver url jdbc:HypersonicSQL:database mail.smtp.host localhost - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
RE: Session affinity doesn't work
This is my workers2.properties. I attached it to my last mail but the
mail server removed it. Sorry for that.
==
[logger]
level=DEBUG
[config:]
#file=${serverRoot}/conf/workers2.properties
#file=c:/Apache2/conf/workers2.properties
file=conf/workers2.properties
debug=0
debugEnv=0
[shm:]
info=Scoreboard. Required for reconfiguration and status with
multiprocess servers
#file=${serverRoot}/logs/jk2.shm
file=logs/jk2.shm
size=100
debug=0
disabled=0
[workerEnv:]
info=Global server options
timing=1
debug=0
# Default Native Logger (apache2 or win32 )
# can be overriden to a file logger, useful
# when tracing win32 related issues
#logger=logger.file:0
[lb:lb]
info=Default load balancer.
debug=0
# tomcat1
[channel.socket:localhost:11009]
port=11009
host=localhost
type=ajp13
lb_factor=100
#tomcatId=tomcat1 : make load balancing not work
# tomcat2
[channel.socket:localhost:12009]
port=12009
host=localhost
type=ajp13
lb_factor=100
#tomcatId=tomcat2 : make load balancing not work
# tomcat3
#[channel.socket:psdwdinhnguyen:13009]
#port=13009
#host=psdwdinhnguyen
#type=ajp13
#lb_factor=100
[uri:/jkstatus/*]
info=Display status information and checks the config file for changes.
#group=status:
[uri:/*.jsp]
info=Extension mapping
==
-Original Message-
From: Dinh Nguyen
Sent: Monday, October 27, 2003 8:50 AM
To: Tomcat Users List
Subject: RE: Session affinity doesn't work
Hi Klaus,
The jvmRoute of the second tomcat instance is "tomcat2", I forgot to
said that in my first email. About the tomcatId, I modified my settings
as you said but now the load balancing no longer works. Only tomcat2
responses to my request.
Thank you anyway. Anyone have another idea? Thanks.
Dinh.
PS: The attachments are my setting files for your reference. server1.xml
is server.xml for tomcat1 and server2.xml is server.xml for tomcat2
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
Re: jserv Vs Tomcat
Geetha Thanu Technical Officer CDFD,Hyderabad. Sir, Thank u so much for ur very clear reply. I immediately try to shift to tomcat. with regds Geetha -REPLY TO- Date:Fri Oct 24 06:04:40 CST 2003 FROM: Christopher Schultz <[EMAIL PROTECTED]> To: Tomcat Users List <[EMAIL PROTECTED]> Subject: Re: jserv Vs Tomcat Geeta, > I am new to this list. I was using jserv with apache to see the servlet > pages. Ouch. I used jserv a long time ago with a company that hadn't yet switched over to using Tomcat. Once we switched, we all felt *so* much better. Configuration in jserv is a nightmare and the tech is so old, that it's hard to do a lot of things provided by new APIs, etc. I woulc strongly recommend moving to Tomcat. > It is running on solaris 8 and the problem I am facing with Apache Jserv > is , I have set the security.maxConnections=50 (default) but still I feel > the TOP command shows so many threads and if it is above 100 , the whole > jserv hangs and unable to process any request. Can you get a thread dump when the thread-count gets high? You can get a thread dump on Solaris by sending a QUIT signal to the process. A thread dump will be emitted on stdout. If you're running jserv from the command-line (in the foreground), you can press CTRL-\ (which sends a SIGQUIT). Take note of which threads are runnable and which are waiting for monitors. It's possible the you have a deadlock situation that gets worse over time. > If installing tomcat is the only solution how to down load it , becos > when i tried downloading it from jakarta site and when I untar it > it is always showing directory check sum error. This is likely to be due to the fact that tar files from Jakarta are tarred using Gnu tar, instead of the one that ships with Solaris. Use gnu tar and you are likely to have better results. -chris - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] - - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
Re: Missing jdbc context
Shapira, Yoav wrote: Howdy, Set debug="99" for your server, engine, host, so you can see why tomcat is running into errors processing server.xml. Unfortunately, that setting does not provide any more information about the problem. Regards, Hans -- Johann Uhrmann xpecto AG | Lindenstrasse 81 | D-84030 Ergolding Telefon: 0700 xpecto 00 (0700 973286 00) Telefax: 0700 xpecto 10 (0700 973286 10) Internet: http://www.xpecto.com - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
Re: Missing jdbc context
where did you put the postgres jar file? Filip - Original Message - From: "Johann Uhrmann" <[EMAIL PROTECTED]> To: "Tomcat Users List" <[EMAIL PROTECTED]> Sent: Wednesday, October 22, 2003 3:59 AM Subject: Missing jdbc context Hello, I have some problems with Tomcat 4.1.27 and database connection pooling: Apparently, the context java:comp/env/jdbc does not exist. This is what I get from catalina.out: Starting service Tomcat-Standalone Apache Tomcat/4.1.27-LE-jdk14 GlobalResourcesLifecycleListener: Destroying MBeans for Global JNDI Resources Stopping service Tomcat-Standalone GlobalResourcesLifecycleListener: Creating MBeans for Global JNDI Resources in Context '' [EMAIL PROTECTED] GlobalResourcesLifecycleListener: Processing resource jdbc java.lang.String GlobalResourcesLifecycleListener: Creating MBeans for Global JNDI Resources in Context 'jdbc/' [EMAIL PROTECTED] GlobalResourcesLifecycleListener: Naming exception processing jdbc: org.apache.naming.NamingContext:[EMAIL PROTECTED] javax.naming.NamingException: Cannot create resource instance The configuration in server.xml is: validationQuery select version() url jdbc:postgresql://dbserver:5432/mydb password myPwd maxActive 10 maxWait 5000 driverClassName org.postgresql.Driver username dbuser maxIdle 2 ... Can someone give me a hint why that context is not available? Thank You, Johann Uhrmann -- Johann Uhrmann xpecto AG | Lindenstrasse 81 | D-84030 Ergolding Telefon: 0700 xpecto 00 (0700 973286 00) Telefax: 0700 xpecto 10 (0700 973286 10) Internet: http://www.xpecto.com - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
