Re: Force 32-bit installation on 64-bit windows?

2011-10-20 Thread Konstantin Kolinko
2011/10/19 Caldarale, Charles R chuck.caldar...@unisys.com:
 From: David kerber [mailto:dcker...@verizon.net]
 Subject: Re: Force 32-bit installation on 64-bit windows?

 So if I select the 32-bit JRE, it should install the 32-bit service?

 Not sure if the installer will ask, but if you make the 32-bit JRE the 
 default, it will use that and select the 32-bit service.

Installer asks and allows you to select the JRE
and it will detect whether the chosen one is 32-bit or 64-bit.

See  Function checkJava in res/tomcat.nsi

Best regards,
Konstantin Kolinko

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: combination of RemoteAddrValve und basic authentication

2011-10-20 Thread Remon Sadikni

Hi Chris,


but allows is part of RequestFilterValve.


Not in the current trunk. Your code expects the allows variable to
be of type String[], and no such variable exists in RequestFilterValve.



Right: the point of the RequestFilterValve is that you don't have to
override the process() method. Overriding it kind of defeats the
purpose of the class, because it really doesn't have any other methods
other than the accessors and mutators for the 'deny' and 'allow'
properties.



I only mentioned once, that I use Tomcat 6: And there is an allows 
attribute and an additional method precalculate.


Regards,
Remon

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



control of session timed out with tomcat

2011-10-20 Thread Alejandro Soto
Hi my friends, I want to ask you all, If there is a way to control the timed
out of sessions with tomcat, what I need is when the session timed out,
automatically the user is redirected to the login page, Is this possible to
do that from tomcat?, I mean, tomcat triggers some event to the user with
session timed out, with no need user interaction.

I know that the time of inactivity of the session is setup in web.xml, with
that I have no problem, what I need is just redirect to a login page when
the session timed out.

I am working with tomcat 7.0.20 and JDBCRealm for authentication.

Thanks in advance.

-- 
Alejandro Soto M.


Re: control of session timed out with tomcat

2011-10-20 Thread Tim Watts
On Thu, 2011-10-20 at 09:51 -0400, Alejandro Soto wrote:
 Hi my friends, I want to ask you all, If there is a way to control the timed
 out of sessions with tomcat, what I need is when the session timed out,
 automatically the user is redirected to the login page, Is this possible to
 do that from tomcat?, I mean, tomcat triggers some event to the user with
 session timed out, with no need user interaction.
 
 I know that the time of inactivity of the session is setup in web.xml, with
 that I have no problem, what I need is just redirect to a login page when
 the session timed out.
 

You mean when a browser is just sitting idle and the session times out
on the server, the browser is automatically redirected to the login
page?  If so, see JavaScript and timers (all JavaScript caveats apply).
But Tomcat itself cannot reach out and trigger events at the client.

Also, they will not be redirected to the login page if they are not
already at a page that requires authentication. You can't directly
redirect to the login page. So the JavaScript script would need to
redirect to a protected page when the timer pops (could be the page
they're on, could be something else).


 I am working with tomcat 7.0.20 and JDBCRealm for authentication.
 
 Thanks in advance.
 



-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: control of session timed out with tomcat

2011-10-20 Thread Hassan Schroeder
On Thu, Oct 20, 2011 at 6:51 AM, Alejandro Soto smalejan...@gmail.com wrote:
 Hi my friends, I want to ask you all, If there is a way to control the timed
 out of sessions with tomcat, what I need is when the session timed out,
 automatically the user is redirected to the login page, Is this possible to
 do that from tomcat?, I mean, tomcat triggers some event to the user with
 session timed out, with no need user interaction.

No. That's not how the web works :-)

What you *can* do is put a meta-refresh tag in the head of each page
(with the time set the same as your session timeout) that redirects to a
protected resource, which will bring up the login page.

HTH,
-- 
Hassan Schroeder  hassan.schroe...@gmail.com
http://about.me/hassanschroeder
twitter: @hassan

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: control of session timed out with tomcat

2011-10-20 Thread Tim Watts
On Thu, 2011-10-20 at 10:06 -0400, Tim Watts wrote:
 On Thu, 2011-10-20 at 09:51 -0400, Alejandro Soto wrote:
  Hi my friends, I want to ask you all, If there is a way to control the timed
  out of sessions with tomcat, what I need is when the session timed out,
  automatically the user is redirected to the login page, Is this possible to
  do that from tomcat?, I mean, tomcat triggers some event to the user with
  session timed out, with no need user interaction.
  
  I know that the time of inactivity of the session is setup in web.xml, with
  that I have no problem, what I need is just redirect to a login page when
  the session timed out.
  
 
 You mean when a browser is just sitting idle and the session times out
 on the server, the browser is automatically redirected to the login
 page?  If so, see JavaScript and timers (all JavaScript caveats apply).
 But Tomcat itself cannot reach out and trigger events at the client.
 
 Also, they will not be redirected to the login page if they are not
 already at a page that requires authentication. You can't directly
 redirect to the login page. So the JavaScript script would need to
 redirect to a protected page when the timer pops (could be the page
 they're on, could be something else).
 

I should also point out that this approach is somewhat kludgey because
of the inherent latency problems when the session is close to
expiration.  But I don't know of a rock solid approach. You just have to
have the timer pop sufficiently sooner than the session expiration --
for some value of sufficient.


 
  I am working with tomcat 7.0.20 and JDBCRealm for authentication.
  
  Thanks in advance.
  
 



-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: control of session timed out with tomcat

2011-10-20 Thread Tim Watts
On Thu, 2011-10-20 at 07:08 -0700, Hassan Schroeder wrote:
 On Thu, Oct 20, 2011 at 6:51 AM, Alejandro Soto smalejan...@gmail.com wrote:
  Hi my friends, I want to ask you all, If there is a way to control the timed
  out of sessions with tomcat, what I need is when the session timed out,
  automatically the user is redirected to the login page, Is this possible to
  do that from tomcat?, I mean, tomcat triggers some event to the user with
  session timed out, with no need user interaction.
 
 No. That's not how the web works :-)
 
 What you *can* do is put a meta-refresh tag in the head of each page
 (with the time set the same as your session timeout) that redirects to a
 protected resource, which will bring up the login page.
 
 HTH,

oh. yes, meta-refresh would be better than a timer.



-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: control of session timed out with tomcat

2011-10-20 Thread Alejandro Soto
Hi, thanks for your replies, These are the only ways I have to do it?, I was
reading something about filters, but I think only works with user
interaction.

Thanks.

On Thu, Oct 20, 2011 at 10:08 AM, Hassan Schroeder 
hassan.schroe...@gmail.com wrote:

 On Thu, Oct 20, 2011 at 6:51 AM, Alejandro Soto smalejan...@gmail.com
 wrote:
  Hi my friends, I want to ask you all, If there is a way to control the
 timed
  out of sessions with tomcat, what I need is when the session timed out,
  automatically the user is redirected to the login page, Is this possible
 to
  do that from tomcat?, I mean, tomcat triggers some event to the user with
  session timed out, with no need user interaction.

 No. That's not how the web works :-)

 What you *can* do is put a meta-refresh tag in the head of each page
 (with the time set the same as your session timeout) that redirects to a
 protected resource, which will bring up the login page.

 HTH,
 --
 Hassan Schroeder  hassan.schroe...@gmail.com
 http://about.me/hassanschroeder
 twitter: @hassan

 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org




-- 
Alejandro Soto M.
Cel: 705-63861


Re: control of session timed out with tomcat

2011-10-20 Thread Tim Watts
On Thu, 2011-10-20 at 10:23 -0400, Alejandro Soto wrote:
 Hi, thanks for your replies, These are the only ways I have to do it?, I was
 reading something about filters, but I think only works with user
 interaction.
 

Basically, that's all. Filters are only active during the
request-response cycle. Once the response is sent, it's done. Strictly
speaking, you could do some kind of ajax thing but that's far into
crazy-land -- just a bad variation on what's already been suggested.


 Thanks.
 
 On Thu, Oct 20, 2011 at 10:08 AM, Hassan Schroeder 
 hassan.schroe...@gmail.com wrote:
 
  On Thu, Oct 20, 2011 at 6:51 AM, Alejandro Soto smalejan...@gmail.com
  wrote:
   Hi my friends, I want to ask you all, If there is a way to control the
  timed
   out of sessions with tomcat, what I need is when the session timed out,
   automatically the user is redirected to the login page, Is this possible
  to
   do that from tomcat?, I mean, tomcat triggers some event to the user with
   session timed out, with no need user interaction.
 
  No. That's not how the web works :-)
 
  What you *can* do is put a meta-refresh tag in the head of each page
  (with the time set the same as your session timeout) that redirects to a
  protected resource, which will bring up the login page.
 
  HTH,
  --
  Hassan Schroeder  hassan.schroe...@gmail.com
  http://about.me/hassanschroeder
  twitter: @hassan
 
  -
  To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
  For additional commands, e-mail: users-h...@tomcat.apache.org
 
 
 
 



-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: control of session timed out with tomcat

2011-10-20 Thread André Warnier

Alejandro Soto wrote:

Hi, thanks for your replies, These are the only ways I have to do it?, I was
reading something about filters, but I think only works with user
interaction.



The basic issues are these :

1) Tomcat (probably) doesn't spend its time all the time scanning stored sessions to see 
if one has expired, and deleting it.
What it does is : when a new request comes in, and that new request has a session-id in 
it, then Tomcat looks for this stored session.  If it finds it, it checks if it has 
expired, and if so, it deletes it and does as if the session had not been there in the 
first place.


2) even assuming that Tomcat would find out, without user interaction, that a session has 
expired, and wanted to send something somewhere, where would it send it ?

It is not certain that the browser of that user still has a connection open 
with the server.
And even if there was such a connection open, and Tomcat sent something on it, the browser 
isn't waiting for anything, since it has not requested anything.  I wouldn't be surprised 
if the browser got very confused then.



That's why you always need the browser to send something, to have Tomcat react and search 
for the session, and send an answer.


Personally, I think that by trying to do this (in whatever way), you set yourself up for 
all kinds of bizarre happenings and side-effects.

What is the problem you are trying to solve ?

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: control of session timed out with tomcat

2011-10-20 Thread Hassan Schroeder
On Thu, Oct 20, 2011 at 7:52 AM, André Warnier a...@ice-sa.com wrote:

 1) Tomcat (probably) doesn't spend its time all the time scanning stored
 sessions to see if one has expired, and deleting it.

Actually, it does. That's what session listeners depend on.

So, for example, I can have a ShoppingCart with a method like

public void valueUnbound(HttpSessionBindingEvent httpsessionbindingevent)
{
 empty(); /* remove reserved status from items */
}

If the session times out without the cart contents being purchased,
the cart returns any items it contains to inventory. Very handy :-)

FWIW,
-- 
Hassan Schroeder  hassan.schroe...@gmail.com
http://about.me/hassanschroeder
twitter: @hassan

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: [OT?] control of session timed out with tomcat

2011-10-20 Thread André Warnier

Hassan Schroeder wrote:

On Thu, Oct 20, 2011 at 7:52 AM, André Warnier a...@ice-sa.com wrote:


1) Tomcat (probably) doesn't spend its time all the time scanning stored
sessions to see if one has expired, and deleting it.


Actually, it does. That's what session listeners depend on.

So, for example, I can have a ShoppingCart with a method like

public void valueUnbound(HttpSessionBindingEvent httpsessionbindingevent)
{
 empty(); /* remove reserved status from items */
}

If the session times out without the cart contents being purchased,
the cart returns any items it contains to inventory. Very handy :-)

You mean that if there are 500 sessions active, Tomcat spends its time checking all of 
them repeatedly on the off-chance that one has expired ?

Or is there a smarter algorithm implemented there ?


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: [OT?] control of session timed out with tomcat

2011-10-20 Thread Mark Thomas
On 20/10/2011 16:22, André Warnier wrote:
 Hassan Schroeder wrote:
 On Thu, Oct 20, 2011 at 7:52 AM, André Warnier a...@ice-sa.com wrote:

 1) Tomcat (probably) doesn't spend its time all the time scanning stored
 sessions to see if one has expired, and deleting it.

 Actually, it does. That's what session listeners depend on.

 So, for example, I can have a ShoppingCart with a method like

 public void valueUnbound(HttpSessionBindingEvent httpsessionbindingevent)
 {
  empty(); /* remove reserved status from items */
 }

 If the session times out without the cart contents being purchased,
 the cart returns any items it contains to inventory. Very handy :-)

 You mean that if there are 500 sessions active, Tomcat spends its time
 checking all of them repeatedly on the off-chance that one has expired ?

It is handled by the background processing thread. By default that
thread runs every 10 seconds and ManagerBase triggers a session
expiration check every 6 runs by default. So in short, they are checked
roughly every 60s. The test is pretty simple so it doesn't take very
long at all.

 Or is there a smarter algorithm implemented there ?

Such as? I'm open to ideas here (maybe not for this exact problem but
certainly the general one).

Mark

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: control of session timed out with tomcat

2011-10-20 Thread Alejandro Soto
Thanks for the clarification.

Well, my system is like a ERP, what I want to do is basically: the user for
work with the system, first must to be authenticated, then the user can
works normally, then, if his session timed out, he need to relogin, that is
the reason because I need to control the sessions, but what the user was
doing before relogin, must be on hold, if the authentication is successful,
then the request of the user is committed.

Any advice will be welcome.

Thanks.

On Thu, Oct 20, 2011 at 10:52 AM, André Warnier a...@ice-sa.com wrote:

 Alejandro Soto wrote:

 Hi, thanks for your replies, These are the only ways I have to do it?, I
 was
 reading something about filters, but I think only works with user
 interaction.


 The basic issues are these :

 1) Tomcat (probably) doesn't spend its time all the time scanning stored
 sessions to see if one has expired, and deleting it.
 What it does is : when a new request comes in, and that new request has a
 session-id in it, then Tomcat looks for this stored session.  If it finds
 it, it checks if it has expired, and if so, it deletes it and does as if the
 session had not been there in the first place.

 2) even assuming that Tomcat would find out, without user interaction, that
 a session has expired, and wanted to send something somewhere, where would
 it send it ?
 It is not certain that the browser of that user still has a connection open
 with the server.
 And even if there was such a connection open, and Tomcat sent something on
 it, the browser isn't waiting for anything, since it has not requested
 anything.  I wouldn't be surprised if the browser got very confused then.


 That's why you always need the browser to send something, to have Tomcat
 react and search for the session, and send an answer.

 Personally, I think that by trying to do this (in whatever way), you set
 yourself up for all kinds of bizarre happenings and side-effects.
 What is the problem you are trying to solve ?


 --**--**-
 To unsubscribe, e-mail: 
 users-unsubscribe@tomcat.**apache.orgusers-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org




-- 
Alejandro Soto M.
Cel: 705-63861


Re: Reuse mod ajp proxy connections

2011-10-20 Thread Dimitar Georgievski
On Wed, Oct 19, 2011 at 10:27 AM, Christopher Schultz 
ch...@christopherschultz.net wrote:

 -BEGIN PGP SIGNED MESSAGE-
 Hash: SHA1

 Dimitar,

 On 10/18/2011 10:50 PM, Dimitar Georgievski wrote:
  SetEnv force-proxy-request-1.0 1 SetEnv proxy-nokeepalive 1
  This setting should control the mod_http_proxy connections. I
  forgot to mention this Apache server does that.


My reading suggests that it controls mod_proxy, which should be the
 same for all mod_proxy_*. The documentation for mod_proxy_ajp is
 woefully slim. Sure, you can learn all about the AJP protocol, just
 not how to configure the proxy in httpd.conf :(

 We have started series of tests to determine the effect of the following
changes;

   1. Upgrade Apache to 2.2.21 (the latest)
   2. Upgrade Tomcat to 5.5.34 (the latest in the 5.x series)
   3. Remove *SetEnv force-proxy-request-1.0 1 SetEnv proxy-nokeepalive 1*

 It will take a while to complete these tests whch has to do with our test
methodologies, which could be summarized as make one change and repeat the
baseline test at least twice.

 I'll definitely take out these settings, because the http proxy
  connections should also be persistent.

 Okay. Did it work? Seems like a simple test to make.

  Regarding the upgrade of the Tomcat server we might not be able to
  do that. The application hosted by Tomcat has dependency on the
  Tomcat 5.5.x version which limits our options. I'll need to
  determine yet which version would be compliant with our
  application.

 If you have dependencies on Tomcat code, it's best to replace those
 with standards-compliant code. Maybe we could help with that kind of
 thing.

 As for 5.5 - 6.0 - 7.0 upgrades, I have recent done that exact thing
 and have had no problems whatsoever. Tomcat *should* be
 backward-compatible with previous releases, but there are some gotchas
 to be found when the TC code has become more spec-compliant or more
 cranky about certain bad configurations that it used to allow.

 As with any upgrade, always read the release notes / changelog carefully.


The application that is deployed on Tomcat 5.x is called Sakai (
http://sakaiproject.org/). From what I know it has strict dependencies on
the Tomcat version. We started reviewing the requirements for the migration
to Tomcat 6.x but this will take a while, probably months to complete.





 I am also considering to install Apache Portable Runtime to
  improve connectors performance and determine its effects on the
  persistence of the proxy connections. What do you think?

 If you expect high concurrency, try using the NIO connector(s): they
 should scale better and have the advantage of being all Java, so you
 have less risk of crashing your JVM if something goes wrong (though
 the APR AJP connector /is/ pretty rock-solid).

 This is also in our test plans but this change has to wait on the result of
the servers upgrade tests. Moving to NIO or APR seems a sensible thing to
do.

The Apache server does more than being a reverse proxy for this Tomcat
server and couldn't be removed from the server configuration of this
application.

Thanks

Dimitar


 - -chris
 -BEGIN PGP SIGNATURE-
 Version: GnuPG v1.4.10 (MingW32)
 Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

 iEYEARECAAYFAk6e3kYACgkQ9CaO5/Lv0PDtEgCeJTRF7GujmZefSjofidEDJOf2
 wxUAnj/Sjt4fFXbs3cdCsnqZCQaz5SMl
 =LlVh
 -END PGP SIGNATURE-

 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org




Tomcat 7

2011-10-20 Thread Barrera, Maribel
Hi,

We are currently using Tomcat 4 and would like to upgrade to Tomcat 6 or
7. We would like Tomcat to run as a service and when the service is
started, it should start a servlet. How do I do that ? Any help would be
highly appreciated. Thanks.

 

Maribel W. Barrera

 

From: Barrera, Maribel 
Sent: Wednesday, October 19, 2011 11:15 AM
To: 'users@tomcat.apache.org'
Subject: how to apply fixes for various identified vulnerabilities

 

Hi,

I want to apply the fixes to various identified vulnerabilities. We are
using Tomcat 4.1.24, McAfee has identified several vulnerabilities. When
I went to your http://tomcat.apache.org/security-4.html site, I can see
the cve numbers and the fix, however, when I click the fixes, it let me
download the source code. How do I build these source codes and replace
the classes in the tomcat files that are currently installed in the
system ? 

 

Maribel W. Barrera

Travelport

Mobile: 1-424-477-4362

Email: maribel.barr...@travelport.com

 


If you are not the intended recipient of this e-mail message, please notify the 
sender 
and delete all copies immediately. The sender believes this message and any 
attachments 
were sent free of any virus, worm, Trojan horse, and other forms of malicious 
code. 
This message and its attachments could have been infected during transmission. 
The 
recipient opens any attachments at the recipient's own risk, and in so doing, 
the 
recipient accepts full responsibility for such actions and agrees to take 
protective 
and remedial action relating to any malicious code. Travelport is not liable 
for any 
loss or damage arising from this message or its attachments.




Re: [OT?] control of session timed out with tomcat

2011-10-20 Thread Tim Watts
On Thu, 2011-10-20 at 16:35 +0100, Mark Thomas wrote:
 On 20/10/2011 16:22, André Warnier wrote:
  Hassan Schroeder wrote:
  On Thu, Oct 20, 2011 at 7:52 AM, André Warnier a...@ice-sa.com wrote:
 
  1) Tomcat (probably) doesn't spend its time all the time scanning stored
  sessions to see if one has expired, and deleting it.
 
  Actually, it does. That's what session listeners depend on.
 
  So, for example, I can have a ShoppingCart with a method like
 
  public void valueUnbound(HttpSessionBindingEvent httpsessionbindingevent)
  {
   empty(); /* remove reserved status from items */
  }
 
  If the session times out without the cart contents being purchased,
  the cart returns any items it contains to inventory. Very handy :-)
 
  You mean that if there are 500 sessions active, Tomcat spends its time
  checking all of them repeatedly on the off-chance that one has expired ?
 
 It is handled by the background processing thread. By default that
 thread runs every 10 seconds and ManagerBase triggers a session
 expiration check every 6 runs by default. So in short, they are checked
 roughly every 60s. The test is pretty simple so it doesn't take very
 long at all.
 
  Or is there a smarter algorithm implemented there ?
 
 Such as? I'm open to ideas here (maybe not for this exact problem but
 certainly the general one).
 
Not necessarily claiming better but:
  * find the oldest session
  * go to sleep until it's ready to expire (since you know nothing
interesting will happen before then)
  * wake up and expire sessions that need expiring
  * repeat

Of course, this would require a dedicated thread. If the background
thread handles more tasks than just expiring sessions there's probably
not much gain in doing this approach. Or you could use the 'find oldest
session' value to compute how many work cycles to skip until the next
actual check. Is the complexity worth the savings in CPU cycles? Eh,
probably a wash. Could set a minimum threshold and only use the computed
value if it's greater than the threshold. Incorporate the computation as
part of the session scan.

But you did ask... :-)

 Mark
 
 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org
 



-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Tomcat 7

2011-10-20 Thread David kerber

On 10/20/2011 11:52 AM, Barrera, Maribel wrote:

Hi,

We are currently using Tomcat 4 and would like to upgrade to Tomcat 6 or
7. We would like Tomcat to run as a service and when the service is
started, it should start a servlet. How do I do that ? Any help would be
highly appreciated. Thanks.


Check the installation documentation for how to install it as a service, 
or it can be done at installation time using the install wizard.


Check the docs for the ContextInitialized() method for having things 
execute at start up.







Maribel W. Barrera



From: Barrera, Maribel
Sent: Wednesday, October 19, 2011 11:15 AM
To: 'users@tomcat.apache.org'
Subject: how to apply fixes for various identified vulnerabilities



Hi,

I want to apply the fixes to various identified vulnerabilities. We are
using Tomcat 4.1.24, McAfee has identified several vulnerabilities. When
I went to your http://tomcat.apache.org/security-4.html site, I can see
the cve numbers and the fix, however, when I click the fixes, it let me
download the source code. How do I build these source codes and replace
the classes in the tomcat files that are currently installed in the
system ?



Maribel W. Barrera

Travelport

Mobile: 1-424-477-4362

Email: maribel.barr...@travelport.com




If you are not the intended recipient of this e-mail message, please notify the 
sender
and delete all copies immediately. The sender believes this message and any 
attachments
were sent free of any virus, worm, Trojan horse, and other forms of malicious 
code.
This message and its attachments could have been infected during transmission. 
The
recipient opens any attachments at the recipient's own risk, and in so doing, 
the
recipient accepts full responsibility for such actions and agrees to take 
protective
and remedial action relating to any malicious code. Travelport is not liable 
for any
loss or damage arising from this message or its attachments.







-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: [OT?] control of session timed out with tomcat

2011-10-20 Thread Mark Thomas
On 20/10/2011 17:01, Tim Watts wrote:
 On Thu, 2011-10-20 at 16:35 +0100, Mark Thomas wrote:
 On 20/10/2011 16:22, André Warnier wrote:
 Hassan Schroeder wrote:
 On Thu, Oct 20, 2011 at 7:52 AM, André Warnier a...@ice-sa.com wrote:

 1) Tomcat (probably) doesn't spend its time all the time scanning stored
 sessions to see if one has expired, and deleting it.

 Actually, it does. That's what session listeners depend on.

 So, for example, I can have a ShoppingCart with a method like

 public void valueUnbound(HttpSessionBindingEvent httpsessionbindingevent)
 {
  empty(); /* remove reserved status from items */
 }

 If the session times out without the cart contents being purchased,
 the cart returns any items it contains to inventory. Very handy :-)

 You mean that if there are 500 sessions active, Tomcat spends its time
 checking all of them repeatedly on the off-chance that one has expired ?

 It is handled by the background processing thread. By default that
 thread runs every 10 seconds and ManagerBase triggers a session
 expiration check every 6 runs by default. So in short, they are checked
 roughly every 60s. The test is pretty simple so it doesn't take very
 long at all.

 Or is there a smarter algorithm implemented there ?

 Such as? I'm open to ideas here (maybe not for this exact problem but
 certainly the general one).

 Not necessarily claiming better but:
   * find the oldest session

This can change dynamically since application code can change the
session expiration time at any point.

   * go to sleep until it's ready to expire (since you know nothing
 interesting will happen before then)
   * wake up and expire sessions that need expiring
   * repeat

 Of course, this would require a dedicated thread. If the background
 thread handles more tasks than just expiring sessions there's probably
 not much gain in doing this approach. Or you could use the 'find oldest
 session' value to compute how many work cycles to skip until the next
 actual check. Is the complexity worth the savings in CPU cycles? Eh,
 probably a wash. Could set a minimum threshold and only use the computed
 value if it's greater than the threshold. Incorporate the computation as
 part of the session scan.
 
 But you did ask... :-)

If session expiration time was constant, this would be fine.
Unfortunately, that is not the case.

Mark

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: control of session timed out with tomcat

2011-10-20 Thread Hassan Schroeder
On Thu, Oct 20, 2011 at 8:35 AM, Alejandro Soto smalejan...@gmail.com wrote:

 Well, my system is like a ERP, what I want to do is basically: the user for
 work with the system, first must to be authenticated, then the user can
 works normally, then, if his session timed out, he need to relogin, that is
 the reason because I need to control the sessions, but what the user was
 doing before relogin, must be on hold, if the authentication is successful,
 then the request of the user is committed.

I think you would need to be a lot more precise about requirements,
like what you mean by what the user was doing before relogin.

But generally, if you have some kind of transaction-in-progress when
the session times out -- what's the question? You'll have to save the
transaction state somewhere and re-associate it with the user's new
session after s/he logs in again.

The details could vary wildly according to your specific requirements :-)

FWIW,
-- 
Hassan Schroeder  hassan.schroe...@gmail.com
http://about.me/hassanschroeder
twitter: @hassan

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



FarmWarDeployer undeploy on slave node when tomcat restart

2011-10-20 Thread Marco Betti
Hi all,
I'm new to the list.
I'm trying to configure tomcat 6.0.33 clustering.
Session replication is ok.
I've a problem with FarmWarDeployer.
I found that:

1. You have to place the Cluster node under the Host element.

Tomcat 6.0.x complains that the element Cluster/Deployer element is not
understood at the Engine level.

2. One node needs to have watchEnabled=true, all other nodes
watchEnabled=false

3. deployDir is the same as appBase


and after I found this post that confirmed these points to me:

http://www.mail-archive.com/users@tomcat.apache.org/msg80374.html

The problem is the following:
let node1 be the master (watchEnabled=true) and node2 the slave
(watchEnabled=false)
This is my configuration:
Deployer className=org.apache.catalina.ha.deploy.FarmWarDeployer

tempDir=/appserv/tomcat/tomcat60/apache-tomcat-6.0.33/server/clu001node01/temp/

deployDir=/appserv/tomcat/tomcat60/apache-tomcat-6.0.33/server/clu001node01/webapps/

watchDir=/appserv/tomcat/tomcat60/apache-tomcat-6.0.33/server/clu001node01/farm/
watchEnabled=true/


If I copy a war to watchDir of node1 evertything works fine and cluster
deploy is achieved.

When i restart node1, FarmWarDeployer undeploy my war both from node1 and
node2, but re-deploy it only on node1.

node1 log:

INFO: Cluster wide remove of web app /example
Oct 20, 2011 5:50:46 PM org.apache.catalina.startup.HostConfig
checkResources
INFO: Undeploying context [/example]
Oct 20, 2011 5:50:46 PM org.apache.catalina.startup.HostConfig deployWAR
INFO: Deploying web application archive example.war


node2 log:

INFO: Undeploying context [/example]
Oct 20, 2011 5:50:47 PM org.apache.catalina.ha.deploy.FarmWarDeployer
messageReceived
SEVERE: Application /example in used. touch war file example.war again!


Obviously, if I touch my war in my watchDir on node1, tomcat redeploys it
correctly on both nodes... but this cannot be the solution...


Is it a known problem?

Could anyone help me?

Many thanks,
Marco


JAR locked in Tomcat after using addUrl to dynamically add JAR to running webapp

2011-10-20 Thread Bob DeRemer
Hi Tomcat Community:

BACKGROUND:
I have a Servlet-based WEBAPP that is running in Tomcat7, JDK 1.6.0_27 on 
Windows Server 2008 R2 64-bit - all 64-bit.  We make use of class.newInstance 
quite a bit as we have a fairly modular, interface-based system, and create 
class instances on the fly.  As part of our extensibility,  I'm also using a 
pretty well documented hack [The code is listed below]  for dynamically 
adding JAR(s) so they are accessible immediately without stopping our WEBAPP or 
the actual Tomcat server process.   This process has worked great for both 
JAR(s) in the WEB-INF/lib and for ones we dynamically added - until you try and 
stop the WEBAPP via the Tomcat manager app.

PROBLEM:
This solution for dynamically loading JARs worked great as long as we 
start/stop the actual Tomcat server process, but I found out the JAR(s) that I 
have been dynamically loading this way are not released when you stop the 
WEBAPP.  I am using SysInternals Process Explorer to monitor the open file 
handles of the Tomcat7 process.  I can see that when I stop the WEBAPP, the 
dynamically loaded JAR is still referenced.

QUESTION:
I made an assumption that calling 
Thread.currentThread().getContextClassLoader() would provide me the classloader 
of my WEBAPP - which should be the same classloader that all the JARs in the 
WEB-INF/lib are in.  We control the WEBAPP, so I assumed this was a safe 
assumption.

The usage of the dynamically loaded JAR(s) is no different than the default 
JAR(s) in WEB-INF/lib.  None of the WEB-INF/lib JARs are left open when we stop 
the WEBAPP - only the JAR(s) that are loaded via the addUrl approach below.

I have been through a number of online articles when I first created this logic 
- including a PDF by Ted Neward [while at Developmentor] that described these 
approaches, but am not sure how to troubleshoot this further now.

If anyone has an answer or any suggestions, I would greatly appreciate it.

Thanks in advance,
Bob


Code to dynamically load JAR(s):

public static void loadJarOnTheFly(File jarFile) throws IOException
{
  Class?[] parameters = new Class[]{URL.class};

  // IMPORTANT: MUST use the webapp classloader - so derived extension 
classes can resolve their base classes
  ClassLoader contextClassLoader = 
Thread.currentThread().getContextClassLoader();

  // cast to a URL class loader so we can additional JAR(s) to the search 
path
URLClassLoader webappClassLoader = (URLClassLoader)contextClassLoader;

Class? sysclass = URLClassLoader.class;

try
{
URL jarUrl = jarFile.toURI().toURL();

Method method = sysclass.getDeclaredMethod(addURL, parameters);
method.setAccessible(true);
method.invoke(webappClassLoader, new Object[]{ jarUrl });
}
catch (Throwable t)
{
throw new IOException(Error, could not add URL to system 
classloader);
}
}



Bob DeRemer
Senior Director, Architecture and Development

http://www.thingworx.comhttp://www.thingworx.com/
Skype: bob.deremer
O: 717.505.7923
M: 717.881.3986



ODBC jar files

2011-10-20 Thread Propes, Barry L

Question. Will it hurt to have two different odbc jar files in the lib folder?

I've been connecting to a production server on Oracle10g for some time, and 
have had my context.xml file in the META-INF directory of one web app 
configured to hit this Oracle server.

Our group just got a new development server on Oracle11g, and while I can 
connect to it via Toad or SQL Plus (thereby assuring the tnsnames file is 
properly configured) I cannot connect at all from the web app in Tomcat.

I've been using the drivers in the ojdbc14_g.jar file for some time but I think 
I may need ojdbc6.jar for the new Oracle server. I wasn't sure if these two 
would conflict or not.

FWIW, I'm using:
Tomcat Version 6.0.26
JDK 1.6.0_18
Win XP is my OS for the test machine.

The above mentioned .jar files. I just added the second one, ojdbc6.jar, then 
deleted the work folder contents and restarted the web app.

My context.xml file is configured in the following manner:

--
Context
  Resource
auth=Container
description=changectrlappdev
name=jdbc/myoracledev
type=javax.sql.DataSource
driverClassName=oracle.jdbc.driver.OracleDriver
username=usernm
password=password
url=jdbc:oracle:thin:@croesm6734:2504:LANDMVJ
maxIdle=30
maxWait=1
maxActive=10
testOnBorrow=true
timeBetweenEvictionRunsMillis=-1
minEvictableIdleTimeMillis=28800
poolPreparedStatements=true
removeAbandoned=true
removeAbandonedTimeout=300
logAbandoned=false/


Realm className=org.apache.catalina.realm.DataSourceRealm
localDataSource=true
   dataSourceName=jdbc/myoracledev
   userTable=users userNameCol=user_name userCredCol=user_pass
   userRoleTable=user_roles roleNameCol=role_name/!--using --

/Context

I've also tried the following:
--
Context
  Resource
auth=Container
description=changectrlappdev
name=jdbc/myoracledev
type=javax.sql.DataSource
driverClassName=oracle.jdbc.driver.OracleDriver
username=usernm
password=password
url=jdbc:oracle:thin:@(DESCRIPTION = (ADDRESS_LIST =
(ADDRESS = (PROTOCOL = IPC )(KEY = LANDMVJ))
(ADDRESS = (PROTOCOL = TCP )(HOST = croesm6734.specserver.net)(PORT = 
2504)))
   (CONNECT_DATA =  (SID = OPSDEV)  (SERVICE_NAME = LANDMVJ)
maxIdle=30
maxWait=1
maxActive=10
testOnBorrow=true
timeBetweenEvictionRunsMillis=-1
minEvictableIdleTimeMillis=28800
poolPreparedStatements=true
removeAbandoned=true
removeAbandonedTimeout=300
logAbandoned=false/

Realm className=org.apache.catalina.realm.DataSourceRealm
localDataSource=true
   dataSourceName=jdbc/myoracledev
   userTable=users userNameCol=user_name userCredCol=user_pass
   userRoleTable=user_roles roleNameCol=role_name/

/Context
--
with the same error message getting logged.

SEVERE: Servlet.service() for servlet jsp threw exception
java.sql.SQLException: Io exception: Connection 
refused(DESCRIPTION=(TMP=)(VSNNUM=185599744)(ERR=12505)(ERROR_STACK=(ERROR=(CODE=12505)(EMFI=4
at oracle.jdbc.dbaccess.DBError.throwSqlException(DBError.java:134)
at oracle.jdbc.dbaccess.DBError.throwSqlException(DBError.java:179)
at oracle.jdbc.dbaccess.DBError.throwSqlException(DBError.java:334)


I feel this is mostly a driver error, but related to Tomcat in terms of the way 
the jar files are housed in the lib directory and perhaps if one set of driver 
classes takes precedent over another?

I really wasn't sure if those two jar files would conflict and cause issues.

If anyone can enlighten me on this it would be appreciated!

Thanks,

Barry

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: ODBC jar files

2011-10-20 Thread Caldarale, Charles R
 From: Propes, Barry L [mailto:barry.l.pro...@citi.com] 
 Subject: ODBC jar files

 Will it hurt to have two different odbc jar files in the 
 lib folder?

Which lib folder are you referring to?  Tomcat's lib folder, or WEB-INF/lib of 
the webapp?

If any class names are common to both jars, you *will* run into trouble.

 - Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY 
MATERIAL and is thus for use only by the intended recipient. If you received 
this in error, please contact the sender and delete the e-mail and its 
attachments from all computers.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Tomcat produces empty/missing log files

2011-10-20 Thread Brian Jones
-  Environment: Windows 7 Professional, SP1 64-bit, Tomcat 5.5.33

-  Logging level set to INFO

-  CATALINA_OPTS: -Dsun.lang.ClassLoader.allowArraySyntax=true

-  No JAVA_OPTS environment variable

-  JAVA_HOME points to JDK 1.6.0_26

-  NOT installed as a Windows service. Tomcat starts/runs/stops fine
using startup.bat and shutdown.bat

-  Applications deploy properly, can be accessed and used properly

-  Tomcat admin console can be accessed and used properly

-  The problem is that the log files are always empty (0kb)

-  The following log files are produced by Tomcat, but are always
empty:

o   admin.date.log

o   catalina.date.log

o   host-manager.date.log

o   localhost.date.log

o   manager.date.log

-  The following log files are NOT produced by Tomcat (missing)

o   stdout.log

o   stderr.log

o   catalina.out

-  I’ve tried several workarounds to produce the log files properly,
all without success

o   Tried running the .bat file from the command line directly piping output
to a local .txt file; all that gets piped to the .txt file is the java
environment variables that are being used

o   Modified catalina.bat to pipe %EXECJAVA% … %ACTION% commands to log file
(didn’t work, nothing in the log file)

o   Followed instructions at
http://tomcat.apache.org/tomcat-5.5-doc/logging.html to set up logging

§  Tried log4j; log files didn’t contain exception messages

§  Tried commons logging; no change (log files still empty)

o   Followed the only previous mail-list item that seemed similar to my
situation: http://www.mail-archive.com/users@tomcat.apache.org/msg74244.html

§  Followed all responses; same result; this thread doesn’t seem to be
solved

§  (I do not receive VM instantiation errors like the user in that thread
does)

-  I can’t upgrade to a newer version of Tomcat because 5.5.33 is
the only version supported by the project I’m working on

 

Contents of logging.properties file (located in BOTH /common/classes/ and
/conf/ folders):

 

# Licensed to the Apache Software Foundation (ASF) under one or more

# contributor license agreements.  See the NOTICE file distributed with

# this work for additional information regarding copyright ownership.

# The ASF licenses this file to You under the Apache License, Version 2.0

# (the License); you may not use this file except in compliance with

# the License.  You may obtain a copy of the License at

#

# http://www.apache.org/licenses/LICENSE-2.0

#

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an AS IS BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

 

handlers = 1catalina.org.apache.juli.FileHandler,
2localhost.org.apache.juli.FileHandler,
3manager.org.apache.juli.FileHandler, 4admin.org.apache.juli.FileHandler,
5host-manager.org.apache.juli.FileHandler, java.util.logging.ConsoleHandler

 

.handlers = 1catalina.org.apache.juli.FileHandler,
java.util.logging.ConsoleHandler

 



# Handler specific properties.

# Describes specific configuration info for Handlers.



 

1catalina.org.apache.juli.FileHandler.level = FINE

1catalina.org.apache.juli.FileHandler.directory = ${catalina.base}/logs

1catalina.org.apache.juli.FileHandler.prefix = catalina.

 

2localhost.org.apache.juli.FileHandler.level = FINE

2localhost.org.apache.juli.FileHandler.directory = ${catalina.base}/logs

2localhost.org.apache.juli.FileHandler.prefix = localhost.

 

3manager.org.apache.juli.FileHandler.level = FINE

3manager.org.apache.juli.FileHandler.directory = ${catalina.base}/logs

3manager.org.apache.juli.FileHandler.prefix = manager.

 

4admin.org.apache.juli.FileHandler.level = FINE

4admin.org.apache.juli.FileHandler.directory = ${catalina.base}/logs

4admin.org.apache.juli.FileHandler.prefix = admin.

 

5host-manager.org.apache.juli.FileHandler.level = FINE

5host-manager.org.apache.juli.FileHandler.directory = ${catalina.base}/logs

5host-manager.org.apache.juli.FileHandler.prefix = host-manager.

 

java.util.logging.ConsoleHandler.level = FINE

java.util.logging.ConsoleHandler.formatter =
java.util.logging.SimpleFormatter

 

 



# Facility specific properties.

# Provides extra control for each logger.



 

org.apache.catalina.core.ContainerBase.[Catalina].[localhost].level = INFO

org.apache.catalina.core.ContainerBase.[Catalina].[localhost].handlers =
2localhost.org.apache.juli.FileHandler

 

org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].lev
el = INFO


RE: ODBC jar files

2011-10-20 Thread Propes, Barry L
Sorry for any confusion there - I meant tomcat/lib, not WEB-INF/lib.

Ok, I imagine that is a problem  then. I haven't perused both jars, but I 
imagine there's some redundancy in there!

Thanks.

-Original Message-
From: Caldarale, Charles R [mailto:chuck.caldar...@unisys.com]
Sent: Thursday, October 20, 2011 12:46 PM
To: Tomcat Users List
Subject: RE: ODBC jar files

 From: Propes, Barry L [mailto:barry.l.pro...@citi.com]
 Subject: ODBC jar files

 Will it hurt to have two different odbc jar files in the lib folder?

Which lib folder are you referring to?  Tomcat's lib folder, or WEB-INF/lib of 
the webapp?

If any class names are common to both jars, you *will* run into trouble.

 - Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY 
MATERIAL and is thus for use only by the intended recipient. If you received 
this in error, please contact the sender and delete the e-mail and its 
attachments from all computers.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: ODBC jar files

2011-10-20 Thread Ashish Kulkarni
If there are common classes it will be very hard to tell which one will be
loaded by class loader

check this document,
http://tomcat.apache.org/tomcat-6.0-doc/class-loader-howto.html



On Thu, Oct 20, 2011 at 3:00 PM, Propes, Barry L barry.l.pro...@citi.comwrote:

 Sorry for any confusion there - I meant tomcat/lib, not WEB-INF/lib.

 Ok, I imagine that is a problem  then. I haven't perused both jars, but I
 imagine there's some redundancy in there!

 Thanks.

 -Original Message-
 From: Caldarale, Charles R [mailto:chuck.caldar...@unisys.com]
 Sent: Thursday, October 20, 2011 12:46 PM
 To: Tomcat Users List
 Subject: RE: ODBC jar files

  From: Propes, Barry L [mailto:barry.l.pro...@citi.com]
  Subject: ODBC jar files

  Will it hurt to have two different odbc jar files in the lib folder?

 Which lib folder are you referring to?  Tomcat's lib folder, or WEB-INF/lib
 of the webapp?

 If any class names are common to both jars, you *will* run into trouble.

  - Chuck


 THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
 MATERIAL and is thus for use only by the intended recipient. If you received
 this in error, please contact the sender and delete the e-mail and its
 attachments from all computers.


 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org


 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org




-- 
Ashish
www.ayurwellness.com
www.mysoftwareneeds.com


Re: Error starting Tomcat

2011-10-20 Thread ramsri

Konstantin:

I am very glad that I found this thread. For a week I have been struggling
with this problem. 

I have Tomcat7 running. My application which was running just fine under
Tomcat5 does not run under Tomcat7. I have created setupclasspath.sh with
all the necessary JARs. My Tomcat starts fine and I see the opening page.
Even my Axis comes up ok but not my application. 

I start Tomcat with ./startup.sh and I do not use Eclipse. The message that
I get is 

***
Oct 20, 2011 3:04:03 PM org.apache.catalina.core.ContainerBase
addChildInternal
SEVERE: ContainerBase.addChild: start:
org.apache.catalina.LifecycleException: Failed to start component
[StandardEngine[Catalina].StandardHost[localhost].StandardContext[/mywebapp]]
at
org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:152)
at
org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:812)
at
org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:787)
at
org.apache.catalina.core.StandardHost.addChild(StandardHost.java:607)
at
org.apache.catalina.startup.HostConfig.deployDirectory(HostConfig.java:1055)
at
org.apache.catalina.startup.HostConfig.deployDirectories(HostConfig.java:978)
at
org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:472)
at
org.apache.catalina.startup.HostConfig.start(HostConfig.java:1329)
at
org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:311)
at
org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:119)

***

I tried reading this thread but I cannot understand what exactly I should do
in my setup. I see only one 

/opt/tomcat7/lib/servlet-api.jar and this file is inside my CLASSPATH. 

Your help is greatly appreciated. Thank you.
-- 
View this message in context: 
http://old.nabble.com/Error-starting-Tomcat-tp32338111p32691794.html
Sent from the Tomcat - User mailing list archive at Nabble.com.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: Error starting Tomcat

2011-10-20 Thread Chad.Davis


 I have Tomcat7 running. My application which was running just fine under
 Tomcat5 does not run under Tomcat7. I have created setupclasspath.sh with
 all the necessary JARs. My Tomcat starts fine and I see the opening page.
 Even my Axis comes up ok but not my application.
 
 I start Tomcat with ./startup.sh and I do not use Eclipse. The message that I
 get is
 
 ***
 Oct 20, 2011 3:04:03 PM org.apache.catalina.core.ContainerBase
 addChildInternal
 SEVERE: ContainerBase.addChild: start:
 org.apache.catalina.LifecycleException: Failed to start component

Sounds like there may have been some configuration changes to the various xml 
files that pertain to your app, between versions 5 and 7 I mean.  Did you 
change any of the server.xml, and friends, when migrating?


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Tomcat produces empty/missing log files

2011-10-20 Thread Konstantin Kolinko
2011/10/20 Brian Jones bjone...@uwo.ca:
 -          Environment: Windows 7 Professional, SP1 64-bit, Tomcat 5.5.33

 -          Logging level set to INFO

 -          CATALINA_OPTS: -Dsun.lang.ClassLoader.allowArraySyntax=true

 -          No JAVA_OPTS environment variable

 -          JAVA_HOME points to JDK 1.6.0_26

 -          NOT installed as a Windows service. Tomcat starts/runs/stops fine
 using startup.bat and shutdown.bat

 -          Applications deploy properly, can be accessed and used properly

 -          Tomcat admin console can be accessed and used properly

 -          The problem is that the log files are always empty (0kb)

 -          The following log files are produced by Tomcat, but are always
 empty:

 o   admin.date.log

 o   catalina.date.log

 o   host-manager.date.log

 o   localhost.date.log

 o   manager.date.log

 -          The following log files are NOT produced by Tomcat (missing)

 o   stdout.log

 o   stderr.log

 o   catalina.out

 -          I’ve tried several workarounds to produce the log files properly,
 all without success

 o   Tried running the .bat file from the command line directly piping output
 to a local .txt file; all that gets piped to the .txt file is the java
 environment variables that are being used

startup.bat is equivalent to calling catalina.bat start

Try using catalina.bat run instead.


 o   Modified catalina.bat to pipe %EXECJAVA% … %ACTION% commands to log file
 (didn’t work, nothing in the log file)

It would be nice to see the actual command line that starts Tomcat's Bootstrap.
The JVM keys that configure java.util.logging should be there.

 o   Followed instructions at
 http://tomcat.apache.org/tomcat-5.5-doc/logging.html to set up logging

Maybe 7.0 docs will be more understandable.


 §  Tried log4j; log files didn’t contain exception messages

Did you restore original configuration after these experiments? Did
you remove log4j.jar?

(...)
 Contents of logging.properties file (located in BOTH /common/classes/ and
 /conf/ folders):

It should be only in conf.

 # Licensed to the Apache Software Foundation (ASF) under one or more
 (...)

Try to simplify your configuration.

Leave only 1catalina.org.apache.juli.FileHandler.

(You may include ConsoleHandler as well if you want to dup all to the
console as well, but omitting it you can catch what goes to console
only and not to the files).

[[[
handlers = 1catalina.org.apache.juli.FileHandler
.handlers = 1catalina.org.apache.juli.FileHandler

1catalina.org.apache.juli.FileHandler.level = FINE
1catalina.org.apache.juli.FileHandler.directory = ${catalina.base}/logs
1catalina.org.apache.juli.FileHandler.prefix = catalina.

.level=INFO
]]]

IIRC If logging fails to start it prints a message to the console.


Best regards,
Konstantin Kolinko

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Use case for adding configurable behavior for unpacking WARs deployed outside the Host's appBase?

2011-10-20 Thread Jason Pringle
We finally tracked down why a 3rd party application we use stopped working as 
of our upgrade to 7.0.14 (and subsequent) - it was the fix applied to 7.0.12 
which stopped unpacking WARs that were deployed from an appBase outside that of 
the container.  It presented itself in an odd way, which is why it took so long 
to track down (vague and unhelpful RMI connection failure from some spawned RMI 
server).

Digging a bit today I found some history on this issue, which seems to be 
summarized in this bugzilla report:

https://issues.apache.org/bugzilla/show_bug.cgi?id=51294

Here's my use case for why I'd like this behavior to be configurable, either at 
the app level or the host level (ie, honor either or both of the unpackWAR 
flags for applications outside of the host's appBase).

We have a standardized deployment mechanism.  We prefer the model where wars 
are put in a standard directory (outside of the server's app base) and then 
referenced by a context file for the instance 
(instance/conf/engine/host/mycontext.xml).  This allows us to manage the 
WAR files outside of the tomcat instance directory and have the war file names 
be something other than the context path for the web app (like a filename with 
version information in it!).

We deploy mostly web applications developed in-house.  These applications don't 
care whether they are exploded or not.

We also deploy a few 3rd party web applications.  One in particular *requires* 
that it be exploded on disk.  The vendor refuses to change the app.

Given the current state of things, we will have to modify our deployment 
approach across the board just to satisfy this one 3rd party application, or 
have a non-homogenous approach to web application deployment and treat this one 
in the special manner.

Neither approach is appealing (3rd party app forcing a particular deployment 
model on our operations or heterogeneous deployment model).

Would it be possible to have the behavior put back at least as an optional 
behavior?

Thanks!

--Jason

This message and the information contained herein is proprietary and 
confidential and subject to the Amdocs policy statement,
you may review at http://www.amdocs.com/email_disclaimer.asp


Re: Reuse mod ajp proxy connections

2011-10-20 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Dimitar,

On 10/20/2011 11:37 AM, Dimitar Georgievski wrote:
 We have started series of tests to determine the effect of the
 following changes;
 
 1. Upgrade Apache to 2.2.21 (the latest) 2. Upgrade Tomcat to
 5.5.34 (the latest in the 5.x series) 3. Remove *SetEnv
 force-proxy-request-1.0 1 SetEnv proxy-nokeepalive 1*
 
 It will take a while to complete these tests whch has to do with
 our test methodologies, which could be summarized as make one
 change and repeat the baseline test at least twice.

I would just go ahead with #3 in a test environment. You should be
able to see in about 5 minutes what's going on.

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk6ghvMACgkQ9CaO5/Lv0PCBAQCeOXpC96cV0ecvknZv9p74NLve
hNIAn2IR1E2C5u+yyfozhyd29lJraWvg
=CdzV
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: control of session timed out with tomcat

2011-10-20 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Tim,

On 10/20/2011 10:15 AM, Tim Watts wrote:
 I should also point out that this approach is somewhat kludgey
 because of the inherent latency problems when the session is close
 to expiration.  But I don't know of a rock solid approach. You just
 have to have the timer pop sufficiently sooner than the session
 expiration -- for some value of sufficient.

Perhaps later? If you make the call too soon, you'll tickle the
session and start the 30-minute (or whatever) clock all over again.

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk6giCMACgkQ9CaO5/Lv0PCDFgCeIhcfq/pC2z8MNjGwmvNPCjBh
qIAAoLq64F23ZnkcY1Lj6L/bqeO22CYp
=HT9l
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: [OT?] control of session timed out with tomcat

2011-10-20 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Mark,

On 10/20/2011 11:35 AM, Mark Thomas wrote:
 On 20/10/2011 16:22, André Warnier wrote:
 Or is there a smarter algorithm implemented there ?
 
 Such as? I'm open to ideas here (maybe not for this exact problem
 but certainly the general one).

I suppose one could use a (inverse?) priority queue where the priority
is the last session touch time. When a session is touched, it's place
in the queue is adjusted. When it's time to cull the sessions, you
linearly process the queue until you hit a session that does not
require expiration, and you're done.

Use of a priority queue might end up being less efficient than the
current implementation, especially when considering the cost of
synchronization for shuffling sessions around in the queue (on every
request!) and then getting an exclusive lock for the session-reaper
which may last a non-trivial amount of time.

I suspect session events are triggered directly by the background
thread, and not delegated to another thread, so a long-running
valueUnbound job could hold-up the entire container.

I didn't say it was a good idea... only that is was AN idea :)

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk6gieQACgkQ9CaO5/Lv0PBQ9ACeMVOxFI7tp5HnJ2QYM5R3X9y+
6kYAnRZM2OUQqtMYrwTStrZLK5fPjJ7/
=LYNt
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: control of session timed out with tomcat

2011-10-20 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Alejandro,

On 10/20/2011 11:35 AM, Alejandro Soto wrote:
 Well, my system is like a ERP, what I want to do is basically: the
 user for work with the system, first must to be authenticated, then
 the user can works normally, then, if his session timed out, he
 need to relogin, that is the reason because I need to control the
 sessions, but what the user was doing before relogin, must be on
 hold, if the authentication is successful, then the request of the
 user is committed.
 
 Any advice will be welcome.

Keep as much information in a form on the page as you can for long,
possibly interruptable workflows. When you submit that form, if the
session is dead, after re-authentication, the form submission will be
replayed and the workflow can continue.

We do this exact thing in pretty much all of our flows: each form
submission has enough information to resume the flow even after a
session expiration.

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk6giqIACgkQ9CaO5/Lv0PChagCePRzdvasTHVV4UEoq1psdWzEG
auwAoJwIGB+WoVvDlZcpCPatIk4RHYxS
=4Y80
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: ODBC jar files

2011-10-20 Thread Propes, Barry L
I had kind of thought that might be the case, but wasn't sure.

I had web app A with a context file in its META-INF directory and  web app B 
with a (different) context file in its META-INF directory.

But just because the jars have different names, I suppose doesn't' even mean 
the package path is different, let alone the class name.

I'll check those very carefully.

Thanks!

-Original Message-
From: Ashish Kulkarni [mailto:ashish.kulkarn...@gmail.com]
Sent: Thursday, October 20, 2011 2:07 PM
To: Tomcat Users List
Subject: Re: ODBC jar files

If there are common classes it will be very hard to tell which one will be 
loaded by class loader

check this document,
http://tomcat.apache.org/tomcat-6.0-doc/class-loader-howto.html



On Thu, Oct 20, 2011 at 3:00 PM, Propes, Barry L barry.l.pro...@citi.comwrote:

 Sorry for any confusion there - I meant tomcat/lib, not WEB-INF/lib.

 Ok, I imagine that is a problem  then. I haven't perused both jars,
 but I imagine there's some redundancy in there!

 Thanks.

 -Original Message-
 From: Caldarale, Charles R [mailto:chuck.caldar...@unisys.com]
 Sent: Thursday, October 20, 2011 12:46 PM
 To: Tomcat Users List
 Subject: RE: ODBC jar files

  From: Propes, Barry L [mailto:barry.l.pro...@citi.com]
  Subject: ODBC jar files

  Will it hurt to have two different odbc jar files in the lib folder?

 Which lib folder are you referring to?  Tomcat's lib folder, or
 WEB-INF/lib of the webapp?

 If any class names are common to both jars, you *will* run into trouble.

  - Chuck


 THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE
 PROPRIETARY MATERIAL and is thus for use only by the intended
 recipient. If you received this in error, please contact the sender
 and delete the e-mail and its attachments from all computers.


 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org


 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org




--
Ashish
www.ayurwellness.com
www.mysoftwareneeds.com

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Fwd: Re: question about inter-webapp communication

2011-10-20 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Garey,
(Thanks for taking this back onto the list).


On 10/19/2011 5:07 PM, Garey Mills wrote:
 Geoserver only has basic authentication on an object by object 
 level. We are deploying it in a unversity that has a Centralized 
 Authentication Server, or CAS. CAS has a implementation that can be
 used in tomcat, and that is realized as a set of filters.

Do you control anything about the implementation of the CAS filters?

 The first problem is that filters have the severe limitation of 
 only allowing one asterisk, making it impossible (as far as I can
 see) to distinguish URLs on the basis of recognizing a pattern in
 the query string.

It's true, filters can only be mapped by relatively simple url-pattern
matching constraints. That doesn't mean the the Filter itself can't be
smart about how it does it's own checks. There is no prohibition on
further processing of the URL to determine how to act. These CAS
filters have to be used in situations where the servlet spec's paltry
url-pattern mapping semantics must be overcome, right? I'm surprised
to hear you say that they are so inflexible.

 So this seems to necessitate recognizing the pattern in code, 
 modifying the URI in some recognizable way (or setting an attribute
 on the request) and redirecting so that it gets intercepted by the
 CAS filter(s).

You can set an attribute on the request and then continue the call
chain (where the CAS filter is later in the chain): there is no need
for a redirect and/or forward to occur.

 This makes it very difficult to work with Geoserver directly. While
  the code is available, this is a massive project.
 
 On the other hand, I got my scheme to work more or less, but there
  are problems. I got it to work by instantiating a
 RequestDispatcher by getNamedDispatcher and finding the servlet
 name (dispatcher) in Geoserver's web.xml. However, I find that
 the content that Geoserver returns embeds a number of URLs that
 point back to itself. I would have to somehow intercept Geoserver's
 return in my fronting webapp and rewrite those URLs.

If this is the strategy you have chosen, then yes, you will have to
act as a proxy/reverse proxy. You're going to have to do that in any
event. And, it's a total pain in the neck. Better to intercept all the
traffic on it's way to Geoserver and do whatever modifications you
need to on the fly, there, than to try to proxy everything and rewrite
links, etc.

 If I bite the bullet and attempt to change Geoserver, there is 
 another difficulty.

If you can customize Geoserver's behavior by inserting your own
filters somewhere in the filter chain (which is trivial of course),
then I would highly recommend that route. Dual webapps where one of
them does authentication and acts as a re-writing reverse proxy sounds
like madness.

 I am attaching Geoserver's web.xml. Here also are the CAS filters
 from my fronting webapp:
 
 filter filter-nameCAS Single Sign Out Filter/filter-name 
 filter-classorg.jasig.cas.client.session.SingleSignOutFilter/filter-class

 
/filter

Hah. I usually see that called SingleSignOn, but I guess if you want
to get out of everything quickly, that will help, too. :)

 A major problem is how to integrate these two. If you can tell me,
  maybe I can attempt to introduce the necessary changes to the
 Geoserver servlet.

I didn't see the web.xml from Geoserver, but merging web.xml files
shouldn't be /too/ hard. If you want to keep Geoserver's webapp
relatively untouched (for easier upgrades, etc.) you could use XSLT to
process their original and add your own stuff (for instance,
installing your own filters at the beginning of the filter chain with
all their filters running afterwards).

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk6gjYUACgkQ9CaO5/Lv0PBjZQCggQWKntrSt/Ko1tgND8tldEnJ
SWMAniNt+FtWZWqG3M+MwybohZ51w3Mr
=a9sS
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: ODBC jar files

2011-10-20 Thread Caldarale, Charles R
 From: Propes, Barry L [mailto:barry.l.pro...@citi.com] 
 Subject: RE: ODBC jar files

 I had web app A with a context file in its META-INF directory and 
 web app B with a (different) context file in its META-INF directory.

That's not related to the classloader being used here.  There's a separate one 
for Tomcat's lib directory, and that's the only one that sees the jars in that 
location.  You can put a JDBC jar in WEB-INF/lib, but then the webapp has to do 
its own DB connection pooling.

- Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY 
MATERIAL and is thus for use only by the intended recipient. If you received 
this in error, please contact the sender and delete the e-mail and its 
attachments from all computers.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: http put not working for larger files

2011-10-20 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Lyudmila,

On 10/18/2011 5:21 PM, Lyudmila L. Balakireva wrote:
 Yes, packages are sent by apache client untill eof,  no socket
 problem reported. And it works for binary and text. And the input
 stream I am getting  from request in tomcat  already truncated  for
 some longer lasting requests.

Sounds like you need to debug your webapp. Can you confirm which part
of the file gets saved when it fails to save the entire thing? First
40KiB?  Last 40KiB? Random sample of bytes?

You should also, of course, be logging the Content-Length or, since
you're using chunked upload, each individual chunk's length.

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk6gkL4ACgkQ9CaO5/Lv0PBnywCgu1uHb+fqRq23bOVnVzrkVKVS
0D8AniJzPXUzQtwqy9WJ6Cwpja+3W6h3
=JlHo
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: JAR locked in Tomcat after using addUrl to dynamically add JAR to running webapp

2011-10-20 Thread Pid
On 20/10/2011 18:18, Bob DeRemer wrote:
 Hi Tomcat Community:
 
 BACKGROUND:
 I have a Servlet-based WEBAPP that is running in Tomcat7, JDK 1.6.0_27 on 
 Windows Server 2008 R2 64-bit - all 64-bit.  We make use of class.newInstance 
 quite a bit as we have a fairly modular, interface-based system, and create 
 class instances on the fly.  As part of our extensibility,  I'm also using a 
 pretty well documented hack [The code is listed below]  for dynamically 
 adding JAR(s) so they are accessible immediately without stopping our WEBAPP 
 or the actual Tomcat server process.   This process has worked great for both 
 JAR(s) in the WEB-INF/lib and for ones we dynamically added - until you try 
 and stop the WEBAPP via the Tomcat manager app.
 
 PROBLEM:
 This solution for dynamically loading JARs worked great as long as we 
 start/stop the actual Tomcat server process, but I found out the JAR(s) that 
 I have been dynamically loading this way are not released when you stop the 
 WEBAPP.  I am using SysInternals Process Explorer to monitor the open file 
 handles of the Tomcat7 process.  I can see that when I stop the WEBAPP, the 
 dynamically loaded JAR is still referenced.
 
 QUESTION:
 I made an assumption that calling 
 Thread.currentThread().getContextClassLoader() would provide me the 
 classloader of my WEBAPP - which should be the same classloader that all the 
 JARs in the WEB-INF/lib are in.  We control the WEBAPP, so I assumed this was 
 a safe assumption.
 
 The usage of the dynamically loaded JAR(s) is no different than the default 
 JAR(s) in WEB-INF/lib.  None of the WEB-INF/lib JARs are left open when we 
 stop the WEBAPP - only the JAR(s) that are loaded via the addUrl approach 
 below.
 
 I have been through a number of online articles when I first created this 
 logic - including a PDF by Ted Neward [while at Developmentor] that described 
 these approaches, but am not sure how to troubleshoot this further now.
 
 If anyone has an answer or any suggestions, I would greatly appreciate it.

Do you have 'antiJarLocking' enabled on the Context?


p

 Thanks in advance,
 Bob
 
 
 Code to dynamically load JAR(s):
 
 public static void loadJarOnTheFly(File jarFile) throws IOException
 {
   Class?[] parameters = new Class[]{URL.class};
 
   // IMPORTANT: MUST use the webapp classloader - so derived extension 
 classes can resolve their base classes
   ClassLoader contextClassLoader = 
 Thread.currentThread().getContextClassLoader();
 
   // cast to a URL class loader so we can additional JAR(s) to the search 
 path
 URLClassLoader webappClassLoader = (URLClassLoader)contextClassLoader;
 
 Class? sysclass = URLClassLoader.class;
 
 try
 {
 URL jarUrl = jarFile.toURI().toURL();
 
 Method method = sysclass.getDeclaredMethod(addURL, parameters);
 method.setAccessible(true);
 method.invoke(webappClassLoader, new Object[]{ jarUrl });
 }
 catch (Throwable t)
 {
 throw new IOException(Error, could not add URL to system 
 classloader);
 }
 }
 
 
 
 Bob DeRemer
 Senior Director, Architecture and Development
 
 http://www.thingworx.comhttp://www.thingworx.com/
 Skype: bob.deremer
 O: 717.505.7923
 M: 717.881.3986
 
 




signature.asc
Description: OpenPGP digital signature


Re: Error starting Tomcat

2011-10-20 Thread Pid
On 20/10/2011 20:16, ramsri wrote:
 
 Konstantin:
 
 I am very glad that I found this thread. For a week I have been struggling
 with this problem. 

If this is a new problem, please start a new thread.

 I have Tomcat7 running. My application which was running just fine under
 Tomcat5 does not run under Tomcat7. I have created setupclasspath.sh with
 all the necessary JARs.

That's not likely to help matters, don't do that.

 My Tomcat starts fine and I see the opening page.
 Even my Axis comes up ok but not my application. 
 
 I start Tomcat with ./startup.sh and I do not use Eclipse. The message that
 I get is 
 
 ***
 Oct 20, 2011 3:04:03 PM org.apache.catalina.core.ContainerBase
 addChildInternal
 SEVERE: ContainerBase.addChild: start:
 org.apache.catalina.LifecycleException: Failed to start component
 [StandardEngine[Catalina].StandardHost[localhost].StandardContext[/mywebapp]]
 at
 org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:152)
 at
 org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:812)
 at
 org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:787)
 at
 org.apache.catalina.core.StandardHost.addChild(StandardHost.java:607)
 at
 org.apache.catalina.startup.HostConfig.deployDirectory(HostConfig.java:1055)
 at
 org.apache.catalina.startup.HostConfig.deployDirectories(HostConfig.java:978)
 at
 org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:472)
 at
 org.apache.catalina.startup.HostConfig.start(HostConfig.java:1329)
 at
 org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:311)
 at
 org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:119)
 
 ***
 
 I tried reading this thread but I cannot understand what exactly I should do
 in my setup. I see only one 
 
 /opt/tomcat7/lib/servlet-api.jar and this file is inside my CLASSPATH. 
 
 Your help is greatly appreciated. Thank you.

Please start a new thread.


p



signature.asc
Description: OpenPGP digital signature


RE: JAR locked in Tomcat after using addUrl to dynamically add JAR to running webapp

2011-10-20 Thread Bob DeRemer
I am not using a local app context and everything I've seen recommends NOT 
using antijarlocking in production settings.

Thx,
bob

-Original Message-
From: Pid [mailto:p...@pidster.com] 
Sent: Thursday, October 20, 2011 5:53 PM
To: Tomcat Users List
Subject: Re: JAR locked in Tomcat after using addUrl to dynamically add JAR to 
running webapp

On 20/10/2011 18:18, Bob DeRemer wrote:
 Hi Tomcat Community:
 
 BACKGROUND:
 I have a Servlet-based WEBAPP that is running in Tomcat7, JDK 1.6.0_27 on 
 Windows Server 2008 R2 64-bit - all 64-bit.  We make use of class.newInstance 
 quite a bit as we have a fairly modular, interface-based system, and create 
 class instances on the fly.  As part of our extensibility,  I'm also using a 
 pretty well documented hack [The code is listed below]  for dynamically 
 adding JAR(s) so they are accessible immediately without stopping our WEBAPP 
 or the actual Tomcat server process.   This process has worked great for both 
 JAR(s) in the WEB-INF/lib and for ones we dynamically added - until you try 
 and stop the WEBAPP via the Tomcat manager app.
 
 PROBLEM:
 This solution for dynamically loading JARs worked great as long as we 
 start/stop the actual Tomcat server process, but I found out the JAR(s) that 
 I have been dynamically loading this way are not released when you stop the 
 WEBAPP.  I am using SysInternals Process Explorer to monitor the open file 
 handles of the Tomcat7 process.  I can see that when I stop the WEBAPP, the 
 dynamically loaded JAR is still referenced.
 
 QUESTION:
 I made an assumption that calling 
 Thread.currentThread().getContextClassLoader() would provide me the 
 classloader of my WEBAPP - which should be the same classloader that all the 
 JARs in the WEB-INF/lib are in.  We control the WEBAPP, so I assumed this was 
 a safe assumption.
 
 The usage of the dynamically loaded JAR(s) is no different than the default 
 JAR(s) in WEB-INF/lib.  None of the WEB-INF/lib JARs are left open when we 
 stop the WEBAPP - only the JAR(s) that are loaded via the addUrl approach 
 below.
 
 I have been through a number of online articles when I first created this 
 logic - including a PDF by Ted Neward [while at Developmentor] that described 
 these approaches, but am not sure how to troubleshoot this further now.
 
 If anyone has an answer or any suggestions, I would greatly appreciate it.

Do you have 'antiJarLocking' enabled on the Context?


p

 Thanks in advance,
 Bob
 
 
 Code to dynamically load JAR(s):
 
 public static void loadJarOnTheFly(File jarFile) throws IOException
 {
   Class?[] parameters = new Class[]{URL.class};
 
   // IMPORTANT: MUST use the webapp classloader - so derived extension 
 classes can resolve their base classes
   ClassLoader contextClassLoader = 
 Thread.currentThread().getContextClassLoader();
 
   // cast to a URL class loader so we can additional JAR(s) to the search 
 path
 URLClassLoader webappClassLoader = (URLClassLoader)contextClassLoader;
 
 Class? sysclass = URLClassLoader.class;
 
 try
 {
 URL jarUrl = jarFile.toURI().toURL();
 
 Method method = sysclass.getDeclaredMethod(addURL, parameters);
 method.setAccessible(true);
 method.invoke(webappClassLoader, new Object[]{ jarUrl });
 }
 catch (Throwable t)
 {
 throw new IOException(Error, could not add URL to system 
 classloader);
 }
 }
 
 
 
 Bob DeRemer
 Senior Director, Architecture and Development
 
 http://www.thingworx.comhttp://www.thingworx.com/
 Skype: bob.deremer
 O: 717.505.7923
 M: 717.881.3986
 
 



-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: JAR locked in Tomcat after using addUrl to dynamically add JAR to running webapp

2011-10-20 Thread Caldarale, Charles R
 From: Bob DeRemer [mailto:bob.dere...@thingworx.com] 
 Subject: RE: JAR locked in Tomcat after using addUrl to dynamically add JAR 
 to running webapp

 I am not using a local app context and everything I've seen 
 recommends NOT using antijarlocking in production settings.

Yes, except for the fact that you're doing rather odd things, including running 
on Windows...

 - Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY 
MATERIAL and is thus for use only by the intended recipient. If you received 
this in error, please contact the sender and delete the e-mail and its 
attachments from all computers.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Tomcat application startup - Lifecycleexception

2011-10-20 Thread ramsri

I have been struggling for a week now getting my application deployed on
Tomcat 7. I am unable to make much progress with it and request your help. I
am not very good with Tomcat. So please bear with me and request details in
your solution. I can see this site being very informative. 

I have Tomcat7 running. My application which was running just fine under
Tomcat5 does not start under Tomcat7. I have modified setclasspath.sh with
all the necessary JARs. That is what I used to do on Tomcat5. Am I not
supposed to mess with this file? There is a servlet-api.jar that I find
under 
$CATALINA_HOME/lib

Tomcat itself starts fine and I see the opening page. Even my Axis comes up
ok but not my application. 

I start Tomcat with ./startup.sh and I do not use Eclipse. The message that
I get is as follows.

Thanks very much for your help. Glad to provide more info if needed. 


***
 Oct 20, 2011 3:04:03 PM org.apache.catalina.core.ContainerBase 
 addChildInternal 
 SEVERE: ContainerBase.addChild: start: 
 org.apache.catalina.LifecycleException: Failed to start component 
 [StandardEngine[Catalina].StandardHost[localhost].StandardContext[/mywebapp]] 
 at 
 org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:152) 
 at 
 org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:812)
  
 at 
 org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:787) 
 at 
 org.apache.catalina.core.StandardHost.addChild(StandardHost.java:607) 
 at 
 org.apache.catalina.startup.HostConfig.deployDirectory(HostConfig.java:1055) 
 at 
 org.apache.catalina.startup.HostConfig.deployDirectories(HostConfig.java:978) 
 at 
 org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:472) 
 at 
 org.apache.catalina.startup.HostConfig.start(HostConfig.java:1329) 
 at 
 org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:311) 
 at 
 org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:119)
  
 
 *** 


-- 
View this message in context: 
http://old.nabble.com/Tomcat-application-startup---Lifecycleexception-tp32693089p32693089.html
Sent from the Tomcat - User mailing list archive at Nabble.com.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Tomcat application startup - Lifecycleexception

2011-10-20 Thread Pid
On 20/10/2011 23:27, ramsri wrote:
 
 I have been struggling for a week now getting my application deployed on
 Tomcat 7. I am unable to make much progress with it and request your help. I
 am not very good with Tomcat. So please bear with me and request details in
 your solution. I can see this site being very informative. 
 
 I have Tomcat7 running. My application which was running just fine under
 Tomcat5 does not start under Tomcat7. I have modified setclasspath.sh with
 all the necessary JARs. That is what I used to do on Tomcat5. Am I not
 supposed to mess with this file? 

No, despite the name, you're not meant to alter this file.
You're meant to put all of the application's JAR files in

 mywebapp/WEB-INF/lib


 There is a servlet-api.jar that I find under 
 $CATALINA_HOME/lib

... and a few other JAR files, all of which Tomcat will load
automatically, because it has its own classloader.


 Tomcat itself starts fine and I see the opening page. Even my Axis comes up
 ok but not my application. 

Start over with a fresh download and a clean installation.

Do not modify setclasspath.sh.

Read all of the following:

 http://tomcat.apache.org/tomcat-7.0-doc/appdev/index.html


p

 I start Tomcat with ./startup.sh and I do not use Eclipse. The message that
 I get is as follows.
 
 Thanks very much for your help. Glad to provide more info if needed. 
 
 
 ***
 Oct 20, 2011 3:04:03 PM org.apache.catalina.core.ContainerBase 
 addChildInternal 
 SEVERE: ContainerBase.addChild: start: 
 org.apache.catalina.LifecycleException: Failed to start component 
 [StandardEngine[Catalina].StandardHost[localhost].StandardContext[/mywebapp]]
  
 at 
 org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:152) 
 at 
 org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:812)
  
 at 
 org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:787) 
 at 
 org.apache.catalina.core.StandardHost.addChild(StandardHost.java:607) 
 at 
 org.apache.catalina.startup.HostConfig.deployDirectory(HostConfig.java:1055) 
 at 
 org.apache.catalina.startup.HostConfig.deployDirectories(HostConfig.java:978)
  
 at 
 org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:472) 
 at 
 org.apache.catalina.startup.HostConfig.start(HostConfig.java:1329) 
 at 
 org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:311) 
 at 
 org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:119)
  

 *** 
 
 




signature.asc
Description: OpenPGP digital signature


Re: control of session timed out with tomcat

2011-10-20 Thread Tim Watts
On Thu, 2011-10-20 at 16:44 -0400, Christopher Schultz wrote:
 -BEGIN PGP SIGNED MESSAGE-
 Hash: SHA1
 
 Tim,
 
 On 10/20/2011 10:15 AM, Tim Watts wrote:
  I should also point out that this approach is somewhat kludgey
  because of the inherent latency problems when the session is close
  to expiration.  But I don't know of a rock solid approach. You just
  have to have the timer pop sufficiently sooner than the session
  expiration -- for some value of sufficient.
 
 Perhaps later? If you make the call too soon, you'll tickle the
 session and start the 30-minute (or whatever) clock all over again.
 

Ah. Left out an important piece of the puzzle: included an indicator on
the redirect URL to invalidate the session.  The reason for not doing it
later was the whole point of the exercise in my case: The client
(paycheck writer) didn't like submitting work and being surprised that
their session had already expired. This was a while ago -- no
HttpSessionListeners available -- so we couldn't easily persist the
session and recall it when the user logged in again.

As, I think, Andre was perhaps alluding to, this approach by itself is
probably overlooking a deeper problem.


 - -chris
 -BEGIN PGP SIGNATURE-
 Version: GnuPG v1.4.10 (MingW32)
 Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
 
 iEYEARECAAYFAk6giCMACgkQ9CaO5/Lv0PCDFgCeIhcfq/pC2z8MNjGwmvNPCjBh
 qIAAoLq64F23ZnkcY1Lj6L/bqeO22CYp
 =HT9l
 -END PGP SIGNATURE-
 
 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org
 



-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Tomcat application startup - Lifecycleexception

2011-10-20 Thread ramsri

Thanks for a prompt reply. 

I had done that clean install before. Anyway got to a clean install
situation and I still got the same error.

So, I looked into my web.xml under $CATALINA_HOME/webapps/myapp/WEB-INF  and
there I found a reference to a servlet-name 'Invoker'. I had read about this
somewhere. I commented out that block and things started working. My
application starts fine. There is some other problem with my .so file. Need
to figure that out. Not sure whether it is connected to this Invoker. 

Thanks for your guidance and I now know that there is no longer a need to
mess around with setclasspath.sh. Great. It had been a nightmare! 

**

ramsri wrote:
 
 I have been struggling for a week now getting my application deployed on
 Tomcat 7. I am unable to make much progress with it and request your help.
 I am not very good with Tomcat. So please bear with me and request details
 in your solution. I can see this site being very informative. 
 
 I have Tomcat7 running. My application which was running just fine under
 Tomcat5 does not start under Tomcat7. I have modified setclasspath.sh with
 all the necessary JARs. That is what I used to do on Tomcat5. Am I not
 supposed to mess with this file? There is a servlet-api.jar that I find
 under 
 $CATALINA_HOME/lib
 
 Tomcat itself starts fine and I see the opening page. Even my Axis comes
 up ok but not my application. 
 
 I start Tomcat with ./startup.sh and I do not use Eclipse. The message
 that I get is as follows.
 
 Thanks very much for your help. Glad to provide more info if needed. 
 
 
 ***
 Oct 20, 2011 3:04:03 PM org.apache.catalina.core.ContainerBase 
 addChildInternal 
 SEVERE: ContainerBase.addChild: start: 
 org.apache.catalina.LifecycleException: Failed to start component 
 [StandardEngine[Catalina].StandardHost[localhost].StandardContext[/mywebapp]]
  
 at 
 org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:152) 
 at 
 org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:812)
  
 at 
 org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:787) 
 at 
 org.apache.catalina.core.StandardHost.addChild(StandardHost.java:607) 
 at 
 org.apache.catalina.startup.HostConfig.deployDirectory(HostConfig.java:1055) 
 at 
 org.apache.catalina.startup.HostConfig.deployDirectories(HostConfig.java:978)
  
 at 
 org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:472) 
 at 
 org.apache.catalina.startup.HostConfig.start(HostConfig.java:1329) 
 at 
 org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:311) 
 at 
 org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:119)
  
 
 *** 
 
 
 

-- 
View this message in context: 
http://old.nabble.com/Tomcat-application-startup---Lifecycleexception-tp32693089p32693293.html
Sent from the Tomcat - User mailing list archive at Nabble.com.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: Tomcat application startup - Lifecycleexception

2011-10-20 Thread Caldarale, Charles R
 From: ramsri [mailto:ramfi...@yahoo.com] 
 Subject: Re: Tomcat application startup - Lifecycleexception

 I looked into my web.xml under $CATALINA_HOME/webapps/myapp/WEB-INF
 and there I found a reference to a servlet-name 'Invoker'. I had read
 about this somewhere.

In this day and age, using the Invoker servlet is a hanging offense:
http://wiki.apache.org/tomcat/FAQ/Miscellaneous#Q3

 There is some other problem with my .so file.

What .so file?  Are you saying your webapp consists partly of native code?  
What prevents you from coding that logic in Java?  If you actually do need 
native code, make sure the LD_LIBRARY_PATH environment variable or the Java 
system property java.library.path points to the location of the .so file so the 
JVM can find it when resolving references to functions in it.

 - Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY 
MATERIAL and is thus for use only by the intended recipient. If you received 
this in error, please contact the sender and delete the e-mail and its 
attachments from all computers.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



RE: JAR locked in Tomcat after using addUrl to dynamically add JAR to running webapp

2011-10-20 Thread Bob DeRemer
While I can appreciate the desire to never use Windows, that isn't reality in 
many of the industries that use our product, so running Tomcat on windows can't 
be considered an oddity or edge case.  If it is, we better look for another app 
server.

With regard to finding a solution, I'll try the antiJarLocking setting, but I 
don't have any problem with any other JARS, so I don't hold out much hope for 
this fixing my problem.  I may look at upgrading to JDK 7 - which has added a 
close method to the URLClassLoader.  Perhaps this might fix it.

If anyone else has any other ideas why ONLY JARs added via the addURL hack 
I've shown below don't get unloaded when the WEBAPP is shutdown - vs stopping 
Tomcat completely, I would greatly appreciate it.

Thanks,
Bob

-Original Message-
From: Caldarale, Charles R [mailto:chuck.caldar...@unisys.com] 
Sent: Thursday, October 20, 2011 6:07 PM
To: Tomcat Users List
Subject: RE: JAR locked in Tomcat after using addUrl to dynamically add JAR to 
running webapp

 From: Bob DeRemer [mailto:bob.dere...@thingworx.com]
 Subject: RE: JAR locked in Tomcat after using addUrl to dynamically 
 add JAR to running webapp

 I am not using a local app context and everything I've seen recommends 
 NOT using antijarlocking in production settings.

Yes, except for the fact that you're doing rather odd things, including running 
on Windows...

 - Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY 
MATERIAL and is thus for use only by the intended recipient. If you received 
this in error, please contact the sender and delete the e-mail and its 
attachments from all computers.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org