Tomcat – Jboss unreachable/ slow behind apache with ajp

apache-2.2jbossmod-proxy-ajpreverse-proxytomcat

I have an linux server running with a JBoss Instance with apache2.
Apache2 will use AJP connection to reverse proxy to JBoss.

I found these messages in the apache error.log:

[error] (70007)The timeout specified has expired: ajp_ilink_receive() can't receive header
[error] ajp_read_header: ajp_ilink_receive failed
[error] (120006)APR does not understand this error code: proxy: read response failed from 8.8.8.8:8009 (hostname)
[error] (111)Connection refused: proxy: AJP: attempt to connect to 8.8.8.8:8009 (hostname) failed
[error] ap_proxy_connect_backend disabling worker for (hostname)
[error] proxy: AJP: failed to make connection to backend: hostname
[error] proxy: AJP: disabled connection for (hostname)25

I googled around but I can't seem to find any related topics.
There are people say this behavior can be caused by misconfigured apache vs jboss.
Telling the max amount of connections apache allows are far greater then jboss, causing the apache connection to time out.

But I know the app isn't used by thousands of simultaneous connections at the time not even hundreds of connections so I don't believe this could be a cause.

Does anybody have an idea? Or could tell me how to debug this problem?

I'm using these versions:

Debian 4.3.5-4 64Bit
Apache Version 2.2.16
JBOSS Version 4.2.3.GA

Thanks

Best Answer

4.2.3 jboss, you should increase the amount of ajp connections that you can allow in server.xml. if that is not set, the default is 40, which is too low. Up that to 20% higher than your current amount of max connections. If you have hundreds of simutanious connections, set it to 512 and monitor it using the status console.

Related Solutions

Apache and ajp performance

you could balance your load across the two servers. Try to give more load to the standalone tomcat. You'll find same examples here: http://httpd.apache.org/docs/2.2/mod/mod_proxy.html#proxypass

The error message looks like your tomcat isn't giving back any response. Did you take a look at your tomcat logs? Perhaps the tomcats have some trouble and apache is keeping connections open. This could also be a source for apache givving up. Do you have mod_status installed on your apache? This could give you some additional hints.

Christian

Https root webapp in jboss 5 through apache mod_proxy with ajp

If everything is on the same server, all you need to do is set up SSL in Apache - you make sure mod_ssl is installed and pretty much use the default config style to make it run. The Apache <=> JBoss communication will happen internally on the same server as usual and be unencrypted.

Given a standard linux (CentOS, e.g.) box with the mod_ssl package installed:

# SSL Basics
LoadModule ssl_module modules/mod_ssl.so
Listen 443
NameVirtualHost *:443
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl    .crl
SSLPassPhraseDialog  builtin
SSLSessionCache         shmcb:/var/cache/mod_ssl/scache(512000)
SSLSessionCacheTimeout  300
SSLMutex default
SSLRandomSeed startup file:/dev/urandom  256
SSLRandomSeed connect builtin
SSLCryptoDevice builtin

<VirtualHost _default_:443>
  ...config stuff...
  ServerName intranet.mycompany.com
  ProxyPreserveHost On
  ProxyPass / balancer://jbosscluster/
  ProxyPassReverse / http://127.0.0.1:8080

  SSLEngine on
  SSLProtocol all -SSLv2
  SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
  SSLCertificateFile /path/to/server.pem
  SSLCertificateKeyFile /path/to/server.pem

  <Files ~ "\.(cgi|shtml|phtml|php3?)$">
    SSLOptions +StdEnvVars
  </Files>

  SetEnvIf User-Agent ".*MSIE.*" \
    nokeepalive ssl-unclean-shutdown \
    downgrade-1.0 force-response-1.0

  CustomLog logs/ssl_request_log \
    "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

  ...more config stuff...
</VirtualHost>

The file server.pem contains both the unencrypted server key and the server cert returned from the upstream authority.

/usr/bin/openssl genrsa -des3 1024 > server.key.encrypted
/usr/bin/openssl rsa -in server.key.encrypted -out server.key

/usr/bin/openssl req -new -key server.key -out server.csr

cat server.key > server.pem
cat server.crt >> server.pem

That's the basic idea -- server.crt is the file given back to you from Thawte, etc. after you gave them the server.csr file (and money).

Related Topic