Rotate Apache Tomcat std Logs using log4j

Apache Tomcat std_out logs can be rotated by using log4j functionality based on its file size as mentioned below.

Modify log4j.properties

log4j.rootCategory=DEBUG,stdout, Sample

#### First appender writes to console
log4j.appender.stdout=org.apache.log4j.ConsoleAppender
log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
# Pattern to output the caller's file name and line number.
log4j.appender.stdout.layout.ConversionPattern=%5p [%t] (%F:%L) - %m%n

#### Second appender writes to a file
log4j.appender.Sample=org.apache.log4j.RollingFileAppender
log4j.appender.Sample.File=D:/ApacheSoftwareFoundation/Tomcat5.5/logs/SampleSiteLogs.txt
### Control the maximum log file size
### Archive log files
### (one backup file here Attribute MaxBackupIndex is where we can define max no of files to be written)
log4j.appender.Sample.MaxFileSize=100KB
log4j.appender.Sample.MaxBackupIndex=5
log4j.appender.Sample.layout=org.apache.log4j.PatternLayout
log4j.appender.Sample.layout.ConversionPattern=%d{dd MMM yyyy HH:mm:ss,SSS} %p %t %c - %m%n

Configure IIS with Multiple Tomcat Instances

Configuring IIS 6.0 with Multiple Tomcat 5.5 server instances is described best in the document uploaded here.its about the IIS and more than 1 tomcat server on to the single windows 2003 server.
Click to Download the Document.

Tomcat LoadBalancing

For this you need a webapp called balancer using this you can do this.

Sample Configuration
The default balancer installation uses a single filter, BalancerFilter, mapped to all requests (url-pattern /*). The filter reads its rules from the location specified in the balancer deployment descriptor (web.xml file). The default rules are:

Redirect requests with News in the URL to http://www.site1.com/
Redirect requests with a parameter named paramName whose value is paramValue to http://www.site2.com/.

Redirect all other requests to jakarta.apache.org.
Therefore, when you install tomcat, start it, and point your browser to http://localhost:8080/balancer, you will be redirected to http://jakarta.apache.org/. If you point your browser to http://localhost:8080/balancer/News you will be redirected to http://www.site1.com/. The request for http://localhost:8080/balancer/BlahBlah?paramName=paramValue will be redirected to http://www.site2.com/.

Balancer Rules
A Rule in the balancer system is a combination of a request matching criterion and a redirection URL for matching requests. Rules implement the org.apache.webapp.balancer.Rule interface.
The balancer distribution contains a number of useful rules. The framework is also designed for easy extensibility so that you can write your own rules quickly. Rules should be JavaBeans (public no-args constructor, public setter method setXXX for property xxx), as they are instantiated by Jakarta Commons Digester. Feel free to inquire on the tomcat-user mailing list regarding the availability of rules or the inclusion of your rules in the distribution.
Rules are assembled into RuleChains. Each BalancerFilter (or Servlet/JSP) refers to one RuleChain when making its redirection decisions. Note that you are not restricted to having one filter mapped to /* as done in the sample configuration. You can configure as many filters as desired, using the full filter mapping possibilities defined in the Servlet Specification. Each filter will have its own RuleChain


How it Works
You write a rules configuration file containing various rules and redirection locations.
You define the balancer filter in your web.xml, mapping it as desired (/* is a common use-case) and configuring it with your rules configuration file.
The server is started, initializing the filter.
A request comes into the server. The filter consults its rule chain to determine where to redirect the request. Rules are consulted in the order in which they are defined in the rules configuration file. The first matching rule will stop the evaluation and cause the request to be redirected.

Setting up of Tomcat Heap Size in versions like 4.0

Earlier Version of Tomcat Like 4.*.* there is no GUI to set the JVM Heap Size in such cases u can set the Java Heap Size in following way
Set one variable in your System Enviornment as

VariableName:->JAVA_OPTS
VariableValue:-> -Xms64m -Xmx128m

This will solve ur heap size issue
If you r using catalina_home then u must define as CATALINE_OPTS as the above value....

Apache Tomcat as windows service

below command will create a Tomcat Server as windows service if you are not installing it thro the binarys.


SC create tomcatRN binpath= D:\apache-tomcat-5.5.16\bin\startup.bat DisplayName= Tomcat_5050
[SC] CreateService SUCCESS

Overriding the default Servlet in Tomcats WEB-INF/web.xml

To Override the Global Tomcat Settings use the below Code for DIR Listings
<servlet>
        <servlet-name>DefaultNoListing</servlet-name>
        <servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>
        <init-param>
            <param-name>debug</param-name>
            <param-value>0</param-value>
        </init-param>
        <init-param>
            <param-name>listings</param-name>
            <param-value>true</param-value>
        </init-param>
        <load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>DefaultNoListing</servlet-name>
<url-pattern>/</url-pattern>
</servlet-mapping>

Configuring tomcat to authenticate using windows Active Directory

<Realm className="org.apache.catalina.realm.JNDIRealm" debug="99"

           connectionURL="ldap://youradsserver:389/"
           alternateURL="ldap://youradsserver:389/"         
           userRoleName="member"
           userBase="cn=Users,dc=yourdomain"
           userPattern="cn={0},cn=Users,dc=yourdomain"
           roleBase="cn=Users,dc=yourdomain"
           roleName="cn"
           roleSearch="(member={0})"
           roleSubtree="false"
           userSubtree="true" 
   />
and define the role in the tomcat-users.xml and the web.xml of your application
edit webapp_root/WEB_INF/Web.xml file as follows:
<security-constraint>
   <display-name>your web app display name</display-name>
   <web-resource-collection>
     <web-resource-name>Protected Area</web-resource-name>
     <url-pattern>*.jsp</url-pattern>
     <url-pattern>*.html</url-pattern>
     <url-pattern>*.xml</url-pattern>
   </web-resource-collection>
   <auth-constraint>
     <role-name>yourrolname(ADS Group)</role-name>
   </auth-constraint>
 </security-constraint>
 <login-config>
   <auth-method>FORM</auth-method>
   <form-login-config>
     <form-login-page>/login.jsp</form-login-page>
     <form-error-page>/error.jsp</form-error-page>
   </form-login-config>
 </login-config>
 <security-role>
   <description>your role description</description>
   <role-name>yourrolename(i.e ADS group)</role-name>
 </security-role>

Tomcat Clustering

Tomcat Clustering

Apache Server with Tomcat server

The simplest configuration is described. It assumes you already have Tomcat 5.5 and Apache 2.0 (instructions for Apache 1.3 is also provided) installed and running.

The instructions are applicable (have been tested) for Windows as well as Linux platform.

Assume you want to map test directory of Apache to the mytest web application of Tomcat. Change the name appropriately to suit your configuration.

1. Shutdown Apache & Tomcat Server
2. Add the following lines to httpd.conf (in conf directory of Apache base directory)

LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so
ProxyPass /test/ http://localhost:8081/mytest/
ProxyPassReverse /test/ http://localhost:8081/mytest/

Note 1: Replace localhost with the appropriate IP address or hostname of the server where Tomcat is installed.

Note 2: On older Apache 1.3 you will have to use libproxy.so instead:
LoadModule proxy_module modules/libproxy.so
AddModule mod_proxy.c

IIS with Apache Tomcat Server

IIS with Apache Tomcat Server

Tomcat 6 - Discloses username="tomcat" password="s3cret" roles="manager"

Tomcat 6 - Discloses username="tomcat" password="s3cret" roles="manager"

Custom Error page configurations not working with Tomcat 6.x and while using the Manager application of tomcat if user tries the invalid username / passwords it discloses the 401 unauthorized page as shown below.

to manage the issue either disable the Manager application or modify the error page so that  username="tomcat" password="s3cret" roles="manager" this string can be avoided and for the same comment out the below code of the 401.jsp file located at D:\ApacheSoftwareFoundation\Tomcat6.0\webapps\manager and restart the tomcat and you are done.

<pre>
&lt;role rolename="manager"/&gt;
&lt;user username="tomcat" password="s3cret" roles="manager"/&gt;
</pre>

Tomcat Startup failure on Win2k8 R2

Getting error while Starting tomcat server 5 on windows 2008 R2 - 64bit operating system as the packages used were supported for 32 bit versions.

[402  prunsrv.c] [error]
The system cannot find the file specified

[1246 prunsrv.c] [error]
Load configuration failed

i have resolved this error simply by installing the JRE 6 and Tomcat 6 for 64 bit windows system and it worked successfully and also it installed this as Windows service which is common isssue if you are installing 32 bit package.

Packages used are
jre-6u4-windows-x64.exe
apache-tomcat-6.0.29.exe


Download links for 64 bit packages - ( JRE )
http://www.start64.com/index.php?Itemid=114&id=1792&option=com_content&task=view

Run your Tomcat server on HTTPS

Simple Steps to make your TOMCAT Run on HTTPS using KEYTOOL utility

1). keytool -genkey -alias www.mytest.com -keyalg RSA -keysize 2048 -keystore www_mytest_com.jks

2). keytool -certreq -alias www.mytest.com -file www_mytest_com.csr -keystore www_mytest_com.jks

3). keytool -import -trustcacerts -alias www.mytest.com -file D:\www_mytest_com.p7b -keystore www_mytest_com.jks
This will install Certificate and the Root Certificate associated with the same., sometimes this will not work and in that case try the below steps.

3.1). keytool -import -alias www.mytest.com -file D:\www_mytest_com.cer -keystore www_mytest_com.jks
3.2). keytool -import -trustcacerts -file D:\www_mytest_com_root.cer -keystore www_mytest_com.jks

4). Modify server.xml and Restart TOMCAT SERVER


**Note: By default Tomcat will look for your Keystore with the file name .keystore in the home directory with the default password changeit. The home directory is generally /home/user_name/ on Unix and Linux systems, and C:\Documents and Settings\user_name\ on Microsoft Windows systems

Apache 2 to Tomcat Connector Using Proxy

The simplest configuration is described. It assumes you already have Tomcat 5.5 and Apache 2.0 (instructions for Apache 1.3 is also provided) installed and running.

The instructions are applicable (have been tested) for Windows as well as Linux platform.

Assume you want to map test directory of Apache to the mytest web application of Tomcat. Change the name appropriately to suit your configuration.

1. Shutdown Apache & Tomcat Server
2. Add the following lines to httpd.conf (in conf directory of Apache base directory)

LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so
ProxyPass /test/ http://localhost:8081/mytest/
ProxyPassReverse /test/ http://localhost:8081/mytest/

Note 1: Replace localhost with the appropriate IP address or hostname of the server where Tomcat is installed.

Note 2: On older Apache 1.3 you will have to use libproxy.so instead:
LoadModule proxy_module modules/libproxy.so
AddModule mod_proxy.c

Tomcat Hardening Recomendations

1. use an unprivileged user account to run the  server.
2.use a firewall before your server
3. Disable the connectors you dont need  in server.xml
4. disable the tomcat's admin/manager web application completely or configure it that way that it needs proper username/passwort and connection from well known hosts
5. Disable the examples application
6. use apache http server to forward the request to the tomcat server.
7. bind tomcat to those IPs and ports only which you need, don't bind to any
8.Use server-minimal.xml instead of server.xml (make security life simpler;-)
9. check what you allow in tomcat's default context.xml, web.xml and anything below your configured host 10. use a special user to run tomcat, don't use administrator/root for that
11. allow only that user to read all your files, disallow any other users
12. make all files read-only (except those tomcat needs to write to)

To Allow/Disallow access from Specifc port use following Valves.
<Valve className="org.apache.catalina.valves.RemoteHostValve" allow="10.6.1.*" deny="10.6.1.1"/>

By Defining Address Tag we can Allow the AJP Access from specific IP only as shown below
<Connector address="127.0.0.1" port="8009"   enableLookups="false" redirectPort="8443" protocol="AJP/1.3"  allowTrace="false" xpoweredBy="true"/>

<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"  prefix="localhost_access_log." suffix=".txt" pattern="common" resolveHosts="false"/>
<Valve className="org.apache.catalina.valves.RemoteHostValve" allow="127.0.0.1,10.6.10.*" deny="10.6.10.2"/>

while Config of ADMIN/ Manager Application For tomcat Administration put admin.xml and manager.xml from the server's server\webapps location to the D:\ApacheSoftwareFoundation\Tomcat5.5\conf\Catalina\localhost and Restart the Tomcat Server to get the Changes
whenever making any change to the admin.xml again put the same in the above mentioned location and Restart

Always Allow ADMIN/Manager Application from Local/Intranet IP's don’t let them over Internet due to security Threat

For more informations on securing TOMCAT refere
http://www.owasp.org/index.php/Securing_tomcat
http://www.unidata.ucar.edu/Projects/THREDDS/tech/reference/TomcatSecurity.html