On Thu, Nov 18, 2010 at 8:52 AM, Christopher Schultz wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> David,
>
> On 11/18/2010 3:41 AM, David Dabbs wrote:
> > We're fronting a Tomcat 6.0.29 instance with httpd 2.2.15 via
> mod_proxy_ajp.
>
> Obligatory question: is it really necessary to use httpd at all?
>
>
Yes, unfortunately.
> > My suspicion is that we get requests with too-long request uri and or
> > Referrer and this is gumming up the works for AJP protocol marshalling.
>
> I believe that's correct. See below:
>
> > Would a change to mod_proxy_http solve the issues? I’d rather not do that
> if
> > there’s some Apache/Tomcat connector conf change I can make.
>
> Switching to mod_proxy_http will probably get you a bit more stability
> - -- the mode_proxy_http connector is older and more mature than
> mod_proxy_ajp. Switching to mod_jk might also get you better stability,
> but the configuration is totally different between mod_proxy_ajp and
> mod_jk, so that might be a no-go for you. mod_proxy_http and
> mod_proxy_ajp have virtually the same configuration (just change all
> ajp:// to http://) so it's easier to switch from one to the other.
>
> > FWIW, here’s my connector def:
> > <!-- Define an AJP 1.3 Connector on port 8009 -->
> >
> > <Connector port="8009" protocol="AJP/1.3" maxThreads="2048"
> > minSpareThreads="50" maxSpareThreads="200" enableLookups="false"/>
>
> That looks pretty standard. 2048 threads might be dangerous depending on
> your environment: we have lots of reports of OutOfMemoryErrors being
> thrown because the JVM can't launch a new thread due to resource
> constraints placed on it by the OS. You might want to double-check your
> environment just to be sure.
>
> Ok, thanks.
> These happen together
> >
> > [Wed Nov 17 16:54:49 2010] [error] ajp_msg_append_cvt_string():
> > BufferOverflowException 4 3129
> > [Wed Nov 17 16:54:49 2010] [error] ajp_marshal_into_msgb: Error appending
> > the query string
> > [Wed Nov 17 16:54:49 2010] [error] ajp_send_header: ajp_marshal_into_msgb
> > failed
> > [Wed Nov 17 16:54:49 2010] [error] (120001)APR does not understand this
> > error code: proxy: AJP: request failed to 127.0.0.1:8009 (localhost)
>
> Hmm. That's either a mod_proxy_ajp bug or a misconfiguration of httpd
> and/or Tomcat. What is your mod_proxy_ajp configuration? Specifically,
> are you setting a max_packet_size?
>
>
See below.
> > Some are like this:
> > [Wed Nov 17 18:25:10 2010] [error] ajp_msg_append_cvt_string():
> > BufferOverflowException 4 8186
> > [Wed Nov 17 18:25:10 2010] [error] ajp_marshal_into_msgb: Error appending
> > attribute AJP_REMOTE_PORT=50872
> > [Wed Nov 17 18:25:10 2010] [error] ajp_send_header: ajp_marshal_into_msgb
> > failed
> > [Wed Nov 17 18:25:10 2010] [error] (120001)APR does not understand this
> > error code: proxy: AJP: request failed to 127.0.0.1:8009 (localhost)
>
> Do the above two errors always happen with this following it:
>
> > [Wed Nov 17 06:08:14 2010] [error] [client 216.220.11.62] request
> > failed: URI too long (longer than 8190)
>
> ?
>
> No, URI too long is rare.
> If you are using very long URIs and/or many headers, you can get these
> kinds of errors. The AJP protocol (or maybe just the httpd and Tomcat
> implementation of them) needs to fit all of the HTTP headers (including
> the request line - "GET /foo/...") into a single packet, whose default
> size is 8192 bytes.
>
> Someone recently posted an error on the Tomcat size with an AJP response
> that was failing for the same reason. Unfortunately, the Tomcat code is
> pretty rough and you get nasty ArrayIndexOutOfBoundsExceptions and no
> real good message like "header content is too long for packet size" or
> something meaningful like that.
>
> > This one is clear, is there a conf change I can make?
>
> You can set the "packetSize" attribute in Tomcat's <Connector> and make
> a corresponding change to the max_packet_size in httpd (I'm sorry, I
> don't know how to configure that in mod_proxy_ajp since I pretty much
> exclusively use mod_jk... you'll have to look up the configuration for
> that on your own).
>
>
We're using mod_proxy_ajp. I'm considering adding the following to my Apache
& Tomcat configs
In Apache httpd.confProxyIOBufferSize 19456 # like max_packet_size
I think
LimitRequestFieldSize 18342In Tomcat server.xml <Connector port="8009"
protocol="AJP/1.3"
maxThreads="2048" minSpareThreads="50" maxSpareThreads="200"
enableLookups="false"
packetSize="20480"
/>
> Hope that helps,
> - -chris
Yes. I appreciate the feedback.
