20 Tips for Using Tomcat in Production

来源:

http://digitalsanctum.com/2007/08/18/20-tips-for-using-tomcat-in-production/

http://kenwublog.com/docs/java6-jvm-options-chinese-edition.htm

 

I've been working with Apache Tomcat for years and always seem to stumble upon new information related to the proper setup and configuration for a production environment. I've decided to put the instructions and tips I've collected together in one place.

So here are some helpful hints for running Tomcat in a production environment:

1. If you're running on a 1.5+ JVM...

Add the following to your JAVA_OPTS in catalina.sh (or catalina.bat for Windows): -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/home/j2ee/heapdumps Then use a tool such asYourKit to analyze the heapdump file.

2. When using Jasper 2 in a production Tomcat server you should consider...

Straight from the Tomcat documentation on Jasper 2...

When using Jasper 2 in a production Tomcat server you should consider making the following changes from the default configuration. development: To disable on access checks for JSP pages compilation set this to false. genStringAsCharArray: To generate slightly more efficient char arrays, set this to true.modificationTestInterval: If development has to be set to true for any reason (such as dynamic generation of JSPs), setting this to a high value will improve performance a lot. trimSpaces: To remove useless bytes from the response, set this to true.

3. Use Tomcat's clustering/session replication capability.

Use Tomcat's clustering/session replication capability to minimize application user impact during maintenance periods.

Recommended Books

1. Java Performance and Scalability: A Quantitative Approach
2. The Well-Grounded Java Developer: Vital techniques of Java 7 and polyglot programming
3. Java Concurrency in Practice
4. Web Performance Daybook Volume 2
5. High Performance Web Sites: Essential Knowledge for Front-End Engineers

4. Implement custom error pages

To hide raw exception messages from the users. To do this, simply add something like the following to your web.xml:

<error-page>
   <error-code>404</error-code>
   <location>/error/404.html</location>
</error-page>

5. Use a logging toolkit.

Eliminate System.out and System.err statements from application code and use a logging toolkit such as Log4J for application logging.

6. Leverage Tomcat's shared library directory.

If you're loading several applications with several of the same library dependencies, consider moving them from the applications' WEB-INF/lib directory to Tomcat's shared library{catalina.home}/shared/lib. This will reduce the memory used by each application and result in smaller WAR files.

Update (comments from the [e-mail] mailing list): The following should be considered when using the shared library directory: 1. The shared classloader is searched in last resort when looking for classes, according to http://tomcat.apache.org/tomcat-5.5-doc/class-loader-howto.html. 2. Because the classes are shared, they share configuration and singletons and if they store objects statically they will prevent your application from unloading.

This is turning out to be a more controversial suggestion...

Starting with Servlet Spec 2.3 (I think) there has been an emphasis on putting everything a web app needs to run into its war file.

Shared classloaders are evil, but not as evil as the invoker servlet. With a shared loader you can easily get Singleton assumptions being wrong, class cast exceptions, versioning woes, and other issues. Saving a little perm memory just doesn't justify it.

7. Tweak memory parameters.

Most of the time you will want to make a change to the default settings. The best advice here is to create a development environment that matches your production environment and load test the application. While you do this you can also use a profiler to identify bottlenecks, etc.

8. Remove unnecessary applications.

9. Secure the Manager application.

By default there are no users with the manager role. To make use of the manager webapp you need to add a new role and user into the CATALINA_HOME/conf/tomcat-users.xml file.

10. Use a valve to filter by IP or hostname to only allow a subset of machines to connect.

This can be configured at the Engine, Host, or Context level in the conf/server.xml by adding something like the following:

<!-- allow only LAN IPs to connect to the manager webapp -->
<!-- contrary to the current Tomcat 5.5 documation the value for 'allow' is not a regular expression -->
<!-- future versions may have to be specified as 192.168.1.* -->
<Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="192.168.1.*"></Valve>

11. Strip down server.xml.

By removing comments to make it easier to read and remove connectors that you don't need. An easy way to do this is the following: Rename CATALINA_HOME/conf/server.xml toCATALINA_HOME/conf/server-original.xml and rename CATALINA_HOME/conf/server-minimal.xml to CATALINA_HOME/conf/server.xml. The minimal configuration provides the same basic configuration, but without the nested comments is much easier to maintain and understand. Do not delete the original file as the comments make it useful for reference if you ever need to make changes. Unless you are using Tomcat with the Apache server, comment out this line in CATALINA_HOME/conf/server.xml:

<Connector port="8009" enableLookups="false" redirectPort="8443" protocol="AJP/1.3"></Connector>

12. Split your Tomcat installation for added flexibility when it comes time to upgrade Tomcat.

See the "Advanced Configuration - Multiple Tomcat Instances" section in the RUNNING.txt file of the Tomcat distribution.

14. Do NOT run Tomcat as root.

Look to my previous post, "3 Ways to Run a Servlet Container on Port 80 as Non-Root", for tips.

15. Precompile JSPs.

Precompile JSPs (at build time).

16. Secure directory listings.

In CATALINA_HOME/conf/web.xml:

<servlet>
   <servlet-name>default</servlet-name>
   <servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>
   <init-param>
      <param-name>debug</param-name>
      <param-value>0</param-value>
   </init-param>
   <init-param>
      <param-name>listings</param-name>
      <param-value>false</param-value>  <!-- make sure this is false -->
   </init-param>
   <load-on-startup>1</load-on-startup>
</servlet>

17. If you have multi-core CPUs or more than one CPUs on your server...

It might be beneficial to increase the thread pool beyond the default 250. On the other hand, if you have a slow server, decreasing the thread pool will decrease the overhead on the server.

18. Monitor application applications via Tomcat MBeans.

This article provides some great insight on how to do this.

Consider JDK 1.5 or even better JDK 1.6

To take advantage of performance improvements.

Update (comments from [e-mail] mailing list):

Note that you can gain even more performance if you recompile your "string concatenation hungry" (d="aaaa"+b+"ccc") support libraries for JDK 5+ on a multi-CPU system. This is because JDK 5 uses the non-synchronized StringBuilder instead of the JDK 4- synchronized StringBuffer. And synchronization over multiple CPUs takes a few more cycles than on single CPU machines.

19. Use the -server JVM option.

This enables the server JVM, which JIT compiles bytecode much earlier, and with stronger optimizations. Startup and first calls will be slower due to JIT compilation taking more time, but subsequent ones will be faster.

20. Use GZIP compression.

Look for the service connector you wish to configure for compression and add two attributes, compression and compressableMimeType. For example:

<Connector>
   port="80"
   maxHttpHeaderSize="8192"
   URIEncoding="UTF-8"
   maxThreads="150"
   minSpareThreads="25"
   maxSpareThreads="75"
   enableLookups="false"
   redirectPort="8443"
   acceptCount="100"
   connectionTimeout="20000"
   disableUploadTimeout="true"
   compression="on"
   compressableMimeType="text/html,text/xml,text/plain,application/xml">
</Connector>

For more information, read the Tomcat HTTP Connector documentation.

The default Tomcat configuration provides good protection for most requirements, but does not prevent a malicious application from compromising the security of other applications running in the same instance. To prevent this sort of attack, Tomcat can be run with a Security Manager enabled which strictly controls access to server resources. Tomcat documentation has a good section on enabling the Security Manager.

Who's Using Tomcat in Production

Curious about what other organizations run Tomcat in a production environment? The Tomcat wiki has a list.

Update: If you're running with Java 6 JVM, I found this great resource which gives a complete list of -XX options. This is helpful if you're doing performance tweaking for your environment or debugging an issue with your system.

Related Reading

1. SpringSource Team Blog: Optimising and Tuning Apache Tomcat
2. Real-Time Tracking and Tuning for Busy Tomcat Servers
3. The official Apache Tomcat Wiki
4. Apache Tomcat
5. Tomcat 6.0 Documentation
6. Tomcat 5.5 Documentation
7. Tomcat 5.0 Documentation

 

Java and Tomcat Jobs

Tomcat Web Server Expert - Software Engineer 4 - Tomcat Web Server Expert... of Apache/Tomcat Security and its configuration. Must have strong knowledge of Java Security . Must have... Newark, DE 19702, 2 days ago

Java Developer - a primary focus on Java developmentmost new development work will be done in Java. A secondary focus of... servers (Tomcat, Apache, etc.). Java frameworks or... Madison, WI, 2 days ago

Software Engineer II Spring, Hibernate, JBoss, Tomcat - Hibernate, JBoss, Tomcat - 610906 Description... in development of Web/Application Servers: JBoss, Tomcat • Experience with relational databases and data... Duluth, GA, 7 days ago

Senior Technical Consultant - Java, Tomcat, Jetty - Our client is seeking a Senior Technical Consultant in Atlanta, Georgia (GA). The job description for the position of Senior Technical Consultant includes, but... Atlanta, GA, 3 days ago

Java Architect - Experience working with Tomcat, Spring, Object relational mapping, and Java based technologies • Have... years of experience with Java and various frameworks... San Francisco, CA, 1 day ago

jobs by