You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Rob Kirkbride <ro...@gmail.com> on 2007/08/08 14:01:18 UTC
MaxHTTPHeaderSize
Hi,
I've been getting a lot MsgAjp Overflow messages recently. The strange
this is only seems to happen only 1 app server at a time and seems to
stop and start in bursts of sometimes over an hour, but then nothing for
several hours after that.
This is with Tomcat 5.5.20 and mod_jk 1.2.23.
Is it possible that it is someone trying to provoke a DOS or should I
really investigate increasing the maxhttpheadersize in server.xml and
max_http_size in Mod_jk?
Thanks for any help,
Rob
2007-08-08 08:36:47,579 ERROR [ ] [org.apache.jk.common.MsgAjp] Buffer
overflow
: buffer.len=8192 pos=259 data=20202
2007-08-08 08:36:47,580 ERROR [ ] [org.apache.jk.common.MsgAjp] Overflow
java.lang.Throwable
at org.apache.jk.common.MsgAjp.cpBytes(MsgAjp.java:194)
at org.apache.jk.common.MsgAjp.appendByteChunk(MsgAjp.java:168)
at org.apache.jk.common.MsgAjp.appendBytes(MsgAjp.java:154)
at
org.apache.jk.common.JkInputStream.appendHead(JkInputStream.java:302)
at org.apache.jk.core.MsgContext.action(MsgContext.java:258)
at org.apache.coyote.Response.action(Response.java:182)
at org.apache.coyote.Response.sendHeaders(Response.java:378)
at
org.apache.catalina.connector.OutputBuffer.doFlush(OutputBuffer.java:
317)
at
org.apache.catalina.connector.OutputBuffer.close(OutputBuffer.java:27
8)
at
org.apache.catalina.connector.Response.finishResponse(Response.java:4
76)
at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.jav
a:151)
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: MaxHTTPHeaderSize
Posted by Rob Kirkbride <ro...@gmail.com>.
Rainer,
Thanks for the comprehensive reply. We're using Apache on RHEL4. I'll try
and investigate the actual URL. It is a very busy environment (> 25 million
hits a day) so it'll take me some time to pick through.
Yes it does look like a response. I'm assuming this doesn't just mean it's a
big page. What kind of information is sent in the header? - We're not really
using cookies at the moment for instance.
Thanks
Rob
On 08/08/2007, Rainer Jung <ra...@kippdata.de> wrote:
>
> Hi Rob,
>
> I would prefer to find out, what kind of requests cause this behaviour.
> Are there log messages in the mod_jk log file? The mod_jk log file
> contains the pid and thread-ID of the web server thread processing the
> request. Dependent on the platform an web server, you casn also log the
> pid and thread-id in the access log of the web server and then identify
> the requests even under medium load by using the time stamp and
> pid/thread-id. After identifying the request, you could check client IP,
> user agent and of course the URL, whether there is something strange.
>
> If your load is low, the time stamps from the Tomcat log could be enough
> to relate to a request in a Tomcat access log, or if time is synced in a
> web server access log.
>
> Furthermore: the stack looks like this is not a strange request, but
> instead a strange response. It seems your webapp produces responses with
> big headers? Maybe I'm wrong, but that's how i interprete the stack.
>
> Regards,
>
> Rainer
>
> Rob Kirkbride wrote:
> > Hi,
> >
> > I've been getting a lot MsgAjp Overflow messages recently. The strange
> > this is only seems to happen only 1 app server at a time and seems to
> > stop and start in bursts of sometimes over an hour, but then nothing for
> > several hours after that.
> > This is with Tomcat 5.5.20 and mod_jk 1.2.23.
> >
> > Is it possible that it is someone trying to provoke a DOS or should I
> > really investigate increasing the maxhttpheadersize in server.xml and
> > max_http_size in Mod_jk?
> >
> > Thanks for any help,
> >
> > Rob
> >
> > 2007-08-08 08:36:47,579 ERROR [ ] [org.apache.jk.common.MsgAjp] Buffer
> > overflow
> > : buffer.len=8192 pos=259 data=20202
> > 2007-08-08 08:36:47,580 ERROR [ ] [org.apache.jk.common.MsgAjp]
> Overflow
> > java.lang.Throwable
> > at org.apache.jk.common.MsgAjp.cpBytes(MsgAjp.java:194)
> > at org.apache.jk.common.MsgAjp.appendByteChunk(MsgAjp.java:168)
> > at org.apache.jk.common.MsgAjp.appendBytes(MsgAjp.java:154)
> > at
> > org.apache.jk.common.JkInputStream.appendHead(JkInputStream.java:302)
> > at org.apache.jk.core.MsgContext.action(MsgContext.java:258)
> > at org.apache.coyote.Response.action(Response.java:182)
> > at org.apache.coyote.Response.sendHeaders(Response.java:378)
> > at
> > org.apache.catalina.connector.OutputBuffer.doFlush(OutputBuffer.java:
> > 317)
> > at
> > org.apache.catalina.connector.OutputBuffer.close(OutputBuffer.java:27
> > 8)
> > at
> > org.apache.catalina.connector.Response.finishResponse(Response.java:4
> > 76)
> > at
> > org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.jav
> > a:151)
>
> ---------------------------------------------------------------------
> To start a new topic, e-mail: users@tomcat.apache.org
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Re: MaxHTTPHeaderSize
Posted by Rainer Jung <ra...@kippdata.de>.
Hi Rob,
I would prefer to find out, what kind of requests cause this behaviour.
Are there log messages in the mod_jk log file? The mod_jk log file
contains the pid and thread-ID of the web server thread processing the
request. Dependent on the platform an web server, you casn also log the
pid and thread-id in the access log of the web server and then identify
the requests even under medium load by using the time stamp and
pid/thread-id. After identifying the request, you could check client IP,
user agent and of course the URL, whether there is something strange.
If your load is low, the time stamps from the Tomcat log could be enough
to relate to a request in a Tomcat access log, or if time is synced in a
web server access log.
Furthermore: the stack looks like this is not a strange request, but
instead a strange response. It seems your webapp produces responses with
big headers? Maybe I'm wrong, but that's how i interprete the stack.
Regards,
Rainer
Rob Kirkbride wrote:
> Hi,
>
> I've been getting a lot MsgAjp Overflow messages recently. The strange
> this is only seems to happen only 1 app server at a time and seems to
> stop and start in bursts of sometimes over an hour, but then nothing for
> several hours after that.
> This is with Tomcat 5.5.20 and mod_jk 1.2.23.
>
> Is it possible that it is someone trying to provoke a DOS or should I
> really investigate increasing the maxhttpheadersize in server.xml and
> max_http_size in Mod_jk?
>
> Thanks for any help,
>
> Rob
>
> 2007-08-08 08:36:47,579 ERROR [ ] [org.apache.jk.common.MsgAjp] Buffer
> overflow
> : buffer.len=8192 pos=259 data=20202
> 2007-08-08 08:36:47,580 ERROR [ ] [org.apache.jk.common.MsgAjp] Overflow
> java.lang.Throwable
> at org.apache.jk.common.MsgAjp.cpBytes(MsgAjp.java:194)
> at org.apache.jk.common.MsgAjp.appendByteChunk(MsgAjp.java:168)
> at org.apache.jk.common.MsgAjp.appendBytes(MsgAjp.java:154)
> at
> org.apache.jk.common.JkInputStream.appendHead(JkInputStream.java:302)
> at org.apache.jk.core.MsgContext.action(MsgContext.java:258)
> at org.apache.coyote.Response.action(Response.java:182)
> at org.apache.coyote.Response.sendHeaders(Response.java:378)
> at
> org.apache.catalina.connector.OutputBuffer.doFlush(OutputBuffer.java:
> 317)
> at
> org.apache.catalina.connector.OutputBuffer.close(OutputBuffer.java:27
> 8)
> at
> org.apache.catalina.connector.Response.finishResponse(Response.java:4
> 76)
> at
> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.jav
> a:151)
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org