Tomcat does not honor acceptCount configuration variable

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
17 messages Options
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Tomcat does not honor acceptCount configuration variable

Timir Hazarika
Folks,

What is the best way to limit connections in tomcat, if there is one ? I
have tried acceptCount, maxThreads, even specifying explicit executor - but
in vain.

    <Connector port="8080" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="8443" acceptCount="5" maxThreads="5" />

Thanks in advance,
Timir
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

RE: Tomcat does not honor acceptCount configuration variable

Caldarale, Charles R
> From: Timir Hazarika [mailto:[hidden email]]
> Subject: Tomcat does not honor acceptCount configuration variable
>
> What is the best way to limit connections in tomcat, if there is one ?

Somewhat depends on what you think "connection" means.  If you're actually referring to sessions, you'll have to limit that based on logic in your webapp, usually implemented in an HttpSessionListener (read the servlet spec for how to configure one).

> I have tried acceptCount

The acceptCount is the value used by the platform's TCP/IP stack to limit the number of HTTP connection requests held in a queue.  The number actually in the queue at any given time is invisible to Tomcat.

> maxThreads

The maxThreads settings limits the number of requests that Tomcat will handle concurrently.  For the JIO <Connector>, that's also the number of active HTTP connections using keep-alive, since there's a thread dedicated to each active connection.  For the NIO and APR connectors, threads are not dedicated to HTTP connections, so it's purely the concurrent request limit.

> explicit executor

This is simply a way of sharing a thread pool across multiple <Connector> elements, nothing more.

So what exactly are you trying to limit?

 - Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.


---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Tomcat does not honor acceptCount configuration variable

Timir Hazarika
Chuck,

I would like tomcat to use a maximum of (say) 5 sockets on my system.
Further connection requests should be dropped. How may I achieve that ?

> The acceptCount is the value used by the platform's TCP/IP stack
> to limit the number of HTTP connection requests held in a queue.
> The number actually in the queue at any given time is invisible to
> Tomcat.

Which API is consumed by tomcat to relay the parameter to platform ?

Timir
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

RE: Tomcat does not honor acceptCount configuration variable

Caldarale, Charles R
> From: Timir Hazarika [mailto:[hidden email]]
> Subject: Re: Tomcat does not honor acceptCount configuration variable
>
> I would like tomcat to use a maximum of (say) 5 sockets on my system.
> Further connection requests should be dropped. How may I achieve that ?

There's no direct control for the number of sockets, but you should be able to limit the number of concurrent HTTP connections by setting maxThreads to 5 and acceptCount to zero, and using the JIO connector or disabling keep-alives.  There will still be some additional sockets used for the shutdown port, DB connections, etc.

 - Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.


---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Tomcat does not honor acceptCount configuration variable

Timir Hazarika
You just lost me. How would this configuration look like in server.xml ?

Timir

On Thu, Apr 8, 2010 at 9:09 PM, Caldarale, Charles R <
[hidden email]> wrote:

> > From: Timir Hazarika [mailto:[hidden email]]
> > Subject: Re: Tomcat does not honor acceptCount configuration variable
> >
> > I would like tomcat to use a maximum of (say) 5 sockets on my system.
> > Further connection requests should be dropped. How may I achieve that ?
>
> There's no direct control for the number of sockets, but you should be able
> to limit the number of concurrent HTTP connections by setting maxThreads to
> 5 and acceptCount to zero, and using the JIO connector or disabling
> keep-alives.  There will still be some additional sockets used for the
> shutdown port, DB connections, etc.
>
>  - Chuck
>
>
> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
> MATERIAL and is thus for use only by the intended recipient. If you received
> this in error, please contact the sender and delete the e-mail and its
> attachments from all computers.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [hidden email]
> For additional commands, e-mail: [hidden email]
>
>
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Tomcat does not honor acceptCount configuration variable

Caldarale, Charles R
On Apr 8, 2010, at 13:37, "Timir Hazarika" <[hidden email]>  
wrote:

> How would this configuration look like in server.xml ?

<Connector ... maxThreads="5" acceptCount="0" />

  - Chuck


---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Tomcat does not honor acceptCount configuration variable

Timir Hazarika
Chuck, this is the same configuration as in my initial question, except for
the value of accept count. I've already tried setting it to zero as well :

Folks,

What is the best way to limit connections in tomcat, if there is one ? I
> have tried acceptCount, maxThreads, even specifying explicit executor - but
> in vain.    <Connector port="8080" protocol="HTTP/1.1"

               connectionTimeout="20000"

               redirectPort="8443" acceptCount="5" maxThreads="5" />


Or am I missing something ?

Timir

On Fri, Apr 9, 2010 at 6:46 AM, Caldarale, Charles R <
[hidden email]> wrote:

> On Apr 8, 2010, at 13:37, "Timir Hazarika" <[hidden email]>
> wrote:
>
> > How would this configuration look like in server.xml ?
>
> <Connector ... maxThreads="5" acceptCount="0" />
>
>  - Chuck
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [hidden email]
> For additional commands, e-mail: [hidden email]
>
>
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Tomcat does not honor acceptCount configuration variable

markt
On 09/04/2010 10:55, Timir Hazarika wrote:

> Chuck, this is the same configuration as in my initial question, except for
> the value of accept count. I've already tried setting it to zero as well :
>
> Folks,
>
> What is the best way to limit connections in tomcat, if there is one ? I
>> have tried acceptCount, maxThreads, even specifying explicit executor - but
>> in vain.<Connector port="8080" protocol="HTTP/1.1"
>
>                 connectionTimeout="20000"
>
>                 redirectPort="8443" acceptCount="5" maxThreads="5" />
>
>
> Or am I missing something ?

Telling us how you are determining that these settings are not being
honored.

Mark



---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Tomcat does not honor acceptCount configuration variable

Timir Hazarika
Mark, I'm using netstat as follows. You can see the tomcat process listening
on 8443 and all the incoming requests in TIME_WAIT. These connections do get
cleared after the default timeout of 60 seconds, my intention is to refuse
creating them in the first place.

netstat -anp | grep 8443

tcp        0      0 0.0.0.0:8443            0.0.0.0:*               LISTEN
   15450/java
tcp        0      0 10.64.62.101:8443       72.163.140.73:19735
TIME_WAIT   -
tcp        0      0 10.64.62.101:8443       72.163.140.73:19744
TIME_WAIT   -
tcp        0      0 10.64.62.101:8443       72.163.140.73:19746
TIME_WAIT   -
tcp        0      0 10.64.62.101:8443       72.163.140.73:19730
TIME_WAIT   -
tcp        0      0 10.64.62.101:8443       72.163.140.73:19745
TIME_WAIT   -
tcp        0      0 10.64.62.101:8443       72.163.140.73:19732
TIME_WAIT   -
tcp        0      0 10.64.62.101:8443       72.163.140.73:19737
TIME_WAIT   -
tcp        0      0 10.64.62.101:8443       72.163.140.73:19742
TIME_WAIT   -
tcp        0      0 10.64.62.101:8443       72.163.140.73:19733
TIME_WAIT   -
tcp        0      0 10.64.62.101:8443       72.163.140.73:19741
TIME_WAIT   -
tcp        0      0 10.64.62.101:8443       72.163.140.73:19747
TIME_WAIT   -
tcp        0      0 10.64.62.101:8443       72.163.140.73:19740
TIME_WAIT   -
tcp        0      0 10.64.62.101:8443       72.163.140.73:19731
TIME_WAIT   -
tcp        0      0 10.64.62.101:8443       72.163.140.73:19743
TIME_WAIT   -
tcp        0      0 10.64.62.101:8443       72.163.140.73:19734
TIME_WAIT   -
tcp        0      0 10.64.62.101:8443       72.163.140.73:19736
TIME_WAIT   -
tcp        0      0 10.64.62.101:8443       72.163.140.73:19738
TIME_WAIT   -
tcp        0      0 10.64.62.101:8443       72.163.140.73:19739
TIME_WAIT   -
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Tomcat does not honor acceptCount configuration variable

Leon Rosenberg-3
I remember a more or less public discussion some time ago, that the
acceptCount setting is virtually worthless, because modern kernels
simply ignore it.

Leon

P.S. By ignore I mean that ServerSocket.accept(100) has no effect.

On Fri, Apr 9, 2010 at 2:10 PM, Timir Hazarika <[hidden email]> wrote:

> Mark, I'm using netstat as follows. You can see the tomcat process listening
> on 8443 and all the incoming requests in TIME_WAIT. These connections do get
> cleared after the default timeout of 60 seconds, my intention is to refuse
> creating them in the first place.
>
> netstat -anp | grep 8443
>
> tcp        0      0 0.0.0.0:8443            0.0.0.0:*               LISTEN
>   15450/java
> tcp        0      0 10.64.62.101:8443       72.163.140.73:19735
> TIME_WAIT   -
> tcp        0      0 10.64.62.101:8443       72.163.140.73:19744
> TIME_WAIT   -
> tcp        0      0 10.64.62.101:8443       72.163.140.73:19746
> TIME_WAIT   -
> tcp        0      0 10.64.62.101:8443       72.163.140.73:19730
> TIME_WAIT   -
> tcp        0      0 10.64.62.101:8443       72.163.140.73:19745
> TIME_WAIT   -
> tcp        0      0 10.64.62.101:8443       72.163.140.73:19732
> TIME_WAIT   -
> tcp        0      0 10.64.62.101:8443       72.163.140.73:19737
> TIME_WAIT   -
> tcp        0      0 10.64.62.101:8443       72.163.140.73:19742
> TIME_WAIT   -
> tcp        0      0 10.64.62.101:8443       72.163.140.73:19733
> TIME_WAIT   -
> tcp        0      0 10.64.62.101:8443       72.163.140.73:19741
> TIME_WAIT   -
> tcp        0      0 10.64.62.101:8443       72.163.140.73:19747
> TIME_WAIT   -
> tcp        0      0 10.64.62.101:8443       72.163.140.73:19740
> TIME_WAIT   -
> tcp        0      0 10.64.62.101:8443       72.163.140.73:19731
> TIME_WAIT   -
> tcp        0      0 10.64.62.101:8443       72.163.140.73:19743
> TIME_WAIT   -
> tcp        0      0 10.64.62.101:8443       72.163.140.73:19734
> TIME_WAIT   -
> tcp        0      0 10.64.62.101:8443       72.163.140.73:19736
> TIME_WAIT   -
> tcp        0      0 10.64.62.101:8443       72.163.140.73:19738
> TIME_WAIT   -
> tcp        0      0 10.64.62.101:8443       72.163.140.73:19739
> TIME_WAIT   -
>

---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Tomcat does not honor acceptCount configuration variable

Timir Hazarika
My point exactly. Is there an alternative setting that I may use ?

Timir

On Fri, Apr 9, 2010 at 5:47 PM, Leon Rosenberg <
[hidden email]> wrote:

> I remember a more or less public discussion some time ago, that the
> acceptCount setting is virtually worthless, because modern kernels
> simply ignore it.
>
> Leon
>
> P.S. By ignore I mean that ServerSocket.accept(100) has no effect.
>
> On Fri, Apr 9, 2010 at 2:10 PM, Timir Hazarika <[hidden email]>
> wrote:
> > Mark, I'm using netstat as follows. You can see the tomcat process
> listening
> > on 8443 and all the incoming requests in TIME_WAIT. These connections do
> get
> > cleared after the default timeout of 60 seconds, my intention is to
> refuse
> > creating them in the first place.
> >
> > netstat -anp | grep 8443
> >
> > tcp        0      0 0.0.0.0:8443            0.0.0.0:*
> LISTEN
> >   15450/java
> > tcp        0      0 10.64.62.101:8443       72.163.140.73:19735
> > TIME_WAIT   -
> > tcp        0      0 10.64.62.101:8443       72.163.140.73:19744
> > TIME_WAIT   -
> > tcp        0      0 10.64.62.101:8443       72.163.140.73:19746
> > TIME_WAIT   -
> > tcp        0      0 10.64.62.101:8443       72.163.140.73:19730
> > TIME_WAIT   -
> > tcp        0      0 10.64.62.101:8443       72.163.140.73:19745
> > TIME_WAIT   -
> > tcp        0      0 10.64.62.101:8443       72.163.140.73:19732
> > TIME_WAIT   -
> > tcp        0      0 10.64.62.101:8443       72.163.140.73:19737
> > TIME_WAIT   -
> > tcp        0      0 10.64.62.101:8443       72.163.140.73:19742
> > TIME_WAIT   -
> > tcp        0      0 10.64.62.101:8443       72.163.140.73:19733
> > TIME_WAIT   -
> > tcp        0      0 10.64.62.101:8443       72.163.140.73:19741
> > TIME_WAIT   -
> > tcp        0      0 10.64.62.101:8443       72.163.140.73:19747
> > TIME_WAIT   -
> > tcp        0      0 10.64.62.101:8443       72.163.140.73:19740
> > TIME_WAIT   -
> > tcp        0      0 10.64.62.101:8443       72.163.140.73:19731
> > TIME_WAIT   -
> > tcp        0      0 10.64.62.101:8443       72.163.140.73:19743
> > TIME_WAIT   -
> > tcp        0      0 10.64.62.101:8443       72.163.140.73:19734
> > TIME_WAIT   -
> > tcp        0      0 10.64.62.101:8443       72.163.140.73:19736
> > TIME_WAIT   -
> > tcp        0      0 10.64.62.101:8443       72.163.140.73:19738
> > TIME_WAIT   -
> > tcp        0      0 10.64.62.101:8443       72.163.140.73:19739
> > TIME_WAIT   -
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [hidden email]
> For additional commands, e-mail: [hidden email]
>
>
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Tomcat does not honor acceptCount configuration variable

Christopher Schultz-2
In reply to this post by Timir Hazarika
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Timir,

On 4/9/2010 8:10 AM, Timir Hazarika wrote:
> Mark, I'm using netstat as follows. You can see the tomcat process listening
> on 8443 and all the incoming requests in TIME_WAIT. These connections do get
> cleared after the default timeout of 60 seconds, my intention is to refuse
> creating them in the first place.

You can't refuse "creating" a TIME_WAIT socket: it's the result of
handling a socket and then closing it. You might want to review the TCP
connection states here:

http://en.wikipedia.org/wiki/Transmission_Control_Protocol#Protocol_operation

This is not an accept problem, this is a problem with having serviced a
request via a socket and then closing the connection. Given that you
can't avoid accepting connections on a useful web server, you will not
be able to prevent them from going through their natural lifecycle.

- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAku/QWkACgkQ9CaO5/Lv0PC1tACeOPKViy9KHPbK35tqWjmRKB8S
kmUAn0q85D72X0Jep0O/T7yy/brveI/R
=5N1X
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Tomcat does not honor acceptCount configuration variable

Timir Hazarika
>
>
> This is not an accept problem, this is a problem with having serviced a

request via a socket and then closing the connection. Given that you

can't avoid accepting connections on a useful web server, you will not

be able to prevent them from going through their natural lifecycle.


>
Chris,

Thanks. I finally chose to write my own endpoint/HTTP protocol handler to
better address the use case of immediate connection reset under load
conditions. The acceptor logic in custom code simply closes socket when
there's no free worker available.

You'll notice in current implementation of tomcat JIOEndpoint, that the
acceptor thread waits for a free worker thread instead.

Timir
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Tomcat does not honor acceptCount configuration variable

André Warnier (tomcat)
Timir Hazarika wrote:

>>
>> This is not an accept problem, this is a problem with having serviced a
>
> request via a socket and then closing the connection. Given that you
>
> can't avoid accepting connections on a useful web server, you will not
>
> be able to prevent them from going through their natural lifecycle.
>
>
> Chris,
>
> Thanks. I finally chose to write my own endpoint/HTTP protocol handler to
> better address the use case of immediate connection reset under load
> conditions. The acceptor logic in custom code simply closes socket when
> there's no free worker available.
>
> You'll notice in current implementation of tomcat JIOEndpoint, that the
> acceptor thread waits for a free worker thread instead.
>

I guess I do not understand what your custom code achieves, as compared
to just setting the acceptCount attribute to 1 or so.

Suppose one request takes approximately 3 s to process.

Suppose that at time T0, you have 100 worker threads available to
process requests.
Starting at time T0, 110 requests (R001-R110) arrive, inside a 3-second
period.
The first 100 (R001-R100) will get a free worker.
The next 10 (R101-R110) will be rejected, since there is no free worker.
At time T0 + 3.02s, the worker who got the first request R001 finishes,
and becomes available.
At time T0 + 3.03s, a new request R111 comes in.
It will find an available worker and will be processed.
So, requests R101-R110 which came in first are rejected, but request
R111 which came in much later is accepted.

Suppose instead we have the normal scheme, with an accept queue length
of 100 (acceptCount="100").

Suppose that at time T0, you have 100 worker threads available to
process requests.
Starting at time T0, 110 requests (R001-R110) arrive, inside of a
3-second period.
The first 100 (R001-R100) will get a free worker, and start being
processed right away.
The next 10 (R101-R110) will be queued, since there is no free worker.
At time T0 + 3.02s, the worker who got the first request R001 finishes,
and becomes available.
Request R101 is now accepted, and starts being processed.
At time T0 + 3.03s, a new request R111 comes in.
There is no available worker, so it will be queued, behind R110.
As soon as workers becomes available, R102-R111 will be processed, in
the order in which they came in.
It is only if the accept queue gets to be totally full (with 100
requests being processed, and 100 waiting), that subsequent requests
would start to be discarded.

The socket accept queue is basically a "shock absorber".  It allows a
temporary surge in requests to be absorbed, while workers are
temporarily overloaded.  As soon as some capacity is available, the
first request in that queue will be accepted and processed. Then the
next one..  By increasing/decreasing the acceptCount, you determine how
big your shock absorber is, without using up too many resources.

With your scheme, you are just transforming this shock absorber into a
rigid closed door, equivalent to setting acceptCount to 1.  And you are
allowing some requests to "jump the queue" compared to others.

Or did I miss something ?




---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Tomcat does not honor acceptCount configuration variable

Timir Hazarika
Andre,

Response from Leon just about summarizes this issue: the shock absorber you
mention is not configurable. Setting the acceptCount to 1 or nine hundred
produces exactly the same behavior in terms of connections awaiting
response.

The "stricter" scheme hence, serves as a usable application workaround for
now.

Timir
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Tomcat does not honor acceptCount configuration variable

André Warnier (tomcat)
Timir Hazarika wrote:
> Andre,
>
> Response from Leon just about summarizes this issue: the shock absorber you
> mention is not configurable. Setting the acceptCount to 1 or nine hundred
> produces exactly the same behavior in terms of connections awaiting
> response.
>
Then that would be a bug, no ? In the sense that the documentation says :

acceptCount

The maximum queue length for incoming connection requests when all
possible request processing threads are in use. Any requests received
when the queue is full will be refused. The default value is 100.

http://tomcat.apache.org/tomcat-6.0-doc/config/http.html

> The "stricter" scheme hence, serves as a usable application workaround for
> now.
>
If the above bug is real, then yes, it makes a difference.
I still believe that handling this at the level of a front-end makes
more sense.  At least there, you can return something nice rather than
brutally rejecting the connection, and you can also examine the request
to determine if you really want to block it or not.


---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Tomcat does not honor acceptCount configuration variable

Jess Holle
If you're talking about the non-native AJP connector, then this is a
long-standing issue.

acceptCount is essentially ignored in this case and all concurrent
requests above pool size /minus 2/ go off into limbo and are not handled
properly.  I don't understand the off-by-2 error, but it is clearly there.

If you're talking about some other connector, then I cannot speak to
that -- as I use the pure Java (non-NIO for stability) connector.  
Native connectors are just too painful to build, update, and
troubleshoot across all the platforms I deal with.  This clearly isn't
going to change no matter how stable these connectors are and I need to
use Apache anyway, so native connectors are a dead end.  It's either
old-IO or NIO, but it needs to be pure Java for me.

--
Jess Holle

On 5/10/2010 7:35 AM, André Warnier wrote:

> Timir Hazarika wrote:
>> Andre,
>>
>> Response from Leon just about summarizes this issue: the shock
>> absorber you
>> mention is not configurable. Setting the acceptCount to 1 or nine
>> hundred
>> produces exactly the same behavior in terms of connections awaiting
>> response.
>>
> Then that would be a bug, no ? In the sense that the documentation says :
>
> acceptCount
>
> The maximum queue length for incoming connection requests when all
> possible request processing threads are in use. Any requests received
> when the queue is full will be refused. The default value is 100.
>
> http://tomcat.apache.org/tomcat-6.0-doc/config/http.html
>
>> The "stricter" scheme hence, serves as a usable application
>> workaround for
>> now.
>>
> If the above bug is real, then yes, it makes a difference.
> I still believe that handling this at the level of a front-end makes
> more sense.  At least there, you can return something nice rather than
> brutally rejecting the connection, and you can also examine the
> request to determine if you really want to block it or not.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [hidden email]
> For additional commands, e-mail: [hidden email]
>
>

Loading...