isapi_redirector.dll Problems - Bad Gateway?

[amythyst]

Hi, I am trying to get an application called JIRA to work externally on our
corporate domain. We believe we have everything set up properly and have
followed numoerous online instructions. The default website in IIS (version
6) is up and the ISAPI filter is "loaded" with the green light. However,
when we go to the website we're getting a "Bad Gateway" error and the ISAPI
logs say this:

[Thu Dec 16 11:20:10.559 2010] [1508:1800] [error]
ajp_get_reply::jk_ajp_common.c (2058): (worker1) Tomcat is down or refused
connection. No response has been sent to the client (yet)

[Thu Dec 16 11:20:10.559 2010] [1508:1800] [info]
ajp_service::jk_ajp_common.c (2543): (worker1) sending request to tomcat
failed (recoverable), because of protocol error (attempt=1)

[Thu Dec 16 11:20:10.559 2010] [1508:1800] [debug]
ajp_service::jk_ajp_common.c (2400): retry 1, sleeping for 100 ms before
retrying

[Thu Dec 16 11:20:10.668 2010] [1508:1800] [debug]
ajp_send_request::jk_ajp_common.c (1572): (worker1) all endpoints are
disconnected.

[Thu Dec 16 11:20:10.668 2010] [1508:1800] [debug]
jk_open_socket::jk_connect.c (484): socket TCP_NODELAY set to On

Could really really use some help here. Please let me know what additional
info you need to assist.

[Michael Ludwig]

The default website in IIS (version 6) is up and the ISAPI filter is
"loaded" with the green light. However, when we go to the website
[Thu Dec 16 11:20:10.559 2010] [1508:1800] [error]
ajp_get_reply::jk_ajp_common.c (2058): (worker1) Tomcat is down or
refused connection. No response has been sent to the client (yet)

Does Tomcat have an AJP connector configured for the port the ISAPI
is expecting? Have you tried to run netstat?

netstat -an -p tcp

There should be something listening on the AJP port, probably 8009.

Do you have a firewall that might block Tomcat?

You could post your worker.properties file to provide further
information.

[amythyst]

Hi, yes we have a connector configured for port 8009. And tomcat is
listening on port 8009. Question about the firewall... IIS is set up for
port 8081 and 443 for our default website. The application is running on
8080 and 8443. And as I said, tomcat is listening on 8009 to route traffic
to the application. In the firewall, I believe the network guy has set up
port 8081 to allow traffic inside. Does he also need to do something for
8009 or 8080 and 8443? We are running the app with SSL, so it would be the
secure ports I should be focusing on right? Below are my worker files for
the connector:

# uriworkermap.properties - IIS
#
# This file provides mappings for the workers
# defined in workermap.properties.minimal.
# The general syntax for this file is:
# [URL]=[Worker name]

/jira/*=worker1

# workers.properties.minimal -
#
# This file provides minimal jk configuration properties needed to
# connect to Tomcat.

#
# The workers that jk should create and work with.
#
worker.list=worker1

#
# Defining a worker named worker1 and of type ajp13.
# Note that the name and the type do not have to match.
#
worker.worker1.type=ajp13
worker.worker1.host=localhost
worker.worker1.port=8009

Post by Michael Ludwig

The default website in IIS (version 6) is up and the ISAPI filter is
"loaded" with the green light. However, when we go to the website
[Thu Dec 16 11:20:10.559 2010] [1508:1800] [error]
ajp_get_reply::jk_ajp_common.c (2058): (worker1) Tomcat is down or
refused connection. No response has been sent to the client (yet)

Does Tomcat have an AJP connector configured for the port the ISAPI
is expecting? Have you tried to run netstat?
netstat -an -p tcp
There should be something listening on the AJP port, probably 8009.
Do you have a firewall that might block Tomcat?
You could post your worker.properties file to provide further
information.
--
Michael Ludwig
---------------------------------------------------------------------

[Michael Ludwig]

Post by amythyst
Hi, yes we have a connector configured for port 8009.

Configured, okay; but it is not replying to your redirector's requests.
You can test AJP connectivity using this Perl script:

http://www.perlmonks.org/?node_id=766945

Post by amythyst
Question about the firewall... IIS is set up for port 8081 and 443
for our default website. The application is running on 8080 and
8443. And as I said, tomcat is listening on 8009 to route traffic to
the application. In the firewall, I believe the network guy has set
up port 8081 to allow traffic inside. Does he also need to do
something for 8009 or 8080 and 8443?

He needs to allow Tomcat to listen on 8009, and IIS to connect to
tomcat-server:8009. The other two ports your Tomcat is configured to
listen on should be irrelevant as far as the ISAPI redirector is
concerned; it does AJP, not HTTP or HTTPS.

Post by amythyst
We are running the app with SSL, so it would be the secure ports I
should be focusing on right?

Not for the AJP connection between IIS and Tomcat.

Post by amythyst
# uriworkermap.properties - IIS
/jira/*=worker1

Okay.

Post by amythyst
# workers.properties.minimal -
worker.list=worker1
worker.worker1.type=ajp13
worker.worker1.host=localhost
worker.worker1.port=8009

Also okay. If you don't configure the connection_pool_size, the
default applies, which is 250 for IIS.

http://tomcat.apache.org/connectors-doc/reference/workers.html

How many threads have you configured for your AJP connector?

[amythyst]

Thanks for the reply.

With that script, how exactly would I execute that script?
Pardon my ignorance, but I am a database developer that has been thrown into
networking because our network admin is at a loss to what the problem is and
doesn't seem keen on fixing it.

According to him, all the ports that we are using are open on the
firewall... 8080, 8081, 443, 8443 and 8009. Tomcat is set to listen on port
8009 and I have configured the server.xml file to accept requests from 8009.

When you ask how many threads I have configured you're talking about worker
threads right? I only have the one.

Post by Michael Ludwig

Post by amythyst
Hi, yes we have a connector configured for port 8009.

Configured, okay; but it is not replying to your redirector's requests.
http://www.perlmonks.org/?node_id=766945

Post by amythyst
Question about the firewall... IIS is set up for port 8081 and 443
for our default website. The application is running on 8080 and
8443. And as I said, tomcat is listening on 8009 to route traffic to
the application. In the firewall, I believe the network guy has set
up port 8081 to allow traffic inside. Does he also need to do
something for 8009 or 8080 and 8443?

He needs to allow Tomcat to listen on 8009, and IIS to connect to
tomcat-server:8009. The other two ports your Tomcat is configured to
listen on should be irrelevant as far as the ISAPI redirector is
concerned; it does AJP, not HTTP or HTTPS.

Post by amythyst
We are running the app with SSL, so it would be the secure ports I
should be focusing on right?

Not for the AJP connection between IIS and Tomcat.

Post by amythyst
# uriworkermap.properties - IIS
/jira/*=worker1

Okay.

Post by amythyst
# workers.properties.minimal -
worker.list=worker1
worker.worker1.type=ajp13
worker.worker1.host=localhost
worker.worker1.port=8009

Also okay. If you don't configure the connection_pool_size, the
default applies, which is 250 for IIS.
http://tomcat.apache.org/connectors-doc/reference/workers.html
How many threads have you configured for your AJP connector?
--
Michael Ludwig
---------------------------------------------------------------------

[André Warnier]

oh oh. So it looks like you have been thrown to the wolves, he ?
The positive side of it, is that if you solve it, you'll be the star.

Time for some ascii-art I think.

Except for firewalls, you have the following schema :


Browser-1 <---> <---> - webapp
Browser-2 <---> IIS + IR <---> AJP + Tomcat - webapp
... <---> - webapp
Browser-n <---> <---> - webapp

The dotted lines represent TCP/IP connections.
IIS + IR : IIS plus the Isapi_Redirector module
AJP + Tomcat : The Tomcat <Connector protocol="AJP"> module, plus Tomcat itself, and then
the applications (webapps) running in Tomcat.

A request starts at the browser, goes to IIS over a connection to port 80 (if simple
HTTP), or port 443 (if HTTPS).
IIS sees that this request is really for Tomcat, so it passes it to its Isapi_redirector
module.
The Isapi_redirector module creates another connection to Tomcat's AJP "Connector", this
time over port 8009, where presumably this AJP connector is listening.
When the AJP connector receives the request, it creates a "thread" in Tomcat to handle
this request.
A thread is like a sub-process of tomcat; it is created to process one request, and will
disappear when this request is processsed and it has sent the response.
To create the response, the thread "runs" one of the webapps.

Now to clear some side-issues :
- the protocol/format used between the browsers and IIS may be HTTP or HTTPS (SSL),
- but the protocol/format between the "IR" module on the IIS side, and the "AJP" module on
the Tomcat side, is neither. It is using a special protocol/format named AJP. (So the
notion of SSL is not relevant here; the decryption already happens at the IIS level, and
over the AJP connection the data flows essentially "in clear".)

For this whole scheme to work, there are a few pre-requisites :
- the browsers must be able to establish a TCP/IP connection to the IIS server. I guess
that part works.
- the IIS server (and its IR module), must be able to establish a TCP connection to the
AJP module of Tomcat, which is usually configured to "listen" on port # 8009.
- the numbers of requests sent at the same time by the sum of all the browsers, needs to
be more or less matched to the number of connections that the IR module and the AJP module
can establish between themselves (otherwise some browser requests would never reach Tomcat)
- the number of simultaneous threads that the AJP connector can start inside of Tomcat,
must also be more or less matched to the number of browser requests. Otherwise, requests
would pile up and have to wait, for a thread to become available to take care of them.
In the long term, that is not sustainable.

So the first thing here, would be to make sure that the Tomcat AJP connector is really
listening on port 8009. The wish for that is indicated, inside your server.xml, by a tag
like :
<Connector port="8009" protocol="AJP/1.3" ... />
Do you have such a tag ?

The second step would be to verify that it is really listening there.
For that, you could use the "netstat" command in a command window on the server, as follows :

netstat -aon -p tcp

and look for a line that looks like this :

TCP 0.0.0.0:8009 0.0.0.0:0 LISTEN 2704

(the important part being that ":8009" part)

Do you see that ?

Post by amythyst
Thanks for the reply.
With that script, how exactly would I execute that script?
Pardon my ignorance, but I am a database developer that has been thrown into
networking because our network admin is at a loss to what the problem is and
doesn't seem keen on fixing it.
According to him, all the ports that we are using are open on the
firewall... 8080, 8081, 443, 8443 and 8009. Tomcat is set to listen on port
8009 and I have configured the server.xml file to accept requests from 8009.
When you ask how many threads I have configured you're talking about worker
threads right? I only have the one.

Post by Michael Ludwig

Post by amythyst
Hi, yes we have a connector configured for port 8009.

Configured, okay; but it is not replying to your redirector's requests.
http://www.perlmonks.org/?node_id=766945

Post by amythyst
Question about the firewall... IIS is set up for port 8081 and 443
for our default website. The application is running on 8080 and
8443. And as I said, tomcat is listening on 8009 to route traffic to
the application. In the firewall, I believe the network guy has set
up port 8081 to allow traffic inside. Does he also need to do
something for 8009 or 8080 and 8443?

He needs to allow Tomcat to listen on 8009, and IIS to connect to
tomcat-server:8009. The other two ports your Tomcat is configured to
listen on should be irrelevant as far as the ISAPI redirector is
concerned; it does AJP, not HTTP or HTTPS.

Post by amythyst
We are running the app with SSL, so it would be the secure ports I
should be focusing on right?

Not for the AJP connection between IIS and Tomcat.

Post by amythyst
# uriworkermap.properties - IIS
/jira/*=worker1

Okay.

Post by amythyst
# workers.properties.minimal -
worker.list=worker1
worker.worker1.type=ajp13
worker.worker1.host=localhost
worker.worker1.port=8009

Also okay. If you don't configure the connection_pool_size, the
default applies, which is 250 for IIS.
http://tomcat.apache.org/connectors-doc/reference/workers.html
How many threads have you configured for your AJP connector?
--
Michael Ludwig
---------------------------------------------------------------------

[amythyst]

Yes, exactly. I have been thrown to the wolves and it is really causing a
problem because our application rollout schedule has been pushed back
because of this problem and its been going on for like 3 weeks. The other
annoying thing is that the application vendor does not support getting the
app to work externally, so I have no real help desk to turn to.

Thank you for the further details... "I'm with ya".

I have the following connector string in my server.xml file:

<Connector port="8009" redirectPort="8443" enableLookups="false"
protocol="AJP/1.3" URIEncoding="UTF-8"/>

I will attach the file itself to make sure you guys think it looks ok.

I ran the netstat command you gave me... lots of stuff there! But I do see
this:

TCP 0.0.0.0:8009 0.0.0.0:0 LISTENING 4

Thanks in advance!

Post by André Warnier
oh oh. So it looks like you have been thrown to the wolves, he ?
The positive side of it, is that if you solve it, you'll be the star.
Time for some ascii-art I think.
Browser-1 <---> <---> - webapp
Browser-2 <---> IIS + IR <---> AJP + Tomcat - webapp
... <---> - webapp
Browser-n <---> <---> - webapp
The dotted lines represent TCP/IP connections.
IIS + IR : IIS plus the Isapi_Redirector module
AJP + Tomcat : The Tomcat <Connector protocol="AJP"> module, plus Tomcat itself, and then
the applications (webapps) running in Tomcat.
A request starts at the browser, goes to IIS over a connection to port 80 (if simple
HTTP), or port 443 (if HTTPS).
IIS sees that this request is really for Tomcat, so it passes it to its Isapi_redirector
module.
The Isapi_redirector module creates another connection to Tomcat's AJP "Connector", this
time over port 8009, where presumably this AJP connector is listening.
When the AJP connector receives the request, it creates a "thread" in Tomcat to handle
this request.
A thread is like a sub-process of tomcat; it is created to process one request, and will
disappear when this request is processsed and it has sent the response.
To create the response, the thread "runs" one of the webapps.
- the protocol/format used between the browsers and IIS may be HTTP or HTTPS (SSL),
- but the protocol/format between the "IR" module on the IIS side, and the "AJP" module on
the Tomcat side, is neither. It is using a special protocol/format named AJP. (So the
notion of SSL is not relevant here; the decryption already happens at the IIS level, and
over the AJP connection the data flows essentially "in clear".)
- the browsers must be able to establish a TCP/IP connection to the IIS server. I guess
that part works.
- the IIS server (and its IR module), must be able to establish a TCP connection to the
AJP module of Tomcat, which is usually configured to "listen" on port # 8009.
- the numbers of requests sent at the same time by the sum of all the browsers, needs to
be more or less matched to the number of connections that the IR module and the AJP module
can establish between themselves (otherwise some browser requests would never reach Tomcat)
- the number of simultaneous threads that the AJP connector can start inside of Tomcat,
must also be more or less matched to the number of browser requests.
Otherwise, requests
would pile up and have to wait, for a thread to become available to take care of them.
In the long term, that is not sustainable.
So the first thing here, would be to make sure that the Tomcat AJP connector is really
listening on port 8009. The wish for that is indicated, inside your server.xml, by a tag
<Connector port="8009" protocol="AJP/1.3" ... />
Do you have such a tag ?
The second step would be to verify that it is really listening there.
For that, you could use the "netstat" command in a command window on the
netstat -aon -p tcp
TCP 0.0.0.0:8009 0.0.0.0:0 LISTEN
2704
(the important part being that ":8009" part)
Do you see that ?

Post by amythyst
Thanks for the reply.
With that script, how exactly would I execute that script?
Pardon my ignorance, but I am a database developer that has been thrown into
networking because our network admin is at a loss to what the problem is and
doesn't seem keen on fixing it.
According to him, all the ports that we are using are open on the
firewall... 8080, 8081, 443, 8443 and 8009. Tomcat is set to listen on port
8009 and I have configured the server.xml file to accept requests from 8009.
When you ask how many threads I have configured you're talking about worker
threads right? I only have the one.

Post by Michael Ludwig

Post by amythyst
Hi, yes we have a connector configured for port 8009.

Configured, okay; but it is not replying to your redirector's requests.
http://www.perlmonks.org/?node_id=766945

Post by amythyst
Question about the firewall... IIS is set up for port 8081 and 443
for our default website. The application is running on 8080 and
8443. And as I said, tomcat is listening on 8009 to route traffic to
the application. In the firewall, I believe the network guy has set
up port 8081 to allow traffic inside. Does he also need to do
something for 8009 or 8080 and 8443?

He needs to allow Tomcat to listen on 8009, and IIS to connect to
tomcat-server:8009. The other two ports your Tomcat is configured to
listen on should be irrelevant as far as the ISAPI redirector is
concerned; it does AJP, not HTTP or HTTPS.

Post by amythyst
We are running the app with SSL, so it would be the secure ports I
should be focusing on right?

Not for the AJP connection between IIS and Tomcat.

Post by amythyst
# uriworkermap.properties - IIS
/jira/*=worker1

Okay.

Post by amythyst
# workers.properties.minimal -
worker.list=worker1
worker.worker1.type=ajp13
worker.worker1.host=localhost
worker.worker1.port=8009

Also okay. If you don't configure the connection_pool_size, the
default applies, which is 250 for IIS.
http://tomcat.apache.org/connectors-doc/reference/workers.html
How many threads have you configured for your AJP connector?
--
Michael Ludwig
---------------------------------------------------------------------

---------------------------------------------------------------------

[amythyst]

Sorry for all the posts... I have a specific question... I'm reading the
isapi_redirector.log which shows the errors... it says things like this:

shutting down the read side of socket 576 [127.0.0.1:1145 ->
127.0.0.1:8009]

To me, it seems like its trying to connect to tomcat on 127.0.0.1:8009 but
tomcat is listening on 0.0.0.0:8009 ... does that make a difference?

[André Warnier]

Post by amythyst
Sorry for all the posts... I have a specific question... I'm reading the
shutting down the read side of socket 576 [127.0.0.1:1145 ->
127.0.0.1:8009]
To me, it seems like its trying to connect to tomcat on 127.0.0.1:8009 but
tomcat is listening on 0.0.0.0:8009 ... does that make a difference?

No. The 0.0.0.0:8009 essentially means that the Tomcat AJP connector is listening on port
8009, for /all/ this hosts's IP addresses.
127.0.0.1 happens to be one of these addresses, the one corresponding to the "loopback"
connection, fom this host to this host (and only valid for local in-same-host connections).

To pick up on the previous exchange:
- we have thus established that Tomcat is listening, with an AJP connector, on port 8009.

In isolation, the message above does not tell us much, except that it seems that some
process at least was having a connection with that Tomcat AJP port. And if you found that
line in the isapi_redirector log, then it must be that it was the isapi_redirector which
had that connection, then.

Mmm, the plot thickens.

I have to scroll back a little, to your first post(s), to find out what isn't working.
...
Are you still getting messages such as these ?

[Thu Dec 16 11:20:10.559 2010] [1508:1800] [error]
ajp_get_reply::jk_ajp_common.c (2058): (worker1) Tomcat is down or refused
connection. No response has been sent to the client (yet)

[Thu Dec 16 11:20:10.559 2010] [1508:1800] [info]
ajp_service::jk_ajp_common.c (2543): (worker1) sending request to tomcat
failed (recoverable), because of protocol error (attempt=1)

[Thu Dec 16 11:20:10.559 2010] [1508:1800] [debug]
ajp_service::jk_ajp_common.c (2400): retry 1, sleeping for 100 ms before
retrying

[Thu Dec 16 11:20:10.668 2010] [1508:1800] [debug]
ajp_send_request::jk_ajp_common.c (1572): (worker1) all endpoints are
disconnected.

[Thu Dec 16 11:20:10.668 2010] [1508:1800] [debug]
jk_open_socket::jk_connect.c (484): socket TCP_NODELAY set to On



Ok, let's do something :

a) under the Tomcat top directory, there is a directory called "webapps" (under which
presumably you already have a subdirectory called "jira").
At the same level as "jira", create another directory called "test", and copy some html
file into it, which you will rename as "test.html"
So you will have :
tomcat_top_dir/webapps/
jira/
(many files)
test/
test.html

b) in your "uriworkermap.properties" file, add the line

/test/*=worker1

c) then restart Tomcat and IIS

d) then from a browser, try to access :

d1) http://yourhostname:8081/test/test.html
(where 8081 is the port on which Tomcat listens with its HTTP protocol connector)

d2) http://yourhostname:80/test/test.html
(where 80) is the port on which IIS is listening)

Do both work and show the page "test.html" ?

[amythyst]

Yes, I'm still getting those error messages in the isapi_connector log.

I don't think the application installs a standard tomcat installation.
Basically, I have a directory in the program files folder called "Atlassian"
then under that I have JIRA 4.2. In that directory I have lots of folders
and one of them is conf and that is where my server.xml file is and some
other files. So, I'm not sure how I would test what you were suggesting.

Post by André Warnier

Post by amythyst
Sorry for all the posts... I have a specific question... I'm reading the
shutting down the read side of socket 576 [127.0.0.1:1145 ->
127.0.0.1:8009]
To me, it seems like its trying to connect to tomcat on 127.0.0.1:8009 but
tomcat is listening on 0.0.0.0:8009 ... does that make a difference?

No. The 0.0.0.0:8009 essentially means that the Tomcat AJP connector is listening on port
8009, for /all/ this hosts's IP addresses.
127.0.0.1 happens to be one of these addresses, the one corresponding to the "loopback"
connection, fom this host to this host (and only valid for local in-same-host connections).
- we have thus established that Tomcat is listening, with an AJP connector, on port 8009.
In isolation, the message above does not tell us much, except that it seems that some
process at least was having a connection with that Tomcat AJP port. And if you found that
line in the isapi_redirector log, then it must be that it was the isapi_redirector which
had that connection, then.
Mmm, the plot thickens.
I have to scroll back a little, to your first post(s), to find out what isn't working.
...
Are you still getting messages such as these ?
[Thu Dec 16 11:20:10.559 2010] [1508:1800] [error]
ajp_get_reply::jk_ajp_common.c (2058): (worker1) Tomcat is down or refused
connection. No response has been sent to the client (yet)
[Thu Dec 16 11:20:10.559 2010] [1508:1800] [info]
ajp_service::jk_ajp_common.c (2543): (worker1) sending request to tomcat
failed (recoverable), because of protocol error (attempt=1)
[Thu Dec 16 11:20:10.559 2010] [1508:1800] [debug]
ajp_service::jk_ajp_common.c (2400): retry 1, sleeping for 100 ms before
retrying
[Thu Dec 16 11:20:10.668 2010] [1508:1800] [debug]
ajp_send_request::jk_ajp_common.c (1572): (worker1) all endpoints are
disconnected.
[Thu Dec 16 11:20:10.668 2010] [1508:1800] [debug]
jk_open_socket::jk_connect.c (484): socket TCP_NODELAY set to On
a) under the Tomcat top directory, there is a directory called "webapps" (under which
presumably you already have a subdirectory called "jira").
At the same level as "jira", create another directory called "test", and copy some html
file into it, which you will rename as "test.html"
tomcat_top_dir/webapps/
jira/
(many files)
test/
test.html
b) in your "uriworkermap.properties" file, add the line
/test/*=worker1
c) then restart Tomcat and IIS
d1) http://yourhostname:8081/test/test.html
(where 8081 is the port on which Tomcat listens with its HTTP protocol connector)
d2) http://yourhostname:80/test/test.html
(where 80) is the port on which IIS is listening)
Do both work and show the page "test.html" ?
---------------------------------------------------------------------

[André Warnier]

Post by amythyst
Yes, I'm still getting those error messages in the isapi_connector log.
I don't think the application installs a standard tomcat installation.
Basically, I have a directory in the program files folder called "Atlassian"
then under that I have JIRA 4.2. In that directory I have lots of folders
and one of them is conf and that is where my server.xml file is and some
other files. So, I'm not sure how I would test what you were suggesting.

That also makes it quite difficult for someone here to help you, because we have no idea
what is where and what changes have been made as compared to a standard configuration.
But Atlassian is a commercial product, no ?
Do they not offer any kind of support ?

[amythyst]

They do not offer any support with getting their application to work
externally. They provide an online walkthrough document which is here:
http://confluence.atlassian.com/display/JIRA/Integrating+JIRA+with+IIS

And that is how I and the network guy set it up.... however, as you know, it
isn't working. I have tried every avenue to fix this and you guys are kinda
my last hope. :) I have been trying to fix this for over a month and I
can't figure it out.

Post by André Warnier

Post by amythyst
Yes, I'm still getting those error messages in the isapi_connector log.
I don't think the application installs a standard tomcat installation.
Basically, I have a directory in the program files folder called "Atlassian"
then under that I have JIRA 4.2. In that directory I have lots of folders
and one of them is conf and that is where my server.xml file is and some
other files. So, I'm not sure how I would test what you were suggesting.

That also makes it quite difficult for someone here to help you, because we have no idea
what is where and what changes have been made as compared to a standard configuration.
But Atlassian is a commercial product, no ?
Do they not offer any kind of support ?
---------------------------------------------------------------------

[André Warnier]

Post by amythyst
They do not offer any support with getting their application to work
http://confluence.atlassian.com/display/JIRA/Integrating+JIRA+with+IIS
And that is how I and the network guy set it up.... however, as you know, it
isn't working. I have tried every avenue to fix this and you guys are kinda
my last hope. :) I have been trying to fix this for over a month and I
can't figure it out.

Ah well, some of us like the desperate cases.
Let's back up a bit.

You mentioned that you found a "conf" directory somewhere.
There should be a server.xml file in there.
Have you posted here already ?
If not, can you *paste* the content into a message to the list, after removing all the
comment parts, and all private info such as hostnames or passwords.

Also, a layout of the directories that you find at the same level as that "conf" directory
would help. Something like :

Atlassian
Jira
conf
xyz ?

etc..

Thanks

[amythyst]

Woooooo!!!! I fixed it! I changed the listener port from 8009 to 8010! And
now it works! Thank you guys so much for the assistance and the guidance.
:)

Post by André Warnier

Post by amythyst
Yes, I'm still getting those error messages in the isapi_connector log.
I don't think the application installs a standard tomcat installation.
Basically, I have a directory in the program files folder called "Atlassian"
then under that I have JIRA 4.2. In that directory I have lots of folders
and one of them is conf and that is where my server.xml file is and some
other files. So, I'm not sure how I would test what you were suggesting.

That also makes it quite difficult for someone here to help you, because we have no idea
what is where and what changes have been made as compared to a standard configuration.
But Atlassian is a commercial product, no ?
Do they not offer any kind of support ?
---------------------------------------------------------------------

[Michael Ludwig]

Post by amythyst
Woooooo!!!! I fixed it! I changed the listener port from 8009 to
8010! And now it works!

Congrats.

The worker.properties you posted last year, however, read as follows:

| worker.worker1.type=ajp13
| worker.worker1.host=localhost
| worker.worker1.port=8009

But then, that was last year. ;-)

[amythyst]

Yup you are correct. It was 8009. And changing the port to 8010 seems to
have resolved it. But I'm not sure why this has fixed it.

I changed the port in the worker.properties and the server.xml

Post by Michael Ludwig

Post by amythyst
Woooooo!!!! I fixed it! I changed the listener port from 8009 to
8010! And now it works!

Congrats.
| worker.worker1.type=ajp13
| worker.worker1.host=localhost
| worker.worker1.port=8009
But then, that was last year. ;-)
--
Michael Ludwig
---------------------------------------------------------------------

[Michael Ludwig]

Post by amythyst
Yup you are correct. It was 8009. And changing the port to 8010
seems to have resolved it. But I'm not sure why this has fixed it.

Unfavourable firewall configuration?

[amythyst]

Yea I don't know... I'm not the network person so I don't have access to see
what is in the firewall. He told me everything was set up properly in the
firewall and when I changed the port to 8010, we made no changes in the
firewall whatsoever.

Post by Michael Ludwig

Post by amythyst
Yup you are correct. It was 8009. And changing the port to 8010
seems to have resolved it. But I'm not sure why this has fixed it.

Unfavourable firewall configuration?
--
Michael Ludwig
---------------------------------------------------------------------

[André Warnier]

Post by amythyst
Yea I don't know... I'm not the network person so I don't have access to see
what is in the firewall. He told me everything was set up properly in the
firewall and when I changed the port to 8010, we made no changes in the
firewall whatsoever.

Post by Michael Ludwig

Post by amythyst
Yup you are correct. It was 8009. And changing the port to 8010
seems to have resolved it. But I'm not sure why this has fixed it.

Unfavourable firewall configuration?
--

Congratulations, and we share your happiness at having resolved the problem.
However, it is always good to know why exactly the problem happened, if only to avoid it
re-appearing at some unexpected future time.

So allow us to continue digging a bit.


I believe that the key must be here, in an answer which you sent previously :

------------

I have the following connector string in my server.xml file:

<Connector port="8009" redirectPort="8443" enableLookups="false"
protocol="AJP/1.3" URIEncoding="UTF-8"/>

I will attach the file itself to make sure you guys think it looks ok.

I ran the netstat command you gave me... lots of stuff there! But I do see
this:

TCP 0.0.0.0:8009 0.0.0.0:0 LISTENING 4

-------------


This 8009 port must not have been Tomcat, but something else.
If it is still there now, then try to find out what "process number 4" actually is. You
should be able to see that in the Task Manager, if you select the PID column for display.

It should also normally show the name of the executable program, if you really entered the
command as :

netstat -aobn

e.g.

TCP 127.0.0.1:1430 127.0.0.1:1429 HERGESTELLT 1092
[komodo.exe]

(maybe you just forgot to copy and paste that second line ?)

On my WinXP laptop for example, I see that process # 4 as [System] :

TCP 192.168.245.129:139 0.0.0.0:0 ABHÖREN 4
[System]

In retrospect, it looks strange to have a process with PID # 4 on that server, listening
on port 8009. What could it be ?

Also, in the Tomcat logs of when you were still having the <Connector> listening on port
8009, there must have been error messages when Tomcat started.
(It should not have been able to start that Connector, if the port was not free).

[amythyst]

Process #4 just says "system" when I run the netstat command you gave me. I
still see port 8009 listening on process #4 but now for the change I made I
see port 8010 listening for my tomcat6.exe process.

We do not have a standard tomcat installation. The application itself
installs tomcat when you install the application. Its a java based
application, so I believe it needs some form of tomcat to function? But,
the application was not throwing any errors and it was working internally on
our intranet. If it wasn't starting the connector, I didn't see it anywhere
in the application logs.

Post by André Warnier

Post by amythyst
Yea I don't know... I'm not the network person so I don't have access to see
what is in the firewall. He told me everything was set up properly in the
firewall and when I changed the port to 8010, we made no changes in the
firewall whatsoever.

Post by Michael Ludwig

Post by amythyst
Yup you are correct. It was 8009. And changing the port to 8010
seems to have resolved it. But I'm not sure why this has fixed it.

Unfavourable firewall configuration?
--

Congratulations, and we share your happiness at having resolved the problem.
However, it is always good to know why exactly the problem happened, if only to avoid it
re-appearing at some unexpected future time.
So allow us to continue digging a bit.
------------
<Connector port="8009" redirectPort="8443" enableLookups="false"
protocol="AJP/1.3" URIEncoding="UTF-8"/>
I will attach the file itself to make sure you guys think it looks ok.
I ran the netstat command you gave me... lots of stuff there! But I do see
TCP 0.0.0.0:8009 0.0.0.0:0 LISTENING 4
-------------
This 8009 port must not have been Tomcat, but something else.
If it is still there now, then try to find out what "process number 4" actually is. You
should be able to see that in the Task Manager, if you select the PID column for display.
It should also normally show the name of the executable program, if you really entered the
netstat -aobn
e.g.
TCP 127.0.0.1:1430 127.0.0.1:1429 HERGESTELLT
1092
[komodo.exe]
(maybe you just forgot to copy and paste that second line ?)
TCP 192.168.245.129:139 0.0.0.0:0 ABHÖREN 4
[System]
In retrospect, it looks strange to have a process with PID # 4 on that server, listening
on port 8009. What could it be ?
Also, in the Tomcat logs of when you were still having the <Connector> listening on port
8009, there must have been error messages when Tomcat started.
(It should not have been able to start that Connector, if the port was not free).
---------------------------------------------------------------------

[Caldarale, Charles R]

Subject: Re: isapi_redirector.dll Problems - Bad Gateway?
And changing the port to 8010 seems to
have resolved it.
I changed the port in the worker.properties and the server.xml

You earlier stated that you changed the "listener" port to 8010; did you really mean <Connector>? A listener is something quite different in the world of Tomcat.

- Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.

[amythyst]

Hmm... maybe. :) I was calling it that because that is the port tomcat is
"listening" on to forward the requests right?

Post by Caldarale, Charles R

Subject: Re: isapi_redirector.dll Problems - Bad Gateway?
And changing the port to 8010 seems to
have resolved it.
I changed the port in the worker.properties and the server.xml

You earlier stated that you changed the "listener" port to 8010; did you
really mean <Connector>? A listener is something quite different in the
world of Tomcat.
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
MATERIAL and is thus for use only by the intended recipient. If you
received this in error, please contact the sender and delete the e-mail
and its attachments from all computers.
---------------------------------------------------------------------

[Michael Ludwig]

Post by amythyst
With that script, how exactly would I execute that script?

Save it to a file called, say, "ajp.pl", and then:

perl ajp.pl

Windows doesn't come with Perl out of the box, so if you don't
use Perl yet maybe it's not worth while downloading it.

Post by amythyst
According to him, all the ports that we are using are open on the
firewall... 8080, 8081, 443, 8443 and 8009. Tomcat is set to listen
on port 8009 and I have configured the server.xml file to accept
requests from 8009.

But the ISAPI redirector doesn't get a reply from Tomcat so we're not
sure the Tomcat side is working. Tools like netstat and the Perl script
can help you determine where exactly the problem lies.

Post by amythyst
When you ask how many threads I have configured you're talking about
worker threads right? I only have the one.

There are threads on both sides. If you haven't configured anything for
your AJP connector the default applies, which is 200.

http://tomcat.apache.org/tomcat-6.0-doc/config/ajp.html

[André Warnier]

Post by Michael Ludwig

Post by amythyst
When you ask how many threads I have configured you're talking about
worker threads right? I only have the one.

There are threads on both sides. If you haven't configured anything for
your AJP connector the default applies, which is 200.
http://tomcat.apache.org/tomcat-6.0-doc/config/ajp.html

Maybe to clear another terminology matter :

From the point of view of the isapi_redirector module which lives in IIS, a "worker" is
one back-end Tomcat server, as a whole.

[amythyst]

I'm fairly certain the tomcat server is up and running because the
application works internally. If tomcat wasn't working then I assume I
wouldn't be able to access the app internally as it requires tomcat to
function.

Post by Michael Ludwig
But the ISAPI redirector doesn't get a reply from Tomcat so we're not
sure the Tomcat side is working. Tools like netstat and the Perl script
can help you determine where exactly the problem lies.

Post by amythyst
When you ask how many threads I have configured you're talking about
worker threads right? I only have the one.

There are threads on both sides. If you haven't configured anything for
your AJP connector the default applies, which is 200.
http://tomcat.apache.org/tomcat-6.0-doc/config/ajp.html
--
Michael Ludwig
---------------------------------------------------------------------

[André Warnier]

Post by amythyst
I'm fairly certain the tomcat server is up and running because the
application works internally. If tomcat wasn't working then I assume I
wouldn't be able to access the app internally as it requires tomcat to
function.

Define what you mean by "internally", as opposed to the other way.
What exactly do you use for the "internal" URL which works, as opposed to what
"non-internal" which does not work ?

(replace the hostname by "myhost.com" or something; but if the hostnames are different in
each case, then convey that somehow).

[amythyst]

What I mean by internally is the application works on the intranet within our
corporate domain. I'm trying to get the application to work externally
outside the corporate firewall.

Post by André Warnier

Post by amythyst
I'm fairly certain the tomcat server is up and running because the
application works internally. If tomcat wasn't working then I assume I
wouldn't be able to access the app internally as it requires tomcat to
function.

Define what you mean by "internally", as opposed to the other way.
What exactly do you use for the "internal" URL which works, as opposed to what
"non-internal" which does not work ?
(replace the hostname by "myhost.com" or something; but if the hostnames are different in
each case, then convey that somehow).
---------------------------------------------------------------------