[Shib-Users] IdP/Tomcat possible memory leak

[Paul Hethmon]

Then implement a clustered solution or only restart during a maintenance window. As Chad pointed out in the earlier messages, the containers just don't do a good enough job restarting a context. A container stop/start should take less than 30 seconds in any case.

Paul

-----

Restarting the container causes an outage though - so we'd prefer to restart the context.


On Wed, Oct 12, 2011 at 11:10 AM, Paul Hethmon <paul.hethmon at clareitysecurity.com<mailto:paul.hethmon at clareitysecurity.com>> wrote:
Hmm, you've kind of resurrected an old thread there. But the general view is to never start/stop the context of the IdP to reload it. You fully stop/start the container (Tomcat, Jetty, etc) instead.

I will say my Tomcat settings are:

JAVA_OPTS="-server -Xms1G -Xmx2G \
-XX:NewSize=256M \
-XX:MaxPermSize=256M \
-XX:PermSize=128M \
"

Those work well for me. On a highly active server, I will go ahead and set -Xms2G instead so it goes ahead and allocates the 2G at start up.

Paul

-----

Can this memory leak issue be alleviated by increasing the amount of memory allocated to tomcat6? We have currently:

-Xmx512m -XX:MaxPermSize=256m

can these values be doubled so that tomcat doesn't run out memory as quickly?

On Fri, Jan 7, 2011 at 7:03 AM, Jan Klever <klever at dfn-cert.de<mailto:klever at dfn-cert.de>> wrote:
Am 07.01.2011 13:52, schrieb Chad La Joie:
> That error message only appears when you're shutting down the context.
> If you're shutting down the server which in turn shuts down the context
> then there is nothing to worry about.  The process terminates and all
> memory is freed.  If you're trying to shutdown and restart the context
> without stopping the server you'll have issues.

OK, I can live with that. :-)

> I'm not trying to pass the buck to Tomcat.  I can't fix the logback
> issue, that's not my code, but I will fix the IdP issue in v3 (it takes
> a bit of a interface change).  However, even if those two issues were
> corrected you still couldn't start and stop the context because the
> container itself does not clean up all the resource it allocates when
> creating a context.  If, in fact, the container did this, the issue it's
> currently warning of (which, again, I agree is in fact an issue), would
> also just go away because it would clean up all the threads it had
> allocated.

Thanks for that information. /me is happy now.

8-)
Jan

--
Jan Klever (Senior PKI Team Member), Phone +49 40 808077-619<tel:%2B49%2040%20808077-619>

DFN-CERT Services GmbH, https://www.dfn-cert.de,  Phone  +49 40 808077-555<tel:%2B49%2040%20808077-555>
Sitz / Register: Hamburg, AG Hamburg, HRB 88805,  Ust-IdNr.:  DE 232129737
Sachsenstraße 5, 20097 Hamburg / Germany, CEO: Dr. Klaus-Peter Kossakowski

18. DFN Workshop "Sicherheit in vernetzten Systemen"
am 15./16. Februar 2011 im Grand Hotel Elysee in Hamburg




--
Roberto Ullfig - rullfig at uic.edu<mailto:rullfig at uic.edu>

-- To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>



--
Roberto Ullfig - rullfig at uic.edu<mailto:rullfig at uic.edu>

-- To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20111012/99695e78/attachment.html