Azedi Technology http://azeditech.com/atom.xml 2006-05-13T15:28:44-07:00 Red Hat Network: How can they charge for less than you can get for free? http://azeditech.com/blog/rhn-vs-yum-and-apt.html 2006-06-12T22:49:01-07:00 2006-06-13T09:28:55-07:00 kief My first experience with the RedHat Network reminds me of a major limitation of commercial platforms that doesn't get much press. You actually get less than you do with free alternatives like apt-get and yum.
I'm setting up a new hosting infrastructure for a client which, among other things, involves moving from the free Fedora to commercial Redhat Linux. Although I've managed Redhat machines before, this is my first time using the Redhat Network (RHN) for installing and updating software.
In the past I've used apt-get on Debian, and yum on Fedora, and found them a godsend. Set up properly, it takes minimal effort to keep multiple systems up to date and consistent, whereas when I've had to go the "by-hand" route, machines invariably ended up with older versions of software. It's just too hard to keep up with all the various packages installed on various servers, not to mention the headache of chasing down various dependencies and resolving conflicts when you do upgrade or install a new package.

]]>
My first experience with the RedHat Network reminds me of a major limitation of commercial platforms that doesn't get much press. You actually get less than you do with free alternatives like apt-get and yum.

I'm setting up a new hosting infrastructure for a client which, among other things, involves moving from the free Fedora to commercial Redhat Linux. Although I've managed Redhat machines before, this is my first time using the Redhat Network (RHN) for installing and updating software.

In the past I've used apt-get on Debian, and yum on Fedora, and found them a godsend. Set up properly, it takes minimal effort to keep multiple systems up to date and consistent, whereas when I've had to go the "by-hand" route, machines invariably ended up with older versions of software. It's just too hard to keep up with all the various packages installed on various servers, not to mention the headache of chasing down various dependencies and resolving conflicts when you do upgrade or install a new package.

So faced with using RHN, I made the typical assumption of a user who is "upgrading" from a free system to a commercial one, i.e. I assumed it would be better. After all, if you're paying a company for it, it'll be better quality than something maintained by a bunch of volunteers, won't it? I should know better, having seen horrors that go on inside the closed-door sausage factories of commercial software development groups.

So what's my bitch this time? Well, there's not as much software available. The first thing I wanted to do with my new Redhat boxes was checkout my puppet manifests and related configuration code from my subversion repository. To do this, I needed the subversion client but sadly, RHN (at least for Redhat Enterprise 3) doesn't have subversion.

It might be available from channels that I don't have access to, I don't know. If so, it's an example of the quicksand that I always seem to find myself mired in with commercial software. Whenever I get saddled with Microsoft Windows servers, I end up wanting to do things that I could do for free on Linux, but can't do without paying thousands of pounds extra with Microsoft, buying add-ons, third-party software, not to mention "Enterprise" editions of everything when I want to run it on more than one server, all multiplied by CPU's of course. And, oh yeah, we need licenses for our development and staging servers as well. Bleh.

So for now I'm going back to the old fashioned days of searching and downloading packages. So far I'm up to 10 packages I've had to add manually, and will have to keep up to date across 15 or more machines.

I'm considering installing yum and just ditching RHN entirely. I guess this will effectively turn my systems into Fedora boxes, and might have weird side effects. So far I haven't found much commentary out on the web related to this situation.

]]>
Configuring the Tomcat manager webapp http://azeditech.com/tomcat/configurating-tomcat-manager.html 2006-05-31T13:56:48-07:00 2006-05-31T14:04:18-07:00 kief I like to have the Tomcat manager webapp installed on each instance, so I can play with the webapps, and see how many active sessions there are. To do this, make a file called manager.xml file in the webapps directory of your Tomcat instance. One I like to use is this:

<Context path="/manager"
docBase="/usr/local/tomcat/server/webapps/manager"
debug="0"
privileged="true">

<ResourceLink name="users"
global="UserDatabase"
type="org.apache.catalina.UserDatabase"/>

<Valve className="org.apache.catalina.valves.RemoteAddrValve"

]]>
I like to have the Tomcat manager webapp installed on each instance, so I can play with the webapps, and see how many active sessions there are. To do this, make a file called manager.xml file in the webapps directory of your Tomcat instance. One I like to use is this:

<Context path="/manager"
docBase="/usr/local/tomcat/server/webapps/manager"
debug="0"
privileged="true">

<ResourceLink name="users"
global="UserDatabase"
type="org.apache.catalina.UserDatabase"/>

<Valve className="org.apache.catalina.valves.RemoteAddrValve"
allow="127.0.0.1,192.168.100.100"/>

</Context>

The key bit is the docBase attribute, which needs to point to the webapp in the Tomcat installation directory. I add a RemoteAddrValve to keep evil people from trying to break into the manager.

You'll also need to add a user account with permission to use the manager. Put a file called tomcat-users.xml into the conf directory of the Tomcat instance, which should have something like the following:

<tomcat-users>
<role rolename="manager"/>
<user username="admin" password="hard2Guess" roles="manager"/>
</tomcat-users>

Finally, your server.xml file needs to have a UserDatabase configured. This is in the example configuration files from the Tomcat installation.

]]>
Running multiple Tomcat instances on one server http://azeditech.com/tomcat/multiple-tomcat-instances.html 2006-05-31T13:41:41-07:00 2006-06-01T23:13:15-07:00 kief Here's a brief step by step guide to running more than one instance of Tomcat on a single machine.

Step 1: Install the Tomcat files
Download Tomcat 4.1 or 5.5, and unzip it into an appropriate directory. I usually put it in /usr/local, so it ends up in a directory called /usr/local/apache-tomcat-5.5.17 (5.5.17 being the current version as of this writing), and make a symlink named /usr/local/tomcat to that directory. When later versions come out, I can unzip them and relink, leaving the older version in case things don't work out (which rarely if ever happens, but I'm paranoid).

]]>
Here's a brief step by step guide to running more than one instance of Tomcat on a single machine.

Step 1: Install the Tomcat files

Download Tomcat 4.1 or 5.5, and unzip it into an appropriate directory. I usually put it in /usr/local, so it ends up in a directory called /usr/local/apache-tomcat-5.5.17 (5.5.17 being the current version as of this writing), and make a symlink named /usr/local/tomcat to that directory. When later versions come out, I can unzip them and relink, leaving the older version in case things don't work out (which rarely if ever happens, but I'm paranoid).

Step 2: Make directories for each instance

For each instance of Tomcat you're going to run, you'll need a directory that will be CATALINA_HOME. For example, you might make them /var/tomcat/serverA and /var/tomcat/serverB.

In each of these directories you need the following subdirectories: conf, logs, temp, webapps, and work.

Put a server.xml and web.xml file in the conf directory. You can get these from the conf directory of the directory where you put the tomcat installation files, although of course you should tighten up your server.xml a bit.

The webapps directory is where you'll put the web applications you want to run on the particular instance of Tomcat.

I like to have the Tomcat manager webapp installed on each instance, so I can play with the webapps, and see how many active sessions there are. See my instructions for configuring the Tomcat manager webapp.

Step 3: Configure the ports and/or addresses for each instance

Tomcat listens to at least two network ports, one for the shutdown command, and one or more for accepting requests. Two instances of Tomcat can't listen to the same port number on the same IP address, so you will need to edit your server.xml files to change the ports they listen to.

The first port to look at is the shutdown port. This is used by the command line shutdown script (actually, but the Java code it runs) to tell the Tomcat instance to shut itself down. This port is defined at the top of the server.xml file for the instance.

<Server port="8001" shutdown="_SHUTDOWN_COMMAND_" debug="0">

Make sure each instance uses a different port value. The port value will normally need to be higher than 1024, and shouldn't conflict with any other network service running on the same system. The shutdown string is the value that is sent to shut the server down. Note that Tomcat won't accept shutdown commands that come from other machines.

Unlike the other ports Tomcat listens to, the shutdown port can't be configured to listen to its port on a different IP address. It always listens on 127.0.0.1.

The other ports Tomcat listens to are configured with the <Connector> elements, for instance the HTTP or JK listeners. The port attribute configures which port to listen to. Setting this to a different value on the different Tomcat instances on a machine will avoid conflict.

Of course, you'll need to configure whatever connects to that Connector to use the different port. If a web server is used as the front end using mod_jk, mod_proxy, or the like, then this is simple enough - change your web server's configuration.

In some cases you may not want to do this, for instance you may not want to use a port other than 8080 for HTTP connectors. If you want all of your Tomcat intances to use the same port number, you'll need to use different IP addresses. The server system must be configured with multiple IP addresses, and the address attribute of the <Connector> element for each Tomcat instance will be set to the appropriate IP address.

Step 4: Startup

Startup scripts are a whole other topic, but here's the brief rundown. The main different from running a single Tomcat instance is you need to set CATALINA_BASE to the directory you set up for the particular instance you want to start (or stop). Here's a typical startup routine:

JAVA_HOME=/usr/java
JAVA_OPTS="-Xmx800m -Xms800m"
CATALINA_HOME=/usr/local/tomcat
CATALINA_BASE=/var/tomcat/serverA
export JAVA_HOME JAVA_OPTS CATALINA_HOME CATALINA_BASE

$CATALINA_HOME/bin/catalina.sh start

]]>
Configuration management with Puppet http://azeditech.com/infrastructure-tools/puppet.html 2006-05-31T12:16:46-07:00 2006-05-31T12:16:46-07:00 kief I've started tinkering with puppet for configuration management. It's a far more flexible and extensible tool than cfengine, so it looks like the best way to go.
It's main drawback is lack of maturity. The documentation is fair, there's a decent reference, but there are only two examples of configuration files that I've seen so far, and neither one is very complex. It's also fairly buggy, although the author is quick to respond when told about specific problems.
I'll most likely be using Puppet to build a J2EE infrastructure based on Red Hat. I'd like to be able to contribute bug fixes, but I'm not sure how many spare cycles I'll have, given that I don't know Ruby. But hopefully I can at least contribute some example files, and some manifests related to Tomcat and general J2EE web application deployments.

]]>
I've started tinkering with puppet for configuration management. It's a far more flexible and extensible tool than cfengine, so it looks like the best way to go.

It's main drawback is lack of maturity. The documentation is fair, there's a decent reference, but there are only two examples of configuration files that I've seen so far, and neither one is very complex. It's also fairly buggy, although the author is quick to respond when told about specific problems.

I'll most likely be using Puppet to build a J2EE infrastructure based on Red Hat. I'd like to be able to contribute bug fixes, but I'm not sure how many spare cycles I'll have, given that I don't know Ruby. But hopefully I can at least contribute some example files, and some manifests related to Tomcat and general J2EE web application deployments.

Assuming I do use Puppet for this project, I'll try to post information here as I go along, in addition to the project itself.

]]>
Ready for disaster http://azeditech.com/node/21 2006-05-27T10:55:43-07:00 2006-05-27T10:55:43-07:00 kief There are a lot of things you can do to make sure that when disaster strikes, you can get back online. Even in environments where you don't have automatic failover, you can take some basic steps so that when you get the alert or the phone call, you can bring things back online.
Let's say you have a single server running a web application with a local database. However, you need to have a second server available. Maybe it's doing something else normally, maybe it's in a less than ideal location, like in your office at the end of a slower Net connection, but as long as you can fire up your application, repoint DNS, and be online, it'll do in a pinch.

]]>
There are a lot of things you can do to make sure that when disaster strikes, you can get back online. Even in environments where you don't have automatic failover, you can take some basic steps so that when you get the alert or the phone call, you can bring things back online.

Let's say you have a single server running a web application with a local database. However, you need to have a second server available. Maybe it's doing something else normally, maybe it's in a less than ideal location, like in your office at the end of a slower Net connection, but as long as you can fire up your application, repoint DNS, and be online, it'll do in a pinch.

First, make sure you have the base server software ready, so your web, application, and database software are installed.

Second, make sure you have a copy of your application code and configuration files handy. I always like to have these in source control, on a server other than my live one, so in the worst case I can pull them down to my emergency location.

Third, you need your live data, that is, your database contents. Take frequent dumps of the data and have them handy, again away from your live server. Do this outside your system backups, use your database tools such as mysqlbackup to dump a file, then zip it and ship it somewhere else. How frequently you do this depends on how often the data changes, and how important it is to have fresh data. In the most extreme case, you might have the database continually dumping a log to a shared file store, where the backup server is reading it in.

A sticking point may be the DNS. You can change the DNS, but users will have the old DNS information cached. How long it takes for them to get the new IP address depends on the TTL you have set in your DNS configuration, and changing this to a lower value after the crash ain't gonna help. A two hour TTL is probably a good setting.

Of course, better yet is if you have multiple servers behind a firewall and/or load balancer, so you don't need to change your DNS at all, just reconfigure and go. But if you're running a budget setup, these are simple steps to follow to make disasters a little less stressful.

]]>
Why cheap hosting services are so cheap http://azeditech.com/cheap-hosting-poor-service.html 2006-05-27T10:43:32-07:00 2006-06-01T12:43:58-07:00 kief Why would someone pay £500 per month for a server when they could pay less than £100 from a different provider? The short answer is support. But it's a more complicated story than that.
One of my clients had a key server die this week, one of many they have with a cheap hosting provider. After investigating a bit, it was clear that it was not a system error - I was briefly able to examine the system logs using the provider's web based recovery tool, with no evidence of problems, but then the server stopped responding even to the tool.
So I called support. The first-line support guy verified that the machine wasn't responding and couldn't be recovered with the online tool, so he referred it to engineering at the data center.

]]>
Why would someone pay £500 per month for a server when they could pay less than £100 from a different provider? The short answer is support. But it's a more complicated story than that.

One of my clients had a key server die this week, one of many they have with a cheap hosting provider. After investigating a bit, it was clear that it was not a system error - I was briefly able to examine the system logs using the provider's web based recovery tool, with no evidence of problems, but then the server stopped responding even to the tool.

So I called support. The first-line support guy verified that the machine wasn't responding and couldn't be recovered with the online tool, so he referred it to engineering at the data center.

However, he couldn't tell me when they would investigate the issue. It depends on how busy they are. With a real hosting provider, you get an SLA that includes response times. You also get someone who will communicate with you, to make you feel like they're on the case. I only got the promise that I would get an email when it was fixed, no direct contact, no phone call.

In the end it took three hours for them to fix the server. This isn't an unreasonable amount of time, given the cost of the service, but during those three hours my client decided that the three new servers they had decided to add that very morning should be gotten from another provider instead. They'll probably end up paying five times the price, but they know they'll get better support.

The key point here isn't that the service was poor. They fixed the problem fairly quickly. It isn't even just that they could not promise a response time - with thousands of customers paying less than a hundred pounds a month, they can't afford to make guarantees.

But even a cheap and cheerful support organisation should have a way to give updates on their progress, even if it is just via semi-automated emails. Let me know when your engineers have started investigating the problem. Let me know when they've identified the cause, and when they've fixed it.

The frosting with these guys came when they sent the form-email that the problem was fixed. I replied, asking if they could tell me what went wrong. The reply came the next day: look at your server logs.

That's lame. That's passing the buck. It's not in the server logs, because it's not an OS problem. Hard booting didn't fix the issue, and whatever did fix it didn't involve changing any configuration files or such on the server. So it was a hardware or network issue of some kind.

I guess I'll never know. And I guess I'll never use these guys again.

]]>
cfengine alternatives http://azeditech.com/infrastructure-tools/cfengine-alternatives.html 2006-05-24T13:25:47-07:00 2006-05-24T13:58:11-07:00 kief I've been working up a cfengine-based setup to manage a new server infrastructure. This will be my third cfengine-based infrastructure, so I should have learned enough to make a cleaner, tighter configuration. Unfortunately I'm still finding cfengine to be too damned awkward.
So, I'd like to put together a list of alternatives to cfengine. I'll add them to this page, and hopefully add on notes and reviews as I learn more. If you have experience with these or others, please add a comment.

  • Puppet seems to be an up and comer. It looks to be designed to be much more extensible than cfengine is. It also lets you make sure each host only sees its own configuration, which is one of my peeves about cfengine. It's my leading candidate at the moment.
  • ]]>
I've been working up a cfengine-based setup to manage a new server infrastructure. This will be my third cfengine-based infrastructure, so I should have learned enough to make a cleaner, tighter configuration. Unfortunately I'm still finding cfengine to be too damned awkward.

So, I'd like to put together a list of alternatives to cfengine. I'll add them to this page, and hopefully add on notes and reviews as I learn more. If you have experience with these or others, please add a comment.

  • Puppet seems to be an up and comer. It looks to be designed to be much more extensible than cfengine is. It also lets you make sure each host only sees its own configuration, which is one of my peeves about cfengine. It's my leading candidate at the moment.
  • bcfg2 was developed at the Argonne National Lab, according to this post they've been using it for 18 months. My main concern, without having even looked at the documentation, is that if it's only been used in one environment it may not have the flexibility to cope with different situations and approaches than its original infrastructure.
]]>
Piers Fawkes interviews Iain Tait http://azeditech.com/node/18 2006-05-18T07:35:36-07:00 2006-05-18T07:35:36-07:00 kief My Fellow Syzygy alum Piers Fawkes interviews Iain Tait, another of our former colleagues now with Poke, about their recent win of two (count 'em!) Webbie awards for their work.
It's a fairly brief piece, but for more of Iain, check out his weblog, where he keeps up an admirable pace of quality posts.

]]>
My Fellow Syzygy alum Piers Fawkes interviews Iain Tait, another of our former colleagues now with Poke, about their recent win of two (count 'em!) Webbie awards for their work.

It's a fairly brief piece, but for more of Iain, check out his weblog, where he keeps up an admirable pace of quality posts.

]]>
cfengine http://azeditech.com/infrastructure-tools/cfengine.html 2006-05-06T03:48:28-07:00 2006-05-13T15:12:07-07:00 kief I would call cfengine a configuration management tool. I just can't get into graphical and web-based tools for managing servers, I much prefer having a set of configuration files that I can check into version control. Once I've got a decent configuration set for an infrastructure, setting up, updating, or changing the role of a machine is a simple matter of tweaking the configuration files and running a command.
I find cfengine to be a bit awkward, it's configuration system suffers from being an academic research project. But so far I haven't found anything better.

]]>
I would call cfengine a configuration management tool. I just can't get into graphical and web-based tools for managing servers, I much prefer having a set of configuration files that I can check into version control. Once I've got a decent configuration set for an infrastructure, setting up, updating, or changing the role of a machine is a simple matter of tweaking the configuration files and running a command.

I find cfengine to be a bit awkward, it's configuration system suffers from being an academic research project. But so far I haven't found anything better.

A challenge I have is that less experienced sysadmins often find it difficult, they would rather just directly change a machine's configuration instead of changing central files and distributing them. But this inevitably leads to a bunch of inconsistent, out of date machines, so discipline is worth it.

Cfengine's syntax is too rigid, it doesn't make it easy to template configuration patterns and reuse them. For example, let's say I want to build Apache configurations for multiple virtual hosts. In Apache's main httpd.conf file I use an include directive to read in all files ending in .conf in the directory /etc/httpd/vhosts. So I just need to configure cfengine to put a .conf file in that directory for each virtual host to be hosted on a given machine.

Ideally I would just have a single set of rules in cfengine which create the appropriate vhost file, using the cfengine editfiles: tasks to build the file with the appropriate apache configuration directives, the copy: task to put it into place, and the files: task to ensure it has the right permissions. But cfengine doesn't let me do this, instead I need to copy the appropriate directives for each vhost.

This kind of inflexibility is one of the reasons cfengine configurations are difficult to understand, which discourages sysadmins from using it.

]]>
Continuous integration article http://azeditech.com/node/11 2006-05-02T06:21:17-07:00 2006-05-02T06:21:17-07:00 kief Martin Fowler has rewritten his article on Continuous Integration.

]]>
Martin Fowler has rewritten his article on Continuous Integration.

]]>
Splitting your Tomcat installation for more power http://azeditech.com/tomcat-setup/splitting-directories.html 2006-05-01T13:49:12-07:00 2006-05-01T14:00:03-07:00 kief The most basic setup of Tomcat involves unzipping the distribution files somewhere on your system, dropping your application into the webapps directory, and firing the server up. This is a fine quick start to run a single app on your own machine, but Tomcat offers a much more powerful way to organize production servers and complex developer setups.
If you read down a ways in the RUNNING.txt file in the tomcat installation bundle, you’ll find a section called “Advanced Configuration - Multiple Tomcat Instances”. This describes how to split your Tomcat installation into two directories, the $CATALINA_HOME directory for the Tomcat installation files, and the $CATALINA_BASE directory with the runtime files. Setting these two environment variables when you start up Tomcat controls where the server will look for its files.

]]>
The most basic setup of Tomcat involves unzipping the distribution files somewhere on your system, dropping your application into the webapps directory, and firing the server up. This is a fine quick start to run a single app on your own machine, but Tomcat offers a much more powerful way to organize production servers and complex developer setups.

If you read down a ways in the RUNNING.txt file in the tomcat installation bundle, you’ll find a section called “Advanced Configuration - Multiple Tomcat Instances”. This describes how to split your Tomcat installation into two directories, the $CATALINA_HOME directory for the Tomcat installation files, and the $CATALINA_BASE directory with the runtime files. Setting these two environment variables when you start up Tomcat controls where the server will look for its files.

The basic idea behind this is that to allow multiple Tomcat server instances to run on the same machine, using a single copy of the Tomcat installation files. There is a single $CATALINA_HOME directory with the installation files, and each server instance has its own $CATALINA_BASE directory, with its own set of webapps, configuration files, libraries, and logs. When you upgrade to a newer version of Tomcat, you simply install the files into a new directory and change the $CATALINA_HOME variable to point there when you restart each of your Tomcat servers. You don’t need to touch the server instance files in $CATALINA_BASE.

But this has additional advantages beyond multiple server instances. For one thing, you can have multiple versions of Tomcat installed on the same machine, and then easily switch which version is being used by a particular server instance by changing the $CATALINA_HOME variable for the instance. This is helpful in development, because you can test your application on different versions of Tomcat to ensure compatibility. It helps in production when different applications need different versions of Tomcat, and also for upgrades. When you upgrade to a newer version of Tomcat, you can switch over applications one by one, and if there is a problem, easily switch back.

]]>
Raible adjusts his max perm size http://azeditech.com/node/3 2006-04-22T02:06:07-07:00 2006-04-22T02:07:32-07:00 kief Matt Raible has found that the latest version of his application stack needs a larger perm size set in the JVM than the default. Tweaking the memory settings of the JVM is becoming more complex than just setting the starting and maximum heap sizes. One of the things on my to-do list is to come up with a set of instructions for running Tomcat (or other app servers) with JMX enabled, and using this to analyze the different sections of JVM memory and adjust your startup parameters appropriately.

]]>
Matt Raible has found that the latest version of his application stack needs a larger perm size set in the JVM than the default. Tweaking the memory settings of the JVM is becoming more complex than just setting the starting and maximum heap sizes. One of the things on my to-do list is to come up with a set of instructions for running Tomcat (or other app servers) with JMX enabled, and using this to analyze the different sections of JVM memory and adjust your startup parameters appropriately.

]]>
About Azedi http://azeditech.com/about.html 2006-04-21T13:20:00-07:00 2006-05-13T15:28:44-07:00 kief This is a site I've put together as a resource for people who need to plan, implement, and manage Java hosting infrastructures.
Who am I
I'm Kief Morris, a technical architect specializing in Java applications and servers. I'm based in London, and currently work as a freelance consultant and implementor.

]]>
This is a site I've put together as a resource for people who need to plan, implement, and manage Java hosting infrastructures.

Who am I

I'm Kief Morris, a technical architect specializing in Java applications and servers. I'm based in London, and currently work as a freelance consultant and implementor.

]]>