企业级Tomcat部署实践及安全调优(2)

日期：2020-06-11 栏目：程序人生浏览：次

1.9 Tomcat多实例配置

多虚拟主机：nginx 多个Server标签（域名，ip，端口）进程数量固定 master+worker

多实例（多进程）：同一个程序启动多次，分为两种情况:

第一种：一台机器跑多个站点；

第二种：一个机器跑一个站点多个实例，配合负载均衡

1.9.1 复制程序文件

cd /application/tools/ tar xf apache-tomcat-8.0.27.tar.gz cp -a apache-tomcat-8.0.27 tomcat8_1 cp -a apache-tomcat-8.0.27 tomcat8_2

修改端口，以启动多实例。多实例之间端口不能一致

sed -i 's#8005#8011#;s#8080#8081#' tomcat8_1/conf/server.xml sed -i 's#8005#8012#;s#8080#8082#' tomcat8_2/conf/server.xml

[root@web03 application]# diff tomcat8_1/conf/server.xml tomcat8_2/conf/server.xml 22c22 < <Server port="8011" shutdown="SHUTDOWN"> --- > <Server port="8012" shutdown="SHUTDOWN"> 67c67 < Define a non-SSL/TLS HTTP/1.1 Connector on port 8081 --- > Define a non-SSL/TLS HTTP/1.1 Connector on port 8082 69c69 < <Connector port="8081" protocol="HTTP/1.1" --- > <Connector port="8082" protocol="HTTP/1.1" 75c75 < port="8081" protocol="HTTP/1.1" --- > port="8082" protocol="HTTP/1.1"

　　将配置好的tomcat程序打包，以备之后使用

tar zcf muti_tomcat8.tar.gz ./tomcat8_1 ./tomcat8_2

启动tomcat多实例

/application/tomcat8_1/bin/startup.sh /application/tomcat8_2/bin/startup.sh

检查端口是否启动

[root@web03 tomcat8_1]# netstat -lntup |grep java tcp6 0 0 127.0.0.1:8011 :::* LISTEN 31906/java tcp6 0 0 127.0.0.1:8012 :::* LISTEN 31932/java tcp6 0 0 :::8080 :::* LISTEN 31812/java tcp6 0 0 :::8081 :::* LISTEN 31906/java tcp6 0 0 :::8082 :::* LISTEN 31932/java tcp6 0 0 127.0.0.1:8005 :::* LISTEN 31812/java tcp6 0 0 :::8009 :::* LISTEN 31812/java

将每个实例的网页进行区分

echo 8081 >>/application/tomcat8_1/webapps/ROOT/index.jsp echo 8082 >>/application/tomcat8_2/webapps/ROOT/index.jsp

1.9.2 在浏览器访问，进行测试

检查多实例的启动

:8082

企业级Tomcat部署实践及安全调优

:8081

企业级Tomcat部署实践及安全调优

1.10 tomcat反向代理集群 1.10.1 负载均衡器说明

[root@lb01 ~]# cat /etc/RedHat-release CentOS release 6.9 (Final) [root@lb01 ~]# uname -a Linux lb01 2.6.32-696.el6.x86_64 #1 SMP Tue Mar 21 19:29:05 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux [root@lb01 ~]# getenforce Disabled [root@lb01 ~]# /etc/init.d/iptables status iptables: Firewall is not running.

负载均衡软件使用nginx，详情参照

1.10.2 配置负载均衡器

备份原配置文件

mv /application/nginx/conf/nginx.conf{,.20171127} egrep -v '#|^$' /application/nginx/conf/nginx.conf.default > /application/nginx/conf/nginx.conf

配置文件内容

[root@lb01 ~]# cat /application/nginx/conf/nginx.conf worker_processes 1; events { worker_connections 1024; } http { include mime.types; default_type application/octet-stream; sendfile on; keepalive_timeout 65; upstream web_pools { server 10.0.0.17:8081; server 10.0.0.17:8082; } server { listen 80; server_name localhost; location / { root html; index index.jsp index.htm; proxy_pass http://web_pools; } error_page 500 502 503 504 /50x.html; location = /50x.html { root html; } } }

配置完成后重启nginx服务

/application/nginx/sbin/nginx -s stop /application/nginx/sbin/nginx

1.10.3 使用命令进行访问测试

使用curl 命令进行测试，tail进行关键字提取

[root@lb01 ~]# curl -s 10.0.0.5|tail -1 8081 [root@lb01 ~]# curl -s 10.0.0.5|tail -1 8082

使用curl 命令进行测试，awk进行关键字提取

[root@lb01 ~]# curl -s 10.0.0.5|awk 'END{print}' 8082 [root@lb01 ~]# curl -s 10.0.0.5|awk 'END{print}' 8081

使用curl 命令进行测试，sed进行关键字提取

[root@lb01 ~]# curl -s 10.0.0.5|sed -n '$p' 8082 [root@lb01 ~]# curl -s 10.0.0.5|sed -n '$p' 8081

1.10.4 在浏览器上进行访问测试

企业级Tomcat部署实践及安全调优

建议使用google浏览器chrome 的隐身模式进行访问，使用ctrl+f5 进行强制刷新

1.11 监控tomcat集群状态 1.11.1 方法一：开发java监控页面

[root@web03 tomcat8_1]# cat /application/tomcat/webapps/memtest/meminfo.jsp <% Runtime rtm = Runtime.getRuntime(); long mm = rtm.maxMemory()/1024/1024; long tm = rtm.totalMemory()/1024/1024; long fm = rtm.freeMemory()/1024/1024; out.println("JVM memory detail info : "); out.println("Max memory:"+mm+"MB"+" "); out.println("Total memory:"+tm+"MB"+" "); out.println("Free memory:"+fm+"MB"+" "); out.println("Available memory can be used is :"+(mm+fm-tm)+"MB"+" "); %>

1.11.2 方法二：使用jps命令进行监控

[root@web03 ~]# jps -lvm 31906 org.apache.catalina.startup.Bootstrap start -Djava.util.logging.config.file=/application/tomcat8_1/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.endorsed.dirs=/application/tomcat8_1/endorsed -Dcatalina.base=/application/tomcat8_1 -Dcatalina.home=/application/tomcat8_1 -Djava.io.tmpdir=/application/tomcat8_1/temp 31812 org.apache.catalina.startup.Bootstrap start -Djava.util.logging.config.file=/application/tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.endorsed.dirs=/application/tomcat/endorsed -Dcatalina.base=/application/tomcat -Dcatalina.home=/application/tomcat -Djava.io.tmpdir=/application/tomcat/temp 31932 org.apache.catalina.startup.Bootstrap start -Djava.util.logging.config.file=/application/tomcat8_2/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.endorsed.dirs=/application/tomcat8_2/endorsed -Dcatalina.base=/application/tomcat8_2 -Dcatalina.home=/application/tomcat8_2 -Djava.io.tmpdir=/application/tomcat8_2/temp 32079 sun.tools.jps.Jps -lvm -Denv.class.path=.:/application/jdk/lib:/application/jdk/jre/lib:/application/jdk/lib/tools.jar -Dapplication.home=/application/jdk1.8.0_60 -Xms8m

1.11.3 Tomcat远程监控功能

修改配置文件，开启远程监控

vim /application/tomcat8_1/bin/catalina.sh +97 CATALINA_OPTS="$CATALINA_OPTS -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port=12345 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false -Djava.rmi.server.hostname=10.0.0.17"

重启服务，检查12345端口是否开启

/application/tomcat8_1/bin/shutdown.sh /application/tomcat8_1/bin/startup.sh netstat -tunlp|grep 12345

检查端口

[root@web03 ~]# netstat -tunlp|grep 12345 tcp6 0 0 :::12345 :::* LISTEN 33158/java

在Windows上监控tomcat

注意：Windwos需要安装jdk环境！

查考：Oracle.com/technetwork/java/javase/downloads/index.html

软件路径

C:\Program Files\Java\jdk1.8.0_31\bin jconsole.exe jvisualvm.exe

jconsole.exe 使用说明

企业级Tomcat部署实践及安全调优