Tomcat - different users for different instances?

[Peter Boy]

When Fedora used systemV init you could define a specific user for a specific tomcat
instance in /etc/systconfig/tomcat-[myinstance] by adding a line TOMCAT_USER=„mytomcat“.

In Fedora 26 with systemd you can define different Tomcat instances but the above
mechanism doesn’t work anymore. I checked the starter script and couldn’t identify a way
to define an instance specific user.

Well, does anybody know how I can achieve this?


My issue is: If my instances are all executing as the same user I get sometimes an „Too
many open files“ error message and the instance stops executing. In RHEL it helps to
define separate users per instance. The other instances were not affected by the broken
one.



Thanks
Peter

[Bill Shirley]

Have you looked at overriding it in the systemd unit file?

I use this for mariadb (/etc/systemd/system/mariadb.service):
.include /usr/lib/systemd/system/mariadb.service

[Service]
#LimitNOFILE=infinity
LimitNOFILE=65536
LimitMEMLOCK=infinity

Bill

On 9/21/2017 6:55 PM, Peter Boy wrote:
>  When Fedora used systemV init you could define a specific user for a
> specific tomcat instance in /etc/systconfig/tomcat-[myinstance] by adding a line
> TOMCAT_USER=„mytomcat“.
>
>  In Fedora 26 with systemd you can define different Tomcat instances but the above
> mechanism doesn’t work anymore. I checked the starter script and couldn’t identify a way
> to define an instance specific user.
>
>  Well, does anybody know how I can achieve this?
>
>
>  My issue is: If my instances are all executing as the same user I get sometimes an „Too
> many open files“ error message and the instance stops executing. In RHEL it helps to
> define separate users per instance. The other instances were not affected by the broken
> one.
>
>
>
>  Thanks
>  Peter
>
>
>  _______________________________________________
>  users mailing list -- users(a)lists.fedoraproject.org
>  To unsubscribe send an email to users-leave(a)lists.fedoraproject.org

[James Hogarth]

On 22 Sep 2017 3:57 am, "Bill Shirley" <bshirley(a)memphis.apirx.biz&gt;
wrote:

Have you looked at overriding it in the systemd unit file?

I use this for mariadb (/etc/systemd/system/mariadb.service):
.include /usr/lib/systemd/system/mariadb.service

[Service]
#LimitNOFILE=infinity
LimitNOFILE=65536
LimitMEMLOCK=infinity

Bill


On 9/21/2017 6:55 PM, Peter Boy wrote:

When Fedora used systemV init you could define a specific user for a
specific tomcat instance in /etc/systconfig/tomcat-[myinstance] by
adding a line TOMCAT_USER=„mytomcat“.

In Fedora 26 with systemd you can define different Tomcat instances
but the above mechanism doesn’t work anymore. I checked the starter
script and couldn’t identify a way to define an instance specific
user.

Well, does anybody know how I can achieve this?


My issue is: If my instances are all executing as the same user I get
sometimes an „Too many open files“ error message and the instance
stops executing. In RHEL it helps to define separate users per
instance. The other instances were not affected by the broken one.



Thanks
Peter


_______________________________________________
users mailing list -- users(a)lists.fedoraproject.org
To unsubscribe send an email to users-leave(a)lists.fedoraproject.org



_______________________________________________
users mailing list -- users(a)lists.fedoraproject.org
To unsubscribe send an email to users-leave(a)lists.fedoraproject.org


Small side note... don't use .include as it's not recommended and long
since deprecated.

Use a systemd unit override which is the supported way of handling it.

mkdir /etc/systemd/system/mariadb.service.d

Pop a .conf file in there with the directives you want to override.

If you do 'systemctl edit <unit_name>' that's how it organises things.

Back to the question of the OP ... sounds like you are in the perfect area
of requirements for a unit template with each tomcat instance from the
template and override User in each to make them different and individually
controllable.

[Peter Boy]

Thank you all for the helpful advice!

Additional question:

>  Am 22.09.2017 um 09:05 schrieb James Hogarth
> <james.hogarth(a)gmail.com&gt;:
>  
>  
>  Small side note... don't use .include as it's not recommended and long since
> deprecated. 
>  
>  Use a systemd unit override which is the supported way of handling it. 
>  
>  mkdir /etc/systemd/system/mariadb.service.d
>  
>  Pop a .conf file in there with the directives you want to override. 
>  
>  If you do 'systemctl edit <unit_name>' that's how it organises things. 
unfortunately I have not overly much experience with systemd at the moment. I did some
internet search, and I guess I had to do


# systemctl  edit  tomcat@[myUniqueInstanceName]

and then insert into the edit windows
  [Service]
  LimitNoFile=8200
and save

So I double the no of open files for that specific instance.

I Would be grateful if you could confirm or correct this. 



>  
>  Back to the question of the OP ... sounds like you are in the perfect area of
> requirements for a unit template with each tomcat instance from the template and override
> User in each to make them different and individually controllable. 

To start my various Tomcat instances I execute various calls of:

systemctl  start  tomcat@[myUniqueInstanceName] 

So I guess Fedora tomcat package already uses unit templates. 


In /usr/lib/systemd/system/tomcat@.service unit file I find
>  - - - - < 
[Service]
. . .
Environment="NAME=%I"
EnvironmentFile=-/etc/sysconfig/tomcat@%I
ExecStart=/usr/libexec/tomcat/server start
. . .
User=tomcat
Group=tomcat
>  - - - - < 
So, there is a mechanism to perform an instance specific configuration using a file in
/etc/sysconfig, nevertheless the user name is hard coded into the unit file, I guess.

So my only options are to either modify the unit file to make the user configurable (and
provide a patch to Fedora) or to use the "systemctl edit
tomcat@[myinstancename]" facility to overwrite the user per instance? 


Thanks for your support and help.


Peter

[Matthew Miller]

On Fri, Sep 22, 2017 at 12:55:34AM +0200, Peter Boy wrote:
>  My issue is: If my instances are all executing as the same user I
> get
>  sometimes an „Too many open files“ error message and the instance
>  stops executing. In RHEL it helps to define separate users per
>  instance. The other instances were not affected by the broken one. 
There may be other reasons to run as separate users, but to address the
immediate problem, have you instead considered raising the limit on
open files for the tomcat user?

On a bigger scope, you might want to look at using containers to
separate your different instaces, which will both address this and give
other benefits.

-- 
Matthew Miller
<mattdm(a)fedoraproject.org&gt;
Fedora Project Leader