Apache Tomcat 8 Configuration Reference

All implementations of Listener support the following attributes:

The APR Lifecycle Listener checks for the presence of the APR/native library and loads the library if it is present. For more information see the APR/native guide.

This listener must only be nested within Server elements.

The following additional attributes are supported by the APR Lifecycle Listener:

The Global Resources Lifecycle Listener initializes the Global JNDI resources defined in server.xml as part of the Global Resources element. Without this listener, none of the Global Resources will be available.

This listener must only be nested within Server elements.

No additional attributes are supported by the Global Resources Lifecycle Listener.

The JNI Library Loading Listener makes it possible for multiple Webapps to use a native library, by loading the native library using a shared class loader (typically the Common class loader but may vary in some configurations)

The listener supports two mutually exclusive attributes, so one of them must be used, but you can not use both together:

The JRE Memory Leak Prevention Listener provides work-arounds for known places where the Java Runtime environment uses the context class loader to load a singleton as this will cause a memory leak if a web application class loader happens to be the context class loader at the time. The work-around is to initialise these singletons when this listener starts as Tomcat's common class loader is the context class loader at that time. It also provides work-arounds for known issues that can result in locked JAR files.

This listener must only be nested within Server elements.

The following additional attributes are supported by the JRE Memory Leak Prevention Listener:

The Version Logging Lifecycle Listener logs Tomcat, Java and operating system information when Tomcat starts.

This listener must only be nested within Server elements and should be the first listener defined.

The following additional attributes are supported by the Version Logging Lifecycle Listener:

This listener requires catalina-jmx-remote.jar to be placed in $CATALINA_HOME/lib. This jar may be found in the extras directory of the binary download area.

The JMX Remote Lifecycle Listener fixes the ports used by the JMX/RMI Server making things much simpler if you need to connect jconsole or a similar tool to a remote Tomcat instance that is running behind a firewall. Only these ports are configured via the listener. The remainder of the configuration is via the standard system properties for configuring JMX. For further information on configuring JMX see Monitoring and Management Using JMX included with the Java SDK documentation.

This listener must only be nested within a Server element.

The following additional attributes are supported by the JMX Remote Lifecycle Listener:

Using file-based Authentication and Authorisation

If this listener was configured in server.xml as:

  <Listener className="org.apache.catalina.mbeans.JmxRemoteLifecycleListener"
          rmiRegistryPortPlatform="10001" rmiServerPortPlatform="10002" />

with the following system properties set (e.g. in setenv.sh):

  -Dcom.sun.management.jmxremote.password.file=$CATALINA_BASE/conf/jmxremote.password
  -Dcom.sun.management.jmxremote.access.file=$CATALINA_BASE/conf/jmxremote.access
  -Dcom.sun.management.jmxremote.ssl=false

$CATALINA_BASE/conf/jmxremote.password containing:

admin letmein

$CATALINA_BASE/conf/jmxremote.access containing:

admin readwrite

then opening ports 10001 (RMI Registry) and 10002 (JMX/RMI Server) in your firewall would enable jconsole to connect to a Tomcat instance running behind a firewall using a connection string of the form:

service:jmx:rmi://<hostname>:10002/jndi/rmi://<hostname>:10001/jmxrmi

with a user name of admin and a password of letmein.

Using JAAS

If we use the following system properties instead:

  -Dcom.sun.management.jmxremote.login.config=Tomcat
  -Djava.security.auth.login.config=$CATALINA_BASE/conf/login.config
  -Dcom.sun.management.jmxremote.access.file=$CATALINA_BASE/conf/jmxremote.access
  -Dcom.sun.management.jmxremote.ssl=false

$CATALINA_BASE/conf/login.config containing your choice of JAAS LoginModule implementation, for example:

  Tomcat { /* should match to the com.sun.management.jmxremote.login.config property */

    /* for illustration purposes only */
    com.sun.security.auth.module.LdapLoginModule REQUIRED
      userProvider="ldap://ldap-svr/ou=people,dc=example,dc=com"
      userFilter="(&(uid={USERNAME})(objectClass=inetOrgPerson))"
      authzIdentity="admin"
      debug=true;
  };

$CATALINA_BASE/conf/jmxremote.access containing:

admin readwrite

then we would need to provide LDAP credentials instead.

Note that the examples above do not use SSL. JMX access should be considered equivalent to administrative access and secured accordingly.

This listener performs system property replacement using the property source configured on the digester. When ${parameter} denoted parameters are found in the values of system properties, the property source will be invoked to attempt to replace it.