In our server tomcat access log, there are lots of requests from 127.0.0.1 which is obviously local request. However, no one from our team actually working from the server so it must be automatic requests. This might be the reason for our server problems last several days as the system always results in full CPU or exceeding memory.
Any one have ideas on how to kill these process?
Thanks
Hi,
I have also been experiencing the same problem with my tomcat as reported by Ngoc (but in my case it was only after I upgraded my war file to 2.12) I am seeing a lot of requests in the log even though I am on 127.0.0.1 and its constantly exceeding memory and completely halting simple processes… I have tried to adjust memory to tomcat but this has not helped. I join Ngoc in asking is there anyone out there with a solution?
On Fri, Jul 19, 2013 at 10:20 AM, Ngoc Thanh Nguyen thanh.hispvietnam@gmail.com wrote:
In our server tomcat access log, there are lots of requests from 127.0.0.1 which is obviously local request. However, no one from our team actually working from the server so it must be automatic requests. This might be the reason for our server problems last several days as the system always results in full CPU or exceeding memory.
Any one have ideas on how to kill these process?
Thanks
Mailing list: https://launchpad.net/~dhis2-devs
Post to : dhis2-devs@lists.launchpad.net
Unsubscribe : https://launchpad.net/~dhis2-devs
More help : https://help.launchpad.net/ListHelp
Hi Jerome,
Is your server public? In my case, I am guessing that some bad guys have hacked into the system by exploiting some security holes of the system or probably dhis2 itself.
Thanh
On Fri, Jul 19, 2013 at 5:05 PM, jerome shaguy jeromeshaguy@gmail.com wrote:
Hi,
I have also been experiencing the same problem with my tomcat as reported by Ngoc (but in my case it was only after I upgraded my war file to 2.12) I am seeing a lot of requests in the log even though I am on 127.0.0.1 and its constantly exceeding memory and completely halting simple processes… I have tried to adjust memory to tomcat but this has not helped. I join Ngoc in asking is there anyone out there with a solution?
On Fri, Jul 19, 2013 at 10:20 AM, Ngoc Thanh Nguyen thanh.hispvietnam@gmail.com wrote:
In our server tomcat access log, there are lots of requests from 127.0.0.1 which is obviously local request. However, no one from our team actually working from the server so it must be automatic requests. This might be the reason for our server problems last several days as the system always results in full CPU or exceeding memory.
Any one have ideas on how to kill these process?
Thanks
Mailing list: https://launchpad.net/~dhis2-devs
Post to : dhis2-devs@lists.launchpad.net
Unsubscribe : https://launchpad.net/~dhis2-devs
More help : https://help.launchpad.net/ListHelp
Hi Ngoc, no my server is not public
On Fri, Jul 19, 2013 at 5:05 PM, jerome shaguy jeromeshaguy@gmail.com wrote:
Hi,
I have also been experiencing the same problem with my tomcat as reported by Ngoc (but in my case it was only after I upgraded my war file to 2.12) I am seeing a lot of requests in the log even though I am on 127.0.0.1 and its constantly exceeding memory and completely halting simple processes… I have tried to adjust memory to tomcat but this has not helped. I join Ngoc in asking is there anyone out there with a solution?
On Fri, Jul 19, 2013 at 10:20 AM, Ngoc Thanh Nguyen thanh.hispvietnam@gmail.com wrote:
In our server tomcat access log, there are lots of requests from 127.0.0.1 which is obviously local request. However, no one from our team actually working from the server so it must be automatic requests. This might be the reason for our server problems last several days as the system always results in full CPU or exceeding memory.
Any one have ideas on how to kill these process?
Thanks
Mailing list: https://launchpad.net/~dhis2-devs
Post to : dhis2-devs@lists.launchpad.net
Unsubscribe : https://launchpad.net/~dhis2-devs
More help : https://help.launchpad.net/ListHelp
I am sure you have a proxy (nginx or apache?) on the same machine. So the users access the proxy and the proxy accesses tomcat (which sees the request as a local one).
You need to add a directive to your proxy to preserve the name of the requesting host. On nginx this is:
see http://ashberlin.co.uk/blog/nginx-proxy-host-header
On apache2:
http://httpd.apache.org/docs/2.2/mod/mod_proxy.html#proxypreservehost
Bob
On 19 July 2013 13:39, jeromeshaguy@gmail.com wrote:
Hi Ngoc, no my server is not public
Sent from my BlackBerry wireless device from MTN
From: Ngoc Thanh Nguyen thanh.hispvietnam@gmail.com
Date: Fri, 19 Jul 2013 18:36:20 +0700
To: jerome shaguyjeromeshaguy@gmail.com
Cc: dhis2-devsdhis2-devs@lists.launchpad.net
Subject: Re: [Dhis2-devs] Strange request from 127.0.0.1
Hi Jerome,
Is your server public? In my case, I am guessing that some bad guys have hacked into the system by exploiting some security holes of the system or probably dhis2 itself.
Thanh
Mailing list: https://launchpad.net/~dhis2-devs
Post to : dhis2-devs@lists.launchpad.net
Unsubscribe : https://launchpad.net/~dhis2-devs
More help : https://help.launchpad.net/ListHelp
On Fri, Jul 19, 2013 at 5:05 PM, jerome shaguy jeromeshaguy@gmail.com wrote:
Hi,
I have also been experiencing the same problem with my tomcat as reported by Ngoc (but in my case it was only after I upgraded my war file to 2.12) I am seeing a lot of requests in the log even though I am on 127.0.0.1 and its constantly exceeding memory and completely halting simple processes… I have tried to adjust memory to tomcat but this has not helped. I join Ngoc in asking is there anyone out there with a solution?
On Fri, Jul 19, 2013 at 10:20 AM, Ngoc Thanh Nguyen thanh.hispvietnam@gmail.com wrote:
In our server tomcat access log, there are lots of requests from 127.0.0.1 which is obviously local request. However, no one from our team actually working from the server so it must be automatic requests. This might be the reason for our server problems last several days as the system always results in full CPU or exceeding memory.
Any one have ideas on how to kill these process?
Thanks
Mailing list: https://launchpad.net/~dhis2-devs
Post to : dhis2-devs@lists.launchpad.net
Unsubscribe : https://launchpad.net/~dhis2-devs
More help : https://help.launchpad.net/ListHelp
Thanks Bob. That’s definitely the case. However, do you think this can affect the performance? In other words, will it cause server memory or cpu problem?
Thanh
On Fri, Jul 19, 2013 at 7:24 PM, Bob Jolliffe bobjolliffe@gmail.com wrote:
I am sure you have a proxy (nginx or apache?) on the same machine. So the users access the proxy and the proxy accesses tomcat (which sees the request as a local one).
You need to add a directive to your proxy to preserve the name of the requesting host. On nginx this is:
On apache2:
http://httpd.apache.org/docs/2.2/mod/mod_proxy.html#proxypreservehost
Bob
On 19 July 2013 13:39, jeromeshaguy@gmail.com wrote:
Hi Ngoc, no my server is not public
Sent from my BlackBerry wireless device from MTN
From: Ngoc Thanh Nguyen thanh.hispvietnam@gmail.com
Date: Fri, 19 Jul 2013 18:36:20 +0700
To: jerome shaguyjeromeshaguy@gmail.com
Cc: dhis2-devsdhis2-devs@lists.launchpad.net
Subject: Re: [Dhis2-devs] Strange request from 127.0.0.1
Hi Jerome,
Is your server public? In my case, I am guessing that some bad guys have hacked into the system by exploiting some security holes of the system or probably dhis2 itself.
Thanh
Mailing list: https://launchpad.net/~dhis2-devs
Post to : dhis2-devs@lists.launchpad.net
Unsubscribe : https://launchpad.net/~dhis2-devs
More help : https://help.launchpad.net/ListHelp
On Fri, Jul 19, 2013 at 5:05 PM, jerome shaguy jeromeshaguy@gmail.com wrote:
Hi,
I have also been experiencing the same problem with my tomcat as reported by Ngoc (but in my case it was only after I upgraded my war file to 2.12) I am seeing a lot of requests in the log even though I am on 127.0.0.1 and its constantly exceeding memory and completely halting simple processes… I have tried to adjust memory to tomcat but this has not helped. I join Ngoc in asking is there anyone out there with a solution?
On Fri, Jul 19, 2013 at 10:20 AM, Ngoc Thanh Nguyen thanh.hispvietnam@gmail.com wrote:
In our server tomcat access log, there are lots of requests from 127.0.0.1 which is obviously local request. However, no one from our team actually working from the server so it must be automatic requests. This might be the reason for our server problems last several days as the system always results in full CPU or exceeding memory.
Any one have ideas on how to kill these process?
Thanks
Mailing list: https://launchpad.net/~dhis2-devs
Post to : dhis2-devs@lists.launchpad.net
Unsubscribe : https://launchpad.net/~dhis2-devs
More help : https://help.launchpad.net/ListHelp
I run the same type of setup on a number of production servers. Nginx/Apache are definitely not the problem, as their memory consumption compared to DHIS2 and the database, is negligible. I suspect it is a configuration issue of your server.
On a related note Bob, do you know how to get the “real IP” of the server into the Tomcat logs? The header directive is necessary, but does not show up in my Tomcat logs with the user’s IP. I somehow think it is not possible but maybe I am missing something.
Regards,
Jason
On Fri, Jul 19, 2013 at 4:26 PM, Ngoc Thanh Nguyen thanh.hispvietnam@gmail.com wrote:
Thanh
Thanks Bob. That’s definitely the case. However, do you think this can affect the performance? In other words, will it cause server memory or cpu problem?
Mailing list: https://launchpad.net/~dhis2-devs
Post to : dhis2-devs@lists.launchpad.net
Unsubscribe : https://launchpad.net/~dhis2-devs
More help : https://help.launchpad.net/ListHelp
On Fri, Jul 19, 2013 at 7:24 PM, Bob Jolliffe bobjolliffe@gmail.com wrote:
I am sure you have a proxy (nginx or apache?) on the same machine. So the users access the proxy and the proxy accesses tomcat (which sees the request as a local one).
You need to add a directive to your proxy to preserve the name of the requesting host. On nginx this is:
On apache2:
http://httpd.apache.org/docs/2.2/mod/mod_proxy.html#proxypreservehost
Bob
On 19 July 2013 13:39, jeromeshaguy@gmail.com wrote:
Hi Ngoc, no my server is not public
Sent from my BlackBerry wireless device from MTN
From: Ngoc Thanh Nguyen thanh.hispvietnam@gmail.com
Date: Fri, 19 Jul 2013 18:36:20 +0700
To: jerome shaguyjeromeshaguy@gmail.com
Cc: dhis2-devsdhis2-devs@lists.launchpad.net
Subject: Re: [Dhis2-devs] Strange request from 127.0.0.1
Hi Jerome,
Is your server public? In my case, I am guessing that some bad guys have hacked into the system by exploiting some security holes of the system or probably dhis2 itself.
Thanh
Mailing list: https://launchpad.net/~dhis2-devs
Post to : dhis2-devs@lists.launchpad.net
Unsubscribe : https://launchpad.net/~dhis2-devs
More help : https://help.launchpad.net/ListHelp
On Fri, Jul 19, 2013 at 5:05 PM, jerome shaguy jeromeshaguy@gmail.com wrote:
Hi,
I have also been experiencing the same problem with my tomcat as reported by Ngoc (but in my case it was only after I upgraded my war file to 2.12) I am seeing a lot of requests in the log even though I am on 127.0.0.1 and its constantly exceeding memory and completely halting simple processes… I have tried to adjust memory to tomcat but this has not helped. I join Ngoc in asking is there anyone out there with a solution?
On Fri, Jul 19, 2013 at 10:20 AM, Ngoc Thanh Nguyen thanh.hispvietnam@gmail.com wrote:
In our server tomcat access log, there are lots of requests from 127.0.0.1 which is obviously local request. However, no one from our team actually working from the server so it must be automatic requests. This might be the reason for our server problems last several days as the system always results in full CPU or exceeding memory.
Any one have ideas on how to kill these process?
Thanks
Mailing list: https://launchpad.net/~dhis2-devs
Post to : dhis2-devs@lists.launchpad.net
Unsubscribe : https://launchpad.net/~dhis2-devs
More help : https://help.launchpad.net/ListHelp
Thinking about the nature of IP this is probably not possible … the “real” server name from the request is certainly possible, but the destination IP (as used by the client) is not really recoverable - along the way it might well have been natted for example (or even load balanced), so the IP of the interface the server is listening on will rarely be the same as the one the client resolved for the FQDN. The only way to know it really is to request the same nameserver which the client did. There isn’t any realistic way you could do this 
On 19 July 2013 18:41, Jason Pickering jason.p.pickering@gmail.com wrote:
I run the same type of setup on a number of production servers. Nginx/Apache are definitely not the problem, as their memory consumption compared to DHIS2 and the database, is negligible. I suspect it is a configuration issue of your server.
On a related note Bob, do you know how to get the “real IP” of the server into the Tomcat logs? The header directive is necessary, but does not show up in my Tomcat logs with the user’s IP. I somehow think it is not possible but maybe I am missing something.
Regards,
Jason
On Fri, Jul 19, 2013 at 4:26 PM, Ngoc Thanh Nguyen thanh.hispvietnam@gmail.com wrote:
Thanh
Thanks Bob. That’s definitely the case. However, do you think this can affect the performance? In other words, will it cause server memory or cpu problem?
Mailing list: https://launchpad.net/~dhis2-devs
Post to : dhis2-devs@lists.launchpad.net
Unsubscribe : https://launchpad.net/~dhis2-devs
More help : https://help.launchpad.net/ListHelp
On Fri, Jul 19, 2013 at 7:24 PM, Bob Jolliffe bobjolliffe@gmail.com wrote:
I am sure you have a proxy (nginx or apache?) on the same machine. So the users access the proxy and the proxy accesses tomcat (which sees the request as a local one).
You need to add a directive to your proxy to preserve the name of the requesting host. On nginx this is:
On apache2:
http://httpd.apache.org/docs/2.2/mod/mod_proxy.html#proxypreservehost
Bob
On 19 July 2013 13:39, jeromeshaguy@gmail.com wrote:
Hi Ngoc, no my server is not public
Sent from my BlackBerry wireless device from MTN
From: Ngoc Thanh Nguyen thanh.hispvietnam@gmail.com
Date: Fri, 19 Jul 2013 18:36:20 +0700
To: jerome shaguyjeromeshaguy@gmail.com
Cc: dhis2-devsdhis2-devs@lists.launchpad.net
Subject: Re: [Dhis2-devs] Strange request from 127.0.0.1
Hi Jerome,
Is your server public? In my case, I am guessing that some bad guys have hacked into the system by exploiting some security holes of the system or probably dhis2 itself.
Thanh
Mailing list: https://launchpad.net/~dhis2-devs
Post to : dhis2-devs@lists.launchpad.net
Unsubscribe : https://launchpad.net/~dhis2-devs
More help : https://help.launchpad.net/ListHelp
On Fri, Jul 19, 2013 at 5:05 PM, jerome shaguy jeromeshaguy@gmail.com wrote:
Hi,
I have also been experiencing the same problem with my tomcat as reported by Ngoc (but in my case it was only after I upgraded my war file to 2.12) I am seeing a lot of requests in the log even though I am on 127.0.0.1 and its constantly exceeding memory and completely halting simple processes… I have tried to adjust memory to tomcat but this has not helped. I join Ngoc in asking is there anyone out there with a solution?
On Fri, Jul 19, 2013 at 10:20 AM, Ngoc Thanh Nguyen thanh.hispvietnam@gmail.com wrote:
In our server tomcat access log, there are lots of requests from 127.0.0.1 which is obviously local request. However, no one from our team actually working from the server so it must be automatic requests. This might be the reason for our server problems last several days as the system always results in full CPU or exceeding memory.
Any one have ideas on how to kill these process?
Thanks
Mailing list: https://launchpad.net/~dhis2-devs
Post to : dhis2-devs@lists.launchpad.net
Unsubscribe : https://launchpad.net/~dhis2-devs
More help : https://help.launchpad.net/ListHelp
Thanh whatt does “top” tell you? Most likely this is java going mental trying to do datamart with too little memory or something similar.
If so, you might want to try running jstack to see what the threads are up to, but if you are totally burning out then its possible the jvm won’t respond 
On 19 July 2013 16:26, Ngoc Thanh Nguyen thanh.hispvietnam@gmail.com wrote:
Thanh
Thanks Bob. That’s definitely the case. However, do you think this can affect the performance? In other words, will it cause server memory or cpu problem?
On Fri, Jul 19, 2013 at 7:24 PM, Bob Jolliffe bobjolliffe@gmail.com wrote:
I am sure you have a proxy (nginx or apache?) on the same machine. So the users access the proxy and the proxy accesses tomcat (which sees the request as a local one).
You need to add a directive to your proxy to preserve the name of the requesting host. On nginx this is:
On apache2:
http://httpd.apache.org/docs/2.2/mod/mod_proxy.html#proxypreservehost
Bob
On 19 July 2013 13:39, jeromeshaguy@gmail.com wrote:
Hi Ngoc, no my server is not public
Sent from my BlackBerry wireless device from MTN
From: Ngoc Thanh Nguyen thanh.hispvietnam@gmail.com
Date: Fri, 19 Jul 2013 18:36:20 +0700
To: jerome shaguyjeromeshaguy@gmail.com
Cc: dhis2-devsdhis2-devs@lists.launchpad.net
Subject: Re: [Dhis2-devs] Strange request from 127.0.0.1
Hi Jerome,
Is your server public? In my case, I am guessing that some bad guys have hacked into the system by exploiting some security holes of the system or probably dhis2 itself.
Thanh
Mailing list: https://launchpad.net/~dhis2-devs
Post to : dhis2-devs@lists.launchpad.net
Unsubscribe : https://launchpad.net/~dhis2-devs
More help : https://help.launchpad.net/ListHelp
On Fri, Jul 19, 2013 at 5:05 PM, jerome shaguy jeromeshaguy@gmail.com wrote:
Hi,
I have also been experiencing the same problem with my tomcat as reported by Ngoc (but in my case it was only after I upgraded my war file to 2.12) I am seeing a lot of requests in the log even though I am on 127.0.0.1 and its constantly exceeding memory and completely halting simple processes… I have tried to adjust memory to tomcat but this has not helped. I join Ngoc in asking is there anyone out there with a solution?
On Fri, Jul 19, 2013 at 10:20 AM, Ngoc Thanh Nguyen thanh.hispvietnam@gmail.com wrote:
In our server tomcat access log, there are lots of requests from 127.0.0.1 which is obviously local request. However, no one from our team actually working from the server so it must be automatic requests. This might be the reason for our server problems last several days as the system always results in full CPU or exceeding memory.
Any one have ideas on how to kill these process?
Thanks
Mailing list: https://launchpad.net/~dhis2-devs
Post to : dhis2-devs@lists.launchpad.net
Unsubscribe : https://launchpad.net/~dhis2-devs
More help : https://help.launchpad.net/ListHelp
Hi Jason,
On 19 July 2013 22:26, Jason Pickering jason.p.pickering@gmail.com wrote:
On a related note Bob, do you know how to get the “real IP” of the server into the Tomcat logs? The header directive is necessary, but does not show up in my Tomcat logs with the user’s IP. I somehow think it is not possible but maybe I am missing something.
I am assuming you are getting the client IP shown correctly in the access logs in tomcat.
The server IP is showing 127.0.0.1 because that what its connector has been bound to. Change the connector’s address to the public address and it will show you that in the logs.
<Connector port="8080" protocol="HTTP/1.1" address="<public-IP here>" connectionTimeout="20000" redirectPort="8443" />
If its dynamic address, it will be problematic though…
Regards,
Saptarshi PURKAYASTHA
My Tech Blog: http://sunnytalkstech.blogspot.com
You Live by CHOICE, Not by CHANCE
Hi Thanh,
You might want to use the Stuck thread detection value for logging, if there is some threads that get stuck.
And these might never complete their requests to return back to nginx.
On Fri, Jul 19, 2013 at 7:24 PM, Bob Jolliffe bobjolliffe@gmail.com wrote:
I am sure you have a proxy (nginx or apache?) on the same machine. So the users access the proxy and the proxy accesses tomcat (which sees the request as a local one).
You need to add a directive to your proxy to preserve the name of the requesting host. On nginx this is:
On apache2:
http://httpd.apache.org/docs/2.2/mod/mod_proxy.html#proxypreservehost
Bob
On 19 July 2013 13:39, jeromeshaguy@gmail.com wrote:
Hi Ngoc, no my server is not public
Sent from my BlackBerry wireless device from MTN
From: Ngoc Thanh Nguyen thanh.hispvietnam@gmail.com
Date: Fri, 19 Jul 2013 18:36:20 +0700
To: jerome shaguyjeromeshaguy@gmail.com
Cc: dhis2-devsdhis2-devs@lists.launchpad.net
Subject: Re: [Dhis2-devs] Strange request from 127.0.0.1
Hi Jerome,
Is your server public? In my case, I am guessing that some bad guys have hacked into the system by exploiting some security holes of the system or probably dhis2 itself.
Thanh
Mailing list: https://launchpad.net/~dhis2-devs
Post to : dhis2-devs@lists.launchpad.net
Unsubscribe : https://launchpad.net/~dhis2-devs
More help : https://help.launchpad.net/ListHelp
On Fri, Jul 19, 2013 at 5:05 PM, jerome shaguy jeromeshaguy@gmail.com wrote:
Hi,
I have also been experiencing the same problem with my tomcat as reported by Ngoc (but in my case it was only after I upgraded my war file to 2.12) I am seeing a lot of requests in the log even though I am on 127.0.0.1 and its constantly exceeding memory and completely halting simple processes… I have tried to adjust memory to tomcat but this has not helped. I join Ngoc in asking is there anyone out there with a solution?
On Fri, Jul 19, 2013 at 10:20 AM, Ngoc Thanh Nguyen thanh.hispvietnam@gmail.com wrote:
In our server tomcat access log, there are lots of requests from 127.0.0.1 which is obviously local request. However, no one from our team actually working from the server so it must be automatic requests. This might be the reason for our server problems last several days as the system always results in full CPU or exceeding memory.
Any one have ideas on how to kill these process?
Thanks
Mailing list: https://launchpad.net/~dhis2-devs
Post to : dhis2-devs@lists.launchpad.net
Unsubscribe : https://launchpad.net/~dhis2-devs
More help : https://help.launchpad.net/ListHelp
Hi Saptarshi,
In my case, Nginx is the forward facing reverse proxy. For security reasons, I do not want to Tomcat to use the public IP directly (which is static), so that is not an option for me.
All requests in the access logs are from 127.0.0.1 (the reverse proxy). Of course I can see the client activity in the Nginx log with the “real IP”, but it would be useful in some cases to have this directly in the Tomcat logs. Not a big deal really, but would be nice to have.
Regards,
Jason
On Sat, Jul 20, 2013 at 7:33 AM, Saptarshi Purkayastha sunbiz@gmail.com wrote:
Hi Jason,
On 19 July 2013 22:26, Jason Pickering jason.p.pickering@gmail.com wrote:
On a related note Bob, do you know how to get the “real IP” of the server into the Tomcat logs? The header directive is necessary, but does not show up in my Tomcat logs with the user’s IP. I somehow think it is not possible but maybe I am missing something.
I am assuming you are getting the client IP shown correctly in the access logs in tomcat.
The server IP is showing 127.0.0.1 because that what its connector has been bound to. Change the connector’s address to the public address and it will show you that in the logs.<Connector port="8080" protocol="HTTP/1.1" address="<public-IP here>" connectionTimeout="20000" redirectPort="8443" />If its dynamic address, it will be problematic though…
Regards,
Saptarshi PURKAYASTHAMy Tech Blog: http://sunnytalkstech.blogspot.com
You Live by CHOICE, Not by CHANCE
ah so it’s not server iip you want but the clients. that should work with the info i replied to tanh . will check later …
On Saturday, 20 July 2013, Jason Pickering jason.p.pickering@gmail.com wrote:
Hi Saptarshi,
In my case, Nginx is the forward facing reverse proxy. For security reasons, I do not want to Tomcat to use the public IP directly (which is static), so that is not an option for me.
All requests in the access logs are from 127.0.0.1 (the reverse proxy). Of course I can see the client activity in the Nginx log with the “real IP”, but it would be useful in some cases to have this directly in the Tomcat logs. Not a big deal really, but would be nice to have.
Regards,
JasonOn Sat, Jul 20, 2013 at 7:33 AM, Saptarshi Purkayastha sunbiz@gmail.com wrote:
Hi Jason,
On 19 July 2013 22:26, Jason Pickering jason.p.pickering@gmail.com wrote:
On a related note Bob, do you know how to get the “real IP” of the server into the Tomcat logs? The header directive is necessary, but does not show up in my Tomcat logs with the user’s IP. I somehow think it is not possible but maybe I am missing something.
I am assuming you are getting the client IP shown correctly in the access logs in tomcat.
The server IP is showing 127.0.0.1 because that what its connector has been bound to. Change the connector’s address to the public address and it will show you that in the logs.
<Connector
port=“8080”
protocol=“HTTP/1.1”
address=“”
connectionTimeout=“20000”
redirectPort="8443"/>
If its dynamic address, it will be problematic though…
Regards,
Saptarshi PURKAYASTHA
My Tech Blog: http://sunnytalkstech.blogspot.com
You Live by CHOICE, Not by CHANCE