• Introduction
• Configuring Manager Application Access
• Supported Manager Commands
  1. Deploy A New Application Remotely
  2. Deploy A New Application from a Local Path
  3. List Currently Deployed Applications
  4. Reload An Existing Application
  5. List OS and JVM Properties
  6. List Available Global JNDI Resources
  7. List Available Security Roles
  8. Session Statistics
  9. Start an Existing Application
  10. Stop an Existing Application
  11. Undeploy an Existing Application
  12. Finding memory leaks
  13. Server Status
• Executing Manager Commands With Ant
  1. Tasks output capture
• Using the JMX Proxy Servlet
  1. What is JMX Proxy Servlet
  2. JMX Query command
  3. JMX Set command

In many production environments, it is very useful to have the capability to deploy a new web application, or undeploy an existing one, without having to shut down and restart the entire container. In addition, you can request an existing application to reload itself, even if you have not declared it to be reloadable in the Tomcat 6 server configuration file.

To support these capabilities, Tomcat 6 includes a web application (installed by default on context path /manager) that supports the following functions:

• Deploy a new web application from the uploaded contents of a WAR file.
• Deploy a new web application, on a specified context path, from the server file system.
• List the currently deployed web applications, as well as the sessions that are currently active for those web apps.
• Reload an existing web application, to reflect changes in the contents of /WEB-INF/classes or /WEB-INF/lib.
• List the OS and JVM property values.
• List the available global JNDI resources, for use in deployment tools that are preparing <ResourceLink> elements nested in a <Context> deployment description.
• List the available security roles defined in the user database.
• Start a stopped application (thus making it available again).
• Stop an existing application (so that it becomes unavailable), but do not undeploy it.
• Undeploy a deployed web application and delete its document base directory (unless it was deployed from file system).

A default Tomcat installation includes the manager. To add an instance of the Manager web application Context to a new host install the manager.xml context configuration file in the $CATALINA_BASE/conf/[enginename]/[hostname] folder. Here is an example:

<Context path="/manager" privileged="true"
         docBase="/usr/local/tomcat6/webapps/manager">
</Context>

If you have Tomcat configured to support multiple virtual hosts (websites) you would need to configure a Manager for each.

There are three ways to use the Manager web application.

• As an application with a user interface you use in your browser. Here is an example URL where you can replace localhost with your website host name: http://localhost/manager/html/ .
• A minimal version using HTTP requests only which is suitable for use by scripts setup by system administrators. Commands are given as part of the request URI, and responses are in the form of simple text that can be easily parsed and processed. See Supported Manager Commands for more information.
• A convenient set of task definitions for the Ant (version 1.4 or later) build tool. See Executing Manager Commands With Ant for more information.

The description below uses the variable name $CATALINA_BASE to refer the base directory against which most relative paths are resolved. If you have not configured Tomcat 6 for multiple instances by setting a CATALINA_BASE directory, then $CATALINA_BASE will be set to the value of $CATALINA_HOME, the directory into which you have installed Tomcat 6.

It would be quite unsafe to ship Tomcat with default settings that allowed anyone on the Internet to execute the Manager application on your server. Therefore, the Manager application is shipped with the requirement that anyone who attempts to use it must authenticate themselves, using a username and password that have the appropriate role associated with them. Further, there is no username in the default users file ($CATALINA_BASE/conf/tomcat-users.xml) that is assigned an appropriate role. Therefore, access to the Manager application is completely disabled by default.

To enable access to the Manager web application, you must either create a new username/password combination and associate on of the manager roles with it, or add a manager role to some existing username/password combination. There are four roles defined by the manager application:

• manager-gui - Allows access to the html interface
• manager-script - Allows access to the plain text interface
• manager-jmx - Allows access to the JMX proxy interface
• manager-status - Allows access to the read-only status pages

The manager application is configured to use the CSRF prevention filter. For this filter to be effective, any user assigned the manager-gui role must not be assigned the manager-script nor the manager-jmx roles.

Exactly where roles are associated to users depends on which Realm implementation you are using:

• MemoryRealm - If you have not customized your $CATALINA_BASE/conf/server.xml to select a different one, Tomcat 6 defaults to an XML-format file stored at $CATALINA_BASE/conf/tomcat-users.xml, which can be edited with any text editor. This file contains an XML <user> for each individual user, which might look something like this:

  	<user name="craigmcc" password="secret" roles="standard,manager-gui" />

  which defines the username and password used by this individual to log on, and the role names he or she is associated with. You can add a role, e.g. manager-gui, to the comma-delimited roles attribute for one or more existing users, and/or create new users with that assigned role.
• JDBCRealm - Your user and role information is stored in a database accessed via JDBC. Add the required role(s) to one or more existing users, and/or create one or more new users with the required role(s) assigned, following the standard procedures for your environment.
• JNDIRealm - Your user and role information is stored in a directory server accessed via LDAP. Add the required role(s) to one or more existing users, and/or create one or more new users with the required role(s) assigned, following the standard procedures for your environment.

The first time you attempt to issue one of the Manager commands described in the next section, you will be challenged to log on using BASIC authentication. The username and password you enter do not matter, as long as they identify a valid user in the users database who possesses the appropriate role.

In addition to the password restrictions the manager web application could be restricted by the remote IP address or host by adding a RemoteAddrValve or RemoteHostValve. Here is an example of restricting access to the localhost by IP address:

<Context privileged="true">
         <Valve className="org.apache.catalina.valves.RemoteAddrValve"
                allow="127\.0\.0\.1"/>
</Context>

All commands that the Manager application knows how to process are specified in a single request URI like this:

	http://{host}:{port}/manager/{command}?{parameters}

where {host} and {port} represent the hostname and port number on which Tomcat is running, {command} represents the Manager command you wish to execute, and {parameters} represents the query parameters that are specific to that command. In the illustrations below, customize the host and port appropriately for your installation.

Most commands accept one or more of the following query parameters:

• path - The context path (including the leading slash) of the web application you are dealing with. To select the ROOT web application, specify "/". NOTE - It is not possible to perform administrative commands on the Manager application itself.
• war - URL of a web application archive (WAR) file, pathname of a directory which contains the web application, or a Context configuration ".xml" file. You can use URLs in any of the following formats:
  • file:/absolute/path/to/a/directory - The absolute path of a directory that contains the unpacked version of a web application. This directory will be attached to the context path you specify without any changes.
  • file:/absolute/path/to/a/webapp.war - The absolute path of a web application archive (WAR) file. This is valid only for the /deploy command, and is the only acceptable format to that command.
  • jar:file:/absolute/path/to/a/warfile.war!/ - The URL to a local web application archive (WAR) file. You can use any syntax that is valid for the JarURLConnection class for reference to an entire JAR file.
  • file:/absolute/path/to/a/context.xml - The absolute path of a web application Context configuration ".xml" file which contains the Context configuration element.
  • directory - The directory name for the web application context in the Host's application base directory.
  • webapp.war - The name of a web application war file located in the Host's application base directory.

Each command will return a response in text/plain format (i.e. plain ASCII with no HTML markup), making it easy for both humans and programs to read). The first line of the response will begin with either OK or FAIL, indicating whether the requested command was successful or not. In the case of failure, the rest of the first line will contain a description of the problem that was encountered. Some commands include additional lines of information as described below.

Internationalization Note - The Manager application looks up its message strings in resource bundles, so it is possible that the strings have been translated for your platform. The examples below show the English version of the messages.

WARNING: the legacy commands /install and /remove are deprecated. They are presently equivalent to /deploy and /undeploy, but could be removed in a future release.

Deploy A New Application Remotely

http://localhost:8080/manager/deploy?path=/foo Upload the web application archive (WAR) file that is specified as the request data in this HTTP PUT request, install it into the appBase directory of our corresponding virtual host, and start , using the directory name or the war file name without the .war extension as the path. The application can later be undeployed (and the corresponding application directory removed) by use of the /undeploy command. The .WAR file may include Tomcat specific deployment configuration, by including a Context configuration XML file in /META-INF/context.xml. URL parameters include: update: When set to true, any existing update will be undeployed first. The default value is set to false. tag: Specifying a tag name, this allows associating the deployed webapp with a version number. The application version can be later redeployed when needed using only the tag. NOTE - This command is the logical opposite of the /undeploy command. If installation and startup is successful, you will receive a response like this: OK - Deployed application at context path /foo Otherwise, the response will start with FAIL and include an error message. Possible causes for problems include: Application already exists at path /foo The context paths for all currently running web applications must be unique. Therefore, you must undeploy the existing web application using this context path, or choose a different context path for the new one. The update parameter may be specified as a parameter on the URL, with a value of true to avoid this error. In that case, an undeploy will be performed on an existing application before performing the deployment. Encountered exception An exception was encountered trying to start the new web application. Check the Tomcat 6 logs for the details, but likely explanations include problems parsing your /WEB-INF/web.xml file, or missing classes encountered when initializing application event listeners and filters.

Deploy A New Application from a Local Path

Deploy and start a new web application, attached to the specified context path (which must not be in use by any other web application). This command is the logical opposite of the /undeploy command. There are a number of different ways the deploy command can be used. Deploy a version of a previously deployed webapp This can be used to deploy a previous version of a web application, which has been deployed using the tag attribute. Note that the work directory for the manager webapp will contain the previously deployed WARs; removing it would make the deployment fail. http://localhost:8080/manager/deploy?path=/footoo&tag=footag Deploy a Directory or WAR by URL Deploy a web application directory or ".war" file located on the Tomcat server. If no path is specified, the directory name or the war file name without the ".war" extension is used as the path. The war parameter specifies a URL (including the file: scheme) for either a directory or a web application archive (WAR) file. The supported syntax for a URL referring to a WAR file is described on the Javadocs page for the java.net.JarURLConnection class. Use only URLs that refer to the entire WAR file. In this example the web application located in the directory /path/to/foo on the Tomcat server is deployed as the web application context named /footoo. http://localhost:8080/manager/deploy?path=/footoo&war=file:/path/to/foo In this example the ".war" file /path/to/bar.war on the Tomcat server is deployed as the web application context named /bar. Notice that there is no path parameter so the context path defaults to the name of the web application archive file without the ".war" extension. http://localhost:8080/manager/deploy?war=jar:file:/path/to/bar.war!/ Deploy a Directory or War from the Host appBase Deploy a web application directory or ".war" file located in your Host appBase directory. The directory name or the war file name without the ".war" extension is used as the path. In this example the web application located in a sub directory named foo in the Host appBase directory of the Tomcat server is deployed as the web application context named /foo. Notice that the context path used is the name of the web application directory. http://localhost:8080/manager/deploy?war=foo In this example the ".war" file bar.war located in your Host appBase directory on the Tomcat server is deployed as the web application context named /bar. http://localhost:8080/manager/deploy?war=bar.war Deploy using a Context configuration ".xml" file If the Host deployXML flag is set to true you can deploy a web application using a Context configuration ".xml" file and an optional ".war" file or web application directory. The context path is not used when deploying a web application using a context ".xml" configuration file. A Context configuration ".xml" file can contain valid XML for a web application Context just as if it were configured in your Tomcat server.xml configuration file. Here is an example: <Context path="/foobar" docBase="/path/to/application/foobar"> <!-- Link to the user database we will get roles from --> <ResourceLink name="users" global="UserDatabase" type="org.apache.catalina.UserDatabase"/> </Context> When the optional war parameter is set to the URL for a web application ".war" file or directory it overrides any docBase configured in the context configuration ".xml" file. Here is an example of deploying an application using a Context configuration ".xml" file. http://localhost:8080/manager/deploy?config=file:/path/context.xml Here is an example of deploying an application using a Context configuration ".xml" file and a web application ".war" file located on the server. http://localhost:8080/manager/deploy?config=file:/path/context.xml&war=jar:file:/path/bar.war!/ Deployment Notes If the Host is configured with unpackWARs=true and you deploy a war file, the war will be unpacked into a directory in your Host appBase directory. If the application war or directory is installed in your Host appBase directory and either the Host is configured with autoDeploy=true or liveDeploy=true, the Context path must match the directory name or war file name without the ".war" extension. For security when untrusted users can manage web applications, the Host deployXML flag can be set to false. This prevents untrusted users from deploying web applications using a configuration XML file and also prevents them from deploying application directories or ".war" files located outside of their Host appBase. Deploy Response If installation and startup is successful, you will receive a response like this: OK - Deployed application at context path /foo Otherwise, the response will start with FAIL and include an error message. Possible causes for problems include: Application already exists at path /foo The context paths for all currently running web applications must be unique. Therefore, you must undeploy the existing web application using this context path, or choose a different context path for the new one. The update parameter may be specified as a parameter on the URL, with a value of true to avoid this error. In that case, an undeploy will be performed on an existing application before performing the deployment. Document base does not exist or is not a readable directory The URL specified by the war parameter must identify a directory on this server that contains the "unpacked" version of a web application, or the absolute URL of a web application archive (WAR) file that contains this application. Correct the value specified by the war parameter. Encountered exception An exception was encountered trying to start the new web application. Check the Tomcat 6 logs for the details, but likely explanations include problems parsing your /WEB-INF/web.xml file, or missing classes encountered when initializing application event listeners and filters. Invalid application URL was specified The URL for the directory or web application that you specified was not valid. Such URLs must start with file:, and URLs for a WAR file must end in ".war". Invalid context path was specified The context path must start with a slash character. To reference the ROOT web application use "/". Context path must match the directory or WAR file name: If the application war or directory is installed in your Host appBase directory and either the Host is configured with autoDeploy=true or liveDeploy=true, the Context path must match the directory name or war file name without the ".war" extension. Only web applications in the Host web application directory can be installed If the Host deployXML flag is set to false this error will happen if an attempt is made to deploy a web application directory or ".war" file outside of the Host appBase directory.

List Currently Deployed Applications

http://localhost:8080/manager/list List the context paths, current status (running or stopped), and number of active sessions for all currently deployed web applications. A typical response immediately after starting Tomcat might look like this: OK - Listed applications for virtual host localhost /webdav:running:0 /examples:running:0 /manager:running:0 /:running:0

Reload An Existing Application
http://localhost:8080/manager/reload?path=/examples Signal an existing application to shut itself down and reload. This can be useful when the web application context is not reloadable and you have updated classes or property files in the /WEB-INF/classes directory or when you have added or updated jar files in the /WEB-INF/lib directory. NOTE: The /WEB-INF/web.xml web application configuration file is not reread on a reload. If you have made changes to your web.xml file you must stop then start the web application. If this command succeeds, you will see a response like this: OK - Reloaded application at context path /examples Otherwise, the response will start with FAIL and include an error message. Possible causes for problems include: Encountered exception An exception was encountered trying to restart the web application. Check the Tomcat 6 logs for the details. Invalid context path was specified The context path must start with a slash character. To reference the ROOT web application use "/". No context exists for path /foo There is no deployed application on the context path that you specified. No context path was specified The path parameter is required. Reload not supported on WAR deployed at path /foo Currently, application reloading (to pick up changes to the classes or web.xml file) is not supported when idth="1" height="1he.catalina.UserDatabase"/> </Context>

When the optional war parameter is set to the URL for a web application ".war" file or directory it overrides any docBase configured in the context configuration ".xml" file.

Here is an example of deploying an application using a Context configuration ".xml" file.

	http://localhost:8080/manager/deploy?config=file:/path/context.xml

Here is an example of deploying an application using a Context configuration ".xml" file and a web application ".war" file located on the server.

	http://localhost:8080/manager/deploy?config=file:/path/context.xml&war=jar:file:/path/bar.war!/

Deployment Notes

If the Host is configured with unpackWARs=true and you deploy a war file, the war will be unpacked into a directory in your Host appBase directory.

If the application war or directory is installed in your Host appBase directory and either the Host is configured with autoDeploy=true or liveDeploy=true, the Context path must match the directory name or war file name without the ".war" extension.

For security when untrusted users can manage web applications, the Host deployXML flag can be set to false. This prevents untrusted users from deploying web applications using a configuration XML file and also prevents them from deploying application directories or ".war" files located outside of their Host appBase.

Deploy Response

If installation and startup is successful, you will receive a response like this:

	OK - Deployed application at context path /foo

Otherwise, the response will start with FAIL and include an error message. Possible causes for problems include:

• Application already exists at path /foo

  The context paths for all currently running web applications must be unique. Therefore, you must undeploy the existing web application using this context path, or choose a different context path for the new one. The update parameter may be specified as a parameter on the URL, with a value of true to avoid this error. In that case, an undeploy will be performed on an existing application before performing the deployment.

• Document base does not exist or is not a readable directory

  The URL specified by the war parameter must identify a directory on this server that contains the "unpacked" version of a web application, or the absolute URL of a web application archive (WAR) file that contains this application. Correct the value specified by the war parameter.

• Encountered exception

  An exception was encountered trying to start the new web application. Check the Tomcat 6 logs for the details, but likely explanations include problems parsing your /WEB-INF/web.xml file, or missing classes encountered when initializing application event listeners and filters.

• Invalid application URL was specified

  The URL for the directory or web application that you specified was not valid. Such URLs must start with file:, and URLs for a WAR file must end in ".war".

• Invalid context path was specified

  The context path must start with a slash character. To reference the ROOT web application use "/".

• Context path must match the directory or WAR file name:

  If the application war or directory is installed in your Host appBase directory and either the Host is configured with autoDeploy=true or liveDeploy=true, the Context path must match the directory name or war file name without the ".war" extension.

• Only web applications in the Host web application directory can be installed

  If the Host deployXML flag is set to false this error will happen if an attempt is made to deploy a web application directory or ".war" file outside of the Host appBase directory.

	http://localhost:8080/manager/list

List the context paths, current status (running or stopped), and number of active sessions for all currently deployed web applications. A typical response immediately after starting Tomcat might look like this:

	OK - Listed applications for virtual host localhost /webdav:running:0 /examples:running:0 /manager:running:0 /:running:0

	http://localhost:8080/manager/reload?path=/examples

Signal an existing application to shut itself down and reload. This can be useful when the web application context is not reloadable and you have updated classes or property files in the /WEB-INF/classes directory or when you have added or updated jar files in the /WEB-INF/lib directory.

NOTE: The /WEB-INF/web.xml web application configuration file is not reread on a reload. If you have made changes to your web.xml file you must stop then start the web application.

If this command succeeds, you will see a response like this:

	OK - Reloaded application at context path /examples

Otherwise, the response will start with FAIL and include an error message. Possible causes for problems include:

• Encountered exception

  An exception was encountered trying to restart the web application. Check the Tomcat 6 logs for the details.

• Invalid context path was specified

  The context path must start with a slash character. To reference the ROOT web application use "/".

• No context exists for path /foo

  There is no deployed application on the context path that you specified.

• No context path was specified

  The path parameter is required.

• Reload not supported on WAR deployed at path /foo

  Currently, application reloading (to pick up changes to the classes or web.xml file) is not supported when idth="1" height="1he.catalina.UserDatabase"/> </Context>