17 Replies Latest reply on Feb 13, 2015 6:47 AM by userCold9

    Cold Fusion with McAfee

    userCold9 Level 1

      Hi,

       

      We are using Cold Fusion 9 in the production environment.

       

      Also, using McAfee on the server where Cold Fusion 9 is installed.

       

      The admin of the server is stating the issue might be with McAfee.

       

      As part of my research, it was metioned that McAfee can affect Cold Fusion and that the Cold Fusion jar files should be added to the exclusion list.

       

      I have search for the jar files and alot of files have been listed.

       

      Which files should be be in the McAfee exclusion list?

       

       

       

      Thanks,

       

      Mike

        • 1. Re: Cold Fusion with McAfee
          Carl Von Stetten Adobe Community Professional & MVP

          If you properly lock down your server as recommended (including isolating both the ColdFusion installation and your application code on separate non-OS drives/partitions), you should be able to exclude the entire ColdFusion installation folder from McAfee scans.  Otherwise you may get a lot of false-positive alerts from McAfee.

          -Carl V.

          • 2. Re: Cold Fusion with McAfee
            userCold9 Level 1

            The server admin noticed the JRUN.exe is consuming the CPU usage.

             

             

             

             

             

            Mike

            • 3. Re: Cold Fusion with McAfee
              userCold9 Level 1

              What would cause the JRun.exe process consume the CPU?

              • 4. Re: Cold Fusion with McAfee
                Carl Von Stetten Adobe Community Professional & MVP

                Do you mean it's using 100% CPU or the like?  That's usually a sign of either runaway threads/contention or garbage collection running amok.  What are your JVM settings in CF Administrator (or if you can't get in due to high CPU, look in the jvm.config file inside the ColdFusion install folder)?

                 

                -Carl V.

                • 5. Re: Cold Fusion with McAfee
                  userCold9 Level 1

                  The CPU is running around 100%.

                  I can log into the server and CF admin

                  Where in CF admin is the JVM settings?

                   

                  Below is the contents of the jvm.config file:


                  # VM configuration
                  #
                  # Where to find JVM, if {java.home}/jre exists then that JVM is used
                  # if not then it must be the path to the JRE itself
                  java.home=C:/JRun4/jre
                  #
                  # If no java.home is specified a VM is located by looking in these places in this
                  # order:
                  #
                  #  1) bin directory for java.dll (windows) or lib/<ARCH>/libjava.so (unix)
                  #  2) ../jre
                  #  3) registry (windows only)
                  #  4) JAVA_HOME env var plus jre (ie $JAVA_HOME/jre)
                  #

                  # Arguments to VM
                  java.args=-server -Xmx512m -Dsun.io.useCanonCaches=false -XX:MaxPermSize=192m -XX:+UseParallelGC -Dcoldfusion.rootDir={application.home}/

                  #
                  # commas will be converted to platform specific separator and the result will be passed
                  # as -Djava.ext.dirs= to the VM
                  java.ext.dirs={jre.home}/lib/ext

                  #
                  # where to find shared libraries
                  java.library.path={application.home}/servers/cfusion/cfusion-ear/cfusion-war/WEB-INF/cfusi on/lib,{application.home}/servers/cfusion/cfusion-ear/cfusion-war/WEB-INF/cfusion/jintegra /bin,{application.home}/servers/cfusion/cfusion-ear/cfusion-war/WEB-INF/cfusion/jintegra/b in/international,{application.home}/servers/cfusion/cfusion-ear/cfusion-war/WEB-INF/cfusio n/lib/oosdk/classes/win
                  system.path.first=false

                  #
                  # set the current working directory - useful for Windows to control
                  # the default search path used when loading DLLs since it comes
                  # before system directory, windows directory and PATH
                  java.user.dir={application.home}/../lib

                  # JVM classpath
                  java.class.path={application.home}/servers/lib,{application.home}/servers/lib,{application .home}/servers/cfusion/cfusion-ear/cfusion-war/WEB-INF/cfusion/lib/oosdk/classes,{applicat ion.home}/servers/cfusion/cfusion-ear/cfusion-war/WEB-INF/cfusion/lib/oosdk/lib,{applicati on.home}/lib

                  • 6. Re: Cold Fusion with McAfee
                    Carl Von Stetten Adobe Community Professional & MVP

                    OK, I'm hoping with that additional information someone with stronger JVM skills will weigh in.  A couple things of note though - it looks like you are using the JRE that comes in JRUN, which I believe is Java 6.  Depending on how up-to-date you are on ColdFusion patches, you might want to try using Java 7.  Just download and install the Java 7 JDK, backup your jvm.config, and point ColdFusion to the JRE folder inside the JDK installation (change the java.home path at top of the jvm.config file.  This will allow you to explore other garbage collection methods too.

                     

                    Also, is this a 32-bit or 64-bit system?  If 32-bit, you can see if increasing the -Xmx value from 512m to 1024m or so helps.  A 32-bit JVM maxes out at 1.3GB or so of memory, but i wouldn't recommend going that high unless you need to.

                     

                    -Carl V.

                    • 7. Re: Cold Fusion with McAfee
                      userCold9 Level 1

                      The server and CF 9 is 32 bit.

                       

                      Also, the number of users using the system with the curren configuration went from 350 to over 500 users.

                       

                       

                      Mike

                      • 8. Re: Cold Fusion with McAfee
                        userCold9 Level 1

                        If the -Xmx value is increased, does this require the Cold Fusion services to be stopped to make the change?

                         

                        Does the MaxPermSize need to be increase, currently 192m? If so, what is recommended?

                         

                        Also, would upgrading to CF 11 help with the issue?

                         

                         

                        Mike

                        • 9. Re: Cold Fusion with McAfee
                          carl type3 Level 4

                          Hi Mike,

                           

                          You are going to need to be careful about what values to apply for -Xmx and MaxPermSize since 32 bit java will only address 1.3Gb of RAM on Windows. So not a lot of wiggle room.

                           

                          Java logging would need to be enabled to know what values to put in but likely -Xmx1024m MaxPermSize=256m will work. CF does need a restart to apply JVM.config alterations. You got a copy of JVM.config  by way of backup right?

                           

                          Java 7 works on:
                          - CF9.0.2 with cumulative hot fix 1
                          - CF9.0.1 CHF4
                          - CF9.0.0 CHF3 (not so sure on this one not done so myself)

                           

                          CF11 still uses java so 32 bit boundaries would still apply. The recently refreshed CF11 installer installs with Java  8 in JRE directory.

                           

                          HTH, Carl M.

                          • 10. Re: Cold Fusion with McAfee
                            charlie@carehart.org Adobe Community Professional & MVP

                            @Mike,separate from Carl's helpful answers I'll offer this in reply to your question about what could make CF use lots of CPU:

                             

                            CF911: High CPU in ColdFusion? Some common but perhaps unexpected causes - Charlie Arehart's Blog

                            • 11. Re: Cold Fusion with McAfee
                              userCold9 Level 1

                              Where in the CF 9 admin would the Java logging be enabled and the location of the log file?

                               

                               

                              Thanks,

                               

                               

                               

                              Mike

                              • 12. Re: Cold Fusion with McAfee
                                carl type3 Level 4

                                Hi Mike,

                                 

                                Add Java logging to JVM args section of JVM.config


                                -XX:+PrintGCDetails -XX:+PrintGCTimeStamps -XX:+PrintHeapAtGC -verbose:gc -Xloggc:cfjvmGC.log

                                Creates a log file in ColdFusion9\runtime\bin\cfjvmgc.log or Jrun4\bin\ in case multiserver

                                 

                                EG


                                # Arguments to VM
                                java.args=-server -Xmx512m
                                -Dsun.io.useCanonCaches=false
                                -XX:MaxPermSize=192m -XX:
                                +UseParallelGC -XX:+PrintGCDetails -XX:
                                +PrintGCTimeStamps -XX:+PrintHeapAtGC
                                -verbose:gc -Xloggc:cfjvmGC.log
                                -Dcoldfusion.rootDir={application.home}/../
                                -Dcoldfusion.libPath={application.home}/../lib
                                -Dcoldfusion.classPath={application.home}/../l
                                ib/updates,{application.home}/../lib,
                                {application.home}/../gateway/lib/,
                                {application.home}/../wwwroot/WEBINF/
                                flex/jars,
                                {application.home}/../wwwroot/WEBINF/
                                cfform/jars


                                You might like to read the log graphically use then GCViewer tool to examine the file contents
                                http://www.tagtraum.com/gcviewer.html

                                 

                                HTH, Carl M.

                                • 13. Re: Cold Fusion with McAfee
                                  userCold9 Level 1

                                  I looked at the link provided. It has information I did not know about.

                                   

                                  I checked the cfusion-out.log file and there were no entries of memory errors.

                                   

                                  I have no client variables. The ClientManagement is set to false in the application.cfc

                                   

                                  I viewed the "CF911: CodFusion Tools for when the Stuff Hits the Fan".  It was mentioned that there was a selection in the CF 9  Admin to Enable CFSTAT.

                                  In the CF 9 Admin, this option is not available.

                                  I think the value in the CF 9 Admin "Maximum number of simultaneous Template requests" which is set at 10 might need to be increased because the number is users went from 300 to 500 plus.

                                  This is when the issue of perfomance for the jrun.exe went to 95% plus CPU usage. But I cannot find CFSTAT command.

                                   

                                  Is there anyway to get CFSTAT available in CF9?

                                   

                                  Below is the CF 9 version information:

                                  Version is: 9,0,1,274733

                                  Edition: Enterprise

                                  Server: 2008

                                  OS Version: 6

                                  Adobe Driver Version: 4.0 (Build 0005)

                                   

                                   

                                   

                                  Thanks,

                                   

                                  Mike

                                  • 14. Re: Cold Fusion with McAfee
                                    carl type3 Level 4

                                    CFadmin > Debugging & Logging > Debug Output Settings > Enable CFSTAT

                                    • 15. Re: Cold Fusion with McAfee
                                      userCold9 Level 1

                                      The option for the CFSTAT in the CF9 Admin is not available.

                                       

                                      Is there a way to have the option appear?

                                      • 16. Re: Cold Fusion with McAfee
                                        haxtbh Level 4

                                        Is this a multi-server setup? CFStat wont appear if it is.

                                         

                                        Charlie Carehart has posted some information here about it - CF911 Wiki: A knowledge base and repository for CF server troubleshooting | Search

                                        • 17. Re: Cold Fusion with McAfee
                                          userCold9 Level 1

                                          I think it is. Cold Fusion is installed in a JRun4 directory.