CentOS 7下Tomcat 8.5安装部署与性能优化指南

1. CentOS 7环境下Tomcat 8.5的安装部署1.1 系统环境准备在开始安装Tomcat之前我们需要先准备好CentOS 7的基础环境。我建议使用最小化安装的CentOS 7系统这样可以减少不必要的服务和资源占用。以下是基础环境配置步骤首先我们需要创建标准的目录结构来存放软件和运行数据mkdir /software # 用于存放安装包 mkdir /data # 用于存放运行数据 mkdir /script # 用于存放维护脚本接下来我们需要检查并清理系统中可能存在的旧版本Javarpm -qa | grep java rpm -e --nodeps java* # 强制卸载所有Java相关包1.2 JDK 8安装配置Tomcat 8.5需要JDK 7或更高版本支持这里我们选择JDK 8作为运行环境。以下是详细的安装步骤下载JDK 8安装包建议使用Oracle JDKcd /software wget http://download.oracle.com/otn-pub/java/jdk/8u161-b12/2f38c3b165be4555a1fa6e98c45e0808/jdk-8u161-linux-x64.tar.gz解压并安装JDKtar zxvf jdk-8u161-linux-x64.tar.gz mv jdk1.8.0_161 /data/jdk ln -s /data/jdk /usr/local/JAVA配置环境变量 编辑/etc/profile文件在末尾添加以下内容export JAVA_HOME/usr/local/JAVA export PATH$JAVA_HOME/bin:$PATH export CLASSPATH.:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar使配置生效并验证安装source /etc/profile java -version1.3 Tomcat 8.5安装配置完成JDK安装后我们可以开始安装Tomcat 8.5下载Tomcat 8.5安装包cd /software wget http://mirrors.tuna.tsinghua.edu.cn/apache/tomcat/tomcat-8/v8.5.28/bin/apache-tomcat-8.5.28.tar.gz解压并安装Tomcattar zxvf apache-tomcat-8.5.28.tar.gz cp -r apache-tomcat-8.5.28 /data/Tomcat-Pay配置Tomcat启动脚本# 启动Tomcat /data/Tomcat-Pay/bin/startup.sh # 停止Tomcat /data/Tomcat-Pay/bin/shutdown.sh # 查看版本信息 /data/Tomcat-Pay/bin/version.sh设置开机自启动chmod x /etc/rc.d/rc.local echo /data/Tomcat-Pay/bin/startup.sh /etc/rc.d/rc.local2. APR安装与性能优化2.1 APR简介与依赖安装APRApache Portable Runtime是一个高度可移植的库能够显著提升Tomcat的性能。在生产环境中使用APR模式可以带来以下优势更好的IO性能支持sendfile、epoll等更高效的SSL处理通过OpenSSL更优的本地进程处理能力安装APR前需要先安装依赖包yum -y install gcc gcc-c libtool* autoconf automake expat-devel perl perl-devel2.2 APR组件安装步骤下载并安装APR核心库cd /software wget http://mirror.bit.edu.cn/apache/apr/apr-1.6.2.tar.gz tar zxvf apr-1.6.2.tar.gz cd apr-1.6.2 ./configure --prefix/usr/local/apr make make install安装APR-iconv字符集转换库wget http://mirror.bit.edu.cn/apache/apr/apr-iconv-1.2.2.tar.gz tar zxvf apr-iconv-1.2.2.tar.gz cd apr-iconv-1.2.2 ./configure --prefix/usr/local/apr-iconv --with-apr/usr/local/apr make make install安装APR-util工具库wget http://mirror.bit.edu.cn/apache/apr/apr-util-1.6.0.tar.gz tar zxvf apr-util-1.6.0.tar.gz cd apr-util-1.6.0 ./configure --prefix/usr/local/apr-util --with-apr/usr/local/apr --with-apr-iconv/usr/local/apr-iconv/bin/apriconv make make install安装OpenSSL加密支持wget https://www.openssl.org/source/openssl-1.1.0f.tar.gz tar zxvf openssl-1.1.0f.tar.gz cd openssl-1.1.0f ./config --prefix/usr/local/openssl make -j 4 make install2.3 Tomcat-native安装与配置安装tomcat-nativecd /data/Tomcat-Pay/bin tar zxvf tomcat-native.tar.gz cd tomcat-native-1.2.12-src/native ./configure --with-ssl/usr/local/openssl --with-apr/usr/local/apr --with-java-home/usr/local/JAVA make make install配置环境变量echo export LD_LIBRARY_PATH/usr/local/apr/lib:$LD_LIBRARY_PATH /etc/profile.d/apr.sh source /etc/profile.d/apr.sh修改Tomcat配置使用APR模式 编辑/data/Tomcat-Pay/conf/server.xml文件修改Connector配置Connector port8080 protocolorg.apache.coyote.http11.Http11AprProtocol connectionTimeout20000 redirectPort8443 /验证APR模式是否生效 重启Tomcat后检查日志应该能看到类似以下信息INFO [main] org.apache.coyote.AbstractProtocol.start Starting ProtocolHandler [http-apr-8080]3. Tomcat生产环境调优3.1 线程池优化配置在生产环境中合理的线程池配置对性能至关重要。以下是优化建议在server.xml中配置线程池Executor nametomcatThreadPool namePrefixcatalina-exec- maxThreads1000 minSpareThreads25 maxIdleTime600000 acceptCount500/参数说明maxThreads最大线程数根据服务器CPU核心数设置建议500-1000minSpareThreads最小空闲线程数建议设置为maxThreads的5-10%maxIdleTime线程空闲超时时间毫秒acceptCount等待队列长度当所有线程都在忙时新请求会进入队列在Connector中引用线程池Connector executortomcatThreadPool port8080 protocolHTTP/1.1 connectionTimeout20000 redirectPort8443 /3.2 连接器高级优化对于生产环境还需要对连接器进行更细致的优化Connector executortomcatThreadPool port8080 protocolHTTP/1.1 URIEncodingUTF-8 enableLookupsfalse disableUploadTimeouttrue connectionTimeout20000 keepAliveTimeout15000 maxKeepAliveRequests1000 useURIValidationHackfalse compressionon compressionMinSize2048 compressableMimeTypetext/html,text/xml,text/javascript,text/css,text/plain redirectPort8443/关键优化点enableLookupsfalse禁用DNS查询减少延迟disableUploadTimeouttrue上传文件时不限制超时时间compressionon启用GZIP压缩减少网络传输量keepAliveTimeout长连接超时时间maxKeepAliveRequests单个长连接上允许的最大请求数3.3 JVM内存优化配置JVM参数优化对Tomcat性能影响极大。以下是针对生产环境的JVM配置建议在catalina.sh中添加export JAVA_OPTS-server -Xms3072M -Xmx3072M -Xmn512M -Xss512k -XX:AggressiveOpts -XX:UseBiasedLocking -XX:PermSize256M -XX:MaxPermSize256M -XX:DisableExplicitGC -XX:UseConcMarkSweepGC -XX:UseParNewGC -XX:CMSParallelRemarkEnabled -XX:UseCMSCompactAtFullCollection -XX:CMSMaxAbortablePrecleanTime5 -XX:CMSClassUnloadingEnabled -XX:LargePageSizeInBytes128m -XX:UseFastAccessorMethods -XX:UseCMSInitiatingOccupancyOnly -XX:CMSInitiatingOccupancyFraction70 -Djava.awt.headlesstrue参数说明-Xms和-Xmx堆内存初始值和最大值建议设置为相同值物理内存的70-80%-Xmn新生代大小建议为堆内存的1/4到1/3-XX:UseConcMarkSweepGC使用CMS垃圾收集器减少停顿时间-XX:CMSInitiatingOccupancyFraction70老年代使用率达到70%时触发CMS GC3.4 运行模式选择与对比Tomcat支持三种运行模式生产环境建议使用APR或NIO2模式BIO阻塞式IO默认模式每个请求需要一个线程处理并发性能较差NIO非阻塞式IO使用Java NIO实现适合中等并发场景配置方式protocolorg.apache.coyote.http11.Http11NioProtocolAPRApache Portable Runtime性能最优需要额外安装native库配置方式protocolorg.apache.coyote.http11.Http11AprProtocol4. 生产环境安全加固4.1 基础安全配置禁用管理控制台rm -rf /data/Tomcat-Pay/webapps/*修改关闭端口和命令 编辑server.xml修改Server配置Server port-1 shutdownSHUTDOWN禁用自动部署Host namelocalhost appBasewebapps unpackWARsfalse autoDeployfalse reloadablefalse4.2 隐藏版本信息修改ServerInfo.properties文件cd /data/Tomcat-Pay/lib unzip catalina.jar cd org/apache/catalina/util vim ServerInfo.properties修改内容为server.infoApache Tomcat server.number server.built重新打包jar uvf catalina.jar org/apache/catalina/util/ServerInfo.properties4.3 连接器安全优化生产环境连接器建议配置Connector executortomcatThreadPool port8080 protocolorg.apache.coyote.http11.Http11Nio2Protocol connectionTimeout60000 maxConnections10000 redirectPort8443 enableLookupsfalse acceptCount100 maxPostSize10485760 maxHttpHeaderSize8192 compressionon disableUploadTimeouttrue compressionMinSize2048 acceptorThreadCount2 compressableMimeTypetext/html,text/plain,text/css,application/javascript,application/json,application/x-font-ttf,application/x-font-otf,image/svgxml,image/jpeg,image/png,image/gif,audio/mpeg,video/mp4 URIEncodingutf-8 processorCache20000 tcpNoDelaytrue connectionLinger5 serverServer Version 11.0 /关键安全参数maxPostSize限制POST请求大小10MBmaxHttpHeaderSize限制HTTP头大小8KBserver隐藏Tomcat版本信息enableLookups禁用DNS查询4.4 文件系统权限控制创建专用运行用户groupadd tomcat useradd -g tomcat -d /data/Tomcat-Pay -s /bin/false tomcat chown -R tomcat:tomcat /data/Tomcat-Pay目录权限设置chmod 750 /data/Tomcat-Pay chmod 750 /data/Tomcat-Pay/conf chmod 640 /data/Tomcat-Pay/conf/*日志目录权限chmod 750 /data/Tomcat-Pay/logs5. 监控与维护5.1 日志配置与管理配置日志轮转 创建/etc/logrotate.d/tomcat文件/data/Tomcat-Pay/logs/catalina.out { copytruncate daily rotate 30 compress missingok size 100M }配置访问日志 在server.xml中添加Valve classNameorg.apache.catalina.valves.AccessLogValve directorylogs prefixlocalhost_access_log suffix.txt pattern%h %l %u %t quot;%rquot; %s %b %D /5.2 JVM监控配置启用GC日志 在JAVA_OPTS中添加-Xloggc:/data/Tomcat-Pay/logs/gc.log -XX:PrintGCDateStamps -XX:PrintGCApplicationStoppedTime -XX:PrintGCApplicationConcurrentTime -XX:PrintGCDetails配置JMX远程监控-Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port9010 -Dcom.sun.management.jmxremote.sslfalse -Dcom.sun.management.jmxremote.authenticatefalse5.3 性能监控工具使用jstat监控JVM状态jstat -gcutil pid 1000 10使用jstack分析线程状态jstack pid /tmp/thread_dump.txt使用VisualVM进行图形化监控jvisualvm5.4 常见问题排查内存泄漏排查步骤使用jmap生成堆转储文件使用MAT工具分析内存占用检查是否有未关闭的资源线程阻塞排查使用jstack获取线程快照查找BLOCKED状态的线程分析锁竞争情况CPU过高排查使用top -H找出高CPU线程使用jstack分析线程堆栈定位热点代码6. 高级调优技巧6.1 内核参数优化修改文件描述符限制echo * soft nofile 65535 /etc/security/limits.conf echo * hard nofile 65535 /etc/security/limits.conf调整TCP/IP参数echo net.ipv4.tcp_tw_reuse 1 /etc/sysctl.conf echo net.ipv4.tcp_tw_recycle 1 /etc/sysctl.conf echo net.ipv4.tcp_fin_timeout 30 /etc/sysctl.conf sysctl -p6.2 会话持久化配置配置JDBC会话存储Manager classNameorg.apache.catalina.session.PersistentManager saveOnRestarttrue maxActiveSessions-1 minIdleSwap0 maxIdleSwap30 maxIdleBackup0 Store classNameorg.apache.catalina.session.JDBCStore driverNamecom.mysql.jdbc.Driver connectionURLjdbc:mysql://localhost/tomcat_sessions?userrootamp;password sessionTabletomcat_sessions sessionIdColsession_id sessionDataColsession_data sessionValidColvalid_session sessionMaxInactiveColmax_inactive sessionLastAccessedCollast_access/ /Manager6.3 集群配置配置Tomcat集群Cluster classNameorg.apache.catalina.ha.tcp.SimpleTcpCluster Manager classNameorg.apache.catalina.ha.session.DeltaManager expireSessionsOnShutdownfalse notifyListenersOnReplicationtrue/ Channel classNameorg.apache.catalina.tribes.group.GroupChannel Membership classNameorg.apache.catalina.tribes.membership.McastService address228.0.0.4 port45564 frequency500 dropTime3000/ Receiver classNameorg.apache.catalina.tribes.transport.nio.NioReceiver addressauto port4000 autoBind100 selectorTimeout5000 maxThreads6/ Sender classNameorg.apache.catalina.tribes.transport.ReplicationTransmitter Transport classNameorg.apache.catalina.tribes.transport.nio.PooledParallelSender/ /Sender Interceptor classNameorg.apache.catalina.tribes.group.interceptors.TcpFailureDetector/ Interceptor classNameorg.apache.catalina.tribes.group.interceptors.MessageDispatch15Interceptor/ /Channel Valve classNameorg.apache.catalina.ha.tcp.ReplicationValve filter/ Valve classNameorg.apache.catalina.ha.session.JvmRouteBinderValve/ Deployer classNameorg.apache.catalina.ha.deploy.FarmWarDeployer tempDir/tmp/war-temp/ deployDir/tmp/war-deploy/ watchDir/tmp/war-listen/ watchEnabledfalse/ ClusterListener classNameorg.apache.catalina.ha.session.JvmRouteSessionIDBinderListener/ ClusterListener classNameorg.apache.catalina.ha.session.ClusterSessionListener/ /Cluster6.4 SSL/TLS配置配置HTTPS连接器Connector port8443 protocolorg.apache.coyote.http11.Http11AprProtocol maxThreads150 SSLEnabledtrue schemehttps securetrue clientAuthfalse sslProtocolTLS keystoreFile/path/to/keystore keystorePasschangeit ciphersTLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_SHA256,TLS_ECDHE_RSA_WITH_AES_128_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_SHA,TLS_ECDHE_RSA_WITH_AES_256_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_SHA384,TLS_ECDHE_RSA_WITH_AES_256_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_SHA,TLS_DHE_RSA_WITH_AES_128_SHA256,TLS_DHE_RSA_WITH_AES_128_SHA,TLS_DHE_DSS_WITH_AES_128_SHA256,TLS_DHE_RSA_WITH_AES_256_SHA256,TLS_DHE_DSS_WITH_AES_256_SHA,TLS_DHE_RSA_WITH_AES_256_SHA /7. 实际应用中的经验分享在生产环境中部署Tomcat多年我总结了一些宝贵的经验内存配置不是越大越好过大的堆内存会导致GC停顿时间变长建议根据应用实际需求设置合理的堆大小。线程池配置要结合实际maxThreads设置过高会导致线程上下文切换开销增加建议通过压力测试找到最佳值。APR模式虽然性能好但对系统环境要求较高在容器化环境中可能不如NIO2稳定。定期检查Tomcat日志和GC日志可以提前发现潜在问题。对于高并发应用建议将静态资源交给Nginx处理减轻Tomcat负担。使用连接池管理数据库连接避免频繁创建和销毁连接带来的性能开销。对于Session数据较大的应用建议使用外部存储如Redis来管理Session。定期更新Tomcat版本及时修复安全漏洞但升级前务必在测试环境充分验证。