Bug#296868: tomcat4: memory leak

[Vladimir Stavrinov]

Package: tomcat4
Version: 4.0.3-3woody3
Severity: normal


For a few years we where running our web application serving by
jserv-1.1.2 and IBMJava2-SDK-1.3 without any problems under significant
load. This application where written with servlet API 1.1 (jdk1.1). Now
when we migrate to jakarta tomcat we encountered memory leak with
tomcat-4.1.31 from debian. We tried Sun java VM j2sdk1.4.2_04 and
jdk1.5.0_01 with different garbage collection and memory heap
parameters: in all cases the end was the same. After few hours
application stopped with "java.lang.OutOfMemoryError". With IBM jdk1.4
it die after half of hour.

I solve this problem in two ways: downgrade tomcat to 4.0.3-3woody3 or
upgrade to 5.5.7. With both versions there are no memory leak or any
other problems. The 4.0.3 is too old but 5.5.7 is out of debian
distribution. That is why I need 4.1.31 from debian, but it has memory
leak with servlets. We have another application running under
tomcat-4.1.31 and there are no memory leak, but this is JSP application
without servlets.

If You need some details about application design, give Your questions.
We suppose this memory leak related to http sessions handling. You can
see this process comparing graphs for different version of tomcat:

http://fog.inist.ru/tomcat-4.1.31.jpg
http://fog.inist.ru/tomcat-4.0.3.jpg
http://fog.inist.ru/tomcat-5.5.7.jpg

There no any differences in the system settings, application configuration
or java VM: only in tomcat version.


-- System Information:
Debian Release: 3.1
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing')
Architecture: i386 (i686)
Kernel: Linux 2.6.10
Locale: LANG=C, LC_CTYPE=ru_RU.koi8-r (charmap=KOI8-R)

Versions of packages tomcat4 depends on:
ii  adduser                    3.62          Add and remove users and groups
ii  java-virtual-machine-dummy 0.3           Dummy Java virtual machine
ii  libtomcat4-java            4.0.3-3woody3 Java Servlet engine -- core librar
ii  logrotate                  3.7-2         Log rotation utility

-- no debconf information