[Looking for Charlie's main web site?]

Sending HTTP headers in a CFHTTP request? Name them correctly

If you ever try to use CFHTTPPARAM (inside a CFHTTP) to set HTTP headers for the request you're calling, be aware that you need to be careful to specify the name of the headers as they're known in the HTTP specification. Don't be misled by what you see in a CFML dump of the CGI scope.

(This is a reprisal and update of an old blog entry I'd done back in 2003, on a blog site that will soon no longer exist. I'll be reprising a few such blog entries in coming days/weeks, to keep them around for posterity [and to save some having to dig for them in the archive.org site] since often the info offered then may be just as valuable now. I hope that in time these new versions would come up if people do searches that would have found the old entry.)

So, about these http headers, while CFML exposes them in a dump of the CGI scope, such as the user-agent field which shows up as cgi.http_user_agent, the issue is that you would not use that name, nor even "user_agent", when specifying it in a CFHTTPPARAM. The proper way to pass the user agent in a CFHTTPPARAM would be as follows:

[....Continue Reading....]

Applying CF security hotfixes: do it from oldest to newest (depending!)

If you may be applying several security hotfixes to a new implementation of CF (or one where none have been applied before), you may wonder if there's any significance to applying them in either chronological order (newest to oldest, or oldest to newest). The technotes don't really clarify this.

Update: Great news. It turns out that just days before I wrote this entry in late 2011, Adobe had in fact addressed and resolved this problem (quietly, I'd say) by making security fixes written from Dec 2011 (apsb11-29) on now have 2 sets of steps, one for if you HAD applied the security hotfix previous to it, and one for if you HAD NOT. And this has proven to be the case for the next few, as I write this update in late 2012. So we can now consider them effectively "cumulative", for those from Dec 2011, on. You need only focus on the latest, and follow either of its 2 provided sets of steps.

That said, I'm not 100% sure if all those from Dec 2011 include all ones prior to that. Has anyone tested things to know?

I'll leave the rest of the note below here for posterity, but stricken out.

[....Continue Reading....]

CF911: Are you finding performance problems with CFDOCUMENT? Aware of the important LOCALURL attr.?

This is something that I find nearly no one has talked about, as a problem and solution. Did you know that by default, a single request doing a CFDOCUMENT may cause CF to execute several additional requests, each doing a CFHTTP to grab any images on the page? even if the images could be found locally on the server? This can be quite tragic.

The good news is that the problem can be solved using the simple LOCALURL attribute. The bad news is that you have to do it at all, and that if you don't do it, it can have such unfortunate and unexpected impact. (And just as bad, again, is that hardly anyone has talked about it.) This entry will elaborate on the issue (and a couple of other possible CFDocument performance issues, as a bonus.)

I've been meaning to write about the importance of this problem and solution (the LocalURL attribute) for a long time (it came out in CF8). Often when I'm helping people with CF troubleshooting problems, whether on mailing lists or in my consulting services, I've been able to show that long-running requests (or an unexpectedly excessive number of requests) were sometimes due to this very problem.

Basics of the LocalURL attribute

[....Continue Reading....]

CF911: Have you updated your ColdFusion JVM to _24 yet? Important security fix for CF 8/9

This isn't new info, but you may have missed it. If you're running CF 8 or 9, did you know you can and should update the JVM that came with it? And that you have Adobe's blessing to do this update? This is because of a serious bug in the JVM that is not fixed until 1.6.0_24.

Both CF 9.0 and 9.01 run on older JVMs (and therefore need this update). And are you on CF8? You're not left out: Adobe even has confirmed this update can be applied to CF 8 and 8.01, too!

Note: if you are finding this blog post because you're searching the web for help on updating the JVM that underlies ColdFusion, note that this is a very old post (2011) about one specific JVM version. Instead, for a more general discussion of updating the JVM, and especially about solving and preventing common problems when doing that, see my more "recent" (2014) and more elaborated post: CF911: 'Help! I've updated the JVM which ColdFusion uses, and now it won't start!'.

Still more updates since this originally was posted:

Update 1: Since I wrote this blog entry in Oct 2011, Adobe has since come out with a new technote in Oct 2012 saying that you are now permitted to update to any version of Java 1.6 (for CF 8/9/10).
Update 2: Since posting this note, I've realized I should document an important fact to be aware of if you DO update the JVM: after doing so, it may seem that changes you made to allow CFHTTP calls to SSL pages (or other tags in CFML that talk via SSL or TLS) may "seem to have been lost". The issue is likely that you had modified your current CF setup to import specific certificates for such sites, but those changes are "lost" when you change the JVM that CF is now using (which has its own keystore). But these cert changes can be recovered. For more on that, see the next to last section below.
Update 3: In Feb 2013, Adobe did come out with an update that authorizes moving to Java 1.7 in either 9 or 10. You must apply the update first, though. More in this Adobe blog entry.

Old news, but not everyone knows

[....Continue Reading....]

My catalog of 50 ColdFusion Zeus features discussed publicly so far

Would you be interested in a catalog of what features have been identified (new, changed, or removed) in ColdFusion Zeus? Would you be surprised to hear that there are about 50 that have been mentioned so far?

Check out what the presentation I offered today, "What's Next In CF Zeus?" (PDF of slides), which I presented at CFCamp in Munich.

(I had mentioned last week that I would be presenting this and another presentation, as well as a daylong class. BTW, the daylong class was popular, with 13 students. Great to meet all those who attended.)

I explain in the slides how I gathered the info, from 5 public Adobe Zeus sessions I've seen so far. None of those had yet cataloged ALL features that had been shown in the other sessions. There were certain things mentioned in all 4, but then also each showed things (or in more detail) that the other did not. I enjoyed pulling this all together in this talk.

As I also note in the slides, I was not permitted to show live demos (only Adobe employees can do that), but still the listing of features and brief discussions (including some code) should still be valuable. I also point to the URLs for the 4 currently available recorded public Adobe sessions, which do in fact offer more code and live demos.

I suspect I'll offer the talk soon on the CFMeetup. I may also present them in another form. But until then, enjoy the slides.

Do let me know if it's a useful list for you, or if I left anything out!

Speaking next week at CFCamp in Germany, 3 topics: Zeus, FusionAnalytics, FusionReactor 4

Just wanted to share, for any who may be interested to hear, that I will be speaking next week at a new conference called CFCamp, being held in Munich, Germany, on Friday Oct 28 (and now sold out).

At the event, I'll be giving 3 talks. Well, two are sessions in the one-track conference, and one is a day-long class the day before.

The two session topics will be:

  • What's Next In Zeus, aka CF10
  • Continuously improve CF code quality, server availability & application stability

The descriptions for each of those is on that page for the conference program". As you'll also note there, the other speakers are Mark Drew, Gert Franz, Gary Gilbert, Luis Majano, and Bilal Soylu.

The day-long class I'll be doing (separately purchased, and nearly sold out) is:

If you haven't heard, both Fusionreactor 4 and FusionAnalytics have been released in recent weeks. They're powerful tools that I help people use all the time in my independent CF troubleshooting consulting. If you haven't checked them out yet, do. And note the availability of both a live demo (nothing to download and install) and a free 10-day demo for each.

See you in Munich, or in the future

If you may be in the area and interested in attending, see that page (top right) for more on registering.

I'll note that I will likely give both the talks in other venues and formats (whether in-person or over the web) in the future. If you may be interested, let me know.

And if you'll be in Germany next week, I hope to see you there. (Sadly, my wife didn't get to come this time.)

Thanks to all the sponsors for helping make the event happen, for me and for all who will be attending.

CF911: Are you finding CF (or CF Admin) busted after applying a hotfix? A few possible reasons

Many people have reported that they find after applying certain ColdFusion cumulative hotfixes (CHFs), security hotfixes (SHFs) and hotfixes (HFs) that either CF Admin or perhaps even some feature of CF is busted.

The "good" news is that there are at least a few really common explanations of what may have happened, which I'll explain them here. Once you consider them, you may find either that you can confirm this is what happened (and fix it), or if nothing else you can keep it in mind if you're ever applying them yourself in the future.

[....Continue Reading....]

CF911: Tips for dealing with Windows service timeout, useful when CF's taking too long to stop/start

In my last entry, CF911: Is your ColdFusion service taking too long to shut down? Find out why, I discussed the first of a two part answer to helping people who are finding that sometimes ColdFusion takes too long to shut down (or startup). That one talks about how to find out where CF may be logging info to explain why it's taking so long.

In this second entry, I'll address the separate but related problem, particularly if you're running CF as a Windows service, that you may find you get timeout errors from the Windows Services panel itself. I'll share some tips to help with that, which I share often with clients of my independent consulting as a CF troubleshooter.

The first thing to understand is that there is indeed a timeout (configurable) for how long the Windows Services control panel is willing to wait. Beyond that, though, there are some 3 more tricks you can use to avoid that timeout. (And I would say again that sometimes you really want to focus instead on WHY CF is taking so long to startup or shutdown, but until you do, the following info may help give you some breathing room.)

[....Continue Reading....]

CF911: Is your ColdFusion service taking too long to shut down? Find out why

Have you ever found (or heard others complain) that sometimes ColdFusion doesn't stop (or it takes a long time to do so)? It can be especially challenging when you're running CF on Windows as a Service, for reasons I'll explain here and in a follow-up entry.

First, this one will help you perhaps find why it's so slow. You may just have been looking in the wrong place for that diagnostic information. Second, the next entry will offer tips to handle on better handling the situation (that the Windows service is slow to stop, and timeouts in the Windows Services panel itself) which you may need to consider until you do solve the root cause problem (or in case it happens again for other reasons).

(Note that most of this info will apply as well if your problem is that CF's taking a long time to start, also.)

As some of you know, I do CF server troubleshooting as an independent consultant. In helping several people a week, this is a fairly common complaint. This also came up on a mailing list today, so I decided to offer these thoughts here.

[....Continue Reading....]

Setting up ColdFusion to process html or other file extensions

As a follow-on to my last entry, Setting up CFBuilder to process htm files with the ColdFusion editor, I wanted to offer more info for those who may want to know more about this--or ensure that more is shared with any who would consider doing this.

If you're looking for how to configure CFBuilder to open htm files with the CFML editor, see that other entry. This one instead is about the related idea of having CF (the server) process htm (or other) file extensions. There are certainly pros and cons.

[....Continue Reading....]

Setting up CFBuilder to process htm files with the ColdFusion editor

A client of mine asked if I might know how he could setup ColdFusion Builder 2 so that when he opened an htm file with it, it opened with its ColdFusion editor. He's one of those folks who've configured their environment so that htm pages are processed by CF so they can have CFML code in them. (More on that notion, the pros and cons, in a moment.)

The solution for getting CFB to open an HTM file in the CF editor is not too hard, but since he was thrown off a bit by some things he saw (when I suggested simply that the answer was in Builder's Preferences>General>Editors>File Associations page), I offered the specific steps. I then decided to go ahead and blog it, since I don't find anyone else having done so (feel free to comment if someone did).

[....Continue Reading....]

I'm speaking this evening on the Adobe CF Developer Week webinars: mine on CF Server Monitor

Hey folks, just a heads up (for those who may not have seen all the tweets and list messages) that this week is the Adobe CF Developer Week series of free webinars.

Update, Recording: Note that this session was recorded. You can view it here, but note that you must login with an Adobe ID to see it.

And I'm presenting a session tonight, Tuesday September 13, at 7pm Eastern, on "Understanding and Using the ColdFusion Server Monitor".

As many of you know, I'm pretty much a fanatic about the monitor, especially about truly understanding elements of it that many miss. And so in my talk this will not be just a dog and pony show, but I will talk about practical experiences with it, though presented to either those new to it or experienced with it.

Note that the times for all these devweek sessions is shown (on the Adobe site) as being Pacific time, so again mine is at 7pm, not 4pm, Eastern.

And yes, the sessions are being recorded and seem to be made available the next day.

Finally, beware that there is no one URL you can use to join in on all the Connect sessions, nor can you get the Connect session URL by going to the event page (via the first link above). Instead, you must register for each event (free) from that first page, to get each session's Connect URL--and you'll want to do that at least several minutes in advance of any session to have time to register, get the email, login, etc.

See you then.

PS Hey, while we're talking monitoring, note as well that if you've not heard, FusionReactor has come out with its new release 4, which has lots of great additions, especially FREC (or the FR Extensions for CF) which cause FR to grab and log lots of great info that the CF Server Monitor only shows and never logs. I'll be blogging about FR 4 soon, but plenty to see on their site. and FusionAnalytics is also just about to release, really!

I won't be discussing these at this talk, focused solely on the server monitor, but as I always tell folks, each tool has its use and often a single shop can benefit from having both (like I do, as do many of the clients I help with troubleshooting). You can find more from me about FR here in my blog. And I'll have lots more to say about FA and FR4 more soon.

Feel like an iphone app is "missing" features? Maybe you're not being notified of its updates

I wanted to pass along this little surprise I had today. You may, like me, have some apps on your iphone that ARE NOT BEING updated! In other words, though you may frequently check the itunes app store app for updates and receive many for some apps, you may be getting NONE for others.

This was happening to me until today. Here's how I found out and what I did about it. Hope it may help others. (Maybe this is old news to some, but it was a surprise for me and a classic bad news/good news situation.)

Update: Problem now understood

Since posting this entry, I've learned an explanation for what I was observing (thanks to Dan Switzer and others sharing their comments below to understand it). It was a case of "new" versions of the apps being created which meant that the "old" version i had was no longer being updated, and I had simply missed news of the new app. Hope that may help someone. I leave the rest of the blog entry below in case the details may interest anyone.

How I found out

So I have a couple of iphone apps I use all the time which until today, I was annoyed that seemingly obvious annoyances/limitations were not being resolved by updates. Was no one else annoyed by these? Really? Or was the developer perhaps being lazy? I lived with them. Hey, most of the apps are free or cheap.

But then today I got an email from one vendor highlighting new app features to consider in a recent update, and I noticed that they referred to enhancements to one of the very features I wanted, but they wrote as if it was a "long-standing" feature. How could I have never seen it then?

What I did to check it out

So I wondered if perhaps somehow I was NOT getting word of updates.

I remembered how when you visit the itunes store and click on an app you already have, it says "installed". I wondered if perhaps I may find that I could in fact "install" these apps, which I already had, but which seemed to have become long in the tooth.

Sure enough, I could do so (for at least two of several I checked). And holy smokes: the apps had indeed improved quite a bit.

Wow, what a shame that I've been limping along with older versions that lacked features I'd long-wanted.

Lesson learned

So obviously it's possible for apps to somehow become disconnected from their update stream. The app names had not changed, so that's not it. I don't know what happened. (For those who may wonder, in my case the apps were Harvest--for time/expense tracking--and Tweetdeck.)

And therefore I wanted to share this with others in case it may be an issue for you.

Want to help others with this problem?

Finally, does anyone know if perhaps there's some way to automate this investigation? Maybe there's info on the phone that tracks updates, and perhaps can indicate if the connection to itunes updates has broken. I suppose that's not likely.

But maybe there's a place on the phone (or in itunes on the computer it's synced to) which lists installed apps in order of last update. That would at least help highlight which ones to focus on?

Better still, perhaps there's "an app for that" which helps identify and resolve this very problem.

If you know more about this issue, feel free to share.

Bashers not welcome

One last thing: often when I write on a subject to share a solution to a problem, some folks are compelled to use the opportunity to bash whatever it is that I found the problem with. That's really not the point here, folks.

So if you're a delighted droid user, or perhaps just an apple-hater who loves the chance to give 'em a smack, or whatever, please withhold such comments. I'm serious, and I will delete or edit any comments that ignore this warning and are only about that. Let's just focus on the problem at hand, and any helpful solutions/suggestions.

I'll be presenting at RIAcon next weekend: "CF911 ColdFusion Performance Report 2011"

I'm delighted to announce that I'll be presenting at next week's RIAcon conference in the DC area, August 6-7 2011.

My session will be "CF911 ColdFusion Performance Report 2011", a new talk/concept I've created. Here's the description:

Starting a new tradition, veteran CF troubleshooter Charlie Arehart will present a review of the performance aspects of making various choices when working with ColdFusion, especially in recent version(s) of ColdFusion. Leveraging the important value of real load testing (as opposed to the less accurate conclusions from "large loop" testing), Charlie's annual report will help attendees appreciate the performance-related improvements of new/changed features, as well some older features where choices can make an important impact. Depending on the timing of the release of "CF next", the session may cover its new features, but it will certainly cover some things new in CF 9 and 9.0.1.

As I note there, I hope this may become an annual event which I might present at this and/or other conferences. (It's an idea rooted in a similar presentation made by a former colleague, from my first IT career from 1982-1997, where he presented the annual "Jim Damon model 204 Performance Report".)

About RIACon

As for RIAcon, I hope you're considering it. Phil Nacelli and the folks at AboutWeb have been working hard to put together the conference, which in some minds is kind of picking up where CFUnited left off. It will be a more intimate event, much like CFunited was when it first started.

Indeed, some will recognize that the location for RIAcon is across the street from one of the hotels where CFunited was held in its early years, right next to the Twinbrook Metro station in Rockville, MD.

A Personal Connection to the Hotel Location

Even more of a delight for me personally is that the hotel (The Legacy Hotel) is right on the land that was once the location of Congressional Roller Skating Rink (until the late 70's), where my sister and I (and many friends) spent our teen years pretty much whenever we weren't in school. Yep, I was a skating nerd: dance, figures, freestyle, and more. Here's incriminating evidence!

When problems are not due to CF, but may be in the web server (and a hat-tip to IIS 7)

Sometimes, CF problems are not really CF problems. Here's a little vignette from a recent consulting engagement (where I provide fast, on-demand CF troubleshooting services).

The challenge

I had a customer contact me recently because their server was performing poorly. They were experiencing significant latency on many requests. They were inclined to think they needed to change something in their application or SQL (as most presume when things go amiss).

I helped them determine ultimately that the problem was not CF at all, but instead something amiss in their web server, in this case Apache. (Before any Apache defenders come at me, please: I'm not "hatin' on Apache", just reporting what we observed. Do keep reading for more details.)

I asked if they'd considered at least trying IIS to confirm if it might work better for this challenge, but they preferred the file-based configurability of Apache. While I noted that IIS had gotten better in recent years in that regard, they preferred to bring in some experienced Apache guys to sort things out. (I don't claim any particular expertise with Apache, and I'm not at all averse to letting a customer know when they may need to have someone else help with certain problems.)

The customer's first attempt at resolution

[....Continue Reading....]

Struggling with using the XML features of CFML? Here's where to learn more

Are you struggling with using the XML features in CFML? Or do you help people who are?

It's not something most people use often, and there is far more to the feature set than meets the eye. If you don't use the right resources to help you, you could waste time trying to piece together a solution using only scant examples you may find.

In this entry, I'll point to several resources you should consider to help get you quickly up to speed in using--and appreciating--the power of the XML features in CFML.

Even if you don't need them today, you (or someone you know) may need them some day, so keep this in mind. (Or if you find this page doing a google search some years down the road, drop a note to let me know if it helped then!)


[....Continue Reading....]

cf.Objective(): I'll be there, and I'll be busy with 4 sessions

I've gotten word from the folks running the cf.Objective() conference that besides the 2 talks I'm giving, they've also recently accepted my proposals for a BOF (birds of a feather) session and a slot in their lightning talk session. Phew! I'll be busy.

Here are the details.

First are the two talks:

(I had put in just the first talk originally, and then a few weeks ago a slot opened and they asked if I could do the other, which I was happy to offer, as an reprisal/update to my talk from the first release.)

Then for the Lightning Round (or what was originally referred to as the Pecha Kucha), my talk will be:

  • Lies, damned lies, and CF request timeouts (in which I'll share in 5 minutes some information that even experienced developers admit having never known)

Finally, for the Birds of a Feather (no page on their site listing them yet), the session I will be leading will be:

  • CF911: Share your CF server troubleshooting tips (come share some ideas, or learn from myself and others)

Sense a theme? Yep, other than the CFBuilder talk, the other sessions are all focused on the topic that is now most near and dear to my heart (and livelihood): CF Server Troubleshooting. It's what I do, and more important it's how I feel I can best help the most people.

There's one last aspect of my involvement at the conference that I'll mention: they started a new sponsorship program this year called "Friends of cf.Objective()", and I'll be participating in that. No mention of it yet on their site, but there should be more news at the event.

So hope to see you there, or if you won't be there, I'll post if any of these are recorded, or if not then I would likely record them myself in the future.

CF911: Looking for info on handling IIS 7 integration in CF9 Updater 1? Not in the docs

Are you looking for info on the change in handling of IIS 7 integration as of CF9 Updater 1? Sadly, it's not in the primary docs you may think to look at. There's also another gotcha that I will explain in a follow-up entry.

What's changed about IIS 7 support in 9.01?

Some folks will know that ColdFusion 9 Updater 1 (9.0.1) has finally added full support for IIS 7, without need to rely upon enabling IIS 6 Compatibility (which IS still required for CF 9.0, 8.0, and 8.0.1). This is indeed great news, whether you're running on Vista, Windows 7, or Windows Server 2008, which all have IIS 7 by default, and for which you can enable IIS 6 Compatibility mode, but it's not on by default and not always straightforward to enable.

So bottom line, if you're on 9.0.1, you no longer need to go through the hoops described in the CF9 Admin/Install docs (nor in helpful blog entries like here and here, though those are still great for those running on CF 9.0 and 8, and may even offer tips of value to anyone setting up CF to run on IIS, which has other challenges on Server 2008.)

Gotcha 1: The IIS 7 Compatibility change is NOT documented where expected

Sadly, though, if you go looking for help on this in the CF docs, such as Chapter 6 of the manual, Installing ColdFusion 9, you will find that it has NOT been updated with the info that is new in the updater.

It opens, "If you are configuring IIS 7 ... ensure that you have the options IIS Metabase and IIS 6 configuration compatibility ... and ISAPI Extensions ... selected".

What a shame.

Solution 1: Where the change IS documented

So with respect to change in 9.0.1, where you no longer need to enable IIS 6 compatibility, the details are covered instead in the installation guide that was created just for installing CF9 updater 1 itself, called "Installing the Coldfusion 9 Update", available online at:


It's certainly reasonable to expect that the primary install manual would have been updated with the info above.

But that's why I'm pointing this out. I have also added a comment explaining it on the page pointed to in the first link above. Hope that may help someone.

(The same info is also offered as a chapter in the manual, "ColdFusion 9 Updater 1: New Feature Notes", available at http://www.adobe.com/support/documentation/en/coldfusion/901/cf901features.pdf, which is of course very interesting if you may have missed it.)

I'll explain the second gotcha in a follow-up blog entry.

This week will be the 175th episode of the online CF Meetup

Just wanted to take a moment to recognize a bit of a milestone for the online ColdFusion Meetup.

This week will mark our 175th episode, with Jim Harris presenting on "Security: Hiding Info. from Individuals Not Authorized To See It", being held Thursday at noon US ET. (And the 176th episode will follow just after that "Requirements and Estimating", with Peter Bell.

If you've missed out on any of the past sessions, they're recorded and posted at recordings.coldfusionmeetup.com, and since 2010 are available in either streaming or downloadable (flv, mp3, mp4, wmv) format.

If you want to know about future meetings, you can join the 2400+ other members of the group (for free at the first URL above) to get email notifications, or you can follow the RSS feed of the calendar there, or if you can't get to meetup.com (being a social networking site), you can also just follow us via @cfmeetup on twitter.

Here's to 175 more episodes in coming years. :-)

PS If anyone is wondering, I count the sessions since I began hosting the CFMeetup in April 2007. Steven Erat had organized it originally and run it in 2005-2006. I simply started counting the recordings as I posted them and didn't think at the time to go back and find/count any previous sessions, so technically the number could/should be larger, but we'll leave that as a historical aberration. :-)

Did you know there's a "request execution limit" on IIS? It's 3, 10, 25, or unlimited, depending...

Did you know there's a "request execution limit" on IIS? It's 3, 10, or unlimited, depending on the version of Windows (Vista, 7, 2008) and edition (such as Starter/Home/Basic/Pro/Server).

I'll detail the limits per version/edition below.

I'll also offer a (possibly surprising) workaround that can allow you to get even more requests through IIS, even for a single web site.

(Before I elaborate on that, note that there is a separate issue if you're finding that CF doesn't let you see more than 25 requests at once. That's instead due to a setting in CF/JRun, the maxworkerthreads setting. For more on that, see this blog entry.)

That said, this is a problem which could affect anyone regardless of the app server they may be running behind IIS. (And yes, I do realize that for some, the answer to this problem will be, "see, that's another reason to run Apache." We get that. Let's just focus on this problem for those who choose/have to remain on IIS.)

[....Continue Reading....]

BlogCFC was created by Raymond Camden. This blog is running version 5.005. (Want to validate the html in this page?)

Carehart Logo

Managed Hosting Services provided by
Managed Dedicated Hosting