Charlie Arehart's Blog

What's new in #ColdFusion 10 that's only in Enterprise? or restricted in Standard?

Tue, 15 May 2012 17:16:00 -0400

CF10 was released today, and in my blog entry announcing that, I noted that there's been some surprise/concern by many over what aspects of new features in CF10 are held back as Enterprise-only, or restricted in Standard (meaning, has some limitation). I want to highlight a few of those things, to save folks having to dig around. You can see for yourself the comparisons in at least a couple of places:

Product Comparison (Standard vs Enterprise, in HTML format)
ColdFusion 10 Feature improvement history (CF 8, 9, and 10, in PDF format)

What's new in CF10 but only in Enterprise?

Among the surprises some are finding are that these are held as Enterprise only (or the free Developer edition) and are not available in Standard are:

Some (though not all) of the CF10 scheduling improvements (such as listeners, chaining, app-specific tasks, clustering, and exception handling)
HTML 5 charting
ORM search
~~Dynamic custom fields in Solr~~ my bad, I just read the column wrong. This is not restricted.
the data import handler for Solr

I obtained this list by looking at the first page above, noting what was listed as "new" or "enhanced" in the CF10 Enterprise column that was listed as "not available" in the CF10 Standard column. This may NOT be the complete list. We can for now only go on what's shown. There may be more, there may be less.

What's new in CF10 but "restricted" in Standard?

Similarly, some of the things that are "new" (or "enhanced") for CF10 may be available in Standard, but are "restricted" in some way. Typically, this means that the feature is throttled by the "Enterprise Feature Router" or EFR that was introduced in CF8. This change then meant that now such features were no longer limited to CF10 (as those above) but are available in Standard but throttled, so that only one concurrent request at a time can use such a restricted feature. There can be another kind of limit, too. See below. Again, going by the list on the page above, we see these new or enhanced features are "restricted":

MS Office 2010 PowerPoint file generation (new)
PDF file conversion from MS Office 2010 Word and MS Office 2010 PowerPoint (new)
MS Office 2010 Excel support (new)
Support for web socket protocol on server (new)
Interface for publish/ subscribe using web socket (new)
Support for Microsoft Exchange 2010 (new)
Microsoft Exchange server integration (enhanced)

Again, I'm basing this on what things were listed as "not available" in the CF9 Standard column, but are listed as "new" or "enhanced" in the CF10 Enterprise column but listed as "restricted" in the CF10 Standard column. That's an imperfect way to judge things, but they didn't choose to list what's "new" or "improved" AND "restricted" in the CF10 Standard column.

Some of the limitations are not what they appear at first

There's been a fair bit of consternation today among some who saw that limit about web sockets being limited. The document there (in the footer) says that "Data can be pushed to no more than five clients on Standard, unlimited on Enterprise". Here's good news: I've heard directly from the CF team that this limit was lifted to 100 before the final release, but this and other docs have just not yet been updated. Finally, let me say also about the MS Office features above that although they list them as "new", I think what they're saying is that support specifically for Office 2010 is new. The features to create Word, Powerpoint, Excel, and such files (in older Office formats), such as CFSPREADSHEET or enhancements for Office docs in CFDOCUMENT and CFPRESENTATION were actually introduced in CF9. Hope that's helpful. Again, I may have something that will need to be updated. Feel free to leave a comment, and share the news of this list with others to help them learn more about the subject.

#ColdFusion 10 released today: maybe you've heard, for better or worse

Tue, 15 May 2012 16:36:00 -0400

If you've not yet heard, final production release of ColdFusion 10 was made available today (well, late last night, so the "day" depends on your time zone). And if you have heard, you may have heard from people who (as is often the case) are raising concerns about something they do or don't like, or they see or don't see. I'd like to address a couple of those points briefly, along with sharing the general announcement. For more, see all the goodness at the coldfusion.com web site. And yes, if you didn't know it, that's a nice easy-to-use domain name that redirects to the main Adobe CF page. There you'll find lots of content about what's new, including videos on various pages (some of which include yours truly).

What's new? Lots more than you may think

As always, the "what's new" pages are rather meager. You'd think there are only a dozen new features. Of course, Adobe is highlighting what they think may be most compelling to the most people (and to motivate upgrades/purchases.) But I'll note again that there are over 200 new changes or improvements, some little, some big. I documented those that I'd found after working with the prerelease for some months, in an entry I did back in March: Charlie Arehart's Ultimate List of 200+ New #ColdFusion 10 Features I've not yet updated that per the final release, most notably because I can't as yet find any Feature Notes for the final release. The link to "CF10 release notes" currently offered on the CF release notes page (listing all releases) currently goes just to a "known issues document", which is not the same at all. There was a 200+ page true "release notes" PDF for the prerelease, that I hope will be offered somewhere soon, as updated for the final release. (I've raised this concern to Adobe, and will hope to update this when I have new info.)

What's Enterprise only?

As in each release, there will always be consternation with regard to what was released for the Standard Edition and what's held back for the Enterprise (or free Developer) edition. You can find that outlined in a couple of docs on the site. But I have created another entry that tries to save you the trouble: What's new in #ColdFusion 10 that's only in Enterprise? or restricted in Standard?.

Any licensing concerns?

And yes, there are some licensing concerns. Those, too, deserve their own post. More to come later. (Some matters are still being sorted out in terms of folks understanding what they're reading, and whether they're coming to the correct conclusions.) All in all, CF10 adds lots of new features. Before you listen to any who assert "there's not much there", or "too much is held back for Enterprise only", or "the new licensing sucks", be sure to dig more closely and make an informed decision.

Where to keep an eye out for new info on CF10, created by the community

Just a quick update since I originally posted this: while you can and should check out the Adobe resources I listed above, and my "ultimate list of new features", I'll note that of course many are now (and recently,and will be) posting their own blog entries on what's new, etc. you can try to keep up with them on twitter, various blog aggregators, etc. But I'll say the best place to keep an eye out is Akbarsait's list of CF10 tutorials, where he basically aggregates all the CF10 documents and blog entries that he comes across. It's an awesome list that he also did for CF9 (and if you may be skipping from CF8 or earlier to CF10, check out that list for mroe on what was new in CF9). He's not updated his CF10 page in a couple of weeks (as of today, as I write), but I'm sure he will soon be kicking into gear to gather up all the great new stuff coming out today and in coming days/weeks. I just want to make sure people seeing this post know to keep an eye on hist list. I see him as a "brother in arms", as a fellow-resource gatherer, as I have done in my CF resources sites: CF411.com (list of CF tools and resources), CF911.com (list of CF troubleshooting resources), and UGTV (list of CF user group presentations recordings). Keep up the great work, Akbarsait!

CF911: Latest CF Security hotfix technote updated (Mar 29) for issue with #ColdFusion 8.0.1

Tue, 03 Apr 2012 11:54:00 -0400

If you are running ColdFusion 8.0.1 and may have applied the latest CF Security hotfix (APSB12-06) since it came out Mar 13 2012, note that there was an update to that on Mar 29, 2012. The good news is that you just need to update the one hotfix jar. While it is discussed in the technote for the hotfix, the note about this update is sadly (currently) at the BOTTOM of the technote. I'll repeat what it says here, to give it some more visibility:

Note - Updated on March 29, 2012 Following bug is reported for ColdFusion 801 against this security bulletin hotfix. java.lang.NoSuchMethodError Exception is thrown while using cffile upload. We have updated the hotfix files of ColdFusion 801 to include the fix for the above issue. Users who have already applied the hotfix for ColdFusion 801 can just update the hotfix jar.

I'm pretty sure this is fixing what some found to be a reliance in the hotfix on your having applied one of the specific Cumulative hotfixes, but if someone had not, or if they inadvertently removed the CHF during the process of adding this single one, things would break. I'll note that the HF technote above does say very specifically what jars to remove, when applying the hotfix. Some people in haste instead delete all the hf and chf jars, or delete chf hars when it says to remove only hf jars. They so look similar in name. I cover this issue of being careful about applying hotfixes (there are other mistakes you can easily make) in another blog entry I did, CF911: Are you finding CF (or CF Admin) busted after applying a hotfix? Three possible reasons. And before someone chimes in to lament, "this is what's so wrong with the CF hotfix process, that mistakes can be easily made", I cover that too. The short answer is that Adobe is addressing this in CF10, and may even offer something to help us later for CF 8 and 9. We shall see.

Need to solve browser problems? Did you know most modern browsers now have built-in developer tools?

Tue, 20 Mar 2012 13:30:00 -0400

When you're trying to understand why something's not working in your browser (page not rendering as expected, feature not working as expected, page content failing to load), it's useful to use of many any available tools which can show you what's going on, whether with respect to the HTML, CSS, or Javascript that may be running, or perhaps the communications between the browser and server. For years, experienced developers have recommended tools like Firebug, Fiddler, Charles, and such. I list these and many others as a category in my CF411 site listing over 1800 tools and resources for CFers, in the category, HTTP Debugging Proxies/Sniffers/Web Client Test Tool. I recently updated the list, though, to point out these "built-in" forms of these tools, now available in most browsers. If you may be in a place where you are "not allowed" to install new software (or are simply disinclined), knowing that the browser may have such a valuable tool built-in can be a real discovery, thus this entry. Here's the content that I've added to that section:

In Chrome, see the Developer Tools, available under the "Customize and control Google Chrome" icon at the top right (the monkey wrench), then Tools>Developer Tools.
In Firefox 6 and above, see the "Web Console" feature in the "Web Developer" tools, available under the Tools menu.
In Internet Explorer, see the Developer Toolbar which is an ad-on for IE 6 and 7, and the Developer Tools that are built into IE 8 and 9 (in the Tools menu).
In Opera, see the Developer Tools in Opera DragonFly, available in the Edit>Developer Tools menu in Windows, and Tools>Advanced on Mac.
In Safari, see the "Web Inspector" feature of the Develop menu.
I welcome additions/corrections/feedback.

The links I've given for each of these often have friendly introductions to using such tools. I can also commend an old but classic discussion of such tools, here. Have you used these sort of tools? How have they helped you. Are you surprised to learn that the browsers now have such tools built-in? Chime in and share your thoughts. I may do a later blog entry or talk introducing using these tools for some common problems working with CF.

Charlie Arehart's Ultimate List of 200+ New #ColdFusion 10 Features

Wed, 07 Mar 2012 18:25:00 -0400

Wondering what all is new in CF10? Have I got a list for you! :-) (revision 1.8, 216 items) I've not yet seen anyone try to create an ultimate list of *all* the new features in CF10, so here's my shot at it. (This is based on the public beta. I will update it soon with info from the final release.) Of course many (including Adobe) have created lists that show perhaps a couple dozen of what they think may be the most prominent features, or the most interesting for them, etc. I've just not yet seen anyone list even simply all the features mentioned in the beta new features guide. That's what I'm doing here. But to be clear, I am not listing every new tag and function (that would be tedious.) Instead, I'm listing them as concepts, and where warranted, any relevant subtopics that expand on the new feature. I've got more to say about the list (how I created it basically from the 244-page CF10 new feature docs, and what you can do to help expand it). But some will want me to cut to the chase, so here's the list. Please check out the additional discussion after it.

Charlie's Ultimate List of new CF10 Features, revision 1.8 (Mar 8 2012), listing 216 items

Replacement of JRun with Tomcat
- Includes support for instances and clusters (no discussion yet, during beta, about what features are in Enterprise edition vs Standard), as previously
- Support for IIS, Apache, and built-in web server, as previously
- Support for SSL and virtual directories
- Support for CFStat, even in multiple instances (and how to change the connector port for that)
- Support for SES (Search engine safe) URLs and log rotation, as previously
- Support for persistent sessions over restarts
- Support for configuring Apache virtual host for each ColdFusion instance
- new sessionStartTime function (this seems listed in the wrong place in the doc)
Security enhancements
- Handling XSS attacks
  - Only the following characters are allowed as values for the attribute name in the tag cfform: alphanumeric characters, _ (underscore), - (hyphen), : (colon), and . (dot). It prevents stored XSS for the scriptsrc field
  - The following new encoding methods are added to reduce XSS attack vulnerability: encodeForHTML, encodeForHTMLAttribute, encodeForJavaScript, encodeForCSS, and encodeForURL. Encode the user inputs depending on the contexts. To decode the input string, added a method: canonicalize
- Handling CSRF attacks
  - CSRFGenerateToken: Returns a random token and stores it in the session
  - CSRFVerifyToken: Validates the given token and the key against the same stored in the session
- Session improvements
  - CF Session cookies (CFID, CFTOKEN, CFAuthorization_app-name). The new features to manage session cookies are:
    - The following properties of ColdFusion session cookies can be configured at server level or application level:
      - httponly: true by default
      - secure: false by default
      - domain
      - timeout: 30 years by default
  - New methods added for session management: SessionInvalidate, SessionRotate
- Handling CRLF attacks
  - Protection is added against CRLF attacks for the tags which create a header, for example, cfheader, cfcontent, cfmail, cfmailpart, and cfmailparam
- Information disclosure (Passwords for all services are encrypted in this version)
- New HMAC function (Hash-based Message Authentication Code)
- cfcookie support in CFScript
- Miscellaneous Changes
  - The httponly cookies support is available on Tomcat supporting J2EE 1.6
  - A new parameter, numIteration, is added to the hash() method
  - Strengthened cflogin and authorization cookies
  - You are logged out from one of the ColdFusion administrators, if from the same host, you log in to the ColdFusion (10) Administrator and the ColdFusion Administrator of an older version
  - For a user with RDS access, in the ColdFusion Administrator, you can set the data source and secured file path permissions
  - The default values for the new sandbox are changed to make it more secure
  - If the action attribute is not specified in the cfform tag, it does not generate the action using the current URL. If there are issues, add the following entry in the ColdFusion-install-dir\cfusion\bin\jvm.config file: -Dcoldfusion.generateformaction=true
ColdFusion WebSocket
- Broadcast
- Point to point
Language enhancements
- Support for for-in construct (for query)
- Provide cffile content in the tag body
- Callstack for ColdFusion functions (new function CallStackDump)
- Getting application metadata (new function getApplicationMetadata)
- Getting disk space details (new getTotalSpace, getFreeSpace functions)
- Application-specific In-memory file system
- Securing your uploads by default (by verifying the MIME type),
  - (Note that some of the features below are useful beyond just securing file uploads)
  - New Application.cfc event method, onAbort
  - New action copy for cfdirectory
  - New function directoryCopy
  - Modifications to the tag cffile
  - New function FileGetMimeType
- New function ArraySlice
- New parameter merge supports arrayAppend
- Implicit constructor for CFC
- Method chaining for CFC methods
- CFC Implicit notation
- New parameter format added to LSParseDateTime function
- New attribute runOnce added to cfinclude
- New attribute timeout in cfstoredproc
- New attribute maxLength in cfparam
- New functions dateTimeFormat and lsDateTimeFormat
- New function reEscape
- The function replaceList takes delimiters
- Modifications to the functions arraySort, listSort, and structSort
- Implicit struct now supports use of : (colon) separator
- The attribute output is ignored in the interface signature
- FUNCTION is now a ColdFusion datatype
- Dynamic references supported in query looping
- New function invoke
- New attribute secure in cfpop
- New attribute group in cfloop
- For-in constructs now support Java arrays
- Enhancements to queryAddRow and queryNew functions
- New function listRemoveDuplicates
- Support for XPath 2.0 and XSLT 2.0 syntax
- (Note that there are some other new tags and functions, mentioned in other sections of this document.)
Closures
- Also adds several new functions, some useful with on their own as well as with closures: ArrayEach, ArrayFilter, ArrayFind, ArrayFindAll, ListFilter, isClosure, StructEach, StructFilter
Enhanced Java integration
- Integrating Java libraries (dynamic class loading)
- CFC Proxy (cfcproxy)
- createDynamicProxy function
ColdFusion ORM search (full text search)
- Settable at application, component, and property level
- Supports both Auto-indexing (on persistence) or Offline indexing (on-demand using ORMIndex)
Solr enhancements¹
- Use Data Import Handler for database indexing
- Index and search based on dynamic custom fields
- Reload individual collections
- Add languages for search
- Secure your search system using ColdFusion Administrator
- Autocommit indexed documents
- Boost specific fields or entire document for improved search results
Scheduler enhancements
- Grouping
- Application-specific tasks
- Event Handling
- Chaining
- Cluster
- Cron commands
- Prioritize tasks
- Exclude dates
- In case of error
- If task misfires
- Pause and resume/Pause all and resume all
- List tasks
- Retry
- Repeat
- Customize quartz
New system functions
- getSystemFreeMemory
- getSystemTotalMemory
- getCPUUsage
Connect to Microsoft Exchange Server 2010
- Folder operations such as create, modify, or delete
- Get rooms and roomlist in the exchange organization
- Information on user availability, that helps effective scheduling
- Conversation operations such as find conversation details, copy, move, and the status if the conversation is read
Lazy loading across client and server (for applications that use ColdFusion ORM in the back end and Flex as the front end)
Web service enhancements
- About:
  - Adds WSDL 2.0 specification support to current WSDL 1.1
  - Axis 2 support in ColdFusion lets you consume web services that publish WSDL in the following styles:
    - Adds "Document Literal Wrapped", to current RPC and Document Literal support
  - Adds SOAP 1.2 protocol support to current SOAP 1.1
RESTful Web Services in ColdFusion
- About
  - Follows HTTP request-response model
  - Supports all HTTP methods
  - Implicit handling of serialization/deserialization
  - Publish web service as both REST service and WSDL service
Media Player enhancements
- HTML 5 video playback capability
- Fallback to HTML 5 video playback if Flash player is not installed
- Browser independent video controls
- Dynamic streaming of Flash videos
- Advanced skinning for media player
- Play list for Flash videos
- Embedding subtitles in SRT format using HTML track element
- Extending media player using plug-ins built using Open Source Media Framework (OSMF), for example to:
- Play videos in the YouTube server
- Use stage video support by showing advertisements within the videos in linear and non-linear mode
- Adding title to the video
HTML enhancements
- Displaying geolocation
- cfinput attribute type now supports all HTML 5 input types, for example, email, range, or date; as well as new attributes such as max and min.
Client-side charting
- Popular chart formats with appropriate fallback functionality: Use HTML 5, Flash, SVG, or VML charts
Caching enhancements
- Application-specific caching (optional along with existing server-level)
- Enhanced query caching using Ehcache (configurable at server or app level, including max size and removal of cache entries by id or region)
- New and modified cache functions
- removeCachedQuery
- Enhancements to existing cache functions
- Cache statistics
- CFLOGIN now uses ehcache for an authentication cache
Other enhancements
- Virtual File System: Support for HTTP, FTP, and ZIP
- ~~CAR, migration, and Code Analyzer~~ (not really "new" in CF10, nor even seemingly updated)
- Interoperability with Microsoft Office 2010
- ColdFusion image enhancements
  - An optional attribute interpolation has been added to cfimage action = "resize" for resampling
  - Change of behavior if attribute name used for cfimage action = "captcha"
  - The function imageDrawText now returns a struct that contains width of the text drawn and the height of the text drawn
  - Fallback to system font for cfimage action = "captcha"
  - New function imageCreateCaptcha
  - New function ImageMakeColorTransparent Creates an image and sets a transparent color
  - New function ImageMakeTranslucent Create a new translucent image with given percentage of translucence
  - New parameters rule and alpha for the function imageOverlay
- Support for HTML 5 multifile input field in fileUploadAll and Form scope
- Function expandPath resolves files in custom tag directory
- Form fields with same name can be accepted as an array, if new this.sameformfieldsasarray = "true" is used
- Enhancements to Amazon S3 integration regarding file uploads
- Available Administrator password reset script
- Database enhancements
  - Track client information (enable auditing on database, while performing a database operation, in databases that support such tracking)
    - using new ClientInfo attribute available on query tags to set the info
    - use new type="clientinfo" for CFDBINFO to determine supported ClientInfo properties
    - retrieve tracking info passed using new fetchclientinfo attribute on query tags
    - Can pass client information on datasource definition in ColdFusion administrator
  - Support for new SQL types (CF_SQL_NCHAR, CF_SQL_NVARCHAR, CF_SQL_LONGNVARCHAR, CF_SQL_NCLOB, CF_SQL_SQLXML)
  - Miscellaneous enhancements that include enhancements to connection validation and exception handling (returned with cfcatch type=database)
ColdFusion Administrator enhancements
- Server update (auto hotfix management)
  - List available updates
  - Notification of new updates (on admin front page)
  - Download updates, to apply now or later (via gui or command line)
- Scheduler (scheduled task interface)
  - Manage Application- and Server- Level Scheduled Tasks
  - Enable Cluster Setup
- Securing search system (can make Solr an HTTPS secured server)
- Caching enhancements
  - Use Internal Cache to store queries
  - Clearing query cache
  - Clearing folder-specific template cache
- Web services
  - specifying default Axis version
  - specifying proxy server details (previously settable only on cfinvoke)
- RDS can be enabled from ColdFusion Administrator
- Disable dumping of application scope of unnamed applications
- Accessing the ColdFusion Administrator in Developer mode when 2-IP address access limit is reached
- Restricting access to ColdFusion Administrator (optionally, to specified IP addresses)
- Logging Administrator actions (all admin changes now tracked in audit.log file)
- Changes to the default settings (for new CF installations)
  - Client variable storage name now defaults to cookie
  - Use UUID for cftoken now defaults to enabled
  - Enable Global Script Protection now defaults to enabled
  - Maximum number of simultaneous Template requests raised from 10 to 25
  - Maximum number of simultaneous CFC function requests (called via URL) raised from 10 to 15
  - Minimum JVM Heap Size (MB) changed from unspecified to 256mb
  - Maximum size of post data (in MB) lowered from 100mb to 20mb
  - Enable ColdFusion Event Gateway Services now disabled by default
- Session cookie settings (HTTPONLY session cookie, Secure Session cookie, Session cookie timeout options)
- Server monitor now shows URL for request, in request details ²

How did I come up with list?

I obtained this list mostly from the Beta New Features Guide, which is listed from the CF10 wiki. Surprisingly, there's no table of contents, which makes it hard therefore to appreciate what all is there. Instead, there is only the bookmarks bar on the left (if you view the doc as a PDF), and that does have an outline structure, but you have to expand each one to see all that's new, which I doubt most would bother to do. So then you would have to browse the whole document and identify the headings, etc. I've filed a bug report (3132948) recommending a Table of Contents be added, if you may want to vote for it. To begin, I grabbed all the main sections (and some of the subsections) of that left navbar of the PDF to create this list. I also found often that some sections had features that were not drawn out into separate subsections in that outline of topics. Further, I also tweaked the wording a bit where necessary to make this stand better as a list on its own. So my list here really is more than "just a regurgitation of the document outline". FWIW, nearly all the same topics are listed also in the CF10 doc "Developing ColdFusion Applications", in the section, "What's new in ColdFusion 10". Just like the new features document and its PDF outline tree, in this other document you do also need to drill into each heading to find more details, and often it does not even list the details in the new features PDF (which at 224 pages is quite substantial).

Finding code examples and more information

Again, at 224 pages the new features PDF is quite substantial, and in many cases it does offer code examples for the new features. You can find still more examples, as well as more info, from any of many blog entries that have been written by various people (Adobe folks before the beta, and them and others after its release). The best news is that, just as with CF 9, inveterate fellow-list maker Albarsait has started his Adobe ColdFusion 10 Tutorials and Resources page where he tracks nearly all such resources (following almost the same pattern of top-level topics as I do above).

The list will surely evolve, help me do so

This is revision 1.8 of the list (as of an update I've done Mar 8 2012). I suspect it will grow and evolve. I know of some items that are being discussed that are not in this list, but I wanted to at least get this out as is in case it may help some readers. I will likely update it in place at least until it changes somehow substantially, so keep coming back to check the version if you're interested in tracking all that's new. :-) I've had thought of doing something still more substantial, like a wiki (that many of us together would contribute to, to elaborate on each feature, show examples, point to resources like blog entries, etc.) If you may be interested in contributing to such a concept, let me know in the comments. (Sadly, we can't seem to contribute to the labs wiki. Plus, that will likely be removed once the beta is over.) BTW, some of you will know that I created a similar list back in Oct 2011, when I did a talk called, "What's new in Zeus. I had compiled that list from the few public presentations Adobe had given. Silly me, I never got around to offering that list as a blog entry, so many never noticed it. I hope this list may help more people. If you have items you think ought to be added, do let me know in the comments, which will serve as your means of being credited (I'd rather not clutter the list with names if I add items, for now).

^[1] The bullets in this section were taken from the Developing ColdFusion 10 Applications document rather than the Beta New Features PDF.

^[2] These bullets present features which are as yet undocumented.

New book review: "Railo 3: Beginner's Guide"

Tue, 28 Feb 2012 11:22:00 -0400

As some of you may know, there's been another new book recently in the CFML world, this time Railo 3: Beginner's Guide. It's from four folks who many in the CFML community will know: Mark Drew, Gert Franz, Paul Klinkenberg, and Jordan Michaels. Mark and Gert work for Railo, while Paul and Jordan are active in the Railo community. I was given a review copy from their publisher, Packet Publishing (and thanks to an arrangement by Mark). With a title like Beginner's Guide, one may wonder what to expect. As a contributor myself to several CF books (carehart.org/contact.cfm#books), I appreciate the challenge in deciding the intended audience for a book, and keeping it in mind as we are writing. And having been a co-contributor on now 10 multi-author books (not all on CF), I appreciate the challenge in keeping a consistent voice among all those authors throughout a book, as well as each keeping that intended audience front and center. It's not easy, although it can be aided greatly by careful editorial control and editing.

What to expect from the book?

So, as a "Railo 3: Beginner's Guide", what would you expect? Something for people making the move (or considering it) from CF to Railo ("beginners to Railo")? Or something for those coming to CFML anew, where Railo is their first CFML engine ("beginners to CFML and to Railo")? In that case, should that audience be presume to be "beginners to web apps" as well, or just to CFML? Indeed, might someone expect such a title to be appropriate for those coming from a Java server background who may have been persuaded to consider CFML and Railo ("beginners to CFML and Railo, but not to programming")? The subtitle is "easily develop and deploy complex applications online using the powerful Railo Server", and the back cover starts by calling it "a practical guide for developing web applications with Railo". Of course, different people may read "complex applications" differently. Let me go ahead and point out what the Preface says about the audience: "If you want to develop your own dynamic web applications using CFML, then this book is for you. No prior experience with Railo or CFML is required, although you are expected to have some experience in web application development experience and the knowledge of HTML, basically, how websites work in general." And from reading the book I'd concur, so it's not intended as a "how or why to transition from CF to Railo" book. And the title should clarify that, but some will inevitably wonder, so we should make that clear right from the outset. Might it still be valuable to you, someone who already knows CFML? Maybe. There are various topics that are indeed Railo-specific.

Considering the Table of Contents

Let's look at the list of topic in the table of contents (I've added the approx number of pages for each): Chapter 1: Introducing Railo Server (18)
Chapter 2: Installing Railo Server (19)
Chapter 3: CFML Language (47)
Chapter 4: Railo Server Administration (50)
Chapter 5: Developing Applications with Railo Server (39)
Chapter 6: Advanced CFML Functionality (19)
Chapter 7: Multimedia and AJAX (20)
Chapter 8: Resources and Mappings (21)
Chapter 9: Extending Railo Server (38)
Chapter 10: Creating a Video-sharing Application (44)
That's quite a wide-ranging set of topics. :-) Note that the biggest chapters are on the "CFML language", and "Railo Server Administration". They're certainly both going to be vital for someone coming to CFML anew. And at the same time certainly someone moving from CF to Railo will still benefit from understanding how Railo Administration works. Same for the other chapters that would be unique to Railo, especially chapter 9, and some of the other chapters where Railo-specific things are mentioned. To be clear, though, they're not really pointed out as different from ColdFusion. That's not the book's intent, and the authors (being Railo folks) are reasonably focused more just on "here's how to use Railo to build CFML apps" for those new to doing CFML apps.

Going beyond the TOC to details per chapter

Still, you may reasonable wonder, then, what are the various subtopics of each chapter. The good news is that you can find the detailed ToC online at the book's site. Click on the "Table of Contents" tab midway down the page. (I couldn't find a way to offer a URL that added something that would make that tab open. I'm really not a fan of tabbed interfaces in web apps, for this very reason. Another challenge is that often a search engines will show a page, indicating it had content you sought, yet when you do a find on the page, you can't locate it--because it's under a tab that you've not thought to click. Grr.) That said, when it comes to looking at that detailed table of contents, the online version suffers from an unfortunate problem, and the print version has another. If you look at the online version, you'll notice that the real "sections" and "subsections" in each chapter don't stand out in any way. They're all at the same level, with no bolding or anything. The print one is a little better. But in both, the section headings are also lost in the weeds of as many or more "time for action" sections (where the book walks through doing something, which is itself a commendable feature). I just wish they would have either done something else for the "time for action" text in the TOC, like have an acronym instead, like TFA, or better yet an icon. It's just hard to perceive the organization--which may be as important for someone standing in the store, as someone later using the book, or as someone contemplating whether to buy it while reading an online review. :-) FWIW, neither of these issues is a problem for the two other Packt Publishing CF books: John Farrar's ColdFusion 9 Developer Tutorial and Matt Gifford's Object-Oriented Programming in ColdFusion. I know, some will think I'm being pedantic for having gone on so about this. Hey, it's my review. :-) Seriously, though, it's a usability issue that could be addressed, online and in any reprints. Finally, as long as I'm talking about the book site, it's a bit of a shame that it does not list both of the other CF books, not even in its "alternative books" widget at the bottom. (There is a special offer to buy the book with John's CF9 book, but no mention of Matt's OOP book, which seems unfortunate for the authors, the publisher, and the readers.

About the Content

So what about the content itself, whatever your place in the prospective "audiences"? Well, recalling that it's a "Beginner's Guide", there's the ever-present challenge of whether a book speaking to them will teach simple techniques (cfquery/cfoutput) or will stretch them from the beginning to use CFCs and cfscript syntax, and use that throughout. There was a recent brouhaha in the CFML community as some castigated the CFWACK books for failing in that regard. Well, those folks won't be happy: the book is pretty much all tags. At least until Chapter 6, which opens with discussing the issue, and from that point through the rest of the book, there's a fairly even split of both types of coding. On a related matter (and good news for that aforementioned camp of folks concerned about how CFML is taught), I will note that after introducing cfquery (albeit pretty late some may say, on p 74, in Chapter 3 on CFML), the book does at least immediately move in the very next section to talking about using CFCs (on p80, which ends that chapter). Separately, some may note that the book then proceeds right to chapter 4, on Railo Server Administration. If one assumes, "well, that's because you have to show how to create DSNs in the Admin", that's actually not the reason. The book did step into the Admin just prior to the cfquery discussion, on p72. That that was using the Railo Web Administrator, whereas chapter 4 is on the Railo Server Administrator. Here again is where folks coming from CF may be a little confused. The chapter does explain the difference between server and web contexts (something foreign to CFers) which does have benefits for true separation of applications, and it goes on to explain those benefits and how to manage things differently, including the nice remote sync feature for keeping admins synced across multiple instances. And the 2nd chapter talks about installing Railo, which is also different from CF and has some useful advantages that are discussed. (Sadly, while the unique cluster scope in Railo is mentioned a couple of times, there's no dedicated discussion to running Railo in a cluster. But let's remember my initial point: this is a "Beginner's Guide".)

What about development topics?

So back to its coverage of development topics: the book does cover the basics of CFML, as expected, mostly in Chapter 3. It then covers more advanced and modern topics many would like to see, such as ORM, caching, and more (in Chapter 5). An interesting point about caching (made in Chapter 5) is how Railo supports a pluggable architecture, so that you can use either built-in caching (ramcache or ehcache lite), or switch to any of several alternatives (memcached, couchdb, infinispan, and more). And while I noted earlier that Chapter 4 is on administration, that chapter also covers various development-oriented features that are controlled by the Admin and (in a somewhat eccentric approach) the chapter shows CFML code demonstrating those there, in that chapter. (These might be missed if a developer chose to skip a chapter on "administration".) Such topics include things (which it may interest some to know are supported) such as text searching via Lucene (from which Solr is built), event gateways and more. It also discusses what Railo calls "magic functions", which is basically like the implicit getters/setters for CFCs that were added in CF9. On the other hand, it's perhaps unfortunate that the "advanced CFML" chapter (6) is about looping and scripted coding. But front-end developers will enjoy Chapter 7 on Multimedia and AJAX. And despite not being quite so obvious from its name, Chapter 8 ("Resources and Mappings") is mostly about accessing the file system, working with zips, as well as working with Amazon S3. Chapter 10 wraps things up with a complete video-sharing app, leveraging especially the ORM and video features introduced earlier.

Still other topics, especially unique to Railo

Other chapters touch on various unique features Railo supports like archives (packaged applications), the easy admin update mechanism (coming now also to CF10), and so on. Chapter 9 is about various ways to extend Railo, ranging from the ability to create new tags and functions (that you can call just as if they were built-in ones, for better or worse), as well as to package up them or indeed complete applications that can be bundled and shared with others (or even sold in a Railo extensions store). Indeed, besides overriding CFML functions in CFML code, you can also just change the underlying Java source for any tag or function (or of course the entire engine), since it's an open source product. Chapter 1 also mentions still other features that Railo supports, some uniquely. Again, the focus of the book is not really "how is Railo different than CF", though CFers will indeed find discussions of things that are different. Chapter 1 could be useful as an intro to Railo for CFers. You can read that first chapter online at the book site. I will note that many of these topics are not developed further, but you can find more at the Railo sites, getrailo.org, getrailo.com, and blog.getrailo.com.

Some nits, yet opportunities

If I have one other nit to pick with the book, it's with the index. If you're not careful, you could think content did not exist. For instance, there's no mention of ORM--you have to think of looking at Object Relational Mapping. That may seem petty, but a good indexer should have seen how often the term ORM was used on its own and offered a cross-reference (because many people do in fact only know it by the acronym.) There's a similar problem with CF tags: don't go looking for them under the letter C. They're instead in front of the index, as , , etc., which is a bit odd. But let me make lemonade from those lemons: if you visit the Amazon page for the book, you'll find it's been enabled for the "see inside this book" feature, so you can easily search for a topic of interest and see how the book covers it. That should help a lot if you're a CFer trying to decide if you may find value in the book. (Of course, that Amazon feature often does not show many pages beyond what you find, so you can't read it entirely there, let alone even much about a specific topic.) So, is Railo 3: Beginner's Guide a book for you? I can't make that decision for you, of course. It really depends on where you are in your understanding of Railo, and indeed CFML. It's certainly not geared toward those with CFML experience, in that it starts from square 1, but then it also covers a lot of ground way beyond square 1. For those willing to dig through to find what will be new, they may not only learn things new to Railo but also things existing in CF that perhaps they've not paid attention to. Then again, some of my readers will wish it covered more about what is specifically different (or may wish that it was made more clear). While others will think it's great that it just "rolls with Railo", which suits a reader not coming from CF. You really will need to decide for yourself, or whether you may recommend it to others you know. I hope I've given you some motivation to consider it further, and both information and additional resources to help you do so.

Recording of my Adobe eseminar session, "Monitoring #ColdFusion with FusionReactor"

Mon, 27 Feb 2012 18:11:00 -0400

After my barrage Friday of four entries on the CF Server Monitor, here's something instead on FusionReactor. Some may know that last week I did a talk on the Adobe ColdFusion eseminar series, "Monitoring ColdFusion with FusionReactor". I got word today that the recording link has been posted. You can find the recording here. Note that you need to login with an Adobe ID, just like when you download Adobe software or participate in their forums. (I have no control over that.) Since that link just goes right to the recording, here is the description I'd used for the session, to help decide if the recording may interest you. BTW, I clarify on the session that FR is useful for more than just ColdFusion, in that FusionReactor can be used for Railo, BlueDragon, and OpenBlueDragon, as well as in fact any Java server (Tomcat, JBoss, Jetty, Glassfish, Websphere, etc.), and the session applies just as well to folks using those.

My session: Monitoring ColdFusion with FusionReactor

Recording
Session Description:
If your CF server starts acting up, how do you go about resolving problems? If you're on ColdFusion 8 or 9 Enterprise, you may know that you have a built-in ColdFusion Server Monitor. Did you know there is an alternative tool that supplements it well? FusionReactor is a commercial third-party tool, which can monitor not only any version of CF (6, 7, 8 or 9, whether Standard or Enterprise) but also Livecycle and any other Java web application or server in your environment. Such monitoring is about more than "watching a screen". You can arrange to receive email alerts with valuable information (sort of a black box recording before a crash), and FusionReactor also creates really valuable logs that can also help with post-mortem analysis. They can also assist with deciding on CF server configuration settings, watch trends for hardware upgrades, and more. And as of FusionReactor 4, these logs now track information that previous only the CF Server Monitor displayed (but didn't log at all). Finally, an additional tool, FusionAnalytics, can help analyze and visualize that data over minutes, hours, days, weeks, months, and so on. In this 50-minute session, veteran CF troubleshooter and independent consultant Charlie Arehart will introduce and demonstrate these and other key features of FusionReactor (including stack tracing and crash protection), and will end with a brief demo of FusionAnaytics.

Session feedback welcomed

Finally, I'd welcome feedback from anyone who did or does view the talk I gave. They offer no such mechanism. Comments here are fine, and I don't mean only any favorable ones. :-) PS If anyone wonders why I've taken to using the #coldfusion hashtag in my blog entry titles, it's simply that many of the CF blog aggregating tools out there are now retweet what gets posted, and so by using the tag here, it increases the chance that CFers may notice the new entry if watching for that hashtag, even if they don't watch for blog entries from a specific person. It may look a little uglier, but I hope it's helpful for all concerned in the long run.

CF911: Want to monitor #ColdFusion "out of process" (from outside the instance itself)? Many ways.

Fri, 24 Feb 2012 15:57:00 -0400

I just blogged about how the hidden gem "enable monitoring server" option in CF 9.0.1 does NOT cause the CF Server Monitor to somehow magically run "out of process". See more on that. Yet people will reasonably want to be able to have some mechanism that "watches" CF "from the outside", to know when it's gone down. How can you do that? That's what I'll point out in this entry. And beyond talking about what goes along with the CF Enterprise Server Monitor, I'll also point out options for those who are NOT running CF 8, 9, or 10 Enterprise and therefore do not have the Enterprise Server Monitor. This also includes those CF 6 or 7. There are solutions for you, and also for those running Railo, BD, or indeed any Java server. More on all that in a moment. This is part 4 of an unexpected series of entries today on the CF Enterprise Server Monitor. :-) I got on a roll, and each seemed deserving of its own topic. See the "Related Blog Entries" below this entry for links to those.

What the CF Server Monitor is, and is not

To be clear, The CF Enterprise Server Monitor (and indeed, FusionReactor and SeeFusion in their basic configuration) is "just" a web interface (Flex-based) that talks to an embedded flex gateway component running within the CF instance/address space to get information about how the instance is doing. If that instance goes down, then the web interface will have nothing to talk to any more, and the "monitor" will no longer be of value. But there are alternatives to watch the instance (indeed, multiple instances) from the outside

First: The CF Enterprise Multiserver monitor

First up, let me talk about what's built into CF 8/9/10 Enterprise, to go along with the CF Server Monitor. Many never notice it, or they misunderstand it: the Multiserver Monitor. This is different from (but closely related to) the Server Monitor. It is a single Flex-based interface that watches whatever other CF Enterprise server monitor instances you tell it to watch. It does run "out of process" in that it runs on your desktop (as a Flex-based web page) and can show you if a monitored server has gone down or become unresponsive. It also shows a few key stats about each monitored instance in the one interface, while such monitored instances are up. If you want to see the full details of what's going on, you then can ask it to open the full CF Server Monitor (as another web page). I talk about it more in an article I did back in 2008, part 4 of my 4-part series of articles on the Server Monitor. But briefly, it's launched from the same "Server Monitor" page in the CF Admin. I suspect that many mistakenly assume that it's only for monitoring "instances in a multiserver deployment of CF". It can do that, but it can be configured to watch any other CF Enterprise instance (whether on the same machine or on another, and whether that's running in a Server, Multiserver, or indeed J2EE form of deployment.) For more on how to configure the Multiserver Monitor itself, as well as how to configure a server to allow you to "watch" it (you need to tweak an XML file on the server to be monitored), and more, see that article above. I should note, as well, that CF 9 (and 10) now offer a Server Manager, also launched from the same "server monitor" page in the CF Admin, and it does much the same as the Multiserver Monitor, and a little more (as well as a little less). You may want to look at both to decide for yourself. See the CF documentation for more on the Server Manager.

What if you don't have CF 8/9/10 Enterprise?

Since the CF Server Monitor and Multiserver Monitor come only with CF 8/9/10 Enterprise (and the MS Monitor can only monitor such an instance), what do you do if you're on CF Standard, or CF 6 or 7? Or indeed Railo, BlueDragon, or Open BlueDragon? There are solutions for you. First up, as I talked about in an entry back in 2007, CF8 monitor doesn't run on CF8 Standard, or any 6 or 7. What to do?, there are indeed alternative CF Server monitors, FusionReactor and SeeFusion, which both work on CF Standard as well as CF Enterprise. FusionReactor even works with Railo, BD, OpenBD, or indeed any Java server. And by that last point, that means such things as LiveCycle and Flex Data Services, as well as generic tools that run on Java like JIRA and Confluence. It also means the Solr Server that comes with CF 9 and 10! And of course both FR and SF also work just fine on a CF 8/9/10 Enterprise server, even if you have the CF Server Monitor running. They can all run with very little overhead, though of course see the entry I did back in 2007 on potential overhead concerns with the CF Server Monitor.

FusionReactor and SeeFusion each also offer an Enterprise Dashboard feature

But the point for this entry is that both FusionReactor and SeeFusion each of offer an Enterprise Dashboard feature which both offer a single interface to watch multiple monitored instances (on one or many machines), similar to the CF Enterprise Multiserver monitor. You do need to have FusionReactor installed on any instance to be watched by its dashboard, and you need SeeFusion installed on any instance to be watched by its dashboard. And you do need the Enterprise edition of each for them to be watched by their respective Enterprise dashboards. But to be clear, the CF license does not need to be Enterprise (and again, FR can watch Railo, BD, and other Java servers.) There is a page on the FR site devoted to FusionReactor Enterprise Dashboard. There's no specific page on the SeeFusion site about its Enterprise dashboard.

What if you're not sitting there in front of these multi-instance dashboards?

A reasonable question might be: all these dashboards to watch multiple servers at once is nice, but it won't help if you're not looking at them when things go amiss. And that's true.

Now, before I talk more about these multi-instance dashboards, let me clarify that all 3 CF monitoring tools have means to notify you by email when an alert condition arises, as detected within the running instance. In the CF Server Monitor, they're called "Alerts" (and I discuss them in part 3 of my 4-part articles series.) In FusionReactor, they're called "crash protection notification", and that's discussed more here and here. And in SeeFusion, they are called Active Monitoring Rules (there's no page dedicated to them that I can point you to.) These alerts are available in the Standard edition of both FusionReactor and SeeFusion.

But if those individual instances become unresponsive or crash, then those alerting mechanisms will not notify you, either. (That said, they may well alert you when you can't get into the monitors, but the instance is still running. They can also alert you with info just before the instance goes down, and may have valuable info. So these alerts are indeed very worthwhile. I should write more about them separately some day.) Back to the point of the multi-instance dashboards, where the one interface is watching the others, that's a different story. The CF Enterprise Multiserver Monitor is just an interface: it has no means to email you that a monitored server has gone down. Neither does SeeFusion's dashboard, as far as I can tell.

FusionReactor offers several enhancements in its Enterprise Dashboard

But FusionReactor's Enterprise Dashboard has several enhancements over the others. I didn't set out in this entry to make this point. It just is worth noting. First, it can in fact be configured to email you when a monitored instance becomes unresponsive (goes down) and comes back up. That can go to one or more people, and of course it could go to an address that could trigger an SMS or other text message. (More on mobile device notification in a moment.) Second, the FR Enterprise Dashboard configuration page can also be configured to run a script when a monitored server goes down or comes back up. For more on that, see "Using FusionReactor Enterprise Scripting" in the FR documentation. Third, FusionReactor offers an available AIR version of its dashboard, which can pop up an alert from your desktop status tray when a monitored server has problems. Fourth and finally, and a delight to many I'm sure, there are available mobile app versions of the FusionReactor Enterprise Dashboard (IOS and Android). So, whether you're coding away, or playing Angry Birds, whether you want a mobile interface or a text message, or good 'ol email. You can get notification about your monitored servers.

So you can, indeed, monitor CF from "outside the process"

Again, the main point of this entry was to show how in fact you can monitor CF (and other CFML engines) from "outside the process". Those on CF 8-10 Enterprise have the MultiServer monitor and Server manager. Those on CF 6-10 Enterprise or Standard have FusionReactor and SeeFusion and their Enterprise Dashboards. FusionReactor also supports other CFML engines and indeed any Java server/app (whether those you have associated with CF, including Solr, LiveCycle, FDS, and more, or really any Java server like Tomcat, JBoss, Glassfish, WebSphere, etc.) And all 3 tools offer email-based alerts from within the process, which certainly has its own value.

Still other non-CF solutions

Finally, someone may want to ensure that I point out that there are, of course, many other monitoring tools that can "watch a CF server" from "outside the process". I did focus here just on those that are devoted to CF itself. But there are many different kinds of other tools you may want to consider. For instance, there are free (and paid) tools and services which will send requests to your server on a periodic basis and will then email you when they are down (and may track that in an interface). I talk about such tools in a category of my CF411 site: Web Site Uptime Monitoring Tools . Some may recognize some prominent ones like Pingdom, Watchmouse. There are many more I list. Second would be the category of system monitoring tools, like Nagios, ServerDensity, Spiceworks, ManageEngine, and others. I have a category for such tools, System Monitoring Tools, again listing many more, free and commercial. Third would be Java Application Monitoring Tools like NewRelic, JaMon, Glassbox, Orion, and others. And I have another separate category for monitoring a JVM itself, but again the focus here is "out of process" monitoring. Indeed, I have several other categories of monitoring tools for other aspects of a web environment. Check out the top-level category that those and the others abvoe are in, Monitoring Tools/Services, to include also database monitoring tools, other (in-process) ColdFusion monitoring tools, SAN/NAS monitoring tools, web analytics tools, and more. Bottom line: there are many ways to watch a CF instance from "outside the process". Go nuts, kids! And let me know what you think.

CF911: "Enable Monitoring Server" option (new in #ColdFusion 9.01) DOES NOT monitor "out of process"

Fri, 24 Feb 2012 14:23:00 -0400

Have you been led to believe that the "Enable Monitoring Server" option (new in the CF 9.0.1 Admin) somehow magically runs the CF Enterprise Server Monitor "out of process". Sadly, even some folks from Adobe have and still may assert that. It's just not true. So what is this option about, then? I'm not denying its value. I just want to clarify it. BTW, today is "more about the CF Server Monitor" day today here at carehart.org. :-) In my last two entries today, I talked about related matters, regarding the impact of the 3 "start" buttons (monitoring, profiling, and memory tracking), as a followup to an older entry I did on them when the monitor came out with CF 8 in 2007. See the "related blog entries" below for more. In the last entry, I mentioned that in 9.0.1, Adobe added a new "Monitoring Settings" page to the CF Admin, and one of the features is that ability I discussed to turn off the 3 start buttons from within the Admin. Below that is this other feature, labeled "Enable Monitoring Server". Let me say first that has really have nothing to do with all the discussion of the "start" buttons in the previous entries.

So what does "Enabling Monitor Server" do?

All it really does (if enabled) is start a new web server (within CF) that the Server Monitor client will then use to talk to CF. That's it. All the CF Server Monitoring activity (gathering the stats, etc.) is still done WITHIN CF itself, as it always has been (as controlled by those 3 "start" buttons discussed above). As I've explained before, the CF Server Monitor is just an interface to view that information--regardless of the web server port. Indeed, it bears noting that if you use the "built-in web server" (offered during installation or enabled manually), so that you access the CF Admin on, for instance port 8500, then you are already accessing the CF admin from a different web server than your production traffic, assuming that's coming in via port 80 (such as from IIS or Apache). But some people may well not enable that built-in web server, and they may access the CF Admin via the same external web server as all the other traffic. Well, if something has made CF not able to respond to all your other traffic, you may find that the CF Server Monitor also cannot respond.

So this is a 3rd, special, web server option for CF

Enter this new (yes, third) alternative web server: if enabled, then the CF Server Monitor will talk to it (on port 5500 by default). And whereas enabling the traditional "built-in web server" involves editing XML files and restarting CF, this new CF 9.0.1 option is just a single click and it takes effect immediately. No restart required. If you click the "server monitor" button from within the "Server Monitor" page in the CF Admin after enabling this, you'll see that it opens the monitor to that port 5500 (or whatever you tell it to use.) FWIW, this new web server does indeed start up *within the CF memory space*, but it's very lightweight. Still, this further diminishes the mistaken assertion that somehow this feature makes the "monitor run out of process". All that said, it's certainly a good idea to use it, of course. I just wanted to clarify what it really is, and is not, since I so often hear people still assert otherwise. I don't blame them. There's not much documentation on it, and some Adobe folks did in fact at early CF 9.0.1 launch presentations suggest this mistaken assertion. I had been a little reluctant to call it out, hoping it may have gone away, but since I still hear it, I felt compelled to go ahead and write.

Reminder of what the CF Server Monitor is, and that it is always "in process"

Again, as I've talked about previously, the CF Server Monitor is an interface to data collected within the CF instance itself. It doesn't matter what web server you use to launch the monitor. It's still going to talk (via Flash Remoting) to the CF instance to get the data that it shows you. And yes, if CF goes down, the CF Server Monitor goes down with it. It is always an "in process" monitor (as are also FusionReactor and SeeFusion in their basic configurations.)

What if you do want to watch CF from "outside the process"?

If you want something that watches the CF instance "from the outside", that's indeed reasonable. You may want something that helps you see when one or more CF instances (perhaps on multiple machines) is acting up (or going down). That's available as another tool, separate from the CF Server monitor, called the Multiserver Monitor. IT's also a feature available in FusionReactor and SeeFusion. Indeed, it's a topic worthy of its own entry. Coming next. Hope this was helpful to someone. I always look forward to feedback.

CF911: Disabling the #ColdFusion Server Monitor "start" buttons, when you can't get into the Monitor

Fri, 24 Feb 2012 13:20:00 -0400

Many know I'm a big fan of CF monitoring, whether with CF Server Monitor, FusionReactor, or SeeFusion. I've written plenty on each (see the categories to the right here). But the CF Server Monitor does have an Achilles Heel: you may turn on one of its "start" buttons, especially "memory tracking", and find that it's crippling your server. You may not be able to then turn off the feature. I talked about this potential issue in an entry when CF 8 was released back in 2007, CF Server Monitor: what's the impact on production? you may be surprised. I clarify there that the monitor will not, as some assert, "always kill your server". See that for more details. And I discussed in an entry earlier today that you can't just "close the monitor" or even restart CF to make the problem go away, because that won't stop the functionality. See CF911: Using the #ColdFusion Server Monitor? Be aware that the "Start" buttons remain enabled. So what if you are in a situation where using one of the features, especially typically "memory tracking", has in fact sent your server into a tizzy. If you can't even get into the monitor to turn it off, you're going to be in quite a pickle, and understandably panicked.

Easy solution if you're on CF 9.0.1

Fortunately, if you're on CF 9.01 and above, Adobe has addressed this problem. A hidden gem is that they added a new "monitoring settings" option in the CF Admin, and on that page there are checkboxes where you can control enabling/disabling the 3 start buttons from within the Admin, without having to open the Server Monitor. Assuming you can at least get into the CF Admin, just disable one or all of the tracking features, and it will take effect immediately. (There could be a lingering impact that may last a little while as things settle down.) That's a great addition. But what if you are not on 9.0.1? Or what if you can't get into the Admin? Well, in the latter case you could try restarting CF to see if you could get in during the moments before it starts going nuts again, but you may have to resort to the following solution.

What to do in CF 8 or 9.0, or if you can't get into the Admin in 9.0.1

If you're on CF 8, 8.0.1, or 9.0, you won't have that feature above. And if you can't get into the monitor to turn them off (or even can't get into the Admin on 9.0.1), then you'll need to edit an xml file yourself to disable the feature(s) and restart CF. (Let me say first that if you find that you simply "can't SEE" the "start" buttons at the top of the server monitor to turn them off, that's a different problem. Just hit the refresh button in your browser. Generally, that makes them appear. I've reported this problem to Adobe and let's hope they may fix it some day.) Fortunately, you can disable the "start" buttons by directly editing the [cf]\lib\neo-monitoring.xml file. (On multiple instances, it's deep within the instance, such as for instance C:\JRun4\servers\cfusion\cfusion-ear\cfusion-war\WEB-INF\cfusion\lib.) Warning: make a copy of the xml file before editing it, to be able to restore it in case you make any sort of mistake and need to recover. In the xml file, set the entries related to monitoring to be "false", such as for:

The others are monitoringenabled and profilingenabled. You will need to restart for these to take affect (and sometimes it's necessary to stop CF before changing these files, to ensure CF doesn't write to them on shutdown.) Hope that's helpful to someone.

What about the "monitoring server" option in CF 9.0.1?

Some may wonder if the the other new setting in CF 9.0.1's "monitoring settings" page, the "Enable Monitoring Server" option, may be of significance here. Well, yes and no. That, too, is deserving of its own entry. But it does not change at all what I talk about above. More to come.

CF911: Using the #ColdFusion Server Monitor? Be aware that the "Start" buttons remain enabled

Fri, 24 Feb 2012 12:52:00 -0400

If you use the CF Enterprise Server Monitor (in CF 8, 9, or 10), it's vital that you understand that if you turn on any of the Start buttons at the top ("Start Monitoring", "Start Profiling", or "Start Memory Tracking"), the settings they enable in CF STAY TURNED ON, even if you close the monitor, and EVEN IF YOU RESTART CF. Why is this important? Well, I discussed the impact of these buttons (which can be severe or negligible, depending on certain factors) in a blog entry I wrote back in 2007 when CF8 was released. And today someone was kind enough to point it out to someone on Twitter, so I took a look at it and tweaked it a bit to give some more context. While doing that, I realized I'd never mentioned this fact about the "start" buttons, and about an important related change in CF 9.01 (and 10), thus this entry.

The buttons remain enabled over CF restart or closing the monitor

So the first key point, when someone appreciates the potential negative that the buttons COULD have (see the other blog entry--they don't t always have negative impact) is that someone may not realize that turning them on and then closing the monitor doesn't eliminate their impact. I've seen many people decide one day to "play around with the monitor", and they may turn on one or more of these start buttons. They may even yawn if they don't find things compelling (though there's really SO much to appreciate--see my articles on the monitor). My point though is that if they close the monitor, they may think "so much for the monitor". Au contraire, mon frere. The work done by the start buttons (monitoring, profiling, or memory tracking) is done by CF, the server instance itself. The monitor is just an interface to view the info that it is gathering. So if you have no intent of ever looking at the monitor, then DON'T leave those buttons. On the other hand, I'm not saying "don't leave them on". You absolutely can and SHOULD leave them on, and yes, even in production, if you find them valuable and find that they have no impact, or acceptable impact.

You can turn them off, even without getting into the Monitor

Finally, what if you have turned them on (let's say "memory tracking"), and you're in the situation where it's now killing your server. If you can't even get into the monitor to turn them off, you're going to be in quite a pickle, and understandably panicked. Fortunately, you can turn the buttons off without getting into the monitor. It's easier on CF 9.01 and above, but you can also do it by manually editing a file in CF 8 or 9.0. I'll address that in another entry.

Some hidden gems in ColdFusion Builder 2.0.1 for those who edit via FTP

Sat, 18 Feb 2012 14:46:00 -0400

Let me say this up front: I realize that some folks may well decry my pointing this out (hold that thought). But in the spirit of my tradition of pointing out "hidden gems" in things related to CF and CFBuilder, those who may edit files via FTP will want to know that there are some enhancements for that support in CF Builder 2.0.1, now in public beta. Among the "other enhancements" mentioned at the bottom of the "New Features Notes" (PDF), note a few related to FTP:

New Upload On Save option on the FTP connector dialog box to upload a file by way of FTP when saved locally
Use shortcuts to perform Synchronize and Upload (Ctrl+Alt+W U)/Download (Ctrl+Alt+W D) simultaneously
Take advantage of the shortcut for Synchronize (Ctrl+Alt+W Y)

Those may be big news for some, which might be easily missed, and which are not likely to be pointed out in most posts on what's new in CFB 2.0.1. And some would even intentionally leave them out, so I'm "takin' one for the community" here by pointing these out. :-)

Why some may decry these features

Some folks, reasonably promoting better development practices, will have great disdain toward anyone who works this way, editing files via FTP within an editor, especially against a production server (I never do it myself, but I know many do.) They would suggest that such folks ought to be using source code control and a process of migration instead, or at least testing locally and then deploying remotely. I do totally understand their position and agree that most folks should have far better development practices. I just know that some folks may feel they have their hands tied, or they just won't be persuaded to change this approach (or, as Russ Michaels would point out, they may be doing it against a remote development or testing server. That said, I'm sure some would contend against doing that, too, and that people really should have a local development server. I'll address a common argument against that below here.) Regardless of reason people may want to edit via FTP, my motivation in pointing out the new features related to it is that, if being able to edit via FTP is important to them, then enhancements to that may help motivate such folks to use CFB, and we can hope that over time they'd benefit from its many other features which CAN lead to better development practices.

It's not Adobe who added FTP support

Of course, folks who would decry the approach of editing via FTP would also lament that any IDE/editor would even ever offer such FTP support(!), as it "only enables these bad practices"(!). To be clear, CFB has had FTP support from the beginning. All that's new is these couple of tweaks. More than that, I'd point out that it's not Adobe who "added this evil FTP support". :-) The FTP support comes with the Eclipse plugin, Aptana, which ColdFusion Builder has integrated since it's initial release. I don't know if these new couple of features come with an Aptana update built into CFB 2.0.1 or if they may well have been added by Adobe specifically. They have in fact added their own tweaks even to things Aptana builds in. Indeed, one reason Adobe does tweak things is that there are certainly folks coming from Dreamweaver or HomeSite who had been used to certain features (including editing via FTP), and Adobe is aware of the benefit of giving them things they want, so that they will move to the many other better features of CFB. And really, that's the reason I'm pointing out this enhancement to FTP support also: to remove one more obstacle from such folks considering CFB.

Overcoming licensing as a common excuse for editing remotely via FTP

Finally, one of the reasons people often pose for why they "have to edit remotely" and "can't setup a development environment" is the cost of buying CF. (I realize there can be some other configuration challenges also that motivate remote development.) With respect to licensing, though, there's great news that many miss about free licensing for development (which has been true for years) and for testing servers (since CF9). That's really worthy of its own post, which I will do shortly.

Sending HTTP headers in a CFHTTP request? Name them correctly

Tue, 27 Dec 2011 17:11:00 -0400

If you ever try to use CFHTTPPARAM (inside a CFHTTP) to set HTTP headers for the request you're calling, be aware that you need to be careful to specify the name of the headers as they're known in the HTTP specification. Don't be misled by what you see in a CFML dump of the CGI scope.

(This is a reprisal and update of an old blog entry I'd done back in 2003, on a blog site that will soon no longer exist. I'll be reprising a few such blog entries in coming days/weeks, to keep them around for posterity [and to save some having to dig for them in the archive.org site] since often the info offered then may be just as valuable now. I hope that in time these new versions would come up if people do searches that would have found the old entry.)

So, about these http headers, while CFML exposes them in a dump of the CGI scope, such as the user-agent field which shows up as cgi.http_user_agent, the issue is that you would not use that name, nor even "user_agent", when specifying it in a CFHTTPPARAM. The proper way to pass the user agent in a CFHTTPPARAM would be as follows:

Why is this an issue, and how may it happen?

An easy mistake to be lulled into

The point is that the name of the header you specify must be a name that is correct according to the http specifications, not the headername as it appears in CFML when you dump the CGI scope. The problem is that CF tries to "help" you by how it labels the headers in these scopes, but it does not show them in the actual name you must specify if you're going to be sending it in a CFHTTPPARAM request. It's is an easy mistake to be lulled into, especially if you aren't careful to confirm the results in the page you are calling. And if you are trying to call some non-CF server, and things aren't working, this may well be the reason.

Other possible headers of interest

Other headers of possible interest that you may want to specify when doing a CFHTTP request are Accept, Accept-Encoding, Referer, and so on. So if you were wanting to send/spoof what CF would show as the cgi.http_referer variable, you'd want to send it with the name just as "referer".

Alternative type="cgi" and type="header"

FWIW, note that I am using here the type="CGI" value. CFML also supports a type="header". The difference is in whether CF urlencodes the result before sending it (it does not for type="header"), which could be another issue to consider. This encoding can also be turned on or off with the available "encoded" attribute, at least for type="cgi".

Yes, you don't need to use cfhttpparam for sending the user agent

Finally, someone may want to point out that you don't even need to use CFHTTPPARAM to send the user agent, since CFHTTP offers a separate built-in USERAGENT attribute which can be used instead. Yes, this is do. I suspect it's an older approach that either existed before CFHTTPPARAM permitted passing it, or it was put in as a shortcut. But the point of this entry is that if you do need to set this or any other headers within the CFHTTPPARAM, be aware of using the correct http header name.

Applying CF security hotfixes: do it from oldest to newest

Fri, 16 Dec 2011 16:47:00 -0400

If you may be applying several security hotfixes to a new implementation of CF (or one where none have been applied before), you may wonder if there's any significance to applying them in either chronological order (newest to oldest, or oldest to newest). The technotes don't really clarify this. I will propose that they should be done from oldest to newest. Here's why. If you look at the list of CF security hotfixes offered here, you may wonder whether to start with the most recent ones, or the oldest ones. If you look at their respective technotes and zip files closely, you may find that some are truly independent of the others. But it's also a reality that some do supercede the others. That may be obvious to some, but I wanted to offer a case in point. Consider the hotfixes for APSB11-14 and APSB11-04. If you look at the zips for these, you may notice that they offer a few files (in the web-inf/lib directory) that appear identical in name (log4j.properties, esapi.properties, validation.properties, commons-fileupload-1.2.jar, and so on.) If you had applied the later one first, you may then wonder if it's significant if you then want to apply the older one. Well, those files are in fact identical (I did a compare). But the files in the CFIDE associated with each hotfix are in fact quite different and so the later ones would supercede the earlier ones. So you would NOT want to do them in the wrong order (older before newer). It's just not always clear from the technotes whether this is an issue to worry about, so I wanted to share it here.

This is not the place for discussion of how complicated CF hotfixes are. That's been discussed to death in many places. If you didn't know, Adobe is indeed addressing the problem in the next release, currently code-named Zeus. You can read about this and 50 other currently publcized Zeus features in a talk I did. And note that they have said they will be back-porting some of that to earlier releases.

Hope it's helpful to someone. If you may have a different experience or opinion about the order of applying security hotfixes, feel free to share it. PS I have written previously about easy mistakes you can make in applying any CF hotfixes, and how to avoid them. See CF911: Are you finding CF (or CF Admin) busted after applying a hotfix? Three possible reasons. I have also written about the challenges of trying to "skip" cumulative hotfixes. You may want to read them if you've not yet done so. But again, please hold off on any comments about the complications of CF hotfixes. There's nothing more to do than deal with the situation as it is and await Adobe offering a better solution.

CF911: Are you finding performance problems with CFDOCUMENT? Aware of the important LOCALURL attr.?

Sat, 19 Nov 2011 15:47:00 -0400

This is something that I find nearly no one has talked about, as a problem and solution. Did you know that by default, a single request doing a CFDOCUMENT may cause CF to execute several additional requests, each doing a CFHTTP to grab any images on the page? even if the images could be found locally on the server? This can be quite tragic. The good news is that the problem can be solved using the simple LOCALURL attribute. The bad news is that you have to do it at all, and that if you don't do it, it can have such unfortunate and unexpected impact. (And just as bad, again, is that hardly anyone has talked about it.) This entry will elaborate on the issue (and a couple of other possible CFDocument performance issues, as a bonus.) I've been meaning to write about the importance of this problem and solution (the LocalURL attribute) for a long time (it came out in CF8). Often when I'm helping people with CF troubleshooting problems, whether on mailing lists or in my consulting services, I've been able to show that long-running requests (or an unexpectedly excessive number of requests) were sometimes due to this very problem.

Basics of the LocalURL attribute

Before we go any further, let's start with the details of the attribute (which may surprise many). The following is extracted from a larger blog entry about various CFDocument improvements in CF8 from Adobe Engineer, Rupesh Kumar, back in 2007:

When CFDocument body contains a relative URL, ColdFusion will resolve the relative URL to an absolute URL and will send an HTTP request for this url [emphasis, mine]. A side effect of this is Server ends up sending HTTP request even for local URL or images that are lying on the local file system which obviously hurts the performance. In ColdFusion 8, we have added a new attribute "localURL" to cfdocument tag which if enabled, will try to resolve the relative URLs as file on the local machine.

localURL : "true" | "false" It should be enabled if the images used in cfdocument body are on the local machine. This would make the cfdocument engine retrieve the images directly from the file system rather then asking the server for it over http
This attribute helps reducing the load from the server so that the same web server thread can now serve user request instead of serving local images to CFDocument. This also addresses some of the "missing image" problems which I mentioned here. Here is a sample code using this attribute. bird Rose

So why is this an issue?

It would help to make a point of clarification: CFDOCUMENT builds a document (perhaps a PDF or Word doc) on the server, from whatever CFML and/or HTML is within the tags. As such, CF will need to "get" whatever images (or scripts or css files) are defined on the generated HTML page (as img src, script src, link href, etc.) so it can build the resulting "document" file on the server. And the point of the dilemma (identified on this page) is that a single CFDOCUMENT with many such img src (or similar) tags will not just cause CF to look to the file system to get the files they point to. Instead, CF will get them via CFHTTP. Technically, the issue is that CF doesn't necessarily "know" that the location pointed to in the img src and similar tags *is* on the local server. So it presumes it has to get ANY of them using a CFHTTP call. That's what causes the problem, if there are many of them. Using the LOCALURL attribute tells CF instead that it SHOULD look for the files on the local filesystem and NOT do a CFHTTP to get them. Sadly, this issue is only barely mentioned in the CF Docs age on CFDocument, and it would be easy to miss the point it's trying to make. (It says only that CF "requests the server for images over HTTP even though the image files are stored locally".)

How some tried to workaround the problem with file:// references

While looking around to see who else maybe had talked about this fix (which, as I noted, I found virtually no other references to it), I did find that some people had effectively "solved" the problem by telling CF to use "file:///" protocol references in the img src and similar tags. Among the entries discussing this were:

It's understandable that people figured it out as a work-around, and perhaps someone even started sharing the idea before CF8 added this attribute, but the LOCALURL would seem generally the way to go.

Some other CFDOCUMENT performance resources

Though not related to the LocalURL attribute, there are some other things that may lead to performance problems. First, those on CF Standard (as opposed to Enterprise or Developer edition) should know that CFDocument is one of several tags that are single-threaded through CF's "Enterprise Feature Router" (EFR). Second, there are certainly still other possible CFDocument performance issues, and the following other resources address some of those:

Cfdocument and Performance, from Mark Kruger
Images and CFDocument performance, also by Rupesh Kumar
A workaround for cfdocument missing images, by Rupesh Kumar
Missing images in CFDocument, by Rupesh Kumar

Hope any or all of the info above may be helpful to some readers. Let me know what you think.

bird
Rose