Charlie Arehart - Server Troubleshooting - apache

ColdFusion 2025 released, Feb 25 2025 - resources and my initial thoughts

Tue, 25 Feb 2025 19:55:00 -0500

ColdFusion 2025 has been released today, Feb 25 2025. In this post I am not only helping share news of the release, and pointing to available resources, but I also share some thoughts/observations on related matters that may be a bit challenging for most to find more about on their own (if they may only assess a couple of resources, or hear only tidbits shared in social media). First, for more on the many features and changes, I share many Adobe resources--about which I also offer some additional comment. I also discuss changes regarding OS and DB support as well as the fact that CF2025 now runs on Java 21-- and that the traditional server deployment of CF comes installed atop Tomcat 10.1. I then share still more info on other matters and resources related to the new version. I then focus on the major change in licensing, for CF2025 and forward, to being subscription only--which I'll note has no effect on those currently running CF2023 or earlier. I share pricing info and also help in assessing differences in the EULA, and more. Finally I discuss some migration considerations--including important REMOVAL of some older features from CF2025, as CF continues to be made more secure and modernized. I also identify tools and resources to help aid you in that migration, when you're ready to begin attempting it. For all that and more, read on. [More]

Announcing ColdFusion emergency update released March 14 2023 - what to do about it

Fri, 17 Mar 2023 03:00:00 -0500

If you've not heard, a new update has been released (March 14, 2023) for ColdFusion 2021 and 2018. Despite what you may hear, this is an URGENT (rated "Priority 1" by Adobe) update that everyone should apply ASAP, for reasons I will explain in this post. In fact, Hackernews reported yesterday (Mar 16) that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) had issued an urgent warning about this, giving federal agencies a deadline to apply the update. TLDR; For some folks, the above may be all you need to hear: you may be dropping your coffee and donuts now to get the update applied. Still others will see this "huge post" and think, "crap, I don't have time for this". For you, skip to the bottom and its "concluding key points". You can then decide what you think you do or don't "need to know" and pick and choose from the sections as you like. Finally, for those who prefer because of the importance of all this to be led more carefully through understanding things (in a way that's worked for the many people I have helped so far this week, and is far more than either Adobe or Hackernews has shared), please do read on. [More]

The 100 most interesting posts on the Adobe ColdFusion blog, the past 3 years

Thu, 09 Feb 2017 13:32:00 -0500

The Adobe ColdFusion team blog often has really some interesting content, but I find that some people are either not aware of the blog or just don't keep up on it, or perhaps they have trouble finding something they saw before or maybe heard was there. So here I present what I feel are the 100 (technically, 105) most interesting/useful posts made there over the past 3 years (2014-16), offering information about CF and CFML which should be valuable to readers for years to come. [More]

The ColdFusion 'metrics log', an oft-missed or misunderstood feature, 'new' since CF10 (Part 1)

Wed, 02 Mar 2016 02:13:00 -0500

I'd like to take a diversion from my recent posts focused on CF2016 and talk about something that applies (and should interest) anyone using CF 10, 11, or 2016. Have you heard of the new "metrics log" option that was enabled in CF10? If you have not, it's worth knowing about (there's precious little documentation, and I'll point to it, and give you still more info to help you use it). It's a useful, low-impact mechanism to get some high-level metrics logged by CF every 60 seconds (by default), and stored along with other CF logs. If you did know about it, you've probably had some problems with it. Why does it show "nulls"? What do reported metrics really mean? Why do they not jive with what I'd expect to be the numbers reported? In this post, and a Part 2 to come, I will introduce the metrics log, pointing out some key things you need to know to have it setup to work at all, and then I'll share my observations of things I've come to understand about the reported metrics. [More]

ColdFusion 2016 - Changes in the CF Administrator

Tue, 23 Feb 2016 22:32:00 -0500

As folks continue to explore ColdFusion (2016 Release), aka CF2016, regarding what's new or changed, I thought I'd put together a listing of what has changed in the CF Admin specifically. This is another in a series of posts I started last week on CF2016. [More]

Released today - CF2016, or 'ColdFusion (2016 release)'. What's new, and more

Tue, 16 Feb 2016 10:04:00 -0500

If you're not following the Adobe CF team blog, you may have missed the announcement there today of the newest version of CF, ColdFusion 2016. More on the name in a moment. And while that Adobe blog post mentions a few of the main new features, as is nearly always the case it leaves out many other new features which may interest folks. It also doesn't point to resources to learn more. I do those things here in this post. [More]

Monitoring ColdFusion web server connectors, more on Tomcat 'Status Workers'

Mon, 03 Aug 2015 01:10:00 -0500

If you've configured your web server (IIS or Apache) to be connected to CF--which can be done using the CF "web server configuration" or wsconfig tool--did you know that there is an optional monitor to observe the status of that web server connector? That connector is technically the Tomcat "AJP connector", which Adobe implements for us. And this monitor, called the Tomcat "Status worker", is an optional feature which we can configure (the CF wsconfig tool doesn't do it for us). In this post, I discuss the tool, elaborating on a post that Adobe offered about it last month (July 2015: for future readers, note that the feature remains essentially unchanged and just as potentially valuable in 2025, when I have tweaked this post just a bit, adding a table of contents and changing the order of some topics). You may well want to consider enabling the "Status Worker" feature, which the Adobe post shows is easily done. Still, in this post I elaborate on some observations and caveats not covered in that brief post, which you will want to consider before enabling or trying to understand the output of the tool. [More]

CF911- Help, How do I connect sites to a new instance w/ the ColdFusion 10/11 webserver config tool?

Thu, 26 Feb 2015 22:35:00 -0500

This one causes a lot of heartburn for folks: you add a new instance in CF10 or 11 (in editions other than Standard, which do support adding instances), and you find that you can't seem to have the web server configuration tool (wsconfig) connect sites to that new instance(s). You never see the new instance listed in the UI of the wsconfig tool. What gives? The solution is relatively easy, and the problem could maybe be fixed (or at least warned about) by Adobe (and I just filed a bug report for it). Until that happens, I wanted to share this. For more, read on. [More]

ColdFusion Lockdown/Security guides - there are several, and some you may have missed

Tue, 24 Jun 2014 01:43:00 -0500

While helping people with various problems in my CF server troubleshooting services, I often have the chance to help people identify security vulnerabilities, especially in their configuration of CF and/or their web server, and sometimes related to their code. I was wanting to point out to someone the various ColdFusion security resources, and while I have a category on them in my CF411 site, I thought this was a list worth pulling out into its own blog entry and expanding a bit. You may be surprised to find that there are more to CF security guidelines than just the venerable server "lockdown guide" (for those administering and configuring CF, the OS, and the web server, among other things). Did you know that there have been "developer security guidelines" as well, focused instead on coding? This latter guide has gone through three iterations, including just recently, as I'll discuss along with the lockdown guides, below. [More]

CF911- Why/when you MUST update the web server connector for ColdFusion 10/11 and may have missed it

Fri, 13 Sep 2013 01:51:00 -0500

Have you installed or updated CF10 (or 11) and found that you still have problems with it running right, even when you have "fully updated" CF10? In this blog entry, I explain how it may NOT be that "CF 10 is broken" but rather that you may have missed an important step when updating it. In brief, a VERY common problem is that while they MAY WELL have applied the provided "updates" for CF, folks often do NOT notice that they may have to (and generally must) "update" the web server "connector" (if they are using an external web server, like IIS or Apache) as a separate manual step, after applying the update. I explain here what that means, how do to it, and why you may miss that you need to. Update in 2019:

Since writing this entry, I did one in 2019 on When and how to upgrade CF web server connector, easier since CF2016, which at least makes it EASIER to upgrade, though much of what I write here still applies. I also updated this post since originally writing it, in ways discussed below.

(Or if you'd rather just have me help you quickly help you analyze and rectify your situation, whether with regard to the connectors or any other CF server troubleshooting, I can do that in a brief consulting session, likely less than an hour, remotely and securely. I provide all the detail here for those who prefer to "go it on their own". For more on my consulting services, including rates, approach, satisfaction guarantee, and more, see the consulting page at carehart.org.) [More]

Setting up ColdFusion to process html or other file extensions

Fri, 14 Oct 2011 20:45:00 -0500

As a follow-on to my last entry, Setting up CFBuilder to process htm files with the ColdFusion editor, I wanted to offer more info for those who may want to know more about this--or ensure that more is shared with any who would consider doing this. If you're looking for how to configure CFBuilder to open htm files with the CFML editor, see that other entry. This one instead is about the related idea of having CF (the server) process htm (or other) file extensions. There are certainly pros and cons. [More]