This is a question that I think I know the answer to, but being that you could put what I know about Tomcat and Java in a thimble and have room for your fist, I thought I'd ask. We have a tomcat server sitting in a dmz zone (2 firewalls to the Net, 2 between our LAN and it). A Java developer here finally launched an "application" consisting of about 42 jsp pages and various and sundry other java objects. This is the production server. We have development servers and qa servers on the LAN, but this is the production box. He wrote his own logging system and places the log files in a directory he made off of the tomcat install root ($CATALINA_HOME). He now tells me he needs a shell account on that host. For obvious reasons, as a rule, we do not provide anyone but sys admins a shell account on any host not on the LAN. They run lambdaprobe on this box in the role of "probeuser". There are not administrator roles defined for lambdaprobe on this box. That gives them access to a whole host of things that make me nervous, including viewing and downloading logs in $CATALINA_HOME/logs. I offered an sftp jail account to the directory he created, but that isn't good enough it seems. He wants shell access and I don't want to go through the pain of setting him up a chroot jail on a production box so that he can "debug" a production application on a production server. Call me stupid, but I thought that was what the dev and qa servers were for: debugging applications.

I have some questions for those of you who are tomcat/java goobs:
1) In Javaland, is it typical to debug apps on production boxes?
2) In Javaland, is it typical to create your own logging directories outside of webapps and/or $CATALINA_HOME/logs?
3) In Javaland, is it SOP to hand out shell accounts to developers on boxes that are in production and not on your LAN?

Any help appreciated. This just doesn't pass the smell test for me. But, as I said, maybe this is normal for Java teams. I just don't know, but I do know that this developer has no difficulty lying to me. He's done it before and it was absolutely clear that he was lying to everyone but the CIO. (He said a file format was X, produced the file and it was not in format X. But, both he and the CIO insisted it was. It wasn't even a close call. The files were dramatically different.)

Unified logging is a great idea and we should do that. With enough shovels, I'd *love* to make the possible.

Just a few notes. The QA/Test boxes are identical. The only difference between the QA/Test boxen and the production box is location. QA/Test boxes are on the LAN, production outside the f/w. So, from my POV, debugging *should* be possible on one of the QA/Test boxes. The dev boxes start out in sych with everything else, but the developers pretty much own those boxes. Until the devs break it. Then we clean them return them to being in synch with production.

Box-> Yep, same guy gives official word that app is ready to push to prod, and my group does it.

I wasn't trying to be a smart ass with my qualifier "In Javaland." I wrote it that way because it's been a decade or so since I developed anything other database stuff. I'm really out of touch with any sort of development that doesn't involve sql, but when I was a developer all those years ago, the sysadmins I worked with would have laughed me out of their offices (or just shot me) if I asked for a shell account on a production box. ;0)

Thanks again everybody!

I'm embarrassed to say this, but the "production" box we're talking about in my case is a single function box with, at present, 1 user utilizing this one batch of jsp pages, 1 or 2 days a week. IOW, it is a *very* lightly loaded box. :0)

We might run into load problems, but they'll be a while off. The plan is to add one user every 1 to 2 weeks up to a grand total of around 90 at the end of the year. And they won't be concurrent users. ;0)