Lucee 6.2.0.321 missing org.apache.commons.net in version 3.3.0

[Markus_Wollny]

I did a fresh manual install using Debian 12 with tomcat 10 and the full lucee-6.2.0.321.jar; the thing was up and running, but I noticed that the admin was extremely slow, each page taking anything from 10 to 30 seconds to load - this was going directly through port 8080 to tomcat, bypassing the Apache connector altogether. I noticed a fair number of error lines in /var/log/lucee/application.log with this error message:

“ERROR”,“http-nio-8080-exec-5”,“04/04/2025”,“15:32:13”,“OSGi”,"The OSGi Bundle with name [org.apache.commons.net] in version [[3.3.0,]] is not available locally [ (/var/lucee/config/server/lucee-server/bundles)] or from the update provider [ (https://update.lucee.org)].;org.osgi.framework.BundleException: The OSGi Bundle with name [org.apache.commons.net] in version [[3.3.0,]] is not available locally [ (/var/lucee/config/server/lucee-server/bundles)] or from the update provider [ (https://update.lucee.org)].

So I did this:
wget https://repo1.maven.org/maven2/commons-net/commons-net/3.3/commons-net-3.3.jar -O /var/lucee/config/server/lucee-server/bundles/org.apache.commons.net-3.3.0.jar

chown tomcat:tomcat /var/lucee/config/server/lucee-server/bundles/org.apache.commons.net-3.3.0.jar

systemctl restart tomcat10

Afterwards, the Lucee admin was running fine, no more extreme load times. I don’t know if there is some misconfiguration on my behalf, but I cannot find anything where I could have made any change to the setup that would require this bundle. There was already a org.apache.commons.commons-net-3.9.0.jar in /var/lucee/config/server/lucee-server/bundles/, but it seems that for some reason, org.apache.commons.net-3.3.0.jar is required and cannot be loaded automatically?

Is there something that I failed to do in the setup of Lucee or is there maybe some quirk in the current lucee-6.2.0.321.jar? I mean I have no issue either way, as it’s running fine after I downloaded the file from maven, but I wanted to find out what the root cause of the issue is here.

OS: Debian 12
Java Version: Java 21 Temurin
Tomcat Version: Tomcat 10
Lucee Version: 6.2.0.321

[Zackster]

that sucks, are u using any old extensions?

if you go into the admin, it will tell you which extensions are using that bundle

using axis?

using the 6.2.1 RC, i stopped tomcat, renamed that jar and restarted, Lucee downloaded it automatically from maven?

"DEBUG","http-nio-9888-exec-2","04/04/2025","17:01:07","OSGi","Start bundle: [org.lucee.jaxrpc:1.4.0]"
"DEBUG","http-nio-9888-exec-2","04/04/2025","17:01:07","OSGi","add bundle:D:\lucee6\tomcat\lucee-server\bundles\org.lucee.saaj-1.4.0.jar"
"DEBUG","http-nio-9888-exec-2","04/04/2025","17:01:07","OSGi","Start bundle: [org.lucee.saaj:1.4.0]"
"DEBUG","http-nio-9888-exec-2","04/04/2025","17:01:07","OSGi","add bundle:D:\lucee6\tomcat\lucee-server\bundles\org.apache.commons.discovery-0.5.0.jar"
"DEBUG","http-nio-9888-exec-2","04/04/2025","17:01:07","OSGi","Start bundle: [org.apache.commons.discovery:0.5.0]"
"INFO","http-nio-9888-exec-2","04/04/2025","17:01:07","bundle-download","Could not find [/bundles/org.apache.commons.net-3.3.0.jar] in lucee.jar"
"WARN","http-nio-9888-exec-2","04/04/2025","17:01:08","bundle-download","Fetch bundle url [https://repo1.maven.org/maven2/commons-net/commons-net/3.3.0/commons-net-3.3.0.jar] returned [404]"
"INFO","http-nio-9888-exec-2","04/04/2025","17:01:08","bundle-download","Downloading bundle [org.apache.commons.net:3.3.0] from https://repo1.maven.org/maven2/commons-net/commons-net/3.3/commons-net-3.3.jar and copying to D:\lucee6\tomcat\lucee-server\bundles\org.apache.commons.net-3.3.0.jar"
"DEBUG","http-nio-9888-exec-2","04/04/2025","17:01:08","OSGi","add bundle:D:\lucee6\tomcat\lucee-server\bundles\org.apache.commons.net-3.3.0.jar"
"DEBUG","http-nio-9888-exec-2","04/04/2025","17:01:08","OSGi","Start bundle: [org.apache.commons.net:3.3.0]"
"DEBUG","http-nio-9888-exec-2","04/04/2025","17:01:08","OSGi","add bundle:D:\lucee6\tomcat\lucee-server\bundles\org.lucee.commons.httpclient-3.1.0.0002L.jar"
"DEBUG","http-nio-9888-exec-2","04/04/2025","17:01:08","OSGi","Start bundle: [org.lucee.commons.httpclient:3.1.0.0002L]"
"DEBUG","http-nio-9888-exec-2","04/04/2025","17:01:08","OSGi","add bundle:D:\lucee6\tomcat\lucee-server\bundles\org.lucee.axis.ant-1.4.0.0006L.jar"
"DEBUG","http-nio-9888-exec-2","04/04/2025","17:01:08","OSGi","Start bundle: [org.lucee.axis.ant:1.4.0.0006L]"
"DEBUG","http-nio-9888-exec-2","04/04/2025","17:01:08","dynamic","extract metadata from [org.lucee.extension.axis.Axis1Handler]"
"TRACE","http-nio-9888-exec-2","04/04/2025","17:01:08","EnvClassLoader","not found [META-INF/services/org.apache.axis.EngineConfigurationFactory] in bundle [org.apache.commons.discovery:0.5.0]"
"TRACE","http-nio-9888-exec-2","04/04/2025","17:01:08",

[Markus_Wollny]

Weird thing is, nothing seems to be using the bundle according to the Lucee Admin UI:

I updated to Lucee 6.2.1.112-RC, stopped tomcat, renamed org.apache.commons.net-3.3.0.jar to org.apache.commons.net-3.3.0.jar.bak, started tomcat and reloaded the Admin, but it doesn’t download the bundle from Maven, instead I get the error messages in application.log again. Here’s the full stack trace:

"ERROR","http-nio-8080-exec-4","04/05/2025","20:47:41","OSGi","The OSGi Bundle with name [org.apache.commons.net] in version [[3.3.0,]] is not available locally [ (/var/lucee/config/server/lucee-server/bundles)] or from the update provider [ (https://update.lucee.org)].;org.osgi.framework.BundleException: The OSGi Bundle with name [org.apache.commons.net] in version [[3.3.0,]] is not available locally [ (/var/lucee/config/server/lucee-server/bundles)] or from the update provider [ (https://update.lucee.org)].
        at lucee.runtime.osgi.OSGiUtil._loadBundle(OSGiUtil.java:823)
        at lucee.runtime.osgi.OSGiUtil.loadBundle(OSGiUtil.java:640)
        at lucee.runtime.osgi.OSGiUtil.loadBundlesAndPackagesFromMessage(OSGiUtil.java:2557)
        at lucee.runtime.osgi.OSGiUtil.resolveBundleLoadingIssues(OSGiUtil.java:2436)
        at lucee.runtime.osgi.OSGiUtil._start(OSGiUtil.java:1493)
        at lucee.runtime.osgi.OSGiUtil._startIfNecessary(OSGiUtil.java:1440)
        at lucee.runtime.osgi.OSGiUtil._loadBundle(OSGiUtil.java:717)
        at lucee.runtime.osgi.OSGiUtil.loadBundles(OSGiUtil.java:1557)
        at lucee.runtime.osgi.OSGiUtil._start(OSGiUtil.java:1474)
        at lucee.runtime.osgi.OSGiUtil._startIfNecessary(OSGiUtil.java:1440)
        at lucee.runtime.osgi.OSGiUtil._loadBundle(OSGiUtil.java:717)
        at lucee.runtime.osgi.OSGiUtil.loadBundle(OSGiUtil.java:678)
        at lucee.runtime.osgi.OSGiUtil$BundleDefinition.getBundle(OSGiUtil.java:2103)
        at lucee.commons.lang.ClassUtil.loadClassByBundle(ClassUtil.java:184)
        at lucee.commons.lang.ClassUtil.loadClassByBundle(ClassUtil.java:168)
        at lucee.transformer.library.ClassDefinitionImpl.getClazz(ClassDefinitionImpl.java:211)
        at lucee.transformer.library.ClassDefinitionImpl.getClazz(ClassDefinitionImpl.java:203)
        at lucee.runtime.config.ConfigWebHelper.getWSHandler(ConfigWebHelper.java:232)
        at lucee.runtime.config.SingleContextConfigWeb.getWSHandler(SingleContextConfigWeb.java:1651)
        at lucee.runtime.config.ConfigWebImpl.getWSHandler(ConfigWebImpl.java:1074)
        at lucee.runtime.functions.system.GetApplicationSettings.call(GetApplicationSettings.java:259)
        at lucee.runtime.functions.system.GetApplicationSettings.call(GetApplicationSettings.java:85)
        at application_cfc$cf.initComponent(/admin/Application.cfc:51)
        at application_cfc$cf.newInstance(/admin/Application.cfc:17)
        at lucee.runtime.component.ComponentLoader.initComponent(ComponentLoader.java:700)
        at lucee.runtime.component.ComponentLoader._loadComponent(ComponentLoader.java:639)
        at lucee.runtime.component.ComponentLoader.loadComponent(ComponentLoader.java:512)
        at lucee.runtime.component.ComponentLoader.loadComponent(ComponentLoader.java:496)
        at lucee.runtime.listener.ModernAppListener._onRequest(ModernAppListener.java:109)
        at lucee.runtime.listener.ModernAppListener.onRequest(ModernAppListener.java:100)
        at lucee.runtime.PageContextImpl.execute(PageContextImpl.java:2810)
        at lucee.runtime.PageContextImpl._execute(PageContextImpl.java:2797)
        at lucee.runtime.PageContextImpl.executeCFML(PageContextImpl.java:2768)
        at lucee.runtime.engine.Request.exe(Request.java:45)
        at lucee.runtime.engine.CFMLEngineImpl._service(CFMLEngineImpl.java:1109)
        at lucee.runtime.engine.CFMLEngineImpl.serviceCFML(CFMLEngineImpl.java:1066)
        at lucee.loader.engine.CFMLEngineWrapper.serviceCFML(CFMLEngineWrapper.java:97)
        at lucee.loader.servlet.jakarta.CFMLServlet.service(CFMLServlet.java:49)
        at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:658)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:195)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140)
        at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:167)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:90)
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:483)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:115)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93)
        at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:663)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:344)
        at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:397)
        at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)
        at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:905)
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1741)
        at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52)
        at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1190)
        at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:63)
        at java.base/java.lang.Thread.run(Thread.java:1583)

These amount to thousands of events within a very short time even without no requests being run on Lucee at all, presumably because this is being run by some background activity as well.

For what it’s worth, I did copy the .CFConfig.json from a previous 6.1 installation and I originally generated that one using the CFConfig CLI module using the transfer option. from a Lucee 5.3 lucee-server.xml.

My installed extensions at the moment:

None can be updated to a newer stable version. I have uninstalled the MSSQL and S3 extensions, as I can do without them, but that didn’t help either.

I cannot see what exactly needs the outdated org.apache.commons.net-3.3.0.jar unfortunately. I am fine with deploying this manually for the time being, but I think I’d sleep a little better knowing what’s behind this, so if there’s anything I can do to investigate this further, I will.

[Zackster]

What happens if you stop the server, rename CFConfig.json and start up again, i.e. let lucee reset to it’s default configuration?

Then diff the renamed cfconfig against the newly generated one?

Or just drop your 5.3 XML in and let Lucee auto migrate itself. I.e stop, deleting cfconfig, copy the lucee-server.xml in and restart

You can also try dropping valid json subsets of the CFconfig.json into the deploy directory, over the fresh install to see which specific settings blow things up

6.2.1 has better logging regarding deploy imports too

It’s all a bit trial and error I know, but that’s the joy of being a developer I guess!

Using this makes it much easier to monitor the logs if you start lucee using catalina.sh run

https://luceeserver.atlassian.net/browse/LDEV-3420

[Markus_Wollny]

Hi,

The automigrate route from the original lucee-server.xml yielded a very similar result and produced a number of additional config entries that I think are mostly unnecessary - probably stuff that’s been in there from v4ish times. So I went back to the original equally broken config and compared this to the default config created by Lucee when starting up with no .CFConfig.json file.

Ignoring stuff like the datasources and helped by your hint at some issue with Axis 1 webservices, I did notice this config bit near the end of the file between “labels” and “suppressWhitespaceBeforeArgument”:

"webservice": {
    "class": "org.lucee.extension.axis.Axis1Handler",
    "bundleName": "org.lucee.axis.extension",
    "bundleVersion": "1.4.0.37"
},

When I remove this, the Admin UI loads perfectly, no more error log lines requesting the missing org.apache.commons.net 3.3.0 bundle. When I add it back in, things turn back to sluggish again and the errors are back in the application.log, so that’s definitely it, this block is causing the issues. I checked with the Version that was migrated from lucee-server.xml and it does have a similar block, albeit under a differen bundleName:

  "webservice": {
    "bundleName": "org.lucee.axis.extension",
    "bundleVersion": "1.4.0.37",
    "class": "org.lucee.extension.axis.Axis1Handler"
  }

Anyway, while getting rid of that does solve the problem, we do still need to interact with a couple of legacy SOAP webservice endpoints; we can migrate some of them ourselves, but there are two fairly important services we still need that are not under our control and the party that is in control does not offer any more modern alternative and I very much doubt that they would create one for us. So I assume that we will indeed be needing the Axis1 extension.

After all the fiddling, there was more stuff that was broken (i.e. clicking on any of the extension brought up error messages like “In the OSGi Bundle with the name [esapi.extension] and the version [2.2.4.18] was no class with name [org.lucee.extension.esapi.functions.SanitizeHTML] found”), so I deleted all of the /var/lucee directory, recreated the empty folder and dropped the fixed .CFConfig.json back into /var/lucee/config/server/lucee-server/context/.CFConfig.json and started Tomcat again.

I am back on Lucee 6.2.0.321 now; I can install additional extension like the Lucee Log Viewer, but attempting to install the stable version of Axis 1 Webservices (1.4.0.37) gives an error message:

Unable to resolve org.lucee.axis.extension [104](R 104.0): missing requirement [org.lucee.axis.extension [104](R 104.0)] osgi.wiring.bundle; (&(osgi.wiring.bundle=org.lucee.axis)(bundle-version>=1.4.0.0006L)) [caused by: Unable to resolve org.lucee.axis [105](R 105.0): missing requirement [org.lucee.axis [105](R 105.0)] osgi.wiring.bundle; (&(osgi.wiring.bundle=org.apache.commons.net)(bundle-version>=3.3.0))] Unresolved requirements: [[org.lucee.axis.extension [104](R 104.0)] osgi.wiring.bundle; (&(osgi.wiring.bundle=org.lucee.axis)(bundle-version>=1.4.0.0006L))]

Choosing the 1.4.0.38-SNAPSHOT version instead was successful however. No errors in application.log either.

TL/DR: When coming from a previous Lucee version that used to make use of Axis1, check .CFConfig.json for a block like

"webservice": {
    "class": "org.lucee.extension.axis.Axis1Handler",
    "bundleName": "org.lucee.axis.extension",
    "bundleVersion": "1.4.0.37"
},

(bundleName may vary). Remove this block, save the .CFConfig.json somewhere, stop Tomcat, delete the deployment directory, recreate the directory structure and set approproate permissions, drop the fixed .CFConfig.json back into the /var/lucee/config/server/lucee-server/context/.CFConfig.json path, start Tomcat and if you’re sure that you still need Axis1, do install the latest 1.4.0.38-SNAPSHOT version.

[Markus_Wollny]

Just a last finding here - I checked, what Lucee did after installing Axis 1 1.4.0.38-SNAPSHOT and the webservice block is back in - just instead of the “bundleVersion”: “1.4.0.37” is has “bundleVersion”: “1.4.0.38-SNAPSHOT”. If there is no blocker preventing a release of 1.4.0.38, it should probably be marked as stable now.

[Zackster]

The 6.2.1-final RC includes an important bug fix for the AXIS extension

https://luceeserver.atlassian.net/browse/LDEV-5475