[Mongrel] Mongrel as Windows service with normal privileges

Luis Lavena luislavena at gmail.com
Wed Jun 4 17:57:00 EDT 2008

On Wed, Jun 4, 2008 at 1:37 PM, Ingmar Stieger <ml at stiegerhs.de> wrote:
> I am trying to run Mongrel 1.1.5 with mongrel_service 0.3.4 on Ruby 1.8.6
> with a "normal" user account, i.e. a user which belongs only to the Windows
> group "Users". The rationale behind this is that running a web server with
> full administrative rights (e.g. Local System) is not something that I would
> like to do.
> Unfortunately, starting the service from the services control panel results
> in the following error message: "The service did not respond to the start or
> control request in a timely fashion" (the error comes up very quickly, maybe
> 1 second max).
> This happens only if the user the service is configured to run as does not
> belong to the "Administrators" group, otherwise it works fine.
> I have read a couple of threads about this subject, so this is what I have
> already tried:
> (With psexec -l cmd.exe:)
> 1. mongrel_rails start -e development -a -p 3000
>   ===> WORKS
> 2. mongrel_service console single -e development -a -p 3000
>   ===> WORKS
> (Interactively logged in as the service user:)
> 3. mongrel_rails start -e development -a -p 3000
>   ===> WORKS
> 4. mongrel_service console single -e development -a -p 3000
>   ===> WORKS
> 5. Running the service with service user in Administrator group
>   ===> WORKS
> 6. Running the service with service user only in Users (or Power Users)
> group
>   ===> DOES NOT WORK
> I had to change a couple of NTFS security settings in order to get it run
> with normal privileges. Now the only thing that still does not work is #6.
>  Unfortunately, no log files are being generated, especially ServiceFB.log
> is nowhere to be found. The server is Windows Server 2003 Standard, by the
> way.

32bits or x64 editions?

In any case, serviceFB.log and mongrel.log and mongrel_service.log
should be stored into ruby/bin folder since was not possible by the
service point to the directory of the service.

I suggest you also try the psexec tool from Sysinternals and also
runas program (builtin in Windows) to get more detail information.

PATH reports from these environment will be help, also the security
bits from the ACLs too, since if it runs as administrator maybe there
is some file down there in your app (maybe log folder) that is not
allowed to be written in it.

> Could anybody please enlighten me how I could further analyze this problem ?
> I followed the advise here in the list as far as I could, but now I am at a
> loss.

It's hard to replicate all the environments, so please try go back to
0.3.3 which generates the servicefb.log file and see what it outputs.

In any case, mongrel.log should always be generated.

> Thanks in advance,
> Ingmar

HTH and please post your results so we can help you out.

Luis Lavena
Human beings, who are almost unique in having the ability to learn from
the experience of others, are also remarkable for their apparent
disinclination to do so.
Douglas Adams

More information about the Mongrel-users mailing list