Thursday, February 18, 2010

Administrative user roles

Administrative user roles

The WAS Administration console application uses the J2EE role-based authorization concept. It has following roles

•Monitor: Least privileged. Allows a user to view the WebSphere

configuration and current application server state.A monitor can complete the following tasks:

◦View the WebSphere Application Server configuration.

◦View the current state of the Application Server.

•Configurator: An individual or group that uses the configurator role has the monitor privilege plus the ability to change the WebSphere Application Server configuration. The configurator can perform all the day-to-day configuration tasks. For example, a configurator can complete the following tasks:

◦Create a resource.
◦Map an application server
◦Install and uninstall an application.
◦Deploy an application.
◦Assign users and groups-to-role mapping for applications.
◦Set up Java 2 security permissions for applications.
◦Customize the Common Secure Interoperability Version 2 (CSIv2), Secure Authentication Service (SAS), and Secure Sockets Layer (SSL) configurations..

•Operator: Monitor privilege in addition to the ability to change runtime state, such as starting or stopping server, also check server status.

•Deployer: Only available for wsadmin users (not administration console). Allows a user to change configuration and runtime state on applications using wsadmin.

•Admin Security Manager: Allows a user to map users and groups to administrative roles through the administrative console, or through wsadmin for fine-grained security. Also, when fine grained administrative security is used, users granted this role can manage authorization groups

•iscadmins: Only available for administration console users. Allows a user to manage users and groups in the Federated repositories.

•Administrator: Operator, configurator, and iscadmins privilege, in addition to additional privileges granted solely to the administrator role, such as:

1.Modifying the primary administrative user and password

2.Create, update, and delete users and groups

3.Enabling or disabling administrative and Java 2 security

The primary administrative user specified when enabling administrative security is automatically mapped to the Administrator and AdminSecurityManager roles. Therefore, it is not necessary to manually add this identity to either of these administrative roles.

Most used commands in WAS

1) Tell me the command to find RAM size in AIX/Unix?


A) prtconf only for AIX.

2) Command to find disk free space?

A) Df –k or m

3) In ls -lrt, what t stands for and r stands for l stands for?

A)-l shows you huge amounts of information (permissions, owners, size, and when last modified.)

    -r reverses the order of how the files are displayed.

    -t shows you the files in modification time

4) How to check a particular port is listening or not in UNIX?

A) netstat -a
grep 80

5) How do you perform heap dump and thread dump?

A) Kill -3 <>

6). How to check disk usage in Linux or UNIX?

A) Du -k

7). How to check the multiple NIC in Unix or Linux?

A) ifconfig -a

8). How to identify and kill a process ID?

A) Ps –ef

9) How to find the process id (PID) using port no?for example 80 is the port no

A) lsof -i TCP:80

10) To find the no.of running JAVA process

A) ps -ef
grep java
wc -l

11) How to find out that a port is listening on remote Box ? Example 80 is the pot no

A) telnet Hostname 80

12) What to see only last 10 lines of a log file ?

A) tail -10 logfilename

How can we configure Remote Plugin?

This is the procedure


Machine A: WAS

Machine B: IHS

Thumb Rule: Install Plugins on IHS Machine and propagrate them to WAS.

Procedure

Machine A : Install WAS.

Machine B: Install IHS

Machine B : Install Plugins: In the installation process, you have to select remote WAS, and name for ur webserverconfig, say webserver1. After installation, in the IHS_INST/conf/httpd.conf check for IBM Module entry and Plugin installation paths

Goto the plugin installation path/bin

Check for configurewebserver1.sh/bat

Now,

Copy that file, configurewebserver1.sh/bat to WAS box, that is Machine A. The file contains this info.

./wsadmin.sh -f configureWebserverDefinition.jacl webserver1 IHS '/software/IBM/IHS' '

/software/IBM/IHS/conf/httpd.conf' 7700 MAP_ALL '/software/IBM/Plugins' unmanage

d webserver1 hostname solaris

(This is an example, 7700 is port number.)

If you already have enabled global security on WAS, you need to add -username adminusername and -password hispassword at the end of the above script.

Then run the script.

Which creates a WebServer definition in the AppServer.

U need to configure WAS to remote admin WebServer

While using df

df -h is the command to display available disk free space in bytes


e.g.,

$df -h

Filesystem size used avail capacity Mounted on

/dev/md/dsk/d84 3.9G 136M 3.8G 4% /var

swap 6.6G 992K 6.6G 1% /tmp

/dev/md/dsk/d101 20G 7.8G 12G 41% /software

Equivalent df in AIX

df -g

Truss
truss is a command to trace system calls and signals


SYNOPSIS

truss [-fcaeildDE] [- [tTvx] [!] syscall ,...]

[- [sS] [!] signal ,...] [- [mM] [!] fault ,...]

[- [rw] [!] fd ,...]

[- [uU] [!] lib ,... : [:] [!] func ,...]

[-o outfile] command
-p pid[/lwps]...

DESCRIPTION

The truss utility executes the specified command and produces a trace ofthe system calls it performs, the signals it receives, and the machine faults it incurs. Each line of the trace output reports either the fault or signal name or the system call name with its arguments and return value(s).

System call arguments are displayed symbolically when possible using defines from relevant system headers. For any path name pointer argument, the pointed-to string is displayed.

Error returns are reported using the error code names described in intro(3). If, in the case of an error, the kernel reports a missing privilege, a privilege name as described in privileges(5) is reported in square brackets ([

]) after the error code name.

Optionally (see the -u option), truss also produce an entry/exit trace of user-level function calls executed by the traced process, indented to indicate nesting.

Why to know about truss?

In the day today admin job, you may want to see what a process is doing? or you may want to check an installation process. Or ur installation process is failing, you want check whats going on. You use truss in such conditions.

Some examples:

truss -p pid

gives you that specific pids systemcalls

$ truss -p 883

/14: lwp_cond_wait(0x0193BFF8, 0x0193BFE0, 0xD287F710, 0) Err#62 ETIME

/14: lwp_cond_broadcast(0x016BA688) = 0

/14: lwp_cond_broadcast(0x01299A98) = 0

/205: lwp_cond_wait(0x016BA688, 0x016BA670, 0xD187F748, 0) = 0

/205: lwp_cond_broadcast(0x0193BFF8) = 0

/14: lwp_cond_wait(0x0193BFF8, 0x0193BFE0, 0x00000000, 0) = 0

/205: lwp_mutex_wakeup(0x0193BFE0) = 0

/14: lwp_mutex_timedlock(0x0193BFE0, 0x00000000) = 0

/205: lwp_mutex_wakeup(0x000F8AD8) = 0

/14: lwp_mutex_timedlock(0x000F8AD8, 0x00000000) = 0

/14: lwp_cond_broadcast(0x000D2E80) = 0

/205: stat64("/software/IBM/WebSphere/AppServer/profiles/AppSrv01/installedApps/hornblowerNode01Cell/FRPApp.ear/FRPApp-WebModule.war/WEB-INF/classes/us/ny/state/oag/model/OrganizationDetail.class", 0xD187F628) = 0


883 is a WebSphere pid.


$ truss -o example.out -p 883

truss traces pid 883 and outputs to example.out

$truss -o example.out install.sh

install.sh is an installer of a software. truss traces the installation process's system calls and outputs to example.out

Umask
umask stands for user file creation mode mask.


777 stands for rwxrwxrwx. first set of rwx is for user, second set of rwx for group and last set is for others. to know what umask u have, at the prompt type umask, which will return a value, say 022.

What does that mean o22?

Its simple.

777-022=755.

umask 022 = rwxr-xr-x, meaning, user has all permissions, group has read and execute, others have read and execute.

To understand umask in permissions mode try this command, umask -S

for example

$ umask

022

$ umask -S

u=rwx,g=rx,o=rx

Was Interview Questions

Q.difference between synchronize and full synchroniz????


Synchronization is a process of replicating the Config directory from Dmgr to other apps server Node's,

Normal sync will do replication of the updated files alone
For example ,If you have created a Datasource in the console and when you do sync,The resource.xml file alone from Dmgr CELL directory will be synced with the other Node's CELL directory

if the same scenario in Full-sync, The complete CELL directory will be overwrited from Dmgr to other Node's config directory

So the normal sync will sync the updated files alone ,

The full-sync will sync the compleat CELL directory from DMGR to Node's

Q..what is the diff b/w external http server and embeded http server?

both are doing same things but external httpserver will be outside of JVM.embeded http server will be inside of JVM.embededHttpserver is the part of the applicationserver.it serves like External httpserver.both are gives the service for static resources like html,servlets,jsp,............;



Q.what are all the components available in war and ear file ?

WAR file is Web archive,It has your Web components like JSP, servelet

EAR file is enterprise archive ,Which holds WAR file and JAR files,In WAR file you will have the Web component and in JAR (JAVA Archive) file you will have the EJB which is responsible of business logic of the application,

Dissable security

To disable global security either edit the security.xml file or use the wsadmin tool.




$WAS_HOME\config\cells\cellname\security.xml



Using WAS command-line client wsadmin (run with was user or root privileges):

1. Open a connection to local WAS in offline mode

wsadmin -conntype NONE



2. Turn off global security

wsadmin> securityoff



3. Save

wsadmin> $AdminConfig save

How to increase the heap size from wsadmin

How to increase the heap size from wsadmin

AdminTask.setJVMInitialHeapSize( ‘[ -nodeName ' + n + ' -serverName ' + s + ' -initialHeapSize ' + str( 384 ) + ' ]‘ )


AdminTask.setJVMMaxHeapSize( ‘[ -nodeName ' + n + ' -serverName ' + s + ' -maximumHeapSize ' + str( 944 ) + ' ]‘ )

# or you could set a bunch of JVM properties in one call

AdminTask.setJVMProperties( ‘[ -nodeName ' + n + ' -serverName ' + s + ' -initialHeapSize ' + str( 384 ) + ' -maximumHeapSize ' + str( 944 ) + ' -verboseModeGarbageCollection true ' + ' ]‘ )

Enable SSL between WebServer (plugin-in) and the WebSphere Application Server

Enable SSL between WebServer (plugin-in) and the WebSphere Application Server


To setup a new SSL-Connection between a IBM HTTP Server (IHS) and your WebSphere Application Server (6.1) a (self-signed) CA SSL certificate has to be propageted to all involved servers.

When setting up a IHS via the administrative console SSL between IHS and WebSphere AppServer should be enabled by default.

1. First take a look at your plugin-cfg.xml of your IHS installation and search for the entry Property Name="keyring"...




ServerCluster CloneSeparatorChange="false" GetDWLMTable="false" IgnoreAffinityRequests="true" LoadBalance="Round Robin" Name="server1_testNodeoglxanclatest32Bit_Cluster" PostBufferSize="64" PostSizeLimit="-1" RemoveSpecialHeaders="true" RetryInterval="60"

Server ConnectTimeout="0" ExtendedHandshake="false" MaxConnections="-1" Name="testNodeoglxanclatest32Bit_server1" ServerIOTimeout="0" WaitForContinue="false"

Transport Hostname="oglxanclatest" Port="9080" Protocol="http"/

Transport Hostname="oglxanclatest" Port="9443" Protocol="https"

Property Name="keyring" Value="/opt/HTTP/Plugins/config/test-webserver/plugin-key.kdb"/

Property Name="stashfile" Value="/opt/HTTP/Plugins/config/test-webserver/plugin-key.sth"/

/Transport

/Server

/ServerCluster

This tags defines the location of the Key-Database for the secure connection between your IHS and your AppServer.

2. In administrative console of WebSphere go to Servers > WebServers > "your webserver" > Plugin-in properties



On this page all necessary entries should be done automatically. To re-copy the default plugin-in.key to your IHS press "Copy to Webserver key store directory".


3. Restart your IHS

###############################################################



To manually setup SSL between IHS and WebSphere first locate the plugin-key.kdb on your AppServer. Than copy over the plugin-key.kdb to the IHS into the specified location (get location form picture above). Then edit the plugin-cfg.xml of the IHS (see tag from step 1). Then restart your IHS and your WebSphere instance

Introduction to LDAP: Part 2: LDAP and WebSphere

http://www.ibm.com/developerworks/tivoli/library/t-ldap02/#N10277


What is LDAP?

LDAP stands for Lightweight Directory Access Protocol. This is a protocol for querying and modifying directory services over TCP/IP. LDAP is an application protocol . LDAP is used for accessing and updating information in a directory. These operations include establishing sessions and disconnecting sessions. LDAP has hierarchical data format. This hierarchy usually has domain names.

websphere aplication server interview questions

1.WHAT IS TRACING?


Tracing is when you go through an entire program and record the value of variables and the output. You trace a program when you want to find out what actually went wrong

2.WHERE TO GIVE APPLICATION PRIORITY WHILE STARTING SERVER?

it will be under Enterprise applications ->app name -> startup behaviour ->Startup order in the admin console

3.HOW TO MOVE CODE DEV ENVIRONMENT TO TESTING ENVIRONMENT?

I'm sure what they mean by code here. I think, incase of applications, export them from in DEC and deploy in TEST.

4.WHAT IS SSL?WHEN IT ENCRYPT & DECRYPT THE DATA?

SSL are digital signed certificates. user for meesage/communication integrity and confidentiality. Generally encrypt at Sender side and decrypt at receiver side

5.WHAT IS INCIDENT MANAGEMENT?

It is part of ITIL process..... simple explanation is, when there is a problem in ur WAS environment, which procedure do you follow.

6.WHEN APPLICATION IS DOWN WHAT U WILL DO?

First look at the logs for errors. If you find the error, save the logs and start ur application. Then start trouble shoot.

If no error found, run a trace and look for FFDC etc..

7.I HAVE 16GB RAM,WHAT IS THE MINIMUM & MAXIMUM HEAPSIZE ?

No relation. Heap settings should be made depends on application

8.HOW TO OPEN ADMIN CONSOLE IN AIX/UNIX & WHAT IS THE DEFAULT FILE SYSTEM OF AIX?

admin console can be viewed from remote machine which has a browser, if not behind firewall.

9.WHAT IS FILE DESCRIPTORS IN AIX?

A file descriptor is a handle created by a process when a file is opened. There is a limit to the amount of file descriptors per process.If the file descriptor limit is exceeded for a process, you may see the following errors:"Too Many Open Files"

10.HOW TO RESOLVE PORT CONFLICTS IN PRODUCTION ENVIRONMENT?


check why there is port conflict

run updateports script in WAS

what is cluster


how do you create a cluster

go to servers -> clusters-> new ->give cluster_name->define first member->define other members->finish


how do you add a new cluster member

go to servers -> clusters->cluster_name ->cluster members ->new ->give name/node/others->apply->ok->save

one of the cluster member (jvm) is having issues. To troubleshoot the issue, you decided to take it out of the cluster. How do you do that?

Make its runtime weight to 0


In a complex environment, there are 10 machines. Machine A is having 8GB RAM and machine B having 2GB of RAM. The administrator decided to send twice as many request as machineB to machineA. How can he achive it?

give machineA twice the weight as machineB

After making some changes on a cluster, it is required to recycle/restart all the cluster JVMs. The lead admin told you to make sure that there should not be any downtime during this recycle. Which option do you use to achieve it?

Ripplestart

A large application which has 5web modules has been deployed on to a cluster. After some months, the developer asked you to update on of the 5web modules. How do you do it?

Rollout

what is a backup cluster

can you change the cluster name, once it was created

No
 
Q. What is jndi?


Ans: we can register resources in the application server's java naming and directory interface (jndi) namespace. Client applications can then obtain the references to these resource objects in their programs.

Q. Application installed but not working. What are troubleshooting steps?


Ans: see jvm & application are up, check plugin-cfg.xml file for the root context used by the web application if it does not exist generate plugin and restart web server.

Q. Applications installed fine, also generated plugin, but application still not working, in this case which log to see?


Ans: plugin.log


Q. What is CellDiscoveryAddress

Ans: Node uses this port to talk to DMGR

Q. What is NodeDiscoveryAddress
Ans: DMGR uses this port to talk to node

Q. How websphere discovers a change in JSP and compiles it?

Ans: There is an algorithm that websphere uses to find the timestamp of .jsp and .class files. It checks that timestamp of .class file is always later than its corresponding .jsp file.