Symantec Access Management

Hi,

My Webagent has all of a sudden stopped working. Below is the error I am seeing:

[20/Apr/2016:04:09:23] [Info] [CA WebAgent LLAWP] [16125] [LLAWP has been started.]

[20/Apr/2016:04:09:24] [Error] SiteMinder Agent

        Unable to load SiteMinder agent configuration object.

        Check that you are using the right agent configuration object and that it exists in your policy server.

[20/Apr/2016:04:09:24] [Error] SiteMinder Agent

        Failed to initialize the configuration manager.

        LLAWP unable to get configuration, exiting.

Below is the version details:

CA Webagent R12.5 CR02 running on Apache 2.2.1.5 64 bit and Rehat 6.7 64 bit.

Any idea?

Thanks

Hi,

Please verify the following:

1. Confirm that the ACO defined in the WebAgent.conf exists in the Policy Server defined in the SmHost.conf file.

2. Verify that the Webagent is referencing the correct, dedicated Policy Server (try with PS IP address instead)

3. Check on the Apache user permissions to the SmHost.conf and WebAgent.conf

4. Any error on the Policy Server end?

Thanks for your response. I have verfied the settings that you pointed out. Please see below:

1. ACO exists in the Policy Server

2. Webagent is able to communicate to the correct Policy Server, tried with IP

3. We have installed with root user, still Apache User has read/execute permission for WebAgent.conf and SmHost.conf files.

4. Could not find any error on the Policy Server.

In addition to these, we tried re-registering the trusted host again with the Policy Server. But still its throwing the same error.

Also tried to start the LLAWP process explicitly using the command, but it didn't start. Verified that LD_LIBRARY_PATH & Path is pointing to WebAgent_Home/bin location

Not sure, if anything is missing.

Thanks,

Priyotosh

psen try creating a new ACO in policy server and update the same in WebAgent.conf, try creating ACO with lower case and without special characters.

Thank you

Yes Richard. Tried recreating the ACO, still it didn't work.

Thanks,

Priyotosh

Hi,

Please confirm if  you have AgentWaitTime set explicitly.

If not, please try adding the following to the WebAgent.conf:

AgentWaitTime=100

Hi,

AgentWaitTime is not set.

Will try setting it and let you know the result.

Thanks

Tried setting AgentWaitTime to 100, still it didn't work.

Thanks

Are you using CLUSTER HCO?  If yes, try changing to without CLUSTER (you can create another for testing) and see if that helps.

Agent PRIOR to R12.52 SP1 CR04 had issues with CLUSTER HCO on *NIX platform.

Hi,

We are using non-clustered HCO.

Thanks

Priyo,

Can you try a few things for me please. Verify in your file the following two lines are present sourcing the env variables.

On Apache Server

vi /etc/sysconfig/httpd

PATH=/opt/CA/webagent/bin:{$PATH}

. /opt/CA/webagent/ca_wa_env.sh

After this please stop the web agent as the root user.

service httpd stop

Go to the /tmp directory and verify anything tied to root is removed

Then I want you to validate you have no stuck semaphores or keys with the following.

Execute the command as root

ipcs -a

This will show you all the semaphores and keys

If you have any stuck as root use the ipcrm command to remove them

example

SEMID: 4095

ipcrm -s 4095

For the sem key use the -M flag

ipcrm -M 0324203

Remove these keys and semaphore ids. and then attempt to start the web agent again with

service httpd start

Please let me know. After you remove the semaphore id's and keys verify nothing is listed with

ipcs -a

Thanks,

Adam

Hi Adam,

Tried your suggestions, still it didn't work.

Thanks,

Priyotosh

Is Apache coming up without any issue, if you disable the webagent ?

If you have not tested this yet, disable the webagent from WebAgent.conf file and start the Apache to isolate the issue.

Regards

Ashok

Hi Ashok,

Thanks for your response :-)

Apache is coming up without any issue even after enabling the webagent.

Thanks,

Priyotosh Sen

I am glad you were able to bring up your Apache with webagent.

if you could share the issue and it's fix which might guide someone with the right direction in future, if they have similar issue.

Regards

Ashok

Hi Ashok,

The apache is coming up but not the LLAWP process. I am yet to find a fix for this issue.

Please help.

Thanks,

Priyotosh

Priyotosh,

The ACO is loaded based on the Policy Server connection information in your Host Configuration Object, not the boot strap configuration from SmHost.conf.  Verify the Policy Server information in the HCO listed in SmHost.conf.  If that information is correct (being thorough here, you likely already checked this), look at the trace logs for the policy server to see what communications it had with the agent.  And server-side error in fetching the ACO should appear there.  if you see nothing, the agent could not connect to the PS, and thus failed to load configuration (one possible issue).  Otherwise, there is hopefully some issue in loading the ACO from the policy store, or some other unexpected issued encountered by the policy server that will lead you further towards the solution.

Is any other agent able to use the same HCO and ACO configuration (we want to isolate the issue to something with the failing agent or something more general in the HCO/ACO configuration)?

I Hope something here helps you move past your issue, or at least make some progress in narrowing to the issue.

Yes, Indeed this was the issue.

HCO contained hostname of the Policy Server whereas SmHost.conf had IP address of the Policy Server, and hostname to IP mapping was not done and hence there was problem in the Policy Server connection. Originally HCO was configured with the IP address and it was changed to hostname and hence this issue popped up.

My understanding was initial connection is being done using the Policy Server detail lookup in SmHost.conf.

Thanks David, Ashok,Adam and others for your valuable suggestion.

Thanks,

Priyotosh

I am glad we were able to resolve your issue.  Thanks for sharing this on CA Communities.  Hopefully others will benefit who may face similar issues.

Best wishes,

Dave Mary